permdock 0.7.0 → 0.9.0

package/dist/{challenge-nGWma08S.js → challenge-DImNcR7B.js}

@@ -1,18 +1,24 @@
 import { r as isRecord, t as compact } from "./compact-CAf557ZB.js";
-import { n as freezeDeep } from "./freeze-CrU8nQeX.js";
-import { i as dateAt, p as nowSeconds } from "./time-DkWjdL98.js";
-import { u as policyDocumentFromClaims } from "./hosted-XBgU6RGT.js";
-import { l as isApprovalErrorCode, s as ApprovalError, t as APPROVAL_HEADER } from "./types-DqzsnlSA.js";
-import { h as toCloudEvent, l as isAbsoluteUri } from "./sink-BEZSlMS_.js";
-import { n as parseCatalogEventData, t as catalogFingerprint } from "./catalog-fingerprint-C144oW4M.js";
-import { t as parseApprovalRequest } from "./parse-request-D_tUXG6M.js";
+import { n as freezeDeep } from "./freeze-jjan0lCv.js";
+import { i as dateAt, p as nowSeconds } from "./time-nR1JesoH.js";
+import { u as policyDocumentFromClaims } from "./hosted-D0IzESu_.js";
+import { l as isApprovalErrorCode, s as ApprovalError, t as APPROVAL_HEADER } from "./types-CcUXciSj.js";
+import { h as toCloudEvent, l as isAbsoluteUri } from "./sink-D9_vh372.js";
+import { n as parseCatalogEventData, t as catalogFingerprint } from "./catalog-fingerprint-e6aCWosn.js";
+import { t as parseApprovalRequest } from "./parse-request-CwCZpyjV.js";
 import { t as timeoutSignal } from "./timeout-D51niuQP.js";
 import { t as CLOUD_BASE_URL } from "./base-url-BQbddZO5.js";
 //#region src/cloud/approver.ts
 const APPROVER_HEADER = "PermDock-Approver";
-/** The RFC 9396 `authorization_details` type that binds an approver token to one verdict. */
+/**
+* The RFC 9396 `authorization_details` type that binds an approver token to one
+* verdict.
+*/
 const APPROVAL_DETAIL_TYPE = "permdock_approval";
-/** Seconds an approver token lives: it proves one resolve call, and the Cloud refuses a replayed `jti`. */
+/**
+* Seconds an approver token lives: it proves one resolve call, and the Cloud
+* refuses a replayed `jti`.
+*/
 const APPROVER_TTL = 60;
 async function facts(read, request, verdict, fallback) {
 	if (read === void 0) return fallback ?? [];
@@ -25,7 +31,10 @@ async function facts(read, request, verdict, fallback) {
 function unauthenticated(detail) {
 	return new ApprovalError("approver-unauthenticated", detail);
 }
-/** A rejection only denies, so the Cloud takes a `system` one without an approver token. */
+/**
+* A rejection only denies, so the Cloud takes a `system` one without an
+* approver token.
+*/
 function isSystemRejection(verdict) {
 	return verdict.status === "rejected" && verdict.by.actor?.kind === "system";
 }
@@ -36,10 +45,10 @@ function isSystemRejection(verdict) {
 * the request id, the verdict status, `vouched`, and the approver's
 * `permissions` and `relations`. With the `roles`, `memberships` and `tenant`
 * claims they are the only facts the Cloud checks a request's `approvers`
-* against in bring-your-own mode. `target` runs only after the
-* approver checks pass. Throws an `ApprovalError` before any resolve when the
-* approver cannot be proven: no signer, no principal, an actor, a failed
-* lookup or a signer failure.
+* against in bring-your-own mode. `target` runs only after the approver checks
+* pass. Throws an `ApprovalError` before any resolve when the approver cannot
+* be proven: no signer, no principal, an actor, a failed lookup or a signer
+* failure.
 */
 async function approverHeaders(verdict, options, issuer, target) {
 	if (isSystemRejection(verdict)) return {};
@@ -80,7 +89,10 @@ async function approverHeaders(verdict, options, issuer, target) {
 }
 //#endregion
 //#region src/cloud/request.ts
-/** Milliseconds a PermDock Cloud request may take; a slower one fails like an unreachable Cloud. */
+/**
+* Milliseconds a PermDock Cloud request may take; a slower one fails like an
+* unreachable Cloud.
+*/
 const CLOUD_TIMEOUT_MS = 1e4;
 function readEnv(name) {
 	const value = globalThis.process?.env?.[name];
@@ -103,15 +115,18 @@ function endpointsOf(url, environment) {
 		jwks: `${issuer}/.well-known/jwks.json`
 	});
 }
-/** `options.environment`, else `PERMDOCK_CLOUD_ENV`, else `""` for the key-bound lookup. */
+/**
+* `options.environment`, else `PERMDOCK_CLOUD_ENV`, else `""` for the key-bound
+* lookup.
+*/
 function configuredEnvironment(options) {
 	return firstNonEmpty(options.environment, readEnv("PERMDOCK_CLOUD_ENV"));
 }
 /**
 * The environment URL and JWK Set URL `cloud()` uses when the environment is
-* configured: `environment`, else `PERMDOCK_CLOUD_ENV`. Throws when neither
-* is set; `resolveCloudEndpoints` then asks the Cloud which environment the
-* key belongs to.
+* configured: `environment`, else `PERMDOCK_CLOUD_ENV`. Throws when neither is
+* set; `resolveCloudEndpoints` then asks the Cloud which environment the key
+* belongs to.
 */
 function cloudEndpoints(options = {}) {
 	const url = cloudUrl(options);
@@ -134,7 +149,10 @@ async function keyEnvironment(url, key, fetchFn) {
 	if (body["issuer"] !== endpoints.issuer) throw new Error(`PermDock Cloud named issuer ${String(body["issuer"])}, not ${endpoints.issuer}`);
 	return endpoints;
 }
-/** The authenticated connection every `permdock/cloud` client shares. Throws without a key. */
+/**
+* The authenticated connection every `permdock/cloud` client shares. Throws
+* without a key.
+*/
 function cloudConnection(options) {
 	const key = firstNonEmpty(options.key, readEnv("PERMDOCK_CLOUD_KEY"));
 	const url = cloudUrl(options);
@@ -172,10 +190,10 @@ function cloudConnection(options) {
 	});
 }
 /**
-* The environment URL and JWK Set URL for a key: `cloudEndpoints(options)`
-* when the environment is configured, else the environment `GET
-* /v1/environment` names for `key` (`PERMDOCK_CLOUD_KEY`). Rejects when the
-* Cloud does not answer or answers another issuer.
+* The environment URL and JWK Set URL for a key: `cloudEndpoints(options)` when
+* the environment is configured, else the environment `GET /v1/environment`
+* names for `key` (`PERMDOCK_CLOUD_KEY`). Rejects when the Cloud does not
+* answer or answers another issuer.
 */
 async function resolveCloudEndpoints(options = {}) {
 	return await cloudConnection(options).endpoints();
@@ -212,7 +230,10 @@ function asApproval(value) {
 	if (!isRecord(value) || value["v"] !== 1 || typeof value["token"] !== "string") return null;
 	return value;
 }
-/** The refusal PermDock Cloud names in its body, else the one its status implies. */
+/**
+* The refusal PermDock Cloud names in its body, else the one its status
+* implies.
+*/
 async function approvalErrorFrom(response) {
 	let body;
 	try {
@@ -467,8 +488,8 @@ const SCHEME = /^[\s,]*([!#$%&'*+.^_`|~0-9A-Za-z-]+)(?=[\s,]|$)/u;
 const PARAM = /^\s*([!#$%&'*+.^_`|~0-9A-Za-z-]+)\s*=\s*(?:"((?:[^"\\]|\\.)*)"|([!#$%&'*+.^_`|~0-9A-Za-z-]+))\s*(?:,|$)/u;
 const TOKEN68 = /^\s*[A-Za-z0-9._~+/-]+=*\s*(?:,|$)/u;
 /**
-* The first `Bearer` challenge in `header` (RFC 9110 section 11.6.1 syntax),
-* or `null`. Other schemes in the same field are skipped.
+* The first `Bearer` challenge in `header` (RFC 9110 section 11.6.1 syntax), or
+* `null`. Other schemes in the same field are skipped.
 */
 function bearerChallenge(header) {
 	if (header === null) return null;

package/dist/chat/index.d.ts

@@ -1,2 +1,2 @@
-import { a as ChatCommandResult, c as createPermDock, d as SubjectFromChatOptions, f as isChatAuthor, i as ChatCommandContext, l as ChatAuthor, n as ChatActionResult, o as ChatPermDock, p as subjectFromChat, r as ChatCommand, s as ChatPermDockOptions, t as ChatAction, u as ChatPrincipal } from "../create-B2-CQqCI.js";
+import { a as ChatCommandResult, c as createPermDock, d as SubjectFromChatOptions, f as isChatAuthor, i as ChatCommandContext, l as ChatAuthor, n as ChatActionResult, o as ChatPermDock, p as subjectFromChat, r as ChatCommand, s as ChatPermDockOptions, t as ChatAction, u as ChatPrincipal } from "../create-DBvUsgzK.js";
 export { type ChatAction, type ChatActionResult, type ChatAuthor, type ChatCommand, type ChatCommandContext, type ChatCommandResult, type ChatPermDock, type ChatPermDockOptions, type ChatPrincipal, type SubjectFromChatOptions, createPermDock, isChatAuthor, subjectFromChat };

package/dist/chat/index.js

@@ -1,11 +1,11 @@
 import { t as compact } from "../compact-CAf557ZB.js";
-import { n as freezeDeep } from "../freeze-CrU8nQeX.js";
-import { n as loadPrincipalByIdentity } from "../principal-source-pHneukrx.js";
-import { f as nowMillis } from "../time-DkWjdL98.js";
-import { l as withApp, t as getPermDock } from "../permdock-BfWEeMqk.js";
-import { c as isApprovalError } from "../types-DqzsnlSA.js";
-import { a as requestApproval, o as resolveApproval, s as resumeDecision } from "../helpers-DY3vXuGs.js";
-import { t as approvalPrompt } from "../approval-prompt-Dg5LeAcT.js";
+import { n as freezeDeep } from "../freeze-jjan0lCv.js";
+import { n as loadPrincipalByIdentity } from "../principal-source-C6N60GtM.js";
+import { f as nowMillis } from "../time-nR1JesoH.js";
+import { l as withApp, t as getPermDock } from "../permdock-BvjivVb9.js";
+import { c as isApprovalError } from "../types-CcUXciSj.js";
+import { a as requestApproval, o as resolveApproval, s as resumeDecision } from "../helpers-DJicaG6f.js";
+import { t as approvalPrompt } from "../approval-prompt-B8hQY69x.js";
 //#region src/chat/subject.ts
 function nonEmpty(value) {
 	return typeof value === "string" && value !== "";
@@ -17,7 +17,10 @@ function isChatAuthor(value) {
 	const workspace = Reflect.get(value, "workspace");
 	return nonEmpty(provider) && nonEmpty(userId) && (workspace === void 0 || nonEmpty(workspace));
 }
-/** The principal linked to `author`, or `null` for an unlinked or malformed author. Never throws. */
+/**
+* The principal linked to `author`, or `null` for an unlinked or malformed
+* author. Never throws.
+*/
 function principalFromChat(author, principals) {
 	if (!isChatAuthor(author)) return Promise.resolve(null);
 	return loadPrincipalByIdentity(principals, compact({
@@ -28,8 +31,8 @@ function principalFromChat(author, principals) {
 	}));
 }
 /**
-* The subject a chat author acts as: the principal its identity link
-* names, or anonymous when there is no link. Never throws.
+* The subject a chat author acts as: the principal its identity link names, or
+* anonymous when there is no link. Never throws.
 */
 async function subjectFromChat(author, options) {
 	return {

package/dist/chat-sdk/index.d.ts

@@ -1,17 +1,20 @@
-import { n as ApprovalUrl, t as ApprovalPrompt } from "../approval-prompt-K0faOLFp.js";
-import { l as ChatAuthor, n as ChatActionResult, o as ChatPermDock } from "../create-B2-CQqCI.js";
-import { n as ChatTransport } from "../types-g7Oy6Zg4.js";
+import { n as ApprovalUrl, t as ApprovalPrompt } from "../approval-prompt-3BqWczTt.js";
+import { l as ChatAuthor, n as ChatActionResult, o as ChatPermDock } from "../create-DBvUsgzK.js";
+import { n as ChatTransport } from "../types-CN0LsqbK.js";
 import { ActionEvent, Author, CardElement } from "chat";
 //#region src/chat-sdk/author.d.ts
 type ChatSdkAuthorOptions = {
-  /** The platform workspace the bot is installed in, matched against identity links. */
+  /**
+   * The platform workspace the bot is installed in, matched against identity
+   * links.
+   */
   readonly workspace?: string;
 };
 /**
  * The `ChatAuthor` of a Chat SDK message or action, named by its adapter
- * (`adapter.name`, such as `slack`). `null` for a bot, this bot, the
- * platform itself or an empty id. Reads only `userId`: the email and display
- * name never identify anyone.
+ * (`adapter.name`, such as `slack`). `null` for a bot, this bot, the platform
+ * itself or an empty id. Reads only `userId`: the email and display name never
+ * identify anyone.
  */
 export declare function chatSdkAuthor(user: Pick<Author, "userId" | "isBot" | "isMe" | "isSystem">, adapter: {
   readonly name: string;
@@ -23,17 +26,23 @@ export declare const APPROVE_ACTION = "permdock:approve";
 /** The `actionId` of the card's reject button; its `value` is the request id. */
 export declare const REJECT_ACTION = "permdock:reject";
 type ApprovalCardOptions = {
-  /** The app's approval page: a base URL the request id is appended to, or a function of the prompt. Must be https. */
+  /**
+   * The app's approval page: a base URL the request id is appended to, or a
+   * function of the prompt. Must be https.
+   */
   readonly approvalUrl: ApprovalUrl;
-  /** `false` leaves out the approve and reject buttons, so the page is the only place to decide. Defaults to `true`. */
+  /**
+   * `false` leaves out the approve and reject buttons, so the page is the only
+   * place to decide. Defaults to `true`.
+   */
   readonly buttons?: boolean;
 };
 /**
- * A Chat SDK card for an approval prompt: the detail, who asked, the
- * permission and the expiry, a link to the approval page, and approve and
- * reject buttons that carry the request id, never its token. A click is
- * applied by `approvalActions` as the verified clicking user. Throws a
- * `TypeError` for an approval page that is not https.
+ * A Chat SDK card for an approval prompt: the detail, who asked, the permission
+ * and the expiry, a link to the approval page, and approve and reject buttons
+ * that carry the request id, never its token. A click is applied by
+ * `approvalActions` as the verified clicking user. Throws a `TypeError` for an
+ * approval page that is not https.
  */
 export declare function approvalCard(prompt: ApprovalPrompt, options: ApprovalCardOptions): CardElement;
 //#endregion
@@ -46,31 +55,40 @@ type ApprovalActionsOptions = ChatSdkAuthorOptions & {
   readonly onResult?: (result: ChatActionResult, event: ActionEvent) => void | Promise<void>;
 };
 type ApprovalActions = {
-  /** The action ids to register: `chat.onAction(actions.actionIds, actions.onAction)`. */
+  /**
+   * The action ids to register: `chat.onAction(actions.actionIds,
+   * actions.onAction)`.
+   */
   readonly actionIds: readonly [typeof APPROVE_ACTION, typeof REJECT_ACTION];
   readonly onAction: (event: ActionEvent) => Promise<void>;
 };
 /**
- * Applies the approve and reject buttons of `approvalCard`. The clicking
- * user, as the Chat SDK adapter verified them, is resolved through
- * `ChatPermDock.resolveAction`; the button value names the request by id.
- * A click from an unlinked user, the requester or a bot records nothing.
+ * Applies the approve and reject buttons of `approvalCard`. The clicking user,
+ * as the Chat SDK adapter verified them, is resolved through
+ * `ChatPermDock.resolveAction`; the button value names the request by id. A
+ * click from an unlinked user, the requester or a bot records nothing.
  */
 export declare function approvalActions(permdock: ChatPermDock, options?: ApprovalActionsOptions): ApprovalActions;
 //#endregion
 //#region src/chat-sdk/transport.d.ts
 /** The part of a Chat SDK `Chat` the transport calls; a `new Chat(...)` fits. */
 type ChatSdkClient = {
-  openDM(user: string): Promise<{
-    post(message: string | CardElement): Promise<{
+  openDM: (user: string) => Promise<{
+    post: (message: string | CardElement) => Promise<{
       readonly id: string;
     }>;
   }>;
 };
 type ChatSdkTransportOptions = {
-  /** The adapter name recipients are on (`slack`, `teams`, …); a target for another provider is rejected. */
+  /**
+   * The adapter name recipients are on (`slack`, `teams`, …); a target for
+   * another provider is rejected.
+   */
   readonly provider: string;
-  /** The workspace the bot is installed in; a target for another workspace is rejected. */
+  /**
+   * The workspace the bot is installed in; a target for another workspace is
+   * rejected.
+   */
   readonly workspace?: string;
   /** Keys this transport remembers to skip a repeat post. Defaults to 1000. */
   readonly remember?: number;
@@ -78,9 +96,9 @@ type ChatSdkTransportOptions = {
 /**
  * The chat channel of `permdock/delivery` over the Chat SDK: opens a direct
  * message with the target's platform user id and posts the text, or the
- * approval card when the message carries an approval prompt. The Chat SDK
- * takes no idempotency key, so the transport skips a key it already sent,
- * per instance and in memory only.
+ * approval card when the message carries an approval prompt. The Chat SDK takes
+ * no idempotency key, so the transport skips a key it already sent, per
+ * instance and in memory only.
  */
 export declare function chatSdkTransport(chat: ChatSdkClient, options: ChatSdkTransportOptions): ChatTransport;
 //#endregion

package/dist/chat-sdk/index.js

@@ -1,13 +1,13 @@
 import { t as compact } from "../compact-CAf557ZB.js";
-import { n as approvalUrlFor } from "../approval-prompt-Dg5LeAcT.js";
-import { i as isDeliveryTarget } from "../target-Bw37TFNA.js";
+import { n as approvalUrlFor } from "../approval-prompt-B8hQY69x.js";
+import { i as isDeliveryTarget } from "../target-qdEAnnhU.js";
 import { Actions, Button, Card, CardText, Field, Fields, LinkButton } from "chat";
 //#region src/chat-sdk/author.ts
 /**
 * The `ChatAuthor` of a Chat SDK message or action, named by its adapter
-* (`adapter.name`, such as `slack`). `null` for a bot, this bot, the
-* platform itself or an empty id. Reads only `userId`: the email and display
-* name never identify anyone.
+* (`adapter.name`, such as `slack`). `null` for a bot, this bot, the platform
+* itself or an empty id. Reads only `userId`: the email and display name never
+* identify anyone.
 */
 function chatSdkAuthor(user, adapter, options = {}) {
 	const provider = typeof adapter === "string" ? adapter : adapter.name;
@@ -28,11 +28,11 @@ function oneLine(value) {
 	return value.replaceAll(/\s+/gu, " ").trim();
 }
 /**
-* A Chat SDK card for an approval prompt: the detail, who asked, the
-* permission and the expiry, a link to the approval page, and approve and
-* reject buttons that carry the request id, never its token. A click is
-* applied by `approvalActions` as the verified clicking user. Throws a
-* `TypeError` for an approval page that is not https.
+* A Chat SDK card for an approval prompt: the detail, who asked, the permission
+* and the expiry, a link to the approval page, and approve and reject buttons
+* that carry the request id, never its token. A click is applied by
+* `approvalActions` as the verified clicking user. Throws a `TypeError` for an
+* approval page that is not https.
 */
 function approvalCard(prompt, options) {
 	const url = approvalUrlFor(prompt, options.approvalUrl);
@@ -101,10 +101,10 @@ async function reply(result, event) {
 	await thread.postEphemeral(event.user, `The approval was not recorded: ${result.cause}.`, { fallbackToDM: false });
 }
 /**
-* Applies the approve and reject buttons of `approvalCard`. The clicking
-* user, as the Chat SDK adapter verified them, is resolved through
-* `ChatPermDock.resolveAction`; the button value names the request by id.
-* A click from an unlinked user, the requester or a bot records nothing.
+* Applies the approve and reject buttons of `approvalCard`. The clicking user,
+* as the Chat SDK adapter verified them, is resolved through
+* `ChatPermDock.resolveAction`; the button value names the request by id. A
+* click from an unlinked user, the requester or a bot records nothing.
 */
 function approvalActions(permdock, options = {}) {
 	const onAction = async (event) => {
@@ -147,9 +147,9 @@ function chatSdkFailure(error) {
 /**
 * The chat channel of `permdock/delivery` over the Chat SDK: opens a direct
 * message with the target's platform user id and posts the text, or the
-* approval card when the message carries an approval prompt. The Chat SDK
-* takes no idempotency key, so the transport skips a key it already sent,
-* per instance and in memory only.
+* approval card when the message carries an approval prompt. The Chat SDK takes
+* no idempotency key, so the transport skips a key it already sent, per
+* instance and in memory only.
 */
 function chatSdkTransport(chat, options) {
 	const remember = options.remember ?? DEFAULT_REMEMBER;

package/dist/{checks-BC_0mPIq.js → checks-CGkP3Z7A.js}

@@ -3,7 +3,10 @@ import { n as isReadonlyArray } from "./compact-CAf557ZB.js";
 function partsOf(check) {
 	return isReadonlyArray(check) ? [check[0], check[1]] : [check, void 0];
 }
-/** `true` when every check is granted, stopping at the first that is not; an empty list is `false`. */
+/**
+* `true` when every check is granted, stopping at the first that is not; an
+* empty list is `false`.
+*/
 function canAllWith(can, checks, options) {
 	if (checks.length === 0) return false;
 	return checks.every((check) => {

package/dist/{claims-map-7oQ3ue4X.js → claims-map-CKkoAAYF.js}

@@ -1,6 +1,9 @@
-import { o as readPath } from "./paths-DXSHAMIa.js";
+import { o as readPath } from "./paths-CUvURzHp.js";
 //#region src/core/claims-map.ts
-/** The value at `path`; a function that throws reads as absent, so a bad mapping fails closed. */
+/**
+* The value at `path`; a function that throws reads as absent, so a bad mapping
+* fails closed.
+*/
 function readClaim(claims, path) {
 	if (typeof path === "string") return readPath(claims, path);
 	try {

package/dist/{claims-map-Ca-QX8C6.d.ts → claims-map-D1Pb5oRq.d.ts}

@@ -1,11 +1,14 @@
 //#region src/core/claims-map.d.ts
-/** Where a value lives in verified claims: a dotted path (`app_metadata.roles`), or a function over the claims. */
+/**
+ * Where a value lives in verified claims: a dotted path (`app_metadata.roles`),
+ * or a function over the claims.
+ */
 type ClaimPath = string | ((claims: Readonly<Record<string, unknown>>) => unknown);
 /**
- * How one provider's verified claims map to a principal. Every subject
- * provider takes it as `claims`; each field it leaves out keeps that
- * provider's default. Mapping only: core never verifies a token, and a claim
- * becomes a principal field only after the provider verified the token.
+ * How one provider's verified claims map to a principal. Every subject provider
+ * takes it as `claims`; each field it leaves out keeps that provider's default.
+ * Mapping only: core never verifies a token, and a claim becomes a principal
+ * field only after the provider verified the token.
  */
 type ClaimsMap = {
   readonly id?: ClaimPath;

package/dist/claude-agent/index.d.ts

@@ -1,6 +1,6 @@
-import { T as Policy, j as PolicyVocabulary, sr as Principal } from "../policy-types-B-F-qAZk.js";
-import { a as PermDock } from "../permdock-Dco6dyCK.js";
-import { o as AgentAdapterOptions, t as AgentPermDock } from "../create-UTnUVETj.js";
+import { T as Policy, j as PolicyVocabulary, pr as Principal } from "../policy-types-DGIO_gxq.js";
+import { a as PermDock } from "../permdock-CprAPN3w.js";
+import { o as AgentAdapterOptions, t as AgentPermDock } from "../create-BPUopdfL.js";
 //#region src/claude-agent/create.d.ts
 /** Structural `McpServerProvenance` from `@anthropic-ai/claude-agent-sdk`. */
 type ClaudeMcpServer = {
@@ -8,9 +8,9 @@ type ClaudeMcpServer = {
   readonly source: string;
 };
 /**
- * What `subject`, `actor` and `tenant` receive: the `canUseTool` options or
- * the hook input. The subject comes from the app that started the query,
- * never from these fields.
+ * What `subject`, `actor` and `tenant` receive: the `canUseTool` options or the
+ * hook input. The subject comes from the app that started the query, never from
+ * these fields.
  */
 type ClaudeAgentContext = {
   readonly toolName: string;

package/dist/claude-agent/index.js

@@ -1,6 +1,6 @@
 import { r as isRecord, t as compact } from "../compact-CAf557ZB.js";
-import { l as withApp } from "../permdock-BfWEeMqk.js";
-import { t as agentRuntime } from "../create-Cb86Z8Im.js";
+import { l as withApp } from "../permdock-BvjivVb9.js";
+import { t as agentRuntime } from "../create-6EwRQlig.js";
 //#region src/claude-agent/create.ts
 const MCP_PREFIX = "mcp__";
 function asInput(input) {
@@ -31,7 +31,10 @@ function createPermDock(policy, given) {
 	const options = withApp(policy, given);
 	const sources = options.mcpSources ?? ["sdk"];
 	const { agent, kernel } = agentRuntime(policy, options, "claude-agent");
-	/** `null`: an unmapped tool under `unmapped: 'allow'`, which PermDock does not decide. */
+	/**
+	* `null`: an unmapped tool under `unmapped: 'allow'`, which PermDock does not
+	* decide.
+	*/
 	const decide = async (context, input) => {
 		const untrusted = untrustedServer(context, sources);
 		if (untrusted !== void 0) return {

package/dist/clerk/index.d.ts

@@ -1,7 +1,7 @@
-import { W as CustomRoleSource, lr as Subject, sr as Principal } from "../policy-types-B-F-qAZk.js";
-import { u as Permission } from "../permission-types-DhNEmoRG.js";
-import { s as RemotePdpCache } from "../types-D3A19w4A.js";
-import { t as ClaimsMap } from "../claims-map-Ca-QX8C6.js";
+import { G as CustomRoleSource, hr as Subject, pr as Principal } from "../policy-types-DGIO_gxq.js";
+import { u as Permission } from "../permission-types-CAY-GU7e.js";
+import { s as RemotePdpCache } from "../types-DlelvQk4.js";
+import { t as ClaimsMap } from "../claims-map-D1Pb5oRq.js";
 import { StandardSchemaV1 } from "@standard-schema/spec";
 //#region src/clerk/types.d.ts
 type ClerkPrincipal = Principal & {
@@ -37,7 +37,11 @@ type ClerkSubjectOptions = {
   readonly customRoles?: CustomRoleSource;
   readonly permissions?: Readonly<Record<string, Permission>>;
   readonly schema?: StandardSchemaV1;
-  /** Where the session token carries platform roles (`claims.roles`): a path such as `publicMetadata.staff`, or a function. Organization roles come from the `o` claim. */
+  /**
+   * Where the session token carries platform roles (`claims.roles`): a path
+   * such as `publicMetadata.staff`, or a function. Organization roles come from
+   * the `o` claim.
+   */
   readonly claims?: Pick<ClaimsMap, "roles">;
   readonly features?: Readonly<Record<string, string>>;
   readonly declared?: readonly string[];
@@ -58,8 +62,8 @@ type ClerkSubjectResolverOptions = ClerkSubjectOptions & {
 //#region src/clerk/subject.d.ts
 export declare function subjectFromClerk(authObject: unknown, options?: ClerkSubjectOptions): Promise<Subject<ClerkPrincipal>>;
 /**
- * A resolver that keeps each user's `memberships: 'all'` list for
- * `cache.ttl` (at most 30 seconds), so a removed membership grants until then.
+ * A resolver that keeps each user's `memberships: 'all'` list for `cache.ttl`
+ * (at most 30 seconds), so a removed membership grants until then.
  */
 export declare function clerkSubjectResolver(options?: ClerkSubjectResolverOptions): (authObject: unknown) => Promise<Subject<ClerkPrincipal>>;
 //#endregion

package/dist/clerk/index.js

@@ -1,9 +1,9 @@
 import { i as omitKeys, r as isRecord, t as compact } from "../compact-CAf557ZB.js";
-import { n as freezeDeep } from "../freeze-CrU8nQeX.js";
-import { r as validateRecord } from "../thenable-yD7SabqG.js";
+import { n as freezeDeep } from "../freeze-jjan0lCv.js";
+import { r as validateRecord } from "../thenable-BNSM1U2R.js";
 import { t as anonymousSubject } from "../subject-BGoM5o8B.js";
-import { t as readClaim } from "../claims-map-7oQ3ue4X.js";
-import { c as ttlMs, s as ttlCache } from "../shared-C8LjUdVU.js";
+import { t as readClaim } from "../claims-map-CKkoAAYF.js";
+import { c as ttlMs, s as ttlCache } from "../shared-l0oGGetg.js";
 //#region src/clerk/subject.ts
 function asRoles(value) {
 	if (typeof value === "string") return value === "" ? [] : [value];
@@ -198,8 +198,8 @@ function subjectFromClerk(authObject, options = {}) {
 	return fromClerk(authObject, options, extraMemberships);
 }
 /**
-* A resolver that keeps each user's `memberships: 'all'` list for
-* `cache.ttl` (at most 30 seconds), so a removed membership grants until then.
+* A resolver that keeps each user's `memberships: 'all'` list for `cache.ttl`
+* (at most 30 seconds), so a removed membership grants until then.
 */
 function clerkSubjectResolver(options = {}) {
 	const { cache, ...rest } = options;

package/dist/cli/bin.js

@@ -5,14 +5,14 @@ import { text } from "node:stream/consumers";
 module.enableCompileCache?.();
 const argv = process.argv.slice(2);
 if (argv.length === 1 && (argv[0] === "--version" || argv[0] === "-v")) {
-	const { cliVersion } = await import("../version-DXkYUISx.js");
+	const { cliVersion } = await import("../version-DizhmD72.js");
 	process.stdout.write(`${cliVersion()}\n`);
 } else {
 	const [{ isCi }, { trapSignals }, { run }, { streamHasColors }] = await Promise.all([
 		import("../env-DJZrPjRi.js"),
-		import("../signals-D3NcTKUS.js"),
-		import("../run-Bz7DXGEv.js"),
-		import("../style-Ds1gNm77.js")
+		import("../signals-B1vHR3fN.js"),
+		import("../run-Ck22anC2.js"),
+		import("../style-DblOtSga.js")
 	]);
 	const signals = trapSignals();
 	const result = await run(argv, {