permdock 0.7.0 → 0.8.0

package/dist/cloud/index.d.ts

@@ -1,11 +1,11 @@
-import { $t as CredentialEvent, Qt as AutomationEvent, Rt as Instant, Xt as AccessEvent, en as DecisionEvent, in as DirectoryEvent, nn as DeliveryEvent, on as MembershipEvent, tn as DeliveryChannel, ut as TokenSigner } from "../policy-types-B-F-qAZk.js";
-import { m as ApprovalStore } from "../types-DC44-hqb.js";
-import { i as CatalogEventData, l as CloudEventType, r as CLOUD_EVENT_TYPES, s as CloudEvent } from "../sink-Cp_Eot9W.js";
-import { c as DeliveryTransport } from "../types-g7Oy6Zg4.js";
-import { a as CloudConnectionOptions, c as CloudOptions, i as CloudClient, l as CloudSignerOptions, n as CloudCatalog, o as CloudEndpointOptions, r as CloudCatalogPush, s as CloudEndpoints, t as CloudApproverOptions } from "../types-DBHftjgS.js";
-import { n as ApprovalWaiter } from "../waiter-DwEyouan.js";
-import { l as ReplayStore } from "../types-cTos-H7p.js";
-import { f as WebhookVerifier, r as WebhookFailureCause$1, s as WebhookJwks } from "../standard-webhooks-B_qRg0ws.js";
+import { $t as CredentialEvent, Qt as AutomationEvent, Rt as Instant, Xt as AccessEvent, en as DecisionEvent, in as DirectoryEvent, nn as DeliveryEvent, on as MembershipEvent, tn as DeliveryChannel, ut as TokenSigner } from "../policy-types-CCiDRZBH.js";
+import { m as ApprovalStore } from "../types-B_tiYvk8.js";
+import { i as CatalogEventData, l as CloudEventType, r as CLOUD_EVENT_TYPES, s as CloudEvent } from "../sink-Dvi7YZG_.js";
+import { c as DeliveryTransport } from "../types-yUuPR5Hy.js";
+import { a as CloudConnectionOptions, c as CloudOptions, i as CloudClient, l as CloudSignerOptions, n as CloudCatalog, o as CloudEndpointOptions, r as CloudCatalogPush, s as CloudEndpoints, t as CloudApproverOptions } from "../types-AMJ5qoU_.js";
+import { n as ApprovalWaiter } from "../waiter-Bu9zAlE0.js";
+import { l as ReplayStore } from "../types-DjuMBNF9.js";
+import { f as WebhookVerifier, r as WebhookFailureCause$1, s as WebhookJwks } from "../standard-webhooks-C-qX4mJW.js";
 //#region src/cloud/base-url.d.ts
 /**
  * The one base URL of PermDock Cloud. The platform issuer is this URL; its
@@ -19,16 +19,16 @@ type CloudScope = "projects:read" | "policy:read" | "catalog:write" | "evidence:
 //#region src/cloud/request.d.ts
 /**
  * The environment URL and JWK Set URL `cloud()` uses when the environment is
- * configured: `environment`, else `PERMDOCK_CLOUD_ENV`. Throws when neither
- * is set; `resolveCloudEndpoints` then asks the Cloud which environment the
- * key belongs to.
+ * configured: `environment`, else `PERMDOCK_CLOUD_ENV`. Throws when neither is
+ * set; `resolveCloudEndpoints` then asks the Cloud which environment the key
+ * belongs to.
  */
 export declare function cloudEndpoints(options?: CloudEndpointOptions): CloudEndpoints;
 /**
- * The environment URL and JWK Set URL for a key: `cloudEndpoints(options)`
- * when the environment is configured, else the environment `GET
- * /v1/environment` names for `key` (`PERMDOCK_CLOUD_KEY`). Rejects when the
- * Cloud does not answer or answers another issuer.
+ * The environment URL and JWK Set URL for a key: `cloudEndpoints(options)` when
+ * the environment is configured, else the environment `GET /v1/environment`
+ * names for `key` (`PERMDOCK_CLOUD_KEY`). Rejects when the Cloud does not
+ * answer or answers another issuer.
  */
 export declare function resolveCloudEndpoints(options?: CloudConnectionOptions): Promise<CloudEndpoints>;
 //#endregion
@@ -39,9 +39,15 @@ export declare function cloud(options?: CloudOptions): CloudClient;
 type CloudOAuthOptions = {
   /** The client id the dashboard issued, or one from `/oauth/register`. */
   readonly clientId: string;
-  /** Registered with the client; the Cloud redirects here with `code` and `state`. */
+  /**
+   * Registered with the client; the Cloud redirects here with `code` and
+   * `state`.
+   */
   readonly redirectUri: string;
-  /** A confidential client's secret, sent as `client_secret_basic` (RFC 6749 section 2.3.1). Server-only. */
+  /**
+   * A confidential client's secret, sent as `client_secret_basic` (RFC 6749
+   * section 2.3.1). Server-only.
+   */
   readonly clientSecret?: string;
   /** The Cloud base URL and platform issuer; defaults to `CLOUD_BASE_URL`. */
   readonly url?: string;
@@ -51,7 +57,10 @@ type CloudOAuthOptions = {
   /** The clock `expires_at` is computed from; defaults to the system clock. */
   readonly now?: () => Instant;
 };
-/** A token response, with RFC 6749 field names; `expires_at` is seconds since the epoch. */
+/**
+ * A token response, with RFC 6749 field names; `expires_at` is seconds since
+ * the epoch.
+ */
 type CloudCredential = {
   readonly access_token: string;
   readonly token_type?: string;
@@ -59,14 +68,20 @@ type CloudCredential = {
   readonly refresh_token?: string;
   readonly scope?: string;
 };
-/** A started authorization. Keep `state` and `codeVerifier` server-side until the callback. */
+/**
+ * A started authorization. Keep `state` and `codeVerifier` server-side until
+ * the callback.
+ */
 type CloudAuthorization = {
   /** Where to send the browser. */
   readonly url: string;
   readonly state: string;
   readonly codeVerifier: string;
 };
-/** `GET /v1/projects` item. A project is one environment: `id` is the `{env}` of `/v1/environments/{env}`. */
+/**
+ * `GET /v1/projects` item. A project is one environment: `id` is the `{env}` of
+ * `/v1/environments/{env}`.
+ */
 type CloudProject = {
   readonly id: string;
   readonly name: string;
@@ -93,8 +108,8 @@ type CloudOAuthClient = {
   }) => Promise<CloudAuthorization>;
   /**
    * Redeems the callback URL. Throws `state-mismatch` unless it echoes
-   * `pending.state`, `issuer-mismatch` for an RFC 9207 `iss` of another
-   * server, and `authorization-denied` for an `error` or a missing `code`.
+   * `pending.state`, `issuer-mismatch` for an RFC 9207 `iss` of another server,
+   * and `authorization-denied` for an `error` or a missing `code`.
    */
   readonly exchangeCode: (callback: string | URL, pending: Pick<CloudAuthorization, "state" | "codeVerifier">) => Promise<CloudCredential>;
   readonly refresh: (refreshToken: string) => Promise<CloudCredential>;
@@ -115,12 +130,18 @@ type CloudAuthErrorCode = "discovery-failed" | "state-mismatch" | "issuer-mismat
 type CloudAuthErrorDetails = {
   /** The HTTP status, when the Cloud answered. */
   readonly status?: number;
-  /** The RFC 6749 or RFC 6750 `error` the Cloud sent (`invalid_grant`, `insufficient_scope`). */
+  /**
+   * The RFC 6749 or RFC 6750 `error` the Cloud sent (`invalid_grant`,
+   * `insufficient_scope`).
+   */
   readonly error?: string;
   /** The scope an `insufficient_scope` challenge names. */
   readonly scope?: string;
 };
-/** A failed `cloudOAuth` call. `code` tells a dead token (`invalid-token`) from a missing scope (`insufficient-scope`). */
+/**
+ * A failed `cloudOAuth` call. `code` tells a dead token (`invalid-token`) from
+ * a missing scope (`insufficient-scope`).
+ */
 export declare class CloudAuthError extends Error {
   override readonly name: "CloudAuthError";
   readonly code: CloudAuthErrorCode;
@@ -129,17 +150,20 @@ export declare class CloudAuthError extends Error {
   readonly scope: string | undefined;
   constructor(code: CloudAuthErrorCode, message: string, details?: CloudAuthErrorDetails);
 }
-/** Matches by `name` and `code`, so an error from another copy of the module still maps. */
+/**
+ * Matches by `name` and `code`, so an error from another copy of the module
+ * still maps.
+ */
 export declare function isCloudAuthError(value: unknown): value is CloudAuthError;
 //#endregion
 //#region src/cloud/delivery.d.ts
 /**
  * A `DeliveryTransport` for `channel` that hands each checked recipient to
- * PermDock Cloud, which sends it from its hosted email, chat or webhook
- * sender and reports back through `com.permdock.delivery.*` events. The
- * router has already decided the recipient: the Cloud receives the target
- * and the permission that let it through, never a decision to make.
- * `Idempotency-Key` is the delivery's idempotency key, so a retry repeats it.
+ * PermDock Cloud, which sends it from its hosted email, chat or webhook sender
+ * and reports back through `com.permdock.delivery.*` events. The router has
+ * already decided the recipient: the Cloud receives the target and the
+ * permission that let it through, never a decision to make. `Idempotency-Key`
+ * is the delivery's idempotency key, so a retry repeats it.
  */
 export declare function cloudDeliveryTransport<C extends DeliveryChannel>(channel: C, options?: CloudConnectionOptions): DeliveryTransport<C>;
 //#endregion
@@ -147,11 +171,11 @@ export declare function cloudDeliveryTransport<C extends DeliveryChannel>(channe
 /**
  * A `TokenSigner` backed by the environment's PermDock Cloud keys, typically
  * KMS-held, for run tickets (`vnd.permdock.run+jwt`) and every other signed
- * output an app issues. The Cloud signs only what the app sends: it sets
- * `iss` to the environment URL and adds no claim. Policy documents,
- * snapshots, evidence exports, Security Event Tokens and `at+jwt` access tokens are the Cloud's own
- * outputs, so their `typ` values are refused here. Verify what it signs with
- * `joseTokenVerifier({ jwks: cloudEndpoints().jwks })`.
+ * output an app issues. The Cloud signs only what the app sends: it sets `iss`
+ * to the environment URL and adds no claim. Policy documents, snapshots,
+ * evidence exports, Security Event Tokens and `at+jwt` access tokens are the
+ * Cloud's own outputs, so their `typ` values are refused here. Verify what it
+ * signs with `joseTokenVerifier({ jwks: cloudEndpoints().jwks })`.
  */
 export declare function cloudSigner(options?: CloudSignerOptions): TokenSigner;
 //#endregion
@@ -165,8 +189,8 @@ type Types = typeof CLOUD_EVENT_TYPES;
 type PermDockCloudEvent = Envelope<Types["decision"], DecisionEvent> | Envelope<Types["approvalRequested"] | Types["approvalResolved"] | Types["approvalExpired"] | Types["approvalCancelled"], DecisionEvent> | Envelope<Types["directoryCreated"] | Types["directoryReplaced"] | Types["directoryPatched"] | Types["directoryDeleted"], DirectoryEvent> | Envelope<Types["membershipAdded"] | Types["membershipRemoved"] | Types["membershipChanged"], MembershipEvent> | Envelope<Types["credentialCreated"] | Types["credentialUsed"] | Types["credentialRotated"] | Types["credentialRevoked"], CredentialEvent> | Envelope<Types["catalogPublished"] | Types["catalogDrifted"], CatalogEventData> | Envelope<Types["supportSessionStarted"] | Types["supportSessionEnded"], AccessEvent> | Envelope<Types["automationPublished"] | Types["automationChanged"] | Types["automationRevoked"] | Types["automationRun"], AutomationEvent> | Envelope<Types["deliverySent"] | Types["deliveryDelivered"] | Types["deliveryBounced"] | Types["deliveryComplained"] | Types["deliveryFailed"], DeliveryEvent>;
 type WebhookOptions = {
   /**
-   * A verifier to reuse across deliveries, so the JWKS is fetched once;
-   * built from `jwks`, `secret`, `replay`, `tolerance` and `now` when absent.
+   * A verifier to reuse across deliveries, so the JWKS is fetched once; built
+   * from `jwks`, `secret`, `replay`, `tolerance` and `now` when absent.
    */
   readonly verifier?: WebhookVerifier;
   /** `cloud().jwks`, a JWKS URL or an inline key set, for `v1a` signatures. */
@@ -180,7 +204,10 @@ type WebhookOptions = {
   readonly now?: () => Instant;
   readonly fetch?: typeof fetch;
 };
-/** The Standard Webhooks verifier's cause, or `invalid-events` for a signed body that is not a CloudEvents batch. */
+/**
+ * The Standard Webhooks verifier's cause, or `invalid-events` for a signed body
+ * that is not a CloudEvents batch.
+ */
 type WebhookFailureCause = WebhookFailureCause$1 | "invalid-events";
 type VerifiedWebhook = {
   readonly ok: true;
@@ -199,8 +226,8 @@ type VerifiedWebhook = {
  */
 export declare function parseCloudEvent(value: unknown): PermDockCloudEvent | null;
 /**
- * Verifies a PermDock Cloud webhook delivery: Standard Webhooks headers over
- * an `application/cloudevents-batch+json` body (or one
+ * Verifies a PermDock Cloud webhook delivery: Standard Webhooks headers over an
+ * `application/cloudevents-batch+json` body (or one
  * `application/cloudevents+json` event). There is no unsigned mode, and it
  * never throws.
  */
@@ -208,13 +235,19 @@ export declare function verifyWebhook(request: Request, options: WebhookOptions)
 //#endregion
 //#region src/cloud/waiter.d.ts
 type CloudApprovalWaiterOptions = WebhookOptions & ({
-  /** Read when a wait starts and every `interval` after; typically `cloud().approvals`. */
+  /**
+   * Read when a wait starts and every `interval` after; typically
+   * `cloud().approvals`.
+   */
   readonly store: ApprovalStore;
   /** Milliseconds between fallback reads of `store`. Defaults to 60000. */
   readonly interval?: number;
   readonly waiter?: undefined;
 } | {
-  /** A durable runner's waiter (`workflowSdkWaiter()`); `wait` and `wake` go to it. */
+  /**
+   * A durable runner's waiter (`workflowSdkWaiter()`); `wait` and `wake`
+   * go to it.
+   */
   readonly waiter: ApprovalWaiter;
   readonly store?: undefined;
   readonly interval?: undefined;
@@ -223,22 +256,21 @@ type CloudApprovalWaiter = ApprovalWaiter & {
   /**
    * The endpoint for the environment's webhook connector. It verifies the
    * Standard Webhooks signature and wakes the wait of every
-   * `com.permdock.approval.resolved`, `.expired` and `.cancelled` event in
-   * the batch. It answers `204` once handled or replayed, and Problem
-   * Details otherwise.
+   * `com.permdock.approval.resolved`, `.expired` and `.cancelled` event in the
+   * batch. It answers `204` once handled or replayed, and Problem Details
+   * otherwise.
    */
   readonly webhook: (request: Request) => Promise<Response>;
 };
 /** The approval token of each event that ends a wait, in delivery order. */
 export declare function approvalTokensOf(events: readonly PermDockCloudEvent[]): readonly string[];
 /**
- * An `ApprovalWaiter` that PermDock Cloud wakes. Mount `webhook` on the
- * route the environment's webhook connector posts to: when an approval is
- * resolved, expires or is cancelled, the parked run for its token wakes.
- * Waking never approves anything. The run decides again with the token, and
- * only the app's `decide` and its approval store can grant. Without
- * `waiter`, waits poll `store` as a fallback for a webhook another process
- * received.
+ * An `ApprovalWaiter` that PermDock Cloud wakes. Mount `webhook` on the route
+ * the environment's webhook connector posts to: when an approval is resolved,
+ * expires or is cancelled, the parked run for its token wakes. Waking never
+ * approves anything. The run decides again with the token, and only the app's
+ * `decide` and its approval store can grant. Without `waiter`, waits poll
+ * `store` as a fallback for a webhook another process received.
  */
 export declare function cloudApprovalWaiter(options: CloudApprovalWaiterOptions): CloudApprovalWaiter;
 //#endregion

package/dist/cloud/index.js

@@ -1,21 +1,24 @@
 import { r as isRecord, t as compact } from "../compact-CAf557ZB.js";
-import { n as freezeDeep } from "../freeze-CrU8nQeX.js";
-import { o as statusProblem } from "../problem-details-cn5X30gZ.js";
-import { h as secondsAt } from "../time-DkWjdL98.js";
-import { r as CLOUD_EVENT_TYPES } from "../sink-BEZSlMS_.js";
-import { i as parseCloudEventBatch, r as parseCloudEvent$1 } from "../catalog-fingerprint-C144oW4M.js";
-import { n as readBodyText } from "../body-text-QcXok_SI.js";
-import { c as problemResponse } from "../problem-CTviyH5L.js";
+import { n as freezeDeep } from "../freeze-jjan0lCv.js";
+import { o as statusProblem } from "../problem-details-CLDgX1KV.js";
+import { h as secondsAt } from "../time-nR1JesoH.js";
+import { r as CLOUD_EVENT_TYPES } from "../sink-D9_vh372.js";
+import { i as parseCloudEventBatch, r as parseCloudEvent$1 } from "../catalog-fingerprint-e6aCWosn.js";
+import { n as readBodyText } from "../body-text-DQhcmqdY.js";
+import { l as problemResponse } from "../problem-BVLHFK33.js";
 import { t as timeoutSignal } from "../timeout-D51niuQP.js";
-import { n as webhookVerifier } from "../standard-webhooks-DgFFD-Ga.js";
-import { c as stringField, n as discoverAuthorizationServer, r as parseToken } from "../device-BARQ8eYG.js";
-import { t as pollingApprovalWaiter } from "../waiter-BGUtGYoU.js";
-import { i as isDeliveryTarget } from "../target-Bw37TFNA.js";
+import { n as webhookVerifier } from "../standard-webhooks-D67a3nzk.js";
+import { c as stringField, n as discoverAuthorizationServer, r as parseToken } from "../device-BwbJNmb2.js";
+import { t as pollingApprovalWaiter } from "../waiter-aBLM63_f.js";
+import { i as isDeliveryTarget } from "../target-qdEAnnhU.js";
 import { t as CLOUD_BASE_URL } from "../base-url-BQbddZO5.js";
-import { a as isCompactJws, i as cloudEndpoints, n as cloud, o as resolveCloudEndpoints, r as cloudConnection, t as bearerChallenge } from "../challenge-nGWma08S.js";
-import { n as randomToken, t as pkce } from "../pkce-5h8NgMQJ.js";
+import { a as isCompactJws, i as cloudEndpoints, n as cloud, o as resolveCloudEndpoints, r as cloudConnection, t as bearerChallenge } from "../challenge-DImNcR7B.js";
+import { n as randomToken, t as pkce } from "../pkce-CnmmYqUZ.js";
 //#region src/cloud/oauth-error.ts
-/** A failed `cloudOAuth` call. `code` tells a dead token (`invalid-token`) from a missing scope (`insufficient-scope`). */
+/**
+* A failed `cloudOAuth` call. `code` tells a dead token (`invalid-token`) from
+* a missing scope (`insufficient-scope`).
+*/
 var CloudAuthError = class extends Error {
 	name = "CloudAuthError";
 	code;
@@ -43,7 +46,10 @@ const CODES = /* @__PURE__ */ new Set([
 	"unreachable",
 	"unexpected-response"
 ]);
-/** Matches by `name` and `code`, so an error from another copy of the module still maps. */
+/**
+* Matches by `name` and `code`, so an error from another copy of the module
+* still maps.
+*/
 function isCloudAuthError(value) {
 	if (!(value instanceof Error) || value.name !== "CloudAuthError") return false;
 	const code = Reflect.get(value, "code");
@@ -51,20 +57,29 @@ function isCloudAuthError(value) {
 }
 //#endregion
 //#region src/cloud/oauth.ts
-/** Milliseconds a Cloud OAuth or read request may take; a slower one fails with `unreachable`. */
+/**
+* Milliseconds a Cloud OAuth or read request may take; a slower one fails with
+* `unreachable`.
+*/
 const OAUTH_TIMEOUT_MS = 1e4;
 const DEFAULT_SCOPES = ["projects:read", "policy:read"];
 function trimSlash(value) {
 	return value.replace(/\/+$/u, "");
 }
-/** The form-urlencoding RFC 6749 section 2.3.1 applies to client_secret_basic credentials. */
+/**
+* The form-urlencoding RFC 6749 section 2.3.1 applies to client_secret_basic
+* credentials.
+*/
 function formEncode(value) {
 	return encodeURIComponent(value).replaceAll("%20", "+");
 }
 function isLoopback(hostname) {
 	return hostname === "localhost" || hostname === "127.0.0.1" || hostname === "[::1]";
 }
-/** An endpoint must be `https:`, except on a loopback issuer, which a local Cloud serves over plain HTTP. */
+/**
+* An endpoint must be `https:`, except on a loopback issuer, which a local
+* Cloud serves over plain HTTP.
+*/
 function secureEndpoint(value, issuer) {
 	try {
 		const url = new URL(value);
@@ -289,11 +304,11 @@ async function fromResponse(response) {
 }
 /**
 * A `DeliveryTransport` for `channel` that hands each checked recipient to
-* PermDock Cloud, which sends it from its hosted email, chat or webhook
-* sender and reports back through `com.permdock.delivery.*` events. The
-* router has already decided the recipient: the Cloud receives the target
-* and the permission that let it through, never a decision to make.
-* `Idempotency-Key` is the delivery's idempotency key, so a retry repeats it.
+* PermDock Cloud, which sends it from its hosted email, chat or webhook sender
+* and reports back through `com.permdock.delivery.*` events. The router has
+* already decided the recipient: the Cloud receives the target and the
+* permission that let it through, never a decision to make. `Idempotency-Key`
+* is the delivery's idempotency key, so a retry repeats it.
 */
 function cloudDeliveryTransport(channel, options = {}) {
 	const connection = cloudConnection(options);
@@ -351,8 +366,8 @@ const REGISTERED = /* @__PURE__ */ new Set([
 	"jti"
 ]);
 /**
-* The Cloud's own outputs and access tokens; a client key that could mint
-* them could forge them, or forge the approver behind `PermDock-Approver`.
+* The Cloud's own outputs and access tokens; a client key that could mint them
+* could forge them, or forge the approver behind `PermDock-Approver`.
 */
 const CLOUD_ISSUED = /* @__PURE__ */ new Set([
 	"vnd.permdock.policy+jwt",
@@ -374,11 +389,11 @@ function headerTyp(token) {
 /**
 * A `TokenSigner` backed by the environment's PermDock Cloud keys, typically
 * KMS-held, for run tickets (`vnd.permdock.run+jwt`) and every other signed
-* output an app issues. The Cloud signs only what the app sends: it sets
-* `iss` to the environment URL and adds no claim. Policy documents,
-* snapshots, evidence exports, Security Event Tokens and `at+jwt` access tokens are the Cloud's own
-* outputs, so their `typ` values are refused here. Verify what it signs with
-* `joseTokenVerifier({ jwks: cloudEndpoints().jwks })`.
+* output an app issues. The Cloud signs only what the app sends: it sets `iss`
+* to the environment URL and adds no claim. Policy documents, snapshots,
+* evidence exports, Security Event Tokens and `at+jwt` access tokens are the
+* Cloud's own outputs, so their `typ` values are refused here. Verify what it
+* signs with `joseTokenVerifier({ jwks: cloudEndpoints().jwks })`.
 */
 function cloudSigner(options = {}) {
 	const connection = cloudConnection(options);
@@ -454,8 +469,8 @@ function eventsOf(body) {
 	return parseCloudEventBatch(parsed);
 }
 /**
-* Verifies a PermDock Cloud webhook delivery: Standard Webhooks headers over
-* an `application/cloudevents-batch+json` body (or one
+* Verifies a PermDock Cloud webhook delivery: Standard Webhooks headers over an
+* `application/cloudevents-batch+json` body (or one
 * `application/cloudevents+json` event). There is no unsigned mode, and it
 * never throws.
 */
@@ -512,13 +527,12 @@ function refusal(cause) {
 	}
 }
 /**
-* An `ApprovalWaiter` that PermDock Cloud wakes. Mount `webhook` on the
-* route the environment's webhook connector posts to: when an approval is
-* resolved, expires or is cancelled, the parked run for its token wakes.
-* Waking never approves anything. The run decides again with the token, and
-* only the app's `decide` and its approval store can grant. Without
-* `waiter`, waits poll `store` as a fallback for a webhook another process
-* received.
+* An `ApprovalWaiter` that PermDock Cloud wakes. Mount `webhook` on the route
+* the environment's webhook connector posts to: when an approval is resolved,
+* expires or is cancelled, the parked run for its token wakes. Waking never
+* approves anything. The run decides again with the token, and only the app's
+* `decide` and its approval store can grant. Without `waiter`, waits poll
+* `store` as a fallback for a webhook another process received.
 */
 function cloudApprovalWaiter(options) {
 	const inner = options.waiter ?? pollingApprovalWaiter({

package/dist/{cloud-CO8pYtwr.js → cloud-BFlGMaak.js}

@@ -1,6 +1,6 @@
-import { n as secretInput } from "./credentials-BpuTwd7a.js";
+import { n as secretInput } from "./credentials-CdDxp7jN.js";
 import { t as defineLeaf } from "./command-L8EstFNm.js";
-import { c as given, i as dryRunFlag } from "./flags-aaeRAdiD.js";
+import { c as given, i as dryRunFlag } from "./flags-DXjoTVbS.js";
 //#region src/cli/commands/cloud.ts
 const sharedFlags = {
 	url: {
@@ -41,7 +41,7 @@ const push = defineLeaf({
 	},
 	async run(ctx, { flags }) {
 		const env = await withStdinSecret(ctx, "key", flags["key-stdin"], "PERMDOCK_CLOUD_KEY");
-		return (await import("./push-tVdG8dUL.js")).runCloud({
+		return (await import("./push-DgssgzkK.js")).runCloud({
 			cwd: ctx.cwd,
 			config: ctx.config,
 			url: given(flags.url),
@@ -70,8 +70,7 @@ const pull = defineLeaf({
 	},
 	async run(ctx, { flags }) {
 		const env = await withStdinSecret(ctx, "token", flags["token-stdin"], "PERMDOCK_CLOUD_TOKEN");
-		const { runCloudPull } = await import("./pull-Cty6Ovyu.js");
-		return runCloudPull({
+		return (await import("./pull-B65ndFNZ.js")).runCloudPull({
 			cwd: ctx.cwd,
 			config: ctx.config,
 			url: given(flags.url),

package/dist/{codemod-i4N2BhDc.js → codemod-DLQ9Zpo4.js}

@@ -1,5 +1,5 @@
 import { t as defineLeaf } from "./command-L8EstFNm.js";
-import { i as dryRunFlag } from "./flags-aaeRAdiD.js";
+import { i as dryRunFlag } from "./flags-DXjoTVbS.js";
 //#region src/cli/commands/codemod.ts
 const codemod = defineLeaf({
 	positionals: [{
@@ -7,7 +7,7 @@ const codemod = defineLeaf({
 		description: "The release to migrate to (0.5)",
 		required: true,
 		async complete() {
-			return (await import("./codemod-BP6n8N9L.js")).codemodVersions();
+			return (await import("./codemod-DWSN2erG.js")).codemodVersions();
 		}
 	}, {
 		name: "paths",
@@ -22,8 +22,7 @@ const codemod = defineLeaf({
 		}
 	},
 	async run(ctx, { flags, args, rest }) {
-		const { runCodemod } = await import("./codemod-BP6n8N9L.js");
-		return runCodemod({
+		return (await import("./codemod-DWSN2erG.js")).runCodemod({
 			cwd: ctx.cwd,
 			version: args["version"],
 			paths: rest,