permdock 0.7.0 → 0.8.0

package/dist/{credentials-BpuTwd7a.js → credentials-CdDxp7jN.js}

@@ -1,4 +1,4 @@
-import { n as CliError } from "./errors-DpP_U6Bf.js";
+import { n as CliError } from "./errors-Vpu6rKHl.js";
 //#region src/cli/core/io.ts
 const FRAMES = [
 	"⠋",
@@ -14,8 +14,8 @@ const FRAMES = [
 ];
 const FRAME_MS = 80;
 /**
-* A spinner on a terminal stderr; a plain line elsewhere, so logs and CI
-* output stay readable. `done` replaces the spinner with a final line.
+* A spinner on a terminal stderr; a plain line elsewhere, so logs and CI output
+* stay readable. `done` replaces the spinner with a final line.
 */
 function progressReporter(input) {
 	return (message) => {
@@ -50,13 +50,13 @@ async function readSecret(readStdin) {
 const URL_PASSWORD = /\b([a-z][a-z0-9+.-]*:\/\/[^\s:/@]+:)([^\s@/]+)@/giu;
 /** `text` with every registered secret and every URL password masked. */
 function redact(text, secrets) {
-	let out = text.replace(URL_PASSWORD, "$1***@");
+	let out = text.replaceAll(URL_PASSWORD, "$1***@");
 	for (const secret of secrets) if (secret.length >= 4) out = out.replaceAll(secret, "***");
 	return out;
 }
 /**
-* The secret piped in for `--<flag>-stdin`, when it was passed, registered
-* for redaction.
+* The secret piped in for `--<flag>-stdin`, when it was passed, registered for
+* redaction.
 */
 async function secretInput(ctx, input) {
 	let value;

package/dist/{deciding-columns-DRo2QM6E.js → deciding-columns-NB4wcyBf.js}

@@ -87,8 +87,8 @@ function tableKey(name) {
 * membership (user, scope, id, `within`, role, `via`, expiry), and the id and
 * value columns of a table a role or user column references, keyed by
 * {@link tableKey}. A client that can write one can give itself a membership.
-* The hook's sources count even when `rls.membershipSources` replaces them
-* for the helpers: the token's claims still come from them.
+* The hook's sources count even when `rls.membershipSources` replaces them for
+* the helpers: the token's claims still come from them.
 */
 function membershipColumns(config) {
 	const sources = /* @__PURE__ */ new Set([...membershipSourcesOf(config), ...config.supabase?.hook?.memberships ?? []]);

package/dist/{delegation-C5rOdTp5.js → delegation-CDB6_keF.js}

@@ -1,14 +1,14 @@
 import { n as isReadonlyArray } from "./compact-CAf557ZB.js";
-import { r as ownGet } from "./paths-DXSHAMIa.js";
-import { a as resolveConditionRef, c as isConditionDate, d as parentHop, l as isConditionRef } from "./refs-CNJBiTFo.js";
-import { o as sameId, t as expiredAt } from "./expiry-D4_YKRKD.js";
-import { g as formerScopes, m as annotationsFor, n as findPermission } from "./permission-registry-DpPtSKNZ.js";
-import { o as epochSeconds } from "./time-DkWjdL98.js";
-import { f as scopeList, h as tenantOf, m as subjectMemberships, s as resolveScope } from "./scopes-BHsc-wp-.js";
-import { t as isoInstant } from "./instant-BluqDvyS.js";
-import { o as flattenGrantee } from "./grantee-BrRANrpT.js";
-import { t as isActive } from "./validity-CZ7-y0Cj.js";
-import { n as matchGrantee } from "./grantee-match-0RtHWQDx.js";
+import { r as ownGet } from "./paths-CUvURzHp.js";
+import { a as resolveConditionRef, c as isConditionDate, d as parentHop, l as isConditionRef } from "./refs-C8BKxc_e.js";
+import { o as sameId, t as expiredAt } from "./expiry-6XByK0dm.js";
+import { g as formerScopes, m as annotationsFor, n as findPermission } from "./permission-registry-B8tYxPIt.js";
+import { o as epochSeconds } from "./time-nR1JesoH.js";
+import { f as scopeList, h as tenantOf, m as subjectMemberships, s as resolveScope } from "./scopes-0Up_UA2t.js";
+import { t as isoInstant } from "./instant-DK3Iz83e.js";
+import { o as flattenGrantee } from "./grantee-Dke-9rd1.js";
+import { t as isActive } from "./validity-Buc7w8E9.js";
+import { n as matchGrantee } from "./grantee-match-7RZZvoT_.js";
 //#region src/conditions/evaluate.ts
 function resolveRef(ref, subject) {
 	return resolveConditionRef(ref, subject);
@@ -145,9 +145,9 @@ function isRowPair(value) {
 	return value !== null && typeof value === "object" && "current" in value && "next" in value;
 }
 /**
-* The row a `where` reads and the row a `check` reads. An instance check
-* takes a `{ current, next }` pair or one row for both; a collection check
-* has no current row, only the input it creates.
+* The row a `where` reads and the row a `check` reads. An instance check takes
+* a `{ current, next }` pair or one row for both; a collection check has no
+* current row, only the input it creates.
 */
 function rowValues(permission, data) {
 	if (permission.kind === "collection") return {
@@ -163,7 +163,10 @@ function rowValues(permission, data) {
 		next: data
 	};
 }
-/** The row's id under `field` as a string, or `*` when the row has no string or number there. */
+/**
+* The row's id under `field` as a string, or `*` when the row has no string or
+* number there.
+*/
 function rowIdOf(row, field = "id") {
 	if (row === null || typeof row !== "object" || !Object.hasOwn(row, field)) return "*";
 	const id = Reflect.get(row, field);
@@ -171,14 +174,17 @@ function rowIdOf(row, field = "id") {
 }
 //#endregion
 //#region src/core/delegation.ts
-/** The permission's scope and any scope it was renamed from: tokens issued before a rename keep working. */
+/**
+* The permission's scope and any scope it was renamed from: tokens issued
+* before a rename keep working.
+*/
 function scopeNames(permission) {
 	return [permission.scope, ...formerScopes(permission)];
 }
 /**
 * Whether a delegated caller may use a permission its principal holds, through
-* OAuth `scopes`, RFC 9396 `authorizationDetails` or GNAP `access`.
-* `undefined` means covered; otherwise the denial reason `decide` would add.
+* OAuth `scopes`, RFC 9396 `authorizationDetails` or GNAP `access`. `undefined`
+* means covered; otherwise the denial reason `decide` would add.
 */
 function coveredByDelegation(permission, delegation, resourceId, hasActor = false) {
 	const unscoped = hasActor ? "no-delegation" : void 0;
@@ -206,7 +212,10 @@ function coveredByDelegation(permission, delegation, resourceId, hasActor = fals
 	if (scopeOk || detailOk || accessOk) return;
 	return "not-delegated";
 }
-/** A `readOnly` actor never uses a permission without `readOnlyHint`, delegated or not. */
+/**
+* A `readOnly` actor never uses a permission without `readOnlyHint`, delegated
+* or not.
+*/
 function readOnlyActorRefuses(actor, permission) {
 	return actor?.readOnly === true && !annotationsFor(permission).readOnlyHint;
 }
@@ -266,10 +275,10 @@ function handsOver(delegation, subject, heldRoles, now) {
 /**
 * The permission keys the policy's delegations let `subject.actor` use for
 * `subject.principal` right now: the union over every active delegation whose
-* `to` matches the actor and whose `from` the principal holds. `undefined`
-* when none applies, so the call falls back to the token delegation alone.
-* An actor with `readOnly: true` gets only each delegation's read-only keys.
-* Attenuation only: a key here still needs a matching allow and no deny.
+* `to` matches the actor and whose `from` the principal holds. `undefined` when
+* none applies, so the call falls back to the token delegation alone. An actor
+* with `readOnly: true` gets only each delegation's read-only keys. Attenuation
+* only: a key here still needs a matching allow and no deny.
 */
 function delegatedPermissions(delegations, subject, heldRoles, now) {
 	const actor = subject.actor;

package/dist/delivery/index.d.ts

@@ -1,5 +1,5 @@
-import { an as EmailCategory, rn as DeliveryFailureCause, tn as DeliveryChannel } from "../policy-types-B-F-qAZk.js";
-import { i as approvalUrlFor, n as ApprovalUrl, r as approvalPrompt, t as ApprovalPrompt } from "../approval-prompt-K0faOLFp.js";
-import { _ as TransportOptions, a as DeliveryReport, c as DeliveryTransport, d as EmailTransport, f as EmailUnsubscribe, g as TransportMessages, h as TransportItem, i as DeliveryMessages, l as DeliveryTransports, m as Recipient, n as ChatTransport, o as DeliveryResult, p as OutgoingEmail, r as DeliverOptions, s as DeliveryTarget, t as ChatMessage, u as EmailMessage, v as WebhookMessage, y as WebhookTransport } from "../types-g7Oy6Zg4.js";
-import { C as audience, S as SubscriberEvent, _ as ParseConnectorResult, a as DeliveryPermDock, b as Audience, c as MemoryDelivery, d as memoryDeliveryTransport, f as CONNECTOR_SCHEMA, g as ConnectorKind, h as ConnectorIssue, i as isDeliveryTarget, l as MemoryDeliveryTransport, m as Connector, n as webhookTransport, o as DeliveryPermDockOptions, p as CONNECTOR_KINDS, r as isAddrSpec, s as createPermDock, t as WebhookTransportOptions, u as MemoryDeliveryTransportOptions, v as SiemDestination, w as subscribersFor, x as AudienceOptions, y as parseConnector } from "../index-DLwcuCN_.js";
+import { an as EmailCategory, rn as DeliveryFailureCause, tn as DeliveryChannel } from "../policy-types-CCiDRZBH.js";
+import { i as approvalUrlFor, n as ApprovalUrl, r as approvalPrompt, t as ApprovalPrompt } from "../approval-prompt-PYagyQUj.js";
+import { _ as TransportOptions, a as DeliveryReport, c as DeliveryTransport, d as EmailTransport, f as EmailUnsubscribe, g as TransportMessages, h as TransportItem, i as DeliveryMessages, l as DeliveryTransports, m as Recipient, n as ChatTransport, o as DeliveryResult, p as OutgoingEmail, r as DeliverOptions, s as DeliveryTarget, t as ChatMessage, u as EmailMessage, v as WebhookMessage, y as WebhookTransport } from "../types-yUuPR5Hy.js";
+import { C as audience, S as SubscriberEvent, _ as ParseConnectorResult, a as DeliveryPermDock, b as Audience, c as MemoryDelivery, d as memoryDeliveryTransport, f as CONNECTOR_SCHEMA, g as ConnectorKind, h as ConnectorIssue, i as isDeliveryTarget, l as MemoryDeliveryTransport, m as Connector, n as webhookTransport, o as DeliveryPermDockOptions, p as CONNECTOR_KINDS, r as isAddrSpec, s as createPermDock, t as WebhookTransportOptions, u as MemoryDeliveryTransportOptions, v as SiemDestination, w as subscribersFor, x as AudienceOptions, y as parseConnector } from "../index-Bv5iXPqU.js";
 export { type ApprovalPrompt, type ApprovalUrl, type Audience, type AudienceOptions, CONNECTOR_KINDS, CONNECTOR_SCHEMA, type ChatMessage, type ChatTransport, type Connector, type ConnectorIssue, type ConnectorKind, type DeliverOptions, type DeliveryChannel, type DeliveryFailureCause, type DeliveryMessages, type DeliveryPermDock, type DeliveryPermDockOptions, type DeliveryReport, type DeliveryResult, type DeliveryTarget, type DeliveryTransport, type DeliveryTransports, type EmailCategory, type EmailMessage, type EmailTransport, type EmailUnsubscribe, type MemoryDelivery, type MemoryDeliveryTransport, type MemoryDeliveryTransportOptions, type OutgoingEmail, type ParseConnectorResult, type Recipient, type SiemDestination, type SubscriberEvent, type TransportItem, type TransportMessages, type TransportOptions, type WebhookMessage, type WebhookTransport, type WebhookTransportOptions, approvalPrompt, approvalUrlFor, audience, createPermDock, isAddrSpec, isDeliveryTarget, memoryDeliveryTransport, parseConnector, subscribersFor, webhookTransport };

package/dist/delivery/index.js

@@ -1,6 +1,6 @@
-import { n as approvalUrlFor, t as approvalPrompt } from "../approval-prompt-Dg5LeAcT.js";
-import { n as subscribersFor, t as audience } from "../audience-BrMs8c4o.js";
-import { t as CONNECTOR_SCHEMA } from "../connector-schema-_VCSsdtD.js";
-import { a as parseConnector, i as CONNECTOR_KINDS, n as createPermDock, r as memoryDeliveryTransport, t as webhookTransport } from "../delivery-rwOKLWRm.js";
-import { i as isDeliveryTarget, n as isAddrSpec } from "../target-Bw37TFNA.js";
+import { n as approvalUrlFor, t as approvalPrompt } from "../approval-prompt-B8hQY69x.js";
+import { n as subscribersFor, t as audience } from "../audience-BAkBDMqn.js";
+import { t as CONNECTOR_SCHEMA } from "../connector-schema-CYLQNMYq.js";
+import { a as parseConnector, i as CONNECTOR_KINDS, n as createPermDock, r as memoryDeliveryTransport, t as webhookTransport } from "../delivery-BupfvJIV.js";
+import { i as isDeliveryTarget, n as isAddrSpec } from "../target-qdEAnnhU.js";
 export { CONNECTOR_KINDS, CONNECTOR_SCHEMA, approvalPrompt, approvalUrlFor, audience, createPermDock, isAddrSpec, isDeliveryTarget, memoryDeliveryTransport, parseConnector, subscribersFor, webhookTransport };

package/dist/{delivery-rwOKLWRm.js → delivery-BupfvJIV.js}

@@ -1,12 +1,12 @@
 import { r as isRecord, t as compact } from "./compact-CAf557ZB.js";
-import { n as freezeDeep } from "./freeze-CrU8nQeX.js";
-import { a as ownRecord } from "./paths-DXSHAMIa.js";
-import { n as loadPrincipalByIdentity } from "./principal-source-pHneukrx.js";
-import { t as deliveryEvent } from "./delivery-event-xX4obB8F.js";
-import { n as CLOUDEVENTS_CONTENT_TYPE } from "./sink-BEZSlMS_.js";
-import { n as copyJson, r as forbiddenKeyPath, t as checkSchema } from "./json-schema-B-vAwlde.js";
-import { t as CONNECTOR_SCHEMA } from "./connector-schema-_VCSsdtD.js";
-import { a as isWebhookAddress, i as isDeliveryTarget, n as isAddrSpec, r as isChatAddress, t as idempotencyKeyFor } from "./target-Bw37TFNA.js";
+import { n as freezeDeep } from "./freeze-jjan0lCv.js";
+import { a as ownRecord } from "./paths-CUvURzHp.js";
+import { n as loadPrincipalByIdentity } from "./principal-source-C6N60GtM.js";
+import { t as deliveryEvent } from "./delivery-event-JioK5YbS.js";
+import { n as CLOUDEVENTS_CONTENT_TYPE } from "./sink-D9_vh372.js";
+import { n as copyJson, r as forbiddenKeyPath, t as checkSchema } from "./json-schema-BPGa-RjQ.js";
+import { t as CONNECTOR_SCHEMA } from "./connector-schema-CYLQNMYq.js";
+import { a as isWebhookAddress, i as isDeliveryTarget, n as isAddrSpec, r as isChatAddress, t as idempotencyKeyFor } from "./target-qdEAnnhU.js";
 //#region src/delivery/connector.ts
 const BRANCHES = new Map((CONNECTOR_SCHEMA.oneOf ?? []).map((branch) => [branch.properties?.["kind"]?.const, branch]));
 /** The kinds `connector-v1` lists, in schema order. */
@@ -25,8 +25,8 @@ function fail$1(issues) {
 }
 /**
 * Checks `input` against `connector-v1.json` and answers a frozen copy, or
-* every issue with a JSON pointer. The branch is chosen by `kind`, so an
-* issue names the field rather than "no branch matched".
+* every issue with a JSON pointer. The branch is chosen by `kind`, so an issue
+* names the field rather than "no branch matched".
 */
 function parseConnector(input) {
 	const issues = [];
@@ -55,7 +55,10 @@ function parseConnector(input) {
 }
 //#endregion
 //#region src/delivery/memory-transport.ts
-/** An in-process transport for tests and examples: it records what it would have sent. */
+/**
+* An in-process transport for tests and examples: it records what it would have
+* sent.
+*/
 function memoryDeliveryTransport(channel, options = {}) {
 	const deliveries = [];
 	return Object.freeze({
@@ -89,7 +92,10 @@ const ROUTER_FIELDS = /* @__PURE__ */ new Set([
 	"list-unsubscribe",
 	"list-unsubscribe-post"
 ]);
-/** Fields that would add recipients or rewrite the envelope past the recipient check. */
+/**
+* Fields that would add recipients or rewrite the envelope past the recipient
+* check.
+*/
 const ENVELOPE_FIELDS = /* @__PURE__ */ new Set([
 	"to",
 	"cc",
@@ -143,8 +149,8 @@ function unsubscribeHeaders(unsubscribe) {
 /**
 * The email a transport sends to `target`: `from` resolved, the caller's
 * headers checked, `Auto-Submitted: auto-generated` (RFC 3834) on every
-* message, and the RFC 2369 / RFC 8058 unsubscribe pair on `notification`
-* only. A message that cannot be sent as given returns the reason.
+* message, and the RFC 2369 / RFC 8058 unsubscribe pair on `notification` only.
+* A message that cannot be sent as given returns the reason.
 */
 function outgoingEmail(message, target, defaultFrom) {
 	const from = message.from ?? defaultFrom;
@@ -188,7 +194,10 @@ function optionalString(value) {
 	if (value === void 0) return;
 	return typeof value === "string" && value !== "" ? value : null;
 }
-/** The recipient in the form its channel compares, or `null` when it is malformed. */
+/**
+* The recipient in the form its channel compares, or `null` when it is
+* malformed.
+*/
 function checkRecipient(value) {
 	const record = ownRecord(value);
 	const channel = record?.["channel"];
@@ -281,9 +290,9 @@ async function sendBatch(transport, batch) {
 	}));
 }
 /**
-* Sends every ready item: one batch call per `batchSize` items for a
-* transport with `deliverBatch`, one `deliver` call each otherwise. Events
-* keep recipient order.
+* Sends every ready item: one batch call per `batchSize` items for a transport
+* with `deliverBatch`, one `deliver` call each otherwise. Events keep recipient
+* order.
 */
 async function send(prepared) {
 	const events = prepared.map((entry) => "transport" in entry ? void 0 : entry);
@@ -310,7 +319,10 @@ async function send(prepared) {
 	}));
 	return events;
 }
-/** Routes checked recipients to channel transports and records a delivery event for each. */
+/**
+* Routes checked recipients to channel transports and records a delivery event
+* for each.
+*/
 function createPermDock(_policy, options) {
 	const source = options.source ?? "permdock";
 	const decideRecipient = async (permdock, checked, permission, row) => {
@@ -497,9 +509,9 @@ function fromStatus(status) {
 }
 /**
 * Posts each CloudEvent to the target's https endpoint as
-* `application/cloudevents+json`, signed with the Standard Webhooks
-* headers. `webhook-id` is the idempotency key, so a retry repeats it and
-* the receiver drops the duplicate. Redirects are not followed.
+* `application/cloudevents+json`, signed with the Standard Webhooks headers.
+* `webhook-id` is the idempotency key, so a retry repeats it and the receiver
+* drops the duplicate. Redirects are not followed.
 */
 function webhookTransport(signer, options = {}) {
 	const timeout = options.timeout ?? 1e4;

package/dist/{delivery-event-xX4obB8F.js → delivery-event-JioK5YbS.js}

@@ -1,12 +1,12 @@
 import { t as compact } from "./compact-CAf557ZB.js";
-import { t as assertAppData } from "./app-data-MuyzVqX8.js";
-import { d as isoNow } from "./time-DkWjdL98.js";
-import { n as requireEventInstant } from "./event-time-CsegxXxB.js";
+import { t as assertAppData } from "./app-data-UNNm07jV.js";
+import { d as isoNow } from "./time-nR1JesoH.js";
+import { n as requireEventInstant } from "./event-time-BGy48400.js";
 //#region src/core/delivery-event.ts
 /**
-* A `delivery` sink event. Throws a `TypeError` when `cause` or `retryable`
-* is set on an operation other than `failed`, and a `RangeError` for a
-* malformed `at`.
+* A `delivery` sink event. Throws a `TypeError` when `cause` or `retryable` is
+* set on an operation other than `failed`, and a `RangeError` for a malformed
+* `at`.
 */
 function checkedX(x) {
 	assertAppData(x, "x of a delivery event");

package/dist/denied-text-CHNlVInN.d.ts

@@ -0,0 +1,22 @@
+import { Ln as Decision } from "./policy-types-CCiDRZBH.js";
+import { u as Permission } from "./permission-types-CAY-GU7e.js";
+//#region src/agent/denied-text.d.ts
+/**
+ * What an agent adapter's `deniedText` receives: the refusal and the text
+ * PermDock wrote for it.
+ */
+type DeniedTextEvent = {
+  readonly decision: Exclude<Decision, {
+    readonly outcome: "granted";
+  }> | null;
+  readonly permission: Permission | undefined;
+  readonly text: string;
+};
+/**
+ * Replaces the human-readable text of a refusal, and nothing else: the outcome,
+ * `isError`, the structured content and the approval token stay. `undefined`
+ * keeps PermDock's text.
+ */
+type DeniedText = (event: DeniedTextEvent) => string | undefined;
+//#endregion
+export { DeniedTextEvent as n, DeniedText as t };

package/dist/{describe-DZlnEtLy.js → describe-Bb4hGK5d.js}

@@ -1,5 +1,5 @@
-import { i as flattenApprovers } from "./approvers-CqPOLD-o.js";
-import { r as requiredPlans } from "./problem-details-cn5X30gZ.js";
+import { i as flattenApprovers } from "./approvers-B4r0N_Uz.js";
+import { r as requiredPlans } from "./problem-details-CLDgX1KV.js";
 //#region src/core/describe.ts
 const TENANT_REASONS = /* @__PURE__ */ new Set([
 	"tenant-mismatch",
@@ -31,7 +31,7 @@ function labelGrantee(grantee) {
 		default: return grantee;
 	}
 }
-const TITLES = {
+const DESCRIBE_TITLES = {
 	granted: "Granted",
 	denied: "Denied",
 	approval: "Approval required",
@@ -57,7 +57,7 @@ function approvalDetail(permission, labels) {
 function describe(decision, options) {
 	const messages = options?.messages;
 	const labelOf = (key) => options?.permission?.key === key ? options.permission.meta?.title ?? key : key;
-	const titleOf = (kind) => messages?.titles?.[kind] ?? TITLES[kind];
+	const titleOf = (kind) => messages?.titles?.[kind] ?? DESCRIBE_TITLES[kind];
 	if (decision.outcome === "granted") {
 		const permission = labelOf(decision.matched.permission);
 		return {
@@ -97,4 +97,4 @@ function describe(decision, options) {
 	};
 }
 //#endregion
-export { describe as t };
+export { describe as n, DESCRIBE_TITLES as t };

package/dist/{describe-O0SwYIK8.d.ts → describe-ByS9LgHK.d.ts}

@@ -1,5 +1,5 @@
-import { Bn as DenialReason, Ln as Decision, Vn as DeniedDecision } from "./policy-types-B-F-qAZk.js";
-import { u as Permission } from "./permission-types-DhNEmoRG.js";
+import { Bn as DenialReason, Ln as Decision, Vn as DeniedDecision } from "./policy-types-CCiDRZBH.js";
+import { u as Permission } from "./permission-types-CAY-GU7e.js";
 //#region src/core/describe.d.ts
 type DecisionDescription = {
   readonly kind: "granted" | "denied" | "approval" | "tenant" | "delegation" | "server-only" | "upgrade";
@@ -16,9 +16,9 @@ type DecisionDescription = {
 type DescribeMessages = {
   readonly titles?: Partial<Record<DecisionDescription["kind"], string>>;
   /**
-   * Text per denial reason; a denied detail joins the texts of its reasons
-   * with `separator`. The function form also sees the decision; `undefined`
-   * keeps the reason code, as a missing record entry does.
+   * Text per denial reason; a denied detail joins the texts of its reasons with
+   * `separator`. The function form also sees the decision; `undefined` keeps
+   * the reason code, as a missing record entry does.
    */
   readonly reasons?: Partial<Record<DenialReason, string>> | ((reason: DenialReason, decision: DeniedDecision) => string | undefined);
   /** Joins denial reason texts. Default `', '`. */

package/dist/{device-BARQ8eYG.js → device-BwbJNmb2.js}

@@ -1,6 +1,6 @@
 import { r as isRecord, t as compact } from "./compact-CAf557ZB.js";
-import { h as secondsAt } from "./time-DkWjdL98.js";
-import { n as readBodyText } from "./body-text-QcXok_SI.js";
+import { h as secondsAt } from "./time-nR1JesoH.js";
+import { n as readBodyText } from "./body-text-DQhcmqdY.js";
 import { t as timeoutSignal } from "./timeout-D51niuQP.js";
 //#region src/terminal/device.ts
 /** Milliseconds an authorization server request may take. */
@@ -15,7 +15,10 @@ async function readJson(response) {
 		return null;
 	}
 }
-/** POSTs a form and reads a JSON object back; any network or parse failure is `null`. */
+/**
+* POSTs a form and reads a JSON object back; any network or parse failure is
+* `null`.
+*/
 async function postForm(runtime, url, fields) {
 	const fetchImpl = runtime.fetch ?? fetch;
 	try {
@@ -33,9 +36,9 @@ function withoutTrailingSlash(url) {
 	return url.replace(/\/+$/u, "");
 }
 /**
-* Where RFC 8414 metadata may live: the well-known segment inserted before
-* the issuer's path (section 3.1), then appended after it for servers that
-* predate the rule. An issuer without a path has one location.
+* Where RFC 8414 metadata may live: the well-known segment inserted before the
+* issuer's path (section 3.1), then appended after it for servers that predate
+* the rule. An issuer without a path has one location.
 */
 function metadataUrls(issuer) {
 	const parsed = new URL(issuer);
@@ -44,8 +47,8 @@ function metadataUrls(issuer) {
 	return path === "" ? [inserted] : [inserted, `${withoutTrailingSlash(issuer)}/.well-known/oauth-authorization-server`];
 }
 /**
-* The issuer's RFC 8414 metadata, or `null`. Metadata whose `issuer` is not
-* the configured issuer is refused (section 3.3), so a mix-up never routes a
+* The issuer's RFC 8414 metadata, or `null`. Metadata whose `issuer` is not the
+* configured issuer is refused (section 3.3), so a mix-up never routes a
 * credential to another server.
 */
 async function discoverAuthorizationServer(issuer, runtime) {

package/dist/{diff-Btr1c1Ow.js → diff-CN8IYhC_.js}

@@ -1,5 +1,5 @@
 import { t as defineLeaf } from "./command-L8EstFNm.js";
-import { c as given } from "./flags-aaeRAdiD.js";
+import { c as given } from "./flags-DXjoTVbS.js";
 //#region src/cli/commands/diff.ts
 const diff = defineLeaf({
 	positionals: [{
@@ -21,7 +21,7 @@ const diff = defineLeaf({
 		}
 	},
 	async run(ctx, { flags, args }) {
-		return (await import("./diff-DzT-xD13.js")).runDiff({
+		return (await import("./diff-iZWV65nC.js")).runDiff({
 			cwd: ctx.cwd,
 			config: ctx.config,
 			sources: [args["before"], args["after"]].filter((value) => value !== void 0),

package/dist/{diff-DzT-xD13.js → diff-iZWV65nC.js}

@@ -1,14 +1,14 @@
-import { A as memoryCustomRoleSource } from "./src-DLFrtrrC.js";
-import { n as findPermission } from "./permission-registry-DpPtSKNZ.js";
-import { g as secondsOf } from "./time-DkWjdL98.js";
+import { A as memoryCustomRoleSource } from "./src-DZ0l9UAg.js";
+import { n as findPermission } from "./permission-registry-B8tYxPIt.js";
+import { g as secondsOf } from "./time-nR1JesoH.js";
 import { t as canonicalJson } from "./canonical-json-DwilZ1iB.js";
-import { t as getPermDock } from "./permdock-BfWEeMqk.js";
-import { i as configError, u as usageResult } from "./errors-DpP_U6Bf.js";
-import { t as buildCatalog } from "./catalog-doc-CV9s6B1S.js";
-import { a as loadModule, n as asPolicy, s as pickNamed } from "./load-DxroEzH1.js";
-import { t as parseCatalog } from "./parse-Ddhz2xf4.js";
-import { t as operationFindings } from "./operation-findings-kRcEp8lE.js";
-import { n as fixtureSubject, r as loadFixtures, t as fixtureRow } from "./fixtures-BTMW6zgU.js";
+import { t as getPermDock } from "./permdock-L-_I_3zP.js";
+import { i as configError, u as usageResult } from "./errors-Vpu6rKHl.js";
+import { t as buildCatalog } from "./catalog-doc-DjMKzJp9.js";
+import { a as loadModule, n as asPolicy, s as pickNamed } from "./load-DjSU5KXO.js";
+import { t as parseCatalog } from "./parse-1_ZheTW5.js";
+import { t as operationFindings } from "./operation-findings-CXtFzlKJ.js";
+import { n as fixtureSubject, r as loadFixtures, t as fixtureRow } from "./fixtures-A1_sp_tR.js";
 import { existsSync, readFileSync } from "node:fs";
 import { resolve } from "node:path";
 //#region src/cli/diff/format.ts
@@ -90,7 +90,10 @@ function setDiff(before, after) {
 		removed: before.filter((item) => !b.has(item)).toSorted()
 	};
 }
-/** What makes two grants "the same grant" across versions: everything but the body. */
+/**
+* What makes two grants "the same grant" across versions: everything but the
+* body.
+*/
 function grantIdentity(grant) {
 	return canonicalJson({
 		permission: grant.permission,
@@ -125,7 +128,10 @@ function fieldsChange(before, after) {
 }
 const validFrom = (value) => secondsOf(value?.from) ?? Number.NEGATIVE_INFINITY;
 const validUntil = (value) => secondsOf(value?.until) ?? Number.POSITIVE_INFINITY;
-/** Narrowed when the window starts later or ends earlier than before; a new window on an open grant narrows it. */
+/**
+* Narrowed when the window starts later or ends earlier than before; a new
+* window on an open grant narrows it.
+*/
 function validityChange(before, after) {
 	return validFrom(after) > validFrom(before) || validUntil(after) < validUntil(before) ? "validity narrowed" : "validity widened";
 }
@@ -207,7 +213,10 @@ function sideRef(side) {
 function aliasesOf(catalog) {
 	return new Map(catalog.permissions.flatMap((item) => (item.renamedFrom ?? []).map((old) => [old, item.key])));
 }
-/** `a` with every key `b` renamed written as its new key, so grants compare by the current name. */
+/**
+* `a` with every key `b` renamed written as its new key, so grants compare by
+* the current name.
+*/
 function underNames(a, aliases) {
 	if (a.catalog.grants === void 0 || aliases.size === 0) return a;
 	return {

package/dist/{digest-B3kc_PgQ.d.ts → digest-8Yx2CchM.d.ts}

@@ -1,9 +1,9 @@
 //#region src/core/digest.d.ts
 /**
  * What a PermDock error's `digest` says. React keeps `digest` when an error
- * crosses from a Server Component to the client, where production builds
- * redact the message, so a client error boundary can still tell a denial or
- * an approval request from any other failure.
+ * crosses from a Server Component to the client, where production builds redact
+ * the message, so a client error boundary can still tell a denial or an
+ * approval request from any other failure.
  */
 type PermDockDigest = {
   readonly outcome: "denied";