permdock 0.15.0 → 0.17.0

package/dist/sveltekit/index.d.ts

@@ -1,9 +1,9 @@
-import { T as Policy, Zt as Snapshot, j as PolicyVocabulary, pr as Principal } from "../policy-types-DGIO_gxq.js";
+import { $t as Snapshot, E as Policy, M as PolicyVocabulary, _r as Principal } from "../policy-types-IRJVABmm.js";
 import { u as Permission } from "../permission-types-CAY-GU7e.js";
 import { a as OperationInput, t as Operation } from "../operations-Ci_rT6Uo.js";
-import { a as PermDock } from "../permdock-CprAPN3w.js";
-import { D as ConnectionOptions, T as Connection, f as InvalidSignatureError, i as OpenApiHooks, o as ProtectOptions, u as SnapshotQuery, v as discoverViaSignatureAgent, x as webBotAuthVerifier } from "../server-types-CyRN0-Cd.js";
-import { a as ProtectTarget, i as PermDockHandlers, n as FetchAdapterOptions, t as ContextReader } from "../fetch-adapter-BIbBAtPZ.js";
+import { a as PermDock } from "../permdock-DUWZEOLR.js";
+import { D as ConnectionOptions, T as Connection, f as InvalidSignatureError, i as OpenApiHooks, o as ProtectOptions, u as SnapshotQuery, v as discoverViaSignatureAgent, x as webBotAuthVerifier } from "../server-types-Bw-lWqzR.js";
+import { a as ProtectTarget, i as PermDockHandlers, n as FetchAdapterOptions, t as ContextReader } from "../fetch-adapter-BgqpOOpd.js";
 import { RequestEvent } from "@sveltejs/kit";
 //#region src/sveltekit/create.d.ts
 /**

package/dist/sveltekit/index.js

@@ -1,5 +1,5 @@
-import { l as InvalidSignatureError, p as webBotAuthVerifier, u as discoverViaSignatureAgent } from "../evaluations-IBceAeKT.js";
-import { n as guardedRoute, r as instanceRoute, t as fetchAdapter } from "../fetch-adapter-dPTgJVHd.js";
+import { l as InvalidSignatureError, p as webBotAuthVerifier, u as discoverViaSignatureAgent } from "../evaluations-DG40eSJa.js";
+import { n as guardedRoute, r as instanceRoute, t as fetchAdapter } from "../fetch-adapter-UZOW0PRC.js";
 //#region src/sveltekit/create.ts
 const route = {
 	context: (event) => event,

package/dist/{tables-DimBcVWY.js → tables-BsGE6HBR.js}

@@ -1,15 +1,15 @@
 import { c as listPermissions, h as formerKeys } from "./permission-registry-B8tYxPIt.js";
 import { a as expandRelation, c as isEdgeRelation, d as isSelfParented, l as isFieldRelation, o as groupEntries, p as restrictedFor, u as isPrincipalRelation } from "./resource-relations-8-pCScBO.js";
-import { f as scopeList, l as rootScope, s as resolveScope, u as scopeChain } from "./scopes-0Up_UA2t.js";
+import { c as rootScope, d as scopeList, l as scopeChain, s as resolveScope } from "./scopes-BSdYaGHs.js";
 import { o as flattenGrantee } from "./grantee-Dke-9rd1.js";
-import { r as relationCondition, t as inheritCondition } from "./grantee-conditions-BrYPe-w0.js";
-import { l as partitionsOf, p as scopeField } from "./tenancy-5d1zVBvK.js";
-import { a as delegatedScopeMap } from "./permdock-BvjivVb9.js";
-import { i as configError } from "./errors-Vpu6rKHl.js";
+import { r as relationCondition, t as inheritCondition } from "./grantee-conditions-DX4K_gGI.js";
+import { l as partitionsOf, p as scopeField } from "./tenancy-DvOHHk3-.js";
+import { a as delegatedScopeMap } from "./permdock-DdzMv5-F.js";
+import { i as configError } from "./errors-BhRkoNS7.js";
 import { d as sqlTextArray, i as qualifySqlTable, t as SQL_IDENT } from "./sql-0WjxIp9g.js";
-import { a as scopeMembershipTable, d as restrictedRowsSql, i as scopeColumn, l as relationArmSql } from "./compile-EzEMB-7v.js";
+import { a as scopeMembershipTable, d as restrictedRowsSql, i as scopeColumn, l as relationArmSql } from "./compile-B_oJqmIg.js";
 import { d as keptKeys, l as roleColumn, u as roleManifest } from "./sources-C4vkzZJV.js";
-import { A as quoteQualified, D as qualified, E as helperSchema, I as scopeTypeOf, O as quoteIdent, R as tenantTypeOf, _ as subjectClaimJsonSql, d as keyTenantSql, f as kindFilterSql, h as roleKindSql, i as allowEntry, j as quoteTable, k as quoteLiteral, m as memberVia, n as GLOBAL_ROLES, o as rootName, r as HELPERS, s as signedIn, t as CUSTOM_ROLES, u as globalKindFilterSql, v as subjectClaimSql, w as CLI, x as userIdHelperSql, y as subjectIdSql } from "./shared-DrGLwM3s.js";
+import { A as quoteQualified, D as qualified, E as helperSchema, I as scopeTypeOf, O as quoteIdent, R as tenantTypeOf, _ as subjectClaimJsonSql, d as keyTenantSql, f as kindFilterSql, h as roleKindSql, i as allowEntry, j as quoteTable, k as quoteLiteral, m as memberVia, n as GLOBAL_ROLES, o as rootName, r as HELPERS, s as signedIn, t as CUSTOM_ROLES, u as globalKindFilterSql, v as subjectClaimSql, w as CLI, x as userIdHelperSql, y as subjectIdSql } from "./shared-DyYVEjKC.js";
 //#region src/cli/sql/active.ts
 function checkActiveRow(label, row) {
 	quoteTable(row.table);

package/dist/tanstack-start/index.d.ts

@@ -1,9 +1,9 @@
-import { T as Policy, Zt as Snapshot, j as PolicyVocabulary, pr as Principal } from "../policy-types-DGIO_gxq.js";
+import { $t as Snapshot, E as Policy, M as PolicyVocabulary, _r as Principal } from "../policy-types-IRJVABmm.js";
 import { u as Permission } from "../permission-types-CAY-GU7e.js";
 import { a as OperationInput, t as Operation } from "../operations-Ci_rT6Uo.js";
-import { a as PermDock } from "../permdock-CprAPN3w.js";
-import { D as ConnectionOptions, T as Connection, f as InvalidSignatureError, i as OpenApiHooks, o as ProtectOptions, u as SnapshotQuery, v as discoverViaSignatureAgent, x as webBotAuthVerifier } from "../server-types-CyRN0-Cd.js";
-import { a as ProtectTarget, n as FetchAdapterOptions, t as ContextReader } from "../fetch-adapter-BIbBAtPZ.js";
+import { a as PermDock } from "../permdock-DUWZEOLR.js";
+import { D as ConnectionOptions, T as Connection, f as InvalidSignatureError, i as OpenApiHooks, o as ProtectOptions, u as SnapshotQuery, v as discoverViaSignatureAgent, x as webBotAuthVerifier } from "../server-types-Bw-lWqzR.js";
+import { a as ProtectTarget, n as FetchAdapterOptions, t as ContextReader } from "../fetch-adapter-BgqpOOpd.js";
 import { RequestMiddleware, RequestMiddlewareAfterServer, createMiddleware } from "@tanstack/react-start";
 //#region src/tanstack-start/create.d.ts
 type TanStackStartPermDockOptions<TUser = unknown> = FetchAdapterOptions<Request, TUser>;

package/dist/tanstack-start/index.js

@@ -1,5 +1,5 @@
-import { l as InvalidSignatureError, p as webBotAuthVerifier, u as discoverViaSignatureAgent } from "../evaluations-IBceAeKT.js";
-import { t as fetchAdapter } from "../fetch-adapter-dPTgJVHd.js";
+import { l as InvalidSignatureError, p as webBotAuthVerifier, u as discoverViaSignatureAgent } from "../evaluations-DG40eSJa.js";
+import { t as fetchAdapter } from "../fetch-adapter-UZOW0PRC.js";
 import { createMiddleware } from "@tanstack/react-start";
 //#region src/tanstack-start/create.ts
 function createPermDock(policy, options) {

package/dist/{tenancy-5d1zVBvK.js → tenancy-DvOHHk3-.js}

@@ -1,7 +1,7 @@
 import { o as sameId, t as expiredAt } from "./expiry-6XByK0dm.js";
 import { l as isFieldRelation } from "./resource-relations-8-pCScBO.js";
 import { o as epochSeconds } from "./time-nR1JesoH.js";
-import { d as scopeIdOf, h as tenantOf, l as rootScope, r as findScope, s as resolveScope, t as activeFor, u as scopeChain } from "./scopes-0Up_UA2t.js";
+import { c as rootScope, l as scopeChain, p as tenantOf, r as findScope, s as resolveScope, t as activeFor, u as scopeIdOf } from "./scopes-BSdYaGHs.js";
 //#region src/core/tenancy.ts
 function nowSeconds(now) {
 	return now ?? epochSeconds();

package/dist/terminal/index.d.ts

@@ -1,9 +1,9 @@
-import { T as Policy, Un as Decision, Wt as Instant, hr as Subject, j as PolicyVocabulary, pr as Principal } from "../policy-types-DGIO_gxq.js";
+import { E as Policy, Kt as Instant, M as PolicyVocabulary, _r as Principal, qn as Decision, yr as Subject } from "../policy-types-IRJVABmm.js";
 import { u as Permission } from "../permission-types-CAY-GU7e.js";
-import { a as PermDock } from "../permdock-CprAPN3w.js";
-import { m as ApprovalStore } from "../types-DLvhVm1r.js";
-import { a as ProblemDetails, t as ApprovalHint } from "../errors-BIM4MFsJ.js";
-import { t as InstanceOptions } from "../instance-options-CoHn-0e8.js";
+import { a as PermDock } from "../permdock-DUWZEOLR.js";
+import { m as ApprovalStore } from "../types-BvBbkAu1.js";
+import { a as ProblemDetails, t as ApprovalHint } from "../errors-Dc9FdamT.js";
+import { t as InstanceOptions } from "../instance-options-BOCRxEFb.js";
 //#region src/terminal/types.d.ts
 type TokenSourceName = "device" | "keychain" | "env" | "ci-oidc";
 type TokenSource = TokenSourceName | {

package/dist/terminal/index.js

@@ -1,13 +1,13 @@
 import { t as compact } from "../compact-CAf557ZB.js";
 import { a as deniedMessage, i as approvalMessage, n as PermDockDeniedError, t as PermDockApprovalRequiredError } from "../errors-B6R_lg2a.js";
 import { h as secondsAt } from "../time-nR1JesoH.js";
+import { r as isSubject } from "../subject-C7RddW0G.js";
 import { n as resourceRef } from "../resource-ref-CaS9yVPi.js";
-import { l as withApp } from "../permdock-BvjivVb9.js";
-import { r as isSubject } from "../subject-BGoM5o8B.js";
+import { l as withApp } from "../permdock-DdzMv5-F.js";
 import { n as readBodyText } from "../body-text-DQhcmqdY.js";
-import { l as storedApprovalToken, s as resumeDecision } from "../helpers-DJicaG6f.js";
+import { l as storedApprovalToken, s as resumeDecision } from "../helpers-DNnZffrI.js";
 import { t as timeoutSignal } from "../timeout-D51niuQP.js";
-import { n as resolveOrNull, t as buildInstance } from "../build-instance-BWXqwQYU.js";
+import { n as resolveOrNull, t as buildInstance } from "../build-instance-lye7oEqf.js";
 import { a as refreshCredential, o as revokeCredential, s as runDeviceFlow, t as TERMINAL_TIMEOUT_MS } from "../device-BwbJNmb2.js";
 import { i as writeCredentials, n as deleteCredentials, r as readCredentials } from "../storage-C2bWdvJH.js";
 import { createInterface } from "node:readline";
@@ -241,12 +241,12 @@ function envOf(options) {
 }
 /**
 * The local y/N is the requester answering for themselves, so it stands in for
-* an approval only where the grant allows that (`distinct: false`) and no agent
+* an approval only where the grant allows that (`mode: 'confirm'`) and no agent
 * is acting for the user.
 */
 function answersLocally(decision, subject) {
 	const approval = decision.grant.approval;
-	return typeof approval === "object" && approval.distinct === false && subject.actor === void 0;
+	return typeof approval === "object" && approval.mode === "confirm" && subject.actor === void 0;
 }
 function isInteractive(options) {
 	if (typeof options.interactive === "boolean") return options.interactive;

package/dist/testing/core.d.ts

@@ -1,2 +1,2 @@
-import { S as policyMatrix, _ as DescribePolicyConfig, a as OrmParityScenario, b as PolicyMatrixCell, c as RlsFieldsOutcome, d as RlsParityOptions, f as RlsParityReport, g as testRlsParity, h as RlsQueryResult, i as OrmParityRunInput, l as RlsParityCase, m as RlsQueryFn, n as OrmParityOptions, o as testOrmParity, p as RlsParitySubject, r as OrmParityReport, s as RlsDbOutcome, t as OrmParityCase, u as RlsParityFixture, v as MatrixCell, x as PolicyMatrixReport, y as MatrixOutcome } from "../core-CFepFiDP.js";
+import { S as policyMatrix, _ as DescribePolicyConfig, a as OrmParityScenario, b as PolicyMatrixCell, c as RlsFieldsOutcome, d as RlsParityOptions, f as RlsParityReport, g as testRlsParity, h as RlsQueryResult, i as OrmParityRunInput, l as RlsParityCase, m as RlsQueryFn, n as OrmParityOptions, o as testOrmParity, p as RlsParitySubject, r as OrmParityReport, s as RlsDbOutcome, t as OrmParityCase, u as RlsParityFixture, v as MatrixCell, x as PolicyMatrixReport, y as MatrixOutcome } from "../core-0iYZ5HUx.js";
 export { type DescribePolicyConfig, type MatrixCell, type MatrixOutcome, type OrmParityCase, type OrmParityOptions, type OrmParityReport, type OrmParityRunInput, type OrmParityScenario, type PolicyMatrixCell, type PolicyMatrixReport, type RlsDbOutcome, type RlsFieldsOutcome, type RlsParityCase, type RlsParityFixture, type RlsParityOptions, type RlsParityReport, type RlsParitySubject, type RlsQueryFn, type RlsQueryResult, policyMatrix, testOrmParity, testRlsParity };

package/dist/testing/core.js

@@ -1 +1 @@
-export { r as policyMatrix, t as testOrmParity, n as testRlsParity } from "../core-lxoANyai.js";
+export { r as policyMatrix, t as testOrmParity, n as testRlsParity } from "../core-W5f4Rjt0.js";

package/dist/testing/fixtures/index.d.ts

@@ -1,4 +1,4 @@
-import { a as CatalogDocument } from "../../types-ZzRGoViD.js";
+import { a as CatalogDocument } from "../../types-NYoj8JBm.js";
 import { i as SupabaseManifest } from "../../manifest-B5yF3CIq.js";
 //#region src/testing/fixtures/index.d.ts
 /**

package/dist/testing/fixtures/index.js

@@ -1,5 +1,5 @@
 import { n as parseSupabaseManifest } from "../../manifest-BXTbHNIV.js";
-import { t as parseCatalog } from "../../parse-1_ZheTW5.js";
+import { t as parseCatalog } from "../../parse-UTC-sDrt.js";
 //#region src/testing/fixtures/better-supabase.catalog.json
 var better_supabase_catalog_default = {
 	$schema: "https://permdock.com/schemas/catalog-v1.json",

package/dist/testing/index.d.ts

@@ -1,30 +1,31 @@
-import { G as CustomRoleSource, J as DecisionSink, T as Policy, U as CredentialVerifier, Y as EntitlementSource, Zt as Snapshot, bt as WhereCompiler, ct as SnapshotSource, dt as SubjectResolver, et as LimitStore, fr as Membership, hr as Subject, ht as TokenVerifier, mt as TokenSigner, nt as MembershipSource, ot as RelationSource, pr as Principal, q as DecisionProvider, sn as DeliveryChannel, st as SettingsSource } from "../policy-types-DGIO_gxq.js";
+import { $t as Snapshot, E as Policy, J as DecisionProvider, K as CustomRoleSource, St as WhereCompiler, W as CredentialVerifier, X as EntitlementSource, Y as DecisionSink, _r as Principal, _t as TokenVerifier, ct as SettingsSource, gr as Membership, gt as TokenSigner, ln as DeliveryChannel, lt as SnapshotSource, pt as SubjectResolver, rt as MembershipSource, st as RelationSource, tt as LimitStore, yr as Subject } from "../policy-types-IRJVABmm.js";
 import { g as ResourceInit, l as InferPermissionTree, u as Permission } from "../permission-types-CAY-GU7e.js";
 import { r as Role } from "../vocabulary-DEJ5j4mR.js";
-import { st as LegacyCheck } from "../index-Cay5-Kvx.js";
-import { D as ApprovalPolicySource, _ as PrincipalSource, a as PermDock, b as Limits, h as PrincipalIdentity } from "../permdock-CprAPN3w.js";
-import { s as PolicySource } from "../hosted-DVxlLZMe.js";
-import { a as ApprovalDelegationSource, m as ApprovalStore } from "../types-DLvhVm1r.js";
-import { a as ProblemDetails } from "../errors-BIM4MFsJ.js";
-import { c as ModelMap, t as AgentPermDock, u as ToolMap } from "../create-BPUopdfL.js";
-import { c as AccessReviewStore } from "../types-B2efzoSX.js";
-import { R as IdempotencyStore } from "../index-DJwEgYzA.js";
+import { st as LegacyCheck } from "../index-Bt-UoBWu.js";
+import { i as ApprovalPolicySource } from "../approval-policies-9VagPixq.js";
+import { C as InstanceCache, _ as PrincipalSource, a as PermDock, b as Limits, h as PrincipalIdentity } from "../permdock-DUWZEOLR.js";
+import { s as PolicySource } from "../hosted-DxRLLiFU.js";
+import { a as ApprovalDelegationSource, m as ApprovalStore } from "../types-BvBbkAu1.js";
+import { a as ProblemDetails } from "../errors-Dc9FdamT.js";
+import { c as ModelMap, t as AgentPermDock, u as ToolMap } from "../create-bzQlBzG4.js";
+import { c as AccessReviewStore } from "../types-AOP5HQku.js";
+import { R as IdempotencyStore } from "../index-CXXUFWtG.js";
 import { n as RevocationFeed } from "../revocations-BaUXHM1N.js";
-import { s as SupportSessionSource } from "../index-CV-7DWeD.js";
+import { s as SupportSessionSource } from "../index-DtGtDzjb.js";
 import { r as SupabaseHookManifest } from "../manifest-B5yF3CIq.js";
-import { n as VersionCache } from "../version-cache-Df11C2Qp.js";
-import { t as supabaseMembershipsBudget } from "../budget-hYsPz_yE.js";
-import { a as AutomationSource, t as Automation } from "../automation-C6Jg75xq.js";
-import { c as DeliveryTransport, g as TransportMessages } from "../types-CN0LsqbK.js";
-import { t as CloudApproverOptions } from "../types-BB-zWDcR.js";
-import { n as ApprovalWaiter } from "../waiter-CqUKX6CY.js";
-import { g as SetQueue, l as ReplayStore } from "../types-DsHGPtkR.js";
-import { r as SnapshotStorage } from "../types-CWBsAwqn.js";
-import { x as DirectoryStore } from "../index-Dj2qF9VC.js";
-import { S as SsfStreamStore } from "../index-BinlXeU-.js";
-import { S as policyMatrix, _ as DescribePolicyConfig, a as OrmParityScenario, b as PolicyMatrixCell, c as RlsFieldsOutcome, d as RlsParityOptions, f as RlsParityReport, g as testRlsParity, h as RlsQueryResult, i as OrmParityRunInput, l as RlsParityCase, m as RlsQueryFn, n as OrmParityOptions, o as testOrmParity, p as RlsParitySubject, r as OrmParityReport, s as RlsDbOutcome, t as OrmParityCase, u as RlsParityFixture, v as MatrixCell, x as PolicyMatrixReport, y as MatrixOutcome } from "../core-CFepFiDP.js";
+import { n as VersionCache } from "../version-cache-9Vq5QVFC.js";
+import { t as supabaseMembershipsBudget } from "../budget-CNLsV2SL.js";
+import { a as AutomationSource, t as Automation } from "../automation-DCWuVKtd.js";
+import { c as DeliveryTransport, g as TransportMessages } from "../types-UfpcY575.js";
+import { t as CloudApproverOptions } from "../types-CA-A33Q5.js";
+import { n as ApprovalWaiter } from "../waiter-C2cXXLFZ.js";
+import { g as SetQueue, l as ReplayStore } from "../types-CJC1aaoJ.js";
+import { r as SnapshotStorage } from "../types-D29K5ZNP.js";
+import { x as DirectoryStore } from "../index-CZ5mixHO.js";
+import { S as SsfStreamStore } from "../index-z44pfWar.js";
+import { S as policyMatrix, _ as DescribePolicyConfig, a as OrmParityScenario, b as PolicyMatrixCell, c as RlsFieldsOutcome, d as RlsParityOptions, f as RlsParityReport, g as testRlsParity, h as RlsQueryResult, i as OrmParityRunInput, l as RlsParityCase, m as RlsQueryFn, n as OrmParityOptions, o as testOrmParity, p as RlsParitySubject, r as OrmParityReport, s as RlsDbOutcome, t as OrmParityCase, u as RlsParityFixture, v as MatrixCell, x as PolicyMatrixReport, y as MatrixOutcome } from "../core-0iYZ5HUx.js";
 import { a as SaasProject } from "../permissions-Bx6UI8n1.js";
-import { n as saasPolicy } from "../policy-BycVKnXv.js";
+import { n as saasPolicy } from "../policy-CTNl7pvN.js";
 import { expectTypeOf } from "vitest";
 //#region src/testing/describe-policy.d.ts
 /** `policyMatrix` under Vitest: one test per cell, plus the exhaustive check. */
@@ -642,6 +643,12 @@ export declare function testPolicySource(source: PolicySource, options?: {
   readonly policy?: Policy;
 }): void;
 export declare function testVersionCache(cache: VersionCache): void;
+/**
+ * The `InstanceCache` contract: one build per key while it lives, a shared
+ * build in flight, no stored rejection, and `evict` dropping a principal's
+ * entries.
+ */
+export declare function testInstanceCache(cache: InstanceCache): void;
 //#endregion
 //#region src/testing/conformance/providers.d.ts
 type DecisionProviderRunnerOptions = {

package/dist/testing/index.js

@@ -1,44 +1,45 @@
 import { r as isRecord } from "../compact-CAf557ZB.js";
 import { n as freezeDeep } from "../freeze-jjan0lCv.js";
 import { i as principal } from "../refs-C8BKxc_e.js";
-import { n as role, r as allow } from "../role-builder-BK2-T6oD.js";
-import { C as memoryLimitStore, E as approvalPoliciesFor, S as limits, d as snapshotFor, j as memoryCustomRoleSource } from "../src-C_pi2Rnh.js";
+import { n as role, r as allow } from "../role-builder-BrmOcXch.js";
+import { C as limits, D as approvalPoliciesFor, M as memoryCustomRoleSource, d as snapshotFor, w as memoryLimitStore } from "../src-nYNBfmgq.js";
 import { t as memoryRevocationFeed } from "../revocations-Bhr0aMIC.js";
 import { n as loadPrincipalByIdentity, t as loadPrincipal } from "../principal-source-C6N60GtM.js";
 import { v as resource } from "../permission-registry-B8tYxPIt.js";
 import { d as isoNow, f as nowMillis, p as nowSeconds, u as isoAt } from "../time-nR1JesoH.js";
 import { r as parseAutomation } from "../automation-x3KEUusw.js";
-import { f as scopeList, o as normalizeMemberships } from "../scopes-0Up_UA2t.js";
-import { u as evaluateCondition } from "../delegation-CDB6_keF.js";
+import { d as scopeList, o as normalizeMemberships } from "../scopes-BSdYaGHs.js";
+import { u as evaluateCondition } from "../delegation-aK4T_5WU.js";
 import { a as authenticated } from "../grantee-Dke-9rd1.js";
 import { t as byCodePoint } from "../compare-DTfyUunF.js";
-import { r as definePolicy } from "../policy-CLQ8__GF.js";
-import { c as mergeHostedGrants, l as parsePolicyDocument } from "../hosted-D0IzESu_.js";
+import { r as definePolicy } from "../policy-DxQyHKPB.js";
+import { c as mergeHostedGrants, l as parsePolicyDocument } from "../hosted-tPZnyjQS.js";
 import { t as definePermissions } from "../permissions-CVXmRILq.js";
-import { T as validateCustomRole } from "../evaluate-BAmf_AQd.js";
-import { n as parseSnapshot } from "../snapshot-CXlzi69u.js";
-import { n as fromSnapshot } from "../from-snapshot-DCakWRsr.js";
-import { t as getPermDock } from "../permdock-BvjivVb9.js";
+import { i as rootMembershipId } from "../subject-C7RddW0G.js";
+import { T as validateCustomRole } from "../evaluate-CsjXeLRo.js";
+import { n as parseSnapshot } from "../snapshot-DN_8J27z.js";
+import { n as fromSnapshot } from "../from-snapshot-DMlSSo9b.js";
+import { t as getPermDock } from "../permdock-DdzMv5-F.js";
 import { t as APPROVAL_HEADER } from "../types-CcUXciSj.js";
-import { i as memoryApprovalStore } from "../store-RNFvaJJv.js";
+import { i as memoryApprovalStore } from "../store-XgBMbfDy.js";
 import { t as catalogFingerprint } from "../catalog-fingerprint-e6aCWosn.js";
-import { s as parseCredential } from "../credential-CyyyvCsL.js";
+import { s as parseCredential } from "../credential-B3Hj4puZ.js";
 import { c as problemFromDecision } from "../problem-BVLHFK33.js";
-import { o as resolveApproval } from "../helpers-DJicaG6f.js";
-import { t as APPROVAL_REQUEST_SCHEMA } from "../request-schema-DhX7UbfQ.js";
-import { t as catalogSchema } from "../schema-BOJjqlWL.js";
-import { t as supabaseMembershipsBudget } from "../budget-BELja5A9.js";
-import { c as parseApiKey } from "../server-3cVlTLde.js";
+import { o as resolveApproval } from "../helpers-DNnZffrI.js";
+import { t as APPROVAL_REQUEST_SCHEMA } from "../request-schema-CMP8Cmxd.js";
+import { t as catalogSchema } from "../schema-CuX70xgH.js";
+import { t as supabaseMembershipsBudget } from "../budget-BBCPDOGP.js";
+import { c as parseApiKey } from "../server-D0PW6ZCw.js";
 import { n as discoverAuthorizationServer } from "../device-BwbJNmb2.js";
 import { t as CONNECTOR_SCHEMA } from "../connector-schema-CYLQNMYq.js";
-import { l as sha256Hex, n as scimHandler, t as directoryMembershipSource } from "../scim-jJBJ7g1Z.js";
+import { l as sha256Hex, n as scimHandler, t as directoryMembershipSource } from "../scim-C30QBBoF.js";
 import { c as quoteSqlTable, o as quoteSqlIdent } from "../sql-0WjxIp9g.js";
-import { i as cloudEndpoints, n as cloud, s as approverHeaders, t as bearerChallenge } from "../challenge-DImNcR7B.js";
+import { i as cloudEndpoints, n as cloud, s as approverHeaders, t as bearerChallenge } from "../challenge-M_ghKJnT.js";
 import { t as supabaseManifestSchema } from "../manifest-schema-DQkBK2Mr.js";
-import { t as PUSHED_POLICY_SCHEMA } from "../pushed-policy-CDuOL2de.js";
-import { i as policyMatrixLayout, n as testRlsParity, r as policyMatrix, t as testOrmParity } from "../core-lxoANyai.js";
-import { i as saasPermissions } from "../permissions-CYcHj_w7.js";
-import { C as saasOrg, E as saasSeed, S as saasMemberships, a as saasProject, g as verifySaasSession, h as signSaasToken, k as saasPolicy, t as saasDoc, w as saasPrincipal, x as saasCustomRoles } from "../saas-DK4V-3Is.js";
+import { t as PUSHED_POLICY_SCHEMA } from "../pushed-policy-DMXAOmEW.js";
+import { i as policyMatrixLayout, n as testRlsParity, r as policyMatrix, t as testOrmParity } from "../core-W5f4Rjt0.js";
+import { i as saasPermissions } from "../permissions-CvpPtz5O.js";
+import { C as saasOrg, E as saasSeed, S as saasMemberships, a as saasProject, g as verifySaasSession, h as signSaasToken, k as saasPolicy, t as saasDoc, w as saasPrincipal, x as saasCustomRoles } from "../saas-BqM9mJkk.js";
 import { t as POLICY_NOT_PUBLISHED } from "../problem-types-DSsRfONQ.js";
 import { t as require__2020 } from "../2020-CJbO8Bvz.js";
 import { afterAll, assert, beforeAll, describe, expect, expectTypeOf, it, vi } from "vitest";
@@ -135,12 +136,14 @@ function leadSnapshot() {
 		memberships: [
 			...saasMemberships("gina"),
 			{
-				tenant: "globex",
+				scope: "tenant",
+				id: "globex",
 				roles: ["viewer"]
 			},
 			{
-				tenant: "globex",
-				team: "team-a",
+				within: { tenant: "globex" },
+				scope: "team",
+				id: "team-a",
 				roles: ["lead"]
 			}
 		]
@@ -573,7 +576,10 @@ function createDomain$2() {
 		const principal = saasPrincipal(sub, orgOf(path));
 		return {
 			...principal,
-			memberships: (principal.memberships ?? []).filter((membership) => membership.tenant === void 0 || !demoted.has(demotionKey(sub, membership.tenant)))
+			memberships: (principal.memberships ?? []).filter((membership) => {
+				const tenant = membership.within?.["tenant"] ?? rootMembershipId(membership);
+				return tenant === void 0 || !demoted.has(demotionKey(sub, tenant));
+			})
 		};
 	};
 	return {
@@ -1874,7 +1880,8 @@ function tenantApprover(tenant) {
 			id: "u_9",
 			roles: [],
 			memberships: [{
-				tenant,
+				scope: "tenant",
+				id: tenant,
 				roles: ["admin"]
 			}]
 		},
@@ -2013,7 +2020,7 @@ function testApprovalStore(store, options = {}) {
 			by: member
 		}))).rejects.toThrow(/eligible|not pending|not found/u);
 	});
-	it("refuses the principal as approver unless the grant sets distinct: false", async () => {
+	it("refuses the principal as approver unless the grant sets mode: confirm", async () => {
 		const principal = {
 			principal: {
 				id: "u_1",
@@ -2024,9 +2031,9 @@ function testApprovalStore(store, options = {}) {
 		const shapes = [
 			["self-human", void 0],
 			["self-by", { by: admin$2 }],
-			["self-distinct", {
+			["self-authorize", {
 				by: admin$2,
-				distinct: true
+				mode: "authorize"
 			}]
 		];
 		for (const [token, approvers] of shapes) {
@@ -2044,7 +2051,7 @@ function testApprovalStore(store, options = {}) {
 			...sampleApproval("self-optout"),
 			approvers: {
 				by: admin$2,
-				distinct: false
+				mode: "confirm"
 			}
 		});
 		const resolved = await store.resolve("self-optout", {
@@ -2183,7 +2190,7 @@ function testApprovalStore(store, options = {}) {
 		await store.create({
 			...sampleApproval("stages-token"),
 			approvers: {
-				mode: "sequential",
+				combine: "sequential",
 				stages: [{ by: {
 					kind: "user",
 					id: "u_10"
@@ -2499,6 +2506,16 @@ function testVersionCache(cache) {
 		expect(await cache.current(principal, read, { live: false })).toBe(1);
 		expect(calls.count).toBe(1);
 	});
+	it("answers a read from a seed and never lowers a seeded version", async () => {
+		const { calls, read } = counted(1);
+		const principal = { id: "u-version-seed" };
+		cache.seed(principal.id, 6);
+		cache.seed(principal.id, 5);
+		if (cache.maxStaleMs > 0) {
+			expect(await cache.current(principal, read, { live: false })).toBe(6);
+			expect(calls.count).toBe(0);
+		}
+	});
 	it("reads again after evict", async () => {
 		const { calls, read } = counted(3);
 		const principal = { id: "u-version-evict" };
@@ -2509,6 +2526,60 @@ function testVersionCache(cache) {
 		expect(cache.stats().reads).toBeGreaterThanOrEqual(2);
 	});
 }
+/**
+* The `InstanceCache` contract: one build per key while it lives, a shared
+* build in flight, no stored rejection, and `evict` dropping a principal's
+* entries.
+*/
+function testInstanceCache(cache) {
+	const key = (principal, version = 1) => ({
+		principal,
+		version,
+		intent: "read",
+		parts: {}
+	});
+	const counted = () => {
+		const calls = { count: 0 };
+		const build = async () => {
+			calls.count += 1;
+			return { n: calls.count };
+		};
+		return {
+			calls,
+			build
+		};
+	};
+	it("builds once per key and keys versions apart", async () => {
+		const { calls, build } = counted();
+		const first = await cache.instance(key("u-instance-key"), [], build);
+		const again = await cache.instance(key("u-instance-key"), [], build);
+		const next = await cache.instance(key("u-instance-key", 2), [], build);
+		if (cache.maxAgeMs > 0) {
+			expect(again).toBe(first);
+			expect(calls.count).toBe(2);
+		}
+		expect(next).not.toBe(first);
+	});
+	it("shares one build between concurrent calls", async () => {
+		const { calls, build } = counted();
+		const built = await Promise.all(Array.from({ length: 5 }, async () => cache.instance(key("u-instance-shared"), [], build)));
+		expect(new Set(built).size).toBe(1);
+		expect(calls.count).toBe(1);
+	});
+	it("stores no rejected build", async () => {
+		await expect(cache.instance(key("u-instance-failed"), [], () => Promise.reject(/* @__PURE__ */ new Error("down")))).rejects.toThrow("down");
+		const { calls, build } = counted();
+		await cache.instance(key("u-instance-failed"), [], build);
+		expect(calls.count).toBe(1);
+	});
+	it("builds again after evict", async () => {
+		const { calls, build } = counted();
+		await cache.instance(key("u-instance-evict"), [], build);
+		cache.evict("u-instance-evict");
+		await cache.instance(key("u-instance-evict"), [], build);
+		expect(calls.count).toBe(2);
+	});
+}
 //#endregion
 //#region src/testing/cloud-api/platform.ts
 const CATALOG = "https://permdock.com/schemas/catalog-v1.json";
@@ -5657,12 +5728,7 @@ function testMembershipSource(source, options) {
 				memberships = [];
 			}
 			for (const membership of memberships) {
-				const shapes = [
-					membership.scope !== void 0,
-					membership.tenant !== void 0 || membership.team !== void 0,
-					membership.on !== void 0
-				].filter(Boolean);
-				expect(shapes.length).toBe(1);
+				expect(membership.scope === void 0 !== (membership.on === void 0)).toBe(true);
 				expect(Array.isArray(membership.roles)).toBe(true);
 				if (options.policy !== void 0) expect(normalizeMemberships([membership], scopeList(options.policy.scopes))).toHaveLength(1);
 			}
@@ -5781,7 +5847,8 @@ function testDirectoryStore(store, options) {
 			value: true
 		}]);
 		expect(await source.membershipsFor({ id: "00u1" }, { tenant: home })).toStrictEqual([{
-			tenant: home,
+			scope: "tenant",
+			id: home,
 			roles: ["editor"],
 			via: `group:${group.id}`,
 			managedBy: "idp"
@@ -6001,7 +6068,8 @@ const supabaseClaimFixtures = {
 			user_metadata: {
 				user_role: "admin",
 				memberships: [{
-					tenant: "acme",
+					scope: "tenant",
+					id: "acme",
 					roles: ["owner"]
 				}]
 			}
@@ -6017,10 +6085,12 @@ const supabaseClaimFixtures = {
 			...base,
 			tenant_id: "acme",
 			memberships: [{
-				tenant: "acme",
+				scope: "tenant",
+				id: "acme",
 				roles: ["admin"]
 			}, {
-				tenant: "globex",
+				scope: "tenant",
+				id: "globex",
 				roles: ["viewer"]
 			}]
 		},
@@ -6029,10 +6099,12 @@ const supabaseClaimFixtures = {
 			roles: [],
 			tenant: "acme",
 			memberships: [{
-				tenant: "acme",
+				scope: "tenant",
+				id: "acme",
 				roles: ["admin"]
 			}, {
-				tenant: "globex",
+				scope: "tenant",
+				id: "globex",
 				roles: ["viewer"]
 			}]
 		}
@@ -6586,4 +6658,4 @@ const PROBLEM_EXAMPLES = Object.freeze({
 	}
 });
 //#endregion
-export { AGENT_THROWING_ROW, AGENT_THROWING_USER, PROBLEM_EXAMPLES, authzenTodoData, authzenTodoPermissions, authzenTodoPolicy, authzenTodoUsers, authzenTodoVectors, describePolicy, expectTypeOf, jwtFixtureAudience, jwtFixtureIssuer, jwtFixtureJwks, jwtFixtureTokens, policyMatrix, seedRows, snapshotFixture, supabaseClaimFixtures, supabaseClaimVectors, supabaseHookManifestFixture, supabaseMembershipsBudget, testAccessReviewStore, testAgentAdapter, testAgentRuntime, testApprovalDelegationSource, testApprovalPolicySource, testApprovalStore, testApprovalWaiter, testAuthzen, testAutomationSource, testClientParity, testClientStore, testCloudApi, testCredentialVerifier, testCustomRoleSource, testDecisionProvider, testDecisionSink, testDeliveryTransport, testDirectoryStore, testEntitlementSource, testHttpAdapter, testIdempotencyStore, testLegacyParity, testLimitStore, testMembershipSource, testOrmParity, testPolicySource, testPrincipalSource, testRelationSource, testReplayStore, testRevocationFeed, testRlsParity, testSetQueue, testSettingsSource, testSnapshotSource, testSnapshotStorage, testSsfStreamStore, testSubjectResolver, testSupportSessionSource, testTokenSigner, testTokenVerifier, testVersionCache, testWhereCompiler };
+export { AGENT_THROWING_ROW, AGENT_THROWING_USER, PROBLEM_EXAMPLES, authzenTodoData, authzenTodoPermissions, authzenTodoPolicy, authzenTodoUsers, authzenTodoVectors, describePolicy, expectTypeOf, jwtFixtureAudience, jwtFixtureIssuer, jwtFixtureJwks, jwtFixtureTokens, policyMatrix, seedRows, snapshotFixture, supabaseClaimFixtures, supabaseClaimVectors, supabaseHookManifestFixture, supabaseMembershipsBudget, testAccessReviewStore, testAgentAdapter, testAgentRuntime, testApprovalDelegationSource, testApprovalPolicySource, testApprovalStore, testApprovalWaiter, testAuthzen, testAutomationSource, testClientParity, testClientStore, testCloudApi, testCredentialVerifier, testCustomRoleSource, testDecisionProvider, testDecisionSink, testDeliveryTransport, testDirectoryStore, testEntitlementSource, testHttpAdapter, testIdempotencyStore, testInstanceCache, testLegacyParity, testLimitStore, testMembershipSource, testOrmParity, testPolicySource, testPrincipalSource, testRelationSource, testReplayStore, testRevocationFeed, testRlsParity, testSetQueue, testSettingsSource, testSnapshotSource, testSnapshotStorage, testSsfStreamStore, testSubjectResolver, testSupportSessionSource, testTokenSigner, testTokenVerifier, testVersionCache, testWhereCompiler };

package/dist/testing/saas/index.d.ts

@@ -1,8 +1,8 @@
-import { Wt as Instant, et as LimitStore, fr as Membership, hr as Subject, lr as Delegation, ot as RelationSource, pr as Principal, rr as Actor, sr as CustomRole } from "../../policy-types-DGIO_gxq.js";
+import { Kt as Instant, _r as Principal, dr as CustomRole, gr as Membership, pr as Delegation, sr as Actor, st as RelationSource, tt as LimitStore, yr as Subject } from "../../policy-types-IRJVABmm.js";
 import { u as Permission } from "../../permission-types-CAY-GU7e.js";
-import { o as PermDockOptions } from "../../permdock-CprAPN3w.js";
+import { o as PermDockOptions } from "../../permdock-DUWZEOLR.js";
 import { a as SaasProject, c as saasPlans, i as SaasFolderSchema, l as saasRoles, n as SaasDocSchema, o as SaasProjectSchema, r as SaasFolder, s as saasPermissions, t as SaasDoc, u as saasTenantRoleNames } from "../../permissions-Bx6UI8n1.js";
-import { n as saasPolicy, t as SAAS_API_KEY_LIMIT } from "../../policy-BycVKnXv.js";
+import { n as saasPolicy, t as SAAS_API_KEY_LIMIT } from "../../policy-CTNl7pvN.js";
 import { StandardSchemaV1 } from "@standard-schema/spec";
 //#region src/testing/saas/schema.d.ts
 type FieldKind = "string" | "boolean" | "nullable-string";

package/dist/testing/saas/index.js

@@ -1,3 +1,3 @@
-import { a as saasPlans, c as rowSchema, i as saasPermissions, n as SaasFolderSchema, o as saasRoles, r as SaasProjectSchema, s as saasTenantRoleNames, t as SaasDocSchema } from "../../permissions-CYcHj_w7.js";
-import { C as saasOrg, D as saasUsers, E as saasSeed, O as SAAS_API_KEY_LIMIT, S as saasMemberships, T as saasRelations, _ as verifySaasToken, a as saasProject, b as SAAS_EXPIRED_AT, c as saasUser, d as saasIssuer, f as saasJwks, g as verifySaasSession, h as signSaasToken, i as saasLimitStore, k as saasPolicy, l as SAAS_TOKEN_TTL_SECONDS, m as saasPublicJwk, n as saasFolder, o as saasScenarioOptions, p as saasPrivateJwk, r as saasFolderScenarios, s as saasScenarios, t as saasDoc, u as saasAudience, v as saasSchemaSql, w as saasPrincipal, x as saasCustomRoles, y as saasSeedSql } from "../../saas-DK4V-3Is.js";
+import { a as saasPlans, c as rowSchema, i as saasPermissions, n as SaasFolderSchema, o as saasRoles, r as SaasProjectSchema, s as saasTenantRoleNames, t as SaasDocSchema } from "../../permissions-CvpPtz5O.js";
+import { C as saasOrg, D as saasUsers, E as saasSeed, O as SAAS_API_KEY_LIMIT, S as saasMemberships, T as saasRelations, _ as verifySaasToken, a as saasProject, b as SAAS_EXPIRED_AT, c as saasUser, d as saasIssuer, f as saasJwks, g as verifySaasSession, h as signSaasToken, i as saasLimitStore, k as saasPolicy, l as SAAS_TOKEN_TTL_SECONDS, m as saasPublicJwk, n as saasFolder, o as saasScenarioOptions, p as saasPrivateJwk, r as saasFolderScenarios, s as saasScenarios, t as saasDoc, u as saasAudience, v as saasSchemaSql, w as saasPrincipal, x as saasCustomRoles, y as saasSeedSql } from "../../saas-BqM9mJkk.js";
 export { SAAS_API_KEY_LIMIT, SAAS_EXPIRED_AT, SAAS_TOKEN_TTL_SECONDS, SaasDocSchema, SaasFolderSchema, SaasProjectSchema, rowSchema, saasAudience, saasCustomRoles, saasDoc, saasFolder, saasFolderScenarios, saasIssuer, saasJwks, saasLimitStore, saasMemberships, saasOrg, saasPermissions, saasPlans, saasPolicy, saasPrincipal, saasPrivateJwk, saasProject, saasPublicJwk, saasRelations, saasRoles, saasScenarioOptions, saasScenarios, saasSchemaSql, saasSeed, saasSeedSql, saasTenantRoleNames, saasUser, saasUsers, signSaasToken, verifySaasSession, verifySaasToken };

package/dist/testing/saas/permissions.js

@@ -1 +1 @@
-export { t as SaasDocSchema, n as SaasFolderSchema, r as SaasProjectSchema, i as saasPermissions, a as saasPlans, o as saasRoles, s as saasTenantRoleNames } from "../../permissions-CYcHj_w7.js";
+export { t as SaasDocSchema, n as SaasFolderSchema, r as SaasProjectSchema, i as saasPermissions, a as saasPlans, o as saasRoles, s as saasTenantRoleNames } from "../../permissions-CvpPtz5O.js";

package/dist/token-D6pWn8Uj.d.ts

@@ -0,0 +1,11 @@
+//#region src/core/token.d.ts
+/**
+ * The hex SHA-256 of `value` as sorted-key JSON: the same string
+ * better-supabase's `approvalFingerprint` resolves to, returned synchronously.
+ * Pass the exact operation an approval covers (the subject, the action and its
+ * arguments) as `fingerprint` so an approval for one change cannot run
+ * another.
+ */
+declare function approvalFingerprint(value: unknown): string;
+//#endregion
+export { approvalFingerprint as t };