permdock 0.5.0 → 0.6.0

package/dist/{codemod-Bmj9dWMH.js → codemod-5mpSpnUY.js}

@@ -7,7 +7,7 @@ const codemod = defineLeaf({
 		description: "The release to migrate to (0.5)",
 		required: true,
 		async complete() {
-			return (await import("./codemod-Cxvvc70T.js")).codemodVersions();
+			return (await import("./codemod-ua2hHy7w.js")).codemodVersions();
 		}
 	}, {
 		name: "paths",
@@ -22,7 +22,7 @@ const codemod = defineLeaf({
 		}
 	},
 	async run(ctx, { flags, args, rest }) {
-		const { runCodemod } = await import("./codemod-Cxvvc70T.js");
+		const { runCodemod } = await import("./codemod-ua2hHy7w.js");
 		return runCodemod({
 			cwd: ctx.cwd,
 			version: args["version"],

package/dist/{codemod-Cxvvc70T.js → codemod-ua2hHy7w.js}

@@ -1,7 +1,7 @@
 import { n as CliError } from "./errors-CWTY6uih.js";
 import { a as rel } from "./files-D_JIzUrP.js";
 import { t as beforeFirst } from "./text-BMFRfBqc.js";
-import { n as ROOT } from "./manifest-CtKR3GXL.js";
+import { n as ROOT } from "./manifest-dvL2XEe1.js";
 import { i as renameMessage, n as DEFAULT_CHANGES, r as flagRename, t as COMMAND_MOVES } from "./renames-CGj7YwcQ.js";
 import { r as refuseDirty, t as applyFiles } from "./files-C5ZI27eV.js";
 import { readFileSync, readdirSync, statSync } from "node:fs";

package/dist/{collect-DloHbDVa.js → collect-Ci6akVwH.js}

@@ -29,10 +29,10 @@ const collect = defineLeaf({
 		};
 		if (flags.watch) {
 			if (flags.check) throw new CliError("usage", "collect: --watch writes the catalog; drop --check", { code: "invalid_value" });
-			const { watchCollect } = await import("./watch-Cb-NcaUw.js");
+			const { watchCollect } = await import("./watch--ovlPOc0.js");
 			return watchCollect(ctx, overrides);
 		}
-		const result = await (await import("./collect-FlXJlhus.js")).runCollect({
+		const result = await (await import("./collect-D7eQDffE.js")).runCollect({
 			cwd: ctx.cwd,
 			config: ctx.config,
 			collect: overrides,

package/dist/collect-D7eQDffE.js

@@ -0,0 +1 @@
+export { r as runCollect } from "./collect-mLTY4nwb.js";

package/dist/{collect-CrZJJnEF.js → collect-mLTY4nwb.js}

@@ -1,10 +1,10 @@
 import { r as isRecord } from "./compact-CAf557ZB.js";
-import { T as isOperationEffect } from "./src-DLfUWFAI.js";
+import { T as isOperationEffect } from "./src-Cu2m75uo.js";
 import { o as isPermission } from "./permission-registry-Br4jSNVi.js";
 import { r as isOperationRisk } from "./permissions-B-wCP5ZC.js";
 import { a as describeError, i as configError } from "./errors-CWTY6uih.js";
 import { a as rel, r as listSourceFiles, s as writeFileEnsuringDir, t as defaultSrcPath } from "./files-D_JIzUrP.js";
-import { a as formatCatalogJson, n as catalogForCompare, t as buildCatalog } from "./catalog-doc-C9wjsfNY.js";
+import { a as formatCatalogJson, n as catalogForCompare, t as buildCatalog } from "./catalog-doc-Cdn7-0pQ.js";
 import { a as loadModule, i as loadConfiguredPolicy, r as leavesOf, s as pickNamed, t as asPermissionTree } from "./load-DFS_ry0W.js";
 import { t as catalogPath } from "./catalog-path-CnI0XTFK.js";
 import { t as shortDiff } from "./text-diff-BQcUapOb.js";

package/dist/compile/index.d.ts

@@ -1,3 +1,3 @@
 import { n as GraphSqlPart, r as RelationsMapping, t as GraphSql } from "../graph-sql-B-dsAT6j.js";
-import { a as CompiledWhere, c as compileWhere, i as CompiledSql, l as escapeLike, n as CompiledCompare, o as MembershipTable, r as CompiledExists, s as MembershipsMapping, t as CompileWhereOptions } from "../compile-Ckm2HqBZ.js";
+import { a as CompiledWhere, c as compileWhere, i as CompiledSql, l as escapeLike, n as CompiledCompare, o as MembershipTable, r as CompiledExists, s as MembershipsMapping, t as CompileWhereOptions } from "../compile-1bsAezL0.js";
 export { type CompileWhereOptions, type CompiledCompare, type CompiledExists, type CompiledSql, type CompiledWhere, type GraphSql, type GraphSqlPart, type MembershipTable, type MembershipsMapping, type RelationsMapping, compileWhere, escapeLike };

package/dist/{compile-Ckm2HqBZ.d.ts → compile-1bsAezL0.d.ts}

@@ -1,6 +1,6 @@
-import { Rt as Instant, cn as Scope, ir as Subject, lr as Condition } from "./policy-types-DzwivBgR.js";
-import { N as ResourceNode } from "./vocabulary-D6lPdb4Z.js";
-import { c as WhereResult } from "./permdock-D7eeLJER.js";
+import { Rt as Instant, ar as Subject, cn as Scope, ur as Condition } from "./policy-types-n0uRTsW8.js";
+import { N as ResourceNode } from "./vocabulary-CN8H_9UF.js";
+import { c as WhereResult } from "./permdock-SV8ZINYT.js";
 import { r as RelationsMapping, t as GraphSql } from "./graph-sql-B-dsAT6j.js";
 //#region src/conditions/compile.d.ts
 type MembershipTable = {

package/dist/{completion-BqhRBJD8.js → completion-BTFrHZhX.js}

@@ -1,6 +1,6 @@
 import { n as CliError } from "./errors-CWTY6uih.js";
 import { a as suggestion, o as GLOBAL_FLAGS } from "./args-IIolxxKA.js";
-import { a as resolve } from "./manifest-CtKR3GXL.js";
+import { a as resolve } from "./manifest-dvL2XEe1.js";
 import { t as defineLeaf } from "./command-L8EstFNm.js";
 //#region src/cli/core/completion.ts
 const SHELLS = [

package/dist/{config-B46rm9sc.js → config-Bj2Ixq3d.js}

@@ -10,7 +10,7 @@ const config = defineLeaf({
 		...failOnFlag
 	},
 	async run(ctx, { flags }) {
-		const { runConfig } = await import("./config-report-DUgj62Ai.js");
+		const { runConfig } = await import("./config-report-DSpsLpCE.js");
 		return runConfig({
 			cwd: ctx.cwd,
 			config: ctx.config,

package/dist/{config-report-DUgj62Ai.js → config-report-DSpsLpCE.js}

@@ -1,9 +1,9 @@
 import { a as rel, t as defaultSrcPath } from "./files-D_JIzUrP.js";
 import { r as CONFIG_REPORT_SCHEMA } from "./version-CEbQ5UeM.js";
-import { n as guessPermissions, t as barrelFile } from "./collect-CrZJJnEF.js";
+import { n as guessPermissions, t as barrelFile } from "./collect-mLTY4nwb.js";
 import { t as catalogPath } from "./catalog-path-CnI0XTFK.js";
 import "./sources-vs5dGOsS.js";
-import { t as DOCS_BASE } from "./manifest-CtKR3GXL.js";
+import { t as DOCS_BASE } from "./manifest-dvL2XEe1.js";
 import { n as MIGRATION_DIRS, t as DEFAULT_SENSITIVE_ACTIONS } from "./constants-DcJABbLW.js";
 //#region src/cli/config-report.ts
 function configReport(input) {

package/dist/{context-bbFHR-0D.js → context-B_u3_bDJ.js}

@@ -1,6 +1,6 @@
 import { t as compact } from "./compact-CAf557ZB.js";
-import { i as isPromiseLike } from "./store-options-BqEakYRa.js";
-import { n as switchTenant, t as providerStore } from "./provider-store-B5Yrkhzr.js";
+import { i as isPromiseLike } from "./store-options-u0ycEe8s.js";
+import { n as switchTenant, t as providerStore } from "./provider-store-DM6DNcta.js";
 import { getContext, onDestroy, setContext } from "svelte";
 import { toStore } from "svelte/store";
 //#region src/svelte/context.ts

package/dist/convex/index.d.ts

@@ -1,8 +1,8 @@
-import { T as Policy, j as PolicyVocabulary, rr as Principal } from "../policy-types-DzwivBgR.js";
-import { w as Permission } from "../vocabulary-D6lPdb4Z.js";
-import { r as PermDock } from "../permdock-D7eeLJER.js";
-import { a as ProblemDetails, r as PermDockDeniedError } from "../errors-C2PXIv4c.js";
-import { t as InstanceOptions } from "../instance-options-Omfd793B.js";
+import { T as Policy, j as PolicyVocabulary, rr as Principal } from "../policy-types-n0uRTsW8.js";
+import { w as Permission } from "../vocabulary-CN8H_9UF.js";
+import { r as PermDock } from "../permdock-SV8ZINYT.js";
+import { a as ProblemDetails, r as PermDockDeniedError } from "../errors-DH5QEGXh.js";
+import { t as InstanceOptions } from "../instance-options-BsVpyGIk.js";
 //#region src/convex/types.d.ts
 type ConvexContextLike = {
   readonly auth?: {

package/dist/convex/index.js

@@ -1,8 +1,8 @@
 import { t as compact } from "../compact-CAf557ZB.js";
 import { n as PermDockValidationError } from "../validation-error-ZfUHbKvf.js";
 import { n as PermDockDeniedError, t as PermDockApprovalRequiredError } from "../errors-BKy0EfhN.js";
-import { c as withApp } from "../permdock-B9JxkBwC.js";
-import { n as resolveOrNull, t as buildInstance } from "../build-instance-BMnAudHn.js";
+import { c as withApp } from "../permdock-BrAscV28.js";
+import { n as resolveOrNull, t as buildInstance } from "../build-instance-Bu_eDqYw.js";
 import { n as tenantScope, t as actorFrom } from "../adapter-context-CRhqyzCk.js";
 //#region src/convex/create.ts
 /** Convex's runtime sends `data` to the client only for an error carrying this symbol. */

package/dist/{create-0VZ7Pdiu.d.ts → create-B30OMUOJ.d.ts}

@@ -1,9 +1,9 @@
-import { Ln as DeniedDecision, Mn as ApprovalRequiredDecision, T as Policy, ir as Subject, j as PolicyVocabulary, rr as Principal, zn as GrantedDecision } from "./policy-types-DzwivBgR.js";
-import { t as Operation } from "./operations-CxybZErY.js";
-import { i as PermDockOptions, p as PrincipalSource, r as PermDock } from "./permdock-D7eeLJER.js";
-import { m as ApprovalStore, p as ApprovalStatus } from "./types-CCpc2Dcv.js";
+import { Ln as DeniedDecision, Mn as ApprovalRequiredDecision, T as Policy, ar as Subject, j as PolicyVocabulary, rr as Principal, zn as GrantedDecision } from "./policy-types-n0uRTsW8.js";
+import { t as Operation } from "./operations-X0VM7F3m.js";
+import { i as PermDockOptions, p as PrincipalSource, r as PermDock } from "./permdock-SV8ZINYT.js";
+import { m as ApprovalStore, p as ApprovalStatus } from "./types-BdtSDbBO.js";
 import { n as ApprovalErrorCode } from "./errors-BWXBMaKK.js";
-import { t as ApprovalPrompt } from "./approval-prompt-Djo_PyZc.js";
+import { t as ApprovalPrompt } from "./approval-prompt-DvSSPQJX.js";
 //#region src/chat/subject.d.ts
 /**
  * The platform user behind a chat message or action. Fill it only from an

package/dist/{create-BDS7wc3y.d.ts → create-CBMmFie-.d.ts}

@@ -1,13 +1,13 @@
-import { $n as Delegation, Nn as Decision, T as Policy, ir as Subject, j as PolicyVocabulary, rr as Principal } from "./policy-types-DzwivBgR.js";
-import { w as Permission } from "./vocabulary-D6lPdb4Z.js";
-import { t as Operation } from "./operations-CxybZErY.js";
-import { r as PermDock } from "./permdock-D7eeLJER.js";
-import { m as ApprovalStore } from "./types-CCpc2Dcv.js";
-import { t as InstanceOptions } from "./instance-options-Omfd793B.js";
+import { $n as Delegation, Nn as Decision, T as Policy, ar as Subject, j as PolicyVocabulary, rr as Principal } from "./policy-types-n0uRTsW8.js";
+import { w as Permission } from "./vocabulary-CN8H_9UF.js";
+import { t as Operation } from "./operations-X0VM7F3m.js";
+import { r as PermDock } from "./permdock-SV8ZINYT.js";
+import { m as ApprovalStore } from "./types-BdtSDbBO.js";
+import { t as InstanceOptions } from "./instance-options-BsVpyGIk.js";
 import { t as RequestContext } from "./request-context-C2_1lchh.js";
-import { n as PermDockWrap } from "./wrap-Bd1Tejur.js";
-import { o as OtelWrap } from "./types-BqAKcRNW.js";
-import { t as DeniedText } from "./denied-text-D8jDHgsl.js";
+import { n as PermDockWrap } from "./wrap-C5jC6sKI.js";
+import { o as OtelWrap } from "./types-lUlG3TVd.js";
+import { t as DeniedText } from "./denied-text-CiFQNuMV.js";
 //#region src/agent/types.d.ts
 /** The part of an operation a tool decision reads; an `OperationMap` entry is one. */
 type ToolBinding = Pick<Operation, "permission" | "data" | "results"> & Partial<Pick<Operation, "name" | "meta">>;

package/dist/{create-C3b4B5eF.js → create-CGm28gyI.js}

@@ -1,10 +1,10 @@
 import { t as compact } from "./compact-CAf557ZB.js";
 import { n as freezeDeep } from "./freeze-CrU8nQeX.js";
-import { a as deniedFor } from "./where-scope-Dv-WTP-w.js";
-import { c as withApp } from "./permdock-B9JxkBwC.js";
+import { a as deniedFor } from "./where-scope-C9vfEphl.js";
+import { c as withApp } from "./permdock-BrAscV28.js";
 import { t as composeWraps } from "./wrap-gX61EtpB.js";
-import { r as instanceOptions } from "./build-instance-BMnAudHn.js";
-import { n as createAgentKernel } from "./kernel-5JatXyND.js";
+import { r as instanceOptions } from "./build-instance-Bu_eDqYw.js";
+import { n as createAgentKernel } from "./kernel-D0NVb1cK.js";
 //#region src/agent/create.ts
 function modelRow(modelId) {
 	return { id: modelId };

package/dist/{create-BWRSXgOF.js → create-CQWIpUG-.js}

@@ -1,7 +1,7 @@
 import { r as isRecord, t as compact } from "./compact-CAf557ZB.js";
 import { n as freezeDeep } from "./freeze-CrU8nQeX.js";
 import { i as dateAt, p as nowSeconds } from "./time-DkWjdL98.js";
-import { s as policyDocumentFromClaims } from "./hosted-BZIAYvon.js";
+import { s as policyDocumentFromClaims } from "./hosted-B46-5LYE.js";
 import { l as isApprovalErrorCode, s as ApprovalError, t as APPROVAL_HEADER } from "./types-DqzsnlSA.js";
 import { h as toCloudEvent, l as isAbsoluteUri } from "./sink-BEZSlMS_.js";
 import { n as parseCatalogEventData, t as catalogFingerprint } from "./catalog-fingerprint-CCP0-yQS.js";

package/dist/{create-DnrmLnLW.js → create-DCF2SvoT.js}

@@ -3,13 +3,13 @@ import { n as freezeDeep } from "./freeze-CrU8nQeX.js";
 import { n as problemDetails } from "./problem-details-cn5X30gZ.js";
 import { c as listPermissions } from "./permission-registry-Br4jSNVi.js";
 import { n as resourceRef } from "./resource-ref-CaS9yVPi.js";
-import { c as withApp, i as challengeScope } from "./permdock-B9JxkBwC.js";
+import { c as withApp, i as challengeScope } from "./permdock-BrAscV28.js";
 import { r as hasCredentials } from "./http-BBoKefeS.js";
 import { i as decisionResponse, o as notFoundProblem, s as problemFromDecision, t as ANONYMOUS, u as unauthenticatedProblem } from "./problem-CTviyH5L.js";
-import { n as resolveOrNull } from "./build-instance-BMnAudHn.js";
-import { n as applyApprovalResume, o as evaluationsHandler, u as InvalidSignatureError } from "./evaluations-DZ2CbV5k.js";
+import { n as resolveOrNull } from "./build-instance-Bu_eDqYw.js";
+import { n as applyApprovalResume, o as evaluationsHandler, u as InvalidSignatureError } from "./evaluations-beAooV0n.js";
 import { n as tenantScope, t as actorFrom } from "./adapter-context-CRhqyzCk.js";
-import { n as requestContext, t as buildReportingInstance } from "./request-context-BTRTG7OT.js";
+import { n as requestContext, t as buildReportingInstance } from "./request-context-C81Pip9n.js";
 //#region src/server/kernel-problems.ts
 const NOT_DELEGATED = freezeDeep({
 	outcome: "denied",

package/dist/{create-BFfm17UA.d.ts → create-D_NmPOdH.d.ts}

@@ -1,10 +1,10 @@
-import { Nn as Decision, Pn as Denial, Rt as Instant, T as Policy, dt as TokenVerifier, j as PolicyVocabulary, qt as AuthEvent, rr as Principal, ut as TokenSigner } from "./policy-types-DzwivBgR.js";
-import { w as Permission } from "./vocabulary-D6lPdb4Z.js";
-import { i as PermDockOptions, p as PrincipalSource, r as PermDock, t as DecideOptions } from "./permdock-D7eeLJER.js";
-import { m as ApprovalStore } from "./types-CCpc2Dcv.js";
-import { a as AutomationSource } from "./automation-BMZPIVUM.js";
-import { n as ApprovalWaiter } from "./waiter-CKy4MQSY.js";
-import { n as RunAutomation, r as RunBinding } from "./run-ticket-BjhTOi6u.js";
+import { Nn as Decision, Pn as Denial, Rt as Instant, T as Policy, dt as TokenVerifier, j as PolicyVocabulary, qt as AuthEvent, rr as Principal, ut as TokenSigner } from "./policy-types-n0uRTsW8.js";
+import { w as Permission } from "./vocabulary-CN8H_9UF.js";
+import { i as PermDockOptions, p as PrincipalSource, r as PermDock, t as DecideOptions } from "./permdock-SV8ZINYT.js";
+import { m as ApprovalStore } from "./types-BdtSDbBO.js";
+import { a as AutomationSource } from "./automation-BNM3TtDo.js";
+import { n as ApprovalWaiter } from "./waiter-B986w1oK.js";
+import { n as RunAutomation, r as RunBinding } from "./run-ticket-DocwaTKn.js";
 //#region src/workflow/create.d.ts
 type WorkflowPermDockOptions = PermDockOptions & {
   /** Signs the run tickets `start` mints. */

package/dist/{credential-DM2um3ha.js → credential-BcoiejpY.js}

@@ -7,8 +7,8 @@ import { c as listPermissions, h as formerKeys } from "./permission-registry-Br4
 import { g as secondsOf, l as isRfc3339, m as rfc3339, p as nowSeconds } from "./time-DkWjdL98.js";
 import { t as canonicalJson } from "./canonical-json-BC8_nMTw.js";
 import { r as sha256Digest } from "./sha256-D9ihqmvd.js";
-import { n as coveredByDelegation } from "./delegation-DaXVdDhM.js";
-import { o as flattenGrantee } from "./grantee-Cn1HyUsI.js";
+import { n as coveredByDelegation } from "./delegation-j6-rc37o.js";
+import { o as flattenGrantee } from "./grantee-hxrUsbpM.js";
 import { t as anonymousSubject } from "./subject-BGoM5o8B.js";
 //#region src/core/credential.ts
 /** A feed id: lowercase, so a mail system that lowercases a local part still matches. At most 16 characters, so `pdfeed_<id>_<secret>` fits an email local part. */

package/dist/{delegation-DaXVdDhM.js → delegation-j6-rc37o.js}

@@ -6,9 +6,9 @@ import { g as formerScopes, m as annotationsFor, n as findPermission } from "./p
 import { o as epochSeconds } from "./time-DkWjdL98.js";
 import { d as scopeList, m as tenantOf, o as resolveScope, p as subjectMemberships } from "./scopes-CUPSjo9q.js";
 import { t as isoInstant } from "./instant-BluqDvyS.js";
-import { o as flattenGrantee } from "./grantee-Cn1HyUsI.js";
+import { o as flattenGrantee } from "./grantee-hxrUsbpM.js";
 import { t as isActive } from "./validity-CZ7-y0Cj.js";
-import { n as matchGrantee } from "./grantee-match-DHArqY82.js";
+import { n as matchGrantee } from "./grantee-match-DbENBHLB.js";
 //#region src/conditions/evaluate.ts
 function resolveRef(ref, subject) {
 	return resolveConditionRef(ref, subject);

package/dist/delivery/index.d.ts

@@ -1,5 +1,5 @@
-import { $t as DeliveryFailureCause, Zt as DeliveryChannel, tn as EmailCategory } from "../policy-types-DzwivBgR.js";
-import { i as approvalUrlFor, n as ApprovalUrl, r as approvalPrompt, t as ApprovalPrompt } from "../approval-prompt-Djo_PyZc.js";
-import { _ as TransportOptions, a as DeliveryReport, c as DeliveryTransport, d as EmailTransport, f as EmailUnsubscribe, g as TransportMessages, h as TransportItem, i as DeliveryMessages, l as DeliveryTransports, m as Recipient, n as ChatTransport, o as DeliveryResult, p as OutgoingEmail, r as DeliverOptions, s as DeliveryTarget, t as ChatMessage, u as EmailMessage, v as WebhookMessage, y as WebhookTransport } from "../types-DX0LaKTb.js";
-import { a as DeliveryPermDock, c as MemoryDelivery, d as memoryDeliveryTransport, f as Audience, g as subscribersFor, h as audience, i as isDeliveryTarget, l as MemoryDeliveryTransport, m as SubscriberEvent, n as webhookTransport, o as DeliveryPermDockOptions, p as AudienceOptions, r as isAddrSpec, s as createPermDock, t as WebhookTransportOptions, u as MemoryDeliveryTransportOptions } from "../index-BcHcPyIo.js";
+import { $t as DeliveryFailureCause, Zt as DeliveryChannel, tn as EmailCategory } from "../policy-types-n0uRTsW8.js";
+import { i as approvalUrlFor, n as ApprovalUrl, r as approvalPrompt, t as ApprovalPrompt } from "../approval-prompt-DvSSPQJX.js";
+import { _ as TransportOptions, a as DeliveryReport, c as DeliveryTransport, d as EmailTransport, f as EmailUnsubscribe, g as TransportMessages, h as TransportItem, i as DeliveryMessages, l as DeliveryTransports, m as Recipient, n as ChatTransport, o as DeliveryResult, p as OutgoingEmail, r as DeliverOptions, s as DeliveryTarget, t as ChatMessage, u as EmailMessage, v as WebhookMessage, y as WebhookTransport } from "../types-BtHtcKMr.js";
+import { a as DeliveryPermDock, c as MemoryDelivery, d as memoryDeliveryTransport, f as Audience, g as subscribersFor, h as audience, i as isDeliveryTarget, l as MemoryDeliveryTransport, m as SubscriberEvent, n as webhookTransport, o as DeliveryPermDockOptions, p as AudienceOptions, r as isAddrSpec, s as createPermDock, t as WebhookTransportOptions, u as MemoryDeliveryTransportOptions } from "../index-CueFnxQc.js";
 export { type ApprovalPrompt, type ApprovalUrl, type Audience, type AudienceOptions, type ChatMessage, type ChatTransport, type DeliverOptions, type DeliveryChannel, type DeliveryFailureCause, type DeliveryMessages, type DeliveryPermDock, type DeliveryPermDockOptions, type DeliveryReport, type DeliveryResult, type DeliveryTarget, type DeliveryTransport, type DeliveryTransports, type EmailCategory, type EmailMessage, type EmailTransport, type EmailUnsubscribe, type MemoryDelivery, type MemoryDeliveryTransport, type MemoryDeliveryTransportOptions, type OutgoingEmail, type Recipient, type SubscriberEvent, type TransportItem, type TransportMessages, type TransportOptions, type WebhookMessage, type WebhookTransport, type WebhookTransportOptions, approvalPrompt, approvalUrlFor, audience, createPermDock, isAddrSpec, isDeliveryTarget, memoryDeliveryTransport, subscribersFor, webhookTransport };

package/dist/delivery/index.js

@@ -1,5 +1,5 @@
 import { n as approvalUrlFor, t as approvalPrompt } from "../approval-prompt-Dg5LeAcT.js";
-import { n as subscribersFor, t as audience } from "../audience-Dg8XsRaO.js";
+import { n as subscribersFor, t as audience } from "../audience-DabClFLQ.js";
 import { i as isDeliveryTarget, n as isAddrSpec } from "../target-Bw37TFNA.js";
 import { n as createPermDock, r as memoryDeliveryTransport, t as webhookTransport } from "../delivery-DCAgNyCn.js";
 export { approvalPrompt, approvalUrlFor, audience, createPermDock, isAddrSpec, isDeliveryTarget, memoryDeliveryTransport, subscribersFor, webhookTransport };

package/dist/{denied-text-D8jDHgsl.d.ts → denied-text-CiFQNuMV.d.ts}

@@ -1,5 +1,5 @@
-import { Nn as Decision } from "./policy-types-DzwivBgR.js";
-import { w as Permission } from "./vocabulary-D6lPdb4Z.js";
+import { Nn as Decision } from "./policy-types-n0uRTsW8.js";
+import { w as Permission } from "./vocabulary-CN8H_9UF.js";
 //#region src/agent/denied-text.d.ts
 /** What an agent adapter's `deniedText` receives: the refusal and the text PermDock wrote for it. */
 type DeniedTextEvent = {

package/dist/{describe-BZUsixiL.d.ts → describe-B5qgDvEW.d.ts}

@@ -1,5 +1,5 @@
-import { In as DenialReason, Ln as DeniedDecision, Nn as Decision } from "./policy-types-DzwivBgR.js";
-import { w as Permission } from "./vocabulary-D6lPdb4Z.js";
+import { In as DenialReason, Ln as DeniedDecision, Nn as Decision } from "./policy-types-n0uRTsW8.js";
+import { w as Permission } from "./vocabulary-CN8H_9UF.js";
 //#region src/core/describe.d.ts
 type DecisionDescription = {
   readonly kind: "granted" | "denied" | "approval" | "tenant" | "delegation" | "server-only" | "upgrade";

package/dist/{diff-DCePiN6M.js → diff-3jbx6Rm4.js}

@@ -1,10 +1,10 @@
-import { E as memoryCustomRoleSource } from "./src-DLfUWFAI.js";
+import { E as memoryCustomRoleSource } from "./src-Cu2m75uo.js";
 import { n as findPermission } from "./permission-registry-Br4jSNVi.js";
 import { g as secondsOf } from "./time-DkWjdL98.js";
 import { t as canonicalJson } from "./canonical-json-BC8_nMTw.js";
-import { t as getPermDock } from "./permdock-B9JxkBwC.js";
+import { t as getPermDock } from "./permdock-BrAscV28.js";
 import { i as configError, u as usageResult } from "./errors-CWTY6uih.js";
-import { t as buildCatalog } from "./catalog-doc-C9wjsfNY.js";
+import { t as buildCatalog } from "./catalog-doc-Cdn7-0pQ.js";
 import { a as loadModule, n as asPolicy, s as pickNamed } from "./load-DFS_ry0W.js";
 import { t as parseCatalog } from "./parse-Cxq0WxrA.js";
 import { t as operationFindings } from "./operation-findings-DgATDpvh.js";

package/dist/{diff-CxZo9pTq.js → diff-CmuSD3vc.js}

@@ -21,7 +21,7 @@ const diff = defineLeaf({
 		}
 	},
 	async run(ctx, { flags, args }) {
-		return (await import("./diff-DCePiN6M.js")).runDiff({
+		return (await import("./diff-3jbx6Rm4.js")).runDiff({
 			cwd: ctx.cwd,
 			config: ctx.config,
 			sources: [args["before"], args["after"]].filter((value) => value !== void 0),

package/dist/{doctor-CxiwSfqH.js → doctor-3ZqNHX_G.js}

@@ -10,7 +10,7 @@ const doctor = defineLeaf({
 			description: "Check codes or groups to run",
 			valueHint: "code",
 			async complete() {
-				const { DOCTOR_CHECKS } = await import("./doctor-DFjUxf2f.js");
+				const { DOCTOR_CHECKS } = await import("./doctor-BdZw53-k.js");
 				return [.../* @__PURE__ */ new Set([...DOCTOR_CHECKS.map(({ code }) => code), ...DOCTOR_CHECKS.flatMap(({ groups }) => groups)])];
 			}
 		},
@@ -27,7 +27,7 @@ const doctor = defineLeaf({
 			if (answer === void 0) return CANCELLED;
 			fix = answer;
 		}
-		return (await import("./doctor-DFjUxf2f.js")).runDoctor({
+		return (await import("./doctor-BdZw53-k.js")).runDoctor({
 			cwd: ctx.cwd,
 			config: ctx.config,
 			only: flags.only,

package/dist/{doctor-DFjUxf2f.js → doctor-BdZw53-k.js}

@@ -3,17 +3,17 @@ import { c as listPermissions, h as formerKeys } from "./permission-registry-Br4
 import { u as isPrincipalRelation } from "./resource-relations-D_jw0BFx.js";
 import { t as canonicalJson } from "./canonical-json-BC8_nMTw.js";
 import { a as normalizeMemberships, d as scopeList, o as resolveScope } from "./scopes-CUPSjo9q.js";
-import { o as flattenGrantee } from "./grantee-Cn1HyUsI.js";
-import { c as separationConflicts } from "./policy-DLZJ5gAp.js";
-import { x as validateCustomRole } from "./evaluate-_R8QkWaf.js";
-import { s as parseCredential } from "./credential-DM2um3ha.js";
+import { o as flattenGrantee } from "./grantee-hxrUsbpM.js";
+import { c as separationConflicts } from "./policy-DbM5YYtV.js";
+import { C as validateCustomRole } from "./evaluate-CNClBvcj.js";
+import { s as parseCredential } from "./credential-BcoiejpY.js";
 import { a as describeError } from "./errors-CWTY6uih.js";
 import { t as policyRowConditionKeys } from "./row-conditions-h2HythXQ.js";
 import { a as rel, n as doctorSrcPath, o as sqlFiles, r as listSourceFiles } from "./files-D_JIzUrP.js";
 import { i as DOCTOR_REPORT_SCHEMA } from "./version-CEbQ5UeM.js";
-import { r as catalogOAuthScopes, s as jsonSchemaOf } from "./catalog-doc-C9wjsfNY.js";
+import { r as catalogOAuthScopes, s as jsonSchemaOf } from "./catalog-doc-Cdn7-0pQ.js";
 import { a as loadModule, i as loadConfiguredPolicy, n as asPolicy, s as pickNamed } from "./load-DFS_ry0W.js";
-import { r as runCollect } from "./collect-CrZJJnEF.js";
+import { r as runCollect } from "./collect-mLTY4nwb.js";
 import { t as catalogPath } from "./catalog-path-CnI0XTFK.js";
 import { n as supabaseTenantClaim } from "./budget-NbEtbJC_.js";
 import { s as quoteSqlLiteral } from "./sql-B5T1IL83.js";
@@ -21,19 +21,19 @@ import { d as keptKeys, r as PERMDOCK_SCHEMA } from "./sources-vs5dGOsS.js";
 import { t as parseCatalog } from "./parse-Cxq0WxrA.js";
 import "./markers-C6joDI3o.js";
 import { t as didYouMean } from "./args-IIolxxKA.js";
-import { t as DOCS_BASE } from "./manifest-CtKR3GXL.js";
+import { t as DOCS_BASE } from "./manifest-dvL2XEe1.js";
 import { t as createStyle } from "./style-Uao76wO7.js";
-import { r as findingOf } from "./output-Dyw8fyPF.js";
+import { r as findingOf } from "./output-1im__-08.js";
 import { i as runSkillsInstall } from "./skills-B6lVdD_W.js";
 import { n as MIGRATION_DIRS, t as DEFAULT_SENSITIVE_ACTIONS } from "./constants-DcJABbLW.js";
 import { l as partPath } from "./output-files-DhRBBE4n.js";
-import { _ as pd045, a as supabaseHookManifest, f as pd039, g as attrsPlan, m as resolveSchemas, n as hookOut, v as readSupabaseConfig, y as supabaseConfig } from "./supabase-hook-DdDQhMlw.js";
+import { _ as pd045, a as supabaseHookManifest, f as pd039, g as attrsPlan, m as resolveSchemas, n as hookOut, v as readSupabaseConfig, y as supabaseConfig } from "./supabase-hook-BMoEhZir.js";
 import { i as group, n as membershipColumns, o as sqlStatements, r as tableKey } from "./deciding-columns-Sq12mEA6.js";
-import { I as graphSqlName, M as contextRefs, S as byKey, a as guardedTables, t as ownershipRules } from "./ownership-BatFgAA4.js";
-import { a as pd010, c as pd014, d as pd038, f as pd041, i as pd008, l as pd015, n as pd001, o as pd011, p as pd057, r as pd007, s as pd013, t as runUsage, u as pd036 } from "./usage-T5mXq98v.js";
-import { d as rowConditionMessage, f as commandFor, i as graphPlan, m as tableFor, p as compileGrants, s as ROW_CONDITION_FIX, u as helperTablePolicies } from "./verify-DbCL9bnB.js";
-import { t as FIELD_VIEWS } from "./fields-D9tPVUUS.js";
-import { r as staleFiles, t as powersyncFiles } from "./powersync-bYUDLOAO.js";
+import { C as byKey, L as graphSqlName, N as contextRefs, a as guardedTables, t as ownershipRules } from "./ownership-DqaJNJPn.js";
+import { a as pd010, c as pd014, d as pd038, f as pd041, i as pd008, l as pd015, n as pd001, o as pd011, p as pd057, r as pd007, s as pd013, t as runUsage, u as pd036 } from "./usage-SveTRTyr.js";
+import { d as rowConditionMessage, f as commandFor, i as graphPlan, m as tableFor, p as compileGrants, s as ROW_CONDITION_FIX, u as helperTablePolicies } from "./verify-BaAKx7t6.js";
+import { t as FIELD_VIEWS } from "./fields-OYG_JR78.js";
+import { r as staleFiles, t as powersyncFiles } from "./powersync-BkWWCS1K.js";
 import { n as legacyHelperNames, r as retirePlan, t as legacyHelperCalls } from "./retire-CALjIQ7e.js";
 import { t as supautilsRejections } from "./supautils-B6HYL9eL.js";
 import { existsSync, readFileSync, readdirSync, statSync } from "node:fs";

package/dist/drizzle/index.d.ts

@@ -1,7 +1,7 @@
-import { Rt as Instant, ir as Subject, lr as Condition } from "../policy-types-DzwivBgR.js";
-import { c as WhereResult } from "../permdock-D7eeLJER.js";
+import { Rt as Instant, ar as Subject, ur as Condition } from "../policy-types-n0uRTsW8.js";
+import { c as WhereResult } from "../permdock-SV8ZINYT.js";
 import { r as RelationsMapping } from "../graph-sql-B-dsAT6j.js";
-import { s as MembershipsMapping } from "../compile-Ckm2HqBZ.js";
+import { s as MembershipsMapping } from "../compile-1bsAezL0.js";
 import { n as WithSubjectOptions, t as RowCheck } from "../row-check-Dt35czLy.js";
 import { SQL, Table } from "drizzle-orm";
 //#region src/drizzle/types.d.ts

package/dist/elysia/index.d.ts

@@ -1,9 +1,9 @@
-import { T as Policy, j as PolicyVocabulary, rr as Principal } from "../policy-types-DzwivBgR.js";
-import { w as Permission } from "../vocabulary-D6lPdb4Z.js";
-import { r as PermDock } from "../permdock-D7eeLJER.js";
+import { T as Policy, j as PolicyVocabulary, rr as Principal } from "../policy-types-n0uRTsW8.js";
+import { w as Permission } from "../vocabulary-CN8H_9UF.js";
+import { r as PermDock } from "../permdock-SV8ZINYT.js";
 import { n as RevocationFeed } from "../revocations-R07lFBnX.js";
-import { D as ConnectionOptions, T as Connection, f as InvalidSignatureError, i as OpenApiHooks, o as ProtectOptions, v as discoverViaSignatureAgent, x as webBotAuthVerifier } from "../server-types-BLd4MnBX.js";
-import { t as ServerAdapterOptions } from "../bind--9EFVYWF.js";
+import { D as ConnectionOptions, T as Connection, f as InvalidSignatureError, i as OpenApiHooks, o as ProtectOptions, v as discoverViaSignatureAgent, x as webBotAuthVerifier } from "../server-types-CKQiCnON.js";
+import { t as ServerAdapterOptions } from "../bind-DOyrv6zi.js";
 import { Elysia } from "elysia";
 //#region src/elysia/create.d.ts
 type ElysiaRequestContext = {

package/dist/elysia/index.js

@@ -1,7 +1,7 @@
 import { a as parsedBody, r as hasCredentials } from "../http-BBoKefeS.js";
-import { d as discoverViaSignatureAgent, m as webBotAuthVerifier, u as InvalidSignatureError } from "../evaluations-DZ2CbV5k.js";
-import { t as problemFromError } from "../map-error-TCAdw-eW.js";
-import { a as socketConnection, i as decorate, r as bindKernel } from "../bind-CZzhx-Vj.js";
+import { d as discoverViaSignatureAgent, m as webBotAuthVerifier, u as InvalidSignatureError } from "../evaluations-beAooV0n.js";
+import { t as problemFromError } from "../map-error-Dr70oA_3.js";
+import { a as socketConnection, i as decorate, r as bindKernel } from "../bind-CAvgUuKs.js";
 import { a as onRevoked, n as closeReason, t as POLICY_VIOLATION } from "../stream-CvdUS9V1.js";
 import { Elysia } from "elysia";
 //#region src/elysia/create.ts

package/dist/{errors-C2PXIv4c.d.ts → errors-DH5QEGXh.d.ts}

@@ -1,5 +1,5 @@
-import { Nn as Decision, an as WireDenial, ir as Subject } from "./policy-types-DzwivBgR.js";
-import { t as Disclosure } from "./problem-details-DXlt-vks.js";
+import { Nn as Decision, an as WireDenial, ar as Subject } from "./policy-types-n0uRTsW8.js";
+import { t as Disclosure } from "./problem-details-B45V5d2b.js";
 import { StandardSchemaV1 } from "@standard-schema/spec";
 //#region src/core/errors.d.ts
 /** Where and how a human approves; carries no secret. */