permdock 0.1.0 → 0.2.0

package/dist/ai-sdk/index.js

@@ -1,7 +1,18 @@
 import { t as compact } from "../compact-y6vfu2_f.js";
-import { n as PermDockDeniedError, t as PermDockApprovalRequiredError } from "../errors-Iy71s7Oj.js";
-import { n as createAgentKernel, t as approvalTokenOf } from "../kernel-YOGCWNLf.js";
+import { n as PermDockDeniedError, t as PermDockApprovalRequiredError } from "../errors-Cz5zn0mW.js";
+import { t as instanceOptions } from "../instance-options-Dhhcnm3y.js";
+import { n as createAgentKernel, t as approvalTokenOf } from "../kernel-GSQnMz3O.js";
 //#region src/ai-sdk/create.ts
+const APPROVAL_STATUSES = /* @__PURE__ */ new Set([
+	"approved",
+	"not-applicable",
+	"denied",
+	"user-approval"
+]);
+function isToolApprovalResult(value) {
+	if (value === void 0 || APPROVAL_STATUSES.has(value)) return true;
+	return typeof value === "object" && value !== null && "type" in value && APPROVAL_STATUSES.has(value.type) && (!("reason" in value) || value.reason === void 0 || typeof value.reason === "string");
+}
 function contextOf(call) {
 	const runtime = call.runtimeContext !== null && typeof call.runtimeContext === "object" ? call.runtimeContext : {};
 	return compact({
@@ -56,24 +67,19 @@ function createPermDock(policy, options) {
 			actor: options.actor,
 			delegation: options.delegation,
 			tenant: options.tenant,
-			memberships: options.memberships,
-			relations: options.relations,
-			entitlements: options.entitlements,
-			customRoles: options.customRoles,
-			policies: options.policies,
-			store: options.store,
-			sink: options.sink,
-			limits: options.limits,
-			snapshots: options.snapshots
+			store: options.store
 		}),
+		...instanceOptions(options),
 		subject: options.subject,
 		tools: options.tools,
 		adapter: "ai-sdk"
 	});
 	const byPermission = /* @__PURE__ */ new Map();
 	for (const [name, binding] of Object.entries(options.tools)) byPermission.set(binding.permission.key, name);
+	const passes = (toolName) => options.unmapped === "allow" && !Object.hasOwn(options.tools, toolName);
 	const decide = (toolName, args, context) => kernel.decideTool(toolName, args, context, compact({ resumeToken: approvalTokenOf(context) }));
 	const toolApproval = async (call) => {
+		if (passes(call.toolCall.toolName)) return "approved";
 		const context = contextOf(call);
 		const verdict = await decide(call.toolCall.toolName, call.toolCall.input, context);
 		if (verdict.outcome === "granted") return "approved";
@@ -96,9 +102,10 @@ function createPermDock(policy, options) {
 		transformParams: async ({ params }) => {
 			if (params.tools === void 0) return params;
 			const allowed = await kernel.allowedToolNames(context);
-			const tools = params.tools.filter((tool) => typeof tool.name === "string" && allowed.has(tool.name));
+			const keeps = (name) => typeof name === "string" && (allowed.has(name) || passes(name));
+			const tools = params.tools.filter((tool) => keeps(tool.name));
 			const choice = params.toolChoice;
-			const forcedAway = choice?.type === "tool" && !(typeof choice.toolName === "string" && allowed.has(choice.toolName));
+			const forcedAway = choice?.type === "tool" && !keeps(choice.toolName);
 			return {
 				...params,
 				tools,
@@ -127,8 +134,18 @@ function createPermDock(policy, options) {
 		});
 		return true;
 	};
+	const composeToolApproval = (app) => async (call) => {
+		const verdict = await toolApproval(call);
+		if (verdict !== "approved") return verdict;
+		const answer = await app(call);
+		return isToolApprovalResult(answer) ? answer : {
+			type: "denied",
+			reason: "The tool approval answer was not valid."
+		};
+	};
 	return {
 		toolApproval,
+		composeToolApproval,
 		capabilityMiddleware,
 		needsApproval
 	};

package/dist/approvals/index.d.ts

@@ -1,3 +1,3 @@
-import { _ as approverRelationKey, a as ApprovalListFilter, c as ApprovalRequest, d as ApprovalStatus, f as ApprovalStore, g as approvalQuorum, h as DEFAULT_APPROVAL_TTL_MS, i as ApprovalInspectResult, l as ApprovalResumeFailure, m as ApprovalVerdict, n as ApprovalApprovers, o as ApprovalListQuery, p as ApprovalSubjectSummary, r as ApprovalCancelMeta, s as ApprovalPage, t as APPROVAL_HEADER, u as ApprovalSignature, v as escalationOpenAt } from "../types-B8w5PFtS.js";
-import { _ as approvalsHandler, a as cancelApprovals, b as isApprovalError, c as readApprovalHeader, d as resumeDecision, f as resumeFromHeader, g as ApprovalsHandlerOptions, h as approverRelations, i as memoryApprovalStore, l as requestApproval, m as ApproverRelationsOptions, n as applyApprovalVerdict, o as consumeApproval, p as summariseSubject, r as assertApprover, s as inspectApproval, t as MemoryApprovalStore, u as resolveApproval, v as ApprovalError, y as ApprovalErrorCode } from "../index-CltcQ4Bf.js";
-export { APPROVAL_HEADER, type ApprovalApprovers, type ApprovalCancelMeta, ApprovalError, type ApprovalErrorCode, type ApprovalInspectResult, type ApprovalListFilter, type ApprovalListQuery, type ApprovalPage, type ApprovalRequest, type ApprovalResumeFailure, type ApprovalSignature, type ApprovalStatus, type ApprovalStore, type ApprovalSubjectSummary, type ApprovalVerdict, type ApprovalsHandlerOptions, type ApproverRelationsOptions, DEFAULT_APPROVAL_TTL_MS, type MemoryApprovalStore, applyApprovalVerdict, approvalQuorum, approvalsHandler, approverRelationKey, approverRelations, assertApprover, cancelApprovals, consumeApproval, escalationOpenAt, inspectApproval, isApprovalError, memoryApprovalStore, readApprovalHeader, requestApproval, resolveApproval, resumeDecision, resumeFromHeader, summariseSubject };
+import { _ as approverRelationKey, a as ApprovalListFilter, c as ApprovalRequest, d as ApprovalStatus, f as ApprovalStore, g as approvalQuorum, h as DEFAULT_APPROVAL_TTL_MS, i as ApprovalInspectResult, l as ApprovalResumeFailure, m as ApprovalVerdict, n as ApprovalApprovers, o as ApprovalListQuery, p as ApprovalSubjectSummary, r as ApprovalCancelMeta, s as ApprovalPage, t as APPROVAL_HEADER, u as ApprovalSignature, v as escalationOpenAt } from "../types-vKyAMtcX.js";
+import { C as ApproverRelationsOptions, D as ApprovalError, E as approvalsHandler, O as ApprovalErrorCode, S as vouchApproval, T as ApprovalsHandlerOptions, _ as resolveApproval, a as approverPermissions, b as storedApprovalToken, c as decodeApprovalCursor, d as pageApprovals, f as cancelApprovals, g as requestApproval, h as readApprovalHeader, i as memoryApprovalStore, k as isApprovalError, l as encodeApprovalCursor, m as inspectApproval, n as applyApprovalVerdict, o as ApprovalCursorPosition, p as consumeApproval, r as assertApprover, s as approvalPageSize, t as MemoryApprovalStore, u as listAllApprovals, v as resumeDecision, w as approverRelations, x as summariseSubject, y as resumeFromHeader } from "../index-D6_cSa1z.js";
+export { APPROVAL_HEADER, type ApprovalApprovers, type ApprovalCancelMeta, type ApprovalCursorPosition, ApprovalError, type ApprovalErrorCode, type ApprovalInspectResult, type ApprovalListFilter, type ApprovalListQuery, type ApprovalPage, type ApprovalRequest, type ApprovalResumeFailure, type ApprovalSignature, type ApprovalStatus, type ApprovalStore, type ApprovalSubjectSummary, type ApprovalVerdict, type ApprovalsHandlerOptions, type ApproverRelationsOptions, DEFAULT_APPROVAL_TTL_MS, type MemoryApprovalStore, applyApprovalVerdict, approvalPageSize, approvalQuorum, approvalsHandler, approverPermissions, approverRelationKey, approverRelations, assertApprover, cancelApprovals, consumeApproval, decodeApprovalCursor, encodeApprovalCursor, escalationOpenAt, inspectApproval, isApprovalError, listAllApprovals, memoryApprovalStore, pageApprovals, readApprovalHeader, requestApproval, resolveApproval, resumeDecision, resumeFromHeader, storedApprovalToken, summariseSubject, vouchApproval };

package/dist/approvals/index.js

@@ -1,4 +1,5 @@
-import { n as isApprovalError, t as ApprovalError } from "../errors-m3u9TmDu.js";
-import { _ as approvalQuorum, a as requestApproval, c as resumeFromHeader, d as applyApprovalVerdict, f as assertApprover, g as DEFAULT_APPROVAL_TTL_MS, h as APPROVAL_HEADER, i as readApprovalHeader, m as approverRelations, n as consumeApproval, o as resolveApproval, p as memoryApprovalStore, r as inspectApproval, s as resumeDecision, t as cancelApprovals, u as summariseSubject, v as approverRelationKey, y as escalationOpenAt } from "../helpers-DnSOrhB9.js";
-import { t as approvalsHandler } from "../approvals-DaxY-Bdg.js";
-export { APPROVAL_HEADER, ApprovalError, DEFAULT_APPROVAL_TTL_MS, applyApprovalVerdict, approvalQuorum, approvalsHandler, approverRelationKey, approverRelations, assertApprover, cancelApprovals, consumeApproval, escalationOpenAt, inspectApproval, isApprovalError, memoryApprovalStore, readApprovalHeader, requestApproval, resolveApproval, resumeDecision, resumeFromHeader, summariseSubject };
+import { n as isApprovalError, t as ApprovalError } from "../errors-DRnGZHzF.js";
+import { a as decodeApprovalCursor, c as pageApprovals, d as approvalQuorum, f as approverRelationKey, i as approvalPageSize, l as APPROVAL_HEADER, n as assertApprover, o as encodeApprovalCursor, p as escalationOpenAt, r as memoryApprovalStore, s as listAllApprovals, t as applyApprovalVerdict, u as DEFAULT_APPROVAL_TTL_MS } from "../store-DMAWwAJV.js";
+import { a as requestApproval, c as resumeFromHeader, d as vouchApproval, f as approverPermissions, i as readApprovalHeader, l as storedApprovalToken, m as approverRelations, n as consumeApproval, o as resolveApproval, r as inspectApproval, s as resumeDecision, t as cancelApprovals, u as summariseSubject } from "../helpers-H_KARDVC.js";
+import { t as approvalsHandler } from "../approvals-DbYAuNkG.js";
+export { APPROVAL_HEADER, ApprovalError, DEFAULT_APPROVAL_TTL_MS, applyApprovalVerdict, approvalPageSize, approvalQuorum, approvalsHandler, approverPermissions, approverRelationKey, approverRelations, assertApprover, cancelApprovals, consumeApproval, decodeApprovalCursor, encodeApprovalCursor, escalationOpenAt, inspectApproval, isApprovalError, listAllApprovals, memoryApprovalStore, pageApprovals, readApprovalHeader, requestApproval, resolveApproval, resumeDecision, resumeFromHeader, storedApprovalToken, summariseSubject, vouchApproval };

package/dist/{approvals-DaxY-Bdg.js → approvals-DbYAuNkG.js}

@@ -1,9 +1,12 @@
 import { t as compact } from "./compact-y6vfu2_f.js";
-import { o as rootMembershipId } from "./scopes-cKVp_WTw.js";
-import { n as isApprovalError } from "./errors-m3u9TmDu.js";
-import { f as assertApprover, m as approverRelations } from "./helpers-DnSOrhB9.js";
+import { t as PROBLEM_BASE } from "./validation-error-CnjZ4t92.js";
+import { s as rootMembershipId } from "./scopes-CVdPrWN-.js";
+import { n as isApprovalError } from "./errors-DRnGZHzF.js";
+import { n as hasCredentials } from "./http-SO7qGttf.js";
+import { l as unauthenticatedProblem } from "./problem-B43ztKIm.js";
+import { n as assertApprover } from "./store-DMAWwAJV.js";
+import { m as approverRelations, p as heldPermissions } from "./helpers-H_KARDVC.js";
 //#region src/approvals/handler.ts
-const PROBLEM_BASE = "https://permdock.dev/problems";
 function problem(status, title, detail, slug) {
 	const body = {
 		type: `${PROBLEM_BASE}/${slug}`,
@@ -68,7 +71,8 @@ function belongsToTenant(subject, tenant) {
 async function mayResolve(request, subject, requireDistinct, options) {
 	try {
 		const relations = await approverRelations(request, subject, options);
-		assertApprover(request, subject, requireDistinct, /* @__PURE__ */ new Date(), relations);
+		const permissions = await heldPermissions(request, subject, options.permdockFor);
+		assertApprover(request, subject, requireDistinct, /* @__PURE__ */ new Date(), relations, permissions);
 		return true;
 	} catch {
 		return false;
@@ -143,11 +147,11 @@ async function readNote(request) {
 		return;
 	}
 }
-function mapError(error) {
+function mapError(error, credentials) {
 	if (!isApprovalError(error)) return problem(500, "Internal error", "approval store failed", "internal");
 	if (error.code === "approval-not-found") return problem(404, "Not found", error.message, "not-found");
 	if (error.code === "approval-not-pending" || error.code === "approval-expired" || error.code === "approver-repeated") return problem(409, "Conflict", error.message, "conflict");
-	if (error.code === "approver-unauthenticated") return problem(401, "Unauthenticated", error.message, "unauthenticated");
+	if (error.code === "approver-unauthenticated") return unauthenticatedProblem(credentials);
 	return problem(403, "Permission denied", error.message, "denied");
 }
 function approvalsHandler(store, options) {
@@ -159,7 +163,7 @@ function approvalsHandler(store, options) {
 		await store.expire();
 		const subject = await resolveSubject(request, options.subject);
 		const principal = subject?.principal ?? null;
-		if (subject === null || principal === null) return problem(401, "Unauthenticated", "approver must be authenticated", "unauthenticated");
+		if (subject === null || principal === null) return unauthenticatedProblem(hasCredentials(request));
 		try {
 			if (route.kind === "pending") {
 				const scoped = inboxScope(url, subject);
@@ -196,13 +200,15 @@ function approvalsHandler(store, options) {
 			const current = await store.get(route.token);
 			if (current === null) return problem(404, "Not found", "approval was not found", "not-found");
 			const relations = await approverRelations(current, subject, options);
-			assertApprover(current, subject, requireDistinct, /* @__PURE__ */ new Date(), relations);
+			const permissions = await heldPermissions(current, subject, options.permdockFor);
+			assertApprover(current, subject, requireDistinct, /* @__PURE__ */ new Date(), relations, permissions);
 			const note = await readNote(request);
 			const resolved = await store.resolve(route.token, compact({
 				status: route.kind === "approve" ? "approved" : "rejected",
 				by: subject,
 				note,
-				relations
+				relations,
+				permissions
 			}));
 			const signed = await signedApproval(resolved, options.signer, options.audience);
 			return json(200, compact({
@@ -210,7 +216,7 @@ function approvalsHandler(store, options) {
 				signed
 			}));
 		} catch (error) {
-			return mapError(error);
+			return mapError(error, hasCredentials(request));
 		}
 	};
 }

package/dist/approvers-DT4AVyIg.js

@@ -0,0 +1,52 @@
+import { n as isReadonlyArray } from "./compact-y6vfu2_f.js";
+//#region src/core/approvers.ts
+/** Approves when the approver holds `permission` in the request's tenant (any role, custom roles included). */
+function holder(permission) {
+	const key = permission?.key;
+	if (typeof key !== "string" || key === "") throw new Error("PermDock: holder() needs a permission");
+	return Object.freeze({
+		kind: "permission",
+		permission: key
+	});
+}
+/** Approves when the approver matches any one of `items`. */
+function anyOf(...items) {
+	if (items.length === 0) throw new Error("PermDock: anyOf() needs at least one approver");
+	return Object.freeze({
+		kind: "any-of",
+		of: Object.freeze([...items])
+	});
+}
+/** Approves when the approver matches every one of `items`; the same as a list. */
+function allOf(...items) {
+	if (items.length === 0) throw new Error("PermDock: allOf() needs at least one approver");
+	return Object.freeze([...items]);
+}
+/** A named approver for `approval.by`, matched on the approver's principal id. */
+function user(id) {
+	if (typeof id !== "string" || id === "") throw new Error("PermDock: user() needs a non-empty principal id");
+	return Object.freeze({
+		kind: "user",
+		id
+	});
+}
+function isUserApprover(value) {
+	return value !== null && typeof value === "object" && "kind" in value && value.kind === "user";
+}
+function flattenApprovers(input) {
+	if (input === void 0) return [];
+	if (isReadonlyArray(input)) return input;
+	return [input];
+}
+/** Every approver `input` names, inside `anyOf` groups too, for reading facts and labels. */
+function approverLeaves(input) {
+	return flattenApprovers(input).flatMap((item) => item.kind === "any-of" ? item.of.flatMap((entry) => approverLeaves(entry)) : [item]);
+}
+function isPermissionApprover(value) {
+	return value !== null && typeof value === "object" && "kind" in value && value.kind === "permission";
+}
+function isAnyOfInput(value) {
+	return value !== null && typeof value === "object" && "kind" in value && value.kind === "any-of";
+}
+//#endregion
+export { holder as a, isUserApprover as c, flattenApprovers as i, user as l, anyOf as n, isAnyOfInput as o, approverLeaves as r, isPermissionApprover as s, allOf as t };

package/dist/{arazzo-CTeVuXr5.js → arazzo-BAgw9ap6.js}

@@ -1,5 +1,5 @@
-import { p as arazzoFindings } from "./snapshot-DE8dE_hz.js";
-import { a as loadModule, o as pickNamed, t as asPermissionTree } from "./load-BZ24CpZP.js";
+import { u as arazzoFindings } from "./snapshot-Enxd0n-s.js";
+import { a as loadModule, o as pickNamed, t as asPermissionTree } from "./load-DhWEB9P1.js";
 import { existsSync, readFileSync } from "node:fs";
 import { resolve } from "node:path";
 //#region src/cli/arazzo.ts

package/dist/{arazzo-aoTkqYsJ.js → arazzo-cmvX2jDe.js}

@@ -1,4 +1,4 @@
-import { a as listArg, i as globalArgs, s as stringArg, t as COMMAND_DESCRIPTIONS } from "./commands-BMh_Etm2.js";
+import { a as listArg, i as globalArgs, s as stringArg, t as COMMAND_DESCRIPTIONS } from "./commands-DWOrSQic.js";
 import { defineCommand } from "citty";
 //#region src/cli/commands/arazzo.ts
 function arazzo(ctx) {
@@ -36,7 +36,7 @@ function arazzo(ctx) {
 			}
 		},
 		async run({ args: parsed, rawArgs }) {
-			const result = await (await import("./arazzo-CTeVuXr5.js")).runArazzo({
+			const result = await (await import("./arazzo-BAgw9ap6.js")).runArazzo({
 				cwd: ctx.cwd,
 				config: ctx.config,
 				rest: parsed._,

package/dist/authzen/index.d.ts

@@ -1,5 +1,6 @@
-import { $ as DecisionSink, C as Policy, at as LimitStore, ct as MembershipSource, ft as RelationSource, mr as Principal, pt as RoleSource, sn as PolicySource, tt as EntitlementSource, xt as SnapshotSource } from "../policy-CInmNGkM.js";
-import { f as ApprovalStore } from "../types-B8w5PFtS.js";
+import { C as Policy, Nr as Principal } from "../policy-CFZAr_Al.js";
+import { f as ApprovalStore } from "../types-vKyAMtcX.js";
+import { t as InstanceOptions } from "../instance-options-BK_rNOSC.js";
 //#region src/authzen/types.d.ts
 type AuthzenResourceAdapter = {
   readonly load?: (id: string) => unknown;
@@ -11,7 +12,7 @@ type AuthzenSubjectRecord = {
   readonly id: string;
   readonly [key: string]: unknown;
 };
-type AuthzenPermDockOptions<TUser = unknown> = {
+type AuthzenPermDockOptions<TUser = unknown> = InstanceOptions & {
   readonly subject: (request: Request) => TUser | Promise<TUser>;
   readonly anonymous?: boolean;
   /**
@@ -24,17 +25,7 @@ type AuthzenPermDockOptions<TUser = unknown> = {
   readonly subjects?: {
     readonly list?: () => readonly AuthzenSubjectRecord[] | Promise<readonly AuthzenSubjectRecord[]>;
   };
-  readonly memberships?: MembershipSource | readonly MembershipSource[];
-  /** The object graph for relation grants that walk a parent chain; without it they deny. */
-  readonly relations?: RelationSource;
-  readonly entitlements?: EntitlementSource;
-  readonly customRoles?: RoleSource;
-  /** Hosted grants, read once per instance; see `PolicySource`. */
-  readonly policies?: PolicySource;
   readonly store?: ApprovalStore;
-  readonly sink?: DecisionSink;
-  readonly limits?: LimitStore;
-  readonly snapshots?: SnapshotSource;
   readonly maxEvaluations?: number;
 };
 type AuthzenPermDock = {

package/dist/authzen/index.js

@@ -1,35 +1,15 @@
 import { t as compact } from "../compact-y6vfu2_f.js";
-import { C as ownGet, c as getResource, g as listPermissions } from "../permissions-DC7GROPA.js";
-import { t as createPermDock$1 } from "../permdock-yoZ7EjxX.js";
-import { l as validationProblem, n as batchTooLarge, o as problemResponse, t as PROBLEM_BASE } from "../problem-Cgp9-KZA.js";
-import { t as applyApprovalResume } from "../evaluations-DsAU9ppl.js";
-import { a as endsWithPath, c as mergeItem, d as pathnameOf, f as permissionOf, g as userFromEntity, h as tenantOf, i as delegationOf, l as pageOf, m as resourceIdOf, n as UNKNOWN, o as evaluationRow, p as resourceData, r as actorOf, s as isRecord, t as UNAVAILABLE, u as paged } from "../map-DowSO96j.js";
+import { E as ownGet, _ as listPermissions, c as getResource } from "../permissions-DVoF6dMt.js";
+import { t as PROBLEM_BASE } from "../validation-error-CnjZ4t92.js";
+import { t as createPermDock$1 } from "../permdock-CzqXjCpU.js";
+import { n as resourceRef } from "../resource-ref-CaS9yVPi.js";
+import { n as hasCredentials } from "../http-SO7qGttf.js";
+import { i as methodNotAllowed, l as unauthenticatedProblem, s as problemResponse, t as batchTooLarge, u as validationProblem } from "../problem-B43ztKIm.js";
+import { t as applyApprovalResume } from "../evaluations-tz6D9A2G.js";
+import { t as instanceOptions } from "../instance-options-Dhhcnm3y.js";
+import { n as permissionLookup } from "../evaluation-items-CfCCejQd.js";
+import { a as endsWithPath, c as mergeItem, d as pathnameOf, f as permissionOf, g as userFromEntity, h as tenantOf, i as delegationOf, l as pageOf, m as resourceIdOf, n as UNKNOWN, o as evaluationRow, p as resourceData, r as actorOf, s as isRecord, t as UNAVAILABLE, u as paged } from "../map-AcxK9o_D.js";
 //#region src/authzen/create.ts
-function unauthorized() {
-	return problemResponse({
-		type: `${PROBLEM_BASE}/unauthenticated`,
-		title: "Unauthenticated",
-		status: 401,
-		detail: "AuthZEN decision endpoint requires authentication"
-	}, void 0, {
-		outcome: "denied",
-		denials: [{
-			role: null,
-			reason: "anonymous"
-		}],
-		alternatives: []
-	});
-}
-function methodNotAllowed(allow) {
-	const response = problemResponse({
-		type: `${PROBLEM_BASE}/method-not-allowed`,
-		title: "Method not allowed",
-		status: 405,
-		detail: `use ${allow}`
-	});
-	response.headers.set("Allow", allow);
-	return response;
-}
 function notFound(detail) {
 	return problemResponse({
 		type: `${PROBLEM_BASE}/not-found`,
@@ -62,17 +42,9 @@ function withRequestId(request, response) {
 	if (id !== null && id !== "") response.headers.set("X-Request-ID", id);
 	return response;
 }
-function resourceRef(permission, data, item) {
-	const fromRow = data !== null && typeof data === "object" && "id" in data ? data.id : void 0;
-	const fromWire = item.resource?.id;
-	const id = typeof fromRow === "string" || typeof fromRow === "number" ? String(fromRow) : typeof fromWire === "string" || typeof fromWire === "number" ? String(fromWire) : void 0;
-	return compact({
-		type: permission.resource,
-		id
-	});
-}
 const createPermDock = (policy, options) => {
 	const maxEvaluations = options.maxEvaluations ?? 256;
+	const lookup = permissionLookup(policy.permissions);
 	const trusts = (pep) => {
 		const allow = options.trustedPep;
 		if (typeof allow !== "function" || pep === null) return false;
@@ -90,7 +62,7 @@ const createPermDock = (policy, options) => {
 		} catch {
 			pep = null;
 		}
-		if ((pep === null || pep === void 0) && !allowAnonymous) return unauthorized();
+		if ((pep === null || pep === void 0) && !allowAnonymous) return unauthenticatedProblem(hasCredentials(request));
 		return { pep: pep ?? null };
 	}
 	function instantiate(pep, item) {
@@ -100,13 +72,7 @@ const createPermDock = (policy, options) => {
 			actor: trusted ? actorOf(item) : void 0,
 			delegation: trusted ? delegationOf(item) : void 0,
 			tenant: tenantOf(item),
-			memberships: options.memberships,
-			relations: options.relations,
-			entitlements: options.entitlements,
-			customRoles: options.customRoles,
-			policies: options.policies,
-			sink: options.sink,
-			limits: options.limits
+			...instanceOptions(options)
 		}));
 	}
 	async function resourceOf(item) {
@@ -132,7 +98,7 @@ const createPermDock = (policy, options) => {
 		};
 	}
 	async function decideItem(request, pep, item) {
-		const permission = permissionOf(policy.permissions, item);
+		const permission = permissionOf(lookup, item);
 		if (permission === void 0) return UNKNOWN;
 		const resolved = await resourceOf(item);
 		if (resolved === void 0) return UNAVAILABLE;
@@ -149,7 +115,7 @@ const createPermDock = (policy, options) => {
 			trusted: false,
 			boundary: "decision-endpoint"
 		});
-		return applyApprovalResume(decision, permission, permdock, options.store, request, resourceRef(permission, data, item), "authzen");
+		return applyApprovalResume(decision, permission, permdock, options.store, request, resourceRef(permission, data, item.resource?.id), "authzen");
 	}
 	async function evaluation(request, pep) {
 		const body = await readJson(request);
@@ -220,7 +186,7 @@ const createPermDock = (policy, options) => {
 		if (!isRecord(body)) return validationProblem("search/resource body must be an object");
 		const item = body;
 		const type = typeof item.resource?.type === "string" ? item.resource.type : void 0;
-		const permission = permissionOf(policy.permissions, item);
+		const permission = permissionOf(lookup, item);
 		if (type === void 0 || permission === void 0) return Response.json(paged([], 0, 1));
 		const rows = await listRows(type, isRecord(item.resource?.properties) ? item.resource.properties : void 0);
 		const permdock = await instantiate(pep, item);

package/dist/better-auth/index.d.ts

@@ -1,5 +1,5 @@
-import { $ as DecisionSink, O as RoleBinding, hr as Subject, mr as Principal, pt as RoleSource } from "../policy-CInmNGkM.js";
-import { p as PermissionTree } from "../permissions-B4apnahQ.js";
+import { Nr as Principal, Pr as Subject, at as DecisionSink, k as RoleBinding, xt as RoleSource } from "../policy-CFZAr_Al.js";
+import { m as PermissionTree } from "../permissions-DttnqqxC.js";
 import { StandardSchemaV1 } from "@standard-schema/spec";
 //#region src/better-auth/types.d.ts
 type BetterAuthPrincipal = Principal & {
@@ -19,7 +19,20 @@ type BetterAuthAssignableRole = {
   readonly name: string;
   readonly statements: BetterAuthStatements;
 };
+type BetterAuthMemberQuery = {
+  readonly model: string;
+  where: {
+    readonly field: string;
+    readonly value: string;
+  }[];
+  readonly limit?: number;
+};
 type BetterAuthLike = {
+  readonly $context?: Promise<{
+    readonly adapter?: {
+      readonly findMany?: (query: BetterAuthMemberQuery) => Promise<unknown>;
+    };
+  }>;
   readonly api?: {
     readonly listOrganizations?: (args?: {
       readonly headers?: unknown;
@@ -49,6 +62,10 @@ type BetterAuthLike = {
 };
 type BetterAuthSubjectOptions = {
   readonly memberships?: "all" | "active";
+  /**
+   * Parses the user's additional fields into `principal.claims`. Without it no
+   * field reaches claims, because a user may edit their own additional fields.
+   */
   readonly schema?: StandardSchemaV1;
   readonly headers?: unknown;
   readonly declared?: readonly string[];
@@ -89,4 +106,4 @@ export declare function onRoleChange(refresh: (event: BetterAuthRoleChangeEvent)
 //#region src/better-auth/subject.d.ts
 export declare function subjectFromBetterAuth(auth: BetterAuthLike, session: unknown, options?: BetterAuthSubjectOptions): Promise<Subject<BetterAuthPrincipal>>;
 //#endregion
-export type { BetterAuthAccessControl, BetterAuthAccessRole, BetterAuthAssignableRole, BetterAuthLike, BetterAuthPrincipal, BetterAuthRoleChangeEvent, BetterAuthRoleSourceOptions, BetterAuthStatements, BetterAuthSubjectOptions, BetterAuthUnmatchedStatement, SeededRoles };
+export type { BetterAuthAccessControl, BetterAuthAccessRole, BetterAuthAssignableRole, BetterAuthLike, BetterAuthMemberQuery, BetterAuthPrincipal, BetterAuthRoleChangeEvent, BetterAuthRoleSourceOptions, BetterAuthStatements, BetterAuthSubjectOptions, BetterAuthUnmatchedStatement, SeededRoles };

package/dist/better-auth/index.js

@@ -1,7 +1,7 @@
 import { n as isReadonlyArray, t as compact } from "../compact-y6vfu2_f.js";
-import { n as freezeDeep } from "../freeze-y1_jQL4v.js";
-import { g as listPermissions } from "../permissions-DC7GROPA.js";
-import { d as role, t as allow } from "../policy-ANp36PnI.js";
+import { n as freezeDeep } from "../freeze-CrU8nQeX.js";
+import { _ as listPermissions } from "../permissions-DVoF6dMt.js";
+import { m as role, t as allow } from "../policy-xyWg7QdR.js";
 import { t as ignoreRejection } from "../thenable-okc2xDsj.js";
 import { t as anonymousSubject } from "../subject-C6dLxqHU.js";
 import { i as membershipEvent } from "../sink-Bd9PSyfq.js";
@@ -255,6 +255,24 @@ async function organizationIds(auth, tenant, options) {
 	}, [])).map((row) => isRecord(row) && typeof row["id"] === "string" ? row["id"] : void 0).filter((id) => id !== void 0 && id !== "");
 	return [...new Set(ids)];
 }
+const MEMBER_LIMIT = 5e3;
+/** Every member row of the user in one adapter query, or `undefined` without an adapter. */
+async function memberRows(auth, userId) {
+	try {
+		const findMany = (await auth.$context)?.adapter?.findMany;
+		if (findMany === void 0) return;
+		return parseMemberRows(await findMany({
+			model: "member",
+			where: [{
+				field: "userId",
+				value: userId
+			}],
+			limit: MEMBER_LIMIT
+		}), userId);
+	} catch {
+		return;
+	}
+}
 function memberIn(auth, userId, organizationId, tenant, headers) {
 	const active = auth.api?.getActiveMember;
 	if (organizationId === tenant && active !== void 0) return settle(async () => parseMemberRows(await active({ headers }), userId), []);
@@ -275,8 +293,11 @@ async function loadMemberships(auth, session, user, userId, tenant, options) {
 	let teams = parseTeamRows(session["teamMembers"] ?? session["teams"] ?? user["teamMembers"], userId);
 	const headers = options.headers;
 	if (members.length === 0) {
-		const ids = await organizationIds(auth, tenant, options);
-		members = (await Promise.all(ids.map((id) => memberIn(auth, userId, id, tenant, headers)))).flat();
+		const rows = options.memberships === "active" ? void 0 : await memberRows(auth, userId);
+		if (rows === void 0) {
+			const ids = await organizationIds(auth, tenant, options);
+			members = (await Promise.all(ids.map((id) => memberIn(auth, userId, id, tenant, headers)))).flat();
+		} else members = rows;
 	}
 	const listUserTeams = auth.api?.listUserTeams;
 	if (teams.length === 0 && listUserTeams !== void 0) teams = await settle(async () => parseTeamRows(await listUserTeams({ headers }), userId), []);
@@ -298,8 +319,7 @@ async function subjectFromBetterAuth(auth, session, options = {}) {
 		const roles = asRoles(user["role"] ?? user["roles"]);
 		const declared = options.declared;
 		const globalRoles = declared === void 0 ? roles : roles.filter((role) => declared.includes(role));
-		let extra = extraFields(user);
-		if (options.schema !== void 0) extra = validateClaims(extra, options.schema) ?? {};
+		const extra = options.schema === void 0 ? {} : validateClaims(extraFields(user), options.schema) ?? {};
 		const memberships = await loadMemberships(auth, session, user, id, tenant, options);
 		const principal = compact({
 			id,