permdock 0.6.0 → 0.8.0

package/dist/{shared-BAK8t4Uo.js → shared-Afctg7B0.js}

@@ -1,45 +1,15 @@
 import { r as isRecord } from "./compact-CAf557ZB.js";
-import { n as isForbiddenKey } from "./paths-DXSHAMIa.js";
-import { t as byCodePoint } from "./compare-pfyVnBjE.js";
-import { i as configError } from "./errors-CWTY6uih.js";
-import { a as quoteQualifiedTable, c as quoteSqlTable, o as quoteSqlIdent, s as quoteSqlLiteral, t as SQL_IDENT } from "./sql-B5T1IL83.js";
-import "./sources-vs5dGOsS.js";
-//#region src/cli/sql/quote.ts
-function quoteIdent(name) {
-	return quoteSqlIdent(name, CLI);
-}
-function quoteTable(name) {
-	return quoteSqlTable(name, CLI);
-}
-/** A table name with `public.` added when it names no schema, quoted. */
-function quoteQualified(name) {
-	return quoteQualifiedTable(name, CLI);
-}
-function helperSchema(ctx) {
-	return ctx.schema ?? "permdock";
-}
-function qualified(ctx, name) {
-	return `${quoteIdent(helperSchema(ctx))}.${name}`;
-}
-function quoteLiteral(value) {
-	return quoteSqlLiteral(value);
-}
-const CLI = "PermDock CLI";
-function declaredArray(values) {
-	return values.length === 0 ? `'{}'::text[]` : `array[${values.map(quoteLiteral).join(", ")}]::text[]`;
-}
+import { n as isForbiddenKey } from "./paths-CUvURzHp.js";
+import { t as byCodePoint } from "./compare-DTfyUunF.js";
+import { i as configError } from "./errors-Vpu6rKHl.js";
+import { a as quoteQualifiedTable, c as quoteSqlTable, o as quoteSqlIdent, s as quoteSqlLiteral, t as SQL_IDENT } from "./sql-0WjxIp9g.js";
+import { t as byScope } from "./compile-EzEMB-7v.js";
+import "./sources-CMAM-2A3.js";
+//#region src/cli/sql/columns.ts
 /**
-* A text array as a Postgres literal (`'{admin,owner}'`). An element that
-* holds a delimiter, a brace, a quote, a backslash, whitespace, or that
-* reads as `NULL`, is double-quoted and escaped, so one element can never
-* split into several.
+* The Postgres type a JSON Schema property compares as; `undefined` for text or
+* an unknown shape.
 */
-function textArrayLiteral(values) {
-	return quoteLiteral(`{${values.map((value) => value === "" || /[\s,{}"\\]/u.test(value) || /^null$/iu.test(value) ? `"${value.replaceAll("\\", "\\\\").replaceAll("\"", "\\\"")}"` : value).join(",")}}`);
-}
-//#endregion
-//#region src/cli/sql/columns.ts
-/** The Postgres type a JSON Schema property compares as; `undefined` for text or an unknown shape. */
 function columnTypeOf(property) {
 	if (!isRecord(property)) return;
 	const variants = [property["anyOf"], property["oneOf"]].find(Array.isArray);
@@ -101,14 +71,55 @@ function sqlType(name) {
 function tenantTypeOf(ctx) {
 	return sqlType(ctx.tenantType ?? "uuid");
 }
-function teamTypeOf(ctx) {
-	return sqlType(ctx.teamType ?? ctx.tenantType ?? "uuid");
-}
-/** Postgres type of scope `name`'s id: `scopeTypes`, then the tenant / team type by position. */
+/**
+* Postgres type of scope `name`'s id: `scopeTypes` by name or by its `tenant` /
+* `team` alias, then the tenant type.
+*/
 function scopeTypeOf(ctx, name) {
-	const declared = ctx.scopeTypes?.[name];
-	if (declared !== void 0) return sqlType(declared);
-	return name === ctx.scopes[1]?.name ? teamTypeOf(ctx) : tenantTypeOf(ctx);
+	const declared = byScope(ctx.scopeTypes, ctx.scopes, name);
+	return declared === void 0 ? tenantTypeOf(ctx) : sqlType(declared);
+}
+/**
+* The tenant type `rls.scopeTypes` gives the first scope, else `uuid`: the type
+* the tenant claim and the custom-role tenant arguments are cast to.
+*/
+function firstScopeType(scopeTypes, scopes) {
+	const first = scopes[0]?.name;
+	return (first === void 0 ? void 0 : byScope(scopeTypes, scopes, first)) ?? scopeTypes?.["tenant"] ?? "uuid";
+}
+//#endregion
+//#region src/cli/sql/quote.ts
+function quoteIdent(name) {
+	return quoteSqlIdent(name, CLI);
+}
+function quoteTable(name) {
+	return quoteSqlTable(name, CLI);
+}
+/** A table name with `public.` added when it names no schema, quoted. */
+function quoteQualified(name) {
+	return quoteQualifiedTable(name, CLI);
+}
+function helperSchema(ctx) {
+	return ctx.schema ?? "permdock";
+}
+function qualified(ctx, name) {
+	return `${quoteIdent(helperSchema(ctx))}.${name}`;
+}
+function quoteLiteral(value) {
+	return quoteSqlLiteral(value);
+}
+const CLI = "PermDock CLI";
+function declaredArray(values) {
+	return values.length === 0 ? `'{}'::text[]` : `array[${values.map(quoteLiteral).join(", ")}]::text[]`;
+}
+/**
+* A text array as a Postgres literal (`'{admin,owner}'`). An element that holds
+* a delimiter, a brace, a quote, a backslash, whitespace, or that reads as
+* `NULL`, is double-quoted and escaped, so one element can never split into
+* several.
+*/
+function textArrayLiteral(values) {
+	return quoteLiteral(`{${values.map((value) => value === "" || /[\s,{}"\\]/u.test(value) || /^null$/iu.test(value) ? `"${value.replaceAll("\\", "\\\\").replaceAll("\"", "\\\"")}"` : value).join(",")}}`);
 }
 //#endregion
 //#region src/cli/sql/context.ts
@@ -118,21 +129,21 @@ function parseMembershipsFlag(raw) {
 	const colon = raw.indexOf(":");
 	const table = colon === -1 ? raw : raw.slice(0, colon);
 	const cols = (colon === -1 ? "" : raw.slice(colon + 1)).split(",").map((item) => item.trim()).filter((item) => item !== "");
-	return { tenant: {
+	return { scopes: { tenant: {
 		table,
-		tenant: cols[0] ?? "tenant_id",
+		columns: { tenant: cols[0] ?? "tenant_id" },
 		user: cols[1] ?? "user_id",
 		role: cols[2] ?? "role",
 		...cols[3] === void 0 ? {} : { expiresAt: cols[3] }
-	} };
+	} } };
 }
 //#endregion
 //#region src/cli/sql/subject.ts
 /**
-* A role with `for` counts only on a membership of one of those kinds:
-* `case role when 'admin' then via = any(...) ... else true end`. A missing
-* kind (`viaExpr` null) holds none of them. A constant kind folds into the
-* roles it excludes, or no filter. `undefined` when nothing is filtered.
+* A role with `for` counts only on a membership of one of those kinds: `case
+* role when 'admin' then via = any(...) ... else true end`. A missing kind
+* (`viaExpr` null) holds none of them. A constant kind folds into the roles it
+* excludes, or no filter. `undefined` when nothing is filtered.
 */
 function kindFilterSql(ctx, roleExpr, viaExpr) {
 	const kinds = Object.entries(ctx.ownership?.kinds ?? {}).toSorted(([a], [b]) => byCodePoint(a, b));
@@ -143,7 +154,10 @@ function kindFilterSql(ctx, roleExpr, viaExpr) {
 	}
 	return `case ${roleExpr} ${kinds.map(([role, allowed]) => `when ${quoteLiteral(role)} then coalesce(${viaExpr}, '') = any(array[${allowed.map(quoteLiteral).join(", ")}]::text[])`).join(" ")} else true end`;
 }
-/** The kind check for one known role; `undefined` when it has no `for` or a constant kind it allows. */
+/**
+* The kind check for one known role; `undefined` when it has no `for` or a
+* constant kind it allows.
+*/
 function roleKindSql(ctx, role, viaExpr) {
 	const allowed = ctx.ownership?.kinds[role];
 	if (allowed === void 0) return;
@@ -161,7 +175,10 @@ function keyTenantSql(ctx, tenant) {
 	const named = `nullif(${subjectClaimJsonSql(ctx, keys.claim)} ->> ${quoteLiteral(keys.tenant)}, '')`;
 	return tenant === void 0 ? `${named} is null` : `(${named} is null or (${tenant})::text = ${named})`;
 }
-/** The active-tenant claim cast to the tenant column's type, so the comparison uses the column's index. */
+/**
+* The active-tenant claim cast to the tenant column's type, so the comparison
+* uses the column's index.
+*/
 function tenantClaimSql(ctx) {
 	return `${subjectClaimSql(ctx, ctx.tenantClaim)}::${tenantTypeOf(ctx)}`;
 }
@@ -170,7 +187,10 @@ function userIdHelperSql(ctx) {
 	return qualified(ctx, USER_ID_HELPER);
 }
 const SESSION_LIVE_HELPER = "permdock_session_live";
-/** `{ subject: { session: { live: true } } }` in a policy; only Supabase has `auth.sessions`. */
+/**
+* `{ subject: { session: { live: true } } }` in a policy; only Supabase has
+* `auth.sessions`.
+*/
 function liveSessionSql(ctx) {
 	if (ctx.dialect !== "supabase") throw configError(`PermDock CLI: { subject: { session: { live: true } } } reads auth.sessions, which only the supabase dialect has (got ${ctx.dialect})`);
 	return `(select ${qualified(ctx, SESSION_LIVE_HELPER)}())`;
@@ -245,7 +265,10 @@ function subjectClaimJsonSql(ctx, claim) {
 function viaAllowed(value, allowed) {
 	return allowed.includes(value ?? "");
 }
-/** The membership kind of a row `m` of `table`: its column as text, or its constant (`null` without one). */
+/**
+* The membership kind of a row `m` of `table`: its column as text, or its
+* constant (`null` without one).
+*/
 function memberVia(table) {
 	const via = table.via;
 	if (via === void 0) return { value: null };
@@ -267,7 +290,10 @@ const HELPERS = {
 	has: "permdock_has",
 	hasFor: "permdock_has_for"
 };
-/** Objects `--custom-roles` adds next to the helpers. Names are part of the SQL contract. */
+/**
+* Objects `--custom-roles` adds next to the helpers. Names are part of the SQL
+* contract.
+*/
 const CUSTOM_ROLES = {
 	permissions: "custom_role_permissions",
 	includes: "custom_role_includes",
@@ -275,31 +301,44 @@ const CUSTOM_ROLES = {
 	keys: "permdock_custom_keys",
 	beyond: "permdock_custom_role_beyond",
 	guard: "permdock_custom_role_guard",
+	syncGuard: "permdock_sync_custom_role_guard",
 	beyondFor: "permdock_custom_role_beyond_for",
 	guardFor: "permdock_custom_role_guard_for",
 	shape: "permdock_custom_role_shape",
 	entries: "permdock_custom_role_entries",
+	entryProblem: "permdock_custom_role_entry_problem",
 	replace: "permdock_replace_custom_role_grants",
 	rename: "permdock_rename_custom_role_grants",
 	remove: "permdock_delete_custom_role_grants",
 	trustedReplace: "permdock_trusted_replace_custom_role_grants",
 	trustedRename: "permdock_trusted_rename_custom_role_grants",
 	trustedRemove: "permdock_trusted_delete_custom_role_grants",
+	replaceById: "permdock_replace_custom_role_grants_by_id",
+	trustedReplaceById: "permdock_trusted_replace_custom_role_grants_by_id",
+	trustedReadById: "permdock_trusted_role_permissions_by_id",
 	cascade: "permdock_cascade_custom_role",
+	nameGuard: "permdock_custom_role_name_guard",
+	sync: "permdock_sync_custom_role",
 	shared: "permdock_is_shared_role"
 };
 /** The function `rls.roles` adds. The name is part of the SQL contract. */
 const GLOBAL_ROLES = { replace: "permdock_replace_global_roles" };
-/** `user` is the SQL for the user id: the dialect's (the default) or the `p_user` parameter of a `_for` helper. */
+/**
+* `user` is the SQL for the user id: the dialect's (the default) or the
+* `p_user` parameter of a `_for` helper.
+*/
 function signedIn(ctx, user = subjectIdSql(ctx)) {
 	return `coalesce(${user}::text, '') <> ''`;
 }
 function rootName(ctx) {
 	return ctx.scopes[0]?.name ?? "tenant";
 }
-/** The stored allow as `permissions` hands it to `permdock_custom_keys`: `key`, or `key@level` with levels. */
+/**
+* The stored allow as `permissions` hands it to `permdock_custom_keys`: `key`,
+* or `key@level` with levels.
+*/
 function allowEntry(ctx) {
 	return ctx.customRoles?.levels === true ? "permission || coalesce('@' || c.level, '')" : "permission";
 }
 //#endregion
-export { declaredArray as A, parseMembershipsFlag as C, sqlType as D, scopeTypeOf as E, quoteQualified as F, quoteTable as I, textArrayLiteral as L, qualified as M, quoteIdent as N, tenantTypeOf as O, quoteLiteral as P, CLAIM as S, columnTypesOf as T, subjectClaimJsonSql as _, customRolesOn as a, tenantClaimSql as b, SESSION_LIVE_HELPER as c, keyTenantSql as d, kindFilterSql as f, sessionLiveHelperSql as g, roleKindSql as h, allowEntry as i, helperSchema as j, CLI as k, USER_ID_HELPER as l, memberVia as m, GLOBAL_ROLES as n, rootName as o, liveSessionSql as p, HELPERS as r, signedIn as s, CUSTOM_ROLES as t, globalKindFilterSql as u, subjectClaimSql as v, arrayColumnsOf as w, userIdHelperSql as x, subjectIdSql as y };
+export { quoteQualified as A, parseMembershipsFlag as C, qualified as D, helperSchema as E, firstScopeType as F, scopeTypeOf as I, sqlType as L, textArrayLiteral as M, arrayColumnsOf as N, quoteIdent as O, columnTypesOf as P, tenantTypeOf as R, CLAIM as S, declaredArray as T, subjectClaimJsonSql as _, customRolesOn as a, tenantClaimSql as b, SESSION_LIVE_HELPER as c, keyTenantSql as d, kindFilterSql as f, sessionLiveHelperSql as g, roleKindSql as h, allowEntry as i, quoteTable as j, quoteLiteral as k, USER_ID_HELPER as l, memberVia as m, GLOBAL_ROLES as n, rootName as o, liveSessionSql as p, HELPERS as r, signedIn as s, CUSTOM_ROLES as t, globalKindFilterSql as u, subjectClaimSql as v, CLI as w, userIdHelperSql as x, subjectIdSql as y };

package/dist/{shared-DvvFzYXe.js → shared-l0oGGetg.js}

@@ -1,9 +1,12 @@
-import { a as durationOf, f as nowMillis } from "./time-DkWjdL98.js";
-import { t as decisionToken } from "./token-BLZcjQgt.js";
+import { a as durationOf, f as nowMillis } from "./time-nR1JesoH.js";
+import { t as decisionToken } from "./token-DC9EQiet.js";
 //#region src/pdp/shared.ts
 const MAX_CACHE_TTL = 30;
 const CACHE_MAX = 1e3;
-/** Milliseconds from `ttl` seconds, clamped to 30 s; a `ttl` that is not a whole number of seconds above 0 disables the cache. */
+/**
+* Milliseconds from `ttl` seconds, clamped to 30 s; a `ttl` that is not a whole
+* number of seconds above 0 disables the cache.
+*/
 function ttlMs(cache) {
 	const ttl = durationOf(cache?.ttl);
 	return ttl === void 0 ? 0 : Math.min(ttl, MAX_CACHE_TTL) * 1e3;
@@ -48,9 +51,9 @@ function granted(provider, permission, subject, data) {
 	};
 }
 /**
-* The request that would be sent, plus what a custom mapping may drop
-* (issuer, tenant, actor): a tenant switch or a changed row never reuses a
-* cached answer.
+* The request that would be sent, plus what a custom mapping may drop (issuer,
+* tenant, actor): a tenant switch or a changed row never reuses a cached
+* answer.
 */
 function cacheKey(subject, permission, body) {
 	return JSON.stringify([

package/dist/{signals-D3NcTKUS.js → signals-B1vHR3fN.js}

@@ -6,8 +6,8 @@ const EXIT_CODES = {
 /** How long a signalled run may take to clean up before the process exits. */
 const GRACE_MS = 2e3;
 /**
-* Turns SIGINT and SIGTERM into an aborted signal and the 128 + n exit code.
-* A second signal, or a run still busy after the grace period, exits at once.
+* Turns SIGINT and SIGTERM into an aborted signal and the 128 + n exit code. A
+* second signal, or a run still busy after the grace period, exits at once.
 */
 function trapSignals() {
 	const controller = new AbortController();

package/dist/{sink-BEZSlMS_.js → sink-D9_vh372.js}

@@ -1,11 +1,14 @@
 import { t as compact } from "./compact-CAf557ZB.js";
-import { n as freezeDeep } from "./freeze-CrU8nQeX.js";
-import { t as assertAppData } from "./app-data-MuyzVqX8.js";
-import { d as isoNow, n as RFC3339_PATTERN } from "./time-DkWjdL98.js";
-import { n as requireEventInstant } from "./event-time-CsegxXxB.js";
+import { n as freezeDeep } from "./freeze-jjan0lCv.js";
+import { t as assertAppData } from "./app-data-UNNm07jV.js";
+import { d as isoNow, n as RFC3339_PATTERN } from "./time-nR1JesoH.js";
+import { n as requireEventInstant } from "./event-time-BGy48400.js";
 //#region src/core/event-schemas.ts
 const SCHEMA = "https://json-schema.org/draft/2020-12/schema";
-/** The URL each event family's schema is published at, and its CloudEvents `dataschema`. */
+/**
+* The URL each event family's schema is published at, and its CloudEvents
+* `dataschema`.
+*/
 const EVENT_SCHEMA_IDS = Object.freeze({
 	decision: "https://permdock.com/schemas/decision-event-v1.json",
 	directory: "https://permdock.com/schemas/directory-event-v1.json",
@@ -671,7 +674,10 @@ const CLOUD_EVENT_TYPES = Object.freeze({
 	deliveryComplained: "com.permdock.delivery.complained",
 	deliveryFailed: "com.permdock.delivery.failed"
 });
-/** Types named for a later release; a receiver refuses them until then. None are reserved now. */
+/**
+* Types named for a later release; a receiver refuses them until then. None are
+* reserved now.
+*/
 const RESERVED_CLOUD_EVENT_TYPES = Object.freeze([]);
 /** The CloudEvents JSON format media type for one event (structured mode). */
 const CLOUDEVENTS_CONTENT_TYPE = "application/cloudevents+json";
@@ -768,7 +774,10 @@ function cloudEventSubject(event) {
 	if (event.type === "automation") return event.automation.id;
 	return event.permission;
 }
-/** `x` as given, after checking it is a plain JSON object; a builder throws on bad input. */
+/**
+* `x` as given, after checking it is a plain JSON object; a builder throws on
+* bad input.
+*/
 function checkedX(x) {
 	if (x !== void 0) assertAppData(x, "x of a sink event");
 	return x;
@@ -802,9 +811,9 @@ function automationEvent(input) {
 	});
 }
 /**
-* The `access` event of a `SupportSession`: `started` when it begins,
-* `ended` when it lapses, `revoked` when it is ended early. `principal` is
-* the staff member, as for a support membership.
+* The `access` event of a `SupportSession`: `started` when it begins, `ended`
+* when it lapses, `revoked` when it is ended early. `principal` is the staff
+* member, as for a support membership.
 */
 function supportSessionEvent(input) {
 	const { session } = input;
@@ -829,8 +838,8 @@ function supportSessionEvent(input) {
 	});
 }
 /**
-* A `credential` sink event for `credential`. `sample` belongs on `used`
-* events only and must be in `(0, 1]`.
+* A `credential` sink event for `credential`. `sample` belongs on `used` events
+* only and must be in `(0, 1]`.
 */
 function credentialEvent(input) {
 	const sample = input.sample;
@@ -917,9 +926,9 @@ function toCloudEvent(event, options) {
 	});
 }
 /**
-* Signs sink events as an offline evidence export: a compact JWS with
-* `typ: vnd.permdock.evidence+jwt` whose `events` claim holds CloudEvents.
-* Live deliveries use Standard Webhooks instead.
+* Signs sink events as an offline evidence export: a compact JWS with `typ:
+* vnd.permdock.evidence+jwt` whose `events` claim holds CloudEvents. Live
+* deliveries use Standard Webhooks instead.
 */
 function signDecisionBatch(events, signer, options) {
 	const source = options.source;
@@ -938,12 +947,14 @@ function memoryDecisionSink(options = {}) {
 			buffer.push(...events);
 			if (buffer.length > capacity) buffer.splice(0, buffer.length - capacity);
 			if (options.signer === void 0) return;
-			return signDecisionBatch(events, options.signer, compact({
-				audience: options.audience,
-				source: options.source
-			})).then((batch) => {
-				signed.push(batch);
-			}).catch(() => void 0);
+			const { signer } = options;
+			const sign = async () => {
+				signed.push(await signDecisionBatch(events, signer, compact({
+					audience: options.audience,
+					source: options.source
+				})));
+			};
+			return sign().catch(() => void 0);
 		},
 		events() {
 			return [...buffer];

package/dist/{sink-4-eQIRWf.d.ts → sink-Dvi7YZG_.d.ts}

@@ -1,7 +1,7 @@
-import { Ct as Credential, Jt as AutomationEvent, Kt as AccessEvent, Yt as CredentialEvent, gt as SupportSession, nn as MembershipEvent, q as DecisionSink, rn as SinkEvent, ut as TokenSigner } from "./policy-types-n0uRTsW8.js";
-import { V as AppData } from "./vocabulary-CN8H_9UF.js";
-import { u as OperationRisk } from "./operations-X0VM7F3m.js";
-import { t as Automation } from "./automation-BNM3TtDo.js";
+import { $t as CredentialEvent, Ct as Credential, Qt as AutomationEvent, Xt as AccessEvent, gt as SupportSession, on as MembershipEvent, q as DecisionSink, sn as SinkEvent, ut as TokenSigner } from "./policy-types-CCiDRZBH.js";
+import { M as AppData } from "./permission-types-CAY-GU7e.js";
+import { u as OperationRisk } from "./operations-Ci_rT6Uo.js";
+import { t as Automation } from "./automation-DqEoWHBc.js";
 //#region src/core/sink.d.ts
 /**
  * The closed list of CloudEvents `type` values, `com.permdock.<family>` or
@@ -40,7 +40,10 @@ declare const CLOUD_EVENT_TYPES: {
   readonly deliveryFailed: "com.permdock.delivery.failed";
 };
 type CloudEventType = (typeof CLOUD_EVENT_TYPES)[keyof typeof CLOUD_EVENT_TYPES];
-/** Types named for a later release; a receiver refuses them until then. None are reserved now. */
+/**
+ * Types named for a later release; a receiver refuses them until then. None are
+ * reserved now.
+ */
 declare const RESERVED_CLOUD_EVENT_TYPES: readonly CloudEventType[];
 /** The CloudEvents JSON format media type for one event (structured mode). */
 declare const CLOUDEVENTS_CONTENT_TYPE = "application/cloudevents+json";
@@ -51,27 +54,42 @@ declare const CLOUDEVENTS_BATCH_CONTENT_TYPE = "application/cloudevents-batch+js
  * which the Cloud then suspends; the `operation-*` codes only report.
  */
 type CatalogFindingCode = "permission-removed" | "not-hostable" | "grantee-removed" | "approval-tightened" | "operation-risk-raised" | "operation-approval-removed";
-/** One drift finding: the permission key and, when one broke, the hosted grant id. */
+/**
+ * One drift finding: the permission key and, when one broke, the hosted grant
+ * id.
+ */
 type CatalogFinding = {
   readonly code: CatalogFindingCode;
   readonly permission: string;
   readonly grant?: string;
   /** The operation name, on the `operation-*` codes. */
   readonly operation?: string;
-  /** `meta.risk` before the publish, on `operation-risk-raised`; an unset risk is `low`. */
+  /**
+   * `meta.risk` before the publish, on `operation-risk-raised`; an unset risk
+   * is `low`.
+   */
   readonly previous?: OperationRisk;
   /** `meta.risk` after the publish, on `operation-risk-raised`. */
   readonly risk?: OperationRisk;
 };
-/** `data` of a `com.permdock.catalog.*` event: a `permdock cloud push` or a drift against live hosted grants. */
+/**
+ * `data` of a `com.permdock.catalog.*` event: a `permdock cloud push` or a
+ * drift against live hosted grants.
+ */
 type CatalogEventData = {
   readonly kind: "publish" | "drift";
-  /** The catalog fingerprint after the publish, or the one drift was measured against. */
+  /**
+   * The catalog fingerprint after the publish, or the one drift was measured
+   * against.
+   */
   readonly fingerprint: string;
   readonly previous?: string;
   readonly findings?: readonly CatalogFinding[];
 };
-/** A CloudEvents 1.0 event in the JSON format, with the distributed-tracing extension. */
+/**
+ * A CloudEvents 1.0 event in the JSON format, with the distributed-tracing
+ * extension.
+ */
 type CloudEvent = {
   readonly specversion: "1.0";
   readonly type: CloudEventType;
@@ -82,9 +100,15 @@ type CloudEvent = {
   /** An RFC 3339 instant: the sink event's `at`. */
   readonly time: string;
   readonly datacontenttype: "application/json";
-  /** The published JSON Schema of `data`, `https://permdock.com/schemas/<family>-event-v1.json`. */
+  /**
+   * The published JSON Schema of `data`,
+   * `https://permdock.com/schemas/<family>-event-v1.json`.
+   */
   readonly dataschema: string;
-  /** W3C Trace Context `traceparent`, the CloudEvents distributed-tracing extension. */
+  /**
+   * W3C Trace Context `traceparent`, the CloudEvents distributed-tracing
+   * extension.
+   */
   readonly traceparent?: string;
   readonly tracestate?: string;
   readonly data: SinkEvent | CatalogEventData;
@@ -141,9 +165,9 @@ declare function automationEvent(input: {
   readonly x?: AppData;
 }): AutomationEvent;
 /**
- * The `access` event of a `SupportSession`: `started` when it begins,
- * `ended` when it lapses, `revoked` when it is ended early. `principal` is
- * the staff member, as for a support membership.
+ * The `access` event of a `SupportSession`: `started` when it begins, `ended`
+ * when it lapses, `revoked` when it is ended early. `principal` is the staff
+ * member, as for a support membership.
  */
 declare function supportSessionEvent(input: {
   readonly operation: AccessEvent["operation"];
@@ -155,8 +179,8 @@ declare function supportSessionEvent(input: {
   readonly x?: AppData;
 }): AccessEvent;
 /**
- * A `credential` sink event for `credential`. `sample` belongs on `used`
- * events only and must be in `(0, 1]`.
+ * A `credential` sink event for `credential`. `sample` belongs on `used` events
+ * only and must be in `(0, 1]`.
  */
 declare function credentialEvent(input: {
   readonly operation: CredentialEvent["operation"];
@@ -215,9 +239,9 @@ declare function accessEvent(input: {
  */
 declare function toCloudEvent(event: SinkEvent, options: CloudEventOptions): CloudEvent;
 /**
- * Signs sink events as an offline evidence export: a compact JWS with
- * `typ: vnd.permdock.evidence+jwt` whose `events` claim holds CloudEvents.
- * Live deliveries use Standard Webhooks instead.
+ * Signs sink events as an offline evidence export: a compact JWS with `typ:
+ * vnd.permdock.evidence+jwt` whose `events` claim holds CloudEvents. Live
+ * deliveries use Standard Webhooks instead.
  */
 declare function signDecisionBatch(events: readonly SinkEvent[], signer: TokenSigner, options: SignDecisionBatchOptions): Promise<string>;
 declare function memoryDecisionSink(options?: MemoryDecisionSinkOptions): MemoryDecisionSink;

package/dist/{skills-B6lVdD_W.js → skills-Bjj7BNEQ.js}

@@ -1,10 +1,12 @@
-import { t as byCodePoint } from "./compare-pfyVnBjE.js";
-import { i as readJsonFile } from "./files-D_JIzUrP.js";
-import { t as packageRoot } from "./package-root-Dk_ETdkp.js";
-import { t as didYouMean } from "./args-IIolxxKA.js";
+import { t as byCodePoint } from "./compare-DTfyUunF.js";
+import { i as readJsonFile } from "./files-BSjrtIHw.js";
+import { l as packageRoot } from "./version-DMQ0dnN5.js";
+import { t as didYouMean } from "./args-0FrVs5EH.js";
+import { a as nonEmptyOr } from "./output-tkju6U7R.js";
 import { cpSync, existsSync, lstatSync, mkdirSync, readFileSync, readdirSync, readlinkSync, realpathSync, writeFileSync } from "node:fs";
 import { basename, dirname, join, relative, resolve } from "node:path";
-import { createRequire } from "node:module";
+import { pathToFileURL } from "node:url";
+import { findPackageJSON } from "node:module";
 //#region src/cli/skills.ts
 const SKILL_NAMES = [
 	"permdock",
@@ -23,7 +25,10 @@ const AGENT_FOLDERS = {
 };
 /** The `--for` names `skills install` knows, with the folder each writes. */
 const SKILL_AGENTS = AGENT_FOLDERS;
-/** Agents whose config folder (`.claude`, `.cursor`, `.agents`) the project already has. */
+/**
+* Agents whose config folder (`.claude`, `.cursor`, `.agents`) the project
+* already has.
+*/
 function detectedAgents(cwd) {
 	return Object.entries(AGENT_FOLDERS).filter(([, folder]) => existsSync(join(cwd, dirname(folder)))).map(([agent]) => agent);
 }
@@ -79,13 +84,13 @@ function runSkillsInstall(input) {
 	const links = linked.length === 0 ? "" : `; linked ${linked.join(", ")}`;
 	return {
 		code: 0,
-		output: `installed ${copied.join(", ") || "no skills"}${links} (permdock@${version})`
+		output: `installed ${nonEmptyOr(copied.join(", "), "no skills")}${links} (permdock@${version})`
 	};
 }
 /**
 * Compares the installed skills with the ones this version ships and writes
-* nothing: exit 1 lists every file that is missing or differs. Without
-* agents it checks the agent folders the project has, else every folder.
+* nothing: exit 1 lists every file that is missing or differs. Without agents
+* it checks the agent folders the project has, else every folder.
 */
 function runSkillsCheck(input) {
 	const source = resolveSkillsRoot(input.cwd, input.bundled ?? join(packageRoot(), "skills"));
@@ -183,9 +188,8 @@ function resolveTargets(agents) {
 }
 function resolveSkillsRoot(cwd, bundled) {
 	try {
-		const pkg = createRequire(resolve(cwd, "package.json")).resolve("permdock/package.json");
-		const root = join(dirname(pkg), "skills");
-		if (existsSync(root)) return root;
+		const pkg = findPackageJSON("permdock", pathToFileURL(resolve(cwd, "package.json")));
+		if (pkg !== void 0 && existsSync(join(dirname(pkg), "skills"))) return join(dirname(pkg), "skills");
 	} catch {}
 	const local = join(cwd, "node_modules/permdock/skills");
 	if (existsSync(local)) return local;

package/dist/{skills-CTYwkl44.js → skills-OuoMR49L.js}

@@ -1,7 +1,7 @@
 import { t as defineLeaf } from "./command-L8EstFNm.js";
-import { t as checkFlag } from "./flags-C3DktBDY.js";
-import { r as pick, t as CANCELLED } from "./prompt-DfZLJLIn.js";
-import { n as detectedAgents, r as runSkills, t as SKILL_AGENTS } from "./skills-B6lVdD_W.js";
+import { t as checkFlag } from "./flags-DXjoTVbS.js";
+import { r as pick, t as CANCELLED } from "./prompt-BYc6drYW.js";
+import { n as detectedAgents, r as runSkills, t as SKILL_AGENTS } from "./skills-Bjj7BNEQ.js";
 //#region src/cli/commands/skills.ts
 const forFlag = { for: {
 	type: "string",