permdock 0.5.0 → 0.6.0

package/dist/a2a/index.d.ts

@@ -1,8 +1,8 @@
-import { T as Policy, Yn as AuthorizationDetail, rr as Principal } from "../policy-types-DzwivBgR.js";
-import { w as Permission } from "../vocabulary-D6lPdb4Z.js";
-import { m as ApprovalStore } from "../types-CCpc2Dcv.js";
-import { a as ProblemDetails } from "../errors-C2PXIv4c.js";
-import { t as InstanceOptions } from "../instance-options-Omfd793B.js";
+import { T as Policy, Yn as AuthorizationDetail, rr as Principal } from "../policy-types-n0uRTsW8.js";
+import { w as Permission } from "../vocabulary-CN8H_9UF.js";
+import { m as ApprovalStore } from "../types-BdtSDbBO.js";
+import { a as ProblemDetails } from "../errors-DH5QEGXh.js";
+import { t as InstanceOptions } from "../instance-options-BsVpyGIk.js";
 //#region src/a2a/types.d.ts
 type A2aAuth = {
   readonly clientId?: string;

package/dist/a2a/index.js

@@ -5,10 +5,10 @@ import { n as PermDockDeniedError, t as PermDockApprovalRequiredError } from "..
 import { t as canonicalJson } from "../canonical-json-BC8_nMTw.js";
 import { t as bytesToBase64Url } from "../sha256-D9ihqmvd.js";
 import { n as resourceRef } from "../resource-ref-CaS9yVPi.js";
-import { a as hasScope, c as withApp, i as challengeScope, o as scopesReaching } from "../permdock-B9JxkBwC.js";
+import { a as hasScope, c as withApp, i as challengeScope, o as scopesReaching } from "../permdock-BrAscV28.js";
 import { f as wwwAuthenticate, r as bearerChallenge } from "../problem-CTviyH5L.js";
-import { r as instanceOptions } from "../build-instance-BMnAudHn.js";
-import { n as createAgentKernel } from "../kernel-5JatXyND.js";
+import { r as instanceOptions } from "../build-instance-Bu_eDqYw.js";
+import { n as createAgentKernel } from "../kernel-D0NVb1cK.js";
 import { t as delegationFrom } from "../delegation-input-FTxMK3ji.js";
 //#region src/a2a/create.ts
 function firstScheme(options) {

package/dist/{adoption-scan-B4R5fnMU.js → adoption-scan-DCYe60Pi.js}

@@ -1,5 +1,5 @@
 import { r as listSourceFiles } from "./files-D_JIzUrP.js";
-import { t as DOCS_BASE } from "./manifest-CtKR3GXL.js";
+import { t as DOCS_BASE } from "./manifest-dvL2XEe1.js";
 import { readFileSync } from "node:fs";
 import { relative } from "node:path";
 //#region src/cli/adoption-scan.ts

package/dist/agent/index.d.ts

@@ -1,3 +1,3 @@
-import { n as DeniedTextEvent, t as DeniedText } from "../denied-text-D8jDHgsl.js";
-import { a as createPermDock, c as ModelMap, i as OperationVerdict, l as ToolBinding, n as AgentPermDockOptions, o as AgentAdapterOptions, r as GatewayOptions, s as DecideToolOptions, t as AgentPermDock, u as ToolMap } from "../create-BDS7wc3y.js";
+import { n as DeniedTextEvent, t as DeniedText } from "../denied-text-CiFQNuMV.js";
+import { a as createPermDock, c as ModelMap, i as OperationVerdict, l as ToolBinding, n as AgentPermDockOptions, o as AgentAdapterOptions, r as GatewayOptions, s as DecideToolOptions, t as AgentPermDock, u as ToolMap } from "../create-CBMmFie-.js";
 export { type AgentAdapterOptions, type AgentPermDock, type AgentPermDockOptions, type DecideToolOptions, type DeniedText, type DeniedTextEvent, type GatewayOptions, type ModelMap, type OperationVerdict, type ToolBinding, type ToolMap, createPermDock };

package/dist/agent/index.js

@@ -1 +1 @@
-export { n as createPermDock } from "../create-C3b4B5eF.js";
+export { n as createPermDock } from "../create-CGm28gyI.js";

package/dist/ai-sdk/index.d.ts

@@ -1,7 +1,7 @@
-import { T as Policy, j as PolicyVocabulary, rr as Principal } from "../policy-types-DzwivBgR.js";
-import { w as Permission } from "../vocabulary-D6lPdb4Z.js";
-import { n as DeniedTextEvent, t as DeniedText } from "../denied-text-D8jDHgsl.js";
-import { o as AgentAdapterOptions, t as AgentPermDock } from "../create-BDS7wc3y.js";
+import { T as Policy, j as PolicyVocabulary, rr as Principal } from "../policy-types-n0uRTsW8.js";
+import { w as Permission } from "../vocabulary-CN8H_9UF.js";
+import { n as DeniedTextEvent, t as DeniedText } from "../denied-text-CiFQNuMV.js";
+import { o as AgentAdapterOptions, t as AgentPermDock } from "../create-CBMmFie-.js";
 //#region src/ai-sdk/create.d.ts
 type AiSdkContext = {
   readonly runtimeContext?: unknown;

package/dist/ai-sdk/index.js

@@ -1,8 +1,8 @@
 import { t as compact } from "../compact-CAf557ZB.js";
 import { n as PermDockDeniedError, t as PermDockApprovalRequiredError } from "../errors-BKy0EfhN.js";
-import { c as withApp } from "../permdock-B9JxkBwC.js";
-import { t as approvalTokenOf } from "../kernel-5JatXyND.js";
-import { t as agentRuntime } from "../create-C3b4B5eF.js";
+import { c as withApp } from "../permdock-BrAscV28.js";
+import { t as approvalTokenOf } from "../kernel-D0NVb1cK.js";
+import { t as agentRuntime } from "../create-CGm28gyI.js";
 //#region src/ai-sdk/create.ts
 const APPROVAL_STATUSES = /* @__PURE__ */ new Set([
 	"approved",

package/dist/{approval-prompt-Djo_PyZc.d.ts → approval-prompt-DvSSPQJX.d.ts}

@@ -1,5 +1,5 @@
-import { s as OperationMeta, t as Operation } from "./operations-CxybZErY.js";
-import { u as ApprovalRequest } from "./types-CCpc2Dcv.js";
+import { s as OperationMeta, t as Operation } from "./operations-X0VM7F3m.js";
+import { u as ApprovalRequest } from "./types-BdtSDbBO.js";
 //#region src/delivery/approval-prompt.d.ts
 /**
  * What an email or chat prompt shows an approver, wire format v1. It carries

package/dist/approvals/index.d.ts

@@ -1,5 +1,5 @@
-import { _ as DEFAULT_APPROVAL_TTL, a as ApprovalDelegationSource, b as escalationOpenAt, c as ApprovalListQuery, d as ApprovalResumeFailureCause, f as ApprovalSignature, g as ApprovalVerdict, h as ApprovalSubjectSummary, i as ApprovalDelegation, l as ApprovalPage, m as ApprovalStore, n as ApprovalApprovers, o as ApprovalInspectResult, p as ApprovalStatus, r as ApprovalCancelMeta, s as ApprovalListFilter, t as APPROVAL_HEADER, u as ApprovalRequest, v as approvalQuorum, y as approverRelationKey } from "../types-CCpc2Dcv.js";
+import { _ as DEFAULT_APPROVAL_TTL, a as ApprovalDelegationSource, b as escalationOpenAt, c as ApprovalListQuery, d as ApprovalResumeFailureCause, f as ApprovalSignature, g as ApprovalVerdict, h as ApprovalSubjectSummary, i as ApprovalDelegation, l as ApprovalPage, m as ApprovalStore, n as ApprovalApprovers, o as ApprovalInspectResult, p as ApprovalStatus, r as ApprovalCancelMeta, s as ApprovalListFilter, t as APPROVAL_HEADER, u as ApprovalRequest, v as approvalQuorum, y as approverRelationKey } from "../types-BdtSDbBO.js";
 import { n as ApprovalErrorCode, r as isApprovalError, t as ApprovalError } from "../errors-BWXBMaKK.js";
-import { a as AccessReviewItemQuery, c as AccessReviewStore, i as AccessReviewItemPage, n as AccessReviewDecision, o as AccessReviewItemStatus, r as AccessReviewItem, s as AccessReviewStatus, t as AccessReview } from "../types-_sHy8BQf.js";
-import { $ as AccessReviewVerdict, A as APPROVAL_REQUEST_SCHEMA, B as matchDelegation, C as ApproverRelationsOptions, D as SignApprovalOptions, E as ApprovalSignatureEntry, F as IdempotencyStore, G as pageAccessReviewItems, H as parseApprovalDelegation, I as IdempotentResponse, J as StartAccessReviewInput, K as AccessReviewHolder, L as memoryIdempotencyStore, M as ApprovalView, N as ApprovalsHandlerOptions, O as approvalSignatureClaims, P as approvalsHandler, Q as isAccessReviewError, R as ApprovalDelegationMatch, S as vouchApproval, T as ApprovalSignatureClaims, U as MemoryAccessReviewStore, V as memoryApprovalDelegationSource, W as memoryAccessReviewStore, X as AccessReviewError, Y as startAccessReview, Z as AccessReviewErrorCode, _ as resolveApproval, a as approverPermissions, b as storedApprovalToken, c as decodeApprovalCursor, d as pageApprovals, et as accessReviewerEligible, f as cancelApprovals, g as requestApproval, h as readApprovalHeader, i as memoryApprovalStore, j as parseApprovalRequest, k as signApproval, l as encodeApprovalCursor, m as inspectApproval, n as applyApprovalVerdict, nt as AccessReviewsHandlerOptions, o as ApprovalCursorPosition, p as consumeApproval, q as AccessReviewOptions, r as assertApprover, rt as accessReviewsHandler, s as approvalPageSize, t as MemoryApprovalStore, tt as decideAccessReviewItem, u as listAllApprovals, v as resumeDecision, w as approverRelations, x as summarizeSubject, y as resumeFromHeader, z as MatchDelegationOptions } from "../index-CxGUswIC.js";
+import { a as AccessReviewItemQuery, c as AccessReviewStore, i as AccessReviewItemPage, n as AccessReviewDecision, o as AccessReviewItemStatus, r as AccessReviewItem, s as AccessReviewStatus, t as AccessReview } from "../types-C_IiEs64.js";
+import { $ as AccessReviewVerdict, A as APPROVAL_REQUEST_SCHEMA, B as matchDelegation, C as ApproverRelationsOptions, D as SignApprovalOptions, E as ApprovalSignatureEntry, F as IdempotencyStore, G as pageAccessReviewItems, H as parseApprovalDelegation, I as IdempotentResponse, J as StartAccessReviewInput, K as AccessReviewHolder, L as memoryIdempotencyStore, M as ApprovalView, N as ApprovalsHandlerOptions, O as approvalSignatureClaims, P as approvalsHandler, Q as isAccessReviewError, R as ApprovalDelegationMatch, S as vouchApproval, T as ApprovalSignatureClaims, U as MemoryAccessReviewStore, V as memoryApprovalDelegationSource, W as memoryAccessReviewStore, X as AccessReviewError, Y as startAccessReview, Z as AccessReviewErrorCode, _ as resolveApproval, a as approverPermissions, b as storedApprovalToken, c as decodeApprovalCursor, d as pageApprovals, et as accessReviewerEligible, f as cancelApprovals, g as requestApproval, h as readApprovalHeader, i as memoryApprovalStore, j as parseApprovalRequest, k as signApproval, l as encodeApprovalCursor, m as inspectApproval, n as applyApprovalVerdict, nt as AccessReviewsHandlerOptions, o as ApprovalCursorPosition, p as consumeApproval, q as AccessReviewOptions, r as assertApprover, rt as accessReviewsHandler, s as approvalPageSize, t as MemoryApprovalStore, tt as decideAccessReviewItem, u as listAllApprovals, v as resumeDecision, w as approverRelations, x as summarizeSubject, y as resumeFromHeader, z as MatchDelegationOptions } from "../index-C-6Letxg.js";
 export { APPROVAL_HEADER, APPROVAL_REQUEST_SCHEMA, type AccessReview, type AccessReviewDecision, AccessReviewError, type AccessReviewErrorCode, type AccessReviewHolder, type AccessReviewItem, type AccessReviewItemPage, type AccessReviewItemQuery, type AccessReviewItemStatus, type AccessReviewOptions, type AccessReviewStatus, type AccessReviewStore, type AccessReviewVerdict, type AccessReviewsHandlerOptions, type ApprovalApprovers, type ApprovalCancelMeta, type ApprovalCursorPosition, type ApprovalDelegation, type ApprovalDelegationMatch, type ApprovalDelegationSource, ApprovalError, type ApprovalErrorCode, type ApprovalInspectResult, type ApprovalListFilter, type ApprovalListQuery, type ApprovalPage, type ApprovalRequest, type ApprovalResumeFailureCause, type ApprovalSignature, type ApprovalSignatureClaims, type ApprovalSignatureEntry, type ApprovalStatus, type ApprovalStore, type ApprovalSubjectSummary, type ApprovalVerdict, type ApprovalView, type ApprovalsHandlerOptions, type ApproverRelationsOptions, DEFAULT_APPROVAL_TTL, type IdempotencyStore, type IdempotentResponse, type MatchDelegationOptions, type MemoryAccessReviewStore, type MemoryApprovalStore, type SignApprovalOptions, type StartAccessReviewInput, accessReviewerEligible, accessReviewsHandler, applyApprovalVerdict, approvalPageSize, approvalQuorum, approvalSignatureClaims, approvalsHandler, approverPermissions, approverRelationKey, approverRelations, assertApprover, cancelApprovals, consumeApproval, decideAccessReviewItem, decodeApprovalCursor, encodeApprovalCursor, escalationOpenAt, inspectApproval, isAccessReviewError, isApprovalError, listAllApprovals, matchDelegation, memoryAccessReviewStore, memoryApprovalDelegationSource, memoryApprovalStore, memoryIdempotencyStore, pageAccessReviewItems, pageApprovals, parseApprovalDelegation, parseApprovalRequest, readApprovalHeader, requestApproval, resolveApproval, resumeDecision, resumeFromHeader, signApproval, startAccessReview, storedApprovalToken, summarizeSubject, vouchApproval };

package/dist/approvals/index.js

@@ -1,8 +1,8 @@
 import { a as escalationOpenAt, c as isApprovalError, i as approverRelationKey, n as DEFAULT_APPROVAL_TTL, r as approvalQuorum, s as ApprovalError, t as APPROVAL_HEADER } from "../types-DqzsnlSA.js";
-import { a as approvalPageSize, c as listAllApprovals, i as memoryApprovalStore, l as pageApprovals, n as assertApprover, o as decodeApprovalCursor, s as encodeApprovalCursor, t as applyApprovalVerdict } from "../store-4u_hxjWa.js";
-import { a as requestApproval, c as resumeFromHeader, d as vouchApproval, f as approverPermissions, i as readApprovalHeader, l as storedApprovalToken, m as approverRelations, n as consumeApproval, o as resolveApproval, r as inspectApproval, s as resumeDecision, t as cancelApprovals, u as summarizeSubject } from "../helpers-DTcZOzhF.js";
+import { a as approvalPageSize, c as listAllApprovals, i as memoryApprovalStore, l as pageApprovals, n as assertApprover, o as decodeApprovalCursor, s as encodeApprovalCursor, t as applyApprovalVerdict } from "../store-BDutJkDL.js";
+import { a as requestApproval, c as resumeFromHeader, d as vouchApproval, f as approverPermissions, i as readApprovalHeader, l as storedApprovalToken, m as approverRelations, n as consumeApproval, o as resolveApproval, r as inspectApproval, s as resumeDecision, t as cancelApprovals, u as summarizeSubject } from "../helpers-CBYVMjwh.js";
 import { n as isAccessReviewError, t as AccessReviewError } from "../errors-BDUwg2qC.js";
-import { a as matchDelegation, c as memoryAccessReviewStore, d as accessReviewsHandler, f as accessReviewerEligible, i as memoryIdempotencyStore, l as pageAccessReviewItems, n as approvalSignatureClaims, o as memoryApprovalDelegationSource, p as decideAccessReviewItem, r as signApproval, s as parseApprovalDelegation, t as approvalsHandler, u as startAccessReview } from "../approvals-DJ6Yd5z1.js";
+import { a as matchDelegation, c as memoryAccessReviewStore, d as accessReviewsHandler, f as accessReviewerEligible, i as memoryIdempotencyStore, l as pageAccessReviewItems, n as approvalSignatureClaims, o as memoryApprovalDelegationSource, p as decideAccessReviewItem, r as signApproval, s as parseApprovalDelegation, t as approvalsHandler, u as startAccessReview } from "../approvals-p1PGoVjb.js";
 import { t as APPROVAL_REQUEST_SCHEMA } from "../request-schema-CMreVuFM.js";
 import { t as parseApprovalRequest } from "../parse-request-D_tUXG6M.js";
 export { APPROVAL_HEADER, APPROVAL_REQUEST_SCHEMA, AccessReviewError, ApprovalError, DEFAULT_APPROVAL_TTL, accessReviewerEligible, accessReviewsHandler, applyApprovalVerdict, approvalPageSize, approvalQuorum, approvalSignatureClaims, approvalsHandler, approverPermissions, approverRelationKey, approverRelations, assertApprover, cancelApprovals, consumeApproval, decideAccessReviewItem, decodeApprovalCursor, encodeApprovalCursor, escalationOpenAt, inspectApproval, isAccessReviewError, isApprovalError, listAllApprovals, matchDelegation, memoryAccessReviewStore, memoryApprovalDelegationSource, memoryApprovalStore, memoryIdempotencyStore, pageAccessReviewItems, pageApprovals, parseApprovalDelegation, parseApprovalRequest, readApprovalHeader, requestApproval, resolveApproval, resumeDecision, resumeFromHeader, signApproval, startAccessReview, storedApprovalToken, summarizeSubject, vouchApproval };

package/dist/{approvals-DJ6Yd5z1.js → approvals-p1PGoVjb.js}

@@ -7,13 +7,13 @@ import { d as isoNow, f as nowMillis, g as secondsOf, i as dateAt } from "./time
 import { t as canonicalJson } from "./canonical-json-BC8_nMTw.js";
 import { r as sha256Digest } from "./sha256-D9ihqmvd.js";
 import { s as rootMembershipId } from "./scopes-CUPSjo9q.js";
-import { o as flattenGrantee } from "./grantee-Cn1HyUsI.js";
+import { o as flattenGrantee } from "./grantee-hxrUsbpM.js";
 import { c as isApprovalError, s as ApprovalError } from "./types-DqzsnlSA.js";
-import { a as approvalPageSize, c as listAllApprovals, n as assertApprover, o as decodeApprovalCursor, r as matchesApprovers } from "./store-4u_hxjWa.js";
+import { a as approvalPageSize, c as listAllApprovals, n as assertApprover, o as decodeApprovalCursor, r as matchesApprovers } from "./store-BDutJkDL.js";
 import { n as readBodyText } from "./body-text-QcXok_SI.js";
 import { r as hasCredentials } from "./http-BBoKefeS.js";
 import { a as methodNotAllowed, c as problemResponse, d as validationProblem, u as unauthenticatedProblem } from "./problem-CTviyH5L.js";
-import { f as approverPermissions, m as approverRelations, p as heldPermissions } from "./helpers-DTcZOzhF.js";
+import { f as approverPermissions, m as approverRelations, p as heldPermissions } from "./helpers-CBYVMjwh.js";
 import { n as isAccessReviewError, t as AccessReviewError } from "./errors-BDUwg2qC.js";
 import { t as bodyTooLarge } from "./body-CH5of8Ne.js";
 //#region src/approvals/access-reviews/decide.ts

package/dist/{arazzo-B6lebmiQ.js → arazzo-41WuzHou.js}

@@ -21,7 +21,7 @@ const check = defineLeaf({
 		...permissionsFlag
 	},
 	async run(ctx, { flags }) {
-		return (await import("./arazzo-BWhNF-k0.js")).runArazzo({
+		return (await import("./arazzo-CaUVBn7D.js")).runArazzo({
 			cwd: ctx.cwd,
 			config: ctx.config,
 			doc: given(flags.doc),

package/dist/{arazzo-BWhNF-k0.js → arazzo-CaUVBn7D.js}

@@ -1,9 +1,9 @@
-import { p as arazzoFindings } from "./src-DLfUWFAI.js";
+import { p as arazzoFindings } from "./src-Cu2m75uo.js";
 import { c as missingInput } from "./errors-CWTY6uih.js";
 import { i as readJsonFile } from "./files-D_JIzUrP.js";
 import { t as ARAZZO_REPORT_SCHEMA } from "./version-CEbQ5UeM.js";
 import { a as loadModule, s as pickNamed, t as asPermissionTree } from "./load-DFS_ry0W.js";
-import { t as DOCS_BASE } from "./manifest-CtKR3GXL.js";
+import { t as DOCS_BASE } from "./manifest-dvL2XEe1.js";
 import { existsSync } from "node:fs";
 import { resolve } from "node:path";
 //#region src/cli/arazzo.ts

package/dist/astro/index.d.ts

@@ -1,9 +1,9 @@
-import { T as Policy, Vt as Snapshot, j as PolicyVocabulary, rr as Principal } from "../policy-types-DzwivBgR.js";
-import { w as Permission } from "../vocabulary-D6lPdb4Z.js";
-import { a as OperationInput, t as Operation } from "../operations-CxybZErY.js";
-import { r as PermDock } from "../permdock-D7eeLJER.js";
-import { D as ConnectionOptions, T as Connection, f as InvalidSignatureError, i as OpenApiHooks, o as ProtectOptions, u as SnapshotQuery, v as discoverViaSignatureAgent, x as webBotAuthVerifier } from "../server-types-BLd4MnBX.js";
-import { a as ProtectTarget, i as PermDockHandlers, n as FetchAdapterOptions, t as ContextReader } from "../fetch-adapter-qKJBuRqy.js";
+import { T as Policy, Vt as Snapshot, j as PolicyVocabulary, rr as Principal } from "../policy-types-n0uRTsW8.js";
+import { w as Permission } from "../vocabulary-CN8H_9UF.js";
+import { a as OperationInput, t as Operation } from "../operations-X0VM7F3m.js";
+import { r as PermDock } from "../permdock-SV8ZINYT.js";
+import { D as ConnectionOptions, T as Connection, f as InvalidSignatureError, i as OpenApiHooks, o as ProtectOptions, u as SnapshotQuery, v as discoverViaSignatureAgent, x as webBotAuthVerifier } from "../server-types-CKQiCnON.js";
+import { a as ProtectTarget, i as PermDockHandlers, n as FetchAdapterOptions, t as ContextReader } from "../fetch-adapter-Dw0MTS3D.js";
 import { APIContext, MiddlewareHandler } from "astro";
 //#region src/astro/create.d.ts
 type AstroPermDockOptions<TUser = unknown> = FetchAdapterOptions<APIContext, TUser>;

package/dist/astro/index.js

@@ -1,5 +1,5 @@
-import { d as discoverViaSignatureAgent, m as webBotAuthVerifier, u as InvalidSignatureError } from "../evaluations-DZ2CbV5k.js";
-import { n as guardedRoute, r as instanceRoute, t as fetchAdapter } from "../fetch-adapter-g0ypLkID.js";
+import { d as discoverViaSignatureAgent, m as webBotAuthVerifier, u as InvalidSignatureError } from "../evaluations-beAooV0n.js";
+import { n as guardedRoute, r as instanceRoute, t as fetchAdapter } from "../fetch-adapter-DD_gfmrC.js";
 //#region src/astro/create.ts
 const route = {
 	context: (context) => context,

package/dist/{audience-Dg8XsRaO.js → audience-DabClFLQ.js}

@@ -1,4 +1,4 @@
-import { t as whoCan } from "./who-can-D0QoYbEb.js";
+import { t as whoCan } from "./who-can-DWBAcaCQ.js";
 //#region src/delivery/audience.ts
 async function granted(permdock, ids, permission, row) {
 	const unique = [...new Set(ids.filter((id) => typeof id === "string" && id !== ""))];

package/dist/authzen/index.d.ts

@@ -1,7 +1,7 @@
-import { T as Policy, rr as Principal } from "../policy-types-DzwivBgR.js";
-import { m as ApprovalStore } from "../types-CCpc2Dcv.js";
-import { t as InstanceOptions } from "../instance-options-Omfd793B.js";
-import { a as evaluationsSemantic, n as EvaluationsSemantic, r as evaluateBatch, t as EVALUATIONS_SEMANTICS } from "../evaluations-16UqqQ6W.js";
+import { T as Policy, rr as Principal } from "../policy-types-n0uRTsW8.js";
+import { m as ApprovalStore } from "../types-BdtSDbBO.js";
+import { t as InstanceOptions } from "../instance-options-BsVpyGIk.js";
+import { a as evaluationsSemantic, n as EvaluationsSemantic, r as evaluateBatch, t as EVALUATIONS_SEMANTICS } from "../evaluations-C_1vdSZc.js";
 //#region src/authzen/types.d.ts
 type AuthzenResourceAdapter = {
   readonly data?: (id: string) => unknown;

package/dist/authzen/index.js

@@ -8,8 +8,8 @@ import { n as readBodyText } from "../body-text-QcXok_SI.js";
 import { r as hasCredentials } from "../http-BBoKefeS.js";
 import { a as methodNotAllowed, c as problemResponse, d as validationProblem, n as batchTooLarge, u as unauthenticatedProblem } from "../problem-CTviyH5L.js";
 import { t as bodyTooLarge } from "../body-CH5of8Ne.js";
-import { n as resolveOrNull, t as buildInstance } from "../build-instance-BMnAudHn.js";
-import { _ as wireResourceId, a as evaluationReasons, c as unknownSemanticProblem, g as permissionLookup, h as itemResourceData, i as evaluateBatch, l as withRequestId, n as applyApprovalResume, r as authzenMetadata, s as evaluationsSemantic, t as EVALUATIONS_SEMANTICS } from "../evaluations-DZ2CbV5k.js";
+import { n as resolveOrNull, t as buildInstance } from "../build-instance-Bu_eDqYw.js";
+import { _ as wireResourceId, a as evaluationReasons, c as unknownSemanticProblem, g as permissionLookup, h as itemResourceData, i as evaluateBatch, l as withRequestId, n as applyApprovalResume, r as authzenMetadata, s as evaluationsSemantic, t as EVALUATIONS_SEMANTICS } from "../evaluations-beAooV0n.js";
 //#region src/authzen/map.ts
 const UNKNOWN = {
 	outcome: "denied",

package/dist/{automation-BMZPIVUM.d.ts → automation-BNM3TtDo.d.ts}

@@ -1,6 +1,6 @@
-import { Lt as InstanceHandle, Pn as Denial, Rt as Instant } from "./policy-types-DzwivBgR.js";
-import { w as Permission } from "./vocabulary-D6lPdb4Z.js";
-import { t as Operation } from "./operations-CxybZErY.js";
+import { Lt as InstanceHandle, Pn as Denial, Rt as Instant } from "./policy-types-n0uRTsW8.js";
+import { w as Permission } from "./vocabulary-CN8H_9UF.js";
+import { t as Operation } from "./operations-X0VM7F3m.js";
 //#region src/core/automation.d.ts
 /**
  * Who an automation runs as. `publisher`: the person who published it, with

package/dist/better-auth/index.d.ts

@@ -1,5 +1,5 @@
-import { N as RoleBinding, W as CustomRoleSource, ir as Subject, q as DecisionSink, rr as Principal } from "../policy-types-DzwivBgR.js";
-import { E as PermissionTree } from "../vocabulary-D6lPdb4Z.js";
+import { N as RoleBinding, W as CustomRoleSource, ar as Subject, q as DecisionSink, rr as Principal } from "../policy-types-n0uRTsW8.js";
+import { E as PermissionTree } from "../vocabulary-CN8H_9UF.js";
 import { StandardSchemaV1 } from "@standard-schema/spec";
 //#region src/better-auth/types.d.ts
 type BetterAuthPrincipal = Principal & {

package/dist/better-auth/index.js

@@ -1,6 +1,6 @@
 import { n as isReadonlyArray, r as isRecord, t as compact } from "../compact-CAf557ZB.js";
 import { n as freezeDeep } from "../freeze-CrU8nQeX.js";
-import { n as role, r as allow } from "../role-builder-CXbis5-X.js";
+import { n as role, r as allow } from "../role-builder-uWQZ4v84.js";
 import { c as listPermissions } from "../permission-registry-Br4jSNVi.js";
 import { r as validateRecord } from "../thenable-yD7SabqG.js";
 import { t as anonymousSubject } from "../subject-BGoM5o8B.js";

package/dist/better-supabase/index.d.ts

@@ -1,10 +1,10 @@
-import { Rt as Instant, St as ApiKeyPrincipal, T as Policy, U as CredentialVerifier, gt as SupportSession, ir as Subject, pn as ApproverInput, qt as AuthEvent, rr as Principal } from "../policy-types-DzwivBgR.js";
-import { E as PermissionTree, w as Permission } from "../vocabulary-D6lPdb4Z.js";
-import { d as PrincipalIdentity, i as PermDockOptions, p as PrincipalSource, r as PermDock } from "../permdock-D7eeLJER.js";
-import { c as AccessReviewStore } from "../types-_sHy8BQf.js";
-import { i as SupabaseRpcCaller } from "../postgrest-NUqZT-RB.js";
-import { g as SupabaseSubjectOptions, m as SupabaseSessionLike, u as SupabasePrincipal } from "../types-CdlxsYQh.js";
-import { c as LinkPolicy, o as CapabilityPrincipal, t as Capability } from "../capability-BSslw1QV.js";
+import { Rt as Instant, St as ApiKeyPrincipal, T as Policy, U as CredentialVerifier, ar as Subject, gt as SupportSession, pn as ApproverInput, qt as AuthEvent, rr as Principal } from "../policy-types-n0uRTsW8.js";
+import { E as PermissionTree, w as Permission } from "../vocabulary-CN8H_9UF.js";
+import { d as PrincipalIdentity, i as PermDockOptions, p as PrincipalSource, r as PermDock } from "../permdock-SV8ZINYT.js";
+import { c as AccessReviewStore } from "../types-C_IiEs64.js";
+import { i as SupabaseRpcCaller } from "../postgrest-CEgRbefE.js";
+import { g as SupabaseSubjectOptions, m as SupabaseSessionLike, u as SupabasePrincipal } from "../types-BzzaHxt3.js";
+import { c as LinkPolicy, o as CapabilityPrincipal, t as Capability } from "../capability-Drg-1YhL.js";
 import { AuthorizationProvider } from "better-supabase/config";
 import { AuthSession, AuthorizationHooks, Authorizer, SupportAuthorize, SupportAuthorizeInput } from "better-supabase/server";
 import { EntitlementClaimOptions } from "better-supabase/blocks/entitlements";

package/dist/better-supabase/index.js

@@ -1,6 +1,6 @@
 import { r as isRecord, t as compact } from "../compact-CAf557ZB.js";
 import { n as freezeDeep } from "../freeze-CrU8nQeX.js";
-import { l as asApprover } from "../role-builder-CXbis5-X.js";
+import { l as asApprover } from "../role-builder-uWQZ4v84.js";
 import { a as holder, i as flattenApprovers, r as approverLeaves } from "../approvers-CqPOLD-o.js";
 import { t as loadPrincipal } from "../principal-source-pHneukrx.js";
 import { a as isId, r as idList } from "../expiry-D4_YKRKD.js";
@@ -10,18 +10,18 @@ import { t as canonicalJson } from "../canonical-json-BC8_nMTw.js";
 import { r as sha256Digest } from "../sha256-D9ihqmvd.js";
 import { t as decideSupportSession } from "../support-session-C6xJQYut.js";
 import { d as scopeList } from "../scopes-CUPSjo9q.js";
-import { o as flattenGrantee } from "../grantee-Cn1HyUsI.js";
+import { o as flattenGrantee } from "../grantee-hxrUsbpM.js";
 import { t as byCodePoint } from "../compare-pfyVnBjE.js";
-import { o as scopesReaching, t as getPermDock } from "../permdock-B9JxkBwC.js";
+import { o as scopesReaching, t as getPermDock } from "../permdock-BrAscV28.js";
 import { t as anonymousSubject } from "../subject-BGoM5o8B.js";
 import { i as linkPolicyViolation, n as capabilityOf, r as capabilitySubject } from "../capability-N1K9IpqS.js";
-import { r as credentialSubject, s as parseCredential } from "../credential-DM2um3ha.js";
+import { r as credentialSubject, s as parseCredential } from "../credential-BcoiejpY.js";
 import { t as AccessReviewError } from "../errors-BDUwg2qC.js";
 import { t as policyRowConditionKeys } from "../row-conditions-h2HythXQ.js";
-import { n as subscribersFor } from "../audience-Dg8XsRaO.js";
+import { n as subscribersFor } from "../audience-DabClFLQ.js";
 import { l as sqlIdent, s as quoteSqlLiteral } from "../sql-B5T1IL83.js";
 import "../sources-vs5dGOsS.js";
-import { c as subjectFromSupabaseSession, t as callRpc } from "../postgrest-CW0IqC-U.js";
+import { c as subjectFromSupabaseSession, t as callRpc } from "../postgrest-DAjUkF9w.js";
 import { t as parseSupabaseManifest } from "../manifest-C8IzW3Do.js";
 import { t as parseCatalog } from "../parse-Cxq0WxrA.js";
 import { AsyncResult, dbError } from "better-supabase";

package/dist/{bind-CZzhx-Vj.js → bind-CAvgUuKs.js}

@@ -1,10 +1,10 @@
 import { t as compact } from "./compact-CAf557ZB.js";
-import { c as withApp } from "./permdock-B9JxkBwC.js";
+import { c as withApp } from "./permdock-BrAscV28.js";
 import { t as composeWraps } from "./wrap-gX61EtpB.js";
-import { r as instanceOptions } from "./build-instance-BMnAudHn.js";
-import { p as invalidSignatureResponse } from "./evaluations-DZ2CbV5k.js";
+import { r as instanceOptions } from "./build-instance-Bu_eDqYw.js";
+import { p as invalidSignatureResponse } from "./evaluations-beAooV0n.js";
 import { n as tenantScope } from "./adapter-context-CRhqyzCk.js";
-import { t as createPermDock } from "./create-DnrmLnLW.js";
+import { t as createPermDock } from "./create-DCF2SvoT.js";
 //#region src/server/bind.ts
 /** The server kernel with the subject and actor callbacks reading the context `contextOf` maps a `Request` to. */
 function adapterKernel(policy, options, adapter, contextOf) {

package/dist/{bind--9EFVYWF.d.ts → bind-DOyrv6zi.d.ts}

@@ -1,11 +1,11 @@
-import { ir as Subject } from "./policy-types-DzwivBgR.js";
-import { m as ApprovalStore } from "./types-CCpc2Dcv.js";
-import { t as InstanceOptions } from "./instance-options-Omfd793B.js";
+import { ar as Subject } from "./policy-types-n0uRTsW8.js";
+import { m as ApprovalStore } from "./types-BdtSDbBO.js";
+import { t as InstanceOptions } from "./instance-options-BsVpyGIk.js";
 import { t as RequestContext } from "./request-context-C2_1lchh.js";
-import { n as PermDockWrap } from "./wrap-Bd1Tejur.js";
-import { o as OtelWrap } from "./types-BqAKcRNW.js";
-import { r as PdpFactory } from "./types-ClZaWzfb.js";
-import { S as TenantOption, _ as WebBotAuthVerifier, t as DeniedResponse } from "./server-types-BLd4MnBX.js";
+import { n as PermDockWrap } from "./wrap-C5jC6sKI.js";
+import { o as OtelWrap } from "./types-lUlG3TVd.js";
+import { r as PdpFactory } from "./types-_WhUP7ud.js";
+import { S as TenantOption, _ as WebBotAuthVerifier, t as DeniedResponse } from "./server-types-CKQiCnON.js";
 //#region src/server/bind.d.ts
 /** The options of every framework adapter; `TContext` is what its callbacks receive. */
 type ServerAdapterOptions<TContext, TUser = unknown> = InstanceOptions & ServerAdapterServices & {

package/dist/{build-instance-BMnAudHn.js → build-instance-Bu_eDqYw.js}

@@ -1,5 +1,5 @@
 import { t as compact } from "./compact-CAf557ZB.js";
-import { t as getPermDock } from "./permdock-B9JxkBwC.js";
+import { t as getPermDock } from "./permdock-BrAscV28.js";
 //#region src/core/instance-options.ts
 const INSTANCE_KEYS = {
 	memberships: true,

package/dist/{capability-BSslw1QV.d.ts → capability-Drg-1YhL.d.ts}

@@ -1,5 +1,5 @@
-import { Rt as Instant, rr as Principal, ut as TokenSigner } from "./policy-types-DzwivBgR.js";
-import { E as PermissionTree, w as Permission } from "./vocabulary-D6lPdb4Z.js";
+import { Rt as Instant, rr as Principal, ut as TokenSigner } from "./policy-types-n0uRTsW8.js";
+import { E as PermissionTree, w as Permission } from "./vocabulary-CN8H_9UF.js";
 //#region src/core/capability.d.ts
 /**
  * Who may redeem a capability: anyone holding it, any signed-in principal,

package/dist/catalog/index.d.ts

@@ -1,8 +1,8 @@
-import { T as Policy, rr as Principal } from "../policy-types-DzwivBgR.js";
-import { a as PolicyDocument } from "../hosted-DBDX0M-P.js";
-import { a as CatalogDocument, c as CatalogOperation, d as CatalogRole, f as CatalogScope, h as CatalogValidity, i as CatalogDelegation, l as CatalogPermission, m as CatalogUsage, n as CatalogApproval, o as CatalogGrant, p as CatalogSupportAccess, r as CatalogBreakGlass, s as CatalogOAuthScope, t as CatalogActivation, u as CatalogResource } from "../types-CZTnPFzM.js";
-import { a as CatalogFinding, i as CatalogEventData } from "../sink-Bj_lDUDq.js";
-import { a as pushedPolicy, i as parsePushedPolicy, n as PushedGrant, r as PushedPolicy, t as PUSHED_POLICY_SCHEMA } from "../pushed-policy-BImMTTIM.js";
+import { T as Policy, rr as Principal } from "../policy-types-n0uRTsW8.js";
+import { a as PolicyDocument } from "../hosted-BPk51-kX.js";
+import { a as CatalogDocument, c as CatalogOperation, d as CatalogRole, f as CatalogScope, h as CatalogValidity, i as CatalogDelegation, l as CatalogPermission, m as CatalogUsage, n as CatalogApproval, o as CatalogGrant, p as CatalogSupportAccess, r as CatalogBreakGlass, s as CatalogOAuthScope, t as CatalogActivation, u as CatalogResource } from "../types-Druu9wLM.js";
+import { a as CatalogFinding, i as CatalogEventData } from "../sink-4-eQIRWf.js";
+import { a as pushedPolicy, i as parsePushedPolicy, n as PushedGrant, r as PushedPolicy, t as PUSHED_POLICY_SCHEMA } from "../pushed-policy-DCW91KQU.js";
 import { StandardSchemaV1 } from "@standard-schema/spec";
 //#region src/catalog/drift.d.ts
 /**

package/dist/catalog/index.js

@@ -1,9 +1,9 @@
 import { n as freezeDeep } from "../freeze-CrU8nQeX.js";
-import { t as hostedGrantDrops } from "../hosted-BZIAYvon.js";
+import { t as hostedGrantDrops } from "../hosted-B46-5LYE.js";
 import { n as rowConditionKeys, t as parseCatalog } from "../parse-Cxq0WxrA.js";
 import { t as operationFindings } from "../operation-findings-DgATDpvh.js";
-import { n as resourceSchemaFromJson, t as policyFromCatalog } from "../policy-from-catalog-DzhEc3Y9.js";
-import { n as parsePushedPolicy, r as pushedPolicy, t as PUSHED_POLICY_SCHEMA } from "../pushed-policy-DobP7AHI.js";
+import { n as resourceSchemaFromJson, t as policyFromCatalog } from "../policy-from-catalog-C2gMa2Dj.js";
+import { n as parsePushedPolicy, r as pushedPolicy, t as PUSHED_POLICY_SCHEMA } from "../pushed-policy-CqtxkV4G.js";
 //#region src/catalog/drift.ts
 /** The finding a drop reason becomes; `null` for a reason the catalog did not cause. */
 function findingCode(reason) {

package/dist/catalog-BoWglDPI.js

@@ -0,0 +1 @@
+export { t as catalogFile, n as runCatalog } from "./catalog-HD2gf5mY.js";

package/dist/{catalog-R_A__RsH.js → catalog-DZVbrF-z.js}

@@ -30,7 +30,7 @@ const catalog = defineLeaf({
 		...checkFlag
 	},
 	async run(ctx, { flags }) {
-		const { catalogFile, runCatalog } = await import("./catalog-DjhMYYCq.js");
+		const { catalogFile, runCatalog } = await import("./catalog-BoWglDPI.js");
 		const result = await runCatalog({
 			cwd: ctx.cwd,
 			config: ctx.config,

package/dist/{catalog-BECMPrwc.js → catalog-HD2gf5mY.js}

@@ -1,8 +1,8 @@
 import { r as isRecord } from "./compact-CAf557ZB.js";
 import { r as listSourceFiles, t as defaultSrcPath } from "./files-D_JIzUrP.js";
-import { a as formatCatalogJson, i as catalogSchemaDocument, o as formatCatalogMarkdown, t as buildCatalog } from "./catalog-doc-C9wjsfNY.js";
+import { a as formatCatalogJson, i as catalogSchemaDocument, o as formatCatalogMarkdown, t as buildCatalog } from "./catalog-doc-Cdn7-0pQ.js";
 import { a as loadModule, i as loadConfiguredPolicy, r as leavesOf, s as pickNamed, t as asPermissionTree } from "./load-DFS_ry0W.js";
-import { a as loadConfiguredOperations, i as scanSources, r as runCollect } from "./collect-CrZJJnEF.js";
+import { a as loadConfiguredOperations, i as scanSources, r as runCollect } from "./collect-mLTY4nwb.js";
 import { n as fileSummary, t as applyFiles } from "./files-C5ZI27eV.js";
 import { existsSync, readFileSync } from "node:fs";
 import { resolve } from "node:path";

package/dist/{catalog-doc-C9wjsfNY.js → catalog-doc-Cdn7-0pQ.js}

@@ -1,6 +1,6 @@
 import { a as getResource, c as listPermissions, h as formerKeys } from "./permission-registry-Br4jSNVi.js";
 import { t as canonicalJson } from "./canonical-json-BC8_nMTw.js";
-import { m as findRole, v as listRoles } from "./grantee-Cn1HyUsI.js";
+import { m as findRole, v as listRoles } from "./grantee-hxrUsbpM.js";
 import { i as wireValidity } from "./validity-CZ7-y0Cj.js";
 import { t as byCodePoint } from "./compare-pfyVnBjE.js";
 import { t as catalogFingerprint } from "./catalog-fingerprint-CCP0-yQS.js";

package/dist/chat/index.d.ts

@@ -1,2 +1,2 @@
-import { a as ChatCommandResult, c as createPermDock, d as SubjectFromChatOptions, f as isChatAuthor, i as ChatCommandContext, l as ChatAuthor, n as ChatActionResult, o as ChatPermDock, p as subjectFromChat, r as ChatCommand, s as ChatPermDockOptions, t as ChatAction, u as ChatPrincipal } from "../create-0VZ7Pdiu.js";
+import { a as ChatCommandResult, c as createPermDock, d as SubjectFromChatOptions, f as isChatAuthor, i as ChatCommandContext, l as ChatAuthor, n as ChatActionResult, o as ChatPermDock, p as subjectFromChat, r as ChatCommand, s as ChatPermDockOptions, t as ChatAction, u as ChatPrincipal } from "../create-B30OMUOJ.js";
 export { type ChatAction, type ChatActionResult, type ChatAuthor, type ChatCommand, type ChatCommandContext, type ChatCommandResult, type ChatPermDock, type ChatPermDockOptions, type ChatPrincipal, type SubjectFromChatOptions, createPermDock, isChatAuthor, subjectFromChat };

package/dist/chat/index.js

@@ -2,9 +2,9 @@ import { t as compact } from "../compact-CAf557ZB.js";
 import { n as freezeDeep } from "../freeze-CrU8nQeX.js";
 import { n as loadPrincipalByIdentity } from "../principal-source-pHneukrx.js";
 import { f as nowMillis } from "../time-DkWjdL98.js";
-import { c as withApp, t as getPermDock } from "../permdock-B9JxkBwC.js";
+import { c as withApp, t as getPermDock } from "../permdock-BrAscV28.js";
 import { c as isApprovalError } from "../types-DqzsnlSA.js";
-import { a as requestApproval, o as resolveApproval, s as resumeDecision } from "../helpers-DTcZOzhF.js";
+import { a as requestApproval, o as resolveApproval, s as resumeDecision } from "../helpers-CBYVMjwh.js";
 import { t as approvalPrompt } from "../approval-prompt-Dg5LeAcT.js";
 //#region src/chat/subject.ts
 function nonEmpty(value) {

package/dist/chat-sdk/index.d.ts

@@ -1,6 +1,6 @@
-import { n as ApprovalUrl, t as ApprovalPrompt } from "../approval-prompt-Djo_PyZc.js";
-import { l as ChatAuthor, n as ChatActionResult, o as ChatPermDock } from "../create-0VZ7Pdiu.js";
-import { n as ChatTransport } from "../types-DX0LaKTb.js";
+import { n as ApprovalUrl, t as ApprovalPrompt } from "../approval-prompt-DvSSPQJX.js";
+import { l as ChatAuthor, n as ChatActionResult, o as ChatPermDock } from "../create-B30OMUOJ.js";
+import { n as ChatTransport } from "../types-BtHtcKMr.js";
 import { ActionEvent, Author, CardElement } from "chat";
 //#region src/chat-sdk/author.d.ts
 type ChatSdkAuthorOptions = {

package/dist/claude-agent/index.d.ts

@@ -1,6 +1,6 @@
-import { T as Policy, j as PolicyVocabulary, rr as Principal } from "../policy-types-DzwivBgR.js";
-import { r as PermDock } from "../permdock-D7eeLJER.js";
-import { o as AgentAdapterOptions, t as AgentPermDock } from "../create-BDS7wc3y.js";
+import { T as Policy, j as PolicyVocabulary, rr as Principal } from "../policy-types-n0uRTsW8.js";
+import { r as PermDock } from "../permdock-SV8ZINYT.js";
+import { o as AgentAdapterOptions, t as AgentPermDock } from "../create-CBMmFie-.js";
 //#region src/claude-agent/create.d.ts
 /** Structural `McpServerProvenance` from `@anthropic-ai/claude-agent-sdk`. */
 type ClaudeMcpServer = {

package/dist/claude-agent/index.js

@@ -1,6 +1,6 @@
 import { r as isRecord, t as compact } from "../compact-CAf557ZB.js";
-import { c as withApp } from "../permdock-B9JxkBwC.js";
-import { t as agentRuntime } from "../create-C3b4B5eF.js";
+import { c as withApp } from "../permdock-BrAscV28.js";
+import { t as agentRuntime } from "../create-CGm28gyI.js";
 //#region src/claude-agent/create.ts
 const MCP_PREFIX = "mcp__";
 function asInput(input) {

package/dist/clerk/index.d.ts

@@ -1,6 +1,6 @@
-import { W as CustomRoleSource, ir as Subject, rr as Principal } from "../policy-types-DzwivBgR.js";
-import { w as Permission } from "../vocabulary-D6lPdb4Z.js";
-import { s as RemotePdpCache } from "../types-ClZaWzfb.js";
+import { W as CustomRoleSource, ar as Subject, rr as Principal } from "../policy-types-n0uRTsW8.js";
+import { w as Permission } from "../vocabulary-CN8H_9UF.js";
+import { s as RemotePdpCache } from "../types-_WhUP7ud.js";
 import { t as ClaimsMap } from "../claims-map-Ca-QX8C6.js";
 import { StandardSchemaV1 } from "@standard-schema/spec";
 //#region src/clerk/types.d.ts

package/dist/cli/bin.js

@@ -11,7 +11,7 @@ if (argv.length === 1 && (argv[0] === "--version" || argv[0] === "-v")) {
 	const [{ isCi }, { trapSignals }, { run }, { streamHasColors }] = await Promise.all([
 		import("../env-DJZrPjRi.js"),
 		import("../signals-D3NcTKUS.js"),
-		import("../run-CNsApDpd.js"),
+		import("../run-DDwUaJDU.js"),
 		import("../style-DiKWnAvn.js")
 	]);
 	const signals = trapSignals();

package/dist/cli/index.d.ts

@@ -1,6 +1,6 @@
-import { a as CatalogDocument, d as CatalogRole, f as CatalogScope, l as CatalogPermission, m as CatalogUsage, n as CatalogApproval, p as CatalogSupportAccess, r as CatalogBreakGlass, t as CatalogActivation, u as CatalogResource } from "../types-CZTnPFzM.js";
-import { a as pushedPolicy, i as parsePushedPolicy, n as PushedGrant, r as PushedPolicy, t as PUSHED_POLICY_SCHEMA } from "../pushed-policy-BImMTTIM.js";
-import { _ as RunResult, c as RlsConfig, d as RlsMembershipTable, f as RlsMemberships, g as RlsTarget, h as RlsSuspension, i as PermDockConfig, l as RlsDialect, m as RlsSuspendedScope, n as CliIo, o as RlsActiveRow, p as RlsSuspendedMembership, r as CollectConfig, s as RlsApiKeys, t as CatalogConfig, u as RlsFunctionMapping } from "../types-5Ut_pbKy.js";
+import { a as CatalogDocument, d as CatalogRole, f as CatalogScope, l as CatalogPermission, m as CatalogUsage, n as CatalogApproval, p as CatalogSupportAccess, r as CatalogBreakGlass, t as CatalogActivation, u as CatalogResource } from "../types-Druu9wLM.js";
+import { a as pushedPolicy, i as parsePushedPolicy, n as PushedGrant, r as PushedPolicy, t as PUSHED_POLICY_SCHEMA } from "../pushed-policy-DCW91KQU.js";
+import { _ as RunResult, c as RlsConfig, d as RlsMembershipTable, f as RlsMemberships, g as RlsTarget, h as RlsSuspension, i as PermDockConfig, l as RlsDialect, m as RlsSuspendedScope, n as CliIo, o as RlsActiveRow, p as RlsSuspendedMembership, r as CollectConfig, s as RlsApiKeys, t as CatalogConfig, u as RlsFunctionMapping } from "../types-Dfv0aTER.js";
 //#region src/cli/catalog-path.d.ts
 /**
  * The absolute path `permdock collect` writes the catalog to: `collect.out`,

package/dist/cli/index.js

@@ -1,8 +1,8 @@
 import { t as catalogPath } from "../catalog-path-CnI0XTFK.js";
 import { t as defineConfig } from "../config-bs_kZeYq.js";
-import { n as parsePushedPolicy, r as pushedPolicy, t as PUSHED_POLICY_SCHEMA } from "../pushed-policy-DobP7AHI.js";
+import { n as parsePushedPolicy, r as pushedPolicy, t as PUSHED_POLICY_SCHEMA } from "../pushed-policy-CqtxkV4G.js";
 import { c as parseGrantsMarker, l as parseHookMarker } from "../markers-C6joDI3o.js";
-import { t as run } from "../run-DOfMtc9V.js";
+import { t as run } from "../run-CUKuz0A8.js";
 //#region src/cli/token-schemas.ts
 const ID = {
 	type: "string",

package/dist/cloud/index.d.ts

@@ -1,11 +1,11 @@
-import { Jt as AutomationEvent, Kt as AccessEvent, Qt as DeliveryEvent, Rt as Instant, Xt as DecisionEvent, Yt as CredentialEvent, Zt as DeliveryChannel, en as DirectoryEvent, nn as MembershipEvent, ut as TokenSigner } from "../policy-types-DzwivBgR.js";
-import { m as ApprovalStore } from "../types-CCpc2Dcv.js";
-import { i as CatalogEventData, l as CloudEventType, r as CLOUD_EVENT_TYPES, s as CloudEvent } from "../sink-Bj_lDUDq.js";
-import { c as DeliveryTransport } from "../types-DX0LaKTb.js";
-import { a as CloudConnectionOptions, c as CloudOptions, i as CloudClient, l as CloudSignerOptions, n as CloudCatalog, o as CloudEndpointOptions, r as CloudCatalogPush, s as CloudEndpoints, t as CloudApproverOptions } from "../types-C8-KNsFf.js";
-import { n as ApprovalWaiter } from "../waiter-CKy4MQSY.js";
-import { l as ReplayStore } from "../types-DiQjupG2.js";
-import { f as WebhookVerifier, r as WebhookFailureCause$1, s as WebhookJwks } from "../standard-webhooks-6lg8v_is.js";
+import { Jt as AutomationEvent, Kt as AccessEvent, Qt as DeliveryEvent, Rt as Instant, Xt as DecisionEvent, Yt as CredentialEvent, Zt as DeliveryChannel, en as DirectoryEvent, nn as MembershipEvent, ut as TokenSigner } from "../policy-types-n0uRTsW8.js";
+import { m as ApprovalStore } from "../types-BdtSDbBO.js";
+import { i as CatalogEventData, l as CloudEventType, r as CLOUD_EVENT_TYPES, s as CloudEvent } from "../sink-4-eQIRWf.js";
+import { c as DeliveryTransport } from "../types-BtHtcKMr.js";
+import { a as CloudConnectionOptions, c as CloudOptions, i as CloudClient, l as CloudSignerOptions, n as CloudCatalog, o as CloudEndpointOptions, r as CloudCatalogPush, s as CloudEndpoints, t as CloudApproverOptions } from "../types-8RnwUAvE.js";
+import { n as ApprovalWaiter } from "../waiter-B986w1oK.js";
+import { l as ReplayStore } from "../types-C791HFu9.js";
+import { f as WebhookVerifier, r as WebhookFailureCause$1, s as WebhookJwks } from "../standard-webhooks-rbD7LS6h.js";
 //#region src/cloud/request.d.ts
 /**
  * The environment URL and JWK Set URL `cloud()` uses, resolved with the same

package/dist/cloud/index.js

@@ -7,7 +7,7 @@ import { c as problemResponse } from "../problem-CTviyH5L.js";
 import { n as webhookVerifier } from "../standard-webhooks-DgFFD-Ga.js";
 import { t as pollingApprovalWaiter } from "../waiter-BGUtGYoU.js";
 import { i as isDeliveryTarget } from "../target-Bw37TFNA.js";
-import { i as isCompactJws, n as cloudConnection, r as cloudEndpoints, t as cloud } from "../create-BWRSXgOF.js";
+import { i as isCompactJws, n as cloudConnection, r as cloudEndpoints, t as cloud } from "../create-CQWIpUG-.js";
 //#region src/cloud/delivery.ts
 function failed(cause, retryable, reason) {
 	return {

package/dist/{cloud-CIoHNevm.js → cloud-ytQ3uviA.js}

@@ -41,7 +41,7 @@ const push = defineLeaf({
 	},
 	async run(ctx, { flags }) {
 		const env = await withStdinSecret(ctx, "key", flags["key-stdin"], "PERMDOCK_CLOUD_KEY");
-		return (await import("./push-CmFVBOeI.js")).runCloud({
+		return (await import("./push-BD4f15co.js")).runCloud({
 			cwd: ctx.cwd,
 			config: ctx.config,
 			url: given(flags.url),
@@ -70,7 +70,7 @@ const pull = defineLeaf({
 	},
 	async run(ctx, { flags }) {
 		const env = await withStdinSecret(ctx, "token", flags["token-stdin"], "PERMDOCK_CLOUD_TOKEN");
-		const { runCloudPull } = await import("./pull-ByOks_Tg.js");
+		const { runCloudPull } = await import("./pull-CvpINcMK.js");
 		return runCloudPull({
 			cwd: ctx.cwd,
 			config: ctx.config,