permdock 0.5.0 → 0.7.0

package/dist/{types-5Ut_pbKy.d.ts → types-BWZybqs9.d.ts}

@@ -1,5 +1,5 @@
-import { n as RoleThrough } from "./types-CdlxsYQh.js";
-import { o as SqlMembershipSource } from "./sources-BV9j0DeZ.js";
+import { n as RoleMap, r as RoleThrough } from "./types-BfVmNJO5.js";
+import { s as SqlMembershipSource } from "./sources-DEEuGb8S.js";
 //#region src/cli/core/errors.d.ts
 /**
  * 0 success, 1 failure, 2 usage, 3 action required, 130 interrupted (SIGINT
@@ -25,7 +25,7 @@ type RlsMembershipTable = {
    * The role key column, a reference to a roles table that holds the key, or
    * several of them: the row holds every non-null key.
    */
-  readonly role: string | RoleThrough | readonly (string | RoleThrough)[];
+  readonly role: string | RoleMap | RoleThrough | readonly (string | RoleMap | RoleThrough)[];
   /** Per scope name, the column holding that scope's id: the table's own scope and its ancestors. */
   readonly columns?: Readonly<Record<string, string>>;
   /** Column of the first scope's id; shorthand for `columns[<first scope>]`. */
@@ -90,8 +90,39 @@ type RlsFunctionMapping = {
   readonly twin: unknown;
   readonly args?: readonly string[];
 };
+/**
+ * A table whose rows reach their scope through a parent table
+ * (`rls.tables`, `via`): the table's `key` column holds the parent's id, and
+ * the parent's `column` holds the scope instance id. The generated policies
+ * call `permitted_<parent, singular>_ids(p_grant)`, a `security definer`
+ * helper that joins the parent to `permitted_<scope>_ids`.
+ */
+type RlsTableVia = {
+  /** `schema.table` of the parent. */
+  readonly table: string;
+  /** The parent's column holding the scope instance id. */
+  readonly column: string;
+  /** This table's column holding the parent's id. Default `<parent table, singular>_id`. */
+  readonly key?: string;
+  /** The parent's id column. Default `id`. */
+  readonly id?: string;
+  /** SQL type of the parent's id column. Default `uuid` in the `supabase` dialect, else `text`. */
+  readonly type?: string;
+  /** The scope `column` holds. Default the policy's root scope. */
+  readonly scope?: string;
+};
+/**
+ * A resource's table: its `schema.table`, an object that adds `via`, or
+ * `false` for a resource with no table (a console permission), which gets no
+ * policies while its role grants are still seeded.
+ */
+type RlsTable = string | false | {
+  readonly table?: string;
+  readonly via: RlsTableVia;
+};
 type RlsConfig = {
-  readonly tables?: Readonly<Record<string, string>>;
+  /** Per resource, the table its policies target; the table is named after the resource when unset, and `false` means it has none. */
+  readonly tables?: Readonly<Record<string, RlsTable>>;
   readonly dialect?: RlsDialect;
   readonly memberships?: RlsMemberships;
   /**
@@ -108,6 +139,17 @@ type RlsConfig = {
   /** Emit FORCE ROW LEVEL SECURITY so the table owner is subject to the policies. */
   readonly force?: boolean;
   readonly fixtures?: string;
+  /**
+   * `rls verify` findings accepted as a baseline. `id` is the
+   * `<code>:<table>:<key>` the finding prints; `reason` is required. An entry
+   * no finding matches is a warning, so the baseline shrinks.
+   */
+  readonly verify?: {
+    readonly ignore?: readonly {
+      readonly id: string;
+      readonly reason: string;
+    }[];
+  };
   readonly tenantClaim?: string;
   /**
    * Which tenants the helpers and `memberOf` checks admit. `'active'`
@@ -185,6 +227,13 @@ type RlsConfig = {
      * path (a migration, a job, a nested trigger) moves the rows directly.
      */
     readonly roles?: RlsCustomRoleTable;
+    /**
+     * The audit function the by-id writers call after a save
+     * (`permdock_replace_custom_role_grants_by_id`), with `event_type`,
+     * `target_type`, `record_id`, `tenant` and `metadata` plus `args`.
+     * Needs `roles.primaryKey`.
+     */
+    readonly audit?: RlsCustomRoleAudit;
   };
   /**
    * Let link capabilities reach resource-scoped grants: `anon` policies that call
@@ -260,17 +309,27 @@ type RlsConfig = {
    */
   readonly readOnlyActors?: boolean | readonly string[];
   readonly apiKeys?: true | RlsApiKeys;
+  /**
+   * Narrow a delegated token (a `client_id`, or an `act` that is not a
+   * support or impersonation session) by its `scope` claim in every helper
+   * and policy: a grant passes only when one of the token's scopes reaches
+   * its permission (the permission's own scope, a former scope, or a policy
+   * `oauthScopes` entry). Denies always apply. Off by default.
+   */
+  readonly tokenScopes?: boolean;
   /** Supabase Realtime: policies on `realtime.messages` for private channels. Supabase dialect only. */
   readonly realtime?: RlsRealtime;
   /** Supabase Storage: policies on `storage.objects` for buckets keyed by a scope folder. Supabase dialect only. */
   readonly storage?: RlsStorage;
   /**
    * `'views'`: one `security_invoker` view `<table>_visible` per table with field-limited
-   * read grants, whose restricted columns are `case when <permitted> then col end`. Off by default.
+   * read grants, whose restricted columns are `case when <permitted> then col end`. `'mask'`:
+   * the same views plus `<schema>.<table>_mask(p_row)`, which nulls the restricted columns of
+   * one row by the same masks, for SQL that reads the table without the view. Off by default.
    */
-  readonly fields?: "views";
+  readonly fields?: "views" | "mask";
   /**
-   * With `fields: 'views'`, grant `anon` and `authenticated` only the unrestricted columns of
+   * With `fields: 'views'` or `'mask'`, grant `anon` and `authenticated` only the unrestricted columns of
    * the base table, so restricted columns are read through the view. Breaks `select *`.
    */
   readonly revokeColumns?: boolean;
@@ -298,6 +357,17 @@ type RlsConfig = {
    * row ids the caller may act on, as the generated policies decide them.
    */
   readonly rowHelpers?: true | readonly string[];
+  /**
+   * `'function'`: the `role_permissions` rows live in
+   * `<schema>.seed()`, which the helpers part creates. Declarative workflows
+   * (pg-delta, migra) then need no seeds migration: call
+   * `select <schema>.seed();` after each deploy.
+   *
+   * `'view'`: `role_permissions` is a `security_invoker` view over a `values`
+   * list, so the rows travel with the declarative schema and need no seeding
+   * step. Nothing can write the rows, so the view cannot take hand-added ones.
+   */
+  readonly seeds?: "function" | "view";
   readonly trustedReaders?: readonly string[];
   readonly treeValues?: Readonly<Record<string, Readonly<Record<string, unknown>>>>;
   /** `rls migrate`: how existing helper calls map onto the generated helpers. */
@@ -364,7 +434,7 @@ type RlsAssignmentTable = {
   /** The tenant column for a scope below the first; defaults to `id` at the first scope. */
   readonly tenant?: string;
   /** The role key column, a reference to a roles table that holds the key, or several of them. */
-  readonly role: string | RoleThrough | readonly (string | RoleThrough)[];
+  readonly role: string | RoleMap | RoleThrough | readonly (string | RoleMap | RoleThrough)[];
   /** The column holding the user the row assigns to, which `ownRole` compares with the caller. */
   readonly user?: string;
 };
@@ -379,8 +449,12 @@ type RlsCustomRoleTable = {
   readonly scope?: string;
   /** A column pinning the role to one instance of its scope. */
   readonly id?: string;
+  /** The row's id column: turns on the by-id write and read functions (`permdock_replace_custom_role_grants_by_id`). */
+  readonly primaryKey?: string;
   /** A boolean column marking rows that are not custom roles (declared or system roles); those rows are skipped. */
   readonly skip?: string;
+  /** A boolean column marking a row with no tenant as a shared custom role, held at `scope` (default the first scope) in every tenant. Without it a row with no tenant is a platform role. */
+  readonly shared?: string;
 };
 /** `rls.customRoles` as an object: custom roles on, plus where existing ones live. */
 type RlsCustomRolesConfig = {
@@ -393,6 +467,14 @@ type RlsCustomRolesConfig = {
  * instance and `skip` flag.
  */
 type RlsCustomRolesFrom = {
+  /**
+   * `'trigger'`: after-row triggers on the permissions table and the
+   * includes table rebuild the affected role through
+   * `permdock_trusted_replace_custom_role_grants` on every legacy write, so
+   * the PermDock grants follow the application's editor. Without it the
+   * backfill copies once.
+   */
+  readonly sync?: "trigger";
   readonly permissions: {
     /** `table` or `schema.table`: one row per permission a role holds. */
     readonly table: string;
@@ -439,6 +521,13 @@ type RlsAudit = {
   /** Named text arguments: `{ tenant_column: 'tenant_id' }` passes `tenant_column => 'tenant_id'`. */
   readonly args?: Readonly<Record<string, string>>;
 };
+/** `rls.customRoleWrites.audit`: the function a by-id custom-role save calls. */
+type RlsCustomRoleAudit = {
+  /** `schema.function` taking named `event_type`, `target_type`, `record_id`, `tenant` and `metadata` arguments. */
+  readonly function: string;
+  /** Extra named text arguments: `{ actor_kind: 'user' }` passes `actor_kind => 'user'`. */
+  readonly args?: Readonly<Record<string, string>>;
+};
 /** `rls.shims`: where the legacy-named wrappers go. */
 type RlsShimsConfig = {
   /** Schema of the legacy helpers. Default `public`. */
@@ -560,6 +649,19 @@ type SupabaseHookConfig = {
    * suspended user gets none.
    */
   readonly claims?: Readonly<Record<string, string>>;
+  /**
+   * The `team_ids` claim: the uuid of every team the user belongs to, read
+   * from `table` (`user` and `team` columns; `tenant` puts the active
+   * tenant's teams first). It shares the `memberships` budget, so a user with
+   * many teams gets a prefix and `memberships_truncated`. A suspended user
+   * gets none. Clients must not write the table.
+   */
+  readonly teams?: {
+    readonly table: string;
+    readonly user: string;
+    readonly team: string;
+    readonly tenant?: string;
+  };
   readonly before?: string | readonly string[];
   /**
    * Check the claims the hook wrote against `supabase-claims-v1.json` with
@@ -624,6 +726,8 @@ type DoctorConfig = {
   readonly migrations?: readonly string[];
   /** A JSON array of sample decoded token claims; PD039 measures each `supabase.hook.claims` entry in it. */
   readonly claims?: string;
+  /** Tables two resources map to on purpose, over disjoint rows; PD075 skips them. */
+  readonly sharedTables?: readonly string[];
 };
 type PermDockConfig = {
   readonly permissions?: string;

package/dist/{types-CZTnPFzM.d.ts → types-BXMYB7BY.d.ts}

@@ -1,5 +1,5 @@
-import { I as ResourceRelation } from "./vocabulary-D6lPdb4Z.js";
-import { s as OperationMeta } from "./operations-CxybZErY.js";
+import { C as ResourceRelation } from "./permission-types-DhNEmoRG.js";
+import { s as OperationMeta } from "./operations-BNLes61x.js";
 //#region src/catalog/types.d.ts
 type CatalogUsage = {
   readonly file: string;

package/dist/{types-CdlxsYQh.d.ts → types-BfVmNJO5.d.ts}

@@ -1,4 +1,4 @@
-import { qt as AuthEvent, rr as Principal } from "./policy-types-DzwivBgR.js";
+import { Zt as AuthEvent, sr as Principal } from "./policy-types-B-F-qAZk.js";
 import { t as ClaimsMap } from "./claims-map-Ca-QX8C6.js";
 import { t as ClientNames } from "./clients-C7zLFuWT.js";
 import { StandardSchemaV1 } from "@standard-schema/spec";
@@ -49,6 +49,8 @@ type SupabasePermDockClaims<TenantClaim extends string = "tenant_id"> = {
   readonly memberships_truncated?: boolean;
   /** Allow-listed server-owned attributes, read as `principal.claims.attrs.<key>`. */
   readonly attrs?: Readonly<Record<string, unknown>>;
+  /** The uuid of every team the user belongs to (`supabase.hook.teams`), cut by the same budget as `memberships`. */
+  readonly team_ids?: readonly string[];
   /** The principal's authorization version. */
   readonly authz_ver?: number;
 } & { readonly [K in TenantClaim]?: string; };
@@ -114,6 +116,15 @@ type RoleThrough = {
   /** The column of `through` that holds the value: the role key, or the user id. */
   readonly column: string;
 };
+/**
+ * A role column whose values are not role keys: each value maps to a role key,
+ * or to `null` for no role, and an unlisted value is no role
+ * (`{ column: 'kind', map: { admin: 'owner', user: null } }`).
+ */
+type RoleMap = {
+  readonly column: string;
+  readonly map: Readonly<Record<string, string | null>>;
+};
 type SupabaseMembershipTable = {
   readonly table: string;
   readonly user: string;
@@ -121,7 +132,7 @@ type SupabaseMembershipTable = {
    * The role key column, a reference to a roles table that holds the key, or
    * several of them: the row holds every non-null key.
    */
-  readonly role: string | RoleThrough | readonly (string | RoleThrough)[];
+  readonly role: string | RoleThrough | RoleMap | readonly (string | RoleThrough | RoleMap)[];
   /** Per scope name, the column holding that scope's id: the table's own scope and its ancestors. */
   readonly columns?: Readonly<Record<string, string>>;
   readonly tenant?: string;
@@ -315,4 +326,4 @@ type SupabaseDelegation = {
   readonly scopes: readonly string[];
 };
 //#endregion
-export { SupabaseClaimsSchema as C, supabaseClaims as E, SupabaseClaimsOptions as S, SupabasePermDockClaims as T, SupabaseSuspendedMembership as _, SupabaseActorResult as a, SupabaseActClaim as b, SupabaseMembershipTable as c, SupabaseRealtime as d, SupabaseRlsConfig as f, SupabaseSubjectOptions as g, SupabaseStorage as h, SupabaseActor as i, SupabasePermissionRef as l, SupabaseSessionLike as m, RoleThrough as n, SupabaseDelegation as o, SupabaseRlsOptions as p, SupabaseActiveRow as r, SupabaseInclude as s, AuthorizeSqlOptions as t, SupabasePrincipal as u, SupabaseSuspendedScope as v, SupabaseMembershipClaim as w, SupabaseClaims as x, SupabaseSuspension as y };
+export { SupabaseClaimsOptions as C, supabaseClaims as D, SupabasePermDockClaims as E, SupabaseClaims as S, SupabaseMembershipClaim as T, SupabaseSubjectOptions as _, SupabaseActor as a, SupabaseSuspension as b, SupabaseInclude as c, SupabasePrincipal as d, SupabaseRealtime as f, SupabaseStorage as g, SupabaseSessionLike as h, SupabaseActiveRow as i, SupabaseMembershipTable as l, SupabaseRlsOptions as m, RoleMap as n, SupabaseActorResult as o, SupabaseRlsConfig as p, RoleThrough as r, SupabaseDelegation as s, AuthorizeSqlOptions as t, SupabasePermissionRef as u, SupabaseSuspendedMembership as v, SupabaseClaimsSchema as w, SupabaseActClaim as x, SupabaseSuspendedScope as y };

package/dist/{types-BqAKcRNW.d.ts → types-CIeZcG8v.d.ts}

@@ -1,5 +1,5 @@
-import { Xt as DecisionEvent, j as PolicyVocabulary } from "./policy-types-DzwivBgR.js";
-import { r as PermDock } from "./permdock-D7eeLJER.js";
+import { en as DecisionEvent, j as PolicyVocabulary } from "./policy-types-B-F-qAZk.js";
+import { a as PermDock } from "./permdock-Dco6dyCK.js";
 //#region src/otel/types.d.ts
 declare const GENAI_SEMCONV_PIN = "1.37.0";
 declare const GEN_AI_TOOL_NAME = "gen_ai.tool.name";

package/dist/{types-BNORmDM8.d.ts → types-CKV71kKh.d.ts}

@@ -1,7 +1,7 @@
-import { $n as Delegation, Nn as Decision, Vt as Snapshot, dt as TokenVerifier, j as PolicyVocabulary, qn as Actor, rr as Principal } from "./policy-types-DzwivBgR.js";
-import { w as Permission } from "./vocabulary-D6lPdb4Z.js";
-import { r as PermDock } from "./permdock-D7eeLJER.js";
-import { n as DescribeMessages, t as DecisionDescription } from "./describe-BZUsixiL.js";
+import { Gt as Snapshot, Ln as Decision, Zn as Actor, dt as TokenVerifier, j as PolicyVocabulary, rr as Delegation, sr as Principal } from "./policy-types-B-F-qAZk.js";
+import { u as Permission } from "./permission-types-DhNEmoRG.js";
+import { a as PermDock } from "./permdock-Dco6dyCK.js";
+import { n as DescribeMessages, t as DecisionDescription } from "./describe-O0SwYIK8.js";
 //#region src/client/request.d.ts
 type StoreHeaders = Readonly<Record<string, string>>;
 //#endregion

package/dist/{types-tIgIeIKJ.d.ts → types-CQVEQawv.d.ts}

@@ -1,7 +1,7 @@
-import { Mn as ApprovalRequiredDecision, Nn as Decision, Vt as Snapshot, dt as TokenVerifier, zn as GrantedDecision } from "./policy-types-DzwivBgR.js";
-import { w as Permission } from "./vocabulary-D6lPdb4Z.js";
-import { n as DescribeMessages } from "./describe-BZUsixiL.js";
-import { h as ClientStoreOptions } from "./types-BNORmDM8.js";
+import { Gt as Snapshot, In as ApprovalRequiredDecision, Ln as Decision, Un as GrantedDecision, dt as TokenVerifier } from "./policy-types-B-F-qAZk.js";
+import { u as Permission } from "./permission-types-DhNEmoRG.js";
+import { n as DescribeMessages } from "./describe-O0SwYIK8.js";
+import { h as ClientStoreOptions } from "./types-CKV71kKh.js";
 import { ReactNode } from "react";
 //#region src/react/types.d.ts
 type PermDockProviderProps = ({

package/dist/{types-BjV-fqcA.d.ts → types-CeIscIKp.d.ts}

@@ -1,7 +1,7 @@
-import { Vt as Snapshot, dt as TokenVerifier, ot as SnapshotSource } from "./policy-types-DzwivBgR.js";
-import { n as DescribeMessages } from "./describe-BZUsixiL.js";
-import { h as ClientStoreOptions } from "./types-BNORmDM8.js";
-import { t as PermDockDefaults } from "./types-tIgIeIKJ.js";
+import { Gt as Snapshot, dt as TokenVerifier, ot as SnapshotSource } from "./policy-types-B-F-qAZk.js";
+import { n as DescribeMessages } from "./describe-O0SwYIK8.js";
+import { h as ClientStoreOptions } from "./types-CKV71kKh.js";
+import { t as PermDockDefaults } from "./types-CQVEQawv.js";
 import { ReactNode } from "react";
 //#region src/react-native/types.d.ts
 type SnapshotStorage = {

package/dist/{types-_sHy8BQf.d.ts → types-CfiKC5aN.d.ts}

@@ -1,4 +1,4 @@
-import { fn as Approver } from "./policy-types-DzwivBgR.js";
+import { gn as Approver } from "./policy-types-B-F-qAZk.js";
 //#region src/approvals/access-reviews/types.d.ts
 type AccessReviewStatus = "open" | "closed";
 type AccessReviewItemStatus = "pending" | "kept" | "revoked";

package/dist/{types-ClZaWzfb.d.ts → types-D3A19w4A.d.ts}

@@ -1,6 +1,6 @@
-import { Nn as Decision, Rn as ExplainedDecision, T as Policy, ir as Subject, j as PolicyVocabulary, nr as Membership, rr as Principal } from "./policy-types-DzwivBgR.js";
-import { E as PermissionTree, w as Permission } from "./vocabulary-D6lPdb4Z.js";
-import { c as WhereResult, i as PermDockOptions, n as DeriveOptions, o as SimulateOptions, r as PermDock, t as DecideOptions } from "./permdock-D7eeLJER.js";
+import { Hn as ExplainedDecision, Ln as Decision, T as Policy, j as PolicyVocabulary, lr as Subject, or as Membership, sr as Principal } from "./policy-types-B-F-qAZk.js";
+import { f as PermissionTree, u as Permission } from "./permission-types-DhNEmoRG.js";
+import { a as PermDock, c as SimulateOptions, n as DecideOptions, o as PermDockOptions, r as DeriveOptions, u as WhereResult, x as PermissionCheck } from "./permdock-Dco6dyCK.js";
 //#region src/pdp/types.d.ts
 type RemotePdpAuth = {
   readonly bearer: string | (() => string | Promise<string>);
@@ -86,7 +86,7 @@ type SpiceDbOptions = {
   readonly cache?: RemotePdpCache;
   readonly fetch?: typeof fetch;
 };
-type PdpPermDock<V extends PolicyVocabulary = PolicyVocabulary> = Omit<PermDock<V>, "can" | "decide" | "decideEach" | "assert" | "explain" | "filter" | "where" | "simulate" | "tenant" | "team" | "derive"> & {
+type PdpPermDock<V extends PolicyVocabulary = PolicyVocabulary> = Omit<PermDock<V>, "can" | "decide" | "canAll" | "decideAll" | "decideEach" | "decideIds" | "assert" | "explain" | "filter" | "where" | "simulate" | "tenant" | "team" | "derive"> & {
   /** `permdock.derive` with the same providers: the result asks the PDP too. */
   readonly derive: (options: DeriveOptions) => Promise<PdpPermDock<V>>;
   /**
@@ -97,6 +97,10 @@ type PdpPermDock<V extends PolicyVocabulary = PolicyVocabulary> = Omit<PermDock<
   readonly where: (permission: Permission) => Promise<WhereResult>;
   readonly can: (permission: Permission, data?: unknown, options?: DecideOptions) => Promise<boolean>;
   readonly decide: (permission: Permission, data?: unknown, options?: DecideOptions) => Promise<Decision>;
+  /** `can` for every check, asking the PDP for each in parallel; `false` for an empty list. */
+  readonly canAll: (checks: readonly PermissionCheck[], options?: DecideOptions) => Promise<boolean>;
+  /** `decide` for every check, in check order, asking the PDP for each in parallel. */
+  readonly decideAll: (checks: readonly PermissionCheck[], options?: DecideOptions) => Promise<readonly Decision[]>;
   /** `decide` for each row, in row order, asking the PDP per row. */
   readonly decideEach: (permission: Permission, rows: readonly unknown[], options?: DecideOptions) => Promise<readonly Decision[]>;
   readonly assert: (permission: Permission, data?: unknown, options?: DecideOptions) => Promise<Extract<Decision, {

package/dist/{types-C8-KNsFf.d.ts → types-DBHftjgS.d.ts}

@@ -1,8 +1,8 @@
-import { dt as TokenVerifier, ir as Subject, ot as SnapshotSource, q as DecisionSink, ut as TokenSigner } from "./policy-types-DzwivBgR.js";
-import { o as PolicySource } from "./hosted-DBDX0M-P.js";
-import { m as ApprovalStore, u as ApprovalRequest } from "./types-CCpc2Dcv.js";
-import { a as CatalogDocument } from "./types-CZTnPFzM.js";
-import { a as CatalogFinding } from "./sink-Bj_lDUDq.js";
+import { dt as TokenVerifier, lr as Subject, ot as SnapshotSource, q as DecisionSink, ut as TokenSigner } from "./policy-types-B-F-qAZk.js";
+import { s as PolicySource } from "./hosted-BmjzxQhp.js";
+import { m as ApprovalStore, u as ApprovalRequest } from "./types-DC44-hqb.js";
+import { a as CatalogDocument } from "./types-BXMYB7BY.js";
+import { a as CatalogFinding } from "./sink-Cp_Eot9W.js";
 //#region src/cloud/types.d.ts
 type CloudEndpointOptions = {
   readonly url?: string;
@@ -59,10 +59,11 @@ type CloudOptions = CloudConnectionOptions & {
   readonly source?: string;
   /**
    * Verifies the environment's signed policy document, typically
-   * `joseTokenVerifier({ jwks: cloudEndpoints().jwks })`. Without one,
+   * `({ jwks }) => joseTokenVerifier({ jwks })`. A function is called once,
+   * with the resolved endpoints, on the first refresh. Without one,
    * `policies.current()` stays `null`: an unverifiable document is never applied.
    */
-  readonly verifier?: TokenVerifier;
+  readonly verifier?: TokenVerifier | ((endpoints: CloudEndpoints) => TokenVerifier);
 };
 /**
  * What `POST /catalog` answers: `201` with the new version and the drift
@@ -86,7 +87,13 @@ type CloudCatalog = {
    */
   push(catalog: CatalogDocument): Promise<CloudCatalogPush>;
 };
-type CloudClient = CloudEndpoints & {
+type CloudClient = Partial<CloudEndpoints> & {
+  /**
+   * The environment URL and JWK Set URL. `issuer` and `jwks` are set only
+   * when the environment is configured; otherwise the first call asks
+   * `GET /v1/environment` which environment the key belongs to.
+   */
+  endpoints(): Promise<CloudEndpoints>;
   readonly approvals: ApprovalStore;
   readonly sink: DecisionSink;
   /**

package/dist/{types-CCpc2Dcv.d.ts → types-DC44-hqb.d.ts}

@@ -1,5 +1,5 @@
-import { Cn as RelationGrantee, Rt as Instant, fn as Approver, ir as Subject, nr as Membership, o as ApprovalStage, on as WireDelegation, r as ApprovalMode, sr as AdapterId } from "./policy-types-DzwivBgR.js";
-import { V as AppData } from "./vocabulary-D6lPdb4Z.js";
+import { Dn as RelationGrantee, Rt as Instant, fr as AdapterId, gn as Approver, lr as Subject, o as ApprovalStage, or as Membership, r as ApprovalMode, un as WireDelegation } from "./policy-types-B-F-qAZk.js";
+import { O as AppData } from "./permission-types-DhNEmoRG.js";
 //#region src/approvals/types.d.ts
 type ApprovalStatus = "pending" | "approved" | "rejected" | "expired";
 type ApprovalApprovers = {

package/dist/{types-fbZ7JEXr.d.ts → types-DXmwu78Z.d.ts}

@@ -1,8 +1,8 @@
-import { Mn as ApprovalRequiredDecision, Nn as Decision, Vt as Snapshot, dt as TokenVerifier, zn as GrantedDecision } from "./policy-types-DzwivBgR.js";
-import { w as Permission } from "./vocabulary-D6lPdb4Z.js";
-import { r as PermDock } from "./permdock-D7eeLJER.js";
+import { Gt as Snapshot, In as ApprovalRequiredDecision, Ln as Decision, Un as GrantedDecision, dt as TokenVerifier } from "./policy-types-B-F-qAZk.js";
+import { u as Permission } from "./permission-types-DhNEmoRG.js";
+import { a as PermDock } from "./permdock-Dco6dyCK.js";
 import { t as PermissionBoundaryState } from "./boundary-BmHxVH1J.js";
-import { l as PermissionState, m as ClientStore, u as ProviderOptionsBase } from "./types-BNORmDM8.js";
+import { l as PermissionState, m as ClientStore, u as ProviderOptionsBase } from "./types-CKV71kKh.js";
 import { Snippet } from "svelte";
 import { Readable } from "svelte/store";
 //#region src/client/views.d.ts

package/dist/{types-DiQjupG2.d.ts → types-cTos-H7p.d.ts}

@@ -1,5 +1,5 @@
-import { Y as JwtClaims, dt as TokenVerifier, et as MembershipSource, ir as Subject, lt as TokenFailureCause, qn as Actor, qt as AuthEvent, rr as Principal } from "./policy-types-DzwivBgR.js";
-import { m as ApprovalStore } from "./types-CCpc2Dcv.js";
+import { Y as JwtClaims, Zn as Actor, Zt as AuthEvent, dt as TokenVerifier, et as MembershipSource, lr as Subject, lt as TokenFailureCause, sr as Principal } from "./policy-types-B-F-qAZk.js";
+import { m as ApprovalStore } from "./types-DC44-hqb.js";
 import { n as RevocationFeed } from "./revocations-R07lFBnX.js";
 import { t as ClaimsMap } from "./claims-map-Ca-QX8C6.js";
 import { t as ClientNames } from "./clients-C7zLFuWT.js";

package/dist/{types-DX0LaKTb.d.ts → types-g7Oy6Zg4.d.ts}

@@ -1,6 +1,6 @@
-import { $t as DeliveryFailureCause, Qt as DeliveryEvent, Zt as DeliveryChannel, tn as EmailCategory, zn as GrantedDecision } from "./policy-types-DzwivBgR.js";
-import { s as CloudEvent } from "./sink-Bj_lDUDq.js";
-import { t as ApprovalPrompt } from "./approval-prompt-Djo_PyZc.js";
+import { Un as GrantedDecision, an as EmailCategory, nn as DeliveryEvent, rn as DeliveryFailureCause, tn as DeliveryChannel } from "./policy-types-B-F-qAZk.js";
+import { s as CloudEvent } from "./sink-Cp_Eot9W.js";
+import { t as ApprovalPrompt } from "./approval-prompt-K0faOLFp.js";
 //#region src/delivery/types.d.ts
 /**
  * Who a delivery goes to. `{ principal }` names an app principal and the

package/dist/unplugin/index.d.ts

@@ -1,4 +1,4 @@
-import { a as PermDockPluginOptions } from "../types-5Ut_pbKy.js";
+import { a as PermDockPluginOptions } from "../types-BWZybqs9.js";
 import { createUnplugin } from "unplugin";
 //#region src/unplugin/index.d.ts
 type CreateUnplugin = typeof createUnplugin<PermDockPluginOptions | undefined>;

package/dist/unplugin/index.js

@@ -1,5 +1,5 @@
-import { n as createCollectScheduler, r as report } from "../watch-CszoTJMq.js";
-import { r as peerHint } from "../peer-C8swJ2GH.js";
+import { n as createCollectScheduler, r as report } from "../watch-C-4VmFlL.js";
+import { r as peerHint } from "../peer-12Q5I_RH.js";
 import { createRequire } from "node:module";
 //#region src/unplugin/index.ts
 function loadCreateUnplugin() {

package/dist/{usage-T5mXq98v.js → usage-Bybmck7f.js}

@@ -1,13 +1,13 @@
-import { a as getResource } from "./permission-registry-Br4jSNVi.js";
-import { u as usageResult } from "./errors-CWTY6uih.js";
+import { a as getResource } from "./permission-registry-DpPtSKNZ.js";
+import { u as usageResult } from "./errors-DpP_U6Bf.js";
 import { a as rel, r as listSourceFiles } from "./files-D_JIzUrP.js";
 import { o as USAGE_REPORT_SCHEMA } from "./version-CEbQ5UeM.js";
-import { s as jsonSchemaOf } from "./catalog-doc-C9wjsfNY.js";
-import { a as loadModule, n as asPolicy, s as pickNamed } from "./load-DFS_ry0W.js";
-import { r as runCollect } from "./collect-CrZJJnEF.js";
+import { c as jsonSchemaOf } from "./catalog-doc-CV9s6B1S.js";
+import { a as loadModule, n as asPolicy, s as pickNamed } from "./load-DxroEzH1.js";
+import { r as runCollect } from "./collect-BaWeMjwV.js";
 import { t as beforeFirst } from "./text-BMFRfBqc.js";
-import { t as DOCS_BASE } from "./manifest-CtKR3GXL.js";
-import { r as findingOf } from "./output-Dyw8fyPF.js";
+import { t as DOCS_BASE } from "./manifest-Dv6q4i5s.js";
+import { r as findingOf } from "./output-DgSDLrta.js";
 import { existsSync, readFileSync, realpathSync } from "node:fs";
 import { dirname, resolve } from "node:path";
 import { fileURLToPath, pathToFileURL } from "node:url";

package/dist/{usage-DHtE8j4E.js → usage-CDaLXCfL.js}

@@ -1,5 +1,5 @@
 import { t as defineLeaf } from "./command-L8EstFNm.js";
-import { a as failOnFlag } from "./flags-C3DktBDY.js";
+import { a as failOnFlag } from "./flags-aaeRAdiD.js";
 //#region src/cli/commands/usage.ts
 const usage = defineLeaf({
 	flags: {
@@ -16,7 +16,7 @@ const usage = defineLeaf({
 		}
 	},
 	async run(ctx, { flags }) {
-		return (await import("./usage-CHOtwL19.js")).runUsage({
+		return (await import("./usage-y-kBNdqs.js")).runUsage({
 			cwd: ctx.cwd,
 			config: ctx.config,
 			ignore: flags.ignore,

package/dist/usage-y-kBNdqs.js

@@ -0,0 +1 @@
+export { t as runUsage } from "./usage-Bybmck7f.js";

package/dist/{validation-error-Bg5Tpluk.d.ts → validation-error-CQpoquwj.d.ts}

@@ -1,4 +1,4 @@
-import { a as ProblemDetails } from "./errors-C2PXIv4c.js";
+import { a as ProblemDetails } from "./errors-B_Qg9D3e.js";
 import { StandardSchemaV1 } from "@standard-schema/spec";
 //#region src/core/validation-error.d.ts
 /** The base of every Problem Details `type` URI; defined here so a validation error does not pull in the Problem Details builders. */