permdock 0.8.0 → 0.9.0

package/dist/terminal/index.d.ts

@@ -1,9 +1,9 @@
-import { Ln as Decision, Rt as Instant, T as Policy, j as PolicyVocabulary, lr as Subject, sr as Principal } from "../policy-types-CCiDRZBH.js";
+import { T as Policy, Un as Decision, Wt as Instant, hr as Subject, j as PolicyVocabulary, pr as Principal } from "../policy-types-DGIO_gxq.js";
 import { u as Permission } from "../permission-types-CAY-GU7e.js";
-import { a as PermDock } from "../permdock-B6Sf4T_S.js";
-import { m as ApprovalStore } from "../types-B_tiYvk8.js";
-import { a as ProblemDetails, t as ApprovalHint } from "../errors-zi_4T-rx.js";
-import { t as InstanceOptions } from "../instance-options-B0KXqTrJ.js";
+import { a as PermDock } from "../permdock-CprAPN3w.js";
+import { m as ApprovalStore } from "../types-DLvhVm1r.js";
+import { a as ProblemDetails, t as ApprovalHint } from "../errors-BIM4MFsJ.js";
+import { t as InstanceOptions } from "../instance-options-CoHn-0e8.js";
 //#region src/terminal/types.d.ts
 type TokenSourceName = "device" | "keychain" | "env" | "ci-oidc";
 type TokenSource = TokenSourceName | {

package/dist/terminal/index.js

@@ -2,12 +2,12 @@ import { t as compact } from "../compact-CAf557ZB.js";
 import { a as deniedMessage, i as approvalMessage, n as PermDockDeniedError, t as PermDockApprovalRequiredError } from "../errors-B6R_lg2a.js";
 import { h as secondsAt } from "../time-nR1JesoH.js";
 import { n as resourceRef } from "../resource-ref-CaS9yVPi.js";
-import { l as withApp } from "../permdock-L-_I_3zP.js";
+import { l as withApp } from "../permdock-BvjivVb9.js";
 import { r as isSubject } from "../subject-BGoM5o8B.js";
 import { n as readBodyText } from "../body-text-DQhcmqdY.js";
 import { l as storedApprovalToken, s as resumeDecision } from "../helpers-DJicaG6f.js";
 import { t as timeoutSignal } from "../timeout-D51niuQP.js";
-import { n as resolveOrNull, t as buildInstance } from "../build-instance-CNWaYJyr.js";
+import { n as resolveOrNull, t as buildInstance } from "../build-instance-BWXqwQYU.js";
 import { a as refreshCredential, o as revokeCredential, s as runDeviceFlow, t as TERMINAL_TIMEOUT_MS } from "../device-BwbJNmb2.js";
 import { i as writeCredentials, n as deleteCredentials, r as readCredentials } from "../storage-C2bWdvJH.js";
 import { createInterface } from "node:readline";

package/dist/testing/core.d.ts

@@ -1,2 +1,2 @@
-import { S as policyMatrix, _ as DescribePolicyConfig, a as OrmParityScenario, b as PolicyMatrixCell, c as RlsFieldsOutcome, d as RlsParityOptions, f as RlsParityReport, g as testRlsParity, h as RlsQueryResult, i as OrmParityRunInput, l as RlsParityCase, m as RlsQueryFn, n as OrmParityOptions, o as testOrmParity, p as RlsParitySubject, r as OrmParityReport, s as RlsDbOutcome, t as OrmParityCase, u as RlsParityFixture, v as MatrixCell, x as PolicyMatrixReport, y as MatrixOutcome } from "../core-hWIARPDz.js";
+import { S as policyMatrix, _ as DescribePolicyConfig, a as OrmParityScenario, b as PolicyMatrixCell, c as RlsFieldsOutcome, d as RlsParityOptions, f as RlsParityReport, g as testRlsParity, h as RlsQueryResult, i as OrmParityRunInput, l as RlsParityCase, m as RlsQueryFn, n as OrmParityOptions, o as testOrmParity, p as RlsParitySubject, r as OrmParityReport, s as RlsDbOutcome, t as OrmParityCase, u as RlsParityFixture, v as MatrixCell, x as PolicyMatrixReport, y as MatrixOutcome } from "../core-CFepFiDP.js";
 export { type DescribePolicyConfig, type MatrixCell, type MatrixOutcome, type OrmParityCase, type OrmParityOptions, type OrmParityReport, type OrmParityRunInput, type OrmParityScenario, type PolicyMatrixCell, type PolicyMatrixReport, type RlsDbOutcome, type RlsFieldsOutcome, type RlsParityCase, type RlsParityFixture, type RlsParityOptions, type RlsParityReport, type RlsParitySubject, type RlsQueryFn, type RlsQueryResult, policyMatrix, testOrmParity, testRlsParity };

package/dist/testing/core.js

@@ -1 +1 @@
-export { r as policyMatrix, t as testOrmParity, n as testRlsParity } from "../core-H-mbhpZc.js";
+export { r as policyMatrix, t as testOrmParity, n as testRlsParity } from "../core-DzVINFbU.js";

package/dist/testing/index.d.ts

@@ -1,29 +1,29 @@
-import { Gt as Snapshot, J as EntitlementSource, K as DecisionProvider, Q as LimitStore, T as Policy, U as CredentialVerifier, W as CustomRoleSource, at as SettingsSource, dt as TokenVerifier, et as MembershipSource, it as RelationSource, lr as Subject, mt as WhereCompiler, or as Membership, ot as SnapshotSource, q as DecisionSink, sr as Principal, st as SubjectResolver, tn as DeliveryChannel, ut as TokenSigner } from "../policy-types-CCiDRZBH.js";
+import { G as CustomRoleSource, J as DecisionSink, T as Policy, U as CredentialVerifier, Y as EntitlementSource, Zt as Snapshot, bt as WhereCompiler, ct as SnapshotSource, dt as SubjectResolver, et as LimitStore, fr as Membership, hr as Subject, ht as TokenVerifier, mt as TokenSigner, nt as MembershipSource, ot as RelationSource, pr as Principal, q as DecisionProvider, sn as DeliveryChannel, st as SettingsSource } from "../policy-types-DGIO_gxq.js";
 import { g as ResourceInit, l as InferPermissionTree, u as Permission } from "../permission-types-CAY-GU7e.js";
 import { r as Role } from "../vocabulary-DEJ5j4mR.js";
-import { st as LegacyCheck } from "../index-BW_0MZOS.js";
-import { D as ApprovalPolicySource, _ as PrincipalSource, a as PermDock, b as Limits, h as PrincipalIdentity } from "../permdock-B6Sf4T_S.js";
-import { s as PolicySource } from "../hosted-Cmtxogd0.js";
-import { a as ApprovalDelegationSource, m as ApprovalStore } from "../types-B_tiYvk8.js";
-import { a as ProblemDetails } from "../errors-zi_4T-rx.js";
-import { c as ModelMap, t as AgentPermDock, u as ToolMap } from "../create-BSNrVuxh.js";
-import { c as AccessReviewStore } from "../types-B2mlGuhW.js";
-import { R as IdempotencyStore } from "../index-_9UiQIkt.js";
+import { Ut as VersionCache, st as LegacyCheck } from "../index-vYjMrXyK.js";
+import { D as ApprovalPolicySource, _ as PrincipalSource, a as PermDock, b as Limits, h as PrincipalIdentity } from "../permdock-CprAPN3w.js";
+import { s as PolicySource } from "../hosted-DVxlLZMe.js";
+import { a as ApprovalDelegationSource, m as ApprovalStore } from "../types-DLvhVm1r.js";
+import { a as ProblemDetails } from "../errors-BIM4MFsJ.js";
+import { c as ModelMap, t as AgentPermDock, u as ToolMap } from "../create-BPUopdfL.js";
+import { c as AccessReviewStore } from "../types-B2efzoSX.js";
+import { R as IdempotencyStore } from "../index-DJwEgYzA.js";
 import { n as RevocationFeed } from "../revocations-BaUXHM1N.js";
-import { s as SupportSessionSource } from "../index-B8s204GL.js";
-import { a as AutomationSource, t as Automation } from "../automation-DqEoWHBc.js";
-import { c as DeliveryTransport, g as TransportMessages } from "../types-yUuPR5Hy.js";
+import { s as SupportSessionSource } from "../index-CV-7DWeD.js";
+import { a as AutomationSource, t as Automation } from "../automation-C6Jg75xq.js";
+import { c as DeliveryTransport, g as TransportMessages } from "../types-CN0LsqbK.js";
 import { r as SupabaseHookManifest } from "../manifest-CzzWtnAb.js";
 import { t as supabaseMembershipsBudget } from "../budget-hYsPz_yE.js";
-import { t as CloudApproverOptions } from "../types-AMJ5qoU_.js";
-import { n as ApprovalWaiter } from "../waiter-Bu9zAlE0.js";
-import { g as SetQueue, l as ReplayStore } from "../types-DjuMBNF9.js";
-import { r as SnapshotStorage } from "../types-HzqOtvsJ.js";
-import { x as DirectoryStore } from "../index-BT5-1VsX.js";
-import { S as SsfStreamStore } from "../index-BhxEUY9J.js";
-import { S as policyMatrix, _ as DescribePolicyConfig, a as OrmParityScenario, b as PolicyMatrixCell, c as RlsFieldsOutcome, d as RlsParityOptions, f as RlsParityReport, g as testRlsParity, h as RlsQueryResult, i as OrmParityRunInput, l as RlsParityCase, m as RlsQueryFn, n as OrmParityOptions, o as testOrmParity, p as RlsParitySubject, r as OrmParityReport, s as RlsDbOutcome, t as OrmParityCase, u as RlsParityFixture, v as MatrixCell, x as PolicyMatrixReport, y as MatrixOutcome } from "../core-hWIARPDz.js";
+import { t as CloudApproverOptions } from "../types-BB-zWDcR.js";
+import { n as ApprovalWaiter } from "../waiter-CqUKX6CY.js";
+import { g as SetQueue, l as ReplayStore } from "../types-DsHGPtkR.js";
+import { r as SnapshotStorage } from "../types-CWBsAwqn.js";
+import { x as DirectoryStore } from "../index-Dj2qF9VC.js";
+import { S as SsfStreamStore } from "../index-BinlXeU-.js";
+import { S as policyMatrix, _ as DescribePolicyConfig, a as OrmParityScenario, b as PolicyMatrixCell, c as RlsFieldsOutcome, d as RlsParityOptions, f as RlsParityReport, g as testRlsParity, h as RlsQueryResult, i as OrmParityRunInput, l as RlsParityCase, m as RlsQueryFn, n as OrmParityOptions, o as testOrmParity, p as RlsParitySubject, r as OrmParityReport, s as RlsDbOutcome, t as OrmParityCase, u as RlsParityFixture, v as MatrixCell, x as PolicyMatrixReport, y as MatrixOutcome } from "../core-CFepFiDP.js";
 import { a as SaasProject } from "../permissions-Bx6UI8n1.js";
-import { n as saasPolicy } from "../policy-Ba4bDhaj.js";
+import { n as saasPolicy } from "../policy-BycVKnXv.js";
 import { expectTypeOf } from "vitest";
 //#region src/testing/describe-policy.d.ts
 /** `policyMatrix` under Vitest: one test per cell, plus the exhaustive check. */
@@ -640,6 +640,7 @@ export declare function testSnapshotSource(source: SnapshotSource): void;
 export declare function testPolicySource(source: PolicySource, options?: {
   readonly policy?: Policy;
 }): void;
+export declare function testVersionCache(cache: VersionCache): void;
 //#endregion
 //#region src/testing/conformance/providers.d.ts
 type DecisionProviderRunnerOptions = {

package/dist/testing/index.js

@@ -2,7 +2,7 @@ import { r as isRecord } from "../compact-CAf557ZB.js";
 import { n as freezeDeep } from "../freeze-jjan0lCv.js";
 import { i as principal } from "../refs-C8BKxc_e.js";
 import { n as role, r as allow } from "../role-builder-BK2-T6oD.js";
-import { A as memoryCustomRoleSource, S as memoryLimitStore, T as approvalPoliciesFor, d as snapshotFor, x as limits } from "../src-DZ0l9UAg.js";
+import { C as memoryLimitStore, E as approvalPoliciesFor, S as limits, d as snapshotFor, j as memoryCustomRoleSource } from "../src-C_pi2Rnh.js";
 import { t as memoryRevocationFeed } from "../revocations-Bhr0aMIC.js";
 import { n as loadPrincipalByIdentity, t as loadPrincipal } from "../principal-source-C6N60GtM.js";
 import { v as resource } from "../permission-registry-B8tYxPIt.js";
@@ -15,10 +15,10 @@ import { t as byCodePoint } from "../compare-DTfyUunF.js";
 import { r as definePolicy } from "../policy-CLQ8__GF.js";
 import { c as mergeHostedGrants, l as parsePolicyDocument } from "../hosted-D0IzESu_.js";
 import { t as definePermissions } from "../permissions-CVXmRILq.js";
-import { T as validateCustomRole } from "../evaluate-Dd8Ta0Ie.js";
+import { T as validateCustomRole } from "../evaluate-BAmf_AQd.js";
 import { n as parseSnapshot } from "../snapshot-CXlzi69u.js";
 import { n as fromSnapshot } from "../from-snapshot-DCakWRsr.js";
-import { t as getPermDock } from "../permdock-L-_I_3zP.js";
+import { t as getPermDock } from "../permdock-BvjivVb9.js";
 import { t as APPROVAL_HEADER } from "../types-CcUXciSj.js";
 import { i as memoryApprovalStore } from "../store-RNFvaJJv.js";
 import { t as catalogFingerprint } from "../catalog-fingerprint-e6aCWosn.js";
@@ -35,10 +35,10 @@ import { c as quoteSqlTable, o as quoteSqlIdent } from "../sql-0WjxIp9g.js";
 import { i as cloudEndpoints, n as cloud, s as approverHeaders, t as bearerChallenge } from "../challenge-DImNcR7B.js";
 import { t as supabaseMembershipsBudget } from "../budget-BELja5A9.js";
 import { t as supabaseManifestSchema } from "../manifest-schema-2r37XRhD.js";
-import { t as PUSHED_POLICY_SCHEMA } from "../pushed-policy-ITwYKvvH.js";
-import { i as policyMatrixLayout, n as testRlsParity, r as policyMatrix, t as testOrmParity } from "../core-H-mbhpZc.js";
-import { i as saasPermissions } from "../permissions-mDcTWoBs.js";
-import { C as saasOrg, E as saasSeed, S as saasMemberships, a as saasProject, g as verifySaasSession, h as signSaasToken, k as saasPolicy, t as saasDoc, w as saasPrincipal, x as saasCustomRoles } from "../saas-iWnUdwCt.js";
+import { t as PUSHED_POLICY_SCHEMA } from "../pushed-policy-CDuOL2de.js";
+import { i as policyMatrixLayout, n as testRlsParity, r as policyMatrix, t as testOrmParity } from "../core-DzVINFbU.js";
+import { i as saasPermissions } from "../permissions-CYcHj_w7.js";
+import { C as saasOrg, E as saasSeed, S as saasMemberships, a as saasProject, g as verifySaasSession, h as signSaasToken, k as saasPolicy, t as saasDoc, w as saasPrincipal, x as saasCustomRoles } from "../saas-DK4V-3Is.js";
 import { t as POLICY_NOT_PUBLISHED } from "../problem-types-DSsRfONQ.js";
 import { t as require__2020 } from "../2020-CJbO8Bvz.js";
 import { afterAll, assert, beforeAll, describe, expect, expectTypeOf, it, vi } from "vitest";
@@ -2456,6 +2456,59 @@ function testPolicySource(source, options = {}) {
 		});
 	}
 }
+function testVersionCache(cache) {
+	const counted = (version) => {
+		const calls = { count: 0 };
+		const read = async () => {
+			calls.count += 1;
+			return version;
+		};
+		return {
+			calls,
+			read
+		};
+	};
+	it("reads live for a write and answers a read from that entry", async () => {
+		const { calls, read } = counted(4);
+		const principal = { id: "u-version-write" };
+		expect(await cache.current(principal, read, { live: true })).toBe(4);
+		expect(await cache.current(principal, read, { live: true })).toBe(4);
+		expect(calls.count).toBe(2);
+		if (cache.maxStaleMs > 0) {
+			expect(await cache.current(principal, read, { live: false })).toBe(4);
+			expect(calls.count).toBe(2);
+		}
+	});
+	it("shares one read between concurrent reads", async () => {
+		const { calls, read } = counted(2);
+		const principal = { id: "u-version-shared" };
+		const answers = await Promise.all(Array.from({ length: 5 }, async () => cache.current(principal, read, { live: false })));
+		expect(answers).toStrictEqual([
+			2,
+			2,
+			2,
+			2,
+			2
+		]);
+		expect(calls.count).toBe(1);
+	});
+	it("stores no rejected read", async () => {
+		const principal = { id: "u-version-failed" };
+		await expect(cache.current(principal, () => Promise.reject(/* @__PURE__ */ new Error("down")), { live: false })).rejects.toThrow("down");
+		const { calls, read } = counted(1);
+		expect(await cache.current(principal, read, { live: false })).toBe(1);
+		expect(calls.count).toBe(1);
+	});
+	it("reads again after evict", async () => {
+		const { calls, read } = counted(3);
+		const principal = { id: "u-version-evict" };
+		await cache.current(principal, read, { live: false });
+		cache.evict(principal.id);
+		await cache.current(principal, read, { live: false });
+		expect(calls.count).toBe(2);
+		expect(cache.stats().reads).toBeGreaterThanOrEqual(2);
+	});
+}
 //#endregion
 //#region src/testing/cloud-api/platform.ts
 const CATALOG = "https://permdock.com/schemas/catalog-v1.json";
@@ -6532,4 +6585,4 @@ const PROBLEM_EXAMPLES = Object.freeze({
 	}
 });
 //#endregion
-export { AGENT_THROWING_ROW, AGENT_THROWING_USER, PROBLEM_EXAMPLES, authzenTodoData, authzenTodoPermissions, authzenTodoPolicy, authzenTodoUsers, authzenTodoVectors, describePolicy, expectTypeOf, jwtFixtureAudience, jwtFixtureIssuer, jwtFixtureJwks, jwtFixtureTokens, policyMatrix, seedRows, snapshotFixture, supabaseClaimFixtures, supabaseClaimVectors, supabaseHookManifestFixture, supabaseMembershipsBudget, testAccessReviewStore, testAgentAdapter, testAgentRuntime, testApprovalDelegationSource, testApprovalPolicySource, testApprovalStore, testApprovalWaiter, testAuthzen, testAutomationSource, testClientParity, testClientStore, testCloudApi, testCredentialVerifier, testCustomRoleSource, testDecisionProvider, testDecisionSink, testDeliveryTransport, testDirectoryStore, testEntitlementSource, testHttpAdapter, testIdempotencyStore, testLegacyParity, testLimitStore, testMembershipSource, testOrmParity, testPolicySource, testPrincipalSource, testRelationSource, testReplayStore, testRevocationFeed, testRlsParity, testSetQueue, testSettingsSource, testSnapshotSource, testSnapshotStorage, testSsfStreamStore, testSubjectResolver, testSupportSessionSource, testTokenSigner, testTokenVerifier, testWhereCompiler };
+export { AGENT_THROWING_ROW, AGENT_THROWING_USER, PROBLEM_EXAMPLES, authzenTodoData, authzenTodoPermissions, authzenTodoPolicy, authzenTodoUsers, authzenTodoVectors, describePolicy, expectTypeOf, jwtFixtureAudience, jwtFixtureIssuer, jwtFixtureJwks, jwtFixtureTokens, policyMatrix, seedRows, snapshotFixture, supabaseClaimFixtures, supabaseClaimVectors, supabaseHookManifestFixture, supabaseMembershipsBudget, testAccessReviewStore, testAgentAdapter, testAgentRuntime, testApprovalDelegationSource, testApprovalPolicySource, testApprovalStore, testApprovalWaiter, testAuthzen, testAutomationSource, testClientParity, testClientStore, testCloudApi, testCredentialVerifier, testCustomRoleSource, testDecisionProvider, testDecisionSink, testDeliveryTransport, testDirectoryStore, testEntitlementSource, testHttpAdapter, testIdempotencyStore, testLegacyParity, testLimitStore, testMembershipSource, testOrmParity, testPolicySource, testPrincipalSource, testRelationSource, testReplayStore, testRevocationFeed, testRlsParity, testSetQueue, testSettingsSource, testSnapshotSource, testSnapshotStorage, testSsfStreamStore, testSubjectResolver, testSupportSessionSource, testTokenSigner, testTokenVerifier, testVersionCache, testWhereCompiler };

package/dist/testing/saas/index.d.ts

@@ -1,8 +1,8 @@
-import { Q as LimitStore, Rt as Instant, Zn as Actor, it as RelationSource, lr as Subject, or as Membership, rr as Delegation, sr as Principal, tr as CustomRole } from "../../policy-types-CCiDRZBH.js";
+import { Wt as Instant, et as LimitStore, fr as Membership, hr as Subject, lr as Delegation, ot as RelationSource, pr as Principal, rr as Actor, sr as CustomRole } from "../../policy-types-DGIO_gxq.js";
 import { u as Permission } from "../../permission-types-CAY-GU7e.js";
-import { o as PermDockOptions } from "../../permdock-B6Sf4T_S.js";
+import { o as PermDockOptions } from "../../permdock-CprAPN3w.js";
 import { a as SaasProject, c as saasPlans, i as SaasFolderSchema, l as saasRoles, n as SaasDocSchema, o as SaasProjectSchema, r as SaasFolder, s as saasPermissions, t as SaasDoc, u as saasTenantRoleNames } from "../../permissions-Bx6UI8n1.js";
-import { n as saasPolicy, t as SAAS_API_KEY_LIMIT } from "../../policy-Ba4bDhaj.js";
+import { n as saasPolicy, t as SAAS_API_KEY_LIMIT } from "../../policy-BycVKnXv.js";
 import { StandardSchemaV1 } from "@standard-schema/spec";
 //#region src/testing/saas/schema.d.ts
 type FieldKind = "string" | "boolean" | "nullable-string";

package/dist/testing/saas/index.js

@@ -1,3 +1,3 @@
-import { a as saasPlans, c as rowSchema, i as saasPermissions, n as SaasFolderSchema, o as saasRoles, r as SaasProjectSchema, s as saasTenantRoleNames, t as SaasDocSchema } from "../../permissions-mDcTWoBs.js";
-import { C as saasOrg, D as saasUsers, E as saasSeed, O as SAAS_API_KEY_LIMIT, S as saasMemberships, T as saasRelations, _ as verifySaasToken, a as saasProject, b as SAAS_EXPIRED_AT, c as saasUser, d as saasIssuer, f as saasJwks, g as verifySaasSession, h as signSaasToken, i as saasLimitStore, k as saasPolicy, l as SAAS_TOKEN_TTL_SECONDS, m as saasPublicJwk, n as saasFolder, o as saasScenarioOptions, p as saasPrivateJwk, r as saasFolderScenarios, s as saasScenarios, t as saasDoc, u as saasAudience, v as saasSchemaSql, w as saasPrincipal, x as saasCustomRoles, y as saasSeedSql } from "../../saas-iWnUdwCt.js";
+import { a as saasPlans, c as rowSchema, i as saasPermissions, n as SaasFolderSchema, o as saasRoles, r as SaasProjectSchema, s as saasTenantRoleNames, t as SaasDocSchema } from "../../permissions-CYcHj_w7.js";
+import { C as saasOrg, D as saasUsers, E as saasSeed, O as SAAS_API_KEY_LIMIT, S as saasMemberships, T as saasRelations, _ as verifySaasToken, a as saasProject, b as SAAS_EXPIRED_AT, c as saasUser, d as saasIssuer, f as saasJwks, g as verifySaasSession, h as signSaasToken, i as saasLimitStore, k as saasPolicy, l as SAAS_TOKEN_TTL_SECONDS, m as saasPublicJwk, n as saasFolder, o as saasScenarioOptions, p as saasPrivateJwk, r as saasFolderScenarios, s as saasScenarios, t as saasDoc, u as saasAudience, v as saasSchemaSql, w as saasPrincipal, x as saasCustomRoles, y as saasSeedSql } from "../../saas-DK4V-3Is.js";
 export { SAAS_API_KEY_LIMIT, SAAS_EXPIRED_AT, SAAS_TOKEN_TTL_SECONDS, SaasDocSchema, SaasFolderSchema, SaasProjectSchema, rowSchema, saasAudience, saasCustomRoles, saasDoc, saasFolder, saasFolderScenarios, saasIssuer, saasJwks, saasLimitStore, saasMemberships, saasOrg, saasPermissions, saasPlans, saasPolicy, saasPrincipal, saasPrivateJwk, saasProject, saasPublicJwk, saasRelations, saasRoles, saasScenarioOptions, saasScenarios, saasSchemaSql, saasSeed, saasSeedSql, saasTenantRoleNames, saasUser, saasUsers, signSaasToken, verifySaasSession, verifySaasToken };

package/dist/testing/saas/permissions.js

@@ -1 +1 @@
-export { t as SaasDocSchema, n as SaasFolderSchema, r as SaasProjectSchema, i as saasPermissions, a as saasPlans, o as saasRoles, s as saasTenantRoleNames } from "../../permissions-mDcTWoBs.js";
+export { t as SaasDocSchema, n as SaasFolderSchema, r as SaasProjectSchema, i as saasPermissions, a as saasPlans, o as saasRoles, s as saasTenantRoleNames } from "../../permissions-CYcHj_w7.js";

package/dist/trpc/index.d.ts

@@ -1,10 +1,10 @@
-import { T as Policy, sr as Principal } from "../policy-types-CCiDRZBH.js";
+import { T as Policy, pr as Principal } from "../policy-types-DGIO_gxq.js";
 import { u as Permission } from "../permission-types-CAY-GU7e.js";
-import { a as PermDock } from "../permdock-B6Sf4T_S.js";
+import { a as PermDock } from "../permdock-CprAPN3w.js";
 import { n as RevocationFeed } from "../revocations-BaUXHM1N.js";
-import { D as ConnectionOptions, T as Connection, i as OpenApiHooks } from "../server-types-CIlpSA2G.js";
-import { t as ServerAdapterOptions } from "../bind-Cp2hBHzP.js";
-import { t as StreamProtectOptions } from "../stream-ltuLdtTG.js";
+import { D as ConnectionOptions, T as Connection, i as OpenApiHooks } from "../server-types-CyRN0-Cd.js";
+import { t as ServerAdapterOptions } from "../bind-YYjvfpB9.js";
+import { t as StreamProtectOptions } from "../stream-9y9qw51m.js";
 import { AnyTRPCMiddlewareFunction } from "@trpc/server";
 //#region src/trpc/create.d.ts
 type TrpcMiddlewareOpts<TCtx = object, TInput = unknown> = {

package/dist/trpc/index.js

@@ -1,8 +1,8 @@
 import { o as problemMessage } from "../http-DKLXrFGk.js";
 import { t as problemFromError } from "../map-error-pasIGqMT.js";
-import { n as attached } from "../bind-D_sZSVA3.js";
+import { n as attached } from "../bind-BNQA9JK9.js";
 import { i as isAsyncIterable, o as reloadAfter } from "../stream-CDvF0sJm.js";
-import { i as rpcCode, n as guardStream, r as problemBody, t as bindRpcKernel } from "../rpc-fNqAIqQk.js";
+import { i as rpcCode, n as guardStream, r as problemBody, t as bindRpcKernel } from "../rpc-vHIwyXCp.js";
 import { TRPCError, isTrackedEnvelope } from "@trpc/server";
 //#region src/trpc/create.ts
 const PROBLEM = Symbol.for("permdock.problem");

package/dist/{type-helpers-BIPIDa6a.d.ts → type-helpers-c7Xo_2Cu.d.ts}

@@ -1,4 +1,4 @@
-import { j as PolicyVocabulary, mn as ScopeNames } from "./policy-types-CCiDRZBH.js";
+import { bn as ScopeNames, j as PolicyVocabulary } from "./policy-types-DGIO_gxq.js";
 import { k as POLICY_SCOPES, u as Permission } from "./permission-types-CAY-GU7e.js";
 import { n as PlanTree } from "./vocabulary-DEJ5j4mR.js";
 import { o as OperationMap } from "./operations-Ci_rT6Uo.js";

package/dist/{types-B2mlGuhW.d.ts → types-B2efzoSX.d.ts}

@@ -1,4 +1,4 @@
-import { gn as Approver } from "./policy-types-CCiDRZBH.js";
+import { Sn as Approver } from "./policy-types-DGIO_gxq.js";
 //#region src/approvals/access-reviews/types.d.ts
 type AccessReviewStatus = "open" | "closed";
 type AccessReviewItemStatus = "pending" | "kept" | "revoked";

package/dist/{types-DHKPcqzr.d.ts → types-B6ExllNo.d.ts}

@@ -1,5 +1,5 @@
-import { en as DecisionEvent, j as PolicyVocabulary } from "./policy-types-CCiDRZBH.js";
-import { a as PermDock } from "./permdock-B6Sf4T_S.js";
+import { j as PolicyVocabulary, on as DecisionEvent } from "./policy-types-DGIO_gxq.js";
+import { a as PermDock } from "./permdock-CprAPN3w.js";
 //#region src/otel/types.d.ts
 declare const GENAI_SEMCONV_PIN = "1.37.0";
 declare const GEN_AI_TOOL_NAME = "gen_ai.tool.name";

package/dist/{types-AMJ5qoU_.d.ts → types-BB-zWDcR.d.ts}

@@ -1,8 +1,8 @@
-import { dt as TokenVerifier, lr as Subject, ot as SnapshotSource, q as DecisionSink, ut as TokenSigner } from "./policy-types-CCiDRZBH.js";
-import { s as PolicySource } from "./hosted-Cmtxogd0.js";
-import { m as ApprovalStore, u as ApprovalRequest } from "./types-B_tiYvk8.js";
+import { J as DecisionSink, ct as SnapshotSource, hr as Subject, ht as TokenVerifier, mt as TokenSigner } from "./policy-types-DGIO_gxq.js";
+import { s as PolicySource } from "./hosted-DVxlLZMe.js";
+import { m as ApprovalStore, u as ApprovalRequest } from "./types-DLvhVm1r.js";
 import { a as CatalogDocument } from "./types-ZzRGoViD.js";
-import { a as CatalogFinding } from "./sink-Dvi7YZG_.js";
+import { a as CatalogFinding } from "./sink-B5zoUW_O.js";
 //#region src/cloud/types.d.ts
 type CloudEndpointOptions = {
   readonly url?: string;

package/dist/{types-ah9NlU6j.d.ts → types-BMVDHvI0.d.ts}

@@ -1,4 +1,4 @@
-import { Zt as AuthEvent, sr as Principal } from "./policy-types-CCiDRZBH.js";
+import { pr as Principal, rn as AuthEvent } from "./policy-types-DGIO_gxq.js";
 import { t as ClaimsMap } from "./claims-map-D1Pb5oRq.js";
 import { t as ClientNames } from "./clients-C_NOET3z.js";
 import { StandardSchemaV1 } from "@standard-schema/spec";

package/dist/{types-djVzLlIV.d.ts → types-CEinc15V.d.ts}

@@ -1,9 +1,9 @@
-import { Gt as Snapshot, In as ApprovalRequiredDecision, Ln as Decision, Un as GrantedDecision, dt as TokenVerifier } from "./policy-types-CCiDRZBH.js";
+import { Hn as ApprovalRequiredDecision, Un as Decision, Yn as GrantedDecision, Zt as Snapshot, ht as TokenVerifier } from "./policy-types-DGIO_gxq.js";
 import { u as Permission } from "./permission-types-CAY-GU7e.js";
-import { a as PermDock } from "./permdock-B6Sf4T_S.js";
+import { a as PermDock } from "./permdock-CprAPN3w.js";
 import { t as PermissionBoundaryState } from "./boundary-C9ck-3uK.js";
-import { t as ActionResult } from "./action-result-CL-QCITA.js";
-import { d as ProtectedActionView, f as ProviderOptionsBase, g as ClientStore, l as PermissionState } from "./types-B_d_g7T3.js";
+import { t as ActionResult } from "./action-result-BcudBQOF.js";
+import { d as ProtectedActionView, f as ProviderOptionsBase, g as ClientStore, l as PermissionState } from "./types-tQB2CEnY.js";
 import { Snippet } from "svelte";
 import { Readable } from "svelte/store";
 //#region src/client/views.d.ts

package/dist/{types-yUuPR5Hy.d.ts → types-CN0LsqbK.d.ts}

@@ -1,6 +1,6 @@
-import { Un as GrantedDecision, an as EmailCategory, nn as DeliveryEvent, rn as DeliveryFailureCause, tn as DeliveryChannel } from "./policy-types-CCiDRZBH.js";
-import { s as CloudEvent } from "./sink-Dvi7YZG_.js";
-import { t as ApprovalPrompt } from "./approval-prompt-PYagyQUj.js";
+import { Yn as GrantedDecision, cn as DeliveryEvent, dn as EmailCategory, ln as DeliveryFailureCause, sn as DeliveryChannel } from "./policy-types-DGIO_gxq.js";
+import { s as CloudEvent } from "./sink-B5zoUW_O.js";
+import { t as ApprovalPrompt } from "./approval-prompt-3BqWczTt.js";
 //#region src/delivery/types.d.ts
 /**
  * Who a delivery goes to. `{ principal }` names an app principal and the

package/dist/{types-HzqOtvsJ.d.ts → types-CWBsAwqn.d.ts}

@@ -1,7 +1,7 @@
-import { Gt as Snapshot, dt as TokenVerifier, ot as SnapshotSource } from "./policy-types-CCiDRZBH.js";
-import { n as DescribeMessages } from "./describe-ByS9LgHK.js";
-import { _ as ClientStoreOptions } from "./types-B_d_g7T3.js";
-import { t as PermDockDefaults } from "./types-BJk0BKRX.js";
+import { Zt as Snapshot, ct as SnapshotSource, ht as TokenVerifier } from "./policy-types-DGIO_gxq.js";
+import { n as DescribeMessages } from "./describe-BbFPBSms.js";
+import { _ as ClientStoreOptions } from "./types-tQB2CEnY.js";
+import { t as PermDockDefaults } from "./types-rCRV4Ge-.js";
 import { ReactNode } from "react";
 //#region src/react-native/types.d.ts
 type SnapshotStorage = {

package/dist/{types-DC1Loeh3.d.ts → types-CzOeVvcC.d.ts}

@@ -1,5 +1,5 @@
-import { n as RoleMap, r as RoleThrough } from "./types-ah9NlU6j.js";
-import { s as SqlMembershipSource } from "./sources-B1Os_YUu.js";
+import { n as RoleMap, r as RoleThrough } from "./types-BMVDHvI0.js";
+import { s as SqlMembershipSource } from "./sources-CWG32C0G.js";
 //#region src/cli/core/errors.d.ts
 /**
  * 0 success, 1 failure, 2 usage, 3 action required, 130 interrupted (SIGINT or
@@ -408,7 +408,9 @@ type RlsConfig = {
    */
   readonly helpersOnly?: boolean;
   /**
-   * Emit `permitted_<resource>_rows(p_permission)` and its `_for` form for
+   * Emit `permitted_<resource>_rows(p_permission)`, its `_for` form,
+   * `permitted_<resource>_rows(p_permission, p_ids)` limited to candidate ids
+   * and the row-valued `permitted_<resource>_row(p_row, p_permission)` for
    * these resources, or for every resource a grant reaches with `true`: the row
    * ids the caller may act on, as the generated policies decide them.
    */

package/dist/{types-B_tiYvk8.d.ts → types-DLvhVm1r.d.ts}

@@ -1,4 +1,4 @@
-import { Dn as RelationGrantee, Rt as Instant, fr as AdapterId, gn as Approver, lr as Subject, o as ApprovalStage, or as Membership, r as ApprovalMode, un as WireDelegation } from "./policy-types-CCiDRZBH.js";
+import { Nn as RelationGrantee, Sn as Approver, Wt as Instant, fr as Membership, gn as WireDelegation, hr as Subject, o as ApprovalStage, r as ApprovalMode, vr as AdapterId } from "./policy-types-DGIO_gxq.js";
 import { M as AppData } from "./permission-types-CAY-GU7e.js";
 //#region src/approvals/types.d.ts
 type ApprovalStatus = "pending" | "approved" | "rejected" | "expired";

package/dist/{types-B4uqKDnp.d.ts → types-DlelvQk4.d.ts}

@@ -1,6 +1,6 @@
-import { Hn as ExplainedDecision, Ln as Decision, T as Policy, j as PolicyVocabulary, lr as Subject, or as Membership, sr as Principal } from "./policy-types-CCiDRZBH.js";
+import { Jn as ExplainedDecision, T as Policy, Un as Decision, fr as Membership, hr as Subject, j as PolicyVocabulary, pr as Principal } from "./policy-types-DGIO_gxq.js";
 import { f as PermissionTree, u as Permission } from "./permission-types-CAY-GU7e.js";
-import { C as PermissionCheck, a as PermDock, f as WhereResult, l as SimulateOptions, n as DecideOptions, o as PermDockOptions, r as DeriveOptions } from "./permdock-B6Sf4T_S.js";
+import { C as PermissionCheck, a as PermDock, f as WhereResult, l as SimulateOptions, n as DecideOptions, o as PermDockOptions, r as DeriveOptions } from "./permdock-CprAPN3w.js";
 //#region src/pdp/types.d.ts
 type RemotePdpAuth = {
   readonly bearer: string | (() => string | Promise<string>);

package/dist/{types-DjuMBNF9.d.ts → types-DsHGPtkR.d.ts}

@@ -1,5 +1,5 @@
-import { Y as JwtClaims, Zn as Actor, Zt as AuthEvent, dt as TokenVerifier, et as MembershipSource, lr as Subject, lt as TokenFailureCause, sr as Principal } from "./policy-types-CCiDRZBH.js";
-import { m as ApprovalStore } from "./types-B_tiYvk8.js";
+import { Z as JwtClaims, hr as Subject, ht as TokenVerifier, nt as MembershipSource, pr as Principal, pt as TokenFailureCause, rn as AuthEvent, rr as Actor } from "./policy-types-DGIO_gxq.js";
+import { m as ApprovalStore } from "./types-DLvhVm1r.js";
 import { n as RevocationFeed } from "./revocations-BaUXHM1N.js";
 import { t as ClaimsMap } from "./claims-map-D1Pb5oRq.js";
 import { t as ClientNames } from "./clients-C_NOET3z.js";

package/dist/{types-BJk0BKRX.d.ts → types-rCRV4Ge-.d.ts}

@@ -1,8 +1,8 @@
-import { Gt as Snapshot, In as ApprovalRequiredDecision, Ln as Decision, Un as GrantedDecision, dt as TokenVerifier } from "./policy-types-CCiDRZBH.js";
+import { Hn as ApprovalRequiredDecision, Un as Decision, Yn as GrantedDecision, Zt as Snapshot, ht as TokenVerifier } from "./policy-types-DGIO_gxq.js";
 import { u as Permission } from "./permission-types-CAY-GU7e.js";
-import { s as RowData } from "./permdock-B6Sf4T_S.js";
-import { n as DescribeMessages } from "./describe-ByS9LgHK.js";
-import { _ as ClientStoreOptions } from "./types-B_d_g7T3.js";
+import { s as RowData } from "./permdock-CprAPN3w.js";
+import { n as DescribeMessages } from "./describe-BbFPBSms.js";
+import { _ as ClientStoreOptions } from "./types-tQB2CEnY.js";
 import { ReactNode } from "react";
 //#region src/react/types.d.ts
 type PermDockProviderProps = ({

package/dist/{types-B_d_g7T3.d.ts → types-tQB2CEnY.d.ts}

@@ -1,8 +1,8 @@
-import { Gt as Snapshot, Ln as Decision, Zn as Actor, dt as TokenVerifier, j as PolicyVocabulary, rr as Delegation, sr as Principal } from "./policy-types-CCiDRZBH.js";
+import { Un as Decision, Zt as Snapshot, ht as TokenVerifier, j as PolicyVocabulary, lr as Delegation, pr as Principal, rr as Actor } from "./policy-types-DGIO_gxq.js";
 import { u as Permission } from "./permission-types-CAY-GU7e.js";
-import { a as PermDock } from "./permdock-B6Sf4T_S.js";
-import { n as DescribeMessages, t as DecisionDescription } from "./describe-ByS9LgHK.js";
-import { t as ActionResult } from "./action-result-CL-QCITA.js";
+import { a as PermDock } from "./permdock-CprAPN3w.js";
+import { n as DescribeMessages, t as DecisionDescription } from "./describe-BbFPBSms.js";
+import { t as ActionResult } from "./action-result-BcudBQOF.js";
 //#region src/client/refresh-on.d.ts
 /**
  * Calls `refresh` when the snapshot may be out of date (a membership event, a

package/dist/unplugin/index.d.ts

@@ -1,4 +1,4 @@
-import { s as PermDockPluginOptions } from "../types-DC1Loeh3.js";
+import { s as PermDockPluginOptions } from "../types-CzOeVvcC.js";
 import { createUnplugin } from "unplugin";
 //#region src/unplugin/index.d.ts
 type CreateUnplugin = typeof createUnplugin<PermDockPluginOptions | undefined>;

package/dist/unplugin/index.js

@@ -1,4 +1,4 @@
-import { n as createCollectScheduler, r as report } from "../watch-Cx_WciLE.js";
+import { n as createCollectScheduler, r as report } from "../watch-BFDKqmUa.js";
 import { r as peerHint } from "../peer-Q0fuZ6hx.js";
 import { createRequire } from "node:module";
 //#region src/unplugin/index.ts

package/dist/usage-0hjZPIRX.js

@@ -0,0 +1 @@
+export { t as runUsage } from "./usage-B9EtHWLa.js";

package/dist/{usage-CxEzS4ey.js → usage-B9EtHWLa.js}

@@ -4,10 +4,10 @@ import { a as rel, r as listSourceFiles } from "./files-BSjrtIHw.js";
 import { o as USAGE_REPORT_SCHEMA } from "./version-DMQ0dnN5.js";
 import { c as jsonSchemaOf } from "./catalog-doc-DjMKzJp9.js";
 import { a as loadModule, n as asPolicy, s as pickNamed } from "./load-DjSU5KXO.js";
-import { r as runCollect } from "./collect-B7ZFAJU3.js";
+import { r as runCollect } from "./collect-WCl8cJQV.js";
 import { t as beforeFirst } from "./text-BMFRfBqc.js";
-import { t as DOCS_BASE } from "./manifest-Cgiq5oqc.js";
-import { r as findingOf } from "./output-tkju6U7R.js";
+import { t as DOCS_BASE } from "./manifest-B2QPh19C.js";
+import { r as findingOf } from "./output-DV5dwOTs.js";
 import { existsSync, readFileSync, realpathSync } from "node:fs";
 import { dirname, resolve } from "node:path";
 import { fileURLToPath, pathToFileURL } from "node:url";

package/dist/{usage-ab0PdusX.js → usage-CBzgwfIs.js}

@@ -16,7 +16,7 @@ const usage = defineLeaf({
 		}
 	},
 	async run(ctx, { flags }) {
-		return (await import("./usage-CYeXek0p.js")).runUsage({
+		return (await import("./usage-0hjZPIRX.js")).runUsage({
 			cwd: ctx.cwd,
 			config: ctx.config,
 			ignore: flags.ignore,

package/dist/{validation-error-YGg2mXyH.d.ts → validation-error-uvp-kyfO.d.ts}

@@ -1,4 +1,4 @@
-import { a as ProblemDetails } from "./errors-zi_4T-rx.js";
+import { a as ProblemDetails } from "./errors-BIM4MFsJ.js";
 import { StandardSchemaV1 } from "@standard-schema/spec";
 //#region src/core/validation-error.d.ts
 /**

package/dist/{verify-DZeqoWu5.js → verify-DlUcTDBz.js}

@@ -1,6 +1,6 @@
 import { a as sole, r as isRecord } from "./compact-CAf557ZB.js";
 import { l as isConditionRef, o as hasConditionOp } from "./refs-C8BKxc_e.js";
-import { A as memoryCustomRoleSource, b as memoryRelationSource } from "./src-DZ0l9UAg.js";
+import { j as memoryCustomRoleSource, x as memoryRelationSource } from "./src-C_pi2Rnh.js";
 import { c as listPermissions, h as formerKeys, n as findPermission } from "./permission-registry-B8tYxPIt.js";
 import { c as isEdgeRelation, l as isFieldRelation, u as isPrincipalRelation } from "./resource-relations-8-pCScBO.js";
 import { f as nowMillis, u as isoAt } from "./time-nR1JesoH.js";
@@ -10,8 +10,8 @@ import { o as requiresStandIn } from "./delegation-CDB6_keF.js";
 import { p as scopeField } from "./tenancy-5d1zVBvK.js";
 import { l as policyLevels, t as coveredLevels } from "./policy-CLQ8__GF.js";
 import { t as requiresApproval } from "./approval-required-TzNB9oQA.js";
-import { c as andWhere, m as customRoleScope, v as leveled, y as membershipsClaim } from "./evaluate-Dd8Ta0Ie.js";
-import { t as getPermDock } from "./permdock-L-_I_3zP.js";
+import { c as andWhere, m as customRoleScope, v as leveled, y as membershipsClaim } from "./evaluate-BAmf_AQd.js";
+import { t as getPermDock } from "./permdock-BvjivVb9.js";
 import { a as describeError, i as configError, u as usageResult } from "./errors-Vpu6rKHl.js";
 import { t as policyRowConditionKeys } from "./row-conditions-BAGHOmVq.js";
 import { s as writeFileEnsuringDir } from "./files-BSjrtIHw.js";
@@ -22,11 +22,11 @@ import { a as scopeMembershipTable, i as scopeColumn } from "./compile-EzEMB-7v.
 import "./budget-BELja5A9.js";
 import "./sources-CMAM-2A3.js";
 import { t as beforeFirst } from "./text-BMFRfBqc.js";
-import { t as DOCS_BASE } from "./manifest-Cgiq5oqc.js";
+import { t as DOCS_BASE } from "./manifest-B2QPh19C.js";
 import { n as fixtureSubject, r as loadFixtures, t as fixtureRow } from "./fixtures-A1_sp_tR.js";
 import { A as quoteQualified, N as arrayColumnsOf, O as quoteIdent, P as columnTypesOf, _ as subjectClaimJsonSql, a as customRolesOn, j as quoteTable, k as quoteLiteral, r as HELPERS, v as subjectClaimSql } from "./shared-Afctg7B0.js";
-import { C as accessSql, D as tokenScopeAllowsCall, S as requiresSql, ht as scopeTable, k as capabilityAccessSql, n as tableNameOf, o as graphPlan, q as apiKeyAllowsCall, r as tableNames } from "./tables-DeMNEy6V.js";
-import { c as breakGlassKey, f as compileConditionSql, l as collectGrants, m as sqlFunctionNames, p as contextRefs, s as breakGlassHolder } from "./ownership-B4L59T9u.js";
+import { C as accessSql, D as tokenScopeAllowsCall, S as requiresSql, ht as scopeTable, k as capabilityAccessSql, n as tableNameOf, o as graphPlan, q as apiKeyAllowsCall, r as tableNames } from "./tables-BqrxBCir.js";
+import { c as breakGlassKey, f as compileConditionSql, l as collectGrants, m as sqlFunctionNames, p as contextRefs, s as breakGlassHolder } from "./ownership-DA5YdYTm.js";
 import { t as membershipSourcesOf } from "./sources-qoIJQrJv.js";
 import { n as pgConnector, t as connectPgPool } from "./pg-DQTqRrou.js";
 import { _ as wrapSql, g as validitySql, m as andSql, s as viewName, t as FIELD_VIEWS } from "./fields-D0vUI6dq.js";

package/dist/vue/index.d.ts

@@ -1,13 +1,13 @@
-import { Gt as Snapshot, In as ApprovalRequiredDecision, Ln as Decision, dt as TokenVerifier, j as PolicyVocabulary, or as Membership } from "../policy-types-CCiDRZBH.js";
+import { Hn as ApprovalRequiredDecision, Un as Decision, Zt as Snapshot, fr as Membership, ht as TokenVerifier, j as PolicyVocabulary } from "../policy-types-DGIO_gxq.js";
 import { u as Permission } from "../permission-types-CAY-GU7e.js";
 import { r as Role } from "../vocabulary-DEJ5j4mR.js";
-import { d as UncheckedData, s as RowData } from "../permdock-B6Sf4T_S.js";
-import { c as requiredPlans } from "../errors-zi_4T-rx.js";
-import { i as describe, r as DescribeOptions, t as DecisionDescription } from "../describe-ByS9LgHK.js";
+import { d as UncheckedData, s as RowData } from "../permdock-CprAPN3w.js";
+import { c as requiredPlans } from "../errors-BIM4MFsJ.js";
+import { i as describe, r as DescribeOptions, t as DecisionDescription } from "../describe-BbFPBSms.js";
 import { t as PermissionBoundaryState } from "../boundary-C9ck-3uK.js";
-import { n as ProtectedAction, t as ActionResult } from "../action-result-CL-QCITA.js";
+import { n as ProtectedAction, t as ActionResult } from "../action-result-BcudBQOF.js";
 import { t as approvalHeaders } from "../headers-B9jQxjtW.js";
-import { a as FilterResult, b as eventSourceRefresh, c as PermissionSet, d as ProtectedActionView, f as ProviderOptionsBase, h as TenantView, i as ClientStatus, l as PermissionState, m as SubjectView, n as ApprovalState, o as GateMode, p as RolesOptions, r as ClientPermDock, s as GateView, t as ApprovalHandle, v as EventSourceRefreshOptions, y as RefreshTrigger } from "../types-B_d_g7T3.js";
+import { a as FilterResult, b as eventSourceRefresh, c as PermissionSet, d as ProtectedActionView, f as ProviderOptionsBase, h as TenantView, i as ClientStatus, l as PermissionState, m as SubjectView, n as ApprovalState, o as GateMode, p as RolesOptions, r as ClientPermDock, s as GateView, t as ApprovalHandle, v as EventSourceRefreshOptions, y as RefreshTrigger } from "../types-tQB2CEnY.js";
 import { ComputedRef, DefineComponent, MaybeRefOrGetter, Plugin, VNode } from "vue";
 //#region src/vue/types.d.ts
 type PermDockPluginOptions = ProviderOptionsBase & {

package/dist/{waiter-Bu9zAlE0.d.ts → waiter-CqUKX6CY.d.ts}

@@ -1,5 +1,5 @@
-import { Rt as Instant } from "./policy-types-CCiDRZBH.js";
-import { m as ApprovalStore } from "./types-B_tiYvk8.js";
+import { Wt as Instant } from "./policy-types-DGIO_gxq.js";
+import { m as ApprovalStore } from "./types-DLvhVm1r.js";
 //#region src/workflow/waiter.d.ts
 type ApprovalWaitOptions = {
   /**

package/dist/{watch-Cx_WciLE.js → watch-BFDKqmUa.js}

@@ -1,7 +1,7 @@
 import { i as dateAt } from "./time-nR1JesoH.js";
 import { a as describeError } from "./errors-Vpu6rKHl.js";
 import { t as defaultSrcPath } from "./files-BSjrtIHw.js";
-import { r as runCollect } from "./collect-B7ZFAJU3.js";
+import { r as runCollect } from "./collect-WCl8cJQV.js";
 import { n as isConfigFile, r as loadConfig } from "./config-BwPBfN0t.js";
 import { watch } from "node:fs";
 import { basename, dirname, relative, resolve, sep } from "node:path";

package/dist/watch-ClLuO2TL.js

@@ -0,0 +1 @@
+export { i as watchCollect } from "./watch-BFDKqmUa.js";

package/dist/webmcp/index.d.ts

@@ -1,4 +1,4 @@
-import { Gt as Snapshot, Ln as Decision } from "../policy-types-CCiDRZBH.js";
+import { Un as Decision, Zt as Snapshot } from "../policy-types-DGIO_gxq.js";
 import { f as PermissionTree, u as Permission } from "../permission-types-CAY-GU7e.js";
 import { StandardSchemaV1 } from "@standard-schema/spec";
 //#region src/webmcp/types.d.ts

package/dist/{who-can-rI7dCR9Q.js → who-can-BoDJm0Nc.js}

@@ -10,7 +10,7 @@ import { o as flattenGrantee } from "./grantee-Dke-9rd1.js";
 import { t as byCodePoint } from "./compare-DTfyUunF.js";
 import { r as relationCondition } from "./grantee-conditions-BrYPe-w0.js";
 import { c as nowSeconds, p as scopeField } from "./tenancy-5d1zVBvK.js";
-import { D as emptyListeners, t as evaluate } from "./evaluate-Dd8Ta0Ie.js";
+import { D as emptyListeners, t as evaluate } from "./evaluate-BAmf_AQd.js";
 import { n as relationId, t as pendingRelations } from "./relations-BxvRvDHK.js";
 import { t as relationWalk } from "./relation-walk-DK_gkgL7.js";
 //#region src/core/who-can.ts