permdock 0.6.0 → 0.8.0

package/dist/kysely/index.d.ts

@@ -1,30 +1,32 @@
-import { Rt as Instant, ar as Subject, ur as Condition } from "../policy-types-n0uRTsW8.js";
-import { c as WhereResult } from "../permdock-SV8ZINYT.js";
-import { r as RelationsMapping } from "../graph-sql-B-dsAT6j.js";
-import { s as MembershipsMapping } from "../compile-1bsAezL0.js";
-import { n as WithSubjectOptions, t as RowCheck } from "../row-check-Dt35czLy.js";
+import { Rt as Instant, lr as Subject, mr as Condition } from "../policy-types-CCiDRZBH.js";
+import { f as WhereResult } from "../permdock-B6Sf4T_S.js";
+import { r as RelationsMapping } from "../graph-sql-BwFC4Qjs.js";
+import { s as MembershipsMapping } from "../compile-BFzysW3o.js";
+import { n as RowCheck, t as WithSubjectOptions } from "../subject-settings-vNW8qmUH.js";
 //#region src/kysely/types.d.ts
 type KyselySelectQuery = {
-  select(expr: unknown): KyselySelectQuery;
-  where(column: string, op: string, value: unknown): KyselySelectQuery;
-  where(expression: unknown): KyselySelectQuery;
-  whereRef(left: string, op: string, right: string): KyselySelectQuery;
+  select: (expr: unknown) => KyselySelectQuery;
+  where: {
+    (column: string, op: string, value: unknown): KyselySelectQuery;
+    (expression: unknown): KyselySelectQuery;
+  };
+  whereRef: (left: string, op: string, right: string) => KyselySelectQuery;
 };
 type KyselyExpressionBuilder = {
   (left: unknown, op: string, right: unknown): unknown;
-  and(args: readonly unknown[]): unknown;
-  or(args: readonly unknown[]): unknown;
-  not(value: unknown): unknown;
-  lit(value: unknown): unknown;
-  val(value: unknown): unknown;
-  ref(column: string): unknown;
-  exists?(query: unknown): unknown;
-  selectFrom?(table: string): KyselySelectQuery;
+  and: (args: readonly unknown[]) => unknown;
+  or: (args: readonly unknown[]) => unknown;
+  not: (value: unknown) => unknown;
+  lit: (value: unknown) => unknown;
+  val: (value: unknown) => unknown;
+  ref: (column: string) => unknown;
+  exists?: (query: unknown) => unknown;
+  selectFrom?: (table: string) => KyselySelectQuery;
 };
 /** Kysely's `sql` tag; `import { sql } from 'kysely'`. */
 type KyselySql = {
   (strings: TemplateStringsArray, ...values: unknown[]): unknown;
-  ref(reference: string): unknown;
+  ref: (reference: string) => unknown;
 };
 type KyselyWhereOptions = {
   readonly columns?: Readonly<Record<string, string>>;
@@ -32,38 +34,51 @@ type KyselyWhereOptions = {
   readonly listFields?: readonly string[];
   readonly subject?: Subject;
   readonly memberships?: MembershipsMapping;
-  /** Where the relation graph lives; graph grants compile to Postgres subqueries with it and are refused without. */
+  /**
+   * Where the relation graph lives; graph grants compile to Postgres subqueries
+   * with it and are refused without.
+   */
   readonly relations?: RelationsMapping;
-  /** The clock membership expiry is read at; a `Temporal.Instant` fits. Defaults to the current time. */
+  /**
+   * The clock membership expiry is read at; a `Temporal.Instant` fits. Defaults
+   * to the current time.
+   */
   readonly now?: Instant;
-  /** Kysely's `sql` tag, for graph subqueries on runtimes without `require`; loaded from the `kysely` peer by default. */
+  /**
+   * Kysely's `sql` tag, for graph subqueries on runtimes without `require`;
+   * loaded from the `kysely` peer by default.
+   */
   readonly sql?: KyselySql;
 };
 type KyselyWithSubjectOptions = WithSubjectOptions & {
-  /** Kysely's `sql` tag, on runtimes without `require`; loaded from the `kysely` peer by default. */
+  /**
+   * Kysely's `sql` tag, on runtimes without `require`; loaded from the `kysely`
+   * peer by default.
+   */
   readonly sql?: KyselySql;
 };
 //#endregion
 //#region src/kysely/to-where.d.ts
 export declare function toWhere(input: Condition | WhereResult, table: string, options?: KyselyWhereOptions): (eb: KyselyExpressionBuilder) => unknown;
 type KyselyLike<Trx> = {
-  transaction(): {
-    execute<T>(fn: (trx: Trx) => Promise<T>): Promise<T>;
+  transaction: () => {
+    execute: <T>(fn: (trx: Trx) => Promise<T>) => Promise<T>;
   };
 };
 /**
- * Runs `fn` in a transaction whose role and claims are `permdock.subject`'s, so the generated
- * RLS policies decide for the same subject as the in-process checks.
+ * Runs `fn` in a transaction whose role and claims are `permdock.subject`'s, so
+ * the generated RLS policies decide for the same subject as the in-process
+ * checks.
  */
 export declare function withSubject<Trx, T>(db: KyselyLike<Trx>, permdock: {
   readonly subject: Subject;
 }, fn: (trx: Trx) => Promise<T>, options?: KyselyWithSubjectOptions): Promise<T>;
 type KyselySelectable = {
-  selectFrom(table: never): {
-    select(selection: (eb: never) => unknown): {
-      where(where: never): {
-        limit(count: number): {
-          execute(): Promise<readonly {
+  selectFrom: (table: never) => {
+    select: (selection: (eb: never) => unknown) => {
+      where: (where: never) => {
+        limit: (count: number) => {
+          execute: () => Promise<readonly {
             readonly granted?: unknown;
           }[]>;
         };
@@ -72,8 +87,9 @@ type KyselySelectable = {
   };
 };
 /**
- * One query for one row: `{ found: false }` when `key` matches nothing, otherwise whether the
- * permission filter keeps the row. Throws when `key` matches more than one row.
+ * One query for one row: `{ found: false }` when `key` matches nothing,
+ * otherwise whether the permission filter keeps the row. Throws when `key`
+ * matches more than one row.
  */
 export declare function checkRow(db: KyselySelectable, table: string, input: Condition | WhereResult, key: (eb: KyselyExpressionBuilder) => unknown, options?: KyselyWhereOptions): Promise<RowCheck>;
 //#endregion

package/dist/kysely/index.js

@@ -1,7 +1,7 @@
 import { t as compact } from "../compact-CAf557ZB.js";
-import { t as assertSafeKey } from "../paths-DXSHAMIa.js";
-import { n as escapeLike, t as compileWhere } from "../compile-CMqMx_IN.js";
-import { a as rowCheckFrom, i as templateOf, r as subjectStatements, s as loadPeer, t as statementTemplate } from "../subject-settings-CkEwrw3W.js";
+import { t as assertSafeKey } from "../paths-CUvURzHp.js";
+import { n as compileWhere, r as escapeLike } from "../compile-EzEMB-7v.js";
+import { a as rowCheckFrom, i as templateOf, r as subjectStatements, s as loadPeer, t as statementTemplate } from "../subject-settings-8sH5HlII.js";
 //#region src/kysely/to-where.ts
 function ident(name) {
 	assertSafeKey(name, "sql identifier");
@@ -96,8 +96,9 @@ function toWhere(input, table, options = {}) {
 	return (eb) => render(eb, compiled, table, options);
 }
 /**
-* Runs `fn` in a transaction whose role and claims are `permdock.subject`'s, so the generated
-* RLS policies decide for the same subject as the in-process checks.
+* Runs `fn` in a transaction whose role and claims are `permdock.subject`'s, so
+* the generated RLS policies decide for the same subject as the in-process
+* checks.
 */
 function withSubject(db, permdock, fn, options = {}) {
 	const statements = subjectStatements(permdock, options);
@@ -108,8 +109,9 @@ function withSubject(db, permdock, fn, options = {}) {
 	});
 }
 /**
-* One query for one row: `{ found: false }` when `key` matches nothing, otherwise whether the
-* permission filter keeps the row. Throws when `key` matches more than one row.
+* One query for one row: `{ found: false }` when `key` matches nothing,
+* otherwise whether the permission filter keeps the row. Throws when `key`
+* matches more than one row.
 */
 async function checkRow(db, table, input, key, options = {}) {
 	const sql = loadSql(options.sql);

package/dist/{live-options-BaAFCIiu.js → live-options-BBIT68le.js}

@@ -7,8 +7,8 @@ const PermDockSnapshotPromiseContext = createContext(null);
 //#region src/react/keyed.ts
 /**
 * `create()` once per distinct `inputs`, held in state: React may drop a
-* `useMemo` value and rebuild it, and a rebuilt store loses its answers,
-* polls and followed snapshot.
+* `useMemo` value and rebuild it, and a rebuilt store loses its answers, polls
+* and followed snapshot.
 */
 function useKeyed(create, inputs) {
 	const [held, setHeld] = useState(() => ({

package/dist/{load-DFS_ry0W.js → load-DjSU5KXO.js}

@@ -1,5 +1,5 @@
-import { c as listPermissions } from "./permission-registry-Br4jSNVi.js";
-import { a as describeError, n as CliError } from "./errors-CWTY6uih.js";
+import { c as listPermissions } from "./permission-registry-B8tYxPIt.js";
+import { a as describeError, n as CliError } from "./errors-Vpu6rKHl.js";
 import { dirname, resolve } from "node:path";
 import { pathToFileURL } from "node:url";
 import { createJiti } from "jiti";
@@ -38,10 +38,10 @@ function importWithJiti(abs, fresh) {
 }
 /**
 * Imports a project module the way its bundler would. Node's own `import()`
-* comes first; a module it cannot resolve or parse (tsconfig `paths`
-* aliases, extensionless relative imports, `enum`, TSX) loads through jiti
-* with the `paths` of the nearest `tsconfig.json` above it. Exports are
-* returned as written; `default` is not merged into the namespace.
+* comes first; a module it cannot resolve or parse (tsconfig `paths` aliases,
+* extensionless relative imports, `enum`, TSX) loads through jiti with the
+* `paths` of the nearest `tsconfig.json` above it. Exports are returned as
+* written; `default` is not merged into the namespace.
 */
 async function loadModule(abs, options) {
 	try {

package/dist/load-Dm0pSYH3.js

@@ -0,0 +1 @@
+export { a as loadModule, s as pickNamed } from "./load-DjSU5KXO.js";

package/dist/{login-Dfe5RlYk.js → login-D-8tMqzo.js}

@@ -1,5 +1,5 @@
 import { t as defineLeaf } from "./command-L8EstFNm.js";
-import { c as given } from "./flags-C3DktBDY.js";
+import { c as given } from "./flags-DXjoTVbS.js";
 //#region src/cli/commands/login.ts
 const urlFlag = { url: {
 	type: "string",
@@ -27,7 +27,7 @@ const login = defineLeaf({
 		}
 	},
 	async run(ctx, { flags }) {
-		const { runLogin } = await import("./login-imhuwvn3.js");
+		const { runLogin } = await import("./login-DplQ0s84.js");
 		return runLogin({
 			cwd: ctx.cwd,
 			url: given(flags.url),
@@ -43,7 +43,7 @@ const login = defineLeaf({
 const logout = defineLeaf({
 	flags: { ...urlFlag },
 	async run(ctx, { flags }) {
-		const { runLogout } = await import("./login-imhuwvn3.js");
+		const { runLogout } = await import("./login-DplQ0s84.js");
 		return runLogout({
 			url: given(flags.url),
 			json: ctx.json,
@@ -55,7 +55,7 @@ const logout = defineLeaf({
 const whoami = defineLeaf({
 	flags: { ...urlFlag },
 	async run(ctx, { flags }) {
-		const { runWhoami } = await import("./login-imhuwvn3.js");
+		const { runWhoami } = await import("./login-DplQ0s84.js");
 		return runWhoami({
 			url: given(flags.url),
 			json: ctx.json,

package/dist/{login-imhuwvn3.js → login-DplQ0s84.js}

@@ -1,18 +1,16 @@
-import { h as secondsAt, i as dateAt, s as instantAt } from "./time-DkWjdL98.js";
-import { n as CliError } from "./errors-CWTY6uih.js";
-import { i as postForm, r as parseToken, s as runDeviceFlow } from "./device-BARQ8eYG.js";
+import { h as secondsAt, i as dateAt, s as instantAt } from "./time-nR1JesoH.js";
+import { n as CliError } from "./errors-Vpu6rKHl.js";
+import { i as postForm, r as parseToken, s as runDeviceFlow } from "./device-BwbJNmb2.js";
 import { i as writeCredentials, n as deleteCredentials, r as readCredentials, t as credentialsPath } from "./storage-C2bWdvJH.js";
-import { n as httpRequest } from "./http-DXJ37RDA.js";
-import { c as READ_SCOPES, d as issuerMetadata, i as credentialsInsideRepository, l as cloudUrl, n as cliRuntime, r as credentialStorage, s as CLI_CLIENT_ID, t as CREDENTIAL_SERVICE } from "./auth-DRLEizbL.js";
-import { createHash, randomBytes } from "node:crypto";
+import { n as randomToken, t as pkce } from "./pkce-CnmmYqUZ.js";
+import { a as nonEmptyOr } from "./output-tkju6U7R.js";
+import { n as httpRequest } from "./http-DOL33cO0.js";
+import { c as READ_SCOPES, d as issuerMetadata, i as credentialsInsideRepository, l as cloudUrl, n as cliRuntime, r as credentialStorage, s as CLI_CLIENT_ID, t as CREDENTIAL_SERVICE } from "./auth--yPyZNgr.js";
 import { spawn } from "node:child_process";
 import { createServer } from "node:http";
 //#region src/cli/cloud/loopback.ts
 /** How long the loopback listener waits for the browser to come back. */
 const LOOPBACK_TIMEOUT_MS = 3e5;
-function base64url(bytes) {
-	return bytes.toString("base64url");
-}
 function listen(server) {
 	return new Promise((resolve, reject) => {
 		server.once("error", reject);
@@ -28,9 +26,8 @@ function listen(server) {
 * `state` that the callback must echo.
 */
 async function runLoopbackFlow(options, runtime) {
-	const verifier = base64url(randomBytes(32));
-	const challenge = base64url(createHash("sha256").update(verifier).digest());
-	const state = base64url(randomBytes(16));
+	const { verifier, challenge } = await pkce();
+	const state = randomToken(16);
 	const { promise: callback, resolve: settle } = Promise.withResolvers();
 	const server = createServer((request, response) => {
 		const url = new URL(request.url ?? "/", "http://127.0.0.1");
@@ -94,7 +91,10 @@ async function runLoopbackFlow(options, runtime) {
 }
 //#endregion
 //#region src/cli/cloud/login.ts
-/** Opens `url` in the default browser; a failure leaves the printed URL to the user. */
+/**
+* Opens `url` in the default browser; a failure leaves the printed URL to the
+* user.
+*/
 function openBrowser(url) {
 	const [command, args] = process.platform === "darwin" ? ["open", [url]] : process.platform === "win32" ? ["cmd", [
 		"/c",
@@ -176,7 +176,10 @@ async function runLogin(input) {
 		}) : `logged in to ${issuer} (${granted.scope ?? scope}); credentials in ${where}`
 	};
 }
-/** Revokes the stored login (RFC 7009) and deletes it; a revocation failure still deletes it. */
+/**
+* Revokes the stored login (RFC 7009) and deletes it; a revocation failure
+* still deletes it.
+*/
 async function runLogout(input) {
 	const issuer = cloudUrl(input.url, input.env);
 	const runtime = cliRuntime(input.io, input.env);
@@ -246,7 +249,7 @@ async function runWhoami(input) {
 	};
 	return {
 		code: 0,
-		output: input.json ? JSON.stringify(data) : `${issuer}: logged in (${scopes.join(" ") || "no scopes"})${expired ? "; the login has expired, run permdock login" : ""}`,
+		output: input.json ? JSON.stringify(data) : `${issuer}: logged in (${nonEmptyOr(scopes.join(" "), "no scopes")})${expired ? "; the login has expired, run permdock login" : ""}`,
 		data
 	};
 }

package/dist/{manifest-dvL2XEe1.js → manifest-Cgiq5oqc.js}

@@ -30,20 +30,20 @@ const SECTIONS = [
 				docs: "init",
 				effects: ["files"],
 				config: false,
-				load: async () => (await import("./init-GG6Jh8HD.js")).init
+				load: async () => (await import("./init-Dz_PsHdv.js")).init
 			}),
 			group("preset", "Decode a preset code, or print its permdock.com/create link", "preset", [leaf("decode", "Print what a preset code holds", {
 				examples: ["permdock preset decode p1AQIDBAc"],
 				docs: "preset",
 				effects: [],
 				config: false,
-				load: async () => (await import("./init-GG6Jh8HD.js")).presetDecode
+				load: async () => (await import("./init-Dz_PsHdv.js")).presetDecode
 			}), leaf("url", "Print the permdock.com/create link that opens a code", {
 				examples: ["permdock preset url p1AQIDBAc"],
 				docs: "preset",
 				effects: [],
 				config: false,
-				load: async () => (await import("./init-GG6Jh8HD.js")).presetUrl
+				load: async () => (await import("./init-Dz_PsHdv.js")).presetUrl
 			})]),
 			group("skills", "Install, update or list the PermDock Agent Skills", "skills", [
 				leaf("install", "Copy the Agent Skills into the agent folders", {
@@ -55,21 +55,21 @@ const SECTIONS = [
 					docs: "skills",
 					effects: ["files"],
 					config: false,
-					load: async () => (await import("./skills-CTYwkl44.js")).install
+					load: async () => (await import("./skills-OuoMR49L.js")).install
 				}),
 				leaf("update", "Replace installed skills with this version's", {
 					examples: ["permdock skills update"],
 					docs: "skills",
 					effects: ["files"],
 					config: false,
-					load: async () => (await import("./skills-CTYwkl44.js")).update
+					load: async () => (await import("./skills-OuoMR49L.js")).update
 				}),
 				leaf("list", "List the skills and where each is installed", {
 					examples: ["permdock skills list"],
 					docs: "skills",
 					effects: [],
 					config: false,
-					load: async () => (await import("./skills-CTYwkl44.js")).list
+					load: async () => (await import("./skills-OuoMR49L.js")).list
 				})
 			]),
 			leaf("doctor", "Check a PermDock installation and print a fix for each finding", {
@@ -82,7 +82,7 @@ const SECTIONS = [
 				effects: ["files"],
 				config: true,
 				findings: true,
-				load: async () => (await import("./doctor-3ZqNHX_G.js")).doctor
+				load: async () => (await import("./doctor-D3wo-yuz.js")).doctor
 			}),
 			leaf("completion", "Print the shell completion script for bash, zsh or fish", {
 				examples: ["permdock completion zsh > ~/.zfunc/_permdock", "eval \"$(permdock completion bash)\""],
@@ -90,7 +90,7 @@ const SECTIONS = [
 				effects: [],
 				config: false,
 				shellOutput: true,
-				load: async () => (await import("./completion-BTFrHZhX.js")).completion
+				load: async () => (await import("./completion-saoYiRFO.js")).completion
 			})
 		]
 	},
@@ -106,14 +106,25 @@ const SECTIONS = [
 				docs: "collect",
 				effects: ["files"],
 				config: true,
-				load: async () => (await import("./collect-Ci6akVwH.js")).collect
+				load: async () => (await import("./collect-Bzv3le0A.js")).collect
 			}),
 			leaf("catalog", "Export the catalog as catalog JSON, JSON Schema or Markdown", {
 				examples: ["permdock catalog --out permissions.catalog.json", "permdock catalog --kind markdown"],
 				docs: "catalog",
 				effects: ["files"],
 				config: true,
-				load: async () => (await import("./catalog-DZVbrF-z.js")).catalog
+				load: async () => (await import("./catalog-DCspHDc8.js")).catalog
+			}),
+			leaf("gen", "Write typed constants, schemas, factories, hooks and messages from the policy", {
+				examples: [
+					"permdock gen",
+					"permdock gen --kind zod --kind factories",
+					"permdock gen --check"
+				],
+				docs: "gen",
+				effects: ["files"],
+				config: true,
+				load: async () => (await import("./gen-B5kvbAoZ.js")).gen
 			}),
 			leaf("usage", "Report unused, ungranted and role-less permissions and conditions on undeclared fields", {
 				examples: ["permdock usage", "permdock usage --fail-on warning"],
@@ -121,14 +132,14 @@ const SECTIONS = [
 				effects: [],
 				config: true,
 				findings: true,
-				load: async () => (await import("./usage-CRVl9V3t.js")).usage
+				load: async () => (await import("./usage-ab0PdusX.js")).usage
 			}),
 			leaf("diff", "Compare two policies or catalogs; exit 1 on a breaking change", {
 				examples: ["permdock diff main.catalog.json permissions.catalog.json", "permdock diff ./old-policy.ts ./src/policy.ts --impact"],
 				docs: "diff",
 				effects: [],
 				config: true,
-				load: async () => (await import("./diff-CmuSD3vc.js")).diff
+				load: async () => (await import("./diff-CN8IYhC_.js")).diff
 			}),
 			leaf("config", "Check permdock.config.ts for unknown keys, or print the effective config", {
 				examples: ["permdock config", "permdock config --print"],
@@ -136,7 +147,7 @@ const SECTIONS = [
 				effects: [],
 				config: true,
 				findings: true,
-				load: async () => (await import("./config-Bj2Ixq3d.js")).config
+				load: async () => (await import("./config-DBeXXmBF.js")).config
 			})
 		]
 	},
@@ -153,14 +164,14 @@ const SECTIONS = [
 						"network"
 					],
 					config: true,
-					load: async () => (await import("./rls-BAqP4q66.js")).generate
+					load: async () => (await import("./rls-Ca8Jz9b5.js")).generate
 				}),
 				leaf("import", "Turn existing RLS policies into a generated definition", {
 					examples: ["permdock rls import --sql schema.sql --out src/permissions.generated.ts", "permdock rls import --db-url-stdin --out src/permissions.generated.ts"],
 					docs: "rls",
 					effects: ["files", "database:read"],
 					config: true,
-					load: async () => (await import("./rls-BAqP4q66.js")).importPolicies
+					load: async () => (await import("./rls-Ca8Jz9b5.js")).importPolicies
 				}),
 				leaf("verify", "Run the fixtures against the policies, or compare a live database", {
 					examples: [
@@ -169,16 +180,24 @@ const SECTIONS = [
 						"permdock rls verify --introspect --db-url-stdin"
 					],
 					docs: "rls",
-					effects: ["database:read"],
+					effects: ["files", "database:read"],
 					config: true,
-					load: async () => (await import("./rls-BAqP4q66.js")).verify
+					findings: true,
+					load: async () => (await import("./rls-Ca8Jz9b5.js")).verify
 				}),
 				leaf("migrate", "Rewrite hand-written policies onto the generated helpers", {
 					examples: ["permdock rls migrate --sql supabase/migrations --dry-run", "permdock rls migrate --sql supabase/migrations"],
 					docs: "rls",
 					effects: ["rewrite", "files"],
 					config: true,
-					load: async () => (await import("./rls-BAqP4q66.js")).migrate
+					load: async () => (await import("./rls-Ca8Jz9b5.js")).migrate
+				}),
+				leaf("explain", "Show the tables, membership sources and triggers the SQL binds to", {
+					examples: ["permdock rls explain", "permdock rls explain --db-url-stdin --json"],
+					docs: "rls",
+					effects: ["database:read"],
+					config: true,
+					load: async () => (await import("./rls-Ca8Jz9b5.js")).explain
 				})
 			]),
 			group("supabase", "Generate the Supabase Custom Access Token Hook, or inspect its manifest", "supabase", [group("hook", "The Custom Access Token Hook", "supabase", [leaf("generate", "Compile the membership sources into the hook migration", {
@@ -186,26 +205,37 @@ const SECTIONS = [
 				docs: "supabase",
 				effects: ["files", "database:read"],
 				config: true,
-				load: async () => (await import("./supabase-By_frk3U.js")).hookGenerate
+				load: async () => (await import("./supabase-D39cuGPt.js")).hookGenerate
 			})]), leaf("inspect", "Print or write the hook and helper manifest", {
 				examples: ["permdock supabase inspect", "permdock supabase inspect --out"],
 				docs: "supabase",
 				effects: ["files"],
 				config: true,
-				load: async () => (await import("./supabase-By_frk3U.js")).inspect
+				load: async () => (await import("./supabase-D39cuGPt.js")).inspect
 			})]),
 			group("powersync", "Generate PowerSync Sync Streams from the policy, or verify them", "powersync", [leaf("generate", "Compile the read grants into sync-config.yaml", {
 				examples: ["permdock powersync generate", "permdock powersync generate --check"],
 				docs: "powersync",
 				effects: ["files"],
 				config: true,
-				load: async () => (await import("./powersync-DISt6SUe.js")).generate
+				load: async () => (await import("./powersync-DXqGuq9A.js")).generate
 			}), leaf("verify", "Fail on stale streams or a stream that syncs a denied row", {
 				examples: ["permdock powersync verify", "permdock powersync verify --db-url-stdin"],
 				docs: "powersync",
 				effects: ["database:read"],
 				config: true,
-				load: async () => (await import("./powersync-DISt6SUe.js")).verify
+				load: async () => (await import("./powersync-DXqGuq9A.js")).verify
+			})]),
+			group("scim", "Generate the Postgres tables postgresDirectoryStore keeps a SCIM directory in", "scim", [leaf("generate", "Write the tenant-keyed users, groups and members tables", {
+				examples: [
+					"permdock scim generate",
+					"permdock scim generate --dialect guc --out db/scim.sql",
+					"permdock scim generate --check"
+				],
+				docs: "scim",
+				effects: ["files"],
+				config: true,
+				load: async () => (await import("./scim-D8YupzX1.js")).generate
 			})])
 		]
 	},
@@ -217,13 +247,13 @@ const SECTIONS = [
 				docs: "openapi",
 				effects: ["files"],
 				config: true,
-				load: async () => (await import("./openapi-C4dDTVEd.js")).emit
+				load: async () => (await import("./openapi-CBZUhA3l.js")).emit
 			}), leaf("import", "Turn an OpenAPI document into a generated definition", {
 				examples: ["permdock openapi import --doc openapi.yaml --out src/permissions.generated.ts"],
 				docs: "openapi",
 				effects: ["files", "network"],
 				config: false,
-				load: async () => (await import("./openapi-C4dDTVEd.js")).importDocument
+				load: async () => (await import("./openapi-CBZUhA3l.js")).importDocument
 			})]),
 			group("arazzo", "Check Arazzo workflows against the permissions", "arazzo", [leaf("check", "Resolve every Arazzo step to x-permdock-permissions", {
 				examples: ["permdock arazzo check --doc arazzo.json --openapi openapi.json"],
@@ -231,7 +261,7 @@ const SECTIONS = [
 				effects: [],
 				config: true,
 				findings: true,
-				load: async () => (await import("./arazzo-41WuzHou.js")).check
+				load: async () => (await import("./arazzo-3RhGfkAK.js")).check
 			})]),
 			leaf("scan", "List authorization checks written without PermDock, to adopt it in an existing app", {
 				examples: ["permdock scan", "permdock scan --src app,lib --pattern isBeta"],
@@ -239,21 +269,21 @@ const SECTIONS = [
 				effects: [],
 				config: true,
 				findings: true,
-				load: async () => (await import("./scan-qvOe0hS3.js")).scan
+				load: async () => (await import("./scan-DCj1KQfn.js")).scan
 			}),
 			group("casl", "Import CASL rules into a generated module", "casl", [leaf("import", "Turn CASL rules per role into a permissions and policy module", {
 				examples: ["permdock casl import --rules rules.json --out src/permissions.generated.ts"],
 				docs: "casl",
 				effects: ["files"],
 				config: false,
-				load: async () => (await import("./casl-64gpT-8x.js")).caslImport
+				load: async () => (await import("./casl-C4OINZHI.js")).caslImport
 			})]),
 			group("casbin", "Import a Casbin model and policy into a generated module", "casbin", [leaf("import", "Turn a Casbin RBAC model and policy into a permissions and policy module", {
 				examples: ["permdock casbin import --model model.conf --policy policy.csv --out src/permissions.generated.ts"],
 				docs: "casbin",
 				effects: ["files"],
 				config: false,
-				load: async () => (await import("./casbin-Cr7RLtA3.js")).casbinImport
+				load: async () => (await import("./casbin-cbSbhT_k.js")).casbinImport
 			})])
 		]
 	},
@@ -265,34 +295,34 @@ const SECTIONS = [
 				docs: "login",
 				effects: ["network", "files"],
 				config: false,
-				load: async () => (await import("./login-Dfe5RlYk.js")).login
+				load: async () => (await import("./login-D-8tMqzo.js")).login
 			}),
 			leaf("logout", "Revoke and delete the stored PermDock Cloud login", {
 				examples: ["permdock logout"],
 				docs: "login",
 				effects: ["network", "files"],
 				config: false,
-				load: async () => (await import("./login-Dfe5RlYk.js")).logout
+				load: async () => (await import("./login-D-8tMqzo.js")).logout
 			}),
 			leaf("whoami", "Print the PermDock Cloud identity the CLI acts as", {
 				examples: ["permdock whoami", "permdock whoami --json"],
 				docs: "login",
 				effects: [],
 				config: false,
-				load: async () => (await import("./login-Dfe5RlYk.js")).whoami
+				load: async () => (await import("./login-D-8tMqzo.js")).whoami
 			}),
 			group("cloud", "Publish to or pull from a PermDock Cloud project", "cloud", [leaf("push", "Publish the catalog, policy and manifest to a Cloud project", {
 				examples: ["permdock cloud push --dry-run", "permdock cloud push --project prj_123"],
 				docs: "cloud",
 				effects: ["network", "cloud:write"],
 				config: true,
-				load: async () => (await import("./cloud-ytQ3uviA.js")).push
+				load: async () => (await import("./cloud-BFlGMaak.js")).push
 			}), leaf("pull", "Write a Cloud project's published catalog and manifest", {
 				examples: ["permdock cloud pull --project prj_123"],
 				docs: "cloud",
 				effects: ["network", "files"],
 				config: true,
-				load: async () => (await import("./cloud-ytQ3uviA.js")).pull
+				load: async () => (await import("./cloud-BFlGMaak.js")).pull
 			})])
 		]
 	},
@@ -303,7 +333,7 @@ const SECTIONS = [
 			docs: "codemod",
 			effects: ["rewrite"],
 			config: false,
-			load: async () => (await import("./codemod-5mpSpnUY.js")).codemod
+			load: async () => (await import("./codemod-DLQ9Zpo4.js")).codemod
 		})]
 	}
 ];
@@ -315,7 +345,7 @@ const COMPLETE_LEAF = leaf("__complete", "Print completion candidates for a part
 	config: false,
 	shellOutput: true,
 	hidden: true,
-	load: async () => (await import("./completion-BTFrHZhX.js")).complete
+	load: async () => (await import("./completion-saoYiRFO.js")).complete
 });
 const ROOT = group("permdock", "Collect, export, diff and check the permissions a PermDock policy declares", "", [...SECTIONS.flatMap((section) => section.entries), COMPLETE_LEAF]);
 /** Each leaf with its path from the root, in manifest order. */
@@ -326,8 +356,8 @@ function leaves(entry = ROOT, path = []) {
 	}] : leaves(child, [...path, child.name]));
 }
 /**
-* Walks positional tokens down the tree until a leaf. Flags may sit
-* anywhere; only bare words name a child.
+* Walks positional tokens down the tree until a leaf. Flags may sit anywhere;
+* only bare words name a child.
 */
 function resolve(argv) {
 	let node = ROOT;