permdock 0.7.0 → 0.9.0

package/dist/{credential-CIM7wHwA.js → credential-CyyyvCsL.js}

@@ -1,17 +1,21 @@
 import { n as isReadonlyArray, t as compact } from "./compact-CAf557ZB.js";
-import { n as freezeDeep } from "./freeze-CrU8nQeX.js";
-import { a as ownRecord } from "./paths-DXSHAMIa.js";
-import { a as isId, r as idList } from "./expiry-D4_YKRKD.js";
-import { n as internalsOf } from "./internals-Dk8A8fX3.js";
-import { c as listPermissions, h as formerKeys } from "./permission-registry-DpPtSKNZ.js";
-import { g as secondsOf, l as isRfc3339, m as rfc3339, p as nowSeconds } from "./time-DkWjdL98.js";
+import { n as freezeDeep } from "./freeze-jjan0lCv.js";
+import { a as ownRecord } from "./paths-CUvURzHp.js";
+import { a as isId, r as idList } from "./expiry-6XByK0dm.js";
+import { n as internalsOf } from "./internals-B3IgHrvo.js";
+import { c as listPermissions, h as formerKeys } from "./permission-registry-B8tYxPIt.js";
+import { g as secondsOf, l as isRfc3339, m as rfc3339, p as nowSeconds } from "./time-nR1JesoH.js";
 import { t as canonicalJson } from "./canonical-json-DwilZ1iB.js";
-import { r as sha256Digest } from "./sha256-D9ihqmvd.js";
-import { n as coveredByDelegation } from "./delegation-C5rOdTp5.js";
-import { o as flattenGrantee } from "./grantee-BrRANrpT.js";
+import { r as sha256Digest } from "./sha256-C-4WXKIu.js";
+import { n as coveredByDelegation } from "./delegation-CDB6_keF.js";
+import { o as flattenGrantee } from "./grantee-Dke-9rd1.js";
 import { t as anonymousSubject } from "./subject-BGoM5o8B.js";
 //#region src/core/credential.ts
-/** A feed id: lowercase, so a mail system that lowercases a local part still matches. At most 16 characters, so `pdfeed_<id>_<secret>` fits an email local part. */
+/**
+* A feed id: lowercase, so a mail system that lowercases a local part still
+* matches. At most 16 characters, so `pdfeed_<id>_<secret>` fits an email local
+* part.
+*/
 function isFeedId(value) {
 	return /^[a-z0-9-]{1,16}$/u.test(value);
 }
@@ -53,10 +57,10 @@ function parsePermissions(value) {
 	return out;
 }
 /**
-* Validates an untrusted credential record and returns a frozen copy with
-* only the v1 fields, or `undefined`. Unknown fields are dropped; a wrong
-* type in a known field, a service credential without `tenant` and `roles`,
-* or a user credential with `roles`, rejects the whole record.
+* Validates an untrusted credential record and returns a frozen copy with only
+* the v1 fields, or `undefined`. Unknown fields are dropped; a wrong type in a
+* known field, a service credential without `tenant` and `roles`, or a user
+* credential with `roles`, rejects the whole record.
 */
 function parseCredential(input) {
 	const value = ownRecord(input);
@@ -111,9 +115,9 @@ function leafByKey(tree) {
 }
 /**
 * The delegation a credential narrows its principal to: OAuth scopes for
-* permissions on every instance, one RFC 9396 entry per id otherwise. A key
-* the definitions no longer declare is dropped, so a credential whose every
-* key is gone delegates nothing and every check is denied.
+* permissions on every instance, one RFC 9396 entry per id otherwise. A key the
+* definitions no longer declare is dropped, so a credential whose every key is
+* gone delegates nothing and every check is denied.
 */
 function credentialDelegation(credential, permissions) {
 	const leaves = leafByKey(permissions);
@@ -138,14 +142,14 @@ function credentialDelegation(credential, permissions) {
 	});
 }
 /**
-* The subject a verified credential acts as. A `user` credential is its
-* owner, passed live as `owner` (roles and memberships as of this request),
-* with the credential's delegation: every check is the owner's rights
-* intersected with the key's. One that names a `tenant` makes it the active
-* tenant, and `getPermDock` then keeps only the owner's memberships
-* inside it and no global role. A `service` credential is a `service`
-* principal whose only membership is `roles` in `tenant`. An owner whose id
-* is not the credential's `principal`, or who is not a user, is anonymous.
+* The subject a verified credential acts as. A `user` credential is its owner,
+* passed live as `owner` (roles and memberships as of this request), with the
+* credential's delegation: every check is the owner's rights intersected with
+* the key's. One that names a `tenant` makes it the active tenant, and
+* `getPermDock` then keeps only the owner's memberships inside it and no global
+* role. A `service` credential is a `service` principal whose only membership
+* is `roles` in `tenant`. An owner whose id is not the credential's
+* `principal`, or who is not a user, is anonymous.
 */
 function credentialSubject(credential, options) {
 	const delegation = credentialDelegation(credential, options.permissions);
@@ -361,25 +365,24 @@ function credentialTenant(credential, active) {
 }
 /**
 * Decides whether the subject of `permdock` may create the credential in
-* `request`. The creator must be a signed-in user or service that is not
-* itself a link or a credential; a delegated creator hands out only what its
-* delegation covers. A key's tenant must be one the creator is a member of;
-* a service key's roles among the creator's `assignableRoles` there and its
+* `request`. The creator must be a signed-in user or service that is not itself
+* a link or a credential; a delegated creator hands out only what its
+* delegation covers. A key's tenant must be one the creator is a member of; a
+* service key's roles among the creator's `assignableRoles` there and its
 * permissions within `assignablePermissions` there (`exceeds-creator`). The
-* `credentials` policy of the key's tenant (its own, or for a user key
-* without one the creator's active tenant) then applies (`credential-policy`; a
+* `credentials` policy of the key's tenant (its own, or for a user key without
+* one the creator's active tenant) then applies (`credential-policy`; a
 * settings source that throws denies with `rule: 'unavailable'`), and
-* `approval` makes the result `approval-required` until `approved` carries
-* its token. PermDock never stores the credential; the application does,
-* after a `granted` result.
+* `approval` makes the result `approval-required` until `approved` carries its
+* token. PermDock never stores the credential; the application does, after a
+* `granted` result.
 */
 /**
 * Decides whether the subject of `permdock` may create the credential in
 * `request`: the creator's own reach, the `credentials` policy of the key's
-* tenant (the call's `settings`, else the instance's), and `approval`.
-* PermDock never stores the credential; the application does, after a
-* `granted` result. An instance built from a snapshot denies with
-* `unsupported`.
+* tenant (the call's `settings`, else the instance's), and `approval`. PermDock
+* never stores the credential; the application does, after a `granted` result.
+* An instance built from a snapshot denies with `unsupported`.
 */
 function decideCredential(permdock, request, options = {}) {
 	const internals = internalsOf(permdock);

package/dist/{credentials-BpuTwd7a.js → credentials-CdDxp7jN.js}

@@ -1,4 +1,4 @@
-import { n as CliError } from "./errors-DpP_U6Bf.js";
+import { n as CliError } from "./errors-Vpu6rKHl.js";
 //#region src/cli/core/io.ts
 const FRAMES = [
 	"⠋",
@@ -14,8 +14,8 @@ const FRAMES = [
 ];
 const FRAME_MS = 80;
 /**
-* A spinner on a terminal stderr; a plain line elsewhere, so logs and CI
-* output stay readable. `done` replaces the spinner with a final line.
+* A spinner on a terminal stderr; a plain line elsewhere, so logs and CI output
+* stay readable. `done` replaces the spinner with a final line.
 */
 function progressReporter(input) {
 	return (message) => {
@@ -50,13 +50,13 @@ async function readSecret(readStdin) {
 const URL_PASSWORD = /\b([a-z][a-z0-9+.-]*:\/\/[^\s:/@]+:)([^\s@/]+)@/giu;
 /** `text` with every registered secret and every URL password masked. */
 function redact(text, secrets) {
-	let out = text.replace(URL_PASSWORD, "$1***@");
+	let out = text.replaceAll(URL_PASSWORD, "$1***@");
 	for (const secret of secrets) if (secret.length >= 4) out = out.replaceAll(secret, "***");
 	return out;
 }
 /**
-* The secret piped in for `--<flag>-stdin`, when it was passed, registered
-* for redaction.
+* The secret piped in for `--<flag>-stdin`, when it was passed, registered for
+* redaction.
 */
 async function secretInput(ctx, input) {
 	let value;

package/dist/{deciding-columns-DRo2QM6E.js → deciding-columns-NB4wcyBf.js}

@@ -87,8 +87,8 @@ function tableKey(name) {
 * membership (user, scope, id, `within`, role, `via`, expiry), and the id and
 * value columns of a table a role or user column references, keyed by
 * {@link tableKey}. A client that can write one can give itself a membership.
-* The hook's sources count even when `rls.membershipSources` replaces them
-* for the helpers: the token's claims still come from them.
+* The hook's sources count even when `rls.membershipSources` replaces them for
+* the helpers: the token's claims still come from them.
 */
 function membershipColumns(config) {
 	const sources = /* @__PURE__ */ new Set([...membershipSourcesOf(config), ...config.supabase?.hook?.memberships ?? []]);

package/dist/{delegation-C5rOdTp5.js → delegation-CDB6_keF.js}

@@ -1,14 +1,14 @@
 import { n as isReadonlyArray } from "./compact-CAf557ZB.js";
-import { r as ownGet } from "./paths-DXSHAMIa.js";
-import { a as resolveConditionRef, c as isConditionDate, d as parentHop, l as isConditionRef } from "./refs-CNJBiTFo.js";
-import { o as sameId, t as expiredAt } from "./expiry-D4_YKRKD.js";
-import { g as formerScopes, m as annotationsFor, n as findPermission } from "./permission-registry-DpPtSKNZ.js";
-import { o as epochSeconds } from "./time-DkWjdL98.js";
-import { f as scopeList, h as tenantOf, m as subjectMemberships, s as resolveScope } from "./scopes-BHsc-wp-.js";
-import { t as isoInstant } from "./instant-BluqDvyS.js";
-import { o as flattenGrantee } from "./grantee-BrRANrpT.js";
-import { t as isActive } from "./validity-CZ7-y0Cj.js";
-import { n as matchGrantee } from "./grantee-match-0RtHWQDx.js";
+import { r as ownGet } from "./paths-CUvURzHp.js";
+import { a as resolveConditionRef, c as isConditionDate, d as parentHop, l as isConditionRef } from "./refs-C8BKxc_e.js";
+import { o as sameId, t as expiredAt } from "./expiry-6XByK0dm.js";
+import { g as formerScopes, m as annotationsFor, n as findPermission } from "./permission-registry-B8tYxPIt.js";
+import { o as epochSeconds } from "./time-nR1JesoH.js";
+import { f as scopeList, h as tenantOf, m as subjectMemberships, s as resolveScope } from "./scopes-0Up_UA2t.js";
+import { t as isoInstant } from "./instant-DK3Iz83e.js";
+import { o as flattenGrantee } from "./grantee-Dke-9rd1.js";
+import { t as isActive } from "./validity-Buc7w8E9.js";
+import { n as matchGrantee } from "./grantee-match-7RZZvoT_.js";
 //#region src/conditions/evaluate.ts
 function resolveRef(ref, subject) {
 	return resolveConditionRef(ref, subject);
@@ -145,9 +145,9 @@ function isRowPair(value) {
 	return value !== null && typeof value === "object" && "current" in value && "next" in value;
 }
 /**
-* The row a `where` reads and the row a `check` reads. An instance check
-* takes a `{ current, next }` pair or one row for both; a collection check
-* has no current row, only the input it creates.
+* The row a `where` reads and the row a `check` reads. An instance check takes
+* a `{ current, next }` pair or one row for both; a collection check has no
+* current row, only the input it creates.
 */
 function rowValues(permission, data) {
 	if (permission.kind === "collection") return {
@@ -163,7 +163,10 @@ function rowValues(permission, data) {
 		next: data
 	};
 }
-/** The row's id under `field` as a string, or `*` when the row has no string or number there. */
+/**
+* The row's id under `field` as a string, or `*` when the row has no string or
+* number there.
+*/
 function rowIdOf(row, field = "id") {
 	if (row === null || typeof row !== "object" || !Object.hasOwn(row, field)) return "*";
 	const id = Reflect.get(row, field);
@@ -171,14 +174,17 @@ function rowIdOf(row, field = "id") {
 }
 //#endregion
 //#region src/core/delegation.ts
-/** The permission's scope and any scope it was renamed from: tokens issued before a rename keep working. */
+/**
+* The permission's scope and any scope it was renamed from: tokens issued
+* before a rename keep working.
+*/
 function scopeNames(permission) {
 	return [permission.scope, ...formerScopes(permission)];
 }
 /**
 * Whether a delegated caller may use a permission its principal holds, through
-* OAuth `scopes`, RFC 9396 `authorizationDetails` or GNAP `access`.
-* `undefined` means covered; otherwise the denial reason `decide` would add.
+* OAuth `scopes`, RFC 9396 `authorizationDetails` or GNAP `access`. `undefined`
+* means covered; otherwise the denial reason `decide` would add.
 */
 function coveredByDelegation(permission, delegation, resourceId, hasActor = false) {
 	const unscoped = hasActor ? "no-delegation" : void 0;
@@ -206,7 +212,10 @@ function coveredByDelegation(permission, delegation, resourceId, hasActor = fals
 	if (scopeOk || detailOk || accessOk) return;
 	return "not-delegated";
 }
-/** A `readOnly` actor never uses a permission without `readOnlyHint`, delegated or not. */
+/**
+* A `readOnly` actor never uses a permission without `readOnlyHint`, delegated
+* or not.
+*/
 function readOnlyActorRefuses(actor, permission) {
 	return actor?.readOnly === true && !annotationsFor(permission).readOnlyHint;
 }
@@ -266,10 +275,10 @@ function handsOver(delegation, subject, heldRoles, now) {
 /**
 * The permission keys the policy's delegations let `subject.actor` use for
 * `subject.principal` right now: the union over every active delegation whose
-* `to` matches the actor and whose `from` the principal holds. `undefined`
-* when none applies, so the call falls back to the token delegation alone.
-* An actor with `readOnly: true` gets only each delegation's read-only keys.
-* Attenuation only: a key here still needs a matching allow and no deny.
+* `to` matches the actor and whose `from` the principal holds. `undefined` when
+* none applies, so the call falls back to the token delegation alone. An actor
+* with `readOnly: true` gets only each delegation's read-only keys. Attenuation
+* only: a key here still needs a matching allow and no deny.
 */
 function delegatedPermissions(delegations, subject, heldRoles, now) {
 	const actor = subject.actor;

package/dist/delivery/index.d.ts

@@ -1,5 +1,5 @@
-import { an as EmailCategory, rn as DeliveryFailureCause, tn as DeliveryChannel } from "../policy-types-B-F-qAZk.js";
-import { i as approvalUrlFor, n as ApprovalUrl, r as approvalPrompt, t as ApprovalPrompt } from "../approval-prompt-K0faOLFp.js";
-import { _ as TransportOptions, a as DeliveryReport, c as DeliveryTransport, d as EmailTransport, f as EmailUnsubscribe, g as TransportMessages, h as TransportItem, i as DeliveryMessages, l as DeliveryTransports, m as Recipient, n as ChatTransport, o as DeliveryResult, p as OutgoingEmail, r as DeliverOptions, s as DeliveryTarget, t as ChatMessage, u as EmailMessage, v as WebhookMessage, y as WebhookTransport } from "../types-g7Oy6Zg4.js";
-import { C as audience, S as SubscriberEvent, _ as ParseConnectorResult, a as DeliveryPermDock, b as Audience, c as MemoryDelivery, d as memoryDeliveryTransport, f as CONNECTOR_SCHEMA, g as ConnectorKind, h as ConnectorIssue, i as isDeliveryTarget, l as MemoryDeliveryTransport, m as Connector, n as webhookTransport, o as DeliveryPermDockOptions, p as CONNECTOR_KINDS, r as isAddrSpec, s as createPermDock, t as WebhookTransportOptions, u as MemoryDeliveryTransportOptions, v as SiemDestination, w as subscribersFor, x as AudienceOptions, y as parseConnector } from "../index-DLwcuCN_.js";
+import { dn as EmailCategory, ln as DeliveryFailureCause, sn as DeliveryChannel } from "../policy-types-DGIO_gxq.js";
+import { i as approvalUrlFor, n as ApprovalUrl, r as approvalPrompt, t as ApprovalPrompt } from "../approval-prompt-3BqWczTt.js";
+import { _ as TransportOptions, a as DeliveryReport, c as DeliveryTransport, d as EmailTransport, f as EmailUnsubscribe, g as TransportMessages, h as TransportItem, i as DeliveryMessages, l as DeliveryTransports, m as Recipient, n as ChatTransport, o as DeliveryResult, p as OutgoingEmail, r as DeliverOptions, s as DeliveryTarget, t as ChatMessage, u as EmailMessage, v as WebhookMessage, y as WebhookTransport } from "../types-CN0LsqbK.js";
+import { C as audience, S as SubscriberEvent, _ as ParseConnectorResult, a as DeliveryPermDock, b as Audience, c as MemoryDelivery, d as memoryDeliveryTransport, f as CONNECTOR_SCHEMA, g as ConnectorKind, h as ConnectorIssue, i as isDeliveryTarget, l as MemoryDeliveryTransport, m as Connector, n as webhookTransport, o as DeliveryPermDockOptions, p as CONNECTOR_KINDS, r as isAddrSpec, s as createPermDock, t as WebhookTransportOptions, u as MemoryDeliveryTransportOptions, v as SiemDestination, w as subscribersFor, x as AudienceOptions, y as parseConnector } from "../index-ymept53A.js";
 export { type ApprovalPrompt, type ApprovalUrl, type Audience, type AudienceOptions, CONNECTOR_KINDS, CONNECTOR_SCHEMA, type ChatMessage, type ChatTransport, type Connector, type ConnectorIssue, type ConnectorKind, type DeliverOptions, type DeliveryChannel, type DeliveryFailureCause, type DeliveryMessages, type DeliveryPermDock, type DeliveryPermDockOptions, type DeliveryReport, type DeliveryResult, type DeliveryTarget, type DeliveryTransport, type DeliveryTransports, type EmailCategory, type EmailMessage, type EmailTransport, type EmailUnsubscribe, type MemoryDelivery, type MemoryDeliveryTransport, type MemoryDeliveryTransportOptions, type OutgoingEmail, type ParseConnectorResult, type Recipient, type SiemDestination, type SubscriberEvent, type TransportItem, type TransportMessages, type TransportOptions, type WebhookMessage, type WebhookTransport, type WebhookTransportOptions, approvalPrompt, approvalUrlFor, audience, createPermDock, isAddrSpec, isDeliveryTarget, memoryDeliveryTransport, parseConnector, subscribersFor, webhookTransport };

package/dist/delivery/index.js

@@ -1,6 +1,6 @@
-import { n as approvalUrlFor, t as approvalPrompt } from "../approval-prompt-Dg5LeAcT.js";
-import { n as subscribersFor, t as audience } from "../audience-BrMs8c4o.js";
-import { t as CONNECTOR_SCHEMA } from "../connector-schema-_VCSsdtD.js";
-import { a as parseConnector, i as CONNECTOR_KINDS, n as createPermDock, r as memoryDeliveryTransport, t as webhookTransport } from "../delivery-rwOKLWRm.js";
-import { i as isDeliveryTarget, n as isAddrSpec } from "../target-Bw37TFNA.js";
+import { n as approvalUrlFor, t as approvalPrompt } from "../approval-prompt-B8hQY69x.js";
+import { n as subscribersFor, t as audience } from "../audience-DTjR8xet.js";
+import { t as CONNECTOR_SCHEMA } from "../connector-schema-CYLQNMYq.js";
+import { a as parseConnector, i as CONNECTOR_KINDS, n as createPermDock, r as memoryDeliveryTransport, t as webhookTransport } from "../delivery-BupfvJIV.js";
+import { i as isDeliveryTarget, n as isAddrSpec } from "../target-qdEAnnhU.js";
 export { CONNECTOR_KINDS, CONNECTOR_SCHEMA, approvalPrompt, approvalUrlFor, audience, createPermDock, isAddrSpec, isDeliveryTarget, memoryDeliveryTransport, parseConnector, subscribersFor, webhookTransport };

package/dist/{delivery-rwOKLWRm.js → delivery-BupfvJIV.js}

@@ -1,12 +1,12 @@
 import { r as isRecord, t as compact } from "./compact-CAf557ZB.js";
-import { n as freezeDeep } from "./freeze-CrU8nQeX.js";
-import { a as ownRecord } from "./paths-DXSHAMIa.js";
-import { n as loadPrincipalByIdentity } from "./principal-source-pHneukrx.js";
-import { t as deliveryEvent } from "./delivery-event-xX4obB8F.js";
-import { n as CLOUDEVENTS_CONTENT_TYPE } from "./sink-BEZSlMS_.js";
-import { n as copyJson, r as forbiddenKeyPath, t as checkSchema } from "./json-schema-B-vAwlde.js";
-import { t as CONNECTOR_SCHEMA } from "./connector-schema-_VCSsdtD.js";
-import { a as isWebhookAddress, i as isDeliveryTarget, n as isAddrSpec, r as isChatAddress, t as idempotencyKeyFor } from "./target-Bw37TFNA.js";
+import { n as freezeDeep } from "./freeze-jjan0lCv.js";
+import { a as ownRecord } from "./paths-CUvURzHp.js";
+import { n as loadPrincipalByIdentity } from "./principal-source-C6N60GtM.js";
+import { t as deliveryEvent } from "./delivery-event-JioK5YbS.js";
+import { n as CLOUDEVENTS_CONTENT_TYPE } from "./sink-D9_vh372.js";
+import { n as copyJson, r as forbiddenKeyPath, t as checkSchema } from "./json-schema-BPGa-RjQ.js";
+import { t as CONNECTOR_SCHEMA } from "./connector-schema-CYLQNMYq.js";
+import { a as isWebhookAddress, i as isDeliveryTarget, n as isAddrSpec, r as isChatAddress, t as idempotencyKeyFor } from "./target-qdEAnnhU.js";
 //#region src/delivery/connector.ts
 const BRANCHES = new Map((CONNECTOR_SCHEMA.oneOf ?? []).map((branch) => [branch.properties?.["kind"]?.const, branch]));
 /** The kinds `connector-v1` lists, in schema order. */
@@ -25,8 +25,8 @@ function fail$1(issues) {
 }
 /**
 * Checks `input` against `connector-v1.json` and answers a frozen copy, or
-* every issue with a JSON pointer. The branch is chosen by `kind`, so an
-* issue names the field rather than "no branch matched".
+* every issue with a JSON pointer. The branch is chosen by `kind`, so an issue
+* names the field rather than "no branch matched".
 */
 function parseConnector(input) {
 	const issues = [];
@@ -55,7 +55,10 @@ function parseConnector(input) {
 }
 //#endregion
 //#region src/delivery/memory-transport.ts
-/** An in-process transport for tests and examples: it records what it would have sent. */
+/**
+* An in-process transport for tests and examples: it records what it would have
+* sent.
+*/
 function memoryDeliveryTransport(channel, options = {}) {
 	const deliveries = [];
 	return Object.freeze({
@@ -89,7 +92,10 @@ const ROUTER_FIELDS = /* @__PURE__ */ new Set([
 	"list-unsubscribe",
 	"list-unsubscribe-post"
 ]);
-/** Fields that would add recipients or rewrite the envelope past the recipient check. */
+/**
+* Fields that would add recipients or rewrite the envelope past the recipient
+* check.
+*/
 const ENVELOPE_FIELDS = /* @__PURE__ */ new Set([
 	"to",
 	"cc",
@@ -143,8 +149,8 @@ function unsubscribeHeaders(unsubscribe) {
 /**
 * The email a transport sends to `target`: `from` resolved, the caller's
 * headers checked, `Auto-Submitted: auto-generated` (RFC 3834) on every
-* message, and the RFC 2369 / RFC 8058 unsubscribe pair on `notification`
-* only. A message that cannot be sent as given returns the reason.
+* message, and the RFC 2369 / RFC 8058 unsubscribe pair on `notification` only.
+* A message that cannot be sent as given returns the reason.
 */
 function outgoingEmail(message, target, defaultFrom) {
 	const from = message.from ?? defaultFrom;
@@ -188,7 +194,10 @@ function optionalString(value) {
 	if (value === void 0) return;
 	return typeof value === "string" && value !== "" ? value : null;
 }
-/** The recipient in the form its channel compares, or `null` when it is malformed. */
+/**
+* The recipient in the form its channel compares, or `null` when it is
+* malformed.
+*/
 function checkRecipient(value) {
 	const record = ownRecord(value);
 	const channel = record?.["channel"];
@@ -281,9 +290,9 @@ async function sendBatch(transport, batch) {
 	}));
 }
 /**
-* Sends every ready item: one batch call per `batchSize` items for a
-* transport with `deliverBatch`, one `deliver` call each otherwise. Events
-* keep recipient order.
+* Sends every ready item: one batch call per `batchSize` items for a transport
+* with `deliverBatch`, one `deliver` call each otherwise. Events keep recipient
+* order.
 */
 async function send(prepared) {
 	const events = prepared.map((entry) => "transport" in entry ? void 0 : entry);
@@ -310,7 +319,10 @@ async function send(prepared) {
 	}));
 	return events;
 }
-/** Routes checked recipients to channel transports and records a delivery event for each. */
+/**
+* Routes checked recipients to channel transports and records a delivery event
+* for each.
+*/
 function createPermDock(_policy, options) {
 	const source = options.source ?? "permdock";
 	const decideRecipient = async (permdock, checked, permission, row) => {
@@ -497,9 +509,9 @@ function fromStatus(status) {
 }
 /**
 * Posts each CloudEvent to the target's https endpoint as
-* `application/cloudevents+json`, signed with the Standard Webhooks
-* headers. `webhook-id` is the idempotency key, so a retry repeats it and
-* the receiver drops the duplicate. Redirects are not followed.
+* `application/cloudevents+json`, signed with the Standard Webhooks headers.
+* `webhook-id` is the idempotency key, so a retry repeats it and the receiver
+* drops the duplicate. Redirects are not followed.
 */
 function webhookTransport(signer, options = {}) {
 	const timeout = options.timeout ?? 1e4;

package/dist/{delivery-event-xX4obB8F.js → delivery-event-JioK5YbS.js}

@@ -1,12 +1,12 @@
 import { t as compact } from "./compact-CAf557ZB.js";
-import { t as assertAppData } from "./app-data-MuyzVqX8.js";
-import { d as isoNow } from "./time-DkWjdL98.js";
-import { n as requireEventInstant } from "./event-time-CsegxXxB.js";
+import { t as assertAppData } from "./app-data-UNNm07jV.js";
+import { d as isoNow } from "./time-nR1JesoH.js";
+import { n as requireEventInstant } from "./event-time-BGy48400.js";
 //#region src/core/delivery-event.ts
 /**
-* A `delivery` sink event. Throws a `TypeError` when `cause` or `retryable`
-* is set on an operation other than `failed`, and a `RangeError` for a
-* malformed `at`.
+* A `delivery` sink event. Throws a `TypeError` when `cause` or `retryable` is
+* set on an operation other than `failed`, and a `RangeError` for a malformed
+* `at`.
 */
 function checkedX(x) {
 	assertAppData(x, "x of a delivery event");

package/dist/denied-text-DHldhVUv.d.ts

@@ -0,0 +1,22 @@
+import { Un as Decision } from "./policy-types-DGIO_gxq.js";
+import { u as Permission } from "./permission-types-CAY-GU7e.js";
+//#region src/agent/denied-text.d.ts
+/**
+ * What an agent adapter's `deniedText` receives: the refusal and the text
+ * PermDock wrote for it.
+ */
+type DeniedTextEvent = {
+  readonly decision: Exclude<Decision, {
+    readonly outcome: "granted";
+  }> | null;
+  readonly permission: Permission | undefined;
+  readonly text: string;
+};
+/**
+ * Replaces the human-readable text of a refusal, and nothing else: the outcome,
+ * `isError`, the structured content and the approval token stay. `undefined`
+ * keeps PermDock's text.
+ */
+type DeniedText = (event: DeniedTextEvent) => string | undefined;
+//#endregion
+export { DeniedTextEvent as n, DeniedText as t };

package/dist/{describe-DZlnEtLy.js → describe-Bb4hGK5d.js}

@@ -1,5 +1,5 @@
-import { i as flattenApprovers } from "./approvers-CqPOLD-o.js";
-import { r as requiredPlans } from "./problem-details-cn5X30gZ.js";
+import { i as flattenApprovers } from "./approvers-B4r0N_Uz.js";
+import { r as requiredPlans } from "./problem-details-CLDgX1KV.js";
 //#region src/core/describe.ts
 const TENANT_REASONS = /* @__PURE__ */ new Set([
 	"tenant-mismatch",
@@ -31,7 +31,7 @@ function labelGrantee(grantee) {
 		default: return grantee;
 	}
 }
-const TITLES = {
+const DESCRIBE_TITLES = {
 	granted: "Granted",
 	denied: "Denied",
 	approval: "Approval required",
@@ -57,7 +57,7 @@ function approvalDetail(permission, labels) {
 function describe(decision, options) {
 	const messages = options?.messages;
 	const labelOf = (key) => options?.permission?.key === key ? options.permission.meta?.title ?? key : key;
-	const titleOf = (kind) => messages?.titles?.[kind] ?? TITLES[kind];
+	const titleOf = (kind) => messages?.titles?.[kind] ?? DESCRIBE_TITLES[kind];
 	if (decision.outcome === "granted") {
 		const permission = labelOf(decision.matched.permission);
 		return {
@@ -97,4 +97,4 @@ function describe(decision, options) {
 	};
 }
 //#endregion
-export { describe as t };
+export { describe as n, DESCRIBE_TITLES as t };

package/dist/{describe-O0SwYIK8.d.ts → describe-BbFPBSms.d.ts}

@@ -1,5 +1,5 @@
-import { Bn as DenialReason, Ln as Decision, Vn as DeniedDecision } from "./policy-types-B-F-qAZk.js";
-import { u as Permission } from "./permission-types-DhNEmoRG.js";
+import { Kn as DenialReason, Un as Decision, qn as DeniedDecision } from "./policy-types-DGIO_gxq.js";
+import { u as Permission } from "./permission-types-CAY-GU7e.js";
 //#region src/core/describe.d.ts
 type DecisionDescription = {
   readonly kind: "granted" | "denied" | "approval" | "tenant" | "delegation" | "server-only" | "upgrade";
@@ -16,9 +16,9 @@ type DecisionDescription = {
 type DescribeMessages = {
   readonly titles?: Partial<Record<DecisionDescription["kind"], string>>;
   /**
-   * Text per denial reason; a denied detail joins the texts of its reasons
-   * with `separator`. The function form also sees the decision; `undefined`
-   * keeps the reason code, as a missing record entry does.
+   * Text per denial reason; a denied detail joins the texts of its reasons with
+   * `separator`. The function form also sees the decision; `undefined` keeps
+   * the reason code, as a missing record entry does.
    */
   readonly reasons?: Partial<Record<DenialReason, string>> | ((reason: DenialReason, decision: DeniedDecision) => string | undefined);
   /** Joins denial reason texts. Default `', '`. */

package/dist/{device-BARQ8eYG.js → device-BwbJNmb2.js}

@@ -1,6 +1,6 @@
 import { r as isRecord, t as compact } from "./compact-CAf557ZB.js";
-import { h as secondsAt } from "./time-DkWjdL98.js";
-import { n as readBodyText } from "./body-text-QcXok_SI.js";
+import { h as secondsAt } from "./time-nR1JesoH.js";
+import { n as readBodyText } from "./body-text-DQhcmqdY.js";
 import { t as timeoutSignal } from "./timeout-D51niuQP.js";
 //#region src/terminal/device.ts
 /** Milliseconds an authorization server request may take. */
@@ -15,7 +15,10 @@ async function readJson(response) {
 		return null;
 	}
 }
-/** POSTs a form and reads a JSON object back; any network or parse failure is `null`. */
+/**
+* POSTs a form and reads a JSON object back; any network or parse failure is
+* `null`.
+*/
 async function postForm(runtime, url, fields) {
 	const fetchImpl = runtime.fetch ?? fetch;
 	try {
@@ -33,9 +36,9 @@ function withoutTrailingSlash(url) {
 	return url.replace(/\/+$/u, "");
 }
 /**
-* Where RFC 8414 metadata may live: the well-known segment inserted before
-* the issuer's path (section 3.1), then appended after it for servers that
-* predate the rule. An issuer without a path has one location.
+* Where RFC 8414 metadata may live: the well-known segment inserted before the
+* issuer's path (section 3.1), then appended after it for servers that predate
+* the rule. An issuer without a path has one location.
 */
 function metadataUrls(issuer) {
 	const parsed = new URL(issuer);
@@ -44,8 +47,8 @@ function metadataUrls(issuer) {
 	return path === "" ? [inserted] : [inserted, `${withoutTrailingSlash(issuer)}/.well-known/oauth-authorization-server`];
 }
 /**
-* The issuer's RFC 8414 metadata, or `null`. Metadata whose `issuer` is not
-* the configured issuer is refused (section 3.3), so a mix-up never routes a
+* The issuer's RFC 8414 metadata, or `null`. Metadata whose `issuer` is not the
+* configured issuer is refused (section 3.3), so a mix-up never routes a
 * credential to another server.
 */
 async function discoverAuthorizationServer(issuer, runtime) {

package/dist/{diff-Btr1c1Ow.js → diff-BwR1JdP2.js}

@@ -1,5 +1,5 @@
 import { t as defineLeaf } from "./command-L8EstFNm.js";
-import { c as given } from "./flags-aaeRAdiD.js";
+import { c as given } from "./flags-DXjoTVbS.js";
 //#region src/cli/commands/diff.ts
 const diff = defineLeaf({
 	positionals: [{
@@ -21,7 +21,7 @@ const diff = defineLeaf({
 		}
 	},
 	async run(ctx, { flags, args }) {
-		return (await import("./diff-DzT-xD13.js")).runDiff({
+		return (await import("./diff-CQegtBAo.js")).runDiff({
 			cwd: ctx.cwd,
 			config: ctx.config,
 			sources: [args["before"], args["after"]].filter((value) => value !== void 0),

package/dist/{diff-DzT-xD13.js → diff-CQegtBAo.js}

@@ -1,14 +1,14 @@
-import { A as memoryCustomRoleSource } from "./src-DLFrtrrC.js";
-import { n as findPermission } from "./permission-registry-DpPtSKNZ.js";
-import { g as secondsOf } from "./time-DkWjdL98.js";
+import { j as memoryCustomRoleSource } from "./src-C_pi2Rnh.js";
+import { n as findPermission } from "./permission-registry-B8tYxPIt.js";
+import { g as secondsOf } from "./time-nR1JesoH.js";
 import { t as canonicalJson } from "./canonical-json-DwilZ1iB.js";
-import { t as getPermDock } from "./permdock-BfWEeMqk.js";
-import { i as configError, u as usageResult } from "./errors-DpP_U6Bf.js";
-import { t as buildCatalog } from "./catalog-doc-CV9s6B1S.js";
-import { a as loadModule, n as asPolicy, s as pickNamed } from "./load-DxroEzH1.js";
-import { t as parseCatalog } from "./parse-Ddhz2xf4.js";
-import { t as operationFindings } from "./operation-findings-kRcEp8lE.js";
-import { n as fixtureSubject, r as loadFixtures, t as fixtureRow } from "./fixtures-BTMW6zgU.js";
+import { t as getPermDock } from "./permdock-BvjivVb9.js";
+import { i as configError, u as usageResult } from "./errors-Vpu6rKHl.js";
+import { t as buildCatalog } from "./catalog-doc-DjMKzJp9.js";
+import { a as loadModule, n as asPolicy, s as pickNamed } from "./load-DjSU5KXO.js";
+import { t as parseCatalog } from "./parse-1_ZheTW5.js";
+import { t as operationFindings } from "./operation-findings-CXtFzlKJ.js";
+import { n as fixtureSubject, r as loadFixtures, t as fixtureRow } from "./fixtures-A1_sp_tR.js";
 import { existsSync, readFileSync } from "node:fs";
 import { resolve } from "node:path";
 //#region src/cli/diff/format.ts
@@ -90,7 +90,10 @@ function setDiff(before, after) {
 		removed: before.filter((item) => !b.has(item)).toSorted()
 	};
 }
-/** What makes two grants "the same grant" across versions: everything but the body. */
+/**
+* What makes two grants "the same grant" across versions: everything but the
+* body.
+*/
 function grantIdentity(grant) {
 	return canonicalJson({
 		permission: grant.permission,
@@ -125,7 +128,10 @@ function fieldsChange(before, after) {
 }
 const validFrom = (value) => secondsOf(value?.from) ?? Number.NEGATIVE_INFINITY;
 const validUntil = (value) => secondsOf(value?.until) ?? Number.POSITIVE_INFINITY;
-/** Narrowed when the window starts later or ends earlier than before; a new window on an open grant narrows it. */
+/**
+* Narrowed when the window starts later or ends earlier than before; a new
+* window on an open grant narrows it.
+*/
 function validityChange(before, after) {
 	return validFrom(after) > validFrom(before) || validUntil(after) < validUntil(before) ? "validity narrowed" : "validity widened";
 }
@@ -207,7 +213,10 @@ function sideRef(side) {
 function aliasesOf(catalog) {
 	return new Map(catalog.permissions.flatMap((item) => (item.renamedFrom ?? []).map((old) => [old, item.key])));
 }
-/** `a` with every key `b` renamed written as its new key, so grants compare by the current name. */
+/**
+* `a` with every key `b` renamed written as its new key, so grants compare by
+* the current name.
+*/
 function underNames(a, aliases) {
 	if (a.catalog.grants === void 0 || aliases.size === 0) return a;
 	return {