permdock 0.7.0 → 0.9.0

package/dist/{types-CQVEQawv.d.ts → types-rCRV4Ge-.d.ts}

@@ -1,7 +1,8 @@
-import { Gt as Snapshot, In as ApprovalRequiredDecision, Ln as Decision, Un as GrantedDecision, dt as TokenVerifier } from "./policy-types-B-F-qAZk.js";
-import { u as Permission } from "./permission-types-DhNEmoRG.js";
-import { n as DescribeMessages } from "./describe-O0SwYIK8.js";
-import { h as ClientStoreOptions } from "./types-CKV71kKh.js";
+import { Hn as ApprovalRequiredDecision, Un as Decision, Yn as GrantedDecision, Zt as Snapshot, ht as TokenVerifier } from "./policy-types-DGIO_gxq.js";
+import { u as Permission } from "./permission-types-CAY-GU7e.js";
+import { s as RowData } from "./permdock-CprAPN3w.js";
+import { n as DescribeMessages } from "./describe-BbFPBSms.js";
+import { _ as ClientStoreOptions } from "./types-tQB2CEnY.js";
 import { ReactNode } from "react";
 //#region src/react/types.d.ts
 type PermDockProviderProps = ({
@@ -9,21 +10,24 @@ type PermDockProviderProps = ({
   readonly snapshotPromise?: never;
 } | {
   /**
-   * An unawaited snapshot from a Server Component. Hooks never suspend on it: until it
-   * resolves they deny with `status: 'pending'`, then re-render. A rejection fails closed
-   * (`server-only`). Set `suspend` to suspend readers through `use()` instead.
+   * An unawaited snapshot from a Server Component. Hooks never suspend on
+   * it: until it resolves they deny with `status: 'pending'`, then
+   * re-render. A rejection fails closed (`server-only`). Set `suspend` to
+   * suspend readers through `use()` instead.
    */
   readonly snapshotPromise: PromiseLike<Snapshot | string>;
   readonly snapshot?: never;
 }) & {
   /**
-   * With `snapshotPromise`: `true` suspends every hook to the nearest Suspense boundary until it
-   * resolves, and a rejection reaches the nearest error boundary. Defaults to `false`.
+   * With `snapshotPromise`: `true` suspends every hook to the nearest Suspense
+   * boundary until it resolves, and a rejection reaches the nearest error
+   * boundary. Defaults to `false`.
    */
   readonly suspend?: boolean;
   /**
-   * The AuthZEN evaluations endpoint for checks the snapshot cannot answer. `false` never
-   * fetches: those checks answer `denied` with reason `server-only`.
+   * The AuthZEN evaluations endpoint for checks the snapshot cannot answer.
+   * `false` never fetches: those checks answer `denied` with reason
+   * `server-only`.
    */
   readonly endpoint?: string | false;
   /** Where `refresh()` fetches a fresh snapshot. Defaults to `endpoint`. */
@@ -44,6 +48,11 @@ type PermDockProviderProps = ({
   readonly onClear?: () => void;
   /** Milliseconds between approval status polls. Defaults to 2000. */
   readonly approvalInterval?: number;
+  /**
+   * Triggers that refresh the snapshot, such as `eventSourceRefresh(url)`; read
+   * when the store is built.
+   */
+  readonly refreshOn?: ClientStoreOptions["refreshOn"];
   readonly children: ReactNode;
 };
 /** Provider-wide content for the `<Protected>` slots a component leaves out. */
@@ -52,9 +61,10 @@ type PermDockDefaults = {
   readonly denied?: ReactNode | ((decision: Decision) => ReactNode);
   readonly approval?: ReactNode | ((decision: ApprovalRequiredDecision) => ReactNode);
 };
-type ProtectedProps = {
-  readonly permission: Permission;
-  readonly data?: unknown;
+type ProtectedProps<P extends Permission = Permission> = {
+  readonly permission: P;
+  /** Any part of the permission's row; see `RowData`. */
+  readonly data?: RowData<P>;
   readonly tenant?: string;
   readonly pending?: ReactNode;
   readonly denied?: ReactNode | ((decision: Decision) => ReactNode);

package/dist/types-tQB2CEnY.d.ts

@@ -0,0 +1,262 @@
+import { Un as Decision, Zt as Snapshot, ht as TokenVerifier, j as PolicyVocabulary, lr as Delegation, pr as Principal, rr as Actor } from "./policy-types-DGIO_gxq.js";
+import { u as Permission } from "./permission-types-CAY-GU7e.js";
+import { a as PermDock } from "./permdock-CprAPN3w.js";
+import { n as DescribeMessages, t as DecisionDescription } from "./describe-BbFPBSms.js";
+import { t as ActionResult } from "./action-result-BcudBQOF.js";
+//#region src/client/refresh-on.d.ts
+/**
+ * Calls `refresh` when the snapshot may be out of date (a membership event, a
+ * window focus, a realtime message) and returns the unsubscribe. A refresh
+ * re-fetches the signed snapshot; it never grants by itself.
+ */
+type RefreshTrigger = (refresh: () => void) => () => void;
+type EventSourceRefreshOptions = {
+  /**
+   * CloudEvent `type` values that refresh; a trailing `*` matches a prefix.
+   * Defaults to `com.permdock.membership.*` and `com.permdock.catalog.*`.
+   */
+  readonly types?: readonly string[];
+  readonly withCredentials?: boolean;
+};
+/**
+ * A `refreshOn` trigger over Server-Sent Events: each `message` whose data is a
+ * structured CloudEvent with a matching `type` refreshes the snapshot. Without
+ * a global `EventSource` it never fires.
+ */
+declare function eventSourceRefresh(url: string, options?: EventSourceRefreshOptions): RefreshTrigger;
+//#endregion
+//#region src/client/request.d.ts
+type StoreHeaders = Readonly<Record<string, string>>;
+//#endregion
+//#region src/client/store.d.ts
+type ClientStoreOptions = {
+  readonly snapshot: Snapshot | string;
+  readonly endpoint?: string;
+  readonly snapshotUrl?: string;
+  readonly approvals?: string;
+  readonly tenant?: string;
+  readonly fetch?: typeof fetch;
+  /**
+   * Request headers, or a getter read on every request so a rotated token needs
+   * no new store.
+   */
+  readonly headers?: StoreHeaders | (() => StoreHeaders | undefined);
+  readonly maxAge?: number;
+  readonly verifier?: TokenVerifier;
+  /**
+   * `raw` is the compact JWS the snapshot was verified from, so a signed
+   * snapshot can be persisted signed.
+   */
+  readonly onSnapshot?: (snapshot: Snapshot, tenant: string | undefined, raw: string | undefined) => void;
+  readonly onClear?: () => void;
+  /**
+   * Called once per key the snapshot cannot answer when there is no `endpoint`
+   * to ask.
+   */
+  readonly onServerOnly?: (permission: Permission) => void;
+  /**
+   * `true` while rendering on the server: endpoint checks answer `pending`
+   * without a request. Defaults to `typeof window === 'undefined'`.
+   */
+  readonly server?: boolean;
+  /** Milliseconds between approval status polls. Defaults to 2000. */
+  readonly approvalInterval?: number;
+  /** Start `pending`: the snapshot arrives later through `track()`. */
+  readonly awaiting?: boolean;
+  /**
+   * The first snapshot that hydrates with a principal is a persisted copy:
+   * `stale` until a refresh or a `replace()` lands.
+   */
+  readonly stale?: boolean;
+  /**
+   * Reuse decisions for the same row object until the next microtask. Only for
+   * renderers that do not track the fields a check reads (React): Vue, Svelte
+   * and Solid would stop re-running when a reactive row changes in place.
+   */
+  readonly passCache?: boolean;
+  /**
+   * Triggers that refresh the snapshot, started while something subscribes and
+   * never during a server render. Calls within 250 ms fold into one refresh.
+   */
+  readonly refreshOn?: readonly RefreshTrigger[];
+};
+type ClientStore = {
+  get: () => ClientPermDock;
+  subscribe: (listener: () => void) => () => void;
+  permissionState: (permission: Permission, data?: unknown) => PermissionState;
+  requestApproval: (decision: Decision, note?: string) => Promise<void>;
+  /** Hydrate from a pushed snapshot; a compact JWS goes through the verifier. */
+  replace: (value: unknown) => void;
+  /**
+   * Stay `pending` until `value` settles, then hydrate; a rejection fails
+   * closed.
+   */
+  follow: (value: PromiseLike<Snapshot | string>) => void;
+  /**
+   * `follow()` once per `value`, without suspending. A thenable React already
+   * settled (`status: 'fulfilled'`) hydrates at once.
+   */
+  track: (value: PromiseLike<Snapshot | string>) => void;
+  /**
+   * The approval state for a decision. While something subscribes, an
+   * `approval-required` decision is polled at `<approvals>/<token>`.
+   */
+  approvalState: (decision: Decision) => ApprovalState;
+  /**
+   * Hydrate from a resolved `snapshotPromise` during render. Idempotent per
+   * `source`; subscribers are notified in a microtask, never synchronously
+   * inside render.
+   */
+  adopt: (value: Snapshot | string, source: object) => void;
+  snapshot: () => Snapshot;
+  /** The tenant the store currently answers for. */
+  tenant: () => string | undefined;
+  /**
+   * Stops polls, drops in-flight results and persistence; the store keeps
+   * answering from its last snapshot.
+   */
+  dispose: () => void;
+};
+//#endregion
+//#region src/client/protected-action.d.ts
+type ProtectedActionState<T> = {
+  /** The last call's answer; `undefined` before the first call. */
+  readonly result: ActionResult<T> | undefined;
+  /** A call is in flight. */
+  readonly pending: boolean;
+};
+//#endregion
+//#region src/client/types.d.ts
+type ClientStatus = "ready" | "pending" | "stale" | "server-only";
+type PermissionState = {
+  readonly allowed: boolean;
+  readonly status: ClientStatus;
+  readonly decision: Decision;
+};
+type PermissionSet = {
+  readonly granted: readonly Permission[];
+  get: (permission: Permission) => PermissionState | undefined;
+};
+type ClientPermDock<V extends PolicyVocabulary = PolicyVocabulary> = PermDock<V> & {
+  status: (permission?: Permission, data?: unknown) => ClientStatus;
+  invalidate: (ref: Permission | {
+    readonly [key: string]: unknown;
+  }) => void;
+  refresh: (options?: {
+    readonly tenant?: string;
+  }) => Promise<void>;
+  clear: () => void;
+  subscribe: (listener: () => void) => () => void;
+};
+type ApprovalState = "not-needed" | "required" | "pending" | "approved" | "rejected" | "expired";
+type ApprovalHandle = {
+  readonly state: ApprovalState;
+  readonly token: string | undefined;
+  readonly request: (note?: string) => Promise<void>;
+};
+/**
+ * A protected server action wired to a control: the gate for its button, the
+ * last answer, and the approval its `approval-required` problem carries. The
+ * client decides nothing; the action answers.
+ */
+type ProtectedActionView<T> = ProtectedActionState<T> & {
+  readonly gate: GateView;
+  /** On an `approval-required` problem, the handle for its token. */
+  readonly approval: ApprovalHandle | undefined;
+};
+type ProtectedActionHandle<T> = ProtectedActionView<T> & {
+  readonly run: (input: unknown) => Promise<ActionResult<T>>;
+  /** Resends the last input with the approval token; `undefined` without one. */
+  readonly retry: () => Promise<ActionResult<T> | undefined>;
+};
+type SubjectView = {
+  readonly principal: Principal | null;
+  readonly actor: Actor | undefined;
+  readonly delegation: Delegation | undefined;
+  readonly expiresAt: number | undefined;
+  readonly simulated: boolean;
+};
+type TenantView = {
+  readonly tenant: string | null;
+  readonly tenants: readonly string[];
+  readonly switchTo: (id: string) => Promise<void>;
+  readonly status: ClientStatus;
+};
+type FilterResult<T> = readonly T[] & {
+  readonly partial: boolean;
+};
+/**
+ * Which held roles `useRoles` lists: those of a tenant (the active one by
+ * default), or only those on the memberships of one `scope`, and of one
+ * instance `id` of it.
+ */
+type RolesOptions = {
+  readonly tenant?: string;
+  readonly scope?: string;
+  readonly id?: string;
+};
+/**
+ * The provider options Vue, Svelte and Solid share; each adds its own reactive
+ * `snapshot`, `tenant`, `headers`, `verifier` and `defaults`.
+ */
+type ProviderOptionsBase = {
+  /**
+   * The AuthZEN evaluations endpoint for checks the snapshot cannot answer.
+   * `false` never calls one: such a check is denied with reason `server-only`.
+   */
+  readonly endpoint?: string | false;
+  /** Where `refresh()` fetches a fresh snapshot. Defaults to `endpoint`. */
+  readonly snapshotUrl?: string;
+  readonly approvals?: string;
+  /** Read on every request, so a new `fetch` applies without a new store. */
+  readonly fetch?: typeof fetch;
+  readonly maxAge?: number;
+  /** Localised text for the describe helper. */
+  readonly messages?: DescribeMessages;
+  /** Called with each snapshot the store accepts. */
+  readonly onSnapshot?: NonNullable<ClientStoreOptions["onSnapshot"]>;
+  /** Called when the store drops its snapshot. */
+  readonly onClear?: () => void;
+  /** Milliseconds between approval status polls. Defaults to 2000. */
+  readonly approvalInterval?: number;
+  /**
+   * Triggers that refresh the snapshot, such as `eventSourceRefresh(url)`; read
+   * once.
+   */
+  readonly refreshOn?: readonly RefreshTrigger[];
+};
+/**
+ * How a control shows a permission it cannot use: hidden, or disabled with a
+ * reason.
+ */
+type GateMode = "hide" | "disable";
+/**
+ * Everything a permission-gated control renders from, in one value: a button, a
+ * menu item or a link reads these fields and decides nothing itself. The client
+ * is a hint; the server checks again.
+ */
+type GateView = {
+  /** The decision granted the action. */
+  readonly allowed: boolean;
+  /** The snapshot is loading; render the control disabled, not hidden. */
+  readonly pending: boolean;
+  /** `mode: "hide"` and the action is not available: render nothing. */
+  readonly hidden: boolean;
+  /**
+   * The control cannot run the action now (denied, pending or awaiting
+   * approval).
+   */
+  readonly disabled: boolean;
+  /** The decision needs a person's approval first; offer to request it. */
+  readonly needsApproval: boolean;
+  /**
+   * The plans that would grant the action, for an upgrade prompt; empty
+   * otherwise.
+   */
+  readonly upgrade: readonly string[];
+  /** Title and detail for a tooltip or an accessible description. */
+  readonly reason: DecisionDescription;
+  readonly decision: Decision;
+};
+//#endregion
+export { ClientStoreOptions as _, FilterResult as a, eventSourceRefresh as b, PermissionSet as c, ProtectedActionView as d, ProviderOptionsBase as f, ClientStore as g, TenantView as h, ClientStatus as i, PermissionState as l, SubjectView as m, ApprovalState as n, GateMode as o, RolesOptions as p, ClientPermDock as r, GateView as s, ApprovalHandle as t, ProtectedActionHandle as u, EventSourceRefreshOptions as v, RefreshTrigger as y };

package/dist/unplugin/index.d.ts

@@ -1,4 +1,4 @@
-import { a as PermDockPluginOptions } from "../types-BWZybqs9.js";
+import { s as PermDockPluginOptions } from "../types-CzOeVvcC.js";
 import { createUnplugin } from "unplugin";
 //#region src/unplugin/index.d.ts
 type CreateUnplugin = typeof createUnplugin<PermDockPluginOptions | undefined>;

package/dist/unplugin/index.js

@@ -1,5 +1,5 @@
-import { n as createCollectScheduler, r as report } from "../watch-C-4VmFlL.js";
-import { r as peerHint } from "../peer-12Q5I_RH.js";
+import { n as createCollectScheduler, r as report } from "../watch-BFDKqmUa.js";
+import { r as peerHint } from "../peer-Q0fuZ6hx.js";
 import { createRequire } from "node:module";
 //#region src/unplugin/index.ts
 function loadCreateUnplugin() {

package/dist/usage-0hjZPIRX.js

@@ -0,0 +1 @@
+export { t as runUsage } from "./usage-B9EtHWLa.js";

package/dist/{usage-Bybmck7f.js → usage-B9EtHWLa.js}

@@ -1,13 +1,13 @@
-import { a as getResource } from "./permission-registry-DpPtSKNZ.js";
-import { u as usageResult } from "./errors-DpP_U6Bf.js";
-import { a as rel, r as listSourceFiles } from "./files-D_JIzUrP.js";
-import { o as USAGE_REPORT_SCHEMA } from "./version-CEbQ5UeM.js";
-import { c as jsonSchemaOf } from "./catalog-doc-CV9s6B1S.js";
-import { a as loadModule, n as asPolicy, s as pickNamed } from "./load-DxroEzH1.js";
-import { r as runCollect } from "./collect-BaWeMjwV.js";
+import { a as getResource } from "./permission-registry-B8tYxPIt.js";
+import { u as usageResult } from "./errors-Vpu6rKHl.js";
+import { a as rel, r as listSourceFiles } from "./files-BSjrtIHw.js";
+import { o as USAGE_REPORT_SCHEMA } from "./version-DMQ0dnN5.js";
+import { c as jsonSchemaOf } from "./catalog-doc-DjMKzJp9.js";
+import { a as loadModule, n as asPolicy, s as pickNamed } from "./load-DjSU5KXO.js";
+import { r as runCollect } from "./collect-WCl8cJQV.js";
 import { t as beforeFirst } from "./text-BMFRfBqc.js";
-import { t as DOCS_BASE } from "./manifest-Dv6q4i5s.js";
-import { r as findingOf } from "./output-DgSDLrta.js";
+import { t as DOCS_BASE } from "./manifest-B2QPh19C.js";
+import { r as findingOf } from "./output-DV5dwOTs.js";
 import { existsSync, readFileSync, realpathSync } from "node:fs";
 import { dirname, resolve } from "node:path";
 import { fileURLToPath, pathToFileURL } from "node:url";
@@ -15,7 +15,10 @@ import { createJiti } from "jiti";
 import { Visitor, parseSync } from "oxc-parser";
 import { isBuiltin } from "node:module";
 //#region src/cli/doctor/source.ts
-/** Entries a client file must not import; `tests/cli/doctor-entries.test.ts` keeps it in step with `exports`. */
+/**
+* Entries a client file must not import; `tests/cli/doctor-entries.test.ts`
+* keeps it in step with `exports`.
+*/
 const SERVER_SPECIFIERS = [
 	"permdock/a2a",
 	"permdock/agent",
@@ -112,7 +115,10 @@ function withoutComments(source) {
 function isClientSource(source, clientEntries) {
 	return clientEntries.has(source.file) || source.text.includes("'use client'") || source.text.includes("\"use client\"") || source.file.includes(".client.");
 }
-/** Specifiers a module loads at runtime: value imports, re-exports and literal dynamic imports. */
+/**
+* Specifiers a module loads at runtime: value imports, re-exports and literal
+* dynamic imports.
+*/
 function runtimeSpecifiers(source) {
 	const { module } = parseSync(source.file, source.text);
 	const out = /* @__PURE__ */ new Set();
@@ -132,10 +138,10 @@ function realFile(path) {
 	}
 }
 /**
-* A resolver for imports of `file`, the way the bundler resolves them:
-* relative paths with or without an extension, the `paths` of the nearest
-* `tsconfig.json`, and package names through `node_modules` and each
-* package's `exports`. An unresolvable specifier gives `undefined`.
+* A resolver for imports of `file`, the way the bundler resolves them: relative
+* paths with or without an extension, the `paths` of the nearest
+* `tsconfig.json`, and package names through `node_modules` and each package's
+* `exports`. An unresolvable specifier gives `undefined`.
 */
 function resolverFor(file) {
 	const jiti = createJiti(file, { tsconfigPaths: dirname(file) });
@@ -222,7 +228,7 @@ function pd010(sources) {
 }
 function pd011(sources) {
 	const findings = [];
-	for (const source of sources) if (/tenant['"]?\s*:\s*['"]hd['"]/u.test(source.text) || /accounts\.google\.com/u.test(source.text) && /tenant/.test(source.text)) findings.push({
+	for (const source of sources) if (/tenant['"]?\s*:\s*['"]hd['"]/u.test(source.text) || /accounts\.google\.com/u.test(source.text) && source.text.includes("tenant")) findings.push({
 		code: "PD011",
 		severity: "warning",
 		message: `${source.file} reads tenant from an optional issuer claim`,
@@ -355,7 +361,10 @@ function pd015(sources) {
 	return findings;
 }
 const SUPABASE_SUBJECT_CALL = /\bsubjectFromSupabase(?:Session)?\s*\(/gu;
-/** Top-level arguments of the call whose `(` ends at `open`, or undefined when unbalanced. */
+/**
+* Top-level arguments of the call whose `(` ends at `open`, or undefined when
+* unbalanced.
+*/
 function callArguments(text, open) {
 	const args = [];
 	let depth = 0;
@@ -382,7 +391,10 @@ function callArguments(text, open) {
 		}
 	}
 }
-/** The claim a `subjectFromSupabase` call reads the tenant from, or undefined when the options are not a literal. */
+/**
+* The claim a `subjectFromSupabase` call reads the tenant from, or undefined
+* when the options are not a literal.
+*/
 function readTenantClaim(options, fallback) {
 	if (options === void 0) return fallback;
 	if (!options.startsWith("{")) return;
@@ -409,9 +421,9 @@ function pd038(sources, tenantClaim, fallback) {
 	return findings;
 }
 /**
-* PD057: `rls.anonymousSignIns` is `'deny'`, so RLS refuses `signInAnonymously()` users, but a
-* `subjectFromSupabase(Session)` call maps them as signed-in users. Options that are not a
-* literal object are not read.
+* PD057: `rls.anonymousSignIns` is `'deny'`, so RLS refuses
+* `signInAnonymously()` users, but a `subjectFromSupabase(Session)` call maps
+* them as signed-in users. Options that are not a literal object are not read.
 */
 function pd057(sources) {
 	const findings = [];
@@ -433,7 +445,10 @@ function pd057(sources) {
 	return findings;
 }
 const EXCHANGE_CALL = /\bexchangeCapability\s*\(/gu;
-/** PD041: `exchangeCapability` signing link tokens with the project's shared JWT secret. */
+/**
+* PD041: `exchangeCapability` signing link tokens with the project's shared JWT
+* secret.
+*/
 function pd041(sources) {
 	const findings = [];
 	for (const source of sources) for (const match of source.text.matchAll(EXCHANGE_CALL)) {
@@ -453,7 +468,10 @@ function pd041(sources) {
 const PROTECT_CALL = /\bprotect\s*\(/gu;
 const ID_ROUTE = /['"`](\/[^'"`\s]*(?::[A-Za-z_$][\w$]*|\{[A-Za-z_$][\w$]*\})[^'"`\s]*)['"`]/gu;
 const DYNAMIC_SEGMENT = /(?:^|[\\/])(\[[^\]/\\]+\])(?=[\\/])/u;
-/** The id-bearing route a `protect` call at `index` sits in: the file's dynamic segment, or a route literal earlier in the same statement. */
+/**
+* The id-bearing route a `protect` call at `index` sits in: the file's dynamic
+* segment, or a route literal earlier in the same statement.
+*/
 function idRouteOf(source, index) {
 	const segment = DYNAMIC_SEGMENT.exec(source.file);
 	if (segment !== null) return segment[1];
@@ -461,7 +479,10 @@ function idRouteOf(source, index) {
 	const start = Math.max(window.lastIndexOf(";"), window.lastIndexOf("\n\n"));
 	return [...window.slice(start + 1).matchAll(ID_ROUTE)].at(-1)?.[1];
 }
-/** PD036: a `protect(permission)` with no row loader on a route whose path names an object id (BOLA, OWASP API1). */
+/**
+* PD036: a `protect(permission)` with no row loader on a route whose path names
+* an object id (BOLA, OWASP API1).
+*/
 function pd036(sources) {
 	const findings = [];
 	for (const source of sources) {
@@ -709,8 +730,11 @@ function ignored(key, patterns) {
 	});
 }
 function formatUsage(report) {
-	const lines = ["permdock usage", ""];
-	lines.push(`  defined but unused (${String(report.unused.length)})`);
+	const lines = [
+		"permdock usage",
+		"",
+		`  defined but unused (${String(report.unused.length)})`
+	];
 	for (const finding of report.unused) lines.push(`    ${finding.key.padEnd(28)} ${finding.detail}`);
 	lines.push("");
 	lines.push(`  used but ungranted (${String(report.ungranted.length)})`);

package/dist/{usage-CDaLXCfL.js → usage-CBzgwfIs.js}

@@ -1,5 +1,5 @@
 import { t as defineLeaf } from "./command-L8EstFNm.js";
-import { a as failOnFlag } from "./flags-aaeRAdiD.js";
+import { a as failOnFlag } from "./flags-DXjoTVbS.js";
 //#region src/cli/commands/usage.ts
 const usage = defineLeaf({
 	flags: {
@@ -16,7 +16,7 @@ const usage = defineLeaf({
 		}
 	},
 	async run(ctx, { flags }) {
-		return (await import("./usage-y-kBNdqs.js")).runUsage({
+		return (await import("./usage-0hjZPIRX.js")).runUsage({
 			cwd: ctx.cwd,
 			config: ctx.config,
 			ignore: flags.ignore,

package/dist/{validation-error-ZfUHbKvf.js → validation-error-CYg2kJEw.js}

@@ -1,6 +1,9 @@
 import { t as compact } from "./compact-CAf557ZB.js";
 //#region src/core/validation-error.ts
-/** The base of every Problem Details `type` URI; defined here so a validation error does not pull in the Problem Details builders. */
+/**
+* The base of every Problem Details `type` URI; defined here so a validation
+* error does not pull in the Problem Details builders.
+*/
 const PROBLEM_BASE = "https://permdock.com/problems";
 var PermDockValidationError = class extends Error {
 	name = "PermDockValidationError";

package/dist/{validation-error-CQpoquwj.d.ts → validation-error-uvp-kyfO.d.ts}

@@ -1,7 +1,10 @@
-import { a as ProblemDetails } from "./errors-B_Qg9D3e.js";
+import { a as ProblemDetails } from "./errors-BIM4MFsJ.js";
 import { StandardSchemaV1 } from "@standard-schema/spec";
 //#region src/core/validation-error.d.ts
-/** The base of every Problem Details `type` URI; defined here so a validation error does not pull in the Problem Details builders. */
+/**
+ * The base of every Problem Details `type` URI; defined here so a validation
+ * error does not pull in the Problem Details builders.
+ */
 declare const PROBLEM_BASE = "https://permdock.com/problems";
 declare class PermDockValidationError extends Error {
   override readonly name: "PermDockValidationError";

package/dist/{validity-CZ7-y0Cj.js → validity-Buc7w8E9.js}

@@ -1,6 +1,6 @@
-import { n as freezeDeep } from "./freeze-CrU8nQeX.js";
-import { i as ownKeys, n as isForbiddenKey, r as ownGet } from "./paths-DXSHAMIa.js";
-import { c as instantOf, g as secondsOf, m as rfc3339 } from "./time-DkWjdL98.js";
+import { n as freezeDeep } from "./freeze-jjan0lCv.js";
+import { i as ownKeys, n as isForbiddenKey, r as ownGet } from "./paths-CUvURzHp.js";
+import { c as instantOf, g as secondsOf, m as rfc3339 } from "./time-nR1JesoH.js";
 //#region src/core/fields.ts
 function sanitizeFields(fields) {
 	if (fields === void 0) return;
@@ -26,9 +26,9 @@ function sanitizeContext(value) {
 //#endregion
 //#region src/core/validity.ts
 /**
-* The normalised validity of a grant, or `undefined` when neither bound is
-* set. Fail-closed at definition time: a bound that does not parse, or a
-* window that ends before it starts, throws so a typo never widens a grant.
+* The normalised validity of a grant, or `undefined` when neither bound is set.
+* Fail-closed at definition time: a bound that does not parse, or a window that
+* ends before it starts, throws so a typo never widens a grant.
 */
 function normalizeValidity(options, permissionKey) {
 	const from = options.validFrom === void 0 ? void 0 : instantOf(options.validFrom);
@@ -42,7 +42,10 @@ function normalizeValidity(options, permissionKey) {
 		...until === void 0 ? {} : { until }
 	});
 }
-/** Whether a grant with this validity applies at `now` (Unix seconds); no validity always applies. */
+/**
+* Whether a grant with this validity applies at `now` (Unix seconds); no
+* validity always applies.
+*/
 function isActive(validity, now) {
 	if (validity === void 0) return true;
 	if (validity.from !== void 0 && now < validity.from) return false;
@@ -56,9 +59,9 @@ function wireValidity(validity) {
 	});
 }
 /**
-* The validity of a wire grant. A malformed window fails closed for the
-* grant's effect: an allow never applies (`{ from: +∞ }`), a deny always
-* does (no window), so a corrupt bound can never lift a deny.
+* The validity of a wire grant. A malformed window fails closed for the grant's
+* effect: an allow never applies (`{ from: +∞ }`), a deny always does (no
+* window), so a corrupt bound can never lift a deny.
 */
 function readWireValidity(value, effect = "allow") {
 	if (value === void 0) return;

package/dist/{verifier-DHuh-okk.js → verifier-DUV6pLqZ.js}

@@ -1,6 +1,6 @@
 import { n as isReadonlyArray, t as compact } from "./compact-CAf557ZB.js";
-import { n as isForbiddenKey, s as splitPath } from "./paths-DXSHAMIa.js";
-import { p as nowSeconds } from "./time-DkWjdL98.js";
+import { n as isForbiddenKey, s as splitPath } from "./paths-CUvURzHp.js";
+import { p as nowSeconds } from "./time-nR1JesoH.js";
 import { t as loadJose } from "./load-jose-DZ4dnjri.js";
 //#region src/jwt/header.ts
 function compactParts(token) {
@@ -145,7 +145,10 @@ function secretBytes(secret) {
 	if (typeof secret === "string") return new TextEncoder().encode(secret);
 	return secret;
 }
-/** The verifier options of a subject config: `audience: false` means none is checked. */
+/**
+* The verifier options of a subject config: `audience: false` means none is
+* checked.
+*/
 function verifierOptions(options) {
 	const { audience, ...rest } = options;
 	return audience === false || audience === void 0 ? rest : {
@@ -348,7 +351,10 @@ function configuredKeys(listed) {
 function isObject(value) {
 	return value !== null && typeof value === "object" && !Array.isArray(value);
 }
-/** Whether `key` may decrypt a token with this header: encryption use, matching `alg` and `kid`, and private material. */
+/**
+* Whether `key` may decrypt a token with this header: encryption use, matching
+* `alg` and `kid`, and private material.
+*/
 function mayDecrypt(key, header) {
 	if (!isObject(key)) return false;
 	if (key["use"] !== void 0 && key["use"] !== "enc") return false;