permdock 0.1.0 → 0.2.0

package/dist/bind-VnYn2HKq.js

@@ -0,0 +1,97 @@
+import { t as compact } from "./compact-y6vfu2_f.js";
+import { o as invalidSignatureResponse } from "./evaluations-tz6D9A2G.js";
+import { t as instanceOptions } from "./instance-options-Dhhcnm3y.js";
+import { n as tenantScope } from "./adapter-context-mlWsVGGg.js";
+import { n as createServerKernel } from "./create-CPhDL6qx.js";
+//#region src/server/bind.ts
+/** The server kernel with the subject and actor callbacks reading the context `contextOf` maps a `Request` to. */
+function adapterKernel(policy, options, adapter, contextOf) {
+	return createServerKernel(policy, compact({
+		subject: (request) => {
+			const context = contextOf(request);
+			return context === void 0 ? null : options.subject(context);
+		},
+		actor: options.actor === void 0 ? void 0 : (request) => {
+			const context = contextOf(request);
+			return context === void 0 ? void 0 : options.actor?.(context);
+		},
+		...instanceOptions(options),
+		store: options.store,
+		pdp: options.pdp,
+		webBotAuth: options.webBotAuth,
+		revocations: options.revocations,
+		adapter,
+		wrap: options.otel
+	}));
+}
+/**
+* The kernel of a framework adapter, with the subject, actor and tenant
+* callbacks reading the framework context each `Request` was built from.
+*/
+function bindKernel(policy, options, adapter, toRequest) {
+	const contexts = /* @__PURE__ */ new WeakMap();
+	const bound = /* @__PURE__ */ new WeakMap();
+	const kernel = adapterKernel(policy, options, adapter, (request) => contexts.get(request));
+	const bind = (context) => {
+		const hit = bound.get(context);
+		if (hit !== void 0) return hit;
+		const request = toRequest(context);
+		bound.set(context, request);
+		contexts.set(request, context);
+		return request;
+	};
+	const rebind = (context) => {
+		const request = toRequest(context);
+		contexts.set(request, context);
+		const previous = bound.get(context);
+		if (previous !== void 0) kernel.shareSubject(previous, request);
+		return request;
+	};
+	const scopeOf = (context) => tenantScope(options.tenant, context);
+	const handlerScope = (request) => {
+		const context = contexts.get(request);
+		return context === void 0 ? Promise.resolve({ tenant: void 0 }) : scopeOf(context);
+	};
+	const attach = (context) => attached(async () => kernel.permdock(bind(context), await scopeOf(context)));
+	return {
+		kernel,
+		bind,
+		rebind,
+		scopeOf,
+		handlerScope,
+		attach
+	};
+}
+/** The instance `build` resolves; an invalid Web Bot Auth signature is its `401` response. */
+async function attached(build) {
+	try {
+		return {
+			ok: true,
+			permdock: await build()
+		};
+	} catch (error) {
+		const response = invalidSignatureResponse(error);
+		if (response === void 0) throw error;
+		return {
+			ok: false,
+			response
+		};
+	}
+}
+/** Sets `permdock`, and `permdockData` when a loader returned a row, on a framework request or context. */
+function decorate(target, instance, data) {
+	Object.assign(target, data === void 0 ? { permdock: instance } : {
+		permdock: instance,
+		permdockData: data
+	});
+}
+/** One connection per socket: every handler of `socket` gets the promise the first one opened. */
+function socketConnection(sockets, socket, open) {
+	const hit = sockets.get(socket);
+	if (hit !== void 0) return hit;
+	const opened = open();
+	sockets.set(socket, opened);
+	return opened;
+}
+//#endregion
+export { socketConnection as a, decorate as i, attached as n, bindKernel as r, adapterKernel as t };

package/dist/boundary-BM8a_P6E.js

@@ -0,0 +1,13 @@
+import { r as parsePermDockDigest } from "./digest-BI-6aa6d.js";
+//#region src/client/boundary.ts
+/** The digest of a PermDock error (`PermDockDeniedError`, `PermDockApprovalRequiredError`); `null` for any other error. */
+function boundaryDigest(error) {
+	if (error === null || typeof error !== "object" || !("digest" in error)) return null;
+	return parsePermDockDigest(error.digest);
+}
+/** What a boundary renders for `digest`: `approval` for an approval request when given, otherwise `denied`. */
+function boundaryFallback(digest, fallbacks) {
+	return digest.outcome === "approval-required" ? fallbacks.approval ?? fallbacks.denied : fallbacks.denied;
+}
+//#endregion
+export { boundaryFallback as n, boundaryDigest as t };

package/dist/boundary-BmHxVH1J.d.ts

@@ -0,0 +1,15 @@
+import { t as PermDockDigest } from "./digest-B3kc_PgQ.js";
+//#region src/client/boundary.d.ts
+type PermissionBoundaryState = PermDockDigest & {
+  /** Renders the boundary's children again, e.g. after an approval or a role change. */
+  readonly retry: () => void;
+};
+/** The digest of a PermDock error (`PermDockDeniedError`, `PermDockApprovalRequiredError`); `null` for any other error. */
+declare function boundaryDigest(error: unknown): PermDockDigest | null;
+/** What a boundary renders for `digest`: `approval` for an approval request when given, otherwise `denied`. */
+declare function boundaryFallback<T>(digest: PermDockDigest, fallbacks: {
+  readonly denied?: T | undefined;
+  readonly approval?: T | undefined;
+}): T | undefined;
+//#endregion
+export { boundaryDigest as n, boundaryFallback as r, PermissionBoundaryState as t };

package/dist/canonical-json-DemiK4Vp.js

@@ -0,0 +1,26 @@
+//#region src/core/canonical-json.ts
+function isRecord(value) {
+	return value !== null && typeof value === "object" && !Array.isArray(value);
+}
+/**
+* JSON with sorted keys and `undefined` members dropped, so equal values hash
+* equally. Dates become ISO strings, bigints `"<n>n"`, and a repeated object
+* on the current path `"[Circular]"`, so any validated row serialises.
+*/
+function canonicalJson(value, path = /* @__PURE__ */ new Set()) {
+	if (typeof value === "bigint") return JSON.stringify(`${value}n`);
+	if (value instanceof Date) return JSON.stringify(Number.isNaN(value.getTime()) ? null : value.toISOString());
+	if (value !== null && typeof value === "object") {
+		if (path.has(value)) return "\"[Circular]\"";
+		path.add(value);
+		try {
+			if (Array.isArray(value)) return `[${value.map((item) => canonicalJson(item === void 0 ? null : item, path)).join(",")}]`;
+			if (isRecord(value)) return `{${Object.keys(value).toSorted().filter((key) => value[key] !== void 0).map((key) => `${JSON.stringify(key)}:${canonicalJson(value[key], path)}`).join(",")}}`;
+		} finally {
+			path.delete(value);
+		}
+	}
+	return JSON.stringify(value) ?? "null";
+}
+//#endregion
+export { canonicalJson as t };

package/dist/{capability-B68OFnZx.js → capability-4qPdO9gk.js}

@@ -1,6 +1,8 @@
 import { t as compact } from "./compact-y6vfu2_f.js";
-import { n as freezeDeep } from "./freeze-y1_jQL4v.js";
-import { S as isForbiddenKey, g as listPermissions } from "./permissions-DC7GROPA.js";
+import { n as freezeDeep } from "./freeze-CrU8nQeX.js";
+import { T as isForbiddenKey, _ as listPermissions } from "./permissions-DVoF6dMt.js";
+import { t as expiredAt } from "./expiry-BoBJ8Tvc.js";
+import { n as sameId } from "./ids-DC4V4CFu.js";
 import { t as anonymousSubject } from "./subject-C6dLxqHU.js";
 //#region src/core/capability.ts
 function redeemerKind(redeemer) {
@@ -126,9 +128,9 @@ function signCapability(input, signer, options = {}) {
 	}));
 }
 function holdsScope(membership, scope, id, now) {
-	if (membership.expiresAt !== void 0 && membership.expiresAt <= now) return false;
-	if (membership.scope === scope && membership.id === id) return true;
-	return scope === "tenant" && membership.tenant === id || scope === "team" && membership.team === id;
+	if (expiredAt(membership, now)) return false;
+	if (membership.scope === scope && sameId(membership.id, id)) return true;
+	return scope === "tenant" && sameId(membership.tenant, id) || scope === "team" && sameId(membership.team, id);
 }
 /** Whether `viewer`, the request's own verified subject, may redeem a capability. */
 function redeemerAllows(redeemer, viewer, now = Date.now() / 1e3) {

package/dist/{capability-BDG_nkxt.d.ts → capability-Dq43tT1u.d.ts}

@@ -1,5 +1,5 @@
-import { Tt as TokenSigner, hr as Subject, mr as Principal } from "./policy-CInmNGkM.js";
-import { d as Permission, p as PermissionTree } from "./permissions-B4apnahQ.js";
+import { Nr as Principal, Pr as Subject, Pt as TokenSigner } from "./policy-CFZAr_Al.js";
+import { f as Permission, m as PermissionTree } from "./permissions-DttnqqxC.js";
 //#region src/core/capability.d.ts
 /**
  * Who may redeem a capability: anyone holding it, any signed-in principal,

package/dist/catalog/index.d.ts

@@ -1,4 +1,4 @@
-import { a as CatalogDocument, c as CatalogResource, d as CatalogSupportAccess, f as CatalogUsage, i as CatalogDelegation, l as CatalogRole, n as CatalogApproval, o as CatalogGrant, p as CatalogValidity, r as CatalogBreakGlass, s as CatalogPermission, t as CatalogActivation, u as CatalogScope } from "../types-BBK-exvJ.js";
+import { a as CatalogDocument, c as CatalogResource, d as CatalogSupportAccess, f as CatalogUsage, i as CatalogDelegation, l as CatalogRole, n as CatalogApproval, o as CatalogGrant, p as CatalogValidity, r as CatalogBreakGlass, s as CatalogPermission, t as CatalogActivation, u as CatalogScope } from "../types-Dnemwd77.js";
 //#region src/catalog/parse.d.ts
 /**
  * Reads a `permissions.catalog.json` document (parsed, or the JSON text) and

package/dist/catalog/index.js

@@ -1,2 +1,2 @@
-import { n as rowConditionKeys, t as parseCatalog } from "../parse-DPfIvFMU.js";
+import { n as rowConditionKeys, t as parseCatalog } from "../parse-BuyjxhZV.js";
 export { parseCatalog, rowConditionKeys };

package/dist/catalog-BjZSovXQ.js

@@ -0,0 +1,2 @@
+import { t as runCatalog } from "./catalog-z8q6bi_r.js";
+export { runCatalog };

package/dist/{catalog-doc-BSo_Q_-6.js → catalog-doc-Dsc9y7sd.js}

@@ -1,27 +1,28 @@
-import { a as formerKeys, c as getResource, g as listPermissions } from "./permissions-DC7GROPA.js";
-import { t as catalogFingerprint } from "./src-CTNT-PBW.js";
-import { b as findRole } from "./grantee-Bv04_Vzf.js";
-import { l as canonicalJson } from "./snapshot-DE8dE_hz.js";
+import { _ as listPermissions, a as formerKeys, c as getResource } from "./permissions-DVoF6dMt.js";
+import { t as catalogFingerprint } from "./src-CSbUiozF.js";
+import { S as findRole } from "./grantee-Cv5Sogfv.js";
+import { t as canonicalJson } from "./canonical-json-DemiK4Vp.js";
 import { t as byCodePoint } from "./compare-pfyVnBjE.js";
-import { t as catalogSchema } from "./schema-P8yoma__.js";
-import { o as generatorBanner, t as CATALOG_SCHEMA } from "./version-CnSh33Fj.js";
+import { t as catalogSchema } from "./schema-D3MnDMxa.js";
+import { s as generatorBanner, t as CATALOG_SCHEMA } from "./version-BvacVTZR.js";
 //#region src/cli/catalog-doc.ts
 const ROW_GRANTEES = /* @__PURE__ */ new Set([
 	"relation",
 	"plan",
 	"actor",
-	"assurance"
+	"assurance",
+	"inherit"
 ]);
 /**
 * Whether a grant depends on more than the role and the scope: a row or body
 * condition, a closure, a field list, a purpose, a break-glass override, a
-* validity window, or a relation, plan, actor or assurance grantee. The SQL helpers
+* validity window, a `requires`, or a relation, plan, actor or assurance grantee. The SQL helpers
 * (`permdock_has`, `permitted_<scope>_ids`) check only role and scope, so a
 * policy that calls them for such a permission would widen access.
 */
 function grantHasRowConditions(grant) {
 	const grantees = Array.isArray(grant.to) ? grant.to : [grant.to];
-	return grant.where !== void 0 || grant.check !== void 0 || grant.closure !== void 0 || !grant.portable || grant.fields !== void 0 || grant.purpose !== void 0 || grant.breakGlass !== void 0 || grant.validity !== void 0 || grantees.some((grantee) => ROW_GRANTEES.has(grantee.kind));
+	return grant.where !== void 0 || grant.check !== void 0 || grant.closure !== void 0 || !grant.portable || grant.fields !== void 0 || grant.purpose !== void 0 || grant.breakGlass !== void 0 || grant.validity !== void 0 || grant.requires !== void 0 || grantees.some((grantee) => ROW_GRANTEES.has(grantee.kind));
 }
 /** Per permission key, whether any code grant for it has row conditions. */
 function policyRowConditionKeys(policy) {
@@ -29,6 +30,11 @@ function policyRowConditionKeys(policy) {
 	for (const grant of [...policy.grants, ...policy.roles.flatMap((binding) => binding.grants)]) if (grant.hosted === void 0 && grantHasRowConditions(grant)) keys.add(grant.permission.key);
 	return keys;
 }
+function leafLevels(tree, leaf) {
+	if (leaf.kind !== "instance") return;
+	const names = Object.keys({ ...getResource(tree, leaf.resource)?.levels });
+	return names.length === 0 ? void 0 : names;
+}
 /** With `policy`, permissions carry `hostable` and a known `rowConditions` (without, it is `true`), and roles carry `on`, `assignable` and their ownership rules. */
 function buildCatalog(tree, scan, generatedAt, policy) {
 	const hostable = new Set(policy?.hostable ?? []);
@@ -43,14 +49,16 @@ function buildCatalog(tree, scan, generatedAt, policy) {
 			schema: node === void 0 ? null : jsonSchemaOf(node),
 			relations: node?.relations,
 			version: node?.version,
-			restricted: node?.restricted
+			restricted: node?.restricted,
+			restrictedStops: node?.restrictedStops
 		} : {
 			id: node?.id ?? "id",
 			schema: node === void 0 ? null : jsonSchemaOf(node),
 			definedIn,
 			relations: node?.relations,
 			version: node?.version,
-			restricted: node?.restricted
+			restricted: node?.restricted,
+			restrictedStops: node?.restrictedStops
 		});
 	}
 	const approvals = codeApprovals(policy);
@@ -66,6 +74,7 @@ function buildCatalog(tree, scan, generatedAt, policy) {
 			meta: metaRecord(leaf.meta),
 			usages: scan.usages[leaf.key] ?? [],
 			renamedFrom: formerKeys(leaf).length === 0 ? void 0 : formerKeys(leaf),
+			levels: leafLevels(tree, leaf),
 			hostable: hostable.has(leaf.key) ? true : void 0,
 			rowConditions: rowConditions?.has(leaf.key) ?? true,
 			approvals: approvals.get(leaf.key),
@@ -131,6 +140,7 @@ function catalogGrant(grant) {
 			validity: grant.validity,
 			name: grant.name,
 			purpose: grant.purpose,
+			requires: grant.requires?.length === 1 ? grant.requires[0] : grant.requires,
 			limit,
 			portable: grant.portable ? void 0 : false
 		})
@@ -252,7 +262,8 @@ function compactResource(resource) {
 			definedIn: resource.definedIn,
 			relations,
 			version: resource.version,
-			restricted: resource.restricted
+			restricted: resource.restricted,
+			restrictedStops: resource.restrictedStops
 		})
 	};
 }

package/dist/{catalog-B0E6bggc.js → catalog-h2tlKFkq.js}

@@ -1,4 +1,4 @@
-import { a as listArg, i as globalArgs, s as stringArg, t as COMMAND_DESCRIPTIONS } from "./commands-BMh_Etm2.js";
+import { a as listArg, i as globalArgs, s as stringArg, t as COMMAND_DESCRIPTIONS } from "./commands-DWOrSQic.js";
 import { defineCommand } from "citty";
 //#region src/cli/commands/catalog.ts
 function catalog(ctx) {
@@ -31,7 +31,7 @@ function catalog(ctx) {
 			}
 		},
 		async run({ args: parsed, rawArgs }) {
-			const result = await (await import("./catalog-idsHc0vo.js")).runCatalog({
+			const result = await (await import("./catalog-BjZSovXQ.js")).runCatalog({
 				cwd: ctx.cwd,
 				config: ctx.config,
 				format: parsed.format,

package/dist/{catalog-H-vFGwWK.js → catalog-z8q6bi_r.js}

@@ -1,7 +1,7 @@
-import { a as formatCatalogMarkdown, i as formatCatalogJson, r as catalogSchemaDocument, t as buildCatalog } from "./catalog-doc-BSo_Q_-6.js";
-import { n as listSourceFiles, t as defaultSrcPath } from "./files-B_wAGYmt.js";
-import { a as loadModule, i as loadConfiguredPolicy, o as pickNamed, r as leavesOf, t as asPermissionTree } from "./load-BZ24CpZP.js";
-import { n as scanSources, t as runCollect } from "./collect-O-tOtbnk.js";
+import { a as formatCatalogMarkdown, i as formatCatalogJson, r as catalogSchemaDocument, t as buildCatalog } from "./catalog-doc-Dsc9y7sd.js";
+import { r as listSourceFiles, t as defaultSrcPath } from "./files-DWUN9PzI.js";
+import { a as loadModule, i as loadConfiguredPolicy, o as pickNamed, r as leavesOf, t as asPermissionTree } from "./load-DhWEB9P1.js";
+import { i as scanSources, r as runCollect } from "./collect-DDDv_ESs.js";
 import { existsSync } from "node:fs";
 import { resolve } from "node:path";
 //#region src/cli/catalog.ts

package/dist/claude-agent/index.d.ts

@@ -1,6 +1,7 @@
-import { $ as DecisionSink, C as Policy, E as PolicyVocabulary, Zt as PermDock, at as LimitStore, ct as MembershipSource, ft as RelationSource, mr as Principal, pt as RoleSource, sn as PolicySource, tt as EntitlementSource, ur as Delegation, xt as SnapshotSource } from "../policy-CInmNGkM.js";
-import { f as ApprovalStore } from "../types-B8w5PFtS.js";
-import { t as ToolMap } from "../types-CxquUByI.js";
+import { C as Policy, D as PolicyVocabulary, Nr as Principal, kr as Delegation, ln as PermDock } from "../policy-CFZAr_Al.js";
+import { f as ApprovalStore } from "../types-vKyAMtcX.js";
+import { t as InstanceOptions } from "../instance-options-BK_rNOSC.js";
+import { t as ToolMap } from "../types-Bvc4oWT6.js";
 //#region src/claude-agent/create.d.ts
 /** Structural `McpServerProvenance` from `@anthropic-ai/claude-agent-sdk`. */
 type ClaudeMcpServer = {
@@ -18,7 +19,7 @@ type ClaudeAgentContext = {
   readonly sessionId?: string;
   readonly agentId?: string;
 };
-type ClaudeAgentPermDockOptions<TUser = unknown> = {
+type ClaudeAgentPermDockOptions<TUser = unknown> = InstanceOptions & {
   readonly subject: (context: ClaudeAgentContext) => TUser | Promise<TUser>;
   readonly actor?: (context: ClaudeAgentContext) => unknown;
   readonly delegation?: (context: ClaudeAgentContext) => Delegation | undefined | Promise<Delegation | undefined>;
@@ -26,17 +27,7 @@ type ClaudeAgentPermDockOptions<TUser = unknown> = {
   readonly tools: ToolMap;
   /** MCP server sources whose `mcp__*` tools may be decided; default `['sdk']`. */
   readonly mcpSources?: readonly string[];
-  readonly memberships?: MembershipSource | readonly MembershipSource[];
-  /** The object graph for relation grants that walk a parent chain; without it they deny. */
-  readonly relations?: RelationSource;
-  readonly entitlements?: EntitlementSource;
-  readonly customRoles?: RoleSource;
-  /** Hosted grants, read once per instance; see `PolicySource`. */
-  readonly policies?: PolicySource;
   readonly store?: ApprovalStore;
-  readonly sink?: DecisionSink;
-  readonly limits?: LimitStore;
-  readonly snapshots?: SnapshotSource;
 };
 type PermissionResult = {
   readonly behavior: "allow";

package/dist/claude-agent/index.js

@@ -1,5 +1,6 @@
 import { t as compact } from "../compact-y6vfu2_f.js";
-import { n as createAgentKernel } from "../kernel-YOGCWNLf.js";
+import { t as instanceOptions } from "../instance-options-Dhhcnm3y.js";
+import { n as createAgentKernel } from "../kernel-GSQnMz3O.js";
 //#region src/claude-agent/create.ts
 const MCP_PREFIX = "mcp__";
 function asInput(input) {
@@ -34,16 +35,9 @@ function createPermDock(policy, options) {
 			actor: options.actor,
 			delegation: options.delegation,
 			tenant: options.tenant,
-			memberships: options.memberships,
-			relations: options.relations,
-			entitlements: options.entitlements,
-			customRoles: options.customRoles,
-			policies: options.policies,
-			store: options.store,
-			sink: options.sink,
-			limits: options.limits,
-			snapshots: options.snapshots
+			store: options.store
 		}),
+		...instanceOptions(options),
 		subject: options.subject,
 		tools: options.tools,
 		adapter: "claude-agent"

package/dist/clerk/index.d.ts

@@ -1,5 +1,6 @@
-import { hr as Subject, mr as Principal, pt as RoleSource } from "../policy-CInmNGkM.js";
-import { d as Permission } from "../permissions-B4apnahQ.js";
+import { Nr as Principal, Pr as Subject, xt as RoleSource } from "../policy-CFZAr_Al.js";
+import { f as Permission } from "../permissions-DttnqqxC.js";
+import { s as RemotePdpCache } from "../types-BVyImy5I.js";
 import { StandardSchemaV1 } from "@standard-schema/spec";
 //#region src/clerk/types.d.ts
 type ClerkPrincipal = Principal & {
@@ -49,8 +50,16 @@ type ClerkAuthObject = {
   readonly sessionClaims?: Readonly<Record<string, unknown>> | null;
   readonly has?: (...args: never[]) => unknown;
 };
+type ClerkSubjectResolverOptions = ClerkSubjectOptions & {
+  readonly cache?: RemotePdpCache;
+};
 //#endregion
 //#region src/clerk/subject.d.ts
 export declare function subjectFromClerk(authObject: unknown, options?: ClerkSubjectOptions): Promise<Subject<ClerkPrincipal>>;
+/**
+ * A resolver that keeps each user's `memberships: 'all'` list for
+ * `cache.ttl` (at most 30 seconds), so a removed membership grants until then.
+ */
+export declare function createClerkSubjectResolver(options?: ClerkSubjectResolverOptions): (authObject: unknown) => Promise<Subject<ClerkPrincipal>>;
 //#endregion
-export type { ClerkAuthObject, ClerkBackend, ClerkGlobalRoles, ClerkMembershipListItem, ClerkPrincipal, ClerkSubjectOptions };
+export type { ClerkAuthObject, ClerkBackend, ClerkGlobalRoles, ClerkMembershipListItem, ClerkPrincipal, ClerkSubjectOptions, ClerkSubjectResolverOptions };

package/dist/clerk/index.js

@@ -1,7 +1,8 @@
 import { t as compact } from "../compact-y6vfu2_f.js";
-import { n as freezeDeep } from "../freeze-y1_jQL4v.js";
+import { n as freezeDeep } from "../freeze-CrU8nQeX.js";
 import { t as ignoreRejection } from "../thenable-okc2xDsj.js";
 import { t as anonymousSubject } from "../subject-C6dLxqHU.js";
+import { c as ttlMs, s as ttlCache } from "../shared-DRu8VFVM.js";
 //#region src/clerk/subject.ts
 function isRecord(value) {
 	return value !== null && typeof value === "object" && !Array.isArray(value);
@@ -197,6 +198,7 @@ function membershipRow(item, userId) {
 		roles
 	});
 }
+/** The memberships Clerk lists for `userId`, or `undefined` when a page fails. */
 async function extraMemberships(backend, userId) {
 	const list = backend?.users?.getOrganizationMembershipList;
 	if (list === void 0) return [];
@@ -219,10 +221,29 @@ async function extraMemberships(backend, userId) {
 		}
 		return out;
 	} catch {
-		return [];
+		return;
 	}
 }
-async function subjectFromClerk(authObject, options = {}) {
+function subjectFromClerk(authObject, options = {}) {
+	return fromClerk(authObject, options, extraMemberships);
+}
+/**
+* A resolver that keeps each user's `memberships: 'all'` list for
+* `cache.ttl` (at most 30 seconds), so a removed membership grants until then.
+*/
+function createClerkSubjectResolver(options = {}) {
+	const { cache, ...rest } = options;
+	const lists = ttlCache(ttlMs(cache));
+	const load = async (backend, userId) => {
+		const hit = lists.get(userId);
+		if (hit !== void 0) return hit;
+		const loaded = await extraMemberships(backend, userId);
+		if (loaded !== void 0) lists.set(userId, loaded);
+		return loaded;
+	};
+	return (authObject) => fromClerk(authObject, rest, load);
+}
+async function fromClerk(authObject, options, loadMemberships) {
 	try {
 		const trustedObject = isAuthObject(authObject);
 		const trustedPayload = isVerifiedPayload(authObject);
@@ -244,7 +265,7 @@ async function subjectFromClerk(authObject, options = {}) {
 			roles: membershipRoles,
 			entitlements: plans.org.length === 0 ? void 0 : plans.org
 		})] : [];
-		const loaded = options.memberships === "all" ? await extraMemberships(options.backend, mapped.id) : [];
+		const loaded = options.memberships === "all" ? await loadMemberships(options.backend, mapped.id) ?? [] : [];
 		const seen = new Set(sessionMembership.map((item) => item.tenant));
 		const memberships = [...sessionMembership, ...loaded.filter((item) => {
 			if (seen.has(item.tenant)) return false;
@@ -277,4 +298,4 @@ async function subjectFromClerk(authObject, options = {}) {
 	}
 }
 //#endregion
-export { subjectFromClerk };
+export { createClerkSubjectResolver, subjectFromClerk };

package/dist/cli/bin.js

@@ -1,5 +1,5 @@
 #!/usr/bin/env node
-import { t as run } from "../run-CJ6UvS3a.js";
+import { t as run } from "../run-YXCJDNYk.js";
 import { n as streamHasColors } from "../style-CTm1AXDT.js";
 //#region src/cli/bin.ts
 const result = await run(process.argv.slice(2), {

package/dist/cli/index.d.ts

@@ -1,5 +1,5 @@
-import { a as CatalogDocument, c as CatalogResource, d as CatalogSupportAccess, f as CatalogUsage, l as CatalogRole, n as CatalogApproval, r as CatalogBreakGlass, s as CatalogPermission, t as CatalogActivation, u as CatalogScope } from "../types-BBK-exvJ.js";
-import { c as RlsDialect, d as RlsMemberships, f as RlsSuspension, i as PermDockConfig, l as RlsFunctionMapping, m as RunResult, n as CliIo, o as RlsActiveRow, p as RlsTarget, r as CollectConfig, s as RlsConfig, t as CatalogConfig, u as RlsMembershipTable } from "../types-D6Z6-rKJ.js";
+import { a as CatalogDocument, c as CatalogResource, d as CatalogSupportAccess, f as CatalogUsage, l as CatalogRole, n as CatalogApproval, r as CatalogBreakGlass, s as CatalogPermission, t as CatalogActivation, u as CatalogScope } from "../types-Dnemwd77.js";
+import { _ as RunResult, c as RlsConfig, d as RlsMembershipTable, f as RlsMemberships, g as RlsTarget, h as RlsSuspension, i as PermDockConfig, l as RlsDialect, m as RlsSuspendedScope, n as CliIo, o as RlsActiveRow, p as RlsSuspendedMembership, r as CollectConfig, s as RlsApiKeys, t as CatalogConfig, u as RlsFunctionMapping } from "../types-BPxgszlT.js";
 //#region src/cli/catalog-path.d.ts
 /**
  * The absolute path `permdock collect` writes the catalog to: `collect.out`,
@@ -43,4 +43,4 @@ export declare function run(argv: readonly string[], options?: {
   readonly io?: CliIo;
 }): Promise<RunResult>;
 //#endregion
-export type { CatalogActivation, CatalogApproval, CatalogBreakGlass, CatalogConfig, CatalogDocument, CatalogPermission, CatalogResource, CatalogRole, CatalogScope, CatalogSupportAccess, CatalogUsage, CollectConfig, PermDockConfig, RlsActiveRow, RlsConfig, RlsDialect, RlsFunctionMapping, RlsMembershipTable, RlsMemberships, RlsSuspension, RlsTarget, RunResult, SupabaseGrantsMarker, SupabaseHookMarker };
+export type { CatalogActivation, CatalogApproval, CatalogBreakGlass, CatalogConfig, CatalogDocument, CatalogPermission, CatalogResource, CatalogRole, CatalogScope, CatalogSupportAccess, CatalogUsage, CollectConfig, PermDockConfig, RlsActiveRow, RlsApiKeys, RlsConfig, RlsDialect, RlsFunctionMapping, RlsMembershipTable, RlsMemberships, RlsSuspendedMembership, RlsSuspendedScope, RlsSuspension, RlsTarget, RunResult, SupabaseGrantsMarker, SupabaseHookMarker };

package/dist/cli/index.js

@@ -1,5 +1,5 @@
 import { t as catalogPath } from "../catalog-path-CnI0XTFK.js";
-import { t as defineConfig } from "../config-BPYmjTOp.js";
+import { t as defineConfig } from "../config-BJiM-xAm.js";
 import { o as parseGrantsMarker, s as parseHookMarker } from "../markers-B0hYLvMD.js";
-import { t as run } from "../run-CJ6UvS3a.js";
+import { t as run } from "../run-YXCJDNYk.js";
 export { catalogPath, defineConfig, parseGrantsMarker, parseHookMarker, run };

package/dist/clients-C7zLFuWT.d.ts

@@ -0,0 +1,12 @@
+//#region src/core/clients.d.ts
+/**
+ * Stable names for OAuth clients whose ids differ per environment or are
+ * assigned at dynamic registration. A record maps each name to the client
+ * id (or ids) it stands for; an unset id (an environment variable that is
+ * not defined) names nothing. A function maps a verified client id to a
+ * name, or `undefined`. Policy delegations name the client (`to: { kind,
+ * client }`), never its id.
+ */
+type ClientNames = Readonly<Record<string, string | readonly string[] | undefined>> | ((clientId: string) => string | undefined);
+//#endregion
+export { ClientNames as t };

package/dist/clients-DjU5ABMy.js

@@ -0,0 +1,23 @@
+//#region src/core/clients.ts
+/**
+* The name `clients` gives `clientId`, or `undefined`: unknown ids, an id
+* two names claim, a function that throws or returns anything but a
+* non-empty string. Never throws.
+*/
+function clientNameOf(clients, clientId) {
+	if (clients === void 0 || clientId === "") return;
+	try {
+		if (typeof clients === "function") {
+			const name = clients(clientId);
+			return typeof name === "string" && name !== "" ? name : void 0;
+		}
+		const names = Object.entries(clients).flatMap(([name, ids]) => {
+			return name !== "" && (typeof ids === "string" ? [ids] : Array.isArray(ids) ? ids : []).includes(clientId) ? [name] : [];
+		});
+		return names.length === 1 ? names[0] : void 0;
+	} catch {
+		return;
+	}
+}
+//#endregion
+export { clientNameOf as t };

package/dist/cloud/index.d.ts

@@ -1,8 +1,7 @@
-import { $ as DecisionSink, Et as TokenVerifier, Y as CredentialEvent, Z as DecisionEvent, et as DirectoryEvent, q as AccessEvent, sn as PolicySource, st as MembershipEvent, wt as TokenFailureCause, xt as SnapshotSource } from "../policy-CInmNGkM.js";
-import { f as ApprovalStore } from "../types-B8w5PFtS.js";
-import { n as CatalogEventData, o as CloudEventType } from "../sink-Cfr9-7YC.js";
-import { a as JsonWebKeySet } from "../types-bva3i4Gf.js";
-import { a as ReplayStore } from "../types-i4BAOvdb.js";
+import { $ as AccessEvent, At as SnapshotSource, Ft as TokenVerifier, Nt as TokenFailureCause, at as DecisionSink, bn as PolicySource, ht as MembershipEvent, ot as DirectoryEvent, rt as DecisionEvent, tt as CredentialEvent } from "../policy-CFZAr_Al.js";
+import { f as ApprovalStore } from "../types-vKyAMtcX.js";
+import { n as CatalogEventData, o as CloudEventType } from "../sink-Gs6TTVa-.js";
+import { a as JsonWebKeySet, g as ReplayStore } from "../types-9AWO9EGt.js";
 //#region src/cloud/types.d.ts
 type CloudEndpointOptions = {
   readonly url?: string;

package/dist/cloud/index.js

@@ -1,10 +1,10 @@
 import { t as compact } from "../compact-y6vfu2_f.js";
-import { n as freezeDeep } from "../freeze-y1_jQL4v.js";
-import { S as isForbiddenKey } from "../permissions-DC7GROPA.js";
-import { i as parsePolicyDocument } from "../hosted-BwKQ1BTA.js";
+import { n as freezeDeep } from "../freeze-CrU8nQeX.js";
+import { T as isForbiddenKey } from "../permissions-DVoF6dMt.js";
+import { i as parsePolicyDocument } from "../hosted-DJQw46hn.js";
 import { t as CLOUD_EVENT_TYPES } from "../sink-Bd9PSyfq.js";
-import { t as ApprovalError } from "../errors-m3u9TmDu.js";
-import { t as joseTokenVerifier } from "../verifier-B90agnhl.js";
+import { r as isApprovalErrorCode, t as ApprovalError } from "../errors-DRnGZHzF.js";
+import { t as joseTokenVerifier } from "../verifier-BxBo6I44.js";
 import { t as timeoutSignal } from "../timeout-D51niuQP.js";
 //#region src/cloud/create.ts
 /** Milliseconds a PermDock Cloud request may take; a slower one fails like an unreachable Cloud. */
@@ -30,6 +30,20 @@ function asApproval(value) {
 function isCompactJws$1(value) {
 	return !value.startsWith("{") && value.split(".").length === 3;
 }
+/** The refusal PermDock Cloud names in its body, else the one its status implies. */
+async function approvalErrorFrom(response) {
+	let body;
+	try {
+		body = await response.json();
+	} catch {
+		return approvalErrorFromStatus(response.status);
+	}
+	if (body === null || typeof body !== "object" || !("code" in body)) return approvalErrorFromStatus(response.status);
+	const code = body.code;
+	if (!isApprovalErrorCode(code)) return approvalErrorFromStatus(response.status);
+	const detail = "detail" in body ? body.detail : void 0;
+	return new ApprovalError(code, typeof detail === "string" && detail.length > 0 ? detail : code);
+}
 function approvalErrorFromStatus(status) {
 	if (status === 409) return new ApprovalError("approval-not-pending", "approval is not pending");
 	if (status === 410) return new ApprovalError("approval-expired", "approval has expired");
@@ -92,7 +106,7 @@ function cloud(options = {}) {
 				method: "POST",
 				body: JSON.stringify(verdict)
 			});
-			if (!response.ok) throw approvalErrorFromStatus(response.status);
+			if (!response.ok) throw await approvalErrorFrom(response);
 			const parsed = asApproval(await response.json());
 			if (parsed === null) throw new ApprovalError("approval-not-found", "PermDock Cloud returned an unknown approval shape");
 			return parsed;

package/dist/{cloud-BNQTrmrr.js → cloud-BGhHS-lY.js}

@@ -1,4 +1,4 @@
-import { i as globalArgs, s as stringArg, t as COMMAND_DESCRIPTIONS } from "./commands-BMh_Etm2.js";
+import { i as globalArgs, s as stringArg, t as COMMAND_DESCRIPTIONS } from "./commands-DWOrSQic.js";
 import { defineCommand } from "citty";
 //#region src/cli/commands/cloud.ts
 function cloud(ctx) {
@@ -30,7 +30,7 @@ function cloud(ctx) {
 			}
 		},
 		async run({ args: parsed }) {
-			const result = await (await import("./cloud-Cuxr6Czw.js")).runCloud({
+			const result = await (await import("./cloud-Bo3e9Ak3.js")).runCloud({
 				cwd: ctx.cwd,
 				config: ctx.config,
 				rest: parsed._,