permdock 0.7.0 → 0.8.0

package/dist/chat/index.d.ts

@@ -1,2 +1,2 @@
-import { a as ChatCommandResult, c as createPermDock, d as SubjectFromChatOptions, f as isChatAuthor, i as ChatCommandContext, l as ChatAuthor, n as ChatActionResult, o as ChatPermDock, p as subjectFromChat, r as ChatCommand, s as ChatPermDockOptions, t as ChatAction, u as ChatPrincipal } from "../create-B2-CQqCI.js";
+import { a as ChatCommandResult, c as createPermDock, d as SubjectFromChatOptions, f as isChatAuthor, i as ChatCommandContext, l as ChatAuthor, n as ChatActionResult, o as ChatPermDock, p as subjectFromChat, r as ChatCommand, s as ChatPermDockOptions, t as ChatAction, u as ChatPrincipal } from "../create-BVq1lNQE.js";
 export { type ChatAction, type ChatActionResult, type ChatAuthor, type ChatCommand, type ChatCommandContext, type ChatCommandResult, type ChatPermDock, type ChatPermDockOptions, type ChatPrincipal, type SubjectFromChatOptions, createPermDock, isChatAuthor, subjectFromChat };

package/dist/chat/index.js

@@ -1,11 +1,11 @@
 import { t as compact } from "../compact-CAf557ZB.js";
-import { n as freezeDeep } from "../freeze-CrU8nQeX.js";
-import { n as loadPrincipalByIdentity } from "../principal-source-pHneukrx.js";
-import { f as nowMillis } from "../time-DkWjdL98.js";
-import { l as withApp, t as getPermDock } from "../permdock-BfWEeMqk.js";
-import { c as isApprovalError } from "../types-DqzsnlSA.js";
-import { a as requestApproval, o as resolveApproval, s as resumeDecision } from "../helpers-DY3vXuGs.js";
-import { t as approvalPrompt } from "../approval-prompt-Dg5LeAcT.js";
+import { n as freezeDeep } from "../freeze-jjan0lCv.js";
+import { n as loadPrincipalByIdentity } from "../principal-source-C6N60GtM.js";
+import { f as nowMillis } from "../time-nR1JesoH.js";
+import { l as withApp, t as getPermDock } from "../permdock-L-_I_3zP.js";
+import { c as isApprovalError } from "../types-CcUXciSj.js";
+import { a as requestApproval, o as resolveApproval, s as resumeDecision } from "../helpers-DJicaG6f.js";
+import { t as approvalPrompt } from "../approval-prompt-B8hQY69x.js";
 //#region src/chat/subject.ts
 function nonEmpty(value) {
 	return typeof value === "string" && value !== "";
@@ -17,7 +17,10 @@ function isChatAuthor(value) {
 	const workspace = Reflect.get(value, "workspace");
 	return nonEmpty(provider) && nonEmpty(userId) && (workspace === void 0 || nonEmpty(workspace));
 }
-/** The principal linked to `author`, or `null` for an unlinked or malformed author. Never throws. */
+/**
+* The principal linked to `author`, or `null` for an unlinked or malformed
+* author. Never throws.
+*/
 function principalFromChat(author, principals) {
 	if (!isChatAuthor(author)) return Promise.resolve(null);
 	return loadPrincipalByIdentity(principals, compact({
@@ -28,8 +31,8 @@ function principalFromChat(author, principals) {
 	}));
 }
 /**
-* The subject a chat author acts as: the principal its identity link
-* names, or anonymous when there is no link. Never throws.
+* The subject a chat author acts as: the principal its identity link names, or
+* anonymous when there is no link. Never throws.
 */
 async function subjectFromChat(author, options) {
 	return {

package/dist/chat-sdk/index.d.ts

@@ -1,17 +1,20 @@
-import { n as ApprovalUrl, t as ApprovalPrompt } from "../approval-prompt-K0faOLFp.js";
-import { l as ChatAuthor, n as ChatActionResult, o as ChatPermDock } from "../create-B2-CQqCI.js";
-import { n as ChatTransport } from "../types-g7Oy6Zg4.js";
+import { n as ApprovalUrl, t as ApprovalPrompt } from "../approval-prompt-PYagyQUj.js";
+import { l as ChatAuthor, n as ChatActionResult, o as ChatPermDock } from "../create-BVq1lNQE.js";
+import { n as ChatTransport } from "../types-yUuPR5Hy.js";
 import { ActionEvent, Author, CardElement } from "chat";
 //#region src/chat-sdk/author.d.ts
 type ChatSdkAuthorOptions = {
-  /** The platform workspace the bot is installed in, matched against identity links. */
+  /**
+   * The platform workspace the bot is installed in, matched against identity
+   * links.
+   */
   readonly workspace?: string;
 };
 /**
  * The `ChatAuthor` of a Chat SDK message or action, named by its adapter
- * (`adapter.name`, such as `slack`). `null` for a bot, this bot, the
- * platform itself or an empty id. Reads only `userId`: the email and display
- * name never identify anyone.
+ * (`adapter.name`, such as `slack`). `null` for a bot, this bot, the platform
+ * itself or an empty id. Reads only `userId`: the email and display name never
+ * identify anyone.
  */
 export declare function chatSdkAuthor(user: Pick<Author, "userId" | "isBot" | "isMe" | "isSystem">, adapter: {
   readonly name: string;
@@ -23,17 +26,23 @@ export declare const APPROVE_ACTION = "permdock:approve";
 /** The `actionId` of the card's reject button; its `value` is the request id. */
 export declare const REJECT_ACTION = "permdock:reject";
 type ApprovalCardOptions = {
-  /** The app's approval page: a base URL the request id is appended to, or a function of the prompt. Must be https. */
+  /**
+   * The app's approval page: a base URL the request id is appended to, or a
+   * function of the prompt. Must be https.
+   */
   readonly approvalUrl: ApprovalUrl;
-  /** `false` leaves out the approve and reject buttons, so the page is the only place to decide. Defaults to `true`. */
+  /**
+   * `false` leaves out the approve and reject buttons, so the page is the only
+   * place to decide. Defaults to `true`.
+   */
   readonly buttons?: boolean;
 };
 /**
- * A Chat SDK card for an approval prompt: the detail, who asked, the
- * permission and the expiry, a link to the approval page, and approve and
- * reject buttons that carry the request id, never its token. A click is
- * applied by `approvalActions` as the verified clicking user. Throws a
- * `TypeError` for an approval page that is not https.
+ * A Chat SDK card for an approval prompt: the detail, who asked, the permission
+ * and the expiry, a link to the approval page, and approve and reject buttons
+ * that carry the request id, never its token. A click is applied by
+ * `approvalActions` as the verified clicking user. Throws a `TypeError` for an
+ * approval page that is not https.
  */
 export declare function approvalCard(prompt: ApprovalPrompt, options: ApprovalCardOptions): CardElement;
 //#endregion
@@ -46,31 +55,40 @@ type ApprovalActionsOptions = ChatSdkAuthorOptions & {
   readonly onResult?: (result: ChatActionResult, event: ActionEvent) => void | Promise<void>;
 };
 type ApprovalActions = {
-  /** The action ids to register: `chat.onAction(actions.actionIds, actions.onAction)`. */
+  /**
+   * The action ids to register: `chat.onAction(actions.actionIds,
+   * actions.onAction)`.
+   */
   readonly actionIds: readonly [typeof APPROVE_ACTION, typeof REJECT_ACTION];
   readonly onAction: (event: ActionEvent) => Promise<void>;
 };
 /**
- * Applies the approve and reject buttons of `approvalCard`. The clicking
- * user, as the Chat SDK adapter verified them, is resolved through
- * `ChatPermDock.resolveAction`; the button value names the request by id.
- * A click from an unlinked user, the requester or a bot records nothing.
+ * Applies the approve and reject buttons of `approvalCard`. The clicking user,
+ * as the Chat SDK adapter verified them, is resolved through
+ * `ChatPermDock.resolveAction`; the button value names the request by id. A
+ * click from an unlinked user, the requester or a bot records nothing.
  */
 export declare function approvalActions(permdock: ChatPermDock, options?: ApprovalActionsOptions): ApprovalActions;
 //#endregion
 //#region src/chat-sdk/transport.d.ts
 /** The part of a Chat SDK `Chat` the transport calls; a `new Chat(...)` fits. */
 type ChatSdkClient = {
-  openDM(user: string): Promise<{
-    post(message: string | CardElement): Promise<{
+  openDM: (user: string) => Promise<{
+    post: (message: string | CardElement) => Promise<{
       readonly id: string;
     }>;
   }>;
 };
 type ChatSdkTransportOptions = {
-  /** The adapter name recipients are on (`slack`, `teams`, …); a target for another provider is rejected. */
+  /**
+   * The adapter name recipients are on (`slack`, `teams`, …); a target for
+   * another provider is rejected.
+   */
   readonly provider: string;
-  /** The workspace the bot is installed in; a target for another workspace is rejected. */
+  /**
+   * The workspace the bot is installed in; a target for another workspace is
+   * rejected.
+   */
   readonly workspace?: string;
   /** Keys this transport remembers to skip a repeat post. Defaults to 1000. */
   readonly remember?: number;
@@ -78,9 +96,9 @@ type ChatSdkTransportOptions = {
 /**
  * The chat channel of `permdock/delivery` over the Chat SDK: opens a direct
  * message with the target's platform user id and posts the text, or the
- * approval card when the message carries an approval prompt. The Chat SDK
- * takes no idempotency key, so the transport skips a key it already sent,
- * per instance and in memory only.
+ * approval card when the message carries an approval prompt. The Chat SDK takes
+ * no idempotency key, so the transport skips a key it already sent, per
+ * instance and in memory only.
  */
 export declare function chatSdkTransport(chat: ChatSdkClient, options: ChatSdkTransportOptions): ChatTransport;
 //#endregion

package/dist/chat-sdk/index.js

@@ -1,13 +1,13 @@
 import { t as compact } from "../compact-CAf557ZB.js";
-import { n as approvalUrlFor } from "../approval-prompt-Dg5LeAcT.js";
-import { i as isDeliveryTarget } from "../target-Bw37TFNA.js";
+import { n as approvalUrlFor } from "../approval-prompt-B8hQY69x.js";
+import { i as isDeliveryTarget } from "../target-qdEAnnhU.js";
 import { Actions, Button, Card, CardText, Field, Fields, LinkButton } from "chat";
 //#region src/chat-sdk/author.ts
 /**
 * The `ChatAuthor` of a Chat SDK message or action, named by its adapter
-* (`adapter.name`, such as `slack`). `null` for a bot, this bot, the
-* platform itself or an empty id. Reads only `userId`: the email and display
-* name never identify anyone.
+* (`adapter.name`, such as `slack`). `null` for a bot, this bot, the platform
+* itself or an empty id. Reads only `userId`: the email and display name never
+* identify anyone.
 */
 function chatSdkAuthor(user, adapter, options = {}) {
 	const provider = typeof adapter === "string" ? adapter : adapter.name;
@@ -28,11 +28,11 @@ function oneLine(value) {
 	return value.replaceAll(/\s+/gu, " ").trim();
 }
 /**
-* A Chat SDK card for an approval prompt: the detail, who asked, the
-* permission and the expiry, a link to the approval page, and approve and
-* reject buttons that carry the request id, never its token. A click is
-* applied by `approvalActions` as the verified clicking user. Throws a
-* `TypeError` for an approval page that is not https.
+* A Chat SDK card for an approval prompt: the detail, who asked, the permission
+* and the expiry, a link to the approval page, and approve and reject buttons
+* that carry the request id, never its token. A click is applied by
+* `approvalActions` as the verified clicking user. Throws a `TypeError` for an
+* approval page that is not https.
 */
 function approvalCard(prompt, options) {
 	const url = approvalUrlFor(prompt, options.approvalUrl);
@@ -101,10 +101,10 @@ async function reply(result, event) {
 	await thread.postEphemeral(event.user, `The approval was not recorded: ${result.cause}.`, { fallbackToDM: false });
 }
 /**
-* Applies the approve and reject buttons of `approvalCard`. The clicking
-* user, as the Chat SDK adapter verified them, is resolved through
-* `ChatPermDock.resolveAction`; the button value names the request by id.
-* A click from an unlinked user, the requester or a bot records nothing.
+* Applies the approve and reject buttons of `approvalCard`. The clicking user,
+* as the Chat SDK adapter verified them, is resolved through
+* `ChatPermDock.resolveAction`; the button value names the request by id. A
+* click from an unlinked user, the requester or a bot records nothing.
 */
 function approvalActions(permdock, options = {}) {
 	const onAction = async (event) => {
@@ -147,9 +147,9 @@ function chatSdkFailure(error) {
 /**
 * The chat channel of `permdock/delivery` over the Chat SDK: opens a direct
 * message with the target's platform user id and posts the text, or the
-* approval card when the message carries an approval prompt. The Chat SDK
-* takes no idempotency key, so the transport skips a key it already sent,
-* per instance and in memory only.
+* approval card when the message carries an approval prompt. The Chat SDK takes
+* no idempotency key, so the transport skips a key it already sent, per
+* instance and in memory only.
 */
 function chatSdkTransport(chat, options) {
 	const remember = options.remember ?? DEFAULT_REMEMBER;

package/dist/{checks-BC_0mPIq.js → checks-CGkP3Z7A.js}

@@ -3,7 +3,10 @@ import { n as isReadonlyArray } from "./compact-CAf557ZB.js";
 function partsOf(check) {
 	return isReadonlyArray(check) ? [check[0], check[1]] : [check, void 0];
 }
-/** `true` when every check is granted, stopping at the first that is not; an empty list is `false`. */
+/**
+* `true` when every check is granted, stopping at the first that is not; an
+* empty list is `false`.
+*/
 function canAllWith(can, checks, options) {
 	if (checks.length === 0) return false;
 	return checks.every((check) => {

package/dist/{claims-map-7oQ3ue4X.js → claims-map-CKkoAAYF.js}

@@ -1,6 +1,9 @@
-import { o as readPath } from "./paths-DXSHAMIa.js";
+import { o as readPath } from "./paths-CUvURzHp.js";
 //#region src/core/claims-map.ts
-/** The value at `path`; a function that throws reads as absent, so a bad mapping fails closed. */
+/**
+* The value at `path`; a function that throws reads as absent, so a bad mapping
+* fails closed.
+*/
 function readClaim(claims, path) {
 	if (typeof path === "string") return readPath(claims, path);
 	try {

package/dist/{claims-map-Ca-QX8C6.d.ts → claims-map-D1Pb5oRq.d.ts}

@@ -1,11 +1,14 @@
 //#region src/core/claims-map.d.ts
-/** Where a value lives in verified claims: a dotted path (`app_metadata.roles`), or a function over the claims. */
+/**
+ * Where a value lives in verified claims: a dotted path (`app_metadata.roles`),
+ * or a function over the claims.
+ */
 type ClaimPath = string | ((claims: Readonly<Record<string, unknown>>) => unknown);
 /**
- * How one provider's verified claims map to a principal. Every subject
- * provider takes it as `claims`; each field it leaves out keeps that
- * provider's default. Mapping only: core never verifies a token, and a claim
- * becomes a principal field only after the provider verified the token.
+ * How one provider's verified claims map to a principal. Every subject provider
+ * takes it as `claims`; each field it leaves out keeps that provider's default.
+ * Mapping only: core never verifies a token, and a claim becomes a principal
+ * field only after the provider verified the token.
  */
 type ClaimsMap = {
   readonly id?: ClaimPath;

package/dist/claude-agent/index.d.ts

@@ -1,6 +1,6 @@
-import { T as Policy, j as PolicyVocabulary, sr as Principal } from "../policy-types-B-F-qAZk.js";
-import { a as PermDock } from "../permdock-Dco6dyCK.js";
-import { o as AgentAdapterOptions, t as AgentPermDock } from "../create-UTnUVETj.js";
+import { T as Policy, j as PolicyVocabulary, sr as Principal } from "../policy-types-CCiDRZBH.js";
+import { a as PermDock } from "../permdock-B6Sf4T_S.js";
+import { o as AgentAdapterOptions, t as AgentPermDock } from "../create-BSNrVuxh.js";
 //#region src/claude-agent/create.d.ts
 /** Structural `McpServerProvenance` from `@anthropic-ai/claude-agent-sdk`. */
 type ClaudeMcpServer = {
@@ -8,9 +8,9 @@ type ClaudeMcpServer = {
   readonly source: string;
 };
 /**
- * What `subject`, `actor` and `tenant` receive: the `canUseTool` options or
- * the hook input. The subject comes from the app that started the query,
- * never from these fields.
+ * What `subject`, `actor` and `tenant` receive: the `canUseTool` options or the
+ * hook input. The subject comes from the app that started the query, never from
+ * these fields.
  */
 type ClaudeAgentContext = {
   readonly toolName: string;

package/dist/claude-agent/index.js

@@ -1,6 +1,6 @@
 import { r as isRecord, t as compact } from "../compact-CAf557ZB.js";
-import { l as withApp } from "../permdock-BfWEeMqk.js";
-import { t as agentRuntime } from "../create-Cb86Z8Im.js";
+import { l as withApp } from "../permdock-L-_I_3zP.js";
+import { t as agentRuntime } from "../create-Cq4Uox0f.js";
 //#region src/claude-agent/create.ts
 const MCP_PREFIX = "mcp__";
 function asInput(input) {
@@ -31,7 +31,10 @@ function createPermDock(policy, given) {
 	const options = withApp(policy, given);
 	const sources = options.mcpSources ?? ["sdk"];
 	const { agent, kernel } = agentRuntime(policy, options, "claude-agent");
-	/** `null`: an unmapped tool under `unmapped: 'allow'`, which PermDock does not decide. */
+	/**
+	* `null`: an unmapped tool under `unmapped: 'allow'`, which PermDock does not
+	* decide.
+	*/
 	const decide = async (context, input) => {
 		const untrusted = untrustedServer(context, sources);
 		if (untrusted !== void 0) return {

package/dist/clerk/index.d.ts

@@ -1,7 +1,7 @@
-import { W as CustomRoleSource, lr as Subject, sr as Principal } from "../policy-types-B-F-qAZk.js";
-import { u as Permission } from "../permission-types-DhNEmoRG.js";
-import { s as RemotePdpCache } from "../types-D3A19w4A.js";
-import { t as ClaimsMap } from "../claims-map-Ca-QX8C6.js";
+import { W as CustomRoleSource, lr as Subject, sr as Principal } from "../policy-types-CCiDRZBH.js";
+import { u as Permission } from "../permission-types-CAY-GU7e.js";
+import { s as RemotePdpCache } from "../types-B4uqKDnp.js";
+import { t as ClaimsMap } from "../claims-map-D1Pb5oRq.js";
 import { StandardSchemaV1 } from "@standard-schema/spec";
 //#region src/clerk/types.d.ts
 type ClerkPrincipal = Principal & {
@@ -37,7 +37,11 @@ type ClerkSubjectOptions = {
   readonly customRoles?: CustomRoleSource;
   readonly permissions?: Readonly<Record<string, Permission>>;
   readonly schema?: StandardSchemaV1;
-  /** Where the session token carries platform roles (`claims.roles`): a path such as `publicMetadata.staff`, or a function. Organization roles come from the `o` claim. */
+  /**
+   * Where the session token carries platform roles (`claims.roles`): a path
+   * such as `publicMetadata.staff`, or a function. Organization roles come from
+   * the `o` claim.
+   */
   readonly claims?: Pick<ClaimsMap, "roles">;
   readonly features?: Readonly<Record<string, string>>;
   readonly declared?: readonly string[];
@@ -58,8 +62,8 @@ type ClerkSubjectResolverOptions = ClerkSubjectOptions & {
 //#region src/clerk/subject.d.ts
 export declare function subjectFromClerk(authObject: unknown, options?: ClerkSubjectOptions): Promise<Subject<ClerkPrincipal>>;
 /**
- * A resolver that keeps each user's `memberships: 'all'` list for
- * `cache.ttl` (at most 30 seconds), so a removed membership grants until then.
+ * A resolver that keeps each user's `memberships: 'all'` list for `cache.ttl`
+ * (at most 30 seconds), so a removed membership grants until then.
  */
 export declare function clerkSubjectResolver(options?: ClerkSubjectResolverOptions): (authObject: unknown) => Promise<Subject<ClerkPrincipal>>;
 //#endregion

package/dist/clerk/index.js

@@ -1,9 +1,9 @@
 import { i as omitKeys, r as isRecord, t as compact } from "../compact-CAf557ZB.js";
-import { n as freezeDeep } from "../freeze-CrU8nQeX.js";
-import { r as validateRecord } from "../thenable-yD7SabqG.js";
+import { n as freezeDeep } from "../freeze-jjan0lCv.js";
+import { r as validateRecord } from "../thenable-BNSM1U2R.js";
 import { t as anonymousSubject } from "../subject-BGoM5o8B.js";
-import { t as readClaim } from "../claims-map-7oQ3ue4X.js";
-import { c as ttlMs, s as ttlCache } from "../shared-C8LjUdVU.js";
+import { t as readClaim } from "../claims-map-CKkoAAYF.js";
+import { c as ttlMs, s as ttlCache } from "../shared-l0oGGetg.js";
 //#region src/clerk/subject.ts
 function asRoles(value) {
 	if (typeof value === "string") return value === "" ? [] : [value];
@@ -198,8 +198,8 @@ function subjectFromClerk(authObject, options = {}) {
 	return fromClerk(authObject, options, extraMemberships);
 }
 /**
-* A resolver that keeps each user's `memberships: 'all'` list for
-* `cache.ttl` (at most 30 seconds), so a removed membership grants until then.
+* A resolver that keeps each user's `memberships: 'all'` list for `cache.ttl`
+* (at most 30 seconds), so a removed membership grants until then.
 */
 function clerkSubjectResolver(options = {}) {
 	const { cache, ...rest } = options;

package/dist/cli/bin.js

@@ -5,14 +5,14 @@ import { text } from "node:stream/consumers";
 module.enableCompileCache?.();
 const argv = process.argv.slice(2);
 if (argv.length === 1 && (argv[0] === "--version" || argv[0] === "-v")) {
-	const { cliVersion } = await import("../version-DXkYUISx.js");
+	const { cliVersion } = await import("../version-DizhmD72.js");
 	process.stdout.write(`${cliVersion()}\n`);
 } else {
 	const [{ isCi }, { trapSignals }, { run }, { streamHasColors }] = await Promise.all([
 		import("../env-DJZrPjRi.js"),
-		import("../signals-D3NcTKUS.js"),
-		import("../run-Bz7DXGEv.js"),
-		import("../style-Ds1gNm77.js")
+		import("../signals-B1vHR3fN.js"),
+		import("../run-D-JE8QWb.js"),
+		import("../style-DblOtSga.js")
 	]);
 	const signals = trapSignals();
 	const result = await run(argv, {

package/dist/cli/index.d.ts

@@ -1,6 +1,10 @@
-import { a as CatalogDocument, d as CatalogRole, f as CatalogScope, l as CatalogPermission, m as CatalogUsage, n as CatalogApproval, p as CatalogSupportAccess, r as CatalogBreakGlass, t as CatalogActivation, u as CatalogResource } from "../types-BXMYB7BY.js";
-import { a as pushedPolicy, i as parsePushedPolicy, n as PushedGrant, r as PushedPolicy, t as PUSHED_POLICY_SCHEMA } from "../pushed-policy-BbcY9r_4.js";
-import { _ as RunResult, c as RlsConfig, d as RlsMembershipTable, f as RlsMemberships, g as RlsTarget, h as RlsSuspension, i as PermDockConfig, l as RlsDialect, m as RlsSuspendedScope, n as CliIo, o as RlsActiveRow, p as RlsSuspendedMembership, r as CollectConfig, s as RlsApiKeys, t as CatalogConfig, u as RlsFunctionMapping } from "../types-BWZybqs9.js";
+import { T as Policy } from "../policy-types-CCiDRZBH.js";
+import { f as PermissionTree } from "../permission-types-CAY-GU7e.js";
+import { o as OperationMap } from "../operations-Ci_rT6Uo.js";
+import { a as CatalogDocument, d as CatalogRole, f as CatalogScope, l as CatalogPermission, m as CatalogUsage, n as CatalogApproval, p as CatalogSupportAccess, r as CatalogBreakGlass, t as CatalogActivation, u as CatalogResource } from "../types-ZzRGoViD.js";
+import { a as pushedPolicy, i as parsePushedPolicy, n as PushedGrant, r as PushedPolicy, t as PUSHED_POLICY_SCHEMA } from "../pushed-policy-D1Eoi6NM.js";
+import { _ as RlsSuspension, a as GenKind, c as RlsActiveRow, d as RlsDialect, f as RlsFunctionMapping, g as RlsSuspendedScope, h as RlsSuspendedMembership, i as GenConfig, l as RlsApiKeys, m as RlsMemberships, n as CliIo, o as PermDockConfig, p as RlsMembershipTable, r as CollectConfig, t as CatalogConfig, u as RlsConfig, v as RlsTarget, y as RunResult } from "../types-DC1Loeh3.js";
+import { o as ResourceNameOf, r as PermissionKeyOf, s as ScopeNameOf, t as ActionNameOf } from "../type-helpers-BIPIDa6a.js";
 //#region src/cli/catalog-path.d.ts
 /**
  * The absolute path `permdock collect` writes the catalog to: `collect.out`,
@@ -9,8 +13,79 @@ import { _ as RunResult, c as RlsConfig, d as RlsMembershipTable, f as RlsMember
  */
 export declare function catalogPath(config: PermDockConfig, cwd: string, out?: string): string;
 //#endregion
+//#region src/cli/project/config-checks.d.ts
+/**
+ * What `defineConfig` accepts: `policy`, `permissions` and `operations` take
+ * the imported value or its module path. A value types the keys below it; the
+ * CLI reads it from the module the config file imports it from.
+ */
+type PermDockConfigInput = Omit<PermDockConfig, "policy" | "permissions" | "operations"> & {
+  readonly policy?: string | Policy;
+  readonly permissions?: string | PermissionTree;
+  readonly operations?: string | OperationMap;
+};
+type At<T, K extends PropertyKey> = T extends { readonly [P in K]?: infer V; } ? NonNullable<V> : never;
+type KeysAt<T, K extends PropertyKey> = keyof At<T, K> & string;
+/** `never` on every key of `T` outside `Allowed`, so a stray key fails. */
+type Only<Keys extends string, Allowed> = { readonly [K in Exclude<Keys, Allowed>]?: never; };
+/** The pattern itself when a `{name}` segment names no scope in `S`. */
+type StrayPlaceholder<Pattern extends string, S> = Pattern extends `${string}{${infer Name}}${infer Rest}` ? Name extends S ? StrayPlaceholder<Rest, S> : Pattern : never;
+type BadTopics<Topics extends string, S> = { readonly [K in Topics as StrayPlaceholder<K, S> extends never ? never : K]?: never; };
+type KeepEntry<P> = PermissionKeyOf<P> | {
+  readonly key: string;
+};
+type BucketChecks<C, P> = { readonly [B in KeysAt<At<At<C, "rls">, "storage">, "buckets">]?: {
+  readonly scope?: ScopeNameOf<P>;
+}; };
+type SuspensionChecks<C, P> = {
+  readonly scopes?: Only<KeysAt<At<At<C, "rls">, "suspension">, "scopes">, ScopeNameOf<P>> & { readonly [S in ScopeNameOf<P>]?: {
+    readonly keep?: readonly KeepEntry<P>[];
+  }; };
+  readonly memberships?: {
+    readonly keep?: readonly KeepEntry<P>[];
+  };
+};
+type RlsChecks<C, P> = {
+  readonly tables?: Only<KeysAt<At<C, "rls">, "tables">, ResourceNameOf<P>>;
+  readonly scopeTypes?: Only<KeysAt<At<C, "rls">, "scopeTypes">, ScopeNameOf<P>>;
+  readonly actions?: Only<KeysAt<At<C, "rls">, "actions">, ActionNameOf<P>>;
+  readonly memberships?: {
+    readonly scopes?: Only<KeysAt<At<At<C, "rls">, "memberships">, "scopes">, ScopeNameOf<P>>;
+  };
+  readonly suspension?: SuspensionChecks<C, P>;
+  readonly customRoleWrites?: {
+    readonly requires?: "manageRoles" | readonly PermissionKeyOf<P>[];
+  };
+  readonly realtime?: {
+    readonly topics?: BadTopics<KeysAt<At<At<C, "rls">, "realtime">, "topics">, ScopeNameOf<P>>;
+  };
+  readonly storage?: {
+    readonly buckets?: BucketChecks<C, P>;
+  };
+};
+type PolicyOf<C> = C extends {
+  readonly policy: infer P;
+} ? P extends Policy ? P : never : never;
+/**
+ * The checks a policy value adds to its config: resource, scope, action and
+ * permission names in the keys that name them, and `{scope}` placeholders in
+ * Realtime topics. Without a policy value, nothing.
+ */
+type ConfigChecks<C> = [PolicyOf<C>] extends [never] ? unknown : {
+  readonly rls?: RlsChecks<C, PolicyOf<C>>;
+  readonly powersync?: {
+    readonly resources?: readonly ResourceNameOf<PolicyOf<C>>[];
+    readonly action?: ActionNameOf<PolicyOf<C>>;
+  };
+};
+//#endregion
 //#region src/cli/project/config.d.ts
-export declare function defineConfig<T extends PermDockConfig>(config: T): T;
+/**
+ * Types a `permdock.config.ts`. Pass the `policy` value rather than its path,
+ * and resource, scope, action and permission names in the config are checked
+ * against it.
+ */
+export declare function defineConfig<const C extends PermDockConfigInput>(config: C & ConfigChecks<C>): C;
 //#endregion
 //#region src/cli/sql/markers.d.ts
 /** The first line of a hook migration `permdock supabase hook generate` wrote. */
@@ -41,8 +116,8 @@ export declare function parseGrantsMarker(sql: string): SupabaseGrantsMarker | u
 //#region src/cli/token-schemas.d.ts
 /**
  * `schemas/run-v1.json`: the claims of a `vnd.permdock.run+jwt`, as
- * `signRunTicket` writes them and `parseRunTicket` accepts them. Unknown
- * claims are allowed; `parseRunTicket` drops them.
+ * `signRunTicket` writes them and `parseRunTicket` accepts them. Unknown claims
+ * are allowed; `parseRunTicket` drops them.
  */
 export declare const RUN_TICKET_SCHEMA: Readonly<Record<string, unknown>>;
 /**
@@ -57,4 +132,4 @@ export declare function run(argv: readonly string[], options?: {
   readonly io?: CliIo;
 }): Promise<RunResult>;
 //#endregion
-export { type CatalogActivation, type CatalogApproval, type CatalogBreakGlass, type CatalogConfig, type CatalogDocument, type CatalogPermission, type CatalogResource, type CatalogRole, type CatalogScope, type CatalogSupportAccess, type CatalogUsage, type CollectConfig, PUSHED_POLICY_SCHEMA, type PermDockConfig, type PushedGrant, type PushedPolicy, type RlsActiveRow, type RlsApiKeys, type RlsConfig, type RlsDialect, type RlsFunctionMapping, type RlsMembershipTable, type RlsMemberships, type RlsSuspendedMembership, type RlsSuspendedScope, type RlsSuspension, type RlsTarget, type RunResult, type SupabaseGrantsMarker, type SupabaseHookMarker, parsePushedPolicy, pushedPolicy };
+export { type CatalogActivation, type CatalogApproval, type CatalogBreakGlass, type CatalogConfig, type CatalogDocument, type CatalogPermission, type CatalogResource, type CatalogRole, type CatalogScope, type CatalogSupportAccess, type CatalogUsage, type CollectConfig, type ConfigChecks, type GenConfig, type GenKind, PUSHED_POLICY_SCHEMA, type PermDockConfig, type PermDockConfigInput, type PushedGrant, type PushedPolicy, type RlsActiveRow, type RlsApiKeys, type RlsConfig, type RlsDialect, type RlsFunctionMapping, type RlsMembershipTable, type RlsMemberships, type RlsSuspendedMembership, type RlsSuspendedScope, type RlsSuspension, type RlsTarget, type RunResult, type SupabaseGrantsMarker, type SupabaseHookMarker, parsePushedPolicy, pushedPolicy };

package/dist/cli/index.js

@@ -1,8 +1,8 @@
 import { t as catalogPath } from "../catalog-path-CnI0XTFK.js";
-import { t as defineConfig } from "../config-CoQHDrDi.js";
-import { n as parsePushedPolicy, r as pushedPolicy, t as PUSHED_POLICY_SCHEMA } from "../pushed-policy-CmYeSQqq.js";
-import { c as parseGrantsMarker, l as parseHookMarker } from "../markers-C6joDI3o.js";
-import { t as run } from "../run-uLD2aWuO.js";
+import { t as defineConfig } from "../config-BwPBfN0t.js";
+import { n as parsePushedPolicy, r as pushedPolicy, t as PUSHED_POLICY_SCHEMA } from "../pushed-policy-ITwYKvvH.js";
+import { c as parseGrantsMarker, l as parseHookMarker } from "../markers-BeHZ4x9Q.js";
+import { t as run } from "../run-Bz26OTfO.js";
 //#region src/cli/token-schemas.ts
 const ID = {
 	type: "string",
@@ -20,8 +20,8 @@ const AUDIENCE = { anyOf: [ID, {
 }] };
 /**
 * `schemas/run-v1.json`: the claims of a `vnd.permdock.run+jwt`, as
-* `signRunTicket` writes them and `parseRunTicket` accepts them. Unknown
-* claims are allowed; `parseRunTicket` drops them.
+* `signRunTicket` writes them and `parseRunTicket` accepts them. Unknown claims
+* are allowed; `parseRunTicket` drops them.
 */
 const RUN_TICKET_SCHEMA = {
 	$schema: "https://json-schema.org/draft/2020-12/schema",

package/dist/{clients-C7zLFuWT.d.ts → clients-C_NOET3z.d.ts}

@@ -1,11 +1,11 @@
 //#region src/core/clients.d.ts
 /**
  * Stable names for OAuth clients whose ids differ per environment or are
- * assigned at dynamic registration. A record maps each name to the client
- * id (or ids) it stands for; an unset id (an environment variable that is
- * not defined) names nothing. A function maps a verified client id to a
- * name, or `undefined`. Policy delegations name the client (`to: { kind,
- * client }`), never its id.
+ * assigned at dynamic registration. A record maps each name to the client id
+ * (or ids) it stands for; an unset id (an environment variable that is not
+ * defined) names nothing. A function maps a verified client id to a name, or
+ * `undefined`. Policy delegations name the client (`to: { kind, client }`),
+ * never its id.
  */
 type ClientNames = Readonly<Record<string, string | readonly string[] | undefined>> | ((clientId: string) => string | undefined);
 //#endregion

package/dist/{clients-DjU5ABMy.js → clients-DYr3U86j.js}

@@ -1,8 +1,8 @@
 //#region src/core/clients.ts
 /**
-* The name `clients` gives `clientId`, or `undefined`: unknown ids, an id
-* two names claim, a function that throws or returns anything but a
-* non-empty string. Never throws.
+* The name `clients` gives `clientId`, or `undefined`: unknown ids, an id two
+* names claim, a function that throws or returns anything but a non-empty
+* string. Never throws.
 */
 function clientNameOf(clients, clientId) {
 	if (clients === void 0 || clientId === "") return;