permdock 0.15.0 → 0.17.0

package/dist/{server-types-CyRN0-Cd.d.ts → server-types-Bw-lWqzR.d.ts}

@@ -1,14 +1,14 @@
-import { Un as Decision, Wt as Instant, X as Intent, Zt as Snapshot, dr as JsonWebKeyLike, hr as Subject, j as PolicyVocabulary, rr as Actor } from "./policy-types-DGIO_gxq.js";
+import { $t as Snapshot, Kt as Instant, M as PolicyVocabulary, Z as Intent, hr as JsonWebKeyLike, qn as Decision, sr as Actor, yr as Subject } from "./policy-types-IRJVABmm.js";
 import { u as Permission } from "./permission-types-CAY-GU7e.js";
-import { a as PermDock, u as SnapshotOptions } from "./permdock-CprAPN3w.js";
-import { m as ApprovalStore } from "./types-DLvhVm1r.js";
-import { a as ProblemDetails, t as ApprovalHint } from "./errors-BIM4MFsJ.js";
-import { t as InstanceOptions } from "./instance-options-CoHn-0e8.js";
+import { a as PermDock, u as SnapshotOptions } from "./permdock-DUWZEOLR.js";
+import { m as ApprovalStore } from "./types-BvBbkAu1.js";
+import { a as ProblemDetails, t as ApprovalHint } from "./errors-Dc9FdamT.js";
+import { t as InstanceOptions } from "./instance-options-BOCRxEFb.js";
 import { t as RequestContext } from "./request-context-C2_1lchh.js";
-import { n as PermDockWrap } from "./wrap-DxXB54Wu.js";
+import { n as PermDockWrap } from "./wrap-DpZAbxuD.js";
 import { n as RevocationFeed } from "./revocations-BaUXHM1N.js";
-import { r as PdpFactory } from "./types-DlelvQk4.js";
-import { i as evaluationsHandler } from "./evaluations-DOWuBpWv.js";
+import { r as PdpFactory } from "./types-B3BOcI0J.js";
+import { i as evaluationsHandler } from "./evaluations-BasA9zXp.js";
 //#region src/server/connection.d.ts
 type ConnectionData<T> = T | (() => T | null | undefined | Promise<T | null | undefined>);
 type ConnectionOptions<T = unknown> = {

package/dist/{shared-l0oGGetg.js → shared-BRmCJxDK.js}

@@ -1,5 +1,5 @@
 import { a as durationOf, f as nowMillis } from "./time-nR1JesoH.js";
-import { t as decisionToken } from "./token-DC9EQiet.js";
+import { n as decisionToken } from "./token-DaMnIU9O.js";
 //#region src/pdp/shared.ts
 const MAX_CACHE_TTL = 30;
 const CACHE_MAX = 1e3;
@@ -46,7 +46,7 @@ function granted(provider, permission, subject, data) {
 			resourceId: resourceIdOf(data),
 			principal,
 			actor: subject.actor,
-			fingerprint: provider
+			source: provider
 		})
 	};
 }

package/dist/{shared-DrGLwM3s.js → shared-DyYVEjKC.js}

@@ -1,9 +1,9 @@
 import { r as isRecord } from "./compact-CAf557ZB.js";
 import { n as isForbiddenKey } from "./paths-CUvURzHp.js";
 import { t as byCodePoint } from "./compare-DTfyUunF.js";
-import { i as configError } from "./errors-Vpu6rKHl.js";
+import { i as configError } from "./errors-BhRkoNS7.js";
 import { a as quoteQualifiedTable, c as quoteSqlTable, o as quoteSqlIdent, s as quoteSqlLiteral, t as SQL_IDENT } from "./sql-0WjxIp9g.js";
-import { t as byScope } from "./compile-EzEMB-7v.js";
+import { t as byScope } from "./compile-B_oJqmIg.js";
 import "./sources-C4vkzZJV.js";
 //#region src/cli/sql/columns.ts
 /**

package/dist/{sink-B5zoUW_O.d.ts → sink-DUzt0e4B.d.ts}

@@ -1,7 +1,7 @@
-import { J as DecisionSink, St as SupportSession, an as CredentialEvent, fn as MembershipEvent, in as AutomationEvent, kt as Credential, mt as TokenSigner, nn as AccessEvent, pn as SinkEvent } from "./policy-types-DGIO_gxq.js";
+import { Y as DecisionSink, gt as TokenSigner, hn as SinkEvent, in as AccessEvent, jt as Credential, mn as MembershipEvent, on as AutomationEvent, sn as CredentialEvent, wt as SupportSession } from "./policy-types-IRJVABmm.js";
 import { M as AppData } from "./permission-types-CAY-GU7e.js";
 import { u as OperationRisk } from "./operations-Ci_rT6Uo.js";
-import { t as Automation } from "./automation-C6Jg75xq.js";
+import { t as Automation } from "./automation-DCWuVKtd.js";
 //#region src/core/sink.d.ts
 /**
  * The closed list of CloudEvents `type` values, `com.permdock.<family>` or

package/dist/{skills-BZxPQ_09.js → skills-BUuH-QFt.js}

@@ -1,8 +1,8 @@
 import { t as byCodePoint } from "./compare-DTfyUunF.js";
 import { i as readJsonFile } from "./files-BSjrtIHw.js";
 import { l as packageRoot } from "./version-DMQ0dnN5.js";
-import { t as didYouMean } from "./args-0FrVs5EH.js";
-import { a as nonEmptyOr } from "./output-BVZpQDad.js";
+import { t as didYouMean } from "./args-iafbHiXn.js";
+import { a as nonEmptyOr } from "./output-DhTpe8v1.js";
 import { cpSync, existsSync, lstatSync, mkdirSync, readFileSync, readdirSync, readlinkSync, realpathSync, writeFileSync } from "node:fs";
 import { basename, dirname, join, relative, resolve } from "node:path";
 import { pathToFileURL } from "node:url";

package/dist/{skills-BIsm1n26.js → skills-a4N6Y2Xm.js}

@@ -1,7 +1,7 @@
 import { t as defineLeaf } from "./command-L8EstFNm.js";
-import { t as checkFlag } from "./flags-DXjoTVbS.js";
+import { t as checkFlag } from "./flags-BlmpmXoY.js";
 import { r as pick, t as CANCELLED } from "./prompt-BYc6drYW.js";
-import { n as detectedAgents, r as runSkills, t as SKILL_AGENTS } from "./skills-BZxPQ_09.js";
+import { n as detectedAgents, r as runSkills, t as SKILL_AGENTS } from "./skills-BUuH-QFt.js";
 //#region src/cli/commands/skills.ts
 const forFlag = { for: {
 	type: "string",

package/dist/{snapshot-CXlzi69u.js → snapshot-DN_8J27z.js}

@@ -3,10 +3,10 @@ import { n as freezeDeep } from "./freeze-jjan0lCv.js";
 import { n as isForbiddenKey } from "./paths-CUvURzHp.js";
 import { a as resolveConditionRef, l as isConditionRef } from "./refs-C8BKxc_e.js";
 import { l as isRfc3339, m as rfc3339, p as nowSeconds } from "./time-nR1JesoH.js";
-import { f as scopeList } from "./scopes-0Up_UA2t.js";
+import { d as scopeList } from "./scopes-BSdYaGHs.js";
 import { _ as listPlans, v as listRoles } from "./grantee-Dke-9rd1.js";
 import { i as wireValidity } from "./validity-Buc7w8E9.js";
-import { m as tenantsOf } from "./tenancy-5d1zVBvK.js";
+import { m as tenantsOf } from "./tenancy-DvOHHk3-.js";
 import { n as toWireDelegation } from "./wire-delegation-Cv3W2eaM.js";
 //#region src/conditions/bind.ts
 function isPrimitive(value) {
@@ -220,6 +220,8 @@ function buildSnapshot(input) {
 		include,
 		simulated: input.simulated === true ? true : void 0,
 		expiresAt: input.subject.expiresAt === void 0 ? void 0 : rfc3339(input.subject.expiresAt),
+		authzVersion: principal?.authzVersion,
+		sessionId: input.subject.session,
 		scopes: input.scopes,
 		ids: Object.keys(ids).length === 0 ? void 0 : ids,
 		assignable: assignable.length > 0 ? assignable : void 0,
@@ -266,6 +268,8 @@ function parseSnapshot(json) {
 	const version = record["v"];
 	if (version !== 1) throw new Error(`PermDock: unsupported snapshot version '${String(version)}'`);
 	if (!isRfc3339(record["issuedAt"]) || record["expiresAt"] !== void 0 && !isRfc3339(record["expiresAt"])) throw new Error("PermDock: snapshot times must be RFC 3339");
+	const authzVersion = record["authzVersion"];
+	if (authzVersion !== void 0 && (typeof authzVersion !== "number" || !Number.isSafeInteger(authzVersion) || authzVersion < 0) || record["sessionId"] !== void 0 && typeof record["sessionId"] !== "string") throw new Error("PermDock: snapshot authzVersion must be a non-negative integer and sessionId a string");
 	return freezeDeep(value);
 }
 //#endregion

package/dist/{snapshot-cache-Bx_4xC_6.js → snapshot-cache-B66h7FBK.js}

@@ -1,20 +1,20 @@
 import { g as secondsOf, p as nowSeconds } from "./time-nR1JesoH.js";
-import { n as payloadDigest } from "./token-DC9EQiet.js";
+import { r as payloadDigest } from "./token-DaMnIU9O.js";
 //#region src/core/snapshot-cache.ts
 /** Seconds since the epoch of a NumericDate or an RFC 3339 instant. */
 function epochSeconds(value) {
 	return typeof value === "number" ? value : secondsOf(value);
 }
 /**
-* `{ stale }` in seconds: `max` when the value never expires, otherwise the
-* seconds left, clamped to `[min, max]`. A value with less than `min` seconds
-* left gets its real remainder, so Next.js leaves it out of prefetches and an
-* HTTP cache does not serve it past `expiresAt`.
+* `{ stale }` in seconds: `max` (default 300). With `capToToken`, the seconds
+* the value has left, clamped to `[min, max]`; a value with less than `min`
+* seconds left gets its real remainder, so Next.js leaves it out of prefetches
+* and an HTTP cache does not serve it past `expiresAt`.
 */
 function cacheLifeFor(value, options = {}) {
 	const min = options.min ?? 30;
 	const max = Math.max(options.max ?? 300, min);
-	const expiresAt = epochSeconds(value?.expiresAt);
+	const expiresAt = options.capToToken === true ? epochSeconds(value?.expiresAt) : void 0;
 	if (expiresAt === void 0) return { stale: max };
 	const issued = epochSeconds(value?.issuedAt);
 	const issuedAt = issued !== void 0 && issued > 0 ? issued : void 0;
@@ -24,6 +24,20 @@ function cacheLifeFor(value, options = {}) {
 	return { stale: Math.min(max, remaining) };
 }
 /**
+* The key of one subject's snapshot in a server cache:
+* `<sub>:<authzVersion>:<tenant>`, with `anon` for no subject and an empty part
+* for a missing version or tenant. It carries no claims, so a refreshed token
+* at the same version keeps the key.
+*/
+function snapshotKey(snapshot) {
+	const principal = snapshot.subject.principal;
+	return [
+		principal?.id ?? "anon",
+		snapshot.authzVersion ?? "",
+		principal?.tenant ?? ""
+	].join(":");
+}
+/**
 * The `cacheTag` for one subject's cached snapshots: `permdock:<sub>`, or
 * `permdock:anon` without a subject. Tag the private cache with it and pass it
 * to `updateTag` or `revalidateTag` on every write that changes the subject's
@@ -43,11 +57,14 @@ function snapshotHeaders(snapshot, options = {}) {
 	for (const [key, value] of Object.entries(snapshot)) if (key !== "issuedAt") content[key] = value;
 	const { tags, ...life } = options;
 	return {
-		"Cache-Control": `private, max-age=${cacheLifeFor(snapshot, life).stale}`,
+		"Cache-Control": `private, max-age=${cacheLifeFor(snapshot, {
+			capToToken: true,
+			...life
+		}).stale}`,
 		Vary: "Authorization, Cookie",
 		ETag: `"${payloadDigest(content)}"`,
 		"Cache-Tag": [snapshotTag(snapshot.subject.principal?.id), ...tags ?? []].join(",")
 	};
 }
 //#endregion
-export { snapshotHeaders as n, snapshotTag as r, cacheLifeFor as t };
+export { snapshotTag as i, snapshotHeaders as n, snapshotKey as r, cacheLifeFor as t };

package/dist/{snapshot-cache-BjAWkchD.d.ts → snapshot-cache-Dbk-Gnij.d.ts}

@@ -1,4 +1,4 @@
-import { Wt as Instant, Zt as Snapshot } from "./policy-types-DGIO_gxq.js";
+import { $t as Snapshot, Kt as Instant } from "./policy-types-IRJVABmm.js";
 //#region src/core/snapshot-cache.d.ts
 type CacheLifeForOptions = {
   /**
@@ -8,14 +8,21 @@ type CacheLifeForOptions = {
   readonly min?: number;
   /** Upper bound in seconds. Next.js keeps a per-session App Shell entry from 300. */
   readonly max?: number;
+  /**
+   * Cap the lifetime at the seconds the token has left, as `bsb.cached()` does.
+   * Off by default: a proxy that refreshes the session on every request keeps
+   * the token ahead of the entry. `snapshotHeaders` turns it on, since an HTTP
+   * cache sees no refresh.
+   */
+  readonly capToToken?: boolean;
   /** Defaults to the snapshot's `issuedAt`, then the clock. */
   readonly now?: Instant;
 };
 /**
- * `{ stale }` in seconds: `max` when the value never expires, otherwise the
- * seconds left, clamped to `[min, max]`. A value with less than `min` seconds
- * left gets its real remainder, so Next.js leaves it out of prefetches and an
- * HTTP cache does not serve it past `expiresAt`.
+ * `{ stale }` in seconds: `max` (default 300). With `capToToken`, the seconds
+ * the value has left, clamped to `[min, max]`; a value with less than `min`
+ * seconds left gets its real remainder, so Next.js leaves it out of prefetches
+ * and an HTTP cache does not serve it past `expiresAt`.
  */
 declare function cacheLifeFor(value: {
   /** RFC 3339, or a NumericDate. */
@@ -25,6 +32,13 @@ declare function cacheLifeFor(value: {
 } | null, options?: CacheLifeForOptions): {
   readonly stale: number;
 };
+/**
+ * The key of one subject's snapshot in a server cache:
+ * `<sub>:<authzVersion>:<tenant>`, with `anon` for no subject and an empty part
+ * for a missing version or tenant. It carries no claims, so a refreshed token
+ * at the same version keeps the key.
+ */
+declare function snapshotKey(snapshot: Snapshot): string;
 /**
  * The `cacheTag` for one subject's cached snapshots: `permdock:<sub>`, or
  * `permdock:anon` without a subject. Tag the private cache with it and pass it
@@ -53,4 +67,4 @@ type SnapshotHeaders = {
  */
 declare function snapshotHeaders(snapshot: Snapshot, options?: SnapshotHeadersOptions): SnapshotHeaders;
 //#endregion
-export { snapshotHeaders as a, cacheLifeFor as i, SnapshotHeaders as n, snapshotTag as o, SnapshotHeadersOptions as r, CacheLifeForOptions as t };
+export { snapshotHeaders as a, cacheLifeFor as i, SnapshotHeaders as n, snapshotKey as o, SnapshotHeadersOptions as r, snapshotTag as s, CacheLifeForOptions as t };

package/dist/solid/index.d.ts

@@ -1,13 +1,13 @@
-import { Hn as ApprovalRequiredDecision, Un as Decision, Yn as GrantedDecision, Zt as Snapshot, fr as Membership, ht as TokenVerifier, j as PolicyVocabulary } from "../policy-types-DGIO_gxq.js";
+import { $n as GrantedDecision, $t as Snapshot, Kn as ApprovalRequiredDecision, M as PolicyVocabulary, _t as TokenVerifier, gr as Membership, qn as Decision } from "../policy-types-IRJVABmm.js";
 import { u as Permission } from "../permission-types-CAY-GU7e.js";
 import { r as Role } from "../vocabulary-DEJ5j4mR.js";
-import { d as UncheckedData, s as RowData } from "../permdock-CprAPN3w.js";
-import { c as requiredPlans } from "../errors-BIM4MFsJ.js";
-import { i as describe, r as DescribeOptions, t as DecisionDescription } from "../describe-BbFPBSms.js";
+import { d as UncheckedData, s as RowData } from "../permdock-DUWZEOLR.js";
+import { c as requiredPlans } from "../errors-Dc9FdamT.js";
+import { i as describe, r as DescribeOptions, t as DecisionDescription } from "../describe-nalX_HHE.js";
 import { t as PermissionBoundaryState } from "../boundary-C9ck-3uK.js";
-import { n as ProtectedAction, t as ActionResult } from "../action-result-BcudBQOF.js";
+import { _ as TenantView, a as ClientPermDock, c as GateMode, d as PermissionState, g as SubjectView, h as RolesOptions, i as ApprovalState, l as GateView, m as ProviderOptionsBase, o as ClientStatus, p as ProtectedActionView, r as ApprovalHandle, s as FilterResult, u as PermissionSet, v as ActionResult, y as ProtectedAction } from "../store-g5ctUrOI.js";
+import { a as broadcastChannelRefresh, c as visibilityRefresh, i as authzChangeRefresh, n as EventSourceRefreshOptions, o as eventSourceRefresh, r as RefreshTrigger, s as focusRefresh, t as AuthzChangeRefresh } from "../refresh-on-L9UOwATg.js";
 import { t as approvalHeaders } from "../headers-B9jQxjtW.js";
-import { a as FilterResult, b as eventSourceRefresh, c as PermissionSet, d as ProtectedActionView, f as ProviderOptionsBase, h as TenantView, i as ClientStatus, l as PermissionState, m as SubjectView, n as ApprovalState, o as GateMode, p as RolesOptions, r as ClientPermDock, s as GateView, t as ApprovalHandle, v as EventSourceRefreshOptions, y as RefreshTrigger } from "../types-tQB2CEnY.js";
 import { Accessor, Accessor as Accessor$1, JSX } from "solid-js";
 //#region src/solid/types.d.ts
 /** Structural `JSX.Element`: text, a DOM node or a list of children. */
@@ -129,4 +129,4 @@ export declare function Protected(props: ProtectedProps): JSX.Element;
 //#region src/solid/provider.d.ts
 export declare function PermDockProvider(props: PermDockProviderProps): JSX.Element;
 //#endregion
-export { type ActionResult, type ApprovalHandle, type ApprovalState, type ClientPermDock, type ClientStatus, type EventSourceRefreshOptions, type FilterResult, type GateMode, type GateView, type PermDockDefaults, type PermDockProviderProps, type PermissionBoundaryProps, type PermissionBoundaryState, type PermissionSet, type PermissionState, type ProtectedAction, type ProtectedActionAccessors, type ProtectedActionView, type ProtectedProps, type RefreshTrigger, type RolesOptions, type SolidChild, type SubjectView, type TenantView, approvalHeaders, describe, eventSourceRefresh, requiredPlans };
+export { type ActionResult, type ApprovalHandle, type ApprovalState, type AuthzChangeRefresh, type ClientPermDock, type ClientStatus, type EventSourceRefreshOptions, type FilterResult, type GateMode, type GateView, type PermDockDefaults, type PermDockProviderProps, type PermissionBoundaryProps, type PermissionBoundaryState, type PermissionSet, type PermissionState, type ProtectedAction, type ProtectedActionAccessors, type ProtectedActionView, type ProtectedProps, type RefreshTrigger, type RolesOptions, type SolidChild, type SubjectView, type TenantView, approvalHeaders, authzChangeRefresh, broadcastChannelRefresh, describe, eventSourceRefresh, focusRefresh, requiredPlans, visibilityRefresh };

package/dist/solid/index.js

@@ -1,11 +1,11 @@
 import { t as compact } from "../compact-CAf557ZB.js";
 import { r as requiredPlans } from "../problem-details-CLDgX1KV.js";
-import { n as describe } from "../describe-Bb4hGK5d.js";
+import { n as describe } from "../describe-CogP1loh.js";
 import { n as boundaryFallback, t as boundaryDigest } from "../boundary-BV3O1eud.js";
-import { n as actionRunner, r as approvalHeaders, t as actionApproval } from "../protected-action-DUYqb-Ma.js";
-import { a as livePermDock, c as rolesView, d as subjectView, f as tenantView, i as gateView, l as scopedTenant, n as describeWith, o as permissionSet, r as filterResult, s as protectedView, t as approvalHandle, u as slotContent } from "../views-CD8wuL4Z.js";
-import { a as isPromiseLike, r as eventSourceRefresh } from "../store-options-Dil3lraY.js";
-import { n as switchTenant, t as providerStore } from "../provider-store-CaTv00tr.js";
+import { n as actionRunner, r as approvalHeaders, t as actionApproval } from "../protected-action-B6n6w7Rl.js";
+import { a as livePermDock, c as rolesView, d as subjectView, f as tenantView, i as gateView, l as scopedTenant, n as describeWith, o as permissionSet, r as filterResult, s as protectedView, t as approvalHandle, u as slotContent } from "../views-TrZYlDnM.js";
+import { a as eventSourceRefresh, i as broadcastChannelRefresh, l as isPromiseLike, o as focusRefresh, r as authzChangeRefresh, s as visibilityRefresh } from "../store-options--zWn48PK.js";
+import { n as switchTenant, t as providerStore } from "../provider-store-BQP_pp8s.js";
 import { ErrorBoundary, createComponent, createComputed, createContext, createMemo, createSignal, getOwner, on, onCleanup, useContext } from "solid-js";
 //#region src/solid/context.ts
 const PermDockContext = createContext(void 0);
@@ -249,4 +249,4 @@ function uiProvider(ui, props) {
 	});
 }
 //#endregion
-export { PermDockProvider, PermissionBoundary, Protected, approvalHeaders, describe, eventSourceRefresh, requiredPlans, useApproval, useAssignablePermissions, useAssignableRoles, useDescribe, useFilter, useGate, useMemberships, usePermDock, usePermission, usePermissionBoundary, usePermissions, useProtectedAction, useRoles, useSubject, useTenant };
+export { PermDockProvider, PermissionBoundary, Protected, approvalHeaders, authzChangeRefresh, broadcastChannelRefresh, describe, eventSourceRefresh, focusRefresh, requiredPlans, useApproval, useAssignablePermissions, useAssignableRoles, useDescribe, useFilter, useGate, useMemberships, usePermDock, usePermission, usePermissionBoundary, usePermissions, useProtectedAction, useRoles, useSubject, useTenant, visibilityRefresh };

package/dist/solid-start/index.d.ts

@@ -1,9 +1,9 @@
-import { T as Policy, Zt as Snapshot, j as PolicyVocabulary, pr as Principal } from "../policy-types-DGIO_gxq.js";
+import { $t as Snapshot, E as Policy, M as PolicyVocabulary, _r as Principal } from "../policy-types-IRJVABmm.js";
 import { u as Permission } from "../permission-types-CAY-GU7e.js";
 import { a as OperationInput, t as Operation } from "../operations-Ci_rT6Uo.js";
-import { a as PermDock } from "../permdock-CprAPN3w.js";
-import { D as ConnectionOptions, T as Connection, f as InvalidSignatureError, i as OpenApiHooks, o as ProtectOptions, u as SnapshotQuery, v as discoverViaSignatureAgent, x as webBotAuthVerifier } from "../server-types-CyRN0-Cd.js";
-import { a as ProtectTarget, n as FetchAdapterOptions, t as ContextReader } from "../fetch-adapter-BIbBAtPZ.js";
+import { a as PermDock } from "../permdock-DUWZEOLR.js";
+import { D as ConnectionOptions, T as Connection, f as InvalidSignatureError, i as OpenApiHooks, o as ProtectOptions, u as SnapshotQuery, v as discoverViaSignatureAgent, x as webBotAuthVerifier } from "../server-types-Bw-lWqzR.js";
+import { a as ProtectTarget, n as FetchAdapterOptions, t as ContextReader } from "../fetch-adapter-BgqpOOpd.js";
 import { APIEvent, FetchEvent } from "@solidjs/start/server";
 //#region src/solid-start/create.d.ts
 /** The h3 event under every SolidStart request; `subject` and `scope` read it. */

package/dist/solid-start/index.js

@@ -1,6 +1,6 @@
-import { l as InvalidSignatureError, p as webBotAuthVerifier, u as discoverViaSignatureAgent } from "../evaluations-IBceAeKT.js";
-import { i as decorate } from "../bind-BNQA9JK9.js";
-import { n as guardedRoute, t as fetchAdapter } from "../fetch-adapter-dPTgJVHd.js";
+import { l as InvalidSignatureError, p as webBotAuthVerifier, u as discoverViaSignatureAgent } from "../evaluations-DG40eSJa.js";
+import { i as decorate } from "../bind-BJFeLX1V.js";
+import { n as guardedRoute, t as fetchAdapter } from "../fetch-adapter-UZOW0PRC.js";
 //#region src/solid-start/create.ts
 /**
 * `event.locals`. Its type, `App.RequestEventLocals`, is declared by

package/dist/{sources-oB1Hg1Fm.d.ts → sources-CXY05xtB.d.ts}

@@ -1,4 +1,4 @@
-import { nt as MembershipSource, pr as Principal, rn as AuthEvent } from "./policy-types-DGIO_gxq.js";
+import { _r as Principal, an as AuthEvent, rt as MembershipSource } from "./policy-types-IRJVABmm.js";
 import { t as ClaimsMap } from "./claims-map-D1Pb5oRq.js";
 import { t as ClientNames } from "./clients-C_NOET3z.js";
 import { c as SupabaseManifestMembership } from "./manifest-B5yF3CIq.js";

package/dist/{src-C_pi2Rnh.js → src-nYNBfmgq.js}

@@ -1,7 +1,7 @@
 import { n as isReadonlyArray, r as isRecord, t as compact } from "./compact-CAf557ZB.js";
 import { n as freezeDeep } from "./freeze-jjan0lCv.js";
 import { n as isForbiddenKey, r as ownGet } from "./paths-CUvURzHp.js";
-import { f as normalizeApproval, g as assertSqlFunctionName, h as assertSqlFunctionArg, m as assertPortableTwin, p as normalizeWhere, u as assertApprovalRelations } from "./role-builder-BK2-T6oD.js";
+import { d as assertSqlFunctionArg, f as assertSqlFunctionName, l as normalizeWhere, u as assertPortableTwin } from "./role-builder-BrmOcXch.js";
 import { n as PermDockDeniedError } from "./errors-B6R_lg2a.js";
 import { o as sameId } from "./expiry-6XByK0dm.js";
 import { n as internalsOf } from "./internals-B3IgHrvo.js";
@@ -9,21 +9,23 @@ import { c as listPermissions, i as getRegistry, n as findPermission, o as isPer
 import { n as isThenable$1 } from "./thenable-BNSM1U2R.js";
 import { c as isEdgeRelation, m as restrictedStops, o as groupEntries, s as isComputedRelation, u as isPrincipalRelation } from "./resource-relations-8-pCScBO.js";
 import { a as durationOf, f as nowMillis, g as secondsOf, m as rfc3339, p as nowSeconds } from "./time-nR1JesoH.js";
-import { a as normalizeMembership$1, d as scopeIdOf, f as scopeList, h as tenantOf, l as rootScope, o as normalizeMemberships$1, s as resolveScope$1, u as scopeChain } from "./scopes-0Up_UA2t.js";
-import { u as evaluateCondition } from "./delegation-CDB6_keF.js";
+import { t as canonicalJson } from "./canonical-json-DwilZ1iB.js";
+import { a as normalizeMembership$1, c as rootScope, d as scopeList, l as scopeChain, o as normalizeMemberships$1, p as tenantOf, s as resolveScope$1, u as scopeIdOf } from "./scopes-BSdYaGHs.js";
+import { u as evaluateCondition } from "./delegation-aK4T_5WU.js";
 import { _ as listPlans, a as authenticated, m as findRole, o as flattenGrantee } from "./grantee-Dke-9rd1.js";
-import { m as tenantsOf, r as isMembershipExpired } from "./tenancy-5d1zVBvK.js";
-import { c as levelNames, i as grantList, n as declaredRoleNames } from "./policy-CLQ8__GF.js";
-import { o as isPortableCondition } from "./hosted-D0IzESu_.js";
+import { a as normalizeApproval, r as assertApprovalRelations } from "./approval-normalize-4KxMRdJC.js";
+import { m as tenantsOf, r as isMembershipExpired } from "./tenancy-DvOHHk3-.js";
+import { c as levelNames, i as grantList, n as declaredRoleNames } from "./policy-DxQyHKPB.js";
+import { o as isPortableCondition } from "./hosted-tPZnyjQS.js";
 import { n as OPERATION_RISKS, r as isOperationRisk } from "./permissions-CVXmRILq.js";
-import { C as tenantCustomRoles, S as roleAllowKeys, f as customRoleId, l as ceilingGrants, m as customRoleScope, p as customRoleOf, x as resolveCustomRole } from "./evaluate-BAmf_AQd.js";
-import { a as heldLevels, f as bindingOf, h as usesAssigns, m as roleMeta, n as snapshotScopes, o as collectSnapshotGrants, p as rankRoles, r as assignableCandidates, t as snapshotOf } from "./instance-snapshot-DuWf1cT3.js";
+import { C as tenantCustomRoles, S as roleAllowKeys, f as customRoleId, l as ceilingGrants, m as customRoleScope, p as customRoleOf, x as resolveCustomRole } from "./evaluate-CsjXeLRo.js";
+import { a as heldLevels, f as bindingOf, h as usesAssigns, m as roleMeta, n as snapshotScopes, o as collectSnapshotGrants, p as rankRoles, r as assignableCandidates, t as snapshotOf } from "./instance-snapshot-BgOGtyCy.js";
 import { n as relationId } from "./relations-BxvRvDHK.js";
-import { i as snapshotGrant, r as plainPermission, t as buildSnapshot } from "./snapshot-CXlzi69u.js";
+import { i as snapshotGrant, r as plainPermission, t as buildSnapshot } from "./snapshot-DN_8J27z.js";
 import { n as LOCAL_CUSTOM_ROLE } from "./parse-local-manifest-DEiCF4ah.js";
-import { c as APP, r as resolveSubject } from "./permdock-BvjivVb9.js";
-import { i as memoryApprovalStore } from "./store-RNFvaJJv.js";
-import { n as wrapPermDock } from "./wrap-B2wziJI_.js";
+import { c as APP, r as resolveSubject } from "./permdock-DdzMv5-F.js";
+import { i as memoryApprovalStore } from "./store-XgBMbfDy.js";
+import { n as wrapPermDock } from "./wrap-C5PWzgkq.js";
 //#region src/conditions/sql-function.ts
 function sqlFunction(name, options) {
 	assertSqlFunctionName(name);
@@ -395,8 +397,8 @@ function shorter(a, b) {
 /**
 * `code` with every matching entry added as further stages: the result needs
 * all of them (`'sequential'` when any part is ordered), keeps the code's
-* escalation, the shortest `ttl`, and `distinct` unless every part opts out.
-* Without a matching entry, `code` unchanged.
+* escalation, the shortest `ttl`, and `'authorize'` unless every part is
+* `'confirm'`. Without a matching entry, `code` unchanged.
 */
 function tightenApproval(code, entries, input) {
 	const extra = entries.filter((entry) => (entry.permission === void 0 || entry.permission === input.permission) && metaMatches(entry, input.operation) && matches(entry, input.tenant, input.subject, input.current, input.next, input.now, input.scopes));
@@ -405,7 +407,7 @@ function tightenApproval(code, entries, input) {
 	const stages = [];
 	const seen = /* @__PURE__ */ new Set();
 	let sequential = false;
-	let distinct = false;
+	let authorize = false;
 	let staleOn;
 	let ttl;
 	for (const [index, part] of parts.entries()) {
@@ -418,18 +420,18 @@ function tightenApproval(code, entries, input) {
 			}
 		}
 		if (part === "human") {
-			distinct = true;
+			authorize = true;
 			continue;
 		}
-		sequential ||= part.mode === "sequential";
-		distinct ||= part.distinct !== false;
+		sequential ||= part.combine === "sequential";
+		authorize ||= part.mode !== "confirm";
 		staleOn ??= part.staleOn;
 		ttl = shorter(ttl, part.ttl);
 	}
 	return compact({
-		mode: sequential ? "sequential" : "all",
+		combine: sequential ? "sequential" : "all",
 		stages,
-		distinct: distinct ? void 0 : false,
+		mode: authorize ? void 0 : "confirm",
 		staleOn,
 		ttl,
 		escalation: code === void 0 || code === "human" ? void 0 : code.escalation
@@ -819,6 +821,152 @@ function signPolicyDocument(document, signer, options) {
 	});
 }
 //#endregion
+//#region src/core/instance-cache.ts
+const MAX_AGE_CEILING_MS = 6e4;
+const DEFAULT_MAX_AGE_MS = 5e3;
+const DEFAULT_MAX_ENTRIES$1 = 1e4;
+function roleKey(method, args) {
+	return `roles:${canonicalJson([method, ...args])}`;
+}
+function withoutMemo(context) {
+	if (context === void 0) return null;
+	const { memo: _memo, ...rest } = context;
+	return rest;
+}
+/**
+* An in-process `InstanceCache`: a bounded LRU that shares builds in flight.
+* Create it once at module scope and pass it as `instances` to every adapter of
+* the app; adapters with the same sources and policy share entries.
+*/
+function instanceCache(options = {}) {
+	const maxAgeMs = Math.min(Math.max(Math.floor(options.maxAgeMs ?? DEFAULT_MAX_AGE_MS), 0), MAX_AGE_CEILING_MS);
+	const maxEntries = Math.max(Math.floor(options.maxEntries ?? DEFAULT_MAX_ENTRIES$1), 1);
+	const now = options.now ?? Date.now;
+	const entries = /* @__PURE__ */ new Map();
+	const inFlight = /* @__PURE__ */ new Map();
+	const byPrincipal = /* @__PURE__ */ new Map();
+	const ownerIds = /* @__PURE__ */ new WeakMap();
+	let nextOwner = 0;
+	const counts = {
+		builds: 0,
+		shared: 0,
+		hits: 0,
+		evictions: 0
+	};
+	const ownerId = (owner) => {
+		const known = ownerIds.get(owner);
+		if (known !== void 0) return known;
+		nextOwner += 1;
+		const id = nextOwner;
+		ownerIds.set(owner, id);
+		return id;
+	};
+	const forget = (id) => {
+		const entry = entries.get(id);
+		entries.delete(id);
+		if (entry?.principal !== void 0) byPrincipal.get(entry.principal)?.delete(id);
+	};
+	const store = (id, entry) => {
+		entries.delete(id);
+		entries.set(id, entry);
+		if (entry.principal !== void 0) {
+			const keys = byPrincipal.get(entry.principal) ?? /* @__PURE__ */ new Set();
+			keys.add(id);
+			byPrincipal.set(entry.principal, keys);
+		}
+		if (entries.size > maxEntries) {
+			const oldest = entries.keys().next();
+			if (oldest.done !== true) forget(oldest.value);
+		}
+	};
+	const through = (id, principal, build) => {
+		const at = now();
+		const entry = entries.get(id);
+		if (entry !== void 0 && at - entry.at <= maxAgeMs) {
+			counts.hits += 1;
+			store(id, entry);
+			return entry.value;
+		}
+		if (entry !== void 0) forget(id);
+		const pending = inFlight.get(id);
+		if (pending !== void 0) {
+			counts.shared += 1;
+			return pending;
+		}
+		counts.builds += 1;
+		const answer = build();
+		if (!isThenable$1(answer)) {
+			if (maxAgeMs > 0) store(id, {
+				value: answer,
+				at,
+				principal
+			});
+			return answer;
+		}
+		const started = Promise.resolve(answer).then((value) => {
+			if (inFlight.get(id) === started && maxAgeMs > 0) store(id, {
+				value,
+				at,
+				principal
+			});
+			return value;
+		});
+		inFlight.set(id, started);
+		const settle = () => {
+			if (inFlight.get(id) === started) inFlight.delete(id);
+		};
+		started.then(settle, settle);
+		return started;
+	};
+	return Object.freeze({
+		name: "memory",
+		maxAgeMs,
+		instance(key, owners, build) {
+			const id = `instance:${owners.map((owner) => typeof owner === "object" && owner !== null || typeof owner === "function" ? ownerId(owner) : 0).join(",")}:${canonicalJson([
+				key.principal,
+				key.version,
+				key.tenant ?? null,
+				key.intent,
+				key.parts
+			])}`;
+			return Promise.resolve(through(id, key.principal, build));
+		},
+		customRoles(source) {
+			const sourceId = ownerId(source);
+			const { globalRoles, sharedRoles, assignable } = source;
+			return Object.freeze({
+				...source.name === void 0 ? {} : { name: source.name },
+				rolesFor: (tenant, context) => through(roleKey(`${sourceId}:rolesFor`, [tenant, withoutMemo(context)]), void 0, () => source.rolesFor(tenant, context)),
+				...assignable === void 0 ? {} : { assignable: (tenant) => through(roleKey(`${sourceId}:assignable`, [tenant]), void 0, () => assignable.call(source, tenant)) },
+				...globalRoles === void 0 ? {} : { globalRoles: (context) => through(roleKey(`${sourceId}:globalRoles`, [withoutMemo(context)]), void 0, () => globalRoles.call(source, context)) },
+				...sharedRoles === void 0 ? {} : { sharedRoles: (context) => through(roleKey(`${sourceId}:sharedRoles`, [withoutMemo(context)]), void 0, () => sharedRoles.call(source, context)) }
+			});
+		},
+		entitlements(source) {
+			const sourceId = ownerId(source);
+			return Object.freeze({
+				...source.name === void 0 ? {} : { name: source.name },
+				entitlementsFor: (principal, scope) => through(`entitlements:${sourceId}:${canonicalJson([principal.id, scope.tenant ?? null])}`, principal.id, () => source.entitlementsFor(principal, scope))
+			});
+		},
+		evict(principal) {
+			counts.evictions += 1;
+			const keys = byPrincipal.get(principal);
+			byPrincipal.delete(principal);
+			for (const id of keys ?? []) {
+				entries.delete(id);
+				inFlight.delete(id);
+			}
+		},
+		stats() {
+			return {
+				...counts,
+				size: entries.size
+			};
+		}
+	});
+}
+//#endregion
 //#region src/core/version-cache.ts
 const MAX_STALE_CEILING_MS = 6e4;
 const DEFAULT_MAX_ENTRIES = 1e4;
@@ -847,23 +995,6 @@ function memoryVersionCache(options) {
 			if (oldest.done !== true) entries.delete(oldest.value);
 		}
 	};
-	const observe = (principal, at) => {
-		const claimed = principal.authzVersion;
-		if (typeof claimed !== "number") return;
-		const issued = typeof principal.issuedAt === "number" ? principal.issuedAt * 1e3 : void 0;
-		const entry = entries.get(principal.id);
-		if (entry === void 0) {
-			if (issued !== void 0 && issued <= at && at - issued <= maxStaleMs) store(principal.id, {
-				version: claimed,
-				at: issued
-			});
-			return;
-		}
-		if (claimed > entry.version) store(principal.id, {
-			version: claimed,
-			at: issued === void 0 ? entry.at : Math.max(entry.at, issued)
-		});
-	};
 	const start = (id, read, at) => {
 		counts.reads += 1;
 		const keep = (version) => {
@@ -892,7 +1023,6 @@ function memoryVersionCache(options) {
 		current(principal, read, { live }) {
 			const at = now();
 			if (live) return start(principal.id, read, at);
-			observe(principal, at);
 			const entry = entries.get(principal.id);
 			if (entry !== void 0 && at - entry.at <= maxStaleMs) {
 				counts.hits += 1;
@@ -906,6 +1036,24 @@ function memoryVersionCache(options) {
 			}
 			return start(principal.id, read, at);
 		},
+		seed(principal, version, at) {
+			if (!Number.isFinite(version)) return;
+			const current = now();
+			const dated = at === void 0 ? current : nowMillis(at);
+			if (dated > current) return;
+			const entry = entries.get(principal);
+			if (entry === void 0) {
+				if (current - dated <= maxStaleMs) store(principal, {
+					version,
+					at: dated
+				});
+				return;
+			}
+			if (version > entry.version || version === entry.version && dated > entry.at) store(principal, {
+				version,
+				at: Math.max(entry.at, dated)
+			});
+		},
 		evict(principal) {
 			counts.evictions += 1;
 			entries.delete(principal);
@@ -2140,4 +2288,4 @@ function toCsvRow(event) {
 	].map(field).join(",");
 }
 //#endregion
-export { isOperationEffect as A, memoryLimitStore as C, memoryApprovalPolicySource as D, approvalPoliciesFor as E, memorySnapshotSource as F, sqlFunction as I, memoryEntitlementSource as M, memoryMembershipSource as N, validateApprovalPolicy as O, memorySettingsSource as P, limits as S, approvalPolicies as T, arazzoFindings as _, normalizeMembership as a, signPolicyDocument as b, crud as c, snapshotFor as d, customRoleSource as f, localSnapshotManifest as g, defineApp as h, decideRoleChange as i, memoryCustomRoleSource as j, defineOperations as k, readable as l, shadowMode as m, toCsvRow as n, normalizeMemberships as o, mayAccess as p, checkRoleChange as r, resolveScope as s, CSV_COLUMNS as t, writable as u, simulateArazzo as v, stripeEntitlementSource as w, memoryRelationSource as x, memoryVersionCache as y };
+export { defineOperations as A, limits as C, approvalPoliciesFor as D, approvalPolicies as E, memorySettingsSource as F, memorySnapshotSource as I, sqlFunction as L, memoryCustomRoleSource as M, memoryEntitlementSource as N, memoryApprovalPolicySource as O, memoryMembershipSource as P, memoryRelationSource as S, stripeEntitlementSource as T, arazzoFindings as _, normalizeMembership as a, instanceCache as b, crud as c, snapshotFor as d, customRoleSource as f, localSnapshotManifest as g, defineApp as h, decideRoleChange as i, isOperationEffect as j, validateApprovalPolicy as k, readable as l, shadowMode as m, toCsvRow as n, normalizeMemberships as o, mayAccess as p, checkRoleChange as r, resolveScope as s, CSV_COLUMNS as t, writable as u, simulateArazzo as v, memoryLimitStore as w, signPolicyDocument as x, memoryVersionCache as y };