permdock 0.1.0 → 0.2.0

package/dist/{usage-CUnK6Ou9.js → usage-DG1oeCca.js}

@@ -1,40 +1,77 @@
-import { c as getResource } from "./permissions-DC7GROPA.js";
-import { i as USAGE_REPORT_SCHEMA } from "./version-CnSh33Fj.js";
-import { o as jsonSchemaOf } from "./catalog-doc-BSo_Q_-6.js";
-import { n as listSourceFiles, r as rel } from "./files-B_wAGYmt.js";
-import { a as loadModule, n as asPolicy, o as pickNamed } from "./load-BZ24CpZP.js";
-import { t as runCollect } from "./collect-O-tOtbnk.js";
-import { a as usageResult } from "./errors-DSMnAVNa.js";
-import { existsSync, readFileSync } from "node:fs";
-import { resolve } from "node:path";
-import { parseSync } from "oxc-parser";
+import { c as getResource } from "./permissions-DVoF6dMt.js";
+import { o as usageResult } from "./errors-CWfoNg9N.js";
+import { a as USAGE_REPORT_SCHEMA } from "./version-BvacVTZR.js";
+import { o as jsonSchemaOf } from "./catalog-doc-Dsc9y7sd.js";
+import { i as rel, r as listSourceFiles } from "./files-DWUN9PzI.js";
+import { a as loadModule, n as asPolicy, o as pickNamed } from "./load-DhWEB9P1.js";
+import { r as runCollect } from "./collect-DDDv_ESs.js";
+import { existsSync, readFileSync, realpathSync } from "node:fs";
+import { dirname, resolve } from "node:path";
+import { fileURLToPath, pathToFileURL } from "node:url";
+import { createJiti } from "jiti";
+import { Visitor, parseSync } from "oxc-parser";
+import { isBuiltin } from "node:module";
 //#region src/cli/doctor-source.ts
+/** Entries a client file must not import; `tests/cli/doctor-entries.test.ts` keeps it in step with `exports`. */
 const SERVER_SPECIFIERS = [
-	"permdock/server",
-	"permdock/next",
-	"permdock/hono",
-	"permdock/mcp",
+	"permdock/a2a",
+	"permdock/ai-sdk",
 	"permdock/approvals",
-	"permdock/jwt",
-	"permdock/supabase",
-	"permdock/ssf",
+	"permdock/authzen",
 	"permdock/better-auth",
+	"permdock/better-supabase",
+	"permdock/claude-agent",
 	"permdock/clerk",
+	"permdock/cloud",
 	"permdock/convex",
-	"permdock/pdp",
-	"permdock/ai-sdk",
-	"permdock/claude-agent",
+	"permdock/drizzle",
+	"permdock/elysia",
 	"permdock/eve",
-	"permdock/openai"
-];
-const ADAPTER_SPECIFIERS = [
+	"permdock/express",
+	"permdock/fastify",
 	"permdock/hono",
-	"permdock/next",
+	"permdock/jwt",
+	"permdock/kysely",
 	"permdock/mcp",
+	"permdock/nest",
+	"permdock/next",
+	"permdock/node",
+	"permdock/openai",
+	"permdock/openapi",
+	"permdock/orpc",
+	"permdock/otel",
+	"permdock/pdp",
+	"permdock/prisma",
+	"permdock/scim",
+	"permdock/server",
+	"permdock/ssf",
+	"permdock/supabase",
+	"permdock/supabase/middleware",
+	"permdock/terminal",
+	"permdock/trpc"
+];
+/** Entries that feed request, tool or model data into a check. */
+const ADAPTER_SPECIFIERS = [
+	"permdock/a2a",
 	"permdock/ai-sdk",
+	"permdock/authzen",
 	"permdock/claude-agent",
+	"permdock/elysia",
+	"permdock/eve",
 	"permdock/express",
-	"permdock/fastify"
+	"permdock/fastify",
+	"permdock/hono",
+	"permdock/mcp",
+	"permdock/nest",
+	"permdock/next",
+	"permdock/node",
+	"permdock/openai",
+	"permdock/orpc",
+	"permdock/server",
+	"permdock/supabase/middleware",
+	"permdock/terminal",
+	"permdock/trpc",
+	"permdock/webmcp"
 ];
 const UNTRUSTED_CLAIMS = [
 	"user_metadata",
@@ -43,7 +80,6 @@ const UNTRUSTED_CLAIMS = [
 	"clientMetadata",
 	"preferred_username"
 ];
-const JWKS_OPTION = /(?<!\b(?:const|let|var)\s+)\bjwks\s*:/u;
 function withoutComments(source) {
 	const { comments } = parseSync(source.file, source.text);
 	let text = source.text;
@@ -53,10 +89,62 @@ function withoutComments(source) {
 function isClientSource(source, clientEntries) {
 	return clientEntries.has(source.file) || source.text.includes("'use client'") || source.text.includes("\"use client\"") || source.file.includes(".client.");
 }
-function pd001(sources, clientEntries = /* @__PURE__ */ new Set()) {
+/** Specifiers a module loads at runtime: value imports, re-exports and literal dynamic imports. */
+function runtimeSpecifiers(source) {
+	const { module } = parseSync(source.file, source.text);
+	const out = /* @__PURE__ */ new Set();
+	for (const item of module.staticImports) if (item.entries.length === 0 || item.entries.some((entry) => !entry.isType)) out.add(item.moduleRequest.value);
+	for (const item of module.staticExports) for (const entry of item.entries) if (entry.moduleRequest !== null && !entry.isType) out.add(entry.moduleRequest.value);
+	for (const item of module.dynamicImports) {
+		const literal = /^\s*(['"`])([^'"`$]+)\1\s*$/u.exec(source.text.slice(item.moduleRequest.start, item.moduleRequest.end));
+		if (literal?.[2] !== void 0) out.add(literal[2]);
+	}
+	return [...out];
+}
+function realFile(path) {
+	try {
+		return realpathSync(path);
+	} catch {
+		return path;
+	}
+}
+/**
+* A resolver for imports of `file`, the way the bundler resolves them:
+* relative paths with or without an extension, the `paths` of the nearest
+* `tsconfig.json`, and package names through `node_modules` and each
+* package's `exports`. An unresolvable specifier gives `undefined`.
+*/
+function resolverFor(file) {
+	const jiti = createJiti(file, { tsconfigPaths: dirname(file) });
+	const parentURL = pathToFileURL(file);
+	return (specifier) => {
+		if (specifier === "" || isBuiltin(specifier)) return;
+		try {
+			const url = jiti.esmResolve(specifier, {
+				parentURL,
+				try: true
+			});
+			const path = url?.startsWith("file:") === true ? fileURLToPath(url) : void 0;
+			return path !== void 0 && existsSync(path) ? realFile(path) : void 0;
+		} catch {
+			return;
+		}
+	};
+}
+function pd001(sources, clientEntries = /* @__PURE__ */ new Set(), policy) {
 	const findings = [];
+	const policyFile = policy === void 0 ? void 0 : realFile(resolve(policy.cwd, policy.path));
 	for (const source of sources) {
 		if (!isClientSource(source, clientEntries)) continue;
+		if (policy !== void 0 && policyFile !== void 0) {
+			const resolveImport = resolverFor(resolve(policy.cwd, source.file));
+			for (const specifier of runtimeSpecifiers(source)) if (specifier !== "permdock" && !specifier.startsWith("permdock/") && resolveImport(specifier) === policyFile) findings.push({
+				code: "PD001",
+				severity: "error",
+				message: `${source.file} imports the policy module through ${specifier}`,
+				fix: "decide on the server and pass a snapshot to the client ('permdock/react'); never import the policy into a client entry"
+			});
+		}
 		for (const spec of SERVER_SPECIFIERS) if (source.text.includes(`'${spec}'`) || source.text.includes(`"${spec}"`)) findings.push({
 			code: "PD001",
 			severity: "error",
@@ -137,29 +225,92 @@ function pd013(sources) {
 	}
 	return findings;
 }
+function unwrapped(node) {
+	let current = node ?? void 0;
+	while (current?.type === "TSAsExpression" || current?.type === "TSSatisfiesExpression" || current?.type === "ParenthesizedExpression") current = current.expression;
+	return current;
+}
+function propertyName(property) {
+	if (property.computed) return;
+	const key = property.key;
+	if (key.type === "Identifier") return key.name;
+	return key.type === "Literal" && typeof key.value === "string" ? key.value : void 0;
+}
+function stringValue(node) {
+	const value = unwrapped(node);
+	if (value?.type === "Literal") return typeof value.value === "string" ? value.value : void 0;
+	return value?.type === "TemplateLiteral" ? value.quasis[0]?.value.cooked ?? void 0 : void 0;
+}
+function isPermDockSpecifier(value) {
+	return value === "permdock" || value.startsWith("permdock/");
+}
+function permdockOptionObjects(source) {
+	const { program } = parseSync(source.file, source.text);
+	const functions = /* @__PURE__ */ new Set();
+	const namespaces = /* @__PURE__ */ new Set();
+	const constants = /* @__PURE__ */ new Map();
+	const calls = [];
+	new Visitor({
+		ImportDeclaration(node) {
+			if (node.importKind === "type" || !isPermDockSpecifier(node.source.value)) return;
+			for (const specifier of node.specifiers) if (specifier.type === "ImportNamespaceSpecifier") namespaces.add(specifier.local.name);
+			else if (specifier.type === "ImportDefaultSpecifier" || specifier.importKind !== "type") functions.add(specifier.local.name);
+		},
+		VariableDeclarator(node) {
+			const init = unwrapped(node.init);
+			if (node.id.type === "Identifier" && init?.type === "ObjectExpression") constants.set(node.id.name, init);
+		},
+		CallExpression(node) {
+			calls.push(node);
+		}
+	}).visit(program);
+	const objects = [];
+	const collect = (node) => {
+		const value = unwrapped(node);
+		const target = value?.type === "Identifier" ? constants.get(value.name) : value;
+		if (target?.type !== "ObjectExpression" || objects.includes(target)) return;
+		objects.push(target);
+		for (const property of target.properties) if (property.type === "Property") collect(property.value);
+	};
+	for (const call of calls) {
+		const callee = call.callee;
+		if (callee.type === "Identifier" && functions.has(callee.name) || callee.type === "MemberExpression" && callee.object.type === "Identifier" && namespaces.has(callee.object.name)) for (const argument of call.arguments) collect(argument);
+	}
+	return objects;
+}
 function pd014(sources) {
 	const findings = [];
 	for (const source of sources) {
-		const text = withoutComments(source);
-		if (/discovery:\s*['"]http:/u.test(text)) findings.push({
-			code: "PD014",
-			severity: "error",
-			message: `${source.file} uses a plain-HTTP discovery URL`,
-			fix: "use an https: issuer"
-		});
-		const setsJwks = JWKS_OPTION.test(text);
-		if (/discovery\s*:/u.test(text) && setsJwks) findings.push({
-			code: "PD014",
-			severity: "error",
-			message: `${source.file} sets discovery together with jwks or issuer`,
-			fix: "use discovery alone, or jwks plus issuer"
-		});
-		if (setsJwks && !/\bissuer\s*[:,}]/u.test(text) && !/discovery\s*:/u.test(text)) findings.push({
-			code: "PD014",
-			severity: "error",
-			message: `${source.file} sets jwks without issuer`,
-			fix: "set issuer with jwks, or switch to discovery"
-		});
+		if (!source.text.includes("permdock")) continue;
+		for (const object of permdockOptionObjects(source)) {
+			const keys = /* @__PURE__ */ new Map();
+			for (const property of object.properties) {
+				if (property.type !== "Property") continue;
+				const name = propertyName(property);
+				if (name !== void 0) keys.set(name, property.value);
+			}
+			const discovery = keys.get("discovery");
+			const setsDiscovery = keys.has("discovery");
+			const setsJwks = keys.has("jwks");
+			if (stringValue(discovery)?.startsWith("http:") === true) findings.push({
+				code: "PD014",
+				severity: "error",
+				message: `${source.file} uses a plain-HTTP discovery URL`,
+				fix: "use an https: issuer"
+			});
+			if (setsDiscovery && (setsJwks || keys.has("issuer"))) findings.push({
+				code: "PD014",
+				severity: "error",
+				message: `${source.file} sets discovery together with jwks or issuer`,
+				fix: "use discovery alone, or jwks plus issuer"
+			});
+			if (setsJwks && !setsDiscovery && !keys.has("issuer")) findings.push({
+				code: "PD014",
+				severity: "error",
+				message: `${source.file} sets jwks without issuer`,
+				fix: "set issuer with jwks, or switch to discovery"
+			});
+		}
 	}
 	return findings;
 }
@@ -288,7 +439,7 @@ function pd036(sources) {
 		for (const match of source.text.matchAll(PROTECT_CALL)) {
 			const open = match.index + match[0].length - 1;
 			const args = callArguments(source.text, open);
-			if (args?.length !== 1) continue;
+			if (args?.length !== 1 || args[0]?.trim() === "null") continue;
 			const route = idRouteOf(source, match.index);
 			if (route === void 0) continue;
 			const line = source.text.slice(0, match.index).split("\n").length;
@@ -305,14 +456,14 @@ function pd036(sources) {
 //#endregion
 //#region src/cli/usage.ts
 async function runUsage(input) {
-	const collected = await runCollect({
+	const collected = input.collected === void 0 ? await runCollect({
 		cwd: input.cwd,
 		config: input.config,
 		collect: input.config.collect ?? {},
 		check: true,
 		now: input.now,
 		io: input.io
-	});
+	}) : await input.collected();
 	if (collected.document === void 0 || collected.scan === void 0) return {
 		code: 2,
 		output: collected.message
@@ -322,17 +473,8 @@ async function runUsage(input) {
 		code: 2,
 		output: "usage: set policy in permdock.config.ts"
 	};
-	const policyAbs = resolve(input.cwd, policyRel);
-	if (!existsSync(policyAbs)) return {
-		code: 2,
-		output: `PermDock CLI: policy module not found: ${policyRel}`
-	};
-	let policy;
-	try {
-		policy = asPolicy(pickNamed(await loadModule(policyAbs), ["policy"]));
-	} catch (error) {
-		return usageResult(error);
-	}
+	const policy = await usagePolicy(input.cwd, policyRel, input.policy);
+	if (!("roles" in policy)) return policy;
 	const granted = /* @__PURE__ */ new Set();
 	const mergedRoles = /* @__PURE__ */ new Set();
 	for (const role of policy.roles) {
@@ -395,6 +537,22 @@ async function runUsage(input) {
 		output: input.json ? `${JSON.stringify(report, null, 2)}\n` : formatUsage(report)
 	};
 }
+async function usagePolicy(cwd, policyRel, loaded) {
+	if (loaded !== void 0) return await loaded() ?? {
+		code: 2,
+		output: `PermDock CLI: policy module failed to load: ${policyRel}`
+	};
+	const policyAbs = resolve(cwd, policyRel);
+	if (!existsSync(policyAbs)) return {
+		code: 2,
+		output: `PermDock CLI: policy module not found: ${policyRel}`
+	};
+	try {
+		return asPolicy(pickNamed(await loadModule(policyAbs), ["policy"]));
+	} catch (error) {
+		return usageResult(error);
+	}
+}
 const CLIENT_CALLS = /* @__PURE__ */ new Set([
 	"usePermission",
 	"can",
@@ -462,8 +620,13 @@ function conditionFields(condition, out) {
 		case "related":
 			add(condition.field);
 			if (condition.restricted !== void 0) add(condition.restricted);
+			if (condition.restrictedAncestors !== void 0) {
+				add(condition.restrictedAncestors.id);
+				add(condition.restrictedAncestors.parent);
+			}
 			break;
-		case "opaque": break;
+		case "opaque":
+		case "liveSession": break;
 		default: throw new Error(`unknown condition ${String(condition)}`);
 	}
 }

package/dist/validation-error-CnjZ4t92.js

@@ -0,0 +1,33 @@
+import { t as compact } from "./compact-y6vfu2_f.js";
+//#region src/core/validation-error.ts
+/** The base of every Problem Details `type` URI; defined here so a validation error does not pull in the Problem Details builders. */
+const PROBLEM_BASE = "https://permdock.com/problems";
+var PermDockValidationError = class extends Error {
+	name = "PermDockValidationError";
+	code;
+	permission;
+	resource;
+	issues;
+	boundary;
+	constructor(input) {
+		super(input.message);
+		this.code = input.code;
+		this.permission = input.permission;
+		this.resource = input.resource;
+		this.issues = input.issues ?? [];
+		this.boundary = input.boundary;
+	}
+	toProblemDetails(options) {
+		return compact({
+			type: `${PROBLEM_BASE}/validation`,
+			title: "Invalid resource data",
+			status: 400,
+			detail: this.message,
+			instance: options?.instance,
+			permission: this.permission,
+			issues: this.issues
+		});
+	}
+};
+//#endregion
+export { PermDockValidationError as n, PROBLEM_BASE as t };

package/dist/validation-error-CtF23SrC.d.ts

@@ -0,0 +1,26 @@
+import { a as ProblemDetails } from "./errors-DAqevpNk.js";
+import { StandardSchemaV1 } from "@standard-schema/spec";
+//#region src/core/validation-error.d.ts
+/** The base of every Problem Details `type` URI; defined here so a validation error does not pull in the Problem Details builders. */
+declare const PROBLEM_BASE = "https://permdock.com/problems";
+declare class PermDockValidationError extends Error {
+  override readonly name: "PermDockValidationError";
+  readonly code: "invalid-data" | "async-schema" | "no-schema" | "non-portable-condition";
+  readonly permission: string;
+  readonly resource: string;
+  readonly issues: readonly StandardSchemaV1.Issue[];
+  readonly boundary: string;
+  constructor(input: {
+    readonly code: "invalid-data" | "async-schema" | "no-schema" | "non-portable-condition";
+    readonly permission: string;
+    readonly resource: string;
+    readonly issues?: readonly StandardSchemaV1.Issue[];
+    readonly boundary: string;
+    readonly message: string;
+  });
+  toProblemDetails(options?: {
+    readonly instance?: string;
+  }): ProblemDetails;
+}
+//#endregion
+export { PermDockValidationError as n, PROBLEM_BASE as t };

package/dist/{validity-D0uRmJKJ.js → validity-uOp8UpYn.js}

@@ -1,35 +1,13 @@
-import { n as freezeDeep } from "./freeze-y1_jQL4v.js";
-import { C as ownGet, S as isForbiddenKey, d as isFieldRelation, w as ownKeys } from "./permissions-DC7GROPA.js";
-import { a as resolveScope, c as scopeChain, f as tenantOf, l as scopeIdOf, r as findScope, s as rootScope, t as activeFor } from "./scopes-cKVp_WTw.js";
-//#region src/core/fields.ts
-function sanitizeFields(fields) {
-	if (fields === void 0) return;
-	return fields.filter((field) => field.length > 0 && !isForbiddenKey(field));
-}
-function grantCoversField(fields, field, effect) {
-	if (fields === void 0) return true;
-	if (fields.length === 0) return false;
-	if (field === void 0) return effect === "allow";
-	return fields.includes(field);
-}
-function pickVisible(row, canField) {
-	const out = {};
-	for (const key of ownKeys(row)) if (canField(key)) out[key] = ownGet(row, key);
-	return freezeDeep(out);
-}
-function sanitizeContext(value) {
-	if (value === null || typeof value !== "object" || Array.isArray(value)) return {};
-	const out = {};
-	for (const key of ownKeys(value)) out[key] = ownGet(value, key);
-	return out;
-}
-//#endregion
+import { f as isFieldRelation } from "./permissions-DVoF6dMt.js";
+import { t as expiredAt } from "./expiry-BoBJ8Tvc.js";
+import { n as sameId } from "./ids-DC4V4CFu.js";
+import { c as rootScope, l as scopeChain, m as tenantOf, o as resolveScope, r as findScope, t as activeFor, u as scopeIdOf } from "./scopes-CVdPrWN-.js";
 //#region src/core/tenancy.ts
 function nowSeconds(now) {
 	return now ?? Date.now() / 1e3;
 }
 function isMembershipExpired(membership, now) {
-	return membership.expiresAt !== void 0 && membership.expiresAt <= (now ?? nowSeconds());
+	return expiredAt(membership, now ?? nowSeconds());
 }
 /** The instances of the first scope the subject holds a live membership in. */
 function tenantsOf(principal, scopes, now) {
@@ -42,6 +20,11 @@ function tenantsOf(principal, scopes, now) {
 	}
 	return [...tenants];
 }
+function heldRoleNamesIn(principal, scopes, tenant, now) {
+	const names = /* @__PURE__ */ new Set();
+	for (const membership of principal?.memberships ?? []) if (!isMembershipExpired(membership, now) && membership.keep === void 0 && tenantOf(membership, scopes) === tenant) for (const name of membership.roles) names.add(name);
+	return [...names];
+}
 /** `requested` when a live membership sits in that instance of the first scope; never a default. */
 function resolveActiveTenant(principal, requested, scopes, now) {
 	if (requested === void 0) return principal.tenant;
@@ -62,9 +45,30 @@ function relatesTo(resource, field, scope, scopes) {
 	if (resource === void 0) return false;
 	return Object.values(resource.relations).some((relation) => isFieldRelation(relation) && relation.field === field && relation.memberOf !== void 0 && resolveScope(scopes, relation.memberOf) === scope);
 }
-/** The scopes whose key partitions `resource`, from its `memberOf` relations. */
+/** The fields of `resource`'s `memberOf` relations to `scope`. */
+function memberOfFields(resource, scope, scopes) {
+	return [...new Set(Object.values(resource.relations).flatMap((relation) => isFieldRelation(relation) && relation.memberOf !== void 0 && resolveScope(scopes, relation.memberOf) === scope ? [relation.field] : []))];
+}
+/**
+* The field of `resource` that holds `scope`'s instance id: the scope's
+* `key` when one of the resource's `memberOf` relations names it, otherwise
+* the field of its one `memberOf` relation to the scope. A table whose own
+* id is the instance (`organizations.id`) declares
+* `{ self: { field: 'id', memberOf: 'organization' } }`.
+*/
+function scopeField(resource, scope, scopes) {
+	const key = findScope(scopes, scope)?.key;
+	if (resource === void 0) return key;
+	const fields = memberOfFields(resource, scope, scopes);
+	if (key !== void 0 && fields.includes(key)) return key;
+	return fields.length === 1 ? fields[0] : key;
+}
+/** The scopes that partition `resource`, from its `memberOf` relations. */
 function partitionsOf(resource, scopes) {
-	return scopes.filter((scope) => scope.key !== void 0 && relatesTo(resource, scope.key, scope.name, scopes)).map((scope) => scope.name);
+	return scopes.filter((scope) => {
+		const field = scopeField(resource, scope.name, scopes);
+		return field !== void 0 && relatesTo(resource, field, scope.name, scopes);
+	}).map((scope) => scope.name);
 }
 /**
 * Whether `row` lies inside a named membership's instance: for the scope and
@@ -72,23 +76,36 @@ function partitionsOf(resource, scopes) {
 * resource declares it) must hold the membership's id for it. There is no
 * cascade: the membership's own scope is checked, never a scope below it.
 */
-function rowInScope(membership, scopes, row, partitioned) {
+function rowInScope(membership, scopes, row, partitioned, fieldOf) {
 	if (membership.scope === void 0 || row === null || typeof row !== "object") return { ok: true };
 	const root = rootScope(scopes);
 	const chain = scopeChain(scopes, membership.scope).toReversed();
 	for (const name of chain) {
-		const key = findScope(scopes, name)?.key;
+		const key = fieldOf?.(name) ?? findScope(scopes, name)?.key;
 		if (key === void 0) continue;
 		const value = Object.hasOwn(row, key) ? row[key] : void 0;
-		if ((value !== void 0 || partitioned(name, key)) && value !== scopeIdOf(membership, name)) return {
+		if ((value !== void 0 || partitioned(name, key)) && !sameId(value, scopeIdOf(membership, name))) return {
 			ok: false,
 			reason: name === root ? "tenant-mismatch" : "scope"
 		};
 	}
 	return { ok: true };
 }
-function matchScopedMembership(subject, scope, roleName, row, scopes, resource, resources, now, rolesOf = (membership) => membership.roles, team, walk) {
+/**
+* Whether a membership answers an instance check for `row`: any membership
+* with a row object, otherwise only the first scope or the instance of the
+* second scope that `team(id)` selected.
+*/
+function nestedAppliesWithoutRow(membership, scopes, row, team) {
+	if (row !== null && typeof row === "object") return true;
+	return membership.scope === rootScope(scopes) || team !== void 0 && membership.scope === scopes[1]?.name;
+}
+function matchScopedMembership(subject, scope, roleName, row, scopes, resource, resources, now, rolesOf = (membership) => membership.roles, team, walk, instance = false, only) {
 	if (scope === "global") return { ok: true };
+	if (only !== void 0 && scope !== only) return {
+		ok: false,
+		reason: "scope"
+	};
 	const principal = subject.principal;
 	if (principal === null) return {
 		ok: false,
@@ -108,7 +125,11 @@ function matchScopedMembership(subject, scope, roleName, row, scopes, resource,
 		}
 		if (typeof scope === "string") {
 			if (findScope(scopes, scope) === void 0 || membership.scope !== scope || !inTeam(membership, scopes, team) || !activeFor(membership, scopes, principal.tenant)) continue;
-			const inside = rowInScope(membership, scopes, row, (name, key) => relatesTo(resource, key, name, scopes));
+			if (instance && !nestedAppliesWithoutRow(membership, scopes, row, team)) {
+				sawWrongScope = true;
+				continue;
+			}
+			const inside = rowInScope(membership, scopes, row, (name, key) => relatesTo(resource, key, name, scopes), (name) => scopeField(resource, name, scopes));
 			if (!inside.ok) {
 				if (inside.reason === "tenant-mismatch") sawTenantMismatch = true;
 				else sawWrongScope = true;
@@ -165,7 +186,7 @@ function matchResourceMembership(membership, roleResource, row, resource, resour
 	if (row === null || typeof row !== "object") return false;
 	if (on.resource !== roleResource && membershipField(resources.get(roleResource), on.resource, resources) === void 0) return false;
 	const field = membershipField(resource, on.resource, resources);
-	return field !== void 0 && row[field] === on.id;
+	return field !== void 0 && sameId(row[field], on.id);
 }
 /**
 * The row field that holds the id of a `membershipResource` membership: the
@@ -221,4 +242,4 @@ function isActive(validity, now) {
 	return validity.until === void 0 || now < validity.until;
 }
 //#endregion
-export { matchScopedMembership as a, partitionsOf as c, rowInScope as d, tenantsOf as f, sanitizeFields as g, sanitizeContext as h, isMembershipExpired as i, relatesTo as l, pickVisible as m, normalizeValidity as n, membershipField as o, grantCoversField as p, inTeam as r, nowSeconds as s, isActive as t, resolveActiveTenant as u };
+export { isMembershipExpired as a, membershipField as c, partitionsOf as d, relatesTo as f, tenantsOf as g, scopeField as h, inTeam as i, nestedAppliesWithoutRow as l, rowInScope as m, normalizeValidity as n, matchScopedMembership as o, resolveActiveTenant as p, heldRoleNamesIn as r, memberOfFields as s, isActive as t, nowSeconds as u };

package/dist/{verifier-B90agnhl.js → verifier-BxBo6I44.js}

@@ -1,5 +1,5 @@
 import { n as isReadonlyArray, t as compact } from "./compact-y6vfu2_f.js";
-import { E as splitPath, S as isForbiddenKey } from "./permissions-DC7GROPA.js";
+import { T as isForbiddenKey, k as splitPath } from "./permissions-DVoF6dMt.js";
 import { t as loadJose } from "./load-jose-BL6LH4bL.js";
 //#region src/jwt/header.ts
 function compactParts(token) {
@@ -173,7 +173,9 @@ function createKeyCache(options) {
 	const jwksInFlight = /* @__PURE__ */ new Map();
 	let discoveryInFlight;
 	let discoveryCache;
+	/** Keyed by `jwks_uri`: keys cached for one URI never answer for another. */
 	let jwksCache;
+	const cachedJwks = (href, now) => jwksCache?.href === href && jwksCache.expiresAt > now ? jwksCache.value : void 0;
 	let cooldownUntil = 0;
 	let discoveryCause;
 	const readDiscovery = async (href, issuer, now) => {
@@ -251,9 +253,10 @@ function createKeyCache(options) {
 		};
 	};
 	const loadJwks = (href, now, force) => {
-		if (!force && jwksCache !== void 0 && jwksCache.expiresAt > now) return Promise.resolve({
+		const cached = force ? void 0 : cachedJwks(href, now);
+		if (cached !== void 0) return Promise.resolve({
 			ok: true,
-			jwks: jwksCache.value
+			jwks: cached
 		});
 		const pending = jwksInFlight.get(href);
 		if (pending !== void 0) return pending;
@@ -273,6 +276,7 @@ function createKeyCache(options) {
 			const body = await response.json();
 			if (!Array.isArray(body.keys) || body.keys.length === 0) throw new Error("empty jwks");
 			jwksCache = {
+				href,
 				value: body,
 				expiresAt: now + clampTtl(cacheControlMaxAge(response.headers.get("cache-control")) ?? maxTtl, minTtl, maxTtl)
 			};
@@ -281,9 +285,10 @@ function createKeyCache(options) {
 				jwks: body
 			};
 		} catch {
-			if (jwksCache !== void 0 && jwksCache.expiresAt > now) return {
+			const stale = cachedJwks(href, now);
+			if (stale !== void 0) return {
 				ok: true,
-				jwks: jwksCache.value
+				jwks: stale
 			};
 			return {
 				ok: false,

package/dist/version-BvacVTZR.js

@@ -0,0 +1,17 @@
+import { t as packageRoot } from "./package-root-zGkxO3oN.js";
+import { readFileSync } from "node:fs";
+import { join } from "node:path";
+//#region src/cli/version.ts
+function cliVersion() {
+	return JSON.parse(readFileSync(join(packageRoot(), "package.json"), "utf8")).version;
+}
+function generatorBanner() {
+	return `permdock@${cliVersion()}`;
+}
+const CATALOG_SCHEMA = "https://permdock.com/schemas/catalog-v1.json";
+const SUPABASE_MANIFEST_SCHEMA = "https://permdock.com/schemas/supabase-manifest-v1.json";
+const USAGE_REPORT_SCHEMA = "https://permdock.com/schemas/usage-report-v1.json";
+const DOCTOR_REPORT_SCHEMA = "https://permdock.com/schemas/doctor-report-v1.json";
+const CONFIG_REPORT_SCHEMA = "https://permdock.com/schemas/config-report-v1.json";
+//#endregion
+export { USAGE_REPORT_SCHEMA as a, SUPABASE_MANIFEST_SCHEMA as i, CONFIG_REPORT_SCHEMA as n, cliVersion as o, DOCTOR_REPORT_SCHEMA as r, generatorBanner as s, CATALOG_SCHEMA as t };