permdock 0.5.0 → 0.6.0

package/dist/supabase/index.js

@@ -1,6 +1,6 @@
-import { a as supabaseClaims, i as supabaseApprovalStore, n as supabaseRls, o as exchangeCapability, r as tableApprovalDelegationSource, t as authorizeSql } from "../supabase-Dxlp8A94.js";
+import { a as supabaseClaims, i as supabaseApprovalStore, n as supabaseRls, o as exchangeCapability, r as tableApprovalDelegationSource, t as authorizeSql } from "../supabase-x5JtR2tc.js";
 import { n as supabaseTenantClaim, t as supabaseMembershipsBudget } from "../budget-NbEtbJC_.js";
 import { c as tableMembershipSource, i as authzVersion, o as junctionMembershipSource, s as supabasePostgresQuery, t as AUTHZ_VERSION_TABLE } from "../sources-vs5dGOsS.js";
-import { a as delegationOf, c as subjectFromSupabaseSession, i as actorOf, n as postgrestSources, r as readSubjectRecord, s as subjectFromSupabase } from "../postgrest-CW0IqC-U.js";
+import { a as delegationOf, c as subjectFromSupabaseSession, i as actorOf, n as postgrestSources, r as readSubjectRecord, s as subjectFromSupabase } from "../postgrest-DAjUkF9w.js";
 import { t as parseSupabaseManifest } from "../manifest-C8IzW3Do.js";
 export { AUTHZ_VERSION_TABLE, actorOf, authorizeSql, authzVersion, delegationOf, exchangeCapability, junctionMembershipSource, parseSupabaseManifest, postgrestSources, readSubjectRecord, subjectFromSupabase, subjectFromSupabaseSession, supabaseApprovalStore, supabaseClaims, supabaseMembershipsBudget, supabasePostgresQuery, supabaseRls, supabaseTenantClaim, tableApprovalDelegationSource, tableMembershipSource };

package/dist/supabase/middleware.d.ts

@@ -1,10 +1,10 @@
-import { T as Policy, ir as Subject, j as PolicyVocabulary, rr as Principal } from "../policy-types-DzwivBgR.js";
-import { w as Permission } from "../vocabulary-D6lPdb4Z.js";
-import { r as PermDock } from "../permdock-D7eeLJER.js";
-import { t as InstanceOptions } from "../instance-options-Omfd793B.js";
+import { T as Policy, ar as Subject, j as PolicyVocabulary, rr as Principal } from "../policy-types-n0uRTsW8.js";
+import { w as Permission } from "../vocabulary-CN8H_9UF.js";
+import { r as PermDock } from "../permdock-SV8ZINYT.js";
+import { t as InstanceOptions } from "../instance-options-BsVpyGIk.js";
 import { t as RequestContext } from "../request-context-C2_1lchh.js";
-import { i as OpenApiHooks } from "../server-types-BLd4MnBX.js";
-import { n as ServerAdapterServices } from "../bind--9EFVYWF.js";
+import { i as OpenApiHooks } from "../server-types-CKQiCnON.js";
+import { n as ServerAdapterServices } from "../bind-DOyrv6zi.js";
 import { Middleware } from "@supabase/middleware";
 //#region src/supabase/middleware.d.ts
 /**

package/dist/supabase/middleware.js

@@ -1,11 +1,11 @@
 import { t as compact } from "../compact-CAf557ZB.js";
-import { c as withApp } from "../permdock-B9JxkBwC.js";
+import { c as withApp } from "../permdock-BrAscV28.js";
 import { t as composeWraps } from "../wrap-gX61EtpB.js";
-import { r as credentialSubject } from "../credential-DM2um3ha.js";
+import { r as credentialSubject } from "../credential-BcoiejpY.js";
 import { a as methodNotAllowed } from "../problem-CTviyH5L.js";
-import { r as instanceOptions } from "../build-instance-BMnAudHn.js";
-import { t as createPermDock$1 } from "../create-DnrmLnLW.js";
-import { n as attached } from "../bind-CZzhx-Vj.js";
+import { r as instanceOptions } from "../build-instance-Bu_eDqYw.js";
+import { t as createPermDock$1 } from "../create-DCF2SvoT.js";
+import { n as attached } from "../bind-CAvgUuKs.js";
 import { defineMiddleware } from "@supabase/middleware";
 //#region src/supabase/middleware.ts
 const SECRET_KEY_NAME = /^[A-Za-z0-9_-]+$/u;

package/dist/{supabase-9pqI57pW.js → supabase-By_frk3U.js}

@@ -47,7 +47,7 @@ const hookGenerate = defineLeaf({
 		const budget = given(flags.budget);
 		const schema = given(flags.schema);
 		const grantsOut = given(flags["grants-out"]);
-		const { runSupabase } = await import("./supabase-hook-CXcGpHqq.js");
+		const { runSupabase } = await import("./supabase-hook-CCw5m35C.js");
 		return runSupabase({
 			cwd: ctx.cwd,
 			config: ctx.config,
@@ -76,7 +76,7 @@ const inspect = defineLeaf({
 	},
 	async run(ctx, { flags }) {
 		const out = flags.out === "" ? true : flags.out === "-" ? void 0 : flags.out;
-		const { runSupabase } = await import("./supabase-hook-CXcGpHqq.js");
+		const { runSupabase } = await import("./supabase-hook-CCw5m35C.js");
 		return runSupabase({
 			cwd: ctx.cwd,
 			config: ctx.config,

package/dist/{supabase-hook-DdDQhMlw.js → supabase-hook-BMoEhZir.js}

@@ -7,20 +7,20 @@ import { i as readJsonFile, o as sqlFiles, s as writeFileEnsuringDir } from "./f
 import { a as SUPABASE_MANIFEST_SCHEMA } from "./version-CEbQ5UeM.js";
 import { c as requirePolicy } from "./load-DFS_ry0W.js";
 import { r as scopeColumn } from "./compile-CMqMx_IN.js";
-import { t as authorizeSql } from "./supabase-Dxlp8A94.js";
+import { t as authorizeSql } from "./supabase-x5JtR2tc.js";
 import "./budget-NbEtbJC_.js";
 import { i as qualifySqlTable } from "./sql-B5T1IL83.js";
 import { a as hookApiNames, d as keptKeys, t as AUTHZ_VERSION_TABLE, u as roleManifest } from "./sources-vs5dGOsS.js";
-import { o as readMemberships } from "./postgrest-CW0IqC-U.js";
+import { o as readMemberships } from "./postgrest-DAjUkF9w.js";
 import { t as beforeFirst } from "./text-BMFRfBqc.js";
 import { n as GRANTS_MARKER, r as HOOK_MARKER, s as hookMarkerFields } from "./markers-C6joDI3o.js";
 import { n as formatManifestJson, t as MANIFEST_FILE } from "./manifest-json-CAGzls-C.js";
 import { n as MIGRATION_DIRS } from "./constants-DcJABbLW.js";
 import { f as writeOutputFiles, l as partPath, r as driftOf, u as pgDeltaPath } from "./output-files-DhRBBE4n.js";
-import { E as scopeTypeOf, F as quoteQualified, I as quoteTable, M as qualified, N as quoteIdent, O as tenantTypeOf, P as quoteLiteral, a as customRolesOn, l as USER_ID_HELPER, r as HELPERS, y as subjectIdSql } from "./shared-CD11nBbC.js";
+import { E as scopeTypeOf, F as quoteQualified, I as quoteTable, M as qualified, N as quoteIdent, O as tenantTypeOf, P as quoteLiteral, a as customRolesOn, l as USER_ID_HELPER, r as HELPERS, y as subjectIdSql } from "./shared-BAK8t4Uo.js";
 import { a as splitUndiffed, r as tableKey, t as decidingColumns } from "./deciding-columns-Sq12mEA6.js";
-import { a as readOnlyActorKinds, f as pgConnector, t as ACTOR_MAY_WRITE } from "./policies-CO1oOymN.js";
-import { $ as checkSuspension, A as roleNames, C as API_KEY_ALLOWS, G as memberRoleOf, H as memberForSources, K as permittedForHelper, R as hasMemberFor, T as apiKeyFields, U as memberForTable, V as memberForHelper, W as memberIdsHelper, X as scopeTable, Z as activeRowSql, a as guardedTables, b as globalRoleSource, c as PERMISSION_HELPERS, d as permissionKeysForHelper, f as permittedByPermissionHelper, l as checkName, o as ASSIGNMENTS, q as permittedIdsHelper, r as holderSources, s as OWNERSHIP, t as ownershipRules, y as globalRoleRows, z as hasPermittedUsers } from "./ownership-BatFgAA4.js";
+import { a as readOnlyActorKinds, f as pgConnector, t as ACTOR_MAY_WRITE } from "./policies-DP2nqRoF.js";
+import { B as hasPermittedUsers, E as apiKeyFields, G as memberIdsHelper, H as memberForHelper, J as permittedIdsHelper, K as memberRoleOf, Q as activeRowSql, U as memberForSources, W as memberForTable, Z as scopeTable, a as guardedTables, c as PERMISSION_HELPERS, d as permissionKeysForHelper, et as checkSuspension, f as permittedByPermissionHelper, j as roleNames, l as checkName, o as ASSIGNMENTS, q as permittedForHelper, r as holderSources, s as OWNERSHIP, t as ownershipRules, v as globalRoleRows, w as API_KEY_ALLOWS, y as globalRoleSource, z as hasMemberFor } from "./ownership-DqaJNJPn.js";
 import { existsSync, readFileSync, readdirSync } from "node:fs";
 import { dirname, join, posix, resolve } from "node:path";
 import { parse } from "smol-toml";
@@ -935,9 +935,10 @@ $$;
 revoke execute on function ${fn}(text, text) from public, anon, authenticated;`;
 }
 /**
-* The custom roles `p_user` holds: tenant roles named on a membership of the
-* scope (and instance) they live at, and platform roles among the global
-* roles, each with its grants and includes in `CustomRole` form.
+* The custom roles `p_user` holds: tenant and shared roles named on a
+* membership of the scope (and instance) they live at, and platform roles
+* among the global roles, each with its grants and includes in `CustomRole`
+* form. A shadowed tenant role comes along; `resolveCustomRole`'s callers drop it.
 */
 function customRolesOfSql(parts) {
 	const helpers = quoteIdent(parts.helpers.schema);
@@ -948,6 +949,7 @@ function customRolesOfSql(parts) {
 	return `
   select coalesce(jsonb_agg(jsonb_strip_nulls(jsonb_build_object(
       'name', c.role,
+      'shared', case when c.tenant_id is null and c.scope <> 'global' then true end,
       'tenant', c.tenant_id::text,
       'scope', c.scope,
       'id', c.scope_id,
@@ -978,7 +980,10 @@ function customRolesOfSql(parts) {
         from jsonb_array_elements(memberships) m
         where m -> 'roles' ? c.role
           and m ->> 'scope' = c.scope
-          and c.tenant_id::text = case when m ->> 'scope' = ${root} then m ->> 'id' else m -> 'within' ->> ${root} end
+          and (
+            (c.tenant_id is null and c.scope_id is null)
+            or c.tenant_id::text = case when m ->> 'scope' = ${root} then m ->> 'id' else m -> 'within' ->> ${root} end
+          )
           and (c.scope_id is null or c.scope_id = m ->> 'id')
       );`;
 }

package/dist/supabase-hook-CCw5m35C.js

@@ -0,0 +1 @@
+export { i as runSupabase } from "./supabase-hook-BMoEhZir.js";

package/dist/{supabase-Dxlp8A94.js → supabase-x5JtR2tc.js}

@@ -2,13 +2,13 @@ import { r as isRecord, t as compact } from "./compact-CAf557ZB.js";
 import { d as isoNow, i as dateAt, p as nowSeconds, u as isoAt } from "./time-DkWjdL98.js";
 import { t as canonicalJson } from "./canonical-json-BC8_nMTw.js";
 import { s as ApprovalError } from "./types-DqzsnlSA.js";
-import { a as approvalPageSize, o as decodeApprovalCursor, s as encodeApprovalCursor, t as applyApprovalVerdict } from "./store-4u_hxjWa.js";
+import { a as approvalPageSize, o as decodeApprovalCursor, s as encodeApprovalCursor, t as applyApprovalVerdict } from "./store-BDutJkDL.js";
 import { a as parseCapability } from "./capability-N1K9IpqS.js";
 import { t as loadJose } from "./load-jose-DZ4dnjri.js";
 import "./budget-NbEtbJC_.js";
 import { a as quoteQualifiedTable, c as quoteSqlTable, i as qualifySqlTable, o as quoteSqlIdent, s as quoteSqlLiteral, u as sqlTextArray } from "./sql-B5T1IL83.js";
 import { d as keptKeys, l as roleColumn } from "./sources-vs5dGOsS.js";
-import { t as callRpc } from "./postgrest-CW0IqC-U.js";
+import { t as callRpc } from "./postgrest-DAjUkF9w.js";
 //#region src/supabase/capability.ts
 const DEFAULT_TTL = 300;
 const MAX_TTL = 3600;
@@ -478,7 +478,7 @@ function claimKept(suspension) {
 }
 function customDatabaseBranch(q, scope, memberships, declared, levels, suspension) {
 	const role = tenantRole(memberships);
-	const match = `c.tenant_id::text = requested_tenant and c.scope = ${literal(scope)} and c.scope_id is null and c.role = ${role.sql}`;
+	const match = `case when ${q("permdock_is_shared_role")}(${literal(scope)}, ${role.sql}) then c.tenant_id is null else c.tenant_id::text = requested_tenant end and c.scope = ${literal(scope)} and c.scope_id is null and c.role = ${role.sql}`;
 	const rows = (source, value, extra) => `array(select c.${value} from ${q(source)} c where ${match}${extra})`;
 	return ` or exists (
       select 1

package/dist/svelte/index.d.ts

@@ -1,10 +1,10 @@
-import { n as requiredPlans } from "../problem-details-DXlt-vks.js";
-import { i as describe } from "../describe-BZUsixiL.js";
+import { n as requiredPlans } from "../problem-details-B45V5d2b.js";
+import { i as describe } from "../describe-B5qgDvEW.js";
 import { t as PermissionBoundaryState } from "../boundary-BmHxVH1J.js";
 import { t as approvalHeaders } from "../headers-CIbDTUTK.js";
-import { a as FilterResult, c as PermissionSet, d as RolesOptions, f as SubjectView, i as ClientStatus, l as PermissionState, n as ApprovalState, p as TenantView, r as ClientPermDock, t as ApprovalHandle } from "../types-BNORmDM8.js";
-import { n as SveltePermDockOptions, o as PermissionBoundaryProps, r as ProtectedProps, t as PermDockDefaults } from "../types-fbZ7JEXr.js";
-import { a as getDescribe, c as permission, d as setPermDock, f as subject, i as filtered, l as permissions, n as assignable, o as getPermDock, p as tenant, r as assignablePermissions, s as memberships, t as approval, u as roles } from "../stores-ClZUgeoP.js";
+import { a as FilterResult, c as PermissionSet, d as RolesOptions, f as SubjectView, i as ClientStatus, l as PermissionState, n as ApprovalState, p as TenantView, r as ClientPermDock, t as ApprovalHandle } from "../types-B3_ooZgZ.js";
+import { n as SveltePermDockOptions, o as PermissionBoundaryProps, r as ProtectedProps, t as PermDockDefaults } from "../types-CVZSNocA.js";
+import { a as getDescribe, c as permission, d as setPermDock, f as subject, i as filtered, l as permissions, n as assignable, o as getPermDock, p as tenant, r as assignablePermissions, s as memberships, t as approval, u as roles } from "../stores-BUGNbJTt.js";
 import { Component } from "svelte";
 //#region src/svelte/index.d.ts
 export declare const Protected: Component<ProtectedProps>;

package/dist/svelte/index.js

@@ -3,9 +3,9 @@ import { t as describe } from "../describe-BybMRY7A.js";
 import { n as boundaryFallback, t as boundaryDigest } from "../boundary-BM8a_P6E.js";
 import { t as approvalHeaders } from "../headers-BIjfMaoC.js";
 import { u as slotContent } from "../views-DTIIO-oQ.js";
-import { n as getUi, t as getStore } from "../context-bbFHR-0D.js";
+import { n as getUi, t as getStore } from "../context-B_u3_bDJ.js";
 import { n as viewFor, t as scopedFor } from "../runtime-D3VTAiCA.js";
-import { a as getDescribe, c as permission, d as setPermDock, f as subject, i as filtered, l as permissions, n as assignable, o as getPermDock, p as tenant, r as assignablePermissions, s as memberships, t as approval, u as roles } from "../stores-BbsD4fAR.js";
+import { a as getDescribe, c as permission, d as setPermDock, f as subject, i as filtered, l as permissions, n as assignable, o as getPermDock, p as tenant, r as assignablePermissions, s as memberships, t as approval, u as roles } from "../stores-CGhM8BN_.js";
 import "svelte/internal/disclose-version";
 import * as $ from "svelte/internal/client";
 import { onDestroy } from "svelte";

package/dist/svelte/runtime.d.ts

@@ -1,7 +1,7 @@
-import { n as DescribeMessages } from "../describe-BZUsixiL.js";
+import { n as DescribeMessages } from "../describe-B5qgDvEW.js";
 import { n as boundaryDigest, r as boundaryFallback, t as PermissionBoundaryState } from "../boundary-BmHxVH1J.js";
-import { m as ClientStore } from "../types-BNORmDM8.js";
-import { a as viewFor, i as scopedFor, o as PermissionBoundaryProps, r as ProtectedProps, s as slotContent, t as PermDockDefaults } from "../types-fbZ7JEXr.js";
+import { m as ClientStore } from "../types-B3_ooZgZ.js";
+import { a as viewFor, i as scopedFor, o as PermissionBoundaryProps, r as ProtectedProps, s as slotContent, t as PermDockDefaults } from "../types-CVZSNocA.js";
 //#region src/svelte/context.d.ts
 /** The provider's `defaults` and `messages`. */
 type PermDockUi = {

package/dist/svelte/runtime.js

@@ -1,5 +1,5 @@
 import { n as boundaryFallback, t as boundaryDigest } from "../boundary-BM8a_P6E.js";
 import { u as slotContent } from "../views-DTIIO-oQ.js";
-import { n as getUi, t as getStore } from "../context-bbFHR-0D.js";
+import { n as getUi, t as getStore } from "../context-B_u3_bDJ.js";
 import { n as viewFor, t as scopedFor } from "../runtime-D3VTAiCA.js";
 export { boundaryDigest, boundaryFallback, getStore, getUi, scopedFor, slotContent, viewFor };

package/dist/svelte/source.d.ts

@@ -1,10 +1,10 @@
-import { n as requiredPlans } from "../problem-details-DXlt-vks.js";
-import { i as describe } from "../describe-BZUsixiL.js";
+import { n as requiredPlans } from "../problem-details-B45V5d2b.js";
+import { i as describe } from "../describe-B5qgDvEW.js";
 import { t as PermissionBoundaryState } from "../boundary-BmHxVH1J.js";
 import { t as approvalHeaders } from "../headers-CIbDTUTK.js";
-import { a as FilterResult, c as PermissionSet, d as RolesOptions, f as SubjectView, i as ClientStatus, l as PermissionState, n as ApprovalState, p as TenantView, r as ClientPermDock, t as ApprovalHandle } from "../types-BNORmDM8.js";
-import { n as SveltePermDockOptions, o as PermissionBoundaryProps, r as ProtectedProps, t as PermDockDefaults } from "../types-fbZ7JEXr.js";
-import { a as getDescribe, c as permission, d as setPermDock, f as subject, i as filtered, l as permissions, n as assignable, o as getPermDock, p as tenant, r as assignablePermissions, s as memberships, t as approval, u as roles } from "../stores-ClZUgeoP.js";
+import { a as FilterResult, c as PermissionSet, d as RolesOptions, f as SubjectView, i as ClientStatus, l as PermissionState, n as ApprovalState, p as TenantView, r as ClientPermDock, t as ApprovalHandle } from "../types-B3_ooZgZ.js";
+import { n as SveltePermDockOptions, o as PermissionBoundaryProps, r as ProtectedProps, t as PermDockDefaults } from "../types-CVZSNocA.js";
+import { a as getDescribe, c as permission, d as setPermDock, f as subject, i as filtered, l as permissions, n as assignable, o as getPermDock, p as tenant, r as assignablePermissions, s as memberships, t as approval, u as roles } from "../stores-BUGNbJTt.js";
 import { Component } from "svelte";
 //#region src/svelte/source.d.ts
 export declare const Protected: Component<ProtectedProps>;

package/dist/svelte/source.js

@@ -1,7 +1,7 @@
 import { r as requiredPlans } from "../problem-details-cn5X30gZ.js";
 import { t as describe } from "../describe-BybMRY7A.js";
 import { t as approvalHeaders } from "../headers-BIjfMaoC.js";
-import { a as getDescribe, c as permission, d as setPermDock, f as subject, i as filtered, l as permissions, n as assignable, o as getPermDock, p as tenant, r as assignablePermissions, s as memberships, t as approval, u as roles } from "../stores-BbsD4fAR.js";
+import { a as getDescribe, c as permission, d as setPermDock, f as subject, i as filtered, l as permissions, n as assignable, o as getPermDock, p as tenant, r as assignablePermissions, s as memberships, t as approval, u as roles } from "../stores-CGhM8BN_.js";
 import PermissionBoundaryComponent from "./PermissionBoundary.svelte";
 import ProtectedComponent from "./Protected.svelte";
 //#region src/svelte/source.ts

package/dist/sveltekit/index.d.ts

@@ -1,9 +1,9 @@
-import { T as Policy, Vt as Snapshot, j as PolicyVocabulary, rr as Principal } from "../policy-types-DzwivBgR.js";
-import { w as Permission } from "../vocabulary-D6lPdb4Z.js";
-import { a as OperationInput, t as Operation } from "../operations-CxybZErY.js";
-import { r as PermDock } from "../permdock-D7eeLJER.js";
-import { D as ConnectionOptions, T as Connection, f as InvalidSignatureError, i as OpenApiHooks, o as ProtectOptions, u as SnapshotQuery, v as discoverViaSignatureAgent, x as webBotAuthVerifier } from "../server-types-BLd4MnBX.js";
-import { a as ProtectTarget, i as PermDockHandlers, n as FetchAdapterOptions, t as ContextReader } from "../fetch-adapter-qKJBuRqy.js";
+import { T as Policy, Vt as Snapshot, j as PolicyVocabulary, rr as Principal } from "../policy-types-n0uRTsW8.js";
+import { w as Permission } from "../vocabulary-CN8H_9UF.js";
+import { a as OperationInput, t as Operation } from "../operations-X0VM7F3m.js";
+import { r as PermDock } from "../permdock-SV8ZINYT.js";
+import { D as ConnectionOptions, T as Connection, f as InvalidSignatureError, i as OpenApiHooks, o as ProtectOptions, u as SnapshotQuery, v as discoverViaSignatureAgent, x as webBotAuthVerifier } from "../server-types-CKQiCnON.js";
+import { a as ProtectTarget, i as PermDockHandlers, n as FetchAdapterOptions, t as ContextReader } from "../fetch-adapter-Dw0MTS3D.js";
 import { RequestEvent } from "@sveltejs/kit";
 //#region src/sveltekit/create.d.ts
 /**

package/dist/sveltekit/index.js

@@ -1,5 +1,5 @@
-import { d as discoverViaSignatureAgent, m as webBotAuthVerifier, u as InvalidSignatureError } from "../evaluations-DZ2CbV5k.js";
-import { n as guardedRoute, r as instanceRoute, t as fetchAdapter } from "../fetch-adapter-g0ypLkID.js";
+import { d as discoverViaSignatureAgent, m as webBotAuthVerifier, u as InvalidSignatureError } from "../evaluations-beAooV0n.js";
+import { n as guardedRoute, r as instanceRoute, t as fetchAdapter } from "../fetch-adapter-DD_gfmrC.js";
 //#region src/sveltekit/create.ts
 const route = {
 	context: (event) => event,

package/dist/tanstack-start/index.d.ts

@@ -1,9 +1,9 @@
-import { T as Policy, Vt as Snapshot, j as PolicyVocabulary, rr as Principal } from "../policy-types-DzwivBgR.js";
-import { w as Permission } from "../vocabulary-D6lPdb4Z.js";
-import { a as OperationInput, t as Operation } from "../operations-CxybZErY.js";
-import { r as PermDock } from "../permdock-D7eeLJER.js";
-import { D as ConnectionOptions, T as Connection, f as InvalidSignatureError, i as OpenApiHooks, o as ProtectOptions, u as SnapshotQuery, v as discoverViaSignatureAgent, x as webBotAuthVerifier } from "../server-types-BLd4MnBX.js";
-import { a as ProtectTarget, n as FetchAdapterOptions, t as ContextReader } from "../fetch-adapter-qKJBuRqy.js";
+import { T as Policy, Vt as Snapshot, j as PolicyVocabulary, rr as Principal } from "../policy-types-n0uRTsW8.js";
+import { w as Permission } from "../vocabulary-CN8H_9UF.js";
+import { a as OperationInput, t as Operation } from "../operations-X0VM7F3m.js";
+import { r as PermDock } from "../permdock-SV8ZINYT.js";
+import { D as ConnectionOptions, T as Connection, f as InvalidSignatureError, i as OpenApiHooks, o as ProtectOptions, u as SnapshotQuery, v as discoverViaSignatureAgent, x as webBotAuthVerifier } from "../server-types-CKQiCnON.js";
+import { a as ProtectTarget, n as FetchAdapterOptions, t as ContextReader } from "../fetch-adapter-Dw0MTS3D.js";
 import { RequestMiddleware, RequestMiddlewareAfterServer, createMiddleware } from "@tanstack/react-start";
 //#region src/tanstack-start/create.d.ts
 type TanStackStartPermDockOptions<TUser = unknown> = FetchAdapterOptions<Request, TUser>;

package/dist/tanstack-start/index.js

@@ -1,5 +1,5 @@
-import { d as discoverViaSignatureAgent, m as webBotAuthVerifier, u as InvalidSignatureError } from "../evaluations-DZ2CbV5k.js";
-import { t as fetchAdapter } from "../fetch-adapter-g0ypLkID.js";
+import { d as discoverViaSignatureAgent, m as webBotAuthVerifier, u as InvalidSignatureError } from "../evaluations-beAooV0n.js";
+import { t as fetchAdapter } from "../fetch-adapter-DD_gfmrC.js";
 import { createMiddleware } from "@tanstack/react-start";
 //#region src/tanstack-start/create.ts
 function createPermDock(policy, options) {

package/dist/terminal/index.d.ts

@@ -1,9 +1,9 @@
-import { Nn as Decision, Rt as Instant, T as Policy, ir as Subject, j as PolicyVocabulary, rr as Principal } from "../policy-types-DzwivBgR.js";
-import { w as Permission } from "../vocabulary-D6lPdb4Z.js";
-import { r as PermDock } from "../permdock-D7eeLJER.js";
-import { m as ApprovalStore } from "../types-CCpc2Dcv.js";
-import { a as ProblemDetails, t as ApprovalHint } from "../errors-C2PXIv4c.js";
-import { t as InstanceOptions } from "../instance-options-Omfd793B.js";
+import { Nn as Decision, Rt as Instant, T as Policy, ar as Subject, j as PolicyVocabulary, rr as Principal } from "../policy-types-n0uRTsW8.js";
+import { w as Permission } from "../vocabulary-CN8H_9UF.js";
+import { r as PermDock } from "../permdock-SV8ZINYT.js";
+import { m as ApprovalStore } from "../types-BdtSDbBO.js";
+import { a as ProblemDetails, t as ApprovalHint } from "../errors-DH5QEGXh.js";
+import { t as InstanceOptions } from "../instance-options-BsVpyGIk.js";
 //#region src/terminal/types.d.ts
 type TokenSourceName = "device" | "keychain" | "env" | "ci-oidc";
 type TokenSource = TokenSourceName | {

package/dist/terminal/index.js

@@ -2,12 +2,12 @@ import { t as compact } from "../compact-CAf557ZB.js";
 import { a as deniedMessage, i as approvalMessage, n as PermDockDeniedError, t as PermDockApprovalRequiredError } from "../errors-BKy0EfhN.js";
 import { h as secondsAt } from "../time-DkWjdL98.js";
 import { n as resourceRef } from "../resource-ref-CaS9yVPi.js";
-import { c as withApp } from "../permdock-B9JxkBwC.js";
+import { c as withApp } from "../permdock-BrAscV28.js";
 import { r as isSubject } from "../subject-BGoM5o8B.js";
 import { n as readBodyText } from "../body-text-QcXok_SI.js";
-import { l as storedApprovalToken, s as resumeDecision } from "../helpers-DTcZOzhF.js";
+import { l as storedApprovalToken, s as resumeDecision } from "../helpers-CBYVMjwh.js";
 import { t as timeoutSignal } from "../timeout-D51niuQP.js";
-import { n as resolveOrNull, t as buildInstance } from "../build-instance-BMnAudHn.js";
+import { n as resolveOrNull, t as buildInstance } from "../build-instance-Bu_eDqYw.js";
 import { a as refreshCredential, o as revokeCredential, s as runDeviceFlow, t as TERMINAL_TIMEOUT_MS } from "../device-BARQ8eYG.js";
 import { i as writeCredentials, n as deleteCredentials, r as readCredentials } from "../storage-C2bWdvJH.js";
 import { createInterface } from "node:readline";

package/dist/testing/index.d.ts

@@ -1,26 +1,26 @@
-import { J as EntitlementSource, K as DecisionProvider, Q as LimitStore, T as Policy, U as CredentialVerifier, Vt as Snapshot, W as CustomRoleSource, Zn as CustomRole, Zt as DeliveryChannel, at as SettingsSource, dt as TokenVerifier, et as MembershipSource, ir as Subject, it as RelationSource, mt as WhereCompiler, nr as Membership, ot as SnapshotSource, q as DecisionSink, rr as Principal, st as SubjectResolver, ut as TokenSigner } from "../policy-types-DzwivBgR.js";
-import { C as InferPermissionTree, k as ResourceInit, r as Role, w as Permission } from "../vocabulary-D6lPdb4Z.js";
-import { Q as LegacyCheck } from "../index-DOVf7RJv.js";
-import { S as ApprovalPolicySource, c as WhereResult, d as PrincipalIdentity, g as Limits, i as PermDockOptions, p as PrincipalSource, r as PermDock } from "../permdock-D7eeLJER.js";
-import { o as PolicySource } from "../hosted-DBDX0M-P.js";
-import { a as ApprovalDelegationSource, m as ApprovalStore } from "../types-CCpc2Dcv.js";
-import { a as ProblemDetails } from "../errors-C2PXIv4c.js";
-import { c as ModelMap, t as AgentPermDock, u as ToolMap } from "../create-BDS7wc3y.js";
-import { c as AccessReviewStore } from "../types-_sHy8BQf.js";
-import { F as IdempotencyStore } from "../index-CxGUswIC.js";
+import { J as EntitlementSource, K as DecisionProvider, Q as LimitStore, T as Policy, U as CredentialVerifier, Vt as Snapshot, W as CustomRoleSource, Zn as CustomRole, Zt as DeliveryChannel, ar as Subject, at as SettingsSource, dt as TokenVerifier, et as MembershipSource, it as RelationSource, mt as WhereCompiler, nr as Membership, ot as SnapshotSource, q as DecisionSink, rr as Principal, st as SubjectResolver, ut as TokenSigner } from "../policy-types-n0uRTsW8.js";
+import { C as InferPermissionTree, k as ResourceInit, r as Role, w as Permission } from "../vocabulary-CN8H_9UF.js";
+import { Q as LegacyCheck } from "../index-DuWxc5dt.js";
+import { S as ApprovalPolicySource, c as WhereResult, d as PrincipalIdentity, g as Limits, i as PermDockOptions, p as PrincipalSource, r as PermDock } from "../permdock-SV8ZINYT.js";
+import { o as PolicySource } from "../hosted-BPk51-kX.js";
+import { a as ApprovalDelegationSource, m as ApprovalStore } from "../types-BdtSDbBO.js";
+import { a as ProblemDetails } from "../errors-DH5QEGXh.js";
+import { c as ModelMap, t as AgentPermDock, u as ToolMap } from "../create-CBMmFie-.js";
+import { c as AccessReviewStore } from "../types-C_IiEs64.js";
+import { F as IdempotencyStore } from "../index-C-6Letxg.js";
 import { n as RevocationFeed } from "../revocations-R07lFBnX.js";
-import { s as SupportSessionSource } from "../index-Chrs5fQ-.js";
-import { a as AutomationSource, t as Automation } from "../automation-BMZPIVUM.js";
-import { c as DeliveryTransport, g as TransportMessages } from "../types-DX0LaKTb.js";
+import { s as SupportSessionSource } from "../index-B8YjkEZ4.js";
+import { a as AutomationSource, t as Automation } from "../automation-BNM3TtDo.js";
+import { c as DeliveryTransport, g as TransportMessages } from "../types-BtHtcKMr.js";
 import { n as SupabaseHookManifest } from "../manifest-mx5ghSFM.js";
 import { t as supabaseMembershipsBudget } from "../budget-JqcRqyhK.js";
-import { t as CloudApproverOptions } from "../types-C8-KNsFf.js";
-import { n as ApprovalWaiter } from "../waiter-CKy4MQSY.js";
-import { g as SetQueue, l as ReplayStore } from "../types-DiQjupG2.js";
-import { r as SnapshotStorage } from "../types-BjV-fqcA.js";
-import { y as DirectoryStore } from "../index-SGdIQyzc.js";
-import { a as SaasProject } from "../permissions-oEWfl-kl.js";
-import { n as saasPolicy } from "../policy-Czo4n3Hs.js";
+import { t as CloudApproverOptions } from "../types-8RnwUAvE.js";
+import { n as ApprovalWaiter } from "../waiter-B986w1oK.js";
+import { g as SetQueue, l as ReplayStore } from "../types-C791HFu9.js";
+import { r as SnapshotStorage } from "../types-C863OQiR.js";
+import { y as DirectoryStore } from "../index-Ch8LpNDp.js";
+import { a as SaasProject } from "../permissions-u_KHg-sN.js";
+import { n as saasPolicy } from "../policy-77FSAq_V.js";
 import { expectTypeOf } from "vitest";
 //#region src/testing/describe-policy.d.ts
 type MatrixOutcome = "granted" | "denied" | "approval-required";

package/dist/testing/index.js

@@ -2,42 +2,42 @@ import { t as require__2020 } from "../2020-C9VN-x8c.js";
 import { r as isRecord } from "../compact-CAf557ZB.js";
 import { n as freezeDeep } from "../freeze-CrU8nQeX.js";
 import { r as principal } from "../refs-K6eWUJ0H.js";
-import { n as role, r as allow } from "../role-builder-CXbis5-X.js";
-import { E as memoryCustomRoleSource, _ as limits, s as snapshotFor, v as memoryLimitStore, x as approvalPoliciesFor } from "../src-DLfUWFAI.js";
+import { n as role, r as allow } from "../role-builder-uWQZ4v84.js";
+import { E as memoryCustomRoleSource, _ as limits, s as snapshotFor, v as memoryLimitStore, x as approvalPoliciesFor } from "../src-Cu2m75uo.js";
 import { t as memoryRevocationFeed } from "../revocations-Bhr0aMIC.js";
 import { n as loadPrincipalByIdentity, t as loadPrincipal } from "../principal-source-pHneukrx.js";
 import { _ as resource, c as listPermissions } from "../permission-registry-Br4jSNVi.js";
 import { d as isoNow, f as nowMillis, p as nowSeconds, u as isoAt } from "../time-DkWjdL98.js";
 import { r as parseAutomation } from "../automation-DVjOckjV.js";
 import { a as normalizeMemberships, d as scopeList } from "../scopes-CUPSjo9q.js";
-import { u as evaluateCondition } from "../delegation-DaXVdDhM.js";
-import { a as authenticated } from "../grantee-Cn1HyUsI.js";
-import { n as definePolicy } from "../policy-DLZJ5gAp.js";
+import { u as evaluateCondition } from "../delegation-j6-rc37o.js";
+import { a as authenticated } from "../grantee-hxrUsbpM.js";
+import { n as definePolicy } from "../policy-DbM5YYtV.js";
 import { t as byCodePoint } from "../compare-pfyVnBjE.js";
-import { a as mergeHostedGrants, o as parsePolicyDocument } from "../hosted-BZIAYvon.js";
+import { a as mergeHostedGrants, o as parsePolicyDocument } from "../hosted-B46-5LYE.js";
 import { t as definePermissions } from "../permissions-B-wCP5ZC.js";
-import { _ as membershipsClaim, x as validateCustomRole } from "../evaluate-_R8QkWaf.js";
-import { n as parseSnapshot } from "../snapshot-CXUWfsNy.js";
-import { n as fromSnapshot } from "../from-snapshot-D2lZt4Dd.js";
-import { t as getPermDock } from "../permdock-B9JxkBwC.js";
+import { C as validateCustomRole, y as membershipsClaim } from "../evaluate-CNClBvcj.js";
+import { n as parseSnapshot } from "../snapshot-B7DkYg6g.js";
+import { n as fromSnapshot } from "../from-snapshot-CTCMsFZk.js";
+import { t as getPermDock } from "../permdock-BrAscV28.js";
 import { t as APPROVAL_HEADER } from "../types-DqzsnlSA.js";
-import { i as memoryApprovalStore } from "../store-4u_hxjWa.js";
+import { i as memoryApprovalStore } from "../store-BDutJkDL.js";
 import { t as catalogFingerprint } from "../catalog-fingerprint-CCP0-yQS.js";
-import { s as parseCredential } from "../credential-DM2um3ha.js";
+import { s as parseCredential } from "../credential-BcoiejpY.js";
 import { s as problemFromDecision } from "../problem-CTviyH5L.js";
-import { o as resolveApproval } from "../helpers-DTcZOzhF.js";
+import { o as resolveApproval } from "../helpers-CBYVMjwh.js";
 import { t as APPROVAL_REQUEST_SCHEMA } from "../request-schema-CMreVuFM.js";
 import { t as catalogSchema } from "../schema-B4v0Qrac.js";
-import { c as parseApiKey } from "../server-DqCT4CgZ.js";
+import { c as parseApiKey } from "../server-C3WXAHZj.js";
 import { n as discoverAuthorizationServer } from "../device-BARQ8eYG.js";
 import { T as sha256Hex, n as directoryMembershipSource, r as scimHandler } from "../scim-ClHtpyV3.js";
-import { a as approverHeaders, r as cloudEndpoints, t as cloud } from "../create-BWRSXgOF.js";
+import { a as approverHeaders, r as cloudEndpoints, t as cloud } from "../create-CQWIpUG-.js";
 import { t as supabaseMembershipsBudget } from "../budget-NbEtbJC_.js";
 import { c as quoteSqlTable, n as defaultSqlCommand, o as quoteSqlIdent, t as SQL_IDENT } from "../sql-B5T1IL83.js";
 import { t as supabaseManifestSchema } from "../manifest-schema-C0kK_8V0.js";
-import { t as PUSHED_POLICY_SCHEMA } from "../pushed-policy-DobP7AHI.js";
-import { i as saasPermissions } from "../permissions-CZKiUfFM.js";
-import { C as saasOrg, E as saasSeed, S as saasMemberships, a as saasProject, g as verifySaasSession, h as signSaasToken, k as saasPolicy, t as saasDoc, w as saasPrincipal, x as saasCustomRoles } from "../saas-FO-Q8oj0.js";
+import { t as PUSHED_POLICY_SCHEMA } from "../pushed-policy-CqtxkV4G.js";
+import { i as saasPermissions } from "../permissions-BPxlwVhN.js";
+import { C as saasOrg, E as saasSeed, S as saasMemberships, a as saasProject, g as verifySaasSession, h as signSaasToken, k as saasPolicy, t as saasDoc, w as saasPrincipal, x as saasCustomRoles } from "../saas-BCXRuXca.js";
 import { t as POLICY_NOT_PUBLISHED } from "../problem-types-CJ2325SZ.js";
 import { afterAll, beforeAll, describe, expect, expectTypeOf, it, vi } from "vitest";
 //#region src/testing/describe-policy.ts

package/dist/testing/saas/index.d.ts

@@ -1,8 +1,8 @@
-import { $n as Delegation, Q as LimitStore, Rt as Instant, Zn as CustomRole, ir as Subject, it as RelationSource, nr as Membership, qn as Actor, rr as Principal } from "../../policy-types-DzwivBgR.js";
-import { w as Permission } from "../../vocabulary-D6lPdb4Z.js";
-import { i as PermDockOptions } from "../../permdock-D7eeLJER.js";
-import { a as SaasProject, c as saasPlans, i as SaasFolderSchema, l as saasRoles, n as SaasDocSchema, o as SaasProjectSchema, r as SaasFolder, s as saasPermissions, t as SaasDoc, u as saasTenantRoleNames } from "../../permissions-oEWfl-kl.js";
-import { n as saasPolicy, t as SAAS_API_KEY_LIMIT } from "../../policy-Czo4n3Hs.js";
+import { $n as Delegation, Q as LimitStore, Rt as Instant, Zn as CustomRole, ar as Subject, it as RelationSource, nr as Membership, qn as Actor, rr as Principal } from "../../policy-types-n0uRTsW8.js";
+import { w as Permission } from "../../vocabulary-CN8H_9UF.js";
+import { i as PermDockOptions } from "../../permdock-SV8ZINYT.js";
+import { a as SaasProject, c as saasPlans, i as SaasFolderSchema, l as saasRoles, n as SaasDocSchema, o as SaasProjectSchema, r as SaasFolder, s as saasPermissions, t as SaasDoc, u as saasTenantRoleNames } from "../../permissions-u_KHg-sN.js";
+import { n as saasPolicy, t as SAAS_API_KEY_LIMIT } from "../../policy-77FSAq_V.js";
 import { StandardSchemaV1 } from "@standard-schema/spec";
 //#region src/testing/saas/schema.d.ts
 type FieldKind = "string" | "boolean" | "nullable-string";

package/dist/testing/saas/index.js

@@ -1,3 +1,3 @@
-import { a as saasPlans, c as rowSchema, i as saasPermissions, n as SaasFolderSchema, o as saasRoles, r as SaasProjectSchema, s as saasTenantRoleNames, t as SaasDocSchema } from "../../permissions-CZKiUfFM.js";
-import { C as saasOrg, D as saasUsers, E as saasSeed, O as SAAS_API_KEY_LIMIT, S as saasMemberships, T as saasRelations, _ as verifySaasToken, a as saasProject, b as SAAS_EXPIRED_AT, c as saasUser, d as saasIssuer, f as saasJwks, g as verifySaasSession, h as signSaasToken, i as saasLimitStore, k as saasPolicy, l as SAAS_TOKEN_TTL_SECONDS, m as saasPublicJwk, n as saasFolder, o as saasScenarioOptions, p as saasPrivateJwk, r as saasFolderScenarios, s as saasScenarios, t as saasDoc, u as saasAudience, v as saasSchemaSql, w as saasPrincipal, x as saasCustomRoles, y as saasSeedSql } from "../../saas-FO-Q8oj0.js";
+import { a as saasPlans, c as rowSchema, i as saasPermissions, n as SaasFolderSchema, o as saasRoles, r as SaasProjectSchema, s as saasTenantRoleNames, t as SaasDocSchema } from "../../permissions-BPxlwVhN.js";
+import { C as saasOrg, D as saasUsers, E as saasSeed, O as SAAS_API_KEY_LIMIT, S as saasMemberships, T as saasRelations, _ as verifySaasToken, a as saasProject, b as SAAS_EXPIRED_AT, c as saasUser, d as saasIssuer, f as saasJwks, g as verifySaasSession, h as signSaasToken, i as saasLimitStore, k as saasPolicy, l as SAAS_TOKEN_TTL_SECONDS, m as saasPublicJwk, n as saasFolder, o as saasScenarioOptions, p as saasPrivateJwk, r as saasFolderScenarios, s as saasScenarios, t as saasDoc, u as saasAudience, v as saasSchemaSql, w as saasPrincipal, x as saasCustomRoles, y as saasSeedSql } from "../../saas-BCXRuXca.js";
 export { SAAS_API_KEY_LIMIT, SAAS_EXPIRED_AT, SAAS_TOKEN_TTL_SECONDS, SaasDocSchema, SaasFolderSchema, SaasProjectSchema, rowSchema, saasAudience, saasCustomRoles, saasDoc, saasFolder, saasFolderScenarios, saasIssuer, saasJwks, saasLimitStore, saasMemberships, saasOrg, saasPermissions, saasPlans, saasPolicy, saasPrincipal, saasPrivateJwk, saasProject, saasPublicJwk, saasRelations, saasRoles, saasScenarioOptions, saasScenarios, saasSchemaSql, saasSeed, saasSeedSql, saasTenantRoleNames, saasUser, saasUsers, signSaasToken, verifySaasSession, verifySaasToken };

package/dist/testing/saas/permissions.d.ts

@@ -1,2 +1,2 @@
-import { a as SaasProject, c as saasPlans, i as SaasFolderSchema, l as saasRoles, n as SaasDocSchema, o as SaasProjectSchema, r as SaasFolder, s as saasPermissions, t as SaasDoc, u as saasTenantRoleNames } from "../../permissions-oEWfl-kl.js";
+import { a as SaasProject, c as saasPlans, i as SaasFolderSchema, l as saasRoles, n as SaasDocSchema, o as SaasProjectSchema, r as SaasFolder, s as saasPermissions, t as SaasDoc, u as saasTenantRoleNames } from "../../permissions-u_KHg-sN.js";
 export { SaasDoc, SaasDocSchema, SaasFolder, SaasFolderSchema, SaasProject, SaasProjectSchema, saasPermissions, saasPlans, saasRoles, saasTenantRoleNames };

package/dist/testing/saas/permissions.js

@@ -1 +1 @@
-export { t as SaasDocSchema, n as SaasFolderSchema, r as SaasProjectSchema, i as saasPermissions, a as saasPlans, o as saasRoles, s as saasTenantRoleNames } from "../../permissions-CZKiUfFM.js";
+export { t as SaasDocSchema, n as SaasFolderSchema, r as SaasProjectSchema, i as saasPermissions, a as saasPlans, o as saasRoles, s as saasTenantRoleNames } from "../../permissions-BPxlwVhN.js";

package/dist/trpc/index.d.ts

@@ -1,10 +1,10 @@
-import { T as Policy, rr as Principal } from "../policy-types-DzwivBgR.js";
-import { w as Permission } from "../vocabulary-D6lPdb4Z.js";
-import { r as PermDock } from "../permdock-D7eeLJER.js";
+import { T as Policy, rr as Principal } from "../policy-types-n0uRTsW8.js";
+import { w as Permission } from "../vocabulary-CN8H_9UF.js";
+import { r as PermDock } from "../permdock-SV8ZINYT.js";
 import { n as RevocationFeed } from "../revocations-R07lFBnX.js";
-import { D as ConnectionOptions, T as Connection, i as OpenApiHooks } from "../server-types-BLd4MnBX.js";
-import { t as ServerAdapterOptions } from "../bind--9EFVYWF.js";
-import { t as StreamProtectOptions } from "../stream-7-xmnf3U.js";
+import { D as ConnectionOptions, T as Connection, i as OpenApiHooks } from "../server-types-CKQiCnON.js";
+import { t as ServerAdapterOptions } from "../bind-DOyrv6zi.js";
+import { t as StreamProtectOptions } from "../stream-CeCMJmBB.js";
 import { AnyTRPCMiddlewareFunction } from "@trpc/server";
 //#region src/trpc/create.d.ts
 type TrpcMiddlewareOpts<TCtx = object, TInput = unknown> = {

package/dist/trpc/index.js

@@ -1,8 +1,8 @@
 import { o as problemMessage } from "../http-BBoKefeS.js";
-import { t as problemFromError } from "../map-error-TCAdw-eW.js";
-import { n as attached } from "../bind-CZzhx-Vj.js";
+import { t as problemFromError } from "../map-error-Dr70oA_3.js";
+import { n as attached } from "../bind-CAvgUuKs.js";
 import { i as isAsyncIterable, o as reloadAfter } from "../stream-CvdUS9V1.js";
-import { i as rpcCode, n as guardStream, r as problemBody, t as bindRpcKernel } from "../rpc-aPyNi6tA.js";
+import { i as rpcCode, n as guardStream, r as problemBody, t as bindRpcKernel } from "../rpc-VSl5ylaQ.js";
 import { TRPCError, isTrackedEnvelope } from "@trpc/server";
 //#region src/trpc/create.ts
 const PROBLEM = Symbol.for("permdock.problem");

package/dist/{types-C8-KNsFf.d.ts → types-8RnwUAvE.d.ts}

@@ -1,8 +1,8 @@
-import { dt as TokenVerifier, ir as Subject, ot as SnapshotSource, q as DecisionSink, ut as TokenSigner } from "./policy-types-DzwivBgR.js";
-import { o as PolicySource } from "./hosted-DBDX0M-P.js";
-import { m as ApprovalStore, u as ApprovalRequest } from "./types-CCpc2Dcv.js";
-import { a as CatalogDocument } from "./types-CZTnPFzM.js";
-import { a as CatalogFinding } from "./sink-Bj_lDUDq.js";
+import { ar as Subject, dt as TokenVerifier, ot as SnapshotSource, q as DecisionSink, ut as TokenSigner } from "./policy-types-n0uRTsW8.js";
+import { o as PolicySource } from "./hosted-BPk51-kX.js";
+import { m as ApprovalStore, u as ApprovalRequest } from "./types-BdtSDbBO.js";
+import { a as CatalogDocument } from "./types-Druu9wLM.js";
+import { a as CatalogFinding } from "./sink-4-eQIRWf.js";
 //#region src/cloud/types.d.ts
 type CloudEndpointOptions = {
   readonly url?: string;

package/dist/{types-BNORmDM8.d.ts → types-B3_ooZgZ.d.ts}

@@ -1,7 +1,7 @@
-import { $n as Delegation, Nn as Decision, Vt as Snapshot, dt as TokenVerifier, j as PolicyVocabulary, qn as Actor, rr as Principal } from "./policy-types-DzwivBgR.js";
-import { w as Permission } from "./vocabulary-D6lPdb4Z.js";
-import { r as PermDock } from "./permdock-D7eeLJER.js";
-import { n as DescribeMessages, t as DecisionDescription } from "./describe-BZUsixiL.js";
+import { $n as Delegation, Nn as Decision, Vt as Snapshot, dt as TokenVerifier, j as PolicyVocabulary, qn as Actor, rr as Principal } from "./policy-types-n0uRTsW8.js";
+import { w as Permission } from "./vocabulary-CN8H_9UF.js";
+import { r as PermDock } from "./permdock-SV8ZINYT.js";
+import { n as DescribeMessages, t as DecisionDescription } from "./describe-B5qgDvEW.js";
 //#region src/client/request.d.ts
 type StoreHeaders = Readonly<Record<string, string>>;
 //#endregion

package/dist/{types-CCpc2Dcv.d.ts → types-BdtSDbBO.d.ts}

@@ -1,5 +1,5 @@
-import { Cn as RelationGrantee, Rt as Instant, fn as Approver, ir as Subject, nr as Membership, o as ApprovalStage, on as WireDelegation, r as ApprovalMode, sr as AdapterId } from "./policy-types-DzwivBgR.js";
-import { V as AppData } from "./vocabulary-D6lPdb4Z.js";
+import { Cn as RelationGrantee, Rt as Instant, ar as Subject, cr as AdapterId, fn as Approver, nr as Membership, o as ApprovalStage, on as WireDelegation, r as ApprovalMode } from "./policy-types-n0uRTsW8.js";
+import { V as AppData } from "./vocabulary-CN8H_9UF.js";
 //#region src/approvals/types.d.ts
 type ApprovalStatus = "pending" | "approved" | "rejected" | "expired";
 type ApprovalApprovers = {

package/dist/{types-DX0LaKTb.d.ts → types-BtHtcKMr.d.ts}

@@ -1,6 +1,6 @@
-import { $t as DeliveryFailureCause, Qt as DeliveryEvent, Zt as DeliveryChannel, tn as EmailCategory, zn as GrantedDecision } from "./policy-types-DzwivBgR.js";
-import { s as CloudEvent } from "./sink-Bj_lDUDq.js";
-import { t as ApprovalPrompt } from "./approval-prompt-Djo_PyZc.js";
+import { $t as DeliveryFailureCause, Qt as DeliveryEvent, Zt as DeliveryChannel, tn as EmailCategory, zn as GrantedDecision } from "./policy-types-n0uRTsW8.js";
+import { s as CloudEvent } from "./sink-4-eQIRWf.js";
+import { t as ApprovalPrompt } from "./approval-prompt-DvSSPQJX.js";
 //#region src/delivery/types.d.ts
 /**
  * Who a delivery goes to. `{ principal }` names an app principal and the

package/dist/{types-CdlxsYQh.d.ts → types-BzzaHxt3.d.ts}

@@ -1,4 +1,4 @@
-import { qt as AuthEvent, rr as Principal } from "./policy-types-DzwivBgR.js";
+import { qt as AuthEvent, rr as Principal } from "./policy-types-n0uRTsW8.js";
 import { t as ClaimsMap } from "./claims-map-Ca-QX8C6.js";
 import { t as ClientNames } from "./clients-C7zLFuWT.js";
 import { StandardSchemaV1 } from "@standard-schema/spec";

package/dist/{types-DiQjupG2.d.ts → types-C791HFu9.d.ts}

@@ -1,5 +1,5 @@
-import { Y as JwtClaims, dt as TokenVerifier, et as MembershipSource, ir as Subject, lt as TokenFailureCause, qn as Actor, qt as AuthEvent, rr as Principal } from "./policy-types-DzwivBgR.js";
-import { m as ApprovalStore } from "./types-CCpc2Dcv.js";
+import { Y as JwtClaims, ar as Subject, dt as TokenVerifier, et as MembershipSource, lt as TokenFailureCause, qn as Actor, qt as AuthEvent, rr as Principal } from "./policy-types-n0uRTsW8.js";
+import { m as ApprovalStore } from "./types-BdtSDbBO.js";
 import { n as RevocationFeed } from "./revocations-R07lFBnX.js";
 import { t as ClaimsMap } from "./claims-map-Ca-QX8C6.js";
 import { t as ClientNames } from "./clients-C7zLFuWT.js";