permdock 0.6.0 → 0.7.0

package/dist/{catalog-DZVbrF-z.js → catalog-BaMQfQ6Y.js}

@@ -1,6 +1,6 @@
-import { c as missingInput } from "./errors-CWTY6uih.js";
+import { c as missingInput } from "./errors-DpP_U6Bf.js";
 import { t as defineLeaf } from "./command-L8EstFNm.js";
-import { c as given, l as outFlag, t as checkFlag, u as permissionsFlag } from "./flags-C3DktBDY.js";
+import { c as given, l as outFlag, t as checkFlag, u as permissionsFlag } from "./flags-aaeRAdiD.js";
 //#region src/cli/commands/catalog.ts
 const RUN_FORMAT = {
 	catalog: "json",
@@ -30,7 +30,7 @@ const catalog = defineLeaf({
 		...checkFlag
 	},
 	async run(ctx, { flags }) {
-		const { catalogFile, runCatalog } = await import("./catalog-BoWglDPI.js");
+		const { catalogFile, runCatalog } = await import("./catalog-BCCjSAdH.js");
 		const result = await runCatalog({
 			cwd: ctx.cwd,
 			config: ctx.config,

package/dist/{catalog-HD2gf5mY.js → catalog-D69WhFii.js}

@@ -1,9 +1,9 @@
 import { r as isRecord } from "./compact-CAf557ZB.js";
 import { r as listSourceFiles, t as defaultSrcPath } from "./files-D_JIzUrP.js";
-import { a as formatCatalogJson, i as catalogSchemaDocument, o as formatCatalogMarkdown, t as buildCatalog } from "./catalog-doc-Cdn7-0pQ.js";
-import { a as loadModule, i as loadConfiguredPolicy, r as leavesOf, s as pickNamed, t as asPermissionTree } from "./load-DFS_ry0W.js";
-import { a as loadConfiguredOperations, i as scanSources, r as runCollect } from "./collect-mLTY4nwb.js";
-import { n as fileSummary, t as applyFiles } from "./files-C5ZI27eV.js";
+import { a as catalogSchemaDocument, n as catalogForCompare, o as formatCatalogJson, r as catalogForDrift, s as formatCatalogMarkdown, t as buildCatalog } from "./catalog-doc-CV9s6B1S.js";
+import { a as loadModule, i as loadConfiguredPolicy, r as leavesOf, s as pickNamed, t as asPermissionTree } from "./load-DxroEzH1.js";
+import { a as loadConfiguredOperations, i as scanSources, r as runCollect } from "./collect-BaWeMjwV.js";
+import { n as fileSummary, t as applyFiles } from "./files-acUbNwWt.js";
 import { existsSync, readFileSync } from "node:fs";
 import { resolve } from "node:path";
 //#region src/cli/catalog.ts
@@ -53,18 +53,30 @@ async function runCatalog(input) {
 		output: formatCatalogJson(filtered)
 	};
 }
-/** The comparable form of a catalog file: without the fields every run changes. */
+/**
+* The comparable forms of a catalog file: without the fields every run
+* changes, then also without `usages[].line`.
+*/
 function comparable(text) {
 	try {
 		const parsed = JSON.parse(text);
 		if (isRecord(parsed)) {
-			const { generatedAt: _generatedAt, generator: _generator, ...rest } = parsed;
-			return JSON.stringify(rest);
+			const doc = parsed;
+			return {
+				full: catalogForCompare(doc),
+				drift: catalogForDrift(doc)
+			};
 		}
 	} catch {}
-	return text;
+	return {
+		full: text,
+		drift: text
+	};
 }
-/** `catalog --out`: writes the export, or with `--check` exits 1 when the file differs. */
+/**
+* `catalog --out`: writes the export, or with `--check` exits 1 when the file
+* differs by more than usage line numbers.
+*/
 function catalogFile(cwd, out, text, check) {
 	if (check) {
 		const path = resolve(cwd, out);
@@ -76,13 +88,31 @@ function catalogFile(cwd, out, text, check) {
 				stale: true
 			}
 		};
-		const stale = comparable(readFileSync(path, "utf8")) !== comparable(text);
+		const onDisk = comparable(readFileSync(path, "utf8"));
+		const generated = comparable(text);
+		if (onDisk.full === generated.full) return {
+			code: 0,
+			output: `${out} is up to date`,
+			data: {
+				out,
+				stale: false
+			}
+		};
+		if (onDisk.drift === generated.drift) return {
+			code: 0,
+			output: `catalog usages moved (lines only): ${out}; run permdock collect to refresh`,
+			data: {
+				out,
+				stale: false,
+				positionsMoved: true
+			}
+		};
 		return {
-			code: stale ? 1 : 0,
-			output: stale ? `catalog stale: ${out}` : `${out} is up to date`,
+			code: 1,
+			output: `catalog stale: ${out}`,
 			data: {
 				out,
-				stale
+				stale: true
 			}
 		};
 	}

package/dist/{catalog-doc-Cdn7-0pQ.js → catalog-doc-CV9s6B1S.js}

@@ -1,9 +1,10 @@
-import { a as getResource, c as listPermissions, h as formerKeys } from "./permission-registry-Br4jSNVi.js";
-import { t as canonicalJson } from "./canonical-json-BC8_nMTw.js";
-import { m as findRole, v as listRoles } from "./grantee-hxrUsbpM.js";
+import { r as isRecord } from "./compact-CAf557ZB.js";
+import { a as getResource, c as listPermissions, h as formerKeys } from "./permission-registry-DpPtSKNZ.js";
+import { t as canonicalJson } from "./canonical-json-DwilZ1iB.js";
+import { m as findRole, v as listRoles } from "./grantee-BrRANrpT.js";
 import { i as wireValidity } from "./validity-CZ7-y0Cj.js";
 import { t as byCodePoint } from "./compare-pfyVnBjE.js";
-import { t as catalogFingerprint } from "./catalog-fingerprint-CCP0-yQS.js";
+import { t as catalogFingerprint } from "./catalog-fingerprint-C144oW4M.js";
 import { t as catalogSchema } from "./schema-B4v0Qrac.js";
 import { t as policyRowConditionKeys } from "./row-conditions-h2HythXQ.js";
 import { c as generatorBanner, n as CATALOG_SCHEMA } from "./version-CEbQ5UeM.js";
@@ -292,6 +293,28 @@ function catalogForCompare(doc) {
 	const { generatedAt: _generatedAt, generator: _generator, ...rest } = doc;
 	return `${JSON.stringify(rest, null, 2)}\n`;
 }
+/**
+* `catalogForCompare` without `usages[].line`: an edit above a call site moves
+* its line without changing the contract, so `--check` does not fail on it.
+*/
+function catalogForDrift(doc) {
+	const permissions = doc.permissions;
+	if (!Array.isArray(permissions)) return catalogForCompare(doc);
+	const { generatedAt: _generatedAt, generator: _generator, ...rest } = doc;
+	const stripped = {
+		...rest,
+		permissions: permissions.map((permission) => {
+			if (!isRecord(permission) || !Array.isArray(permission["usages"])) return permission;
+			const usages = permission["usages"].map((usage) => {
+				if (!isRecord(usage)) return usage;
+				const { line: _line, ...position } = usage;
+				return position;
+			});
+			return Object.assign({}, permission, { usages });
+		})
+	};
+	return `${JSON.stringify(stripped, null, 2)}\n`;
+}
 function formatCatalogMarkdown(doc) {
 	const lines = ["# Permissions", ""];
 	const byResource = /* @__PURE__ */ new Map();
@@ -312,4 +335,4 @@ function catalogSchemaDocument() {
 	return catalogSchema;
 }
 //#endregion
-export { formatCatalogJson as a, catalogSchemaDocument as i, catalogForCompare as n, formatCatalogMarkdown as o, catalogOAuthScopes as r, jsonSchemaOf as s, buildCatalog as t };
+export { catalogSchemaDocument as a, jsonSchemaOf as c, catalogOAuthScopes as i, catalogForCompare as n, formatCatalogJson as o, catalogForDrift as r, formatCatalogMarkdown as s, buildCatalog as t };

package/dist/{catalog-fingerprint-CCP0-yQS.js → catalog-fingerprint-C144oW4M.js}

@@ -2,7 +2,7 @@ import { r as isRecord, t as compact } from "./compact-CAf557ZB.js";
 import { n as freezeDeep } from "./freeze-CrU8nQeX.js";
 import { n as isForbiddenKey } from "./paths-DXSHAMIa.js";
 import { l as isRfc3339 } from "./time-DkWjdL98.js";
-import { t as canonicalJson } from "./canonical-json-BC8_nMTw.js";
+import { t as canonicalJson } from "./canonical-json-DwilZ1iB.js";
 import { r as sha256Digest } from "./sha256-D9ihqmvd.js";
 import { C as EVENT_SCHEMA_IDS, T as SINK_EVENT_SCHEMAS, i as RESERVED_CLOUD_EVENT_TYPES, l as isAbsoluteUri, r as CLOUD_EVENT_TYPES, s as cloudEventType, u as isTraceparent, v as CATALOG_EVENT_SCHEMA } from "./sink-BEZSlMS_.js";
 import { n as copyJson, t as checkSchema } from "./json-schema-B-vAwlde.js";

package/dist/{create-CQWIpUG-.js → challenge-nGWma08S.js}

@@ -1,12 +1,13 @@
 import { r as isRecord, t as compact } from "./compact-CAf557ZB.js";
 import { n as freezeDeep } from "./freeze-CrU8nQeX.js";
 import { i as dateAt, p as nowSeconds } from "./time-DkWjdL98.js";
-import { s as policyDocumentFromClaims } from "./hosted-B46-5LYE.js";
+import { u as policyDocumentFromClaims } from "./hosted-XBgU6RGT.js";
 import { l as isApprovalErrorCode, s as ApprovalError, t as APPROVAL_HEADER } from "./types-DqzsnlSA.js";
 import { h as toCloudEvent, l as isAbsoluteUri } from "./sink-BEZSlMS_.js";
-import { n as parseCatalogEventData, t as catalogFingerprint } from "./catalog-fingerprint-CCP0-yQS.js";
+import { n as parseCatalogEventData, t as catalogFingerprint } from "./catalog-fingerprint-C144oW4M.js";
 import { t as parseApprovalRequest } from "./parse-request-D_tUXG6M.js";
 import { t as timeoutSignal } from "./timeout-D51niuQP.js";
+import { t as CLOUD_BASE_URL } from "./base-url-BQbddZO5.js";
 //#region src/cloud/approver.ts
 const APPROVER_HEADER = "PermDock-Approver";
 /** The RFC 9396 `authorization_details` type that binds an approver token to one verdict. */
@@ -92,44 +93,93 @@ function firstNonEmpty(...values) {
 function trimSlash(value) {
 	return value.endsWith("/") ? value.slice(0, -1) : value;
 }
-/**
-* The environment URL and JWK Set URL `cloud()` uses, resolved with the same
-* fallbacks (`PERMDOCK_CLOUD_URL`; `PERMDOCK_CLOUD_ENV`, `VERCEL_ENV`, `production`).
-*/
-function cloudEndpoints(options = {}) {
-	const url = trimSlash(firstNonEmpty(options.url, readEnv("PERMDOCK_CLOUD_URL")));
-	if (url === "") throw new Error("PermDock: cloud() requires url and key.");
-	const environment = firstNonEmpty(options.environment, readEnv("PERMDOCK_CLOUD_ENV"), readEnv("VERCEL_ENV"), "production");
+function cloudUrl(options) {
+	return trimSlash(firstNonEmpty(options.url, readEnv("PERMDOCK_CLOUD_URL"), CLOUD_BASE_URL));
+}
+function endpointsOf(url, environment) {
 	const issuer = `${url}/v1/environments/${encodeURIComponent(environment)}`;
 	return Object.freeze({
 		issuer,
 		jwks: `${issuer}/.well-known/jwks.json`
 	});
 }
-/** The authenticated connection every `permdock/cloud` client shares. Throws without a URL or key. */
+/** `options.environment`, else `PERMDOCK_CLOUD_ENV`, else `""` for the key-bound lookup. */
+function configuredEnvironment(options) {
+	return firstNonEmpty(options.environment, readEnv("PERMDOCK_CLOUD_ENV"));
+}
+/**
+* The environment URL and JWK Set URL `cloud()` uses when the environment is
+* configured: `environment`, else `PERMDOCK_CLOUD_ENV`. Throws when neither
+* is set; `resolveCloudEndpoints` then asks the Cloud which environment the
+* key belongs to.
+*/
+function cloudEndpoints(options = {}) {
+	const url = cloudUrl(options);
+	const environment = configuredEnvironment(options);
+	if (environment === "") throw new Error("PermDock: cloudEndpoints() requires environment or PERMDOCK_CLOUD_ENV; resolveCloudEndpoints() asks the Cloud for the key's environment.");
+	return endpointsOf(url, environment);
+}
+async function keyEnvironment(url, key, fetchFn) {
+	const response = await fetchFn(`${url}/v1/environment`, {
+		headers: {
+			authorization: `Bearer ${key}`,
+			accept: "application/json"
+		},
+		signal: timeoutSignal(CLOUD_TIMEOUT_MS)
+	});
+	if (!response.ok) throw new Error(`PermDock Cloud did not name the key's environment: HTTP ${String(response.status)}`);
+	const body = await response.json();
+	if (!isRecord(body) || typeof body["environment"] !== "string") throw new Error("PermDock Cloud answered GET /v1/environment in an unknown shape");
+	const endpoints = endpointsOf(url, body["environment"]);
+	if (body["issuer"] !== endpoints.issuer) throw new Error(`PermDock Cloud named issuer ${String(body["issuer"])}, not ${endpoints.issuer}`);
+	return endpoints;
+}
+/** The authenticated connection every `permdock/cloud` client shares. Throws without a key. */
 function cloudConnection(options) {
 	const key = firstNonEmpty(options.key, readEnv("PERMDOCK_CLOUD_KEY"));
-	if (key === "") throw new Error("PermDock: cloud() requires url and key.");
-	const endpoints = cloudEndpoints(options);
+	const url = cloudUrl(options);
+	if (key === "") throw new Error("PermDock: cloud() requires a key (PERMDOCK_CLOUD_KEY).");
+	const environment = configuredEnvironment(options);
+	const known = environment === "" ? void 0 : endpointsOf(url, environment);
 	const fetchFn = options.fetch ?? globalThis.fetch.bind(globalThis);
-	const request = (path, init = {}, accept, contentType) => {
+	let pending;
+	const endpoints = () => {
+		if (known !== void 0) return Promise.resolve(known);
+		pending ??= keyEnvironment(url, key, fetchFn).catch((error) => {
+			pending = void 0;
+			throw error;
+		});
+		return pending;
+	};
+	const request = async (path, init = {}, accept, contentType) => {
+		const { issuer } = await endpoints();
 		const headers = new Headers();
 		headers.set("authorization", `Bearer ${key}`);
 		headers.set("content-type", "application/json");
 		for (const [name, value] of new Headers(init.headers)) headers.set(name, value);
 		if (accept !== void 0) headers.set("accept", accept);
 		if (contentType !== void 0) headers.set("content-type", contentType);
-		return fetchFn(`${endpoints.issuer}${path}`, {
+		return fetchFn(`${issuer}${path}`, {
 			...init,
 			headers,
 			signal: timeoutSignal(CLOUD_TIMEOUT_MS, init.signal)
 		});
 	};
 	return Object.freeze({
-		...endpoints,
+		known,
+		endpoints,
 		request
 	});
 }
+/**
+* The environment URL and JWK Set URL for a key: `cloudEndpoints(options)`
+* when the environment is configured, else the environment `GET
+* /v1/environment` names for `key` (`PERMDOCK_CLOUD_KEY`). Rejects when the
+* Cloud does not answer or answers another issuer.
+*/
+async function resolveCloudEndpoints(options = {}) {
+	return await cloudConnection(options).endpoints();
+}
 /** `true` for a compact JWS: three dot-separated parts, not JSON. */
 function isCompactJws(value) {
 	return !value.startsWith("{") && value.split(".").length === 3;
@@ -182,7 +232,7 @@ function approvalErrorFromStatus(status) {
 	return new ApprovalError("approval-not-found", "approval was not found");
 }
 function cloud(options = {}) {
-	const { issuer: root, jwks, request } = cloudConnection(options);
+	const { known, endpoints, request } = cloudConnection(options);
 	const flushAt = options.flushAt ?? 32;
 	const waitUntil = options.waitUntil;
 	const approvals = {
@@ -211,7 +261,7 @@ function cloud(options = {}) {
 			}
 		},
 		async resolve(token, verdict) {
-			const approver = await approverHeaders(verdict, options.approver, root, async () => {
+			const approver = await approverHeaders(verdict, options.approver, (await endpoints()).issuer, async () => {
 				const response = await request("/approvals/by-token", { headers: { [APPROVAL_HEADER]: token } });
 				if (!response.ok) throw await approvalErrorFrom(response);
 				const found = parseApprovalRequest(await response.json());
@@ -306,8 +356,7 @@ function cloud(options = {}) {
 		}
 	};
 	const capacity = options.capacity ?? 1e4;
-	const source = options.source ?? root;
-	if (!isAbsoluteUri(source)) throw new TypeError("PermDock: cloud() source is an absolute URI");
+	if (options.source !== void 0 && !isAbsoluteUri(options.source)) throw new TypeError("PermDock: cloud() source is an absolute URI");
 	const pending = [];
 	const bound = () => {
 		if (pending.length > capacity) pending.splice(0, pending.length - capacity);
@@ -316,6 +365,7 @@ function cloud(options = {}) {
 		if (pending.length === 0) return;
 		const events = pending.splice(0);
 		try {
+			const source = options.source ?? (await endpoints()).issuer;
 			if (!(await request("/decisions", {
 				method: "POST",
 				body: JSON.stringify(events.map((event) => toCloudEvent(event, { source })))
@@ -342,6 +392,13 @@ function cloud(options = {}) {
 		return text;
 	} });
 	let document = null;
+	let built;
+	const policyVerifier = (resolved) => {
+		const verifier = options.verifier;
+		if (typeof verifier !== "function") return verifier;
+		built ??= verifier(resolved);
+		return built;
+	};
 	return freezeDeep({
 		approvals,
 		sink,
@@ -351,10 +408,15 @@ function cloud(options = {}) {
 				return document;
 			},
 			async refresh() {
-				const verifier = options.verifier;
-				if (verifier === void 0) return;
+				if (options.verifier === void 0) return;
 				let response;
+				let root;
+				let verifier;
 				try {
+					const resolved = await endpoints();
+					root = resolved.issuer;
+					verifier = policyVerifier(resolved);
+					if (verifier === void 0) return;
 					response = await request("/policy");
 				} catch {
 					return;
@@ -395,9 +457,44 @@ function cloud(options = {}) {
 			if (parsed === null) throw new Error("PermDock Cloud answered the catalog push in an unknown shape");
 			return parsed;
 		} },
-		issuer: root,
-		jwks
+		endpoints,
+		...known
 	});
 }
 //#endregion
-export { approverHeaders as a, isCompactJws as i, cloudConnection as n, cloudEndpoints as r, cloud as t };
+//#region src/cloud/challenge.ts
+const SCHEME = /^[\s,]*([!#$%&'*+.^_`|~0-9A-Za-z-]+)(?=[\s,]|$)/u;
+const PARAM = /^\s*([!#$%&'*+.^_`|~0-9A-Za-z-]+)\s*=\s*(?:"((?:[^"\\]|\\.)*)"|([!#$%&'*+.^_`|~0-9A-Za-z-]+))\s*(?:,|$)/u;
+const TOKEN68 = /^\s*[A-Za-z0-9._~+/-]+=*\s*(?:,|$)/u;
+/**
+* The first `Bearer` challenge in `header` (RFC 9110 section 11.6.1 syntax),
+* or `null`. Other schemes in the same field are skipped.
+*/
+function bearerChallenge(header) {
+	if (header === null) return null;
+	let rest = header;
+	while (rest.trim() !== "") {
+		const scheme = SCHEME.exec(rest);
+		if (scheme === null) return null;
+		rest = rest.slice(scheme[0].length);
+		const entries = [];
+		let param = PARAM.exec(rest);
+		if (param === null) {
+			const token68 = TOKEN68.exec(rest);
+			rest = token68 === null ? rest : rest.slice(token68[0].length);
+		}
+		while (param !== null) {
+			const quoted = param[2];
+			entries.push([(param[1] ?? "").toLowerCase(), quoted === void 0 ? param[3] ?? "" : quoted.replaceAll(/\\(.)/gu, "$1")]);
+			rest = rest.slice(param[0].length);
+			param = PARAM.exec(rest);
+		}
+		if ((scheme[1] ?? "").toLowerCase() === "bearer") return Object.freeze({
+			scheme: "bearer",
+			params: Object.freeze(Object.fromEntries(entries))
+		});
+	}
+	return null;
+}
+//#endregion
+export { isCompactJws as a, cloudEndpoints as i, cloud as n, resolveCloudEndpoints as o, cloudConnection as r, approverHeaders as s, bearerChallenge as t };

package/dist/chat/index.d.ts

@@ -1,2 +1,2 @@
-import { a as ChatCommandResult, c as createPermDock, d as SubjectFromChatOptions, f as isChatAuthor, i as ChatCommandContext, l as ChatAuthor, n as ChatActionResult, o as ChatPermDock, p as subjectFromChat, r as ChatCommand, s as ChatPermDockOptions, t as ChatAction, u as ChatPrincipal } from "../create-B30OMUOJ.js";
+import { a as ChatCommandResult, c as createPermDock, d as SubjectFromChatOptions, f as isChatAuthor, i as ChatCommandContext, l as ChatAuthor, n as ChatActionResult, o as ChatPermDock, p as subjectFromChat, r as ChatCommand, s as ChatPermDockOptions, t as ChatAction, u as ChatPrincipal } from "../create-B2-CQqCI.js";
 export { type ChatAction, type ChatActionResult, type ChatAuthor, type ChatCommand, type ChatCommandContext, type ChatCommandResult, type ChatPermDock, type ChatPermDockOptions, type ChatPrincipal, type SubjectFromChatOptions, createPermDock, isChatAuthor, subjectFromChat };

package/dist/chat/index.js

@@ -2,9 +2,9 @@ import { t as compact } from "../compact-CAf557ZB.js";
 import { n as freezeDeep } from "../freeze-CrU8nQeX.js";
 import { n as loadPrincipalByIdentity } from "../principal-source-pHneukrx.js";
 import { f as nowMillis } from "../time-DkWjdL98.js";
-import { c as withApp, t as getPermDock } from "../permdock-BrAscV28.js";
+import { l as withApp, t as getPermDock } from "../permdock-BfWEeMqk.js";
 import { c as isApprovalError } from "../types-DqzsnlSA.js";
-import { a as requestApproval, o as resolveApproval, s as resumeDecision } from "../helpers-CBYVMjwh.js";
+import { a as requestApproval, o as resolveApproval, s as resumeDecision } from "../helpers-DY3vXuGs.js";
 import { t as approvalPrompt } from "../approval-prompt-Dg5LeAcT.js";
 //#region src/chat/subject.ts
 function nonEmpty(value) {

package/dist/chat-sdk/index.d.ts

@@ -1,6 +1,6 @@
-import { n as ApprovalUrl, t as ApprovalPrompt } from "../approval-prompt-DvSSPQJX.js";
-import { l as ChatAuthor, n as ChatActionResult, o as ChatPermDock } from "../create-B30OMUOJ.js";
-import { n as ChatTransport } from "../types-BtHtcKMr.js";
+import { n as ApprovalUrl, t as ApprovalPrompt } from "../approval-prompt-K0faOLFp.js";
+import { l as ChatAuthor, n as ChatActionResult, o as ChatPermDock } from "../create-B2-CQqCI.js";
+import { n as ChatTransport } from "../types-g7Oy6Zg4.js";
 import { ActionEvent, Author, CardElement } from "chat";
 //#region src/chat-sdk/author.d.ts
 type ChatSdkAuthorOptions = {

package/dist/checks-BC_0mPIq.js

@@ -0,0 +1,37 @@
+import { n as isReadonlyArray } from "./compact-CAf557ZB.js";
+//#region src/core/checks.ts
+function partsOf(check) {
+	return isReadonlyArray(check) ? [check[0], check[1]] : [check, void 0];
+}
+/** `true` when every check is granted, stopping at the first that is not; an empty list is `false`. */
+function canAllWith(can, checks, options) {
+	if (checks.length === 0) return false;
+	return checks.every((check) => {
+		const [permission, data] = partsOf(check);
+		return can(permission, data, options);
+	});
+}
+/** One decision per check, in check order. */
+function decideAllWith(decide, checks, options) {
+	return Object.freeze(checks.map((check) => {
+		const [permission, data] = partsOf(check);
+		return decide(permission, data, options);
+	}));
+}
+/** The async `canAll` of an instance whose `can` answers a Promise. */
+async function canAllAsync(can, checks, options) {
+	if (checks.length === 0) return false;
+	return (await Promise.all(checks.map((check) => {
+		const [permission, data] = partsOf(check);
+		return can(permission, data, options);
+	}))).every(Boolean);
+}
+/** The async `decideAll` of an instance whose `decide` answers a Promise. */
+async function decideAllAsync(decide, checks, options) {
+	return Object.freeze(await Promise.all(checks.map((check) => {
+		const [permission, data] = partsOf(check);
+		return decide(permission, data, options);
+	})));
+}
+//#endregion
+export { decideAllWith as i, canAllWith as n, decideAllAsync as r, canAllAsync as t };

package/dist/claude-agent/index.d.ts

@@ -1,6 +1,6 @@
-import { T as Policy, j as PolicyVocabulary, rr as Principal } from "../policy-types-n0uRTsW8.js";
-import { r as PermDock } from "../permdock-SV8ZINYT.js";
-import { o as AgentAdapterOptions, t as AgentPermDock } from "../create-CBMmFie-.js";
+import { T as Policy, j as PolicyVocabulary, sr as Principal } from "../policy-types-B-F-qAZk.js";
+import { a as PermDock } from "../permdock-Dco6dyCK.js";
+import { o as AgentAdapterOptions, t as AgentPermDock } from "../create-UTnUVETj.js";
 //#region src/claude-agent/create.d.ts
 /** Structural `McpServerProvenance` from `@anthropic-ai/claude-agent-sdk`. */
 type ClaudeMcpServer = {

package/dist/claude-agent/index.js

@@ -1,6 +1,6 @@
 import { r as isRecord, t as compact } from "../compact-CAf557ZB.js";
-import { c as withApp } from "../permdock-BrAscV28.js";
-import { t as agentRuntime } from "../create-CGm28gyI.js";
+import { l as withApp } from "../permdock-BfWEeMqk.js";
+import { t as agentRuntime } from "../create-Cb86Z8Im.js";
 //#region src/claude-agent/create.ts
 const MCP_PREFIX = "mcp__";
 function asInput(input) {

package/dist/clerk/index.d.ts

@@ -1,6 +1,6 @@
-import { W as CustomRoleSource, ar as Subject, rr as Principal } from "../policy-types-n0uRTsW8.js";
-import { w as Permission } from "../vocabulary-CN8H_9UF.js";
-import { s as RemotePdpCache } from "../types-_WhUP7ud.js";
+import { W as CustomRoleSource, lr as Subject, sr as Principal } from "../policy-types-B-F-qAZk.js";
+import { u as Permission } from "../permission-types-DhNEmoRG.js";
+import { s as RemotePdpCache } from "../types-D3A19w4A.js";
 import { t as ClaimsMap } from "../claims-map-Ca-QX8C6.js";
 import { StandardSchemaV1 } from "@standard-schema/spec";
 //#region src/clerk/types.d.ts

package/dist/clerk/index.js

@@ -3,7 +3,7 @@ import { n as freezeDeep } from "../freeze-CrU8nQeX.js";
 import { r as validateRecord } from "../thenable-yD7SabqG.js";
 import { t as anonymousSubject } from "../subject-BGoM5o8B.js";
 import { t as readClaim } from "../claims-map-7oQ3ue4X.js";
-import { c as ttlMs, s as ttlCache } from "../shared-DvvFzYXe.js";
+import { c as ttlMs, s as ttlCache } from "../shared-C8LjUdVU.js";
 //#region src/clerk/subject.ts
 function asRoles(value) {
 	if (typeof value === "string") return value === "" ? [] : [value];

package/dist/cli/bin.js

@@ -11,8 +11,8 @@ if (argv.length === 1 && (argv[0] === "--version" || argv[0] === "-v")) {
 	const [{ isCi }, { trapSignals }, { run }, { streamHasColors }] = await Promise.all([
 		import("../env-DJZrPjRi.js"),
 		import("../signals-D3NcTKUS.js"),
-		import("../run-DDwUaJDU.js"),
-		import("../style-DiKWnAvn.js")
+		import("../run-Bz7DXGEv.js"),
+		import("../style-Ds1gNm77.js")
 	]);
 	const signals = trapSignals();
 	const result = await run(argv, {

package/dist/cli/index.d.ts

@@ -1,6 +1,6 @@
-import { a as CatalogDocument, d as CatalogRole, f as CatalogScope, l as CatalogPermission, m as CatalogUsage, n as CatalogApproval, p as CatalogSupportAccess, r as CatalogBreakGlass, t as CatalogActivation, u as CatalogResource } from "../types-Druu9wLM.js";
-import { a as pushedPolicy, i as parsePushedPolicy, n as PushedGrant, r as PushedPolicy, t as PUSHED_POLICY_SCHEMA } from "../pushed-policy-DCW91KQU.js";
-import { _ as RunResult, c as RlsConfig, d as RlsMembershipTable, f as RlsMemberships, g as RlsTarget, h as RlsSuspension, i as PermDockConfig, l as RlsDialect, m as RlsSuspendedScope, n as CliIo, o as RlsActiveRow, p as RlsSuspendedMembership, r as CollectConfig, s as RlsApiKeys, t as CatalogConfig, u as RlsFunctionMapping } from "../types-Dfv0aTER.js";
+import { a as CatalogDocument, d as CatalogRole, f as CatalogScope, l as CatalogPermission, m as CatalogUsage, n as CatalogApproval, p as CatalogSupportAccess, r as CatalogBreakGlass, t as CatalogActivation, u as CatalogResource } from "../types-BXMYB7BY.js";
+import { a as pushedPolicy, i as parsePushedPolicy, n as PushedGrant, r as PushedPolicy, t as PUSHED_POLICY_SCHEMA } from "../pushed-policy-BbcY9r_4.js";
+import { _ as RunResult, c as RlsConfig, d as RlsMembershipTable, f as RlsMemberships, g as RlsTarget, h as RlsSuspension, i as PermDockConfig, l as RlsDialect, m as RlsSuspendedScope, n as CliIo, o as RlsActiveRow, p as RlsSuspendedMembership, r as CollectConfig, s as RlsApiKeys, t as CatalogConfig, u as RlsFunctionMapping } from "../types-BWZybqs9.js";
 //#region src/cli/catalog-path.d.ts
 /**
  * The absolute path `permdock collect` writes the catalog to: `collect.out`,

package/dist/cli/index.js

@@ -1,8 +1,8 @@
 import { t as catalogPath } from "../catalog-path-CnI0XTFK.js";
-import { t as defineConfig } from "../config-bs_kZeYq.js";
-import { n as parsePushedPolicy, r as pushedPolicy, t as PUSHED_POLICY_SCHEMA } from "../pushed-policy-CqtxkV4G.js";
+import { t as defineConfig } from "../config-CoQHDrDi.js";
+import { n as parsePushedPolicy, r as pushedPolicy, t as PUSHED_POLICY_SCHEMA } from "../pushed-policy-CmYeSQqq.js";
 import { c as parseGrantsMarker, l as parseHookMarker } from "../markers-C6joDI3o.js";
-import { t as run } from "../run-CUKuz0A8.js";
+import { t as run } from "../run-uLD2aWuO.js";
 //#region src/cli/token-schemas.ts
 const ID = {
 	type: "string",