permdock 0.4.0 → 0.6.0

package/dist/{types-7rJVLWe5.d.ts → types-Dfv0aTER.d.ts}

@@ -1,5 +1,12 @@
-import { n as RoleThrough } from "./types-CqrjB9o6.js";
-import { o as SqlMembershipSource } from "./sources-Dljy06zL.js";
+import { n as RoleThrough } from "./types-BzzaHxt3.js";
+import { o as SqlMembershipSource } from "./sources-Xc4zkszI.js";
+//#region src/cli/core/errors.d.ts
+/**
+ * 0 success, 1 failure, 2 usage, 3 action required, 130 interrupted (SIGINT
+ * or a cancelled prompt), 143 terminated (SIGTERM).
+ */
+type ExitCode = 0 | 1 | 2 | 3 | 130 | 143;
+//#endregion
 //#region src/cli/types.d.ts
 type CollectConfig = {
   readonly srcPath?: readonly string[];
@@ -88,7 +95,7 @@ type RlsConfig = {
   readonly dialect?: RlsDialect;
   readonly memberships?: RlsMemberships;
   /**
-   * `database` mode: the `fromTable` / `fromJunction` sources the helpers
+   * `database` mode: the `tableMembershipSource` / `junctionMembershipSource` sources the helpers
    * read for every scope `memberships` maps no table for. Default
    * `supabase.hook.memberships`, so the helpers and the token hook run the
    * same SQL. Setting it selects `database` mode.
@@ -117,6 +124,13 @@ type RlsConfig = {
   /** Postgres type of each named scope's id column; overrides `tenantType` / `teamType`. */
   readonly scopeTypes?: Readonly<Record<string, string>>;
   readonly roleClaim?: string;
+  /**
+   * Role values the existing SQL compares against (a string literal or an
+   * enum label) and the PermDock role each one is. `rls import` writes the
+   * PermDock name for a mapped value; `rls migrate` filters a `role` helper by
+   * it. An unmapped value must already be a declared role.
+   */
+  readonly roleValues?: Readonly<Record<string, string>>;
   readonly gucPrefix?: string;
   readonly out?: string;
   /** `--target drizzle`: where each policy's `.link()` finds its table. */
@@ -218,7 +232,8 @@ type RlsConfig = {
    * Add the approval store `supabaseApprovalStore` reads and writes: the
    * `approval_requests` table and one function per `ApprovalStore` method, in
    * the helper schema, executable by no client role. Off by default. An
-   * object adopts a table the app already has instead.
+   * object with `table` adopts a table the app already has instead, and
+   * `delegations: true` adds the out-of-office covers.
    */
   readonly approvals?: boolean | RlsApprovalsAdopt;
   /**
@@ -301,8 +316,15 @@ type RlsConfig = {
  * fields into the app's own columns on each write, converted to their types.
  */
 type RlsApprovalsAdopt = {
-  /** `table` or `schema.table`. */
-  readonly table: string;
+  /** `table` or `schema.table`. Without it the store is the generated `approval_requests`. */
+  readonly table?: string;
+  /**
+   * Add `approval_delegations`, the out-of-office covers a user writes for
+   * themselves, and the four-argument `permdock_is_approver` that answers for
+   * a delegate inside an active cover. `tableApprovalDelegationSource` reads
+   * the same rows for `approvalsHandler`. Off by default.
+   */
+  readonly delegations?: boolean;
   /** A text column unique per request. Default `token`. */
   readonly token?: string;
   /** A jsonb column holding the `ApprovalRequest`. Default `body`. */
@@ -359,6 +381,8 @@ type RlsCustomRoleTable = {
   readonly id?: string;
   /** A boolean column marking rows that are not custom roles (declared or system roles); those rows are skipped. */
   readonly skip?: string;
+  /** A boolean column marking a row with no tenant as a shared custom role, held at `scope` (default the first scope) in every tenant. Without it a row with no tenant is a platform role. */
+  readonly shared?: string;
 };
 /** `rls.customRoles` as an object: custom roles on, plus where existing ones live. */
 type RlsCustomRolesConfig = {
@@ -432,6 +456,9 @@ type RlsActions = Readonly<Record<string, "select" | "insert" | "update" | "dele
 type RlsMigrateHelper = {
   readonly form: "ids" | "row" | "membership";
   readonly scope: string;
+} | {
+  readonly form: "role";
+  readonly scope: string;
 } | {
   readonly form: "scoped";
 } | {
@@ -500,7 +527,7 @@ type RlsStorage = {
 };
 /** `permdock supabase hook generate` input. */
 type SupabaseHookConfig = {
-  /** The same `fromTable` / `fromJunction` sources the app passes as `memberships`. */
+  /** The same `tableMembershipSource` / `junctionMembershipSource` sources the app passes as `memberships`. */
   readonly memberships: readonly SqlMembershipSource[];
   /** Schema of the hook and the version table. Default `rls.schema`, else `permdock`. */
   readonly schema?: string;
@@ -565,8 +592,21 @@ type SupabaseHookConfig = {
   readonly suspension?: RlsSuspension;
   readonly out?: string;
 };
+/**
+ * How the project turns SQL into Supabase migrations: `'pg-delta'`
+ * (Declarative Schemas 2.0, `supabase db schema declarative sync`),
+ * `'migra'` (declarative schemas on `supabase db diff`) or `'migrations'`
+ * (hand-written migrations, no declarative schemas).
+ */
+type SupabaseSchemas = "pg-delta" | "migra" | "migrations";
 type SupabaseConfig = {
   readonly hook?: SupabaseHookConfig;
+  /**
+   * The schema workflow `rls generate --split`, `supabase hook generate` and
+   * doctor follow. Default: `'migra'` when `supabase/config.toml` sets
+   * `[experimental.pgdelta] enabled = false`, else `'pg-delta'`.
+   */
+  readonly schemas?: SupabaseSchemas;
 };
 type DoctorConfig = {
   /**
@@ -578,7 +618,7 @@ type DoctorConfig = {
   readonly srcPath?: readonly string[];
   readonly sensitiveActions?: readonly string[];
   readonly memberships?: string;
-  /** A JSON fixture `{ credentials?, settings? }` of API-key credentials and per-tenant settings (the `memorySettings` input) for PD029. */
+  /** A JSON fixture `{ credentials?, settings? }` of API-key credentials and per-tenant settings (the `memorySettingsSource` input) for PD029. */
   readonly credentials?: string;
   /** Globs or directories whose files are client entries for PD001, for frameworks with no `'use client'` convention. */
   readonly clientEntries?: readonly string[];
@@ -590,6 +630,8 @@ type DoctorConfig = {
 type PermDockConfig = {
   readonly permissions?: string;
   readonly policy?: string;
+  /** A module exporting the `defineOperations` map as `operations` or default; `collect` writes it to the catalog's `operations`. */
+  readonly operations?: string;
   readonly collect?: CollectConfig;
   readonly catalog?: CatalogConfig;
   readonly openapi?: {
@@ -608,7 +650,7 @@ type PowerSyncConfig = {
   readonly resources?: readonly string[];
   /** The action whose grants decide which rows sync; default `read`. */
   readonly action?: string;
-  /** Where `generate` writes `localSnapshotManifest(policy)` as JSON for `localSnapshot` and `powersyncSource`; none by default. */
+  /** Where `generate` writes `localSnapshotManifest(policy)` as JSON for `localSnapshot` and `powerSyncSource`; none by default. */
   readonly manifest?: string;
 };
 type CliIo = {
@@ -617,13 +659,23 @@ type CliIo = {
   readonly now?: () => Date;
   readonly fetch?: typeof fetch;
   readonly env?: Readonly<Record<string, string | undefined>>;
-  /** Styled human output; `--no-color` turns it off. Unset is plain. */
+  /** Styled stdout; `--no-color` turns it off. Unset is plain. */
   readonly color?: boolean;
+  /** Styled stderr, decided for that stream on its own. Unset is plain. */
+  readonly errColor?: boolean;
   /** A person at a terminal: commands may prompt. Unset never prompts. */
   readonly interactive?: boolean;
+  /** stdout is a terminal; agent detection reads it. Unset is a pipe. */
+  readonly stdoutIsTty?: boolean;
+  /** stderr is a terminal: progress draws a spinner. Unset prints lines. */
+  readonly stderrIsTty?: boolean;
+  /** Reads all of stdin, for `--*-stdin` secrets. Unset reads nothing. */
+  readonly readStdin?: () => Promise<string>;
+  /** Aborted on SIGINT or SIGTERM. */
+  readonly signal?: AbortSignal;
 };
 type RunResult = {
-  readonly code: 0 | 1 | 2;
+  readonly code: ExitCode;
   readonly stdout: string;
   readonly stderr: string;
 };

package/dist/types-DqzsnlSA.js

@@ -0,0 +1,67 @@
+import { a as durationOf } from "./time-DkWjdL98.js";
+//#region src/approvals/errors.ts
+var ApprovalError = class extends Error {
+	name = "ApprovalError";
+	code;
+	constructor(code, message) {
+		super(message);
+		this.code = code;
+	}
+};
+const CODES = /* @__PURE__ */ new Set([
+	"approval-not-found",
+	"approval-not-pending",
+	"approval-expired",
+	"approver-unauthenticated",
+	"approver-is-actor",
+	"approver-is-principal",
+	"approver-not-eligible",
+	"approver-repeated"
+]);
+function isApprovalErrorCode(value) {
+	return typeof value === "string" && CODES.has(value);
+}
+/** Matches by `name` and `code`, so an error from another copy of the module still maps. */
+function isApprovalError(value) {
+	if (!(value instanceof Error) || value.name !== "ApprovalError") return false;
+	const code = Reflect.get(value, "code");
+	return typeof code === "string" && CODES.has(code);
+}
+//#endregion
+//#region src/approvals/types.ts
+const APPROVAL_HEADER = "PermDock-Approval";
+/** Seconds a request stays open when neither the store nor the call sets a `ttl`. */
+const DEFAULT_APPROVAL_TTL = 3600;
+/** The approvals a request needs in total: `approvers.quorum` (or 1), or the sum of its stages' quorums. */
+function approvalQuorum(request) {
+	const stages = request.approvers?.stages;
+	if (stages !== void 0) return stages.reduce((sum, stage) => sum + (stage.quorum ?? 1), 0);
+	return request.approvers?.quorum ?? 1;
+}
+/**
+* The instant from which `approvers.escalation.to` may approve, in epoch
+* milliseconds, or `undefined` when the request has no escalation or its
+* `after` does not parse (then nobody escalates: fail-closed).
+*/
+function escalationOpenAt(request) {
+	const seconds = durationOf(request.approvers?.escalation?.after);
+	if (seconds === void 0) return;
+	return Date.parse(request.createdAt) + seconds * 1e3;
+}
+/** The instant from which a stage's own `escalation.to` may approve it, in epoch milliseconds; `undefined` when it has none or `after` does not parse. */
+function stageEscalationOpenAt(request, stage) {
+	const seconds = durationOf(stage.escalation?.after);
+	if (seconds === void 0) return;
+	return Date.parse(request.createdAt) + seconds * 1e3;
+}
+/** The key a verdict's `relations` lists a relation approver under. */
+function approverRelationKey(item) {
+	return JSON.stringify([
+		item.resource,
+		item.relation,
+		item.through ?? null,
+		item.depth ?? null
+	]);
+}
+//#endregion
+export { escalationOpenAt as a, isApprovalError as c, approverRelationKey as i, isApprovalErrorCode as l, DEFAULT_APPROVAL_TTL as n, stageEscalationOpenAt as o, approvalQuorum as r, ApprovalError as s, APPROVAL_HEADER as t };

package/dist/{types-DpWfQdSh.d.ts → types-Druu9wLM.d.ts}

@@ -1,4 +1,5 @@
-import { S as ResourceRelation } from "./permission-types-Dg39z9Kv.js";
+import { I as ResourceRelation } from "./vocabulary-CN8H_9UF.js";
+import { s as OperationMeta } from "./operations-X0VM7F3m.js";
 //#region src/catalog/types.d.ts
 type CatalogUsage = {
   readonly file: string;
@@ -35,7 +36,8 @@ type CatalogBreakGlass = {
   readonly overrides: readonly string[];
   readonly purpose?: readonly string[];
   readonly reason: boolean;
-  readonly maxDuration?: string;
+  /** Seconds. */
+  readonly maxDuration?: number;
   readonly obligations: readonly string[];
 };
 type CatalogApproval = "human" | {
@@ -48,9 +50,11 @@ type CatalogApproval = "human" | {
   readonly distinct?: boolean;
   readonly staleOn?: "resource-change";
   readonly quorum?: number;
-  readonly ttl?: string;
+  /** Seconds. */
+  readonly ttl?: number;
+  /** `after` is seconds from the request's creation. */
   readonly escalation?: {
-    readonly after: string;
+    readonly after: number;
     readonly to: unknown;
   };
 };
@@ -58,6 +62,18 @@ type CatalogResource = {
   readonly id: string;
   readonly schema: unknown;
   readonly definedIn?: string;
+  /** `resource(…, { parent })`: the row field that holds the parent row's id. */
+  readonly parent?: {
+    readonly field: string;
+    readonly resource: string;
+  };
+  /** `resource(…, { links })`: to-one links `through` walks; absent when none. */
+  readonly links?: Readonly<Record<string, {
+    readonly field: string;
+    readonly resource: string;
+  }>>;
+  /** `'hide'` answers a denied check on a loaded row as if the row did not exist; absent for `'reveal'`. */
+  readonly disclosure?: "hide";
   readonly relations?: Readonly<Record<string, ResourceRelation>>;
   /** The row field an `approval: { staleOn: 'resource-change' }` binds to. */
   readonly version?: string;
@@ -88,7 +104,8 @@ type CatalogRole = {
 };
 /** A role activation as the catalog carries it. */
 type CatalogActivation = {
-  readonly maxDuration?: string;
+  /** Seconds. */
+  readonly maxDuration?: number;
   readonly justification: "required" | "optional";
   readonly approval?: boolean;
   readonly assurance?: {
@@ -101,7 +118,8 @@ type CatalogActivation = {
 type CatalogSupportAccess = {
   readonly actorRequired: boolean;
   readonly group: string;
-  readonly durations: readonly string[];
+  /** Seconds. */
+  readonly durations: readonly number[];
 };
 /** One declared scope, in declaration order. */
 type CatalogScope = {
@@ -109,10 +127,10 @@ type CatalogScope = {
   readonly key: string;
   readonly within?: string;
 };
-/** A grant's `validFrom` / `validUntil` window in Unix seconds. */
+/** A grant's `validFrom` / `validUntil` window in RFC 3339. */
 type CatalogValidity = {
-  readonly from?: number;
-  readonly until?: number;
+  readonly from?: string;
+  readonly until?: string;
 };
 /**
  * One code grant as the catalog carries it: the normalised shape
@@ -143,7 +161,8 @@ type CatalogGrant = {
   readonly requires?: string | readonly string[];
   readonly limit?: {
     readonly count: number;
-    readonly per: string;
+    /** Seconds. */
+    readonly per: number;
     readonly mode?: "hard" | "soft";
   };
   /** Present when the grant is a closure, reads the relation graph or is opaque; `where` and `check` are then omitted. */
@@ -171,6 +190,22 @@ type CatalogDocument = {
   readonly grants?: readonly CatalogGrant[];
   /** The policy's standing delegations, canonically ordered; present when the policy declares any. */
   readonly delegations?: readonly CatalogDelegation[];
+  /** The `defineOperations` map in definition order; present when the config names an `operations` module. */
+  readonly operations?: readonly CatalogOperation[];
+  /** The policy's coarse OAuth scopes, sorted by scope; present when the policy declares any. */
+  readonly oauthScopes?: readonly CatalogOAuthScope[];
+};
+/** One `definePolicy({ oauthScopes })` entry: the coarse scope an authorization server issues and the permission keys it covers, sorted by code point. */
+type CatalogOAuthScope = {
+  readonly scope: string;
+  readonly permissions: readonly string[];
+};
+/** One `defineOperations` entry: its name, the permission keys it is bound to, and its meta. */
+type CatalogOperation = {
+  readonly name: string;
+  readonly permission: string;
+  readonly results?: string;
+  readonly meta: OperationMeta;
 };
 /** One `definePolicy({ delegations })` entry: who hands over, to which actor, which permission keys, and when. */
 type CatalogDelegation = {
@@ -184,4 +219,4 @@ type CatalogDelegation = {
   readonly validity?: CatalogValidity;
 };
 //#endregion
-export { CatalogDocument as a, CatalogResource as c, CatalogSupportAccess as d, CatalogUsage as f, CatalogDelegation as i, CatalogRole as l, CatalogApproval as n, CatalogGrant as o, CatalogValidity as p, CatalogBreakGlass as r, CatalogPermission as s, CatalogActivation as t, CatalogScope as u };
+export { CatalogDocument as a, CatalogOperation as c, CatalogRole as d, CatalogScope as f, CatalogValidity as h, CatalogDelegation as i, CatalogPermission as l, CatalogUsage as m, CatalogApproval as n, CatalogGrant as o, CatalogSupportAccess as p, CatalogBreakGlass as r, CatalogOAuthScope as s, CatalogActivation as t, CatalogResource as u };

package/dist/{types-CIlTojhq.d.ts → types-_WhUP7ud.d.ts}

@@ -1,5 +1,6 @@
-import { At as DeriveOptions, Dr as Membership, E as Policy, It as WhereResult, Mn as ArazzoSimulateInput, Mt as PermDockOptions, Or as Principal, Pt as SimulateOptions, ir as Decision, j as PolicyVocabulary, jn as ArazzoPlan, jt as PermDock, kr as Subject, kt as DecideOptions, lr as ExplainedDecision } from "./policy-types-sp9P1iIV.js";
-import { d as Permission, p as PermissionTree } from "./permission-types-Dg39z9Kv.js";
+import { Nn as Decision, Rn as ExplainedDecision, T as Policy, ar as Subject, j as PolicyVocabulary, nr as Membership, rr as Principal } from "./policy-types-n0uRTsW8.js";
+import { E as PermissionTree, w as Permission } from "./vocabulary-CN8H_9UF.js";
+import { c as WhereResult, i as PermDockOptions, n as DeriveOptions, o as SimulateOptions, r as PermDock, t as DecideOptions } from "./permdock-SV8ZINYT.js";
 //#region src/pdp/types.d.ts
 type RemotePdpAuth = {
   readonly bearer: string | (() => string | Promise<string>);
@@ -25,7 +26,8 @@ type RemotePdpEndpoints = {
   readonly searchResource?: string;
 };
 type RemotePdpCache = {
-  readonly ttl: number | `${number}s` | `${number}ms`;
+  /** Seconds, at most 30. */
+  readonly ttl: number;
 };
 type RemotePdpOptions = {
   readonly url: string;
@@ -84,9 +86,9 @@ type SpiceDbOptions = {
   readonly cache?: RemotePdpCache;
   readonly fetch?: typeof fetch;
 };
-type PdpPermDock<V extends PolicyVocabulary = PolicyVocabulary> = Omit<PermDock<V>, "can" | "decide" | "assert" | "explain" | "filter" | "where" | "simulate" | "tenant" | "team" | "derive"> & {
+type PdpPermDock<V extends PolicyVocabulary = PolicyVocabulary> = Omit<PermDock<V>, "can" | "decide" | "decideEach" | "assert" | "explain" | "filter" | "where" | "simulate" | "tenant" | "team" | "derive"> & {
   /** `permdock.derive` with the same providers: the result asks the PDP too. */
-  readonly derive: (options: DeriveOptions) => PdpPermDock<V> | Promise<PdpPermDock<V>>;
+  readonly derive: (options: DeriveOptions) => Promise<PdpPermDock<V>>;
   /**
    * For a delegated permission whose provider lists ids, an `in` over them
    * (AND the local condition when local grants exist); otherwise the local
@@ -95,6 +97,8 @@ type PdpPermDock<V extends PolicyVocabulary = PolicyVocabulary> = Omit<PermDock<
   readonly where: (permission: Permission) => Promise<WhereResult>;
   readonly can: (permission: Permission, data?: unknown, options?: DecideOptions) => Promise<boolean>;
   readonly decide: (permission: Permission, data?: unknown, options?: DecideOptions) => Promise<Decision>;
+  /** `decide` for each row, in row order, asking the PDP per row. */
+  readonly decideEach: (permission: Permission, rows: readonly unknown[], options?: DecideOptions) => Promise<readonly Decision[]>;
   readonly assert: (permission: Permission, data?: unknown, options?: DecideOptions) => Promise<Extract<Decision, {
     readonly outcome: "granted";
   }>>;
@@ -103,7 +107,6 @@ type PdpPermDock<V extends PolicyVocabulary = PolicyVocabulary> = Omit<PermDock<
   readonly filter: <T>(permission: Permission<string, T, "instance">, rows: readonly T[], options?: DecideOptions) => Promise<T[]>;
   readonly simulate: {
     (checks: readonly (readonly [Permission, unknown?])[], options?: SimulateOptions): Promise<readonly Decision[]>;
-    (plan: ArazzoSimulateInput): ArazzoPlan;
     (preview: {
       readonly roles?: readonly (string | {
         readonly key: string;

package/dist/{types-CUcFZfpU.d.ts → types-lUlG3TVd.d.ts}

@@ -1,4 +1,5 @@
-import { j as PolicyVocabulary, jt as PermDock, xn as DecisionEvent } from "./policy-types-sp9P1iIV.js";
+import { Xt as DecisionEvent, j as PolicyVocabulary } from "./policy-types-n0uRTsW8.js";
+import { r as PermDock } from "./permdock-SV8ZINYT.js";
 //#region src/otel/types.d.ts
 declare const GENAI_SEMCONV_PIN = "1.37.0";
 declare const GEN_AI_TOOL_NAME = "gen_ai.tool.name";

package/dist/unplugin/index.d.ts

@@ -1,4 +1,4 @@
-import { a as PermDockPluginOptions } from "../types-7rJVLWe5.js";
+import { a as PermDockPluginOptions } from "../types-Dfv0aTER.js";
 import { createUnplugin } from "unplugin";
 //#region src/unplugin/index.d.ts
 type CreateUnplugin = typeof createUnplugin<PermDockPluginOptions | undefined>;

package/dist/unplugin/index.js

@@ -1,5 +1,5 @@
-import { n as createCollectScheduler, r as report } from "../watch-zeucB7eF.js";
-import { t as peerHint } from "../peer-BOr_kJE1.js";
+import { n as createCollectScheduler, r as report } from "../watch-vea54PRw.js";
+import { r as peerHint } from "../peer-C8swJ2GH.js";
 import { createRequire } from "node:module";
 //#region src/unplugin/index.ts
 function loadCreateUnplugin() {

package/dist/usage-CRVl9V3t.js

@@ -0,0 +1,32 @@
+import { t as defineLeaf } from "./command-L8EstFNm.js";
+import { a as failOnFlag } from "./flags-C3DktBDY.js";
+//#region src/cli/commands/usage.ts
+const usage = defineLeaf({
+	flags: {
+		...failOnFlag,
+		ignore: {
+			type: "string",
+			repeatable: true,
+			description: "Permission keys or globs to skip",
+			valueHint: "glob"
+		},
+		"dynamic-as-used": {
+			type: "boolean",
+			description: "Count computed permission references as uses"
+		}
+	},
+	async run(ctx, { flags }) {
+		return (await import("./usage-CZpSQP6L.js")).runUsage({
+			cwd: ctx.cwd,
+			config: ctx.config,
+			ignore: flags.ignore,
+			strict: flags["fail-on"] === "warning",
+			json: ctx.json,
+			dynamicAsUsed: flags["dynamic-as-used"],
+			now: ctx.now,
+			io: ctx.io
+		});
+	}
+});
+//#endregion
+export { usage };

package/dist/usage-CZpSQP6L.js

@@ -0,0 +1 @@
+export { t as runUsage } from "./usage-SveTRTyr.js";

package/dist/{usage-CG9nOYZw.js → usage-SveTRTyr.js}

@@ -1,10 +1,13 @@
-import { a as getResource } from "./permission-registry-BsblpB-z.js";
-import { o as usageResult } from "./errors-CWfoNg9N.js";
+import { a as getResource } from "./permission-registry-Br4jSNVi.js";
+import { u as usageResult } from "./errors-CWTY6uih.js";
 import { a as rel, r as listSourceFiles } from "./files-D_JIzUrP.js";
-import { a as USAGE_REPORT_SCHEMA } from "./version-BEogC-rB.js";
-import { o as jsonSchemaOf } from "./catalog-doc-DWtg0gGR.js";
-import { a as loadModule, n as asPolicy, s as pickNamed } from "./load-C3_oTHyO.js";
-import { r as runCollect } from "./collect-2SrB7lfk.js";
+import { o as USAGE_REPORT_SCHEMA } from "./version-CEbQ5UeM.js";
+import { s as jsonSchemaOf } from "./catalog-doc-Cdn7-0pQ.js";
+import { a as loadModule, n as asPolicy, s as pickNamed } from "./load-DFS_ry0W.js";
+import { r as runCollect } from "./collect-mLTY4nwb.js";
+import { t as beforeFirst } from "./text-BMFRfBqc.js";
+import { t as DOCS_BASE } from "./manifest-dvL2XEe1.js";
+import { r as findingOf } from "./output-1im__-08.js";
 import { existsSync, readFileSync, realpathSync } from "node:fs";
 import { dirname, resolve } from "node:path";
 import { fileURLToPath, pathToFileURL } from "node:url";
@@ -15,20 +18,26 @@ import { isBuiltin } from "node:module";
 /** Entries a client file must not import; `tests/cli/doctor-entries.test.ts` keeps it in step with `exports`. */
 const SERVER_SPECIFIERS = [
 	"permdock/a2a",
+	"permdock/agent",
 	"permdock/ai-sdk",
 	"permdock/approvals",
+	"permdock/astro",
 	"permdock/authzen",
 	"permdock/better-auth",
 	"permdock/better-supabase",
+	"permdock/chat",
+	"permdock/chat-sdk",
 	"permdock/claude-agent",
 	"permdock/clerk",
 	"permdock/cloud",
 	"permdock/convex",
+	"permdock/delivery",
 	"permdock/drizzle",
 	"permdock/elysia",
 	"permdock/eve",
 	"permdock/express",
 	"permdock/fastify",
+	"permdock/h3",
 	"permdock/hono",
 	"permdock/jwt",
 	"permdock/kysely",
@@ -42,24 +51,35 @@ const SERVER_SPECIFIERS = [
 	"permdock/otel",
 	"permdock/pdp",
 	"permdock/prisma",
+	"permdock/resend",
 	"permdock/scim",
 	"permdock/server",
+	"permdock/solid-start",
 	"permdock/ssf",
 	"permdock/supabase",
 	"permdock/supabase/middleware",
+	"permdock/sveltekit",
+	"permdock/tanstack-start",
 	"permdock/terminal",
-	"permdock/trpc"
+	"permdock/trpc",
+	"permdock/workflow",
+	"permdock/workflow-sdk"
 ];
 /** Entries that feed request, tool or model data into a check. */
 const ADAPTER_SPECIFIERS = [
 	"permdock/a2a",
+	"permdock/agent",
 	"permdock/ai-sdk",
+	"permdock/astro",
 	"permdock/authzen",
+	"permdock/chat",
+	"permdock/chat-sdk",
 	"permdock/claude-agent",
 	"permdock/elysia",
 	"permdock/eve",
 	"permdock/express",
 	"permdock/fastify",
+	"permdock/h3",
 	"permdock/hono",
 	"permdock/mcp",
 	"permdock/nest",
@@ -68,7 +88,10 @@ const ADAPTER_SPECIFIERS = [
 	"permdock/openai",
 	"permdock/orpc",
 	"permdock/server",
+	"permdock/solid-start",
 	"permdock/supabase/middleware",
+	"permdock/sveltekit",
+	"permdock/tanstack-start",
 	"permdock/terminal",
 	"permdock/trpc",
 	"permdock/webmcp"
@@ -241,6 +264,12 @@ function stringValue(node) {
 	if (value?.type === "Literal") return typeof value.value === "string" ? value.value : void 0;
 	return value?.type === "TemplateLiteral" ? value.quasis[0]?.value.cooked ?? void 0 : void 0;
 }
+/** Their `jwks` holds Standard Webhooks `v1a` keys, not a token issuer's. */
+const WEBHOOK_VERIFIERS = /* @__PURE__ */ new Set([
+	"cloudApprovalWaiter",
+	"verifyWebhook",
+	"webhookVerifier"
+]);
 function isPermDockSpecifier(value) {
 	return value === "permdock" || value.startsWith("permdock/");
 }
@@ -254,7 +283,8 @@ function permdockOptionObjects(source) {
 		ImportDeclaration(node) {
 			if (node.importKind === "type" || !isPermDockSpecifier(node.source.value)) return;
 			for (const specifier of node.specifiers) if (specifier.type === "ImportNamespaceSpecifier") namespaces.add(specifier.local.name);
-			else if (specifier.type === "ImportDefaultSpecifier" || specifier.importKind !== "type") functions.add(specifier.local.name);
+			else if (specifier.type === "ImportDefaultSpecifier") functions.add(specifier.local.name);
+			else if (specifier.importKind !== "type" && !WEBHOOK_VERIFIERS.has(specifier.imported.type === "Identifier" ? specifier.imported.name : specifier.imported.value)) functions.add(specifier.local.name);
 		},
 		VariableDeclarator(node) {
 			const init = unwrapped(node.init);
@@ -373,7 +403,7 @@ function pd038(sources, tenantClaim, fallback) {
 			code: "PD038",
 			severity: "warning",
 			message: `${source.file}:${line} reads the tenant from '${read}', but rls.tenantClaim is '${tenantClaim}'`,
-			fix: `pass tenant: '${tenantClaim}' or set rls.tenantClaim to '${read}'`
+			fix: `pass claims: { tenant: '${tenantClaim}' } or set rls.tenantClaim to '${read}'`
 		});
 	}
 	return findings;
@@ -534,7 +564,20 @@ async function runUsage(input) {
 	};
 	return {
 		code: report.errors > 0 || input.strict && report.warnings > 0 ? 1 : 0,
-		output: input.json ? `${JSON.stringify(report, null, 2)}\n` : formatUsage(report)
+		output: input.json ? `${JSON.stringify(report, null, 2)}\n` : formatUsage(report),
+		findings: [
+			...unused,
+			...ungranted,
+			...noRole,
+			...dynamic,
+			...undeclared,
+			...outsideInclude
+		].map((item) => findingOf({
+			code: item.kind,
+			severity: item.kind === "no-role" ? "error" : "warning",
+			message: `${item.key === "*" ? "" : `${item.key}: `}${item.detail}`,
+			docs: `${DOCS_BASE}/usage`
+		}))
 	};
 }
 async function usagePolicy(cwd, policyRel, loaded) {
@@ -587,7 +630,7 @@ function declaredFields(policy, resource) {
 function conditionFields(condition, out) {
 	if (condition === void 0) return;
 	const add = (field) => {
-		out.add(field.split(".")[0] ?? field);
+		out.add(beforeFirst(field, "."));
 	};
 	switch (condition.op) {
 		case "eq":

package/dist/{validation-error-BSSw0l_8.d.ts → validation-error-DHUrAkku.d.ts}

@@ -1,4 +1,4 @@
-import { a as ProblemDetails } from "./errors-OD_4c__H.js";
+import { a as ProblemDetails } from "./errors-DH5QEGXh.js";
 import { StandardSchemaV1 } from "@standard-schema/spec";
 //#region src/core/validation-error.d.ts
 /** The base of every Problem Details `type` URI; defined here so a validation error does not pull in the Problem Details builders. */