permdock 0.8.0 → 0.10.0

package/dist/{catalog-BFpz2EmT.js → catalog-CGlSwU6j.js}

@@ -2,8 +2,8 @@ import { r as isRecord } from "./compact-CAf557ZB.js";
 import { r as listSourceFiles, t as defaultSrcPath } from "./files-BSjrtIHw.js";
 import { a as catalogSchemaDocument, n as catalogForCompare, o as formatCatalogJson, r as catalogForDrift, s as formatCatalogMarkdown, t as buildCatalog } from "./catalog-doc-DjMKzJp9.js";
 import { a as loadModule, i as loadConfiguredPolicy, r as leavesOf, s as pickNamed, t as asPermissionTree } from "./load-DjSU5KXO.js";
-import { t as loadConfiguredOperations } from "./catalog-operations-Dadrl7Z-.js";
-import { i as scanSources, r as runCollect } from "./collect-B7ZFAJU3.js";
+import { t as loadConfiguredOperations } from "./catalog-operations-DeHTrJSV.js";
+import { i as scanSources, r as runCollect } from "./collect-WCl8cJQV.js";
 import { n as fileSummary, t as applyFiles } from "./files-B3AA05f1.js";
 import { existsSync, readFileSync } from "node:fs";
 import { resolve } from "node:path";

package/dist/catalog-D3oS2GH3.js

@@ -0,0 +1 @@
+export { t as catalogFile, n as runCatalog } from "./catalog-CGlSwU6j.js";

package/dist/{catalog-DCspHDc8.js → catalog-amPDr0JQ.js}

@@ -30,7 +30,7 @@ const catalog = defineLeaf({
 		...checkFlag
 	},
 	async run(ctx, { flags }) {
-		const { catalogFile, runCatalog } = await import("./catalog-mRQQQhNK.js");
+		const { catalogFile, runCatalog } = await import("./catalog-D3oS2GH3.js");
 		const result = await runCatalog({
 			cwd: ctx.cwd,
 			config: ctx.config,

package/dist/{catalog-operations-Dadrl7Z-.js → catalog-operations-DeHTrJSV.js}

@@ -1,5 +1,5 @@
 import { r as isRecord } from "./compact-CAf557ZB.js";
-import { k as isOperationEffect } from "./src-DZ0l9UAg.js";
+import { A as isOperationEffect } from "./src-C_pi2Rnh.js";
 import { o as isPermission } from "./permission-registry-B8tYxPIt.js";
 import { r as isOperationRisk } from "./permissions-CVXmRILq.js";
 import { i as configError } from "./errors-Vpu6rKHl.js";

package/dist/chat/index.d.ts

@@ -1,2 +1,2 @@
-import { a as ChatCommandResult, c as createPermDock, d as SubjectFromChatOptions, f as isChatAuthor, i as ChatCommandContext, l as ChatAuthor, n as ChatActionResult, o as ChatPermDock, p as subjectFromChat, r as ChatCommand, s as ChatPermDockOptions, t as ChatAction, u as ChatPrincipal } from "../create-BVq1lNQE.js";
+import { a as ChatCommandResult, c as createPermDock, d as SubjectFromChatOptions, f as isChatAuthor, i as ChatCommandContext, l as ChatAuthor, n as ChatActionResult, o as ChatPermDock, p as subjectFromChat, r as ChatCommand, s as ChatPermDockOptions, t as ChatAction, u as ChatPrincipal } from "../create-DBvUsgzK.js";
 export { type ChatAction, type ChatActionResult, type ChatAuthor, type ChatCommand, type ChatCommandContext, type ChatCommandResult, type ChatPermDock, type ChatPermDockOptions, type ChatPrincipal, type SubjectFromChatOptions, createPermDock, isChatAuthor, subjectFromChat };

package/dist/chat/index.js

@@ -2,7 +2,7 @@ import { t as compact } from "../compact-CAf557ZB.js";
 import { n as freezeDeep } from "../freeze-jjan0lCv.js";
 import { n as loadPrincipalByIdentity } from "../principal-source-C6N60GtM.js";
 import { f as nowMillis } from "../time-nR1JesoH.js";
-import { l as withApp, t as getPermDock } from "../permdock-L-_I_3zP.js";
+import { l as withApp, t as getPermDock } from "../permdock-BvjivVb9.js";
 import { c as isApprovalError } from "../types-CcUXciSj.js";
 import { a as requestApproval, o as resolveApproval, s as resumeDecision } from "../helpers-DJicaG6f.js";
 import { t as approvalPrompt } from "../approval-prompt-B8hQY69x.js";

package/dist/chat-sdk/index.d.ts

@@ -1,6 +1,6 @@
-import { n as ApprovalUrl, t as ApprovalPrompt } from "../approval-prompt-PYagyQUj.js";
-import { l as ChatAuthor, n as ChatActionResult, o as ChatPermDock } from "../create-BVq1lNQE.js";
-import { n as ChatTransport } from "../types-yUuPR5Hy.js";
+import { n as ApprovalUrl, t as ApprovalPrompt } from "../approval-prompt-3BqWczTt.js";
+import { l as ChatAuthor, n as ChatActionResult, o as ChatPermDock } from "../create-DBvUsgzK.js";
+import { n as ChatTransport } from "../types-CN0LsqbK.js";
 import { ActionEvent, Author, CardElement } from "chat";
 //#region src/chat-sdk/author.d.ts
 type ChatSdkAuthorOptions = {

package/dist/claude-agent/index.d.ts

@@ -1,6 +1,6 @@
-import { T as Policy, j as PolicyVocabulary, sr as Principal } from "../policy-types-CCiDRZBH.js";
-import { a as PermDock } from "../permdock-B6Sf4T_S.js";
-import { o as AgentAdapterOptions, t as AgentPermDock } from "../create-BSNrVuxh.js";
+import { T as Policy, j as PolicyVocabulary, pr as Principal } from "../policy-types-DGIO_gxq.js";
+import { a as PermDock } from "../permdock-CprAPN3w.js";
+import { o as AgentAdapterOptions, t as AgentPermDock } from "../create-BPUopdfL.js";
 //#region src/claude-agent/create.d.ts
 /** Structural `McpServerProvenance` from `@anthropic-ai/claude-agent-sdk`. */
 type ClaudeMcpServer = {

package/dist/claude-agent/index.js

@@ -1,6 +1,6 @@
 import { r as isRecord, t as compact } from "../compact-CAf557ZB.js";
-import { l as withApp } from "../permdock-L-_I_3zP.js";
-import { t as agentRuntime } from "../create-Cq4Uox0f.js";
+import { l as withApp } from "../permdock-BvjivVb9.js";
+import { t as agentRuntime } from "../create-6EwRQlig.js";
 //#region src/claude-agent/create.ts
 const MCP_PREFIX = "mcp__";
 function asInput(input) {

package/dist/clerk/index.d.ts

@@ -1,6 +1,6 @@
-import { W as CustomRoleSource, lr as Subject, sr as Principal } from "../policy-types-CCiDRZBH.js";
+import { G as CustomRoleSource, hr as Subject, pr as Principal } from "../policy-types-DGIO_gxq.js";
 import { u as Permission } from "../permission-types-CAY-GU7e.js";
-import { s as RemotePdpCache } from "../types-B4uqKDnp.js";
+import { s as RemotePdpCache } from "../types-DlelvQk4.js";
 import { t as ClaimsMap } from "../claims-map-D1Pb5oRq.js";
 import { StandardSchemaV1 } from "@standard-schema/spec";
 //#region src/clerk/types.d.ts

package/dist/cli/bin.js

@@ -11,7 +11,7 @@ if (argv.length === 1 && (argv[0] === "--version" || argv[0] === "-v")) {
 	const [{ isCi }, { trapSignals }, { run }, { streamHasColors }] = await Promise.all([
 		import("../env-DJZrPjRi.js"),
 		import("../signals-B1vHR3fN.js"),
-		import("../run-D-JE8QWb.js"),
+		import("../run-BATawNVH.js"),
 		import("../style-DblOtSga.js")
 	]);
 	const signals = trapSignals();

package/dist/cli/index.d.ts

@@ -1,10 +1,10 @@
-import { T as Policy } from "../policy-types-CCiDRZBH.js";
+import { T as Policy } from "../policy-types-DGIO_gxq.js";
 import { f as PermissionTree } from "../permission-types-CAY-GU7e.js";
 import { o as OperationMap } from "../operations-Ci_rT6Uo.js";
 import { a as CatalogDocument, d as CatalogRole, f as CatalogScope, l as CatalogPermission, m as CatalogUsage, n as CatalogApproval, p as CatalogSupportAccess, r as CatalogBreakGlass, t as CatalogActivation, u as CatalogResource } from "../types-ZzRGoViD.js";
-import { a as pushedPolicy, i as parsePushedPolicy, n as PushedGrant, r as PushedPolicy, t as PUSHED_POLICY_SCHEMA } from "../pushed-policy-D1Eoi6NM.js";
-import { _ as RlsSuspension, a as GenKind, c as RlsActiveRow, d as RlsDialect, f as RlsFunctionMapping, g as RlsSuspendedScope, h as RlsSuspendedMembership, i as GenConfig, l as RlsApiKeys, m as RlsMemberships, n as CliIo, o as PermDockConfig, p as RlsMembershipTable, r as CollectConfig, t as CatalogConfig, u as RlsConfig, v as RlsTarget, y as RunResult } from "../types-DC1Loeh3.js";
-import { o as ResourceNameOf, r as PermissionKeyOf, s as ScopeNameOf, t as ActionNameOf } from "../type-helpers-BIPIDa6a.js";
+import { a as pushedPolicy, i as parsePushedPolicy, n as PushedGrant, r as PushedPolicy, t as PUSHED_POLICY_SCHEMA } from "../pushed-policy-CryQheKq.js";
+import { _ as RlsSuspension, a as GenKind, c as RlsActiveRow, d as RlsDialect, f as RlsFunctionMapping, g as RlsSuspendedScope, h as RlsSuspendedMembership, i as GenConfig, l as RlsApiKeys, m as RlsMemberships, n as CliIo, o as PermDockConfig, p as RlsMembershipTable, r as CollectConfig, t as CatalogConfig, u as RlsConfig, v as RlsTarget, y as RunResult } from "../types-Cklw5hJo.js";
+import { o as ResourceNameOf, r as PermissionKeyOf, s as ScopeNameOf, t as ActionNameOf } from "../type-helpers-c7Xo_2Cu.js";
 //#region src/cli/catalog-path.d.ts
 /**
  * The absolute path `permdock collect` writes the catalog to: `collect.out`,
@@ -76,6 +76,11 @@ type ConfigChecks<C> = [PolicyOf<C>] extends [never] ? unknown : {
   readonly powersync?: {
     readonly resources?: readonly ResourceNameOf<PolicyOf<C>>[];
     readonly action?: ActionNameOf<PolicyOf<C>>;
+    readonly tables?: Readonly<Record<string, {
+      readonly follow?: readonly {
+        readonly resource: ResourceNameOf<PolicyOf<C>>;
+      }[];
+    }>>;
   };
 };
 //#endregion

package/dist/cli/index.js

@@ -1,8 +1,8 @@
 import { t as catalogPath } from "../catalog-path-CnI0XTFK.js";
-import { t as defineConfig } from "../config-BwPBfN0t.js";
-import { n as parsePushedPolicy, r as pushedPolicy, t as PUSHED_POLICY_SCHEMA } from "../pushed-policy-ITwYKvvH.js";
+import { t as defineConfig } from "../config-BR23fL8m.js";
+import { n as parsePushedPolicy, r as pushedPolicy, t as PUSHED_POLICY_SCHEMA } from "../pushed-policy-CDuOL2de.js";
 import { c as parseGrantsMarker, l as parseHookMarker } from "../markers-BeHZ4x9Q.js";
-import { t as run } from "../run-Bz26OTfO.js";
+import { t as run } from "../run-CLP_fQUF.js";
 //#region src/cli/token-schemas.ts
 const ID = {
 	type: "string",
@@ -85,6 +85,14 @@ const RUN_TICKET_SCHEMA = {
 					maxItems: 64
 				}
 			}
+		},
+		resource: {
+			type: "object",
+			required: ["type", "id"],
+			properties: {
+				type: ID,
+				id: ID
+			}
 		}
 	},
 	anyOf: [{

package/dist/cloud/index.d.ts

@@ -1,11 +1,11 @@
-import { $t as CredentialEvent, Qt as AutomationEvent, Rt as Instant, Xt as AccessEvent, en as DecisionEvent, in as DirectoryEvent, nn as DeliveryEvent, on as MembershipEvent, tn as DeliveryChannel, ut as TokenSigner } from "../policy-types-CCiDRZBH.js";
-import { m as ApprovalStore } from "../types-B_tiYvk8.js";
-import { i as CatalogEventData, l as CloudEventType, r as CLOUD_EVENT_TYPES, s as CloudEvent } from "../sink-Dvi7YZG_.js";
-import { c as DeliveryTransport } from "../types-yUuPR5Hy.js";
-import { a as CloudConnectionOptions, c as CloudOptions, i as CloudClient, l as CloudSignerOptions, n as CloudCatalog, o as CloudEndpointOptions, r as CloudCatalogPush, s as CloudEndpoints, t as CloudApproverOptions } from "../types-AMJ5qoU_.js";
-import { n as ApprovalWaiter } from "../waiter-Bu9zAlE0.js";
-import { l as ReplayStore } from "../types-DjuMBNF9.js";
-import { f as WebhookVerifier, r as WebhookFailureCause$1, s as WebhookJwks } from "../standard-webhooks-C-qX4mJW.js";
+import { Wt as Instant, an as CredentialEvent, cn as DeliveryEvent, fn as MembershipEvent, in as AutomationEvent, mt as TokenSigner, nn as AccessEvent, on as DecisionEvent, sn as DeliveryChannel, un as DirectoryEvent } from "../policy-types-DGIO_gxq.js";
+import { m as ApprovalStore } from "../types-DLvhVm1r.js";
+import { i as CatalogEventData, l as CloudEventType, r as CLOUD_EVENT_TYPES, s as CloudEvent } from "../sink-B5zoUW_O.js";
+import { c as DeliveryTransport } from "../types-CN0LsqbK.js";
+import { a as CloudConnectionOptions, c as CloudOptions, i as CloudClient, l as CloudSignerOptions, n as CloudCatalog, o as CloudEndpointOptions, r as CloudCatalogPush, s as CloudEndpoints, t as CloudApproverOptions } from "../types-BB-zWDcR.js";
+import { n as ApprovalWaiter } from "../waiter-CqUKX6CY.js";
+import { l as ReplayStore } from "../types-DsHGPtkR.js";
+import { f as WebhookVerifier, r as WebhookFailureCause$1, s as WebhookJwks } from "../standard-webhooks-DOYEuOLx.js";
 //#region src/cloud/base-url.d.ts
 /**
  * The one base URL of PermDock Cloud. The platform issuer is this URL; its

package/dist/{cloud-BFlGMaak.js → cloud-3RIuS4E9.js}

@@ -41,7 +41,7 @@ const push = defineLeaf({
 	},
 	async run(ctx, { flags }) {
 		const env = await withStdinSecret(ctx, "key", flags["key-stdin"], "PERMDOCK_CLOUD_KEY");
-		return (await import("./push-DgssgzkK.js")).runCloud({
+		return (await import("./push-Dq_ca4-j.js")).runCloud({
 			cwd: ctx.cwd,
 			config: ctx.config,
 			url: given(flags.url),
@@ -70,7 +70,7 @@ const pull = defineLeaf({
 	},
 	async run(ctx, { flags }) {
 		const env = await withStdinSecret(ctx, "token", flags["token-stdin"], "PERMDOCK_CLOUD_TOKEN");
-		return (await import("./pull-B65ndFNZ.js")).runCloudPull({
+		return (await import("./pull-DYbyod1f.js")).runCloudPull({
 			cwd: ctx.cwd,
 			config: ctx.config,
 			url: given(flags.url),

package/dist/{codemod-DLQ9Zpo4.js → codemod-DLcp-B6v.js}

@@ -7,7 +7,7 @@ const codemod = defineLeaf({
 		description: "The release to migrate to (0.5)",
 		required: true,
 		async complete() {
-			return (await import("./codemod-DWSN2erG.js")).codemodVersions();
+			return (await import("./codemod-DRl_w-bY.js")).codemodVersions();
 		}
 	}, {
 		name: "paths",
@@ -22,7 +22,7 @@ const codemod = defineLeaf({
 		}
 	},
 	async run(ctx, { flags, args, rest }) {
-		return (await import("./codemod-DWSN2erG.js")).runCodemod({
+		return (await import("./codemod-DRl_w-bY.js")).runCodemod({
 			cwd: ctx.cwd,
 			version: args["version"],
 			paths: rest,

package/dist/{codemod-DWSN2erG.js → codemod-DRl_w-bY.js}

@@ -1,7 +1,7 @@
 import { n as CliError } from "./errors-Vpu6rKHl.js";
 import { a as rel } from "./files-BSjrtIHw.js";
 import { t as beforeFirst } from "./text-BMFRfBqc.js";
-import { n as ROOT } from "./manifest-Cgiq5oqc.js";
+import { n as ROOT } from "./manifest-B4ENCp2I.js";
 import { i as renameMessage, n as DEFAULT_CHANGES, r as flagRename, t as COMMAND_MOVES } from "./renames-CGj7YwcQ.js";
 import { i as refuseDirty, t as applyFiles } from "./files-B3AA05f1.js";
 import { readFileSync, readdirSync, statSync } from "node:fs";

package/dist/collect-D-eroIfV.js

@@ -0,0 +1 @@
+export { r as runCollect } from "./collect-WCl8cJQV.js";

package/dist/{collect-Bzv3le0A.js → collect-D9Tt0Bcx.js}

@@ -29,9 +29,9 @@ const collect = defineLeaf({
 		};
 		if (flags.watch) {
 			if (flags.check) throw new CliError("usage", "collect: --watch writes the catalog; drop --check", { code: "invalid_value" });
-			return (await import("./watch-DB42U1ib.js")).watchCollect(ctx, overrides);
+			return (await import("./watch-COuvly20.js")).watchCollect(ctx, overrides);
 		}
-		const result = await (await import("./collect-B5BL3klN.js")).runCollect({
+		const result = await (await import("./collect-D-eroIfV.js")).runCollect({
 			cwd: ctx.cwd,
 			config: ctx.config,
 			collect: overrides,

package/dist/{collect-B7ZFAJU3.js → collect-WCl8cJQV.js}

@@ -2,7 +2,7 @@ import { a as describeError } from "./errors-Vpu6rKHl.js";
 import { a as rel, r as listSourceFiles, s as writeFileEnsuringDir, t as defaultSrcPath } from "./files-BSjrtIHw.js";
 import { n as catalogForCompare, o as formatCatalogJson, r as catalogForDrift, t as buildCatalog } from "./catalog-doc-DjMKzJp9.js";
 import { a as loadModule, i as loadConfiguredPolicy, r as leavesOf, s as pickNamed, t as asPermissionTree } from "./load-DjSU5KXO.js";
-import { t as loadConfiguredOperations } from "./catalog-operations-Dadrl7Z-.js";
+import { t as loadConfiguredOperations } from "./catalog-operations-DeHTrJSV.js";
 import { t as catalogPath } from "./catalog-path-CnI0XTFK.js";
 import { t as shortDiff } from "./text-diff-BtfSmdUo.js";
 import { existsSync, readFileSync } from "node:fs";

package/dist/compile/index.d.ts

@@ -1,3 +1,3 @@
 import { n as GraphSqlPart, r as RelationsMapping, t as GraphSql } from "../graph-sql-BwFC4Qjs.js";
-import { a as CompiledWhere, c as compileWhere, i as CompiledSql, l as escapeLike, n as CompiledCompare, o as MembershipTable, r as CompiledExists, s as MembershipsMapping, t as CompileWhereOptions } from "../compile-BFzysW3o.js";
+import { a as CompiledWhere, c as compileWhere, i as CompiledSql, l as escapeLike, n as CompiledCompare, o as MembershipTable, r as CompiledExists, s as MembershipsMapping, t as CompileWhereOptions } from "../compile-BEklRUYo.js";
 export { type CompileWhereOptions, type CompiledCompare, type CompiledExists, type CompiledSql, type CompiledWhere, type GraphSql, type GraphSqlPart, type MembershipTable, type MembershipsMapping, type RelationsMapping, compileWhere, escapeLike };

package/dist/{compile-BFzysW3o.d.ts → compile-BEklRUYo.d.ts}

@@ -1,6 +1,6 @@
-import { Rt as Instant, fn as Scope, lr as Subject, mr as Condition } from "./policy-types-CCiDRZBH.js";
+import { Wt as Instant, br as Condition, hr as Subject, vn as Scope } from "./policy-types-DGIO_gxq.js";
 import { b as ResourceNode } from "./permission-types-CAY-GU7e.js";
-import { f as WhereResult } from "./permdock-B6Sf4T_S.js";
+import { f as WhereResult } from "./permdock-CprAPN3w.js";
 import { r as RelationsMapping, t as GraphSql } from "./graph-sql-BwFC4Qjs.js";
 //#region src/conditions/compile.d.ts
 type MembershipTable = {

package/dist/{completion-saoYiRFO.js → completion-VSWvaaPO.js}

@@ -1,6 +1,6 @@
 import { n as CliError } from "./errors-Vpu6rKHl.js";
 import { a as suggestion, o as GLOBAL_FLAGS } from "./args-0FrVs5EH.js";
-import { a as resolve } from "./manifest-Cgiq5oqc.js";
+import { a as resolve } from "./manifest-B4ENCp2I.js";
 import { t as defineLeaf } from "./command-L8EstFNm.js";
 //#region src/cli/core/completion.ts
 const SHELLS = [

package/dist/{config-BwPBfN0t.js → config-BR23fL8m.js}

@@ -1,6 +1,6 @@
 import { r as isRecord } from "./compact-CAf557ZB.js";
 import { i as configError, n as CliError } from "./errors-Vpu6rKHl.js";
-import { a as isSection, i as isModuleKey, n as MODULE_KEYS, o as kindOf, r as describeKinds, t as CONFIG_SHAPE } from "./config-shape-ykV0Vm2n.js";
+import { a as isSection, i as isModuleKey, n as MODULE_KEYS, o as kindOf, r as describeKinds, t as CONFIG_SHAPE } from "./config-shape-tsxHx71E.js";
 import { existsSync } from "node:fs";
 import { relative, resolve } from "node:path";
 //#region src/cli/project/config-schema.ts
@@ -89,7 +89,7 @@ function hasModuleValue(raw) {
 	return isRecord(raw) && Object.keys(MODULE_KEYS).some((key) => isRecord(raw[key]));
 }
 async function traceValues(cwd, file, display, config, options) {
-	const { traceModuleValues } = await import("./module-values-BJTBdo6y.js");
+	const { traceModuleValues } = await import("./module-values-B1EVTkHP.js");
 	return traceModuleValues({
 		cwd,
 		file,

package/dist/{config-DBeXXmBF.js → config-kL36AxkE.js}

@@ -10,7 +10,7 @@ const config = defineLeaf({
 		...failOnFlag
 	},
 	async run(ctx, { flags }) {
-		const { runConfig } = await import("./config-report-BipSWA6V.js");
+		const { runConfig } = await import("./config-report-osnfUNg5.js");
 		return runConfig({
 			cwd: ctx.cwd,
 			config: ctx.config,

package/dist/{config-report-BipSWA6V.js → config-report-osnfUNg5.js}

@@ -1,9 +1,9 @@
 import { a as rel, t as defaultSrcPath } from "./files-BSjrtIHw.js";
 import { r as CONFIG_REPORT_SCHEMA } from "./version-DMQ0dnN5.js";
 import { t as catalogPath } from "./catalog-path-CnI0XTFK.js";
-import { n as guessPermissions, t as barrelFile } from "./collect-B7ZFAJU3.js";
-import "./sources-CMAM-2A3.js";
-import { t as DOCS_BASE } from "./manifest-Cgiq5oqc.js";
+import { n as guessPermissions, t as barrelFile } from "./collect-WCl8cJQV.js";
+import "./sources-C4vkzZJV.js";
+import { t as DOCS_BASE } from "./manifest-B4ENCp2I.js";
 import { n as MIGRATION_DIRS, t as DEFAULT_SENSITIVE_ACTIONS } from "./constants-DcJABbLW.js";
 //#region src/cli/config-report.ts
 function configReport(input) {

package/dist/{config-shape-ykV0Vm2n.js → config-shape-tsxHx71E.js}

@@ -81,7 +81,8 @@ const CONFIG_SHAPE = {
 		out: STRING,
 		resources: ARRAY,
 		action: STRING,
-		manifest: STRING
+		manifest: STRING,
+		tables: OBJECT
 	},
 	doctor: {
 		sensitiveActions: ARRAY,

package/dist/convex/index.d.ts

@@ -1,8 +1,8 @@
-import { T as Policy, j as PolicyVocabulary, sr as Principal } from "../policy-types-CCiDRZBH.js";
+import { T as Policy, j as PolicyVocabulary, pr as Principal } from "../policy-types-DGIO_gxq.js";
 import { u as Permission } from "../permission-types-CAY-GU7e.js";
-import { a as PermDock } from "../permdock-B6Sf4T_S.js";
-import { a as ProblemDetails, r as PermDockDeniedError } from "../errors-zi_4T-rx.js";
-import { t as InstanceOptions } from "../instance-options-B0KXqTrJ.js";
+import { a as PermDock } from "../permdock-CprAPN3w.js";
+import { a as ProblemDetails, r as PermDockDeniedError } from "../errors-BIM4MFsJ.js";
+import { t as InstanceOptions } from "../instance-options-CoHn-0e8.js";
 //#region src/convex/types.d.ts
 type ConvexContextLike = {
   readonly auth?: {

package/dist/convex/index.js

@@ -1,8 +1,8 @@
 import { t as compact } from "../compact-CAf557ZB.js";
 import { n as PermDockValidationError } from "../validation-error-CYg2kJEw.js";
 import { n as PermDockDeniedError, t as PermDockApprovalRequiredError } from "../errors-B6R_lg2a.js";
-import { l as withApp } from "../permdock-L-_I_3zP.js";
-import { n as resolveOrNull, t as buildInstance } from "../build-instance-CNWaYJyr.js";
+import { l as withApp } from "../permdock-BvjivVb9.js";
+import { n as resolveOrNull, t as buildInstance } from "../build-instance-BWXqwQYU.js";
 import { n as tenantScope, t as actorFrom } from "../adapter-context-CIQpQxbE.js";
 //#region src/convex/create.ts
 /**

package/dist/{core-hWIARPDz.d.ts → core-CFepFiDP.d.ts}

@@ -1,6 +1,6 @@
-import { Ln as Decision, T as Policy, or as Membership, tr as CustomRole } from "./policy-types-CCiDRZBH.js";
+import { T as Policy, Un as Decision, fr as Membership, sr as CustomRole } from "./policy-types-DGIO_gxq.js";
 import { u as Permission } from "./permission-types-CAY-GU7e.js";
-import { f as WhereResult, o as PermDockOptions } from "./permdock-B6Sf4T_S.js";
+import { f as WhereResult, o as PermDockOptions } from "./permdock-CprAPN3w.js";
 //#region src/testing/policy-matrix.d.ts
 type MatrixOutcome = "granted" | "denied" | "approval-required";
 type MatrixCell = MatrixOutcome | {

package/dist/{core-H-mbhpZc.js → core-DzVINFbU.js}

@@ -1,10 +1,10 @@
-import { A as memoryCustomRoleSource } from "./src-DZ0l9UAg.js";
+import { j as memoryCustomRoleSource } from "./src-C_pi2Rnh.js";
 import { c as listPermissions } from "./permission-registry-B8tYxPIt.js";
 import { f as scopeList } from "./scopes-0Up_UA2t.js";
-import { y as membershipsClaim } from "./evaluate-Dd8Ta0Ie.js";
+import { y as membershipsClaim } from "./evaluate-BAmf_AQd.js";
 import { n as parseSnapshot } from "./snapshot-CXlzi69u.js";
 import { n as fromSnapshot } from "./from-snapshot-DCakWRsr.js";
-import { t as getPermDock } from "./permdock-L-_I_3zP.js";
+import { t as getPermDock } from "./permdock-BvjivVb9.js";
 import { c as quoteSqlTable, n as defaultSqlCommand, o as quoteSqlIdent, t as SQL_IDENT } from "./sql-0WjxIp9g.js";
 import "./budget-BELja5A9.js";
 //#region src/testing/policy-matrix.ts

package/dist/{create-Cq4Uox0f.js → create-6EwRQlig.js}

@@ -1,10 +1,10 @@
 import { t as compact } from "./compact-CAf557ZB.js";
 import { n as freezeDeep } from "./freeze-jjan0lCv.js";
 import { o as deniedFor } from "./where-scope-DlCdCM_8.js";
-import { l as withApp } from "./permdock-L-_I_3zP.js";
+import { l as withApp } from "./permdock-BvjivVb9.js";
 import { t as composeWraps } from "./wrap-B2wziJI_.js";
-import { r as instanceOptions } from "./build-instance-CNWaYJyr.js";
-import { n as createAgentKernel } from "./kernel-C-fYydV2.js";
+import { r as instanceOptions } from "./build-instance-BWXqwQYU.js";
+import { n as createAgentKernel } from "./kernel-qv4cr9w8.js";
 //#region src/agent/create.ts
 function modelRow(modelId) {
 	return { id: modelId };

package/dist/{create-_noSrY1T.js → create-BLPKnJKa.js}

@@ -3,13 +3,13 @@ import { n as freezeDeep } from "./freeze-jjan0lCv.js";
 import { n as problemDetails } from "./problem-details-CLDgX1KV.js";
 import { c as listPermissions } from "./permission-registry-B8tYxPIt.js";
 import { n as resourceRef } from "./resource-ref-CaS9yVPi.js";
-import { i as challengeScope, l as withApp } from "./permdock-L-_I_3zP.js";
+import { i as challengeScope, l as withApp } from "./permdock-BvjivVb9.js";
 import { r as hasCredentials } from "./http-DKLXrFGk.js";
 import { a as decisionResponse, c as problemFromDecision, d as unauthenticatedProblem, s as notFoundProblem, t as ANONYMOUS } from "./problem-BVLHFK33.js";
-import { n as resolveOrNull } from "./build-instance-CNWaYJyr.js";
+import { n as resolveOrNull } from "./build-instance-BWXqwQYU.js";
 import { _ as LOAD_FAILED, l as InvalidSignatureError, n as applyApprovalResume, o as evaluationsHandler } from "./evaluations-IBceAeKT.js";
 import { n as tenantScope, t as actorFrom } from "./adapter-context-CIQpQxbE.js";
-import { n as requestContext, t as buildReportingInstance } from "./request-context-C25ilqiJ.js";
+import { n as requestContext, t as buildReportingInstance } from "./request-context-Duzdf0cd.js";
 //#region src/server/kernel-problems.ts
 const NOT_DELEGATED = freezeDeep({
 	outcome: "denied",
@@ -170,6 +170,11 @@ async function resolveActor(request, options) {
 	return (options.webBotAuth === void 0 ? void 0 : await options.webBotAuth.verify(request)) ?? actorFrom(options.actor, request);
 }
 const NO_TENANT = "\0";
+const READ_METHODS = /* @__PURE__ */ new Set([
+	"GET",
+	"HEAD",
+	"OPTIONS"
+]);
 /**
 * The Fetch factory behind every HTTP adapter. The subject and actor are
 * resolved once per `Request`; one instance is cached per `(Request, tenant)`,
@@ -200,7 +205,17 @@ function createPermDock(policy, given) {
 		return resolved;
 	};
 	const reporters = /* @__PURE__ */ new WeakMap();
-	const instanceFor = async ({ user, actor, context, errors }, tenant) => {
+	const intentOf = (request) => {
+		let chosen;
+		try {
+			chosen = options.intent?.(request);
+		} catch {
+			return "write";
+		}
+		if (chosen === void 0) return READ_METHODS.has(request.method) ? "read" : "write";
+		return chosen === "read" ? "read" : "write";
+	};
+	const instanceFor = async ({ user, actor, context, errors }, tenant, intent) => {
 		const built = await buildReportingInstance({
 			policy,
 			user,
@@ -208,7 +223,8 @@ function createPermDock(policy, given) {
 			scope: {
 				tenant,
 				actor,
-				context
+				context,
+				intent
 			},
 			errors,
 			wrap: (created) => options.wrap === void 0 ? created : options.wrap(created)
@@ -231,7 +247,7 @@ function createPermDock(policy, given) {
 		const key = tenant ?? NO_TENANT;
 		const hit = byTenant.get(key);
 		if (hit !== void 0) return hit;
-		const built = (async () => instanceFor(await resolveSubject(request), tenant))();
+		const built = (async () => instanceFor(await resolveSubject(request), tenant, intentOf(request)))();
 		byTenant.set(key, built);
 		return built;
 	};
@@ -239,7 +255,7 @@ function createPermDock(policy, given) {
 		const { tenant } = scope ?? await tenantScope(options.tenant, request);
 		return (await import("./connection-B72dg5Q2.js")).openConnection({
 			open: async () => (await build(request, { tenant })).permdock,
-			rebuild: async () => (await instanceFor(await freshSubject(request), tenant)).permdock,
+			rebuild: async () => (await instanceFor(await freshSubject(request), tenant, "write")).permdock,
 			tenant,
 			...options.revocations === void 0 ? {} : { feed: options.revocations },
 			adapter,

package/dist/{create-BSNrVuxh.d.ts → create-BPUopdfL.d.ts}

@@ -1,13 +1,13 @@
-import { Ln as Decision, T as Policy, j as PolicyVocabulary, lr as Subject, rr as Delegation, sr as Principal } from "./policy-types-CCiDRZBH.js";
+import { T as Policy, Un as Decision, hr as Subject, j as PolicyVocabulary, lr as Delegation, pr as Principal } from "./policy-types-DGIO_gxq.js";
 import { u as Permission } from "./permission-types-CAY-GU7e.js";
 import { t as Operation } from "./operations-Ci_rT6Uo.js";
-import { a as PermDock } from "./permdock-B6Sf4T_S.js";
-import { m as ApprovalStore } from "./types-B_tiYvk8.js";
-import { t as InstanceOptions } from "./instance-options-B0KXqTrJ.js";
+import { a as PermDock } from "./permdock-CprAPN3w.js";
+import { m as ApprovalStore } from "./types-DLvhVm1r.js";
+import { t as InstanceOptions } from "./instance-options-CoHn-0e8.js";
 import { t as RequestContext } from "./request-context-C2_1lchh.js";
-import { n as PermDockWrap } from "./wrap-DlJE3gS_.js";
-import { o as OtelWrap } from "./types-DHKPcqzr.js";
-import { t as DeniedText } from "./denied-text-CHNlVInN.js";
+import { n as PermDockWrap } from "./wrap-DxXB54Wu.js";
+import { o as OtelWrap } from "./types-B6ExllNo.js";
+import { t as DeniedText } from "./denied-text-DHldhVUv.js";
 //#region src/agent/step-up.d.ts
 /**
  * What the user can do to lift a denial: authenticate again with the `acr` and

package/dist/{create-CM1FciYG.d.ts → create-CDd9c22W.d.ts}

@@ -1,10 +1,10 @@
-import { Ln as Decision, Rn as Denial, Rt as Instant, T as Policy, Zt as AuthEvent, dt as TokenVerifier, j as PolicyVocabulary, sr as Principal, ut as TokenSigner } from "./policy-types-CCiDRZBH.js";
+import { T as Policy, Un as Decision, Wn as Denial, Wt as Instant, ht as TokenVerifier, j as PolicyVocabulary, mt as TokenSigner, pr as Principal, rn as AuthEvent } from "./policy-types-DGIO_gxq.js";
 import { u as Permission } from "./permission-types-CAY-GU7e.js";
-import { _ as PrincipalSource, a as PermDock, n as DecideOptions, o as PermDockOptions } from "./permdock-B6Sf4T_S.js";
-import { m as ApprovalStore } from "./types-B_tiYvk8.js";
-import { a as AutomationSource } from "./automation-DqEoWHBc.js";
-import { n as ApprovalWaiter } from "./waiter-Bu9zAlE0.js";
-import { i as RunBinding, r as RunAutomation } from "./run-ticket-DbWI9f99.js";
+import { _ as PrincipalSource, a as PermDock, n as DecideOptions, o as PermDockOptions } from "./permdock-CprAPN3w.js";
+import { m as ApprovalStore } from "./types-DLvhVm1r.js";
+import { a as AutomationSource } from "./automation-C6Jg75xq.js";
+import { n as ApprovalWaiter } from "./waiter-CqUKX6CY.js";
+import { c as RunResource, i as RunBinding, r as RunAutomation } from "./run-ticket-ylovhyFQ.js";
 //#region src/workflow/create.d.ts
 type WorkflowPermDockOptions = PermDockOptions & {
   /** Signs the run tickets `start` mints. */
@@ -47,6 +47,14 @@ type AutomationOptions = {
   /** The run id (`jti`); a fresh UUID when absent. */
   readonly id?: string;
   readonly binding?: RunBinding;
+  /**
+   * The record the run is bound to. The automation's permissions on
+   * `resource.type` then hold on that id only, through an
+   * `authorization_details` `identifier`; a check on another id, or with no
+   * row, denies. Its other permissions are unchanged. A type none of its
+   * permissions is on denies the start.
+   */
+  readonly resource?: RunResource;
   readonly now?: Instant;
 };
 type StartAutomationResult = {
@@ -55,6 +63,7 @@ type StartAutomationResult = {
   readonly run: {
     readonly id: string;
     readonly automation: RunAutomation;
+    readonly resource?: RunResource;
   };
 } | {
   readonly outcome: "denied";

package/dist/{create-BVq1lNQE.d.ts → create-DBvUsgzK.d.ts}

@@ -1,9 +1,9 @@
-import { In as ApprovalRequiredDecision, T as Policy, Un as GrantedDecision, Vn as DeniedDecision, j as PolicyVocabulary, lr as Subject, sr as Principal } from "./policy-types-CCiDRZBH.js";
+import { Hn as ApprovalRequiredDecision, T as Policy, Yn as GrantedDecision, hr as Subject, j as PolicyVocabulary, pr as Principal, qn as DeniedDecision } from "./policy-types-DGIO_gxq.js";
 import { t as Operation } from "./operations-Ci_rT6Uo.js";
-import { _ as PrincipalSource, a as PermDock, o as PermDockOptions } from "./permdock-B6Sf4T_S.js";
-import { m as ApprovalStore, p as ApprovalStatus } from "./types-B_tiYvk8.js";
+import { _ as PrincipalSource, a as PermDock, o as PermDockOptions } from "./permdock-CprAPN3w.js";
+import { m as ApprovalStore, p as ApprovalStatus } from "./types-DLvhVm1r.js";
 import { n as ApprovalErrorCode } from "./errors-CHwoRRpB.js";
-import { t as ApprovalPrompt } from "./approval-prompt-PYagyQUj.js";
+import { t as ApprovalPrompt } from "./approval-prompt-3BqWczTt.js";
 //#region src/chat/subject.d.ts
 /**
  * The platform user behind a chat message or action. Fill it only from an event

package/dist/delivery/index.d.ts

@@ -1,5 +1,5 @@
-import { an as EmailCategory, rn as DeliveryFailureCause, tn as DeliveryChannel } from "../policy-types-CCiDRZBH.js";
-import { i as approvalUrlFor, n as ApprovalUrl, r as approvalPrompt, t as ApprovalPrompt } from "../approval-prompt-PYagyQUj.js";
-import { _ as TransportOptions, a as DeliveryReport, c as DeliveryTransport, d as EmailTransport, f as EmailUnsubscribe, g as TransportMessages, h as TransportItem, i as DeliveryMessages, l as DeliveryTransports, m as Recipient, n as ChatTransport, o as DeliveryResult, p as OutgoingEmail, r as DeliverOptions, s as DeliveryTarget, t as ChatMessage, u as EmailMessage, v as WebhookMessage, y as WebhookTransport } from "../types-yUuPR5Hy.js";
-import { C as audience, S as SubscriberEvent, _ as ParseConnectorResult, a as DeliveryPermDock, b as Audience, c as MemoryDelivery, d as memoryDeliveryTransport, f as CONNECTOR_SCHEMA, g as ConnectorKind, h as ConnectorIssue, i as isDeliveryTarget, l as MemoryDeliveryTransport, m as Connector, n as webhookTransport, o as DeliveryPermDockOptions, p as CONNECTOR_KINDS, r as isAddrSpec, s as createPermDock, t as WebhookTransportOptions, u as MemoryDeliveryTransportOptions, v as SiemDestination, w as subscribersFor, x as AudienceOptions, y as parseConnector } from "../index-Bv5iXPqU.js";
+import { dn as EmailCategory, ln as DeliveryFailureCause, sn as DeliveryChannel } from "../policy-types-DGIO_gxq.js";
+import { i as approvalUrlFor, n as ApprovalUrl, r as approvalPrompt, t as ApprovalPrompt } from "../approval-prompt-3BqWczTt.js";
+import { _ as TransportOptions, a as DeliveryReport, c as DeliveryTransport, d as EmailTransport, f as EmailUnsubscribe, g as TransportMessages, h as TransportItem, i as DeliveryMessages, l as DeliveryTransports, m as Recipient, n as ChatTransport, o as DeliveryResult, p as OutgoingEmail, r as DeliverOptions, s as DeliveryTarget, t as ChatMessage, u as EmailMessage, v as WebhookMessage, y as WebhookTransport } from "../types-CN0LsqbK.js";
+import { C as audience, S as SubscriberEvent, _ as ParseConnectorResult, a as DeliveryPermDock, b as Audience, c as MemoryDelivery, d as memoryDeliveryTransport, f as CONNECTOR_SCHEMA, g as ConnectorKind, h as ConnectorIssue, i as isDeliveryTarget, l as MemoryDeliveryTransport, m as Connector, n as webhookTransport, o as DeliveryPermDockOptions, p as CONNECTOR_KINDS, r as isAddrSpec, s as createPermDock, t as WebhookTransportOptions, u as MemoryDeliveryTransportOptions, v as SiemDestination, w as subscribersFor, x as AudienceOptions, y as parseConnector } from "../index-ymept53A.js";
 export { type ApprovalPrompt, type ApprovalUrl, type Audience, type AudienceOptions, CONNECTOR_KINDS, CONNECTOR_SCHEMA, type ChatMessage, type ChatTransport, type Connector, type ConnectorIssue, type ConnectorKind, type DeliverOptions, type DeliveryChannel, type DeliveryFailureCause, type DeliveryMessages, type DeliveryPermDock, type DeliveryPermDockOptions, type DeliveryReport, type DeliveryResult, type DeliveryTarget, type DeliveryTransport, type DeliveryTransports, type EmailCategory, type EmailMessage, type EmailTransport, type EmailUnsubscribe, type MemoryDelivery, type MemoryDeliveryTransport, type MemoryDeliveryTransportOptions, type OutgoingEmail, type ParseConnectorResult, type Recipient, type SiemDestination, type SubscriberEvent, type TransportItem, type TransportMessages, type TransportOptions, type WebhookMessage, type WebhookTransport, type WebhookTransportOptions, approvalPrompt, approvalUrlFor, audience, createPermDock, isAddrSpec, isDeliveryTarget, memoryDeliveryTransport, parseConnector, subscribersFor, webhookTransport };

package/dist/delivery/index.js

@@ -1,5 +1,5 @@
 import { n as approvalUrlFor, t as approvalPrompt } from "../approval-prompt-B8hQY69x.js";
-import { n as subscribersFor, t as audience } from "../audience-BAkBDMqn.js";
+import { n as subscribersFor, t as audience } from "../audience-DTjR8xet.js";
 import { t as CONNECTOR_SCHEMA } from "../connector-schema-CYLQNMYq.js";
 import { a as parseConnector, i as CONNECTOR_KINDS, n as createPermDock, r as memoryDeliveryTransport, t as webhookTransport } from "../delivery-BupfvJIV.js";
 import { i as isDeliveryTarget, n as isAddrSpec } from "../target-qdEAnnhU.js";

package/dist/{denied-text-CHNlVInN.d.ts → denied-text-DHldhVUv.d.ts}

@@ -1,4 +1,4 @@
-import { Ln as Decision } from "./policy-types-CCiDRZBH.js";
+import { Un as Decision } from "./policy-types-DGIO_gxq.js";
 import { u as Permission } from "./permission-types-CAY-GU7e.js";
 //#region src/agent/denied-text.d.ts
 /**

package/dist/{describe-ByS9LgHK.d.ts → describe-BbFPBSms.d.ts}

@@ -1,4 +1,4 @@
-import { Bn as DenialReason, Ln as Decision, Vn as DeniedDecision } from "./policy-types-CCiDRZBH.js";
+import { Kn as DenialReason, Un as Decision, qn as DeniedDecision } from "./policy-types-DGIO_gxq.js";
 import { u as Permission } from "./permission-types-CAY-GU7e.js";
 //#region src/core/describe.d.ts
 type DecisionDescription = {