permdock 0.15.0 → 0.17.0

package/dist/{token-DC9EQiet.js → token-DaMnIU9O.js}

@@ -1,5 +1,5 @@
 import { t as canonicalJson } from "./canonical-json-DwilZ1iB.js";
-import { r as sha256Digest } from "./sha256-C-4WXKIu.js";
+import { n as sha256, r as sha256Digest } from "./sha256-C-4WXKIu.js";
 //#region src/core/token.ts
 /**
 * Only stable identity goes into the token, so refreshing a session (new roles,
@@ -23,6 +23,18 @@ function versionOf(row, field) {
 	if (value instanceof Date) return Number.isNaN(value.getTime()) ? null : value.toISOString();
 	return typeof value === "string" || typeof value === "number" || typeof value === "bigint" || typeof value === "boolean" ? String(value) : null;
 }
+/**
+* The hex SHA-256 of `value` as sorted-key JSON: the same string
+* better-supabase's `approvalFingerprint` resolves to, returned synchronously.
+* Pass the exact operation an approval covers (the subject, the action and its
+* arguments) as `fingerprint` so an approval for one change cannot run
+* another.
+*/
+function approvalFingerprint(value) {
+	let hex = "";
+	for (const byte of sha256(canonicalJson(value))) hex += byte.toString(16).padStart(2, "0");
+	return hex;
+}
 /** The digest that binds a token to the call's data when no row id does. */
 function payloadDigest(data) {
 	return sha256Digest(canonicalJson(data));
@@ -37,10 +49,13 @@ function tokenPayload(resourceId, data, args) {
 	return resourceId === "*" && data !== void 0 ? payloadDigest(data) : void 0;
 }
 /**
-* `version` is set only for an approval that goes stale on a resource change;
-* without it the payload, and so every other token, is unchanged. `payload` is
-* set when `resourceId` is `*` (a collection action or a row without an id), so
-* an approval covers the arguments it was given and no others.
+* `source` names what decided: the policy fingerprint, `snapshot:<issuedAt>` or
+* the PDP provider. `version` is set only for an approval that goes stale on a
+* resource change; without it the payload, and so every other token, is
+* unchanged. `payload` is set when `resourceId` is `*` (a collection action or
+* a row without an id), so an approval covers the arguments it was given and no
+* others. `fingerprint` is the caller's `approvalFingerprint` of the exact
+* operation, bound only when given.
 */
 function decisionToken(input) {
 	const payload = canonicalJson({
@@ -51,11 +66,12 @@ function decisionToken(input) {
 			id: input.actor.id,
 			kind: input.actor.kind
 		},
-		fingerprint: input.fingerprint,
+		source: input.source,
 		...input.version === void 0 ? {} : { version: input.version },
-		...input.payload === void 0 ? {} : { payload: input.payload }
+		...input.payload === void 0 ? {} : { payload: input.payload },
+		...input.fingerprint === void 0 ? {} : { fingerprint: input.fingerprint }
 	});
 	return sha256Digest(payload);
 }
 //#endregion
-export { versionOf as i, payloadDigest as n, tokenPayload as r, decisionToken as t };
+export { versionOf as a, tokenPayload as i, decisionToken as n, payloadDigest as r, approvalFingerprint as t };

package/dist/{tool-refusal-Qpjs_W6M.js → tool-refusal-C1UlhU0V.js}

@@ -1,5 +1,5 @@
 import { t as wireDenials } from "./wire-denial-C7PaVYEM.js";
-import { n as describe } from "./describe-Bb4hGK5d.js";
+import { n as describe } from "./describe-CogP1loh.js";
 //#region src/core/tool-refusal.ts
 function deniedToolRefusal(decision, permission, resource) {
 	const alternatives = decision.alternatives.map((leaf) => leaf.key);

package/dist/trpc/index.d.ts

@@ -1,10 +1,10 @@
-import { T as Policy, pr as Principal } from "../policy-types-DGIO_gxq.js";
+import { E as Policy, _r as Principal } from "../policy-types-IRJVABmm.js";
 import { u as Permission } from "../permission-types-CAY-GU7e.js";
-import { a as PermDock } from "../permdock-CprAPN3w.js";
+import { a as PermDock } from "../permdock-DUWZEOLR.js";
 import { n as RevocationFeed } from "../revocations-BaUXHM1N.js";
-import { D as ConnectionOptions, T as Connection, i as OpenApiHooks } from "../server-types-CyRN0-Cd.js";
-import { t as ServerAdapterOptions } from "../bind-YYjvfpB9.js";
-import { t as StreamProtectOptions } from "../stream-9y9qw51m.js";
+import { D as ConnectionOptions, T as Connection, i as OpenApiHooks } from "../server-types-Bw-lWqzR.js";
+import { t as ServerAdapterOptions } from "../bind-DjFNX0Pq.js";
+import { t as StreamProtectOptions } from "../stream-BMJg56jU.js";
 import { AnyTRPCMiddlewareFunction } from "@trpc/server";
 //#region src/trpc/create.d.ts
 type TrpcMiddlewareOpts<TCtx = object, TInput = unknown> = {

package/dist/trpc/index.js

@@ -1,8 +1,8 @@
 import { o as problemMessage } from "../http-DKLXrFGk.js";
-import { t as problemFromError } from "../map-error-pasIGqMT.js";
-import { n as attached } from "../bind-BNQA9JK9.js";
+import { t as problemFromError } from "../map-error-B_f3C5cs.js";
+import { n as attached } from "../bind-BJFeLX1V.js";
 import { i as isAsyncIterable, o as reloadAfter } from "../stream-CDvF0sJm.js";
-import { i as rpcCode, n as guardStream, r as problemBody, t as bindRpcKernel } from "../rpc-vHIwyXCp.js";
+import { i as rpcCode, n as guardStream, r as problemBody, t as bindRpcKernel } from "../rpc-BOu3FD6X.js";
 import { TRPCError, isTrackedEnvelope } from "@trpc/server";
 //#region src/trpc/create.ts
 const PROBLEM = Symbol.for("permdock.problem");

package/dist/{type-helpers-c7Xo_2Cu.d.ts → type-helpers-C_OnZW8c.d.ts}

@@ -1,4 +1,4 @@
-import { bn as ScopeNames, j as PolicyVocabulary } from "./policy-types-DGIO_gxq.js";
+import { M as PolicyVocabulary, Sn as ScopeNames } from "./policy-types-IRJVABmm.js";
 import { k as POLICY_SCOPES, u as Permission } from "./permission-types-CAY-GU7e.js";
 import { n as PlanTree } from "./vocabulary-DEJ5j4mR.js";
 import { o as OperationMap } from "./operations-Ci_rT6Uo.js";

package/dist/{types-B2efzoSX.d.ts → types-AOP5HQku.d.ts}

@@ -1,4 +1,4 @@
-import { Sn as Approver } from "./policy-types-DGIO_gxq.js";
+import { wn as Approver } from "./policy-types-IRJVABmm.js";
 //#region src/approvals/access-reviews/types.d.ts
 type AccessReviewStatus = "open" | "closed";
 type AccessReviewItemStatus = "pending" | "kept" | "revoked";

package/dist/{types-DlelvQk4.d.ts → types-B3BOcI0J.d.ts}

@@ -1,6 +1,6 @@
-import { Jn as ExplainedDecision, T as Policy, Un as Decision, fr as Membership, hr as Subject, j as PolicyVocabulary, pr as Principal } from "./policy-types-DGIO_gxq.js";
+import { E as Policy, M as PolicyVocabulary, Qn as ExplainedDecision, _r as Principal, gr as Membership, qn as Decision, yr as Subject } from "./policy-types-IRJVABmm.js";
 import { f as PermissionTree, u as Permission } from "./permission-types-CAY-GU7e.js";
-import { C as PermissionCheck, a as PermDock, f as WhereResult, l as SimulateOptions, n as DecideOptions, o as PermDockOptions, r as DeriveOptions } from "./permdock-CprAPN3w.js";
+import { O as PermissionCheck, a as PermDock, f as WhereResult, l as SimulateOptions, n as DecideOptions, o as PermDockOptions, r as DeriveOptions } from "./permdock-DUWZEOLR.js";
 //#region src/pdp/types.d.ts
 type RemotePdpAuth = {
   readonly bearer: string | (() => string | Promise<string>);

package/dist/{types-DLvhVm1r.d.ts → types-BvBbkAu1.d.ts}

@@ -1,15 +1,18 @@
-import { Nn as RelationGrantee, Sn as Approver, Wt as Instant, fr as Membership, gn as WireDelegation, hr as Subject, o as ApprovalStage, r as ApprovalMode, vr as AdapterId } from "./policy-types-DGIO_gxq.js";
+import { Kt as Instant, Ln as RelationGrantee, Sr as AdapterId, gr as Membership, i as ApprovalMode, n as ApprovalCombine, s as ApprovalStage, vn as WireDelegation, wn as Approver, yr as Subject } from "./policy-types-IRJVABmm.js";
 import { M as AppData } from "./permission-types-CAY-GU7e.js";
 //#region src/approvals/types.d.ts
 type ApprovalStatus = "pending" | "approved" | "rejected" | "expired";
 type ApprovalApprovers = {
-  /** Under `mode: 'any'` (the default). */
+  /** Under `combine: 'any'` (the default). */
   readonly by?: Approver | readonly Approver[];
-  readonly mode?: ApprovalMode;
-  /** Under `mode: 'all'` or `'sequential'`. */
+  readonly combine?: ApprovalCombine;
+  /** Under `combine: 'all'` or `'sequential'`. */
   readonly stages?: readonly ApprovalStage[];
-  /** `false` lets the request's principal approve it; absent means `true`. */
-  readonly distinct?: boolean;
+  /**
+   * `'confirm'` lets the request's principal approve it; absent means
+   * `'authorize'`.
+   */
+  readonly mode?: ApprovalMode;
   /** Set when the approval no longer applies once the row's `version` changes. */
   readonly staleOn?: "resource-change";
   /**
@@ -123,6 +126,12 @@ type ApprovalRequest = {
   readonly vouched?: string;
   readonly note?: string;
   readonly consumedAt?: string;
+  /**
+   * The caller's `approvalFingerprint` of the exact operation, from the
+   * decision's `fingerprint`. Consuming or resuming under another one fails
+   * with `approval-fingerprint-mismatch`.
+   */
+  readonly fingerprint?: string;
   /**
    * The application's own data, set when the request opens; plain JSON, never
    * read by a decision.
@@ -213,7 +222,7 @@ type ApprovalStore = {
   consume: (token: string, now?: Instant) => Promise<ApprovalRequest | null> | ApprovalRequest | null;
   cancel?: (filter: ApprovalListFilter, meta: ApprovalCancelMeta) => Promise<number> | number;
 };
-type ApprovalResumeFailureCause = "approval-not-found" | "approval-pending" | "approval-rejected" | "approval-expired" | "approval-consumed";
+type ApprovalResumeFailureCause = "approval-not-found" | "approval-pending" | "approval-rejected" | "approval-expired" | "approval-consumed" | "approval-fingerprint-mismatch";
 type ApprovalInspectResult = {
   readonly ok: true;
   readonly request: ApprovalRequest;

package/dist/{types-BB-zWDcR.d.ts → types-CA-A33Q5.d.ts}

@@ -1,8 +1,8 @@
-import { J as DecisionSink, ct as SnapshotSource, hr as Subject, ht as TokenVerifier, mt as TokenSigner } from "./policy-types-DGIO_gxq.js";
-import { s as PolicySource } from "./hosted-DVxlLZMe.js";
-import { m as ApprovalStore, u as ApprovalRequest } from "./types-DLvhVm1r.js";
-import { a as CatalogDocument } from "./types-ZzRGoViD.js";
-import { a as CatalogFinding } from "./sink-B5zoUW_O.js";
+import { Y as DecisionSink, _t as TokenVerifier, gt as TokenSigner, lt as SnapshotSource, yr as Subject } from "./policy-types-IRJVABmm.js";
+import { s as PolicySource } from "./hosted-DxRLLiFU.js";
+import { m as ApprovalStore, u as ApprovalRequest } from "./types-BvBbkAu1.js";
+import { a as CatalogDocument } from "./types-NYoj8JBm.js";
+import { a as CatalogFinding } from "./sink-DUzt0e4B.js";
 //#region src/cloud/types.d.ts
 type CloudEndpointOptions = {
   readonly url?: string;

package/dist/{types-Cklw5hJo.d.ts → types-CAAN7evk.d.ts}

@@ -1,4 +1,4 @@
-import { h as RoleThrough, m as RoleMap, s as SqlMembershipSource } from "./sources-oB1Hg1Fm.js";
+import { h as RoleThrough, m as RoleMap, s as SqlMembershipSource } from "./sources-CXY05xtB.js";
 //#region src/cli/core/errors.d.ts
 /**
  * 0 success, 1 failure, 2 usage, 3 action required, 130 interrupted (SIGINT or
@@ -454,6 +454,16 @@ type RlsApprovalsAdopt = {
    * same rows for `approvalsHandler`. Off by default.
    */
   readonly delegations?: boolean;
+  /**
+   * Add `approval_policies`, the approval requirements a tenant keeps as data,
+   * and `permdock_approval_policies_for`, which `tableApprovalPolicySource`
+   * reads. A holder of the `manage` permission key in a tenant writes that
+   * tenant's rows; rows with `tenant` null are platform floors, written only by
+   * the table owner. Off by default.
+   */
+  readonly tenantPolicies?: {
+    readonly manage: string;
+  };
   /** A text column unique per request. Default `token`. */
   readonly token?: string;
   /** A jsonb column holding the `ApprovalRequest`. Default `body`. */
@@ -811,6 +821,19 @@ type SupabaseHookConfig = {
    * `true`.
    */
   readonly version?: boolean;
+  /**
+   * Broadcast every version bump as `{ user_id, version }` with event `changed`
+   * on `topic`, which no user may join, and on the user's own `authz:<uid>`.
+   * `topic` defaults to `better_supabase:authz` in a better-supabase project,
+   * else `permdock:authz`. `receivePolicy` writes the `realtime.messages`
+   * policy that lets a user receive `authz:<uid>`; it defaults to `true`, and
+   * to `false` when better-supabase's `sessions.authzVersions` writes the same
+   * policy. `false` sends nothing.
+   */
+  readonly broadcast?: false | {
+    readonly topic?: string;
+    readonly receivePolicy?: boolean;
+  };
   /**
    * Write PostgREST wrappers for `subject_for`, `members_of` and
    * `authz_version_for` into `schema` (default `public`), named

package/dist/{types-DsHGPtkR.d.ts → types-CJC1aaoJ.d.ts}

@@ -1,5 +1,5 @@
-import { Z as JwtClaims, hr as Subject, ht as TokenVerifier, nt as MembershipSource, pr as Principal, pt as TokenFailureCause, rn as AuthEvent, rr as Actor } from "./policy-types-DGIO_gxq.js";
-import { m as ApprovalStore } from "./types-DLvhVm1r.js";
+import { Q as JwtClaims, _r as Principal, _t as TokenVerifier, an as AuthEvent, ht as TokenFailureCause, rt as MembershipSource, sr as Actor, yr as Subject } from "./policy-types-IRJVABmm.js";
+import { m as ApprovalStore } from "./types-BvBbkAu1.js";
 import { n as RevocationFeed } from "./revocations-BaUXHM1N.js";
 import { t as ClaimsMap } from "./claims-map-D1Pb5oRq.js";
 import { t as ClientNames } from "./clients-C_NOET3z.js";

package/dist/{types-CWBsAwqn.d.ts → types-D29K5ZNP.d.ts}

@@ -1,7 +1,7 @@
-import { Zt as Snapshot, ct as SnapshotSource, ht as TokenVerifier } from "./policy-types-DGIO_gxq.js";
-import { n as DescribeMessages } from "./describe-BbFPBSms.js";
-import { _ as ClientStoreOptions } from "./types-tQB2CEnY.js";
-import { t as PermDockDefaults } from "./types-rCRV4Ge-.js";
+import { $t as Snapshot, _t as TokenVerifier, lt as SnapshotSource } from "./policy-types-IRJVABmm.js";
+import { n as DescribeMessages } from "./describe-nalX_HHE.js";
+import { n as ClientStoreOptions } from "./store-g5ctUrOI.js";
+import { t as PermDockDefaults } from "./types-e82uzrTn.js";
 import { ReactNode } from "react";
 //#region src/react-native/types.d.ts
 type SnapshotStorage = {

package/dist/{types-CEinc15V.d.ts → types-DVZNTkU0.d.ts}

@@ -1,9 +1,8 @@
-import { Hn as ApprovalRequiredDecision, Un as Decision, Yn as GrantedDecision, Zt as Snapshot, ht as TokenVerifier } from "./policy-types-DGIO_gxq.js";
+import { $n as GrantedDecision, $t as Snapshot, Kn as ApprovalRequiredDecision, _t as TokenVerifier, qn as Decision } from "./policy-types-IRJVABmm.js";
 import { u as Permission } from "./permission-types-CAY-GU7e.js";
-import { a as PermDock } from "./permdock-CprAPN3w.js";
+import { a as PermDock } from "./permdock-DUWZEOLR.js";
 import { t as PermissionBoundaryState } from "./boundary-C9ck-3uK.js";
-import { t as ActionResult } from "./action-result-BcudBQOF.js";
-import { d as ProtectedActionView, f as ProviderOptionsBase, g as ClientStore, l as PermissionState } from "./types-tQB2CEnY.js";
+import { d as PermissionState, m as ProviderOptionsBase, p as ProtectedActionView, t as ClientStore, v as ActionResult } from "./store-g5ctUrOI.js";
 import { Snippet } from "svelte";
 import { Readable } from "svelte/store";
 //#region src/client/views.d.ts

package/dist/{types-ZzRGoViD.d.ts → types-NYoj8JBm.d.ts}

@@ -56,12 +56,12 @@ type CatalogBreakGlass = {
 };
 type CatalogApproval = "human" | {
   readonly by?: unknown;
-  readonly mode?: "any" | "all" | "sequential";
+  readonly combine?: "any" | "all" | "sequential";
   readonly stages?: readonly {
     readonly by: unknown;
     readonly quorum?: number;
   }[];
-  readonly distinct?: boolean;
+  readonly mode?: "confirm" | "authorize";
   readonly staleOn?: "resource-change";
   readonly quorum?: number;
   /** Seconds. */

package/dist/{types-B6ExllNo.d.ts → types-Sj1U8HMm.d.ts}

@@ -1,5 +1,5 @@
-import { j as PolicyVocabulary, on as DecisionEvent } from "./policy-types-DGIO_gxq.js";
-import { a as PermDock } from "./permdock-CprAPN3w.js";
+import { M as PolicyVocabulary, cn as DecisionEvent } from "./policy-types-IRJVABmm.js";
+import { a as PermDock } from "./permdock-DUWZEOLR.js";
 //#region src/otel/types.d.ts
 declare const GENAI_SEMCONV_PIN = "1.37.0";
 declare const GEN_AI_TOOL_NAME = "gen_ai.tool.name";

package/dist/{types-CN0LsqbK.d.ts → types-UfpcY575.d.ts}

@@ -1,6 +1,6 @@
-import { Yn as GrantedDecision, cn as DeliveryEvent, dn as EmailCategory, ln as DeliveryFailureCause, sn as DeliveryChannel } from "./policy-types-DGIO_gxq.js";
-import { s as CloudEvent } from "./sink-B5zoUW_O.js";
-import { t as ApprovalPrompt } from "./approval-prompt-3BqWczTt.js";
+import { $n as GrantedDecision, dn as DeliveryFailureCause, ln as DeliveryChannel, pn as EmailCategory, un as DeliveryEvent } from "./policy-types-IRJVABmm.js";
+import { s as CloudEvent } from "./sink-DUzt0e4B.js";
+import { t as ApprovalPrompt } from "./approval-prompt-BSh-yxbH.js";
 //#region src/delivery/types.d.ts
 /**
  * Who a delivery goes to. `{ principal }` names an app principal and the

package/dist/{types-rCRV4Ge-.d.ts → types-e82uzrTn.d.ts}

@@ -1,8 +1,8 @@
-import { Hn as ApprovalRequiredDecision, Un as Decision, Yn as GrantedDecision, Zt as Snapshot, ht as TokenVerifier } from "./policy-types-DGIO_gxq.js";
+import { $n as GrantedDecision, $t as Snapshot, Kn as ApprovalRequiredDecision, _t as TokenVerifier, qn as Decision } from "./policy-types-IRJVABmm.js";
 import { u as Permission } from "./permission-types-CAY-GU7e.js";
-import { s as RowData } from "./permdock-CprAPN3w.js";
-import { n as DescribeMessages } from "./describe-BbFPBSms.js";
-import { _ as ClientStoreOptions } from "./types-tQB2CEnY.js";
+import { s as RowData } from "./permdock-DUWZEOLR.js";
+import { n as DescribeMessages } from "./describe-nalX_HHE.js";
+import { n as ClientStoreOptions } from "./store-g5ctUrOI.js";
 import { ReactNode } from "react";
 //#region src/react/types.d.ts
 type PermDockProviderProps = ({

package/dist/unplugin/index.d.ts

@@ -1,4 +1,4 @@
-import { s as PermDockPluginOptions } from "../types-Cklw5hJo.js";
+import { s as PermDockPluginOptions } from "../types-CAAN7evk.js";
 import { createUnplugin } from "unplugin";
 //#region src/unplugin/index.d.ts
 type CreateUnplugin = typeof createUnplugin<PermDockPluginOptions | undefined>;

package/dist/unplugin/index.js

@@ -1,5 +1,5 @@
-import { n as createCollectScheduler, r as report } from "../watch-DAkjm75Y.js";
-import { r as peerHint } from "../peer-Q0fuZ6hx.js";
+import { n as createCollectScheduler, r as report } from "../watch-DXRDBSCu.js";
+import { r as peerHint } from "../peer-BuK9F53f.js";
 import { createRequire } from "node:module";
 //#region src/unplugin/index.ts
 function loadCreateUnplugin() {

package/dist/{usage-e6M1Mls1.js → usage-COsGLht5.js}

@@ -1,13 +1,13 @@
 import { a as getResource } from "./permission-registry-B8tYxPIt.js";
-import { u as usageResult } from "./errors-Vpu6rKHl.js";
+import { u as usageResult } from "./errors-BhRkoNS7.js";
 import { a as rel, r as listSourceFiles } from "./files-BSjrtIHw.js";
 import { o as USAGE_REPORT_SCHEMA } from "./version-DMQ0dnN5.js";
-import { c as jsonSchemaOf } from "./catalog-doc-DjMKzJp9.js";
-import { a as loadModule, n as asPolicy, s as pickNamed } from "./load-DjSU5KXO.js";
-import { r as runCollect } from "./collect-WCl8cJQV.js";
+import { c as jsonSchemaOf } from "./catalog-doc-C4DGfJCO.js";
+import { a as loadModule, n as asPolicy, s as pickNamed } from "./load-BaEamml-.js";
+import { r as runCollect } from "./collect-HfJXl8Tr.js";
 import { t as beforeFirst } from "./text-BMFRfBqc.js";
-import { t as DOCS_BASE } from "./manifest-CbEyvPN2.js";
-import { r as findingOf } from "./output-BVZpQDad.js";
+import { t as DOCS_BASE } from "./manifest-Dij1U0hx.js";
+import { r as findingOf } from "./output-DhTpe8v1.js";
 import { existsSync, readFileSync, realpathSync } from "node:fs";
 import { dirname, resolve } from "node:path";
 import { fileURLToPath, pathToFileURL } from "node:url";

package/dist/{usage-DBNrpwoT.js → usage-CqcMeQgX.js}

@@ -1,5 +1,5 @@
 import { t as defineLeaf } from "./command-L8EstFNm.js";
-import { a as failOnFlag } from "./flags-DXjoTVbS.js";
+import { a as failOnFlag } from "./flags-BlmpmXoY.js";
 //#region src/cli/commands/usage.ts
 const usage = defineLeaf({
 	flags: {
@@ -16,7 +16,7 @@ const usage = defineLeaf({
 		}
 	},
 	async run(ctx, { flags }) {
-		return (await import("./usage-D3KJyaNS.js")).runUsage({
+		return (await import("./usage-D1cpHO7p.js")).runUsage({
 			cwd: ctx.cwd,
 			config: ctx.config,
 			ignore: flags.ignore,

package/dist/usage-D1cpHO7p.js

@@ -0,0 +1 @@
+export { t as runUsage } from "./usage-COsGLht5.js";

package/dist/{validation-error-uvp-kyfO.d.ts → validation-error-DpvsBwZJ.d.ts}

@@ -1,4 +1,4 @@
-import { a as ProblemDetails } from "./errors-BIM4MFsJ.js";
+import { a as ProblemDetails } from "./errors-Dc9FdamT.js";
 import { StandardSchemaV1 } from "@standard-schema/spec";
 //#region src/core/validation-error.d.ts
 /**

package/dist/{verify-CgIpJRcG.js → verify-C8G8D5mk.js}

@@ -1,35 +1,35 @@
 import { a as sole, r as isRecord } from "./compact-CAf557ZB.js";
 import { l as isConditionRef, o as hasConditionOp } from "./refs-C8BKxc_e.js";
-import { j as memoryCustomRoleSource, x as memoryRelationSource } from "./src-C_pi2Rnh.js";
+import { M as memoryCustomRoleSource, S as memoryRelationSource } from "./src-nYNBfmgq.js";
 import { c as listPermissions, h as formerKeys, n as findPermission } from "./permission-registry-B8tYxPIt.js";
 import { c as isEdgeRelation, l as isFieldRelation, u as isPrincipalRelation } from "./resource-relations-8-pCScBO.js";
 import { f as nowMillis, u as isoAt } from "./time-nR1JesoH.js";
 import { t as canonicalJson } from "./canonical-json-DwilZ1iB.js";
-import { f as scopeList, l as rootScope, o as normalizeMemberships } from "./scopes-0Up_UA2t.js";
-import { o as requiresStandIn } from "./delegation-CDB6_keF.js";
-import { p as scopeField } from "./tenancy-5d1zVBvK.js";
-import { l as policyLevels, t as coveredLevels } from "./policy-CLQ8__GF.js";
+import { c as rootScope, d as scopeList, o as normalizeMemberships } from "./scopes-BSdYaGHs.js";
+import { o as requiresStandIn } from "./delegation-aK4T_5WU.js";
+import { p as scopeField } from "./tenancy-DvOHHk3-.js";
+import { l as policyLevels, t as coveredLevels } from "./policy-DxQyHKPB.js";
 import { t as requiresApproval } from "./approval-required-TzNB9oQA.js";
-import { c as andWhere, m as customRoleScope, v as leveled, y as membershipsClaim } from "./evaluate-BAmf_AQd.js";
-import { t as getPermDock } from "./permdock-BvjivVb9.js";
-import { a as describeError, i as configError, u as usageResult } from "./errors-Vpu6rKHl.js";
+import { c as andWhere, m as customRoleScope, v as leveled, y as membershipsClaim } from "./evaluate-CsjXeLRo.js";
+import { t as getPermDock } from "./permdock-DdzMv5-F.js";
+import { a as describeError, i as configError, u as usageResult } from "./errors-BhRkoNS7.js";
 import { t as policyRowConditionKeys } from "./row-conditions-BAGHOmVq.js";
 import { s as writeFileEnsuringDir } from "./files-BSjrtIHw.js";
-import { c as jsonSchemaOf } from "./catalog-doc-DjMKzJp9.js";
-import { o as loadPolicyAt } from "./load-DjSU5KXO.js";
-import "./budget-BELja5A9.js";
+import { c as jsonSchemaOf } from "./catalog-doc-C4DGfJCO.js";
+import { o as loadPolicyAt } from "./load-BaEamml-.js";
+import "./budget-BBCPDOGP.js";
 import { i as qualifySqlTable, n as defaultSqlCommand, t as SQL_IDENT } from "./sql-0WjxIp9g.js";
-import { a as scopeMembershipTable, i as scopeColumn } from "./compile-EzEMB-7v.js";
+import { a as scopeMembershipTable, i as scopeColumn } from "./compile-B_oJqmIg.js";
 import "./sources-C4vkzZJV.js";
 import { t as beforeFirst } from "./text-BMFRfBqc.js";
-import { t as DOCS_BASE } from "./manifest-CbEyvPN2.js";
-import { n as fixtureSubject, r as loadFixtures, t as fixtureRow } from "./fixtures-Bm4_K1ke.js";
-import { A as quoteQualified, N as arrayColumnsOf, O as quoteIdent, P as columnTypesOf, _ as subjectClaimJsonSql, a as customRolesOn, j as quoteTable, k as quoteLiteral, r as HELPERS, v as subjectClaimSql } from "./shared-DrGLwM3s.js";
-import { C as accessSql, D as tokenScopeAllowsCall, S as requiresSql, ht as scopeTable, k as capabilityAccessSql, n as tableNameOf, o as graphPlan, q as apiKeyAllowsCall, r as tableNames } from "./tables-DimBcVWY.js";
-import { c as breakGlassKey, f as compileConditionSql, l as collectGrants, m as sqlFunctionNames, p as contextRefs, s as breakGlassHolder } from "./ownership-qqBuGJXr.js";
+import { t as DOCS_BASE } from "./manifest-Dij1U0hx.js";
+import { n as fixtureSubject, r as loadFixtures, t as fixtureRow } from "./fixtures-0VTW5oNq.js";
+import { A as quoteQualified, N as arrayColumnsOf, O as quoteIdent, P as columnTypesOf, _ as subjectClaimJsonSql, a as customRolesOn, j as quoteTable, k as quoteLiteral, r as HELPERS, v as subjectClaimSql } from "./shared-DyYVEjKC.js";
+import { C as accessSql, D as tokenScopeAllowsCall, S as requiresSql, ht as scopeTable, k as capabilityAccessSql, n as tableNameOf, o as graphPlan, q as apiKeyAllowsCall, r as tableNames } from "./tables-BsGE6HBR.js";
+import { c as breakGlassKey, f as compileConditionSql, l as collectGrants, m as sqlFunctionNames, p as contextRefs, s as breakGlassHolder } from "./ownership-moSRhxl_.js";
 import { t as membershipSourcesOf } from "./sources-qoIJQrJv.js";
-import { n as pgConnector, t as connectPgPool } from "./pg-DQTqRrou.js";
-import { _ as wrapSql, g as validitySql, m as andSql, s as viewName, t as FIELD_VIEWS } from "./fields-DI8s3cPl.js";
+import { n as pgConnector, t as connectPgPool } from "./pg-Ddxsd5ZB.js";
+import { _ as wrapSql, g as validitySql, m as andSql, s as viewName, t as FIELD_VIEWS } from "./fields-CrjL6A49.js";
 import { resolve } from "node:path";
 import { createHash, randomUUID } from "node:crypto";
 //#region src/cli/rls/indexes.ts

package/dist/{version-cache-Df11C2Qp.d.ts → version-cache-9Vq5QVFC.d.ts}

@@ -1,4 +1,4 @@
-import { Wt as Instant, yt as VersionQuery } from "./policy-types-DGIO_gxq.js";
+import { Kt as Instant, xt as VersionQuery } from "./policy-types-IRJVABmm.js";
 //#region src/core/version-cache.d.ts
 type VersionCacheStats = {
   /** Version reads the cache started. */
@@ -20,12 +20,18 @@ type VersionCache = {
   readonly maxStaleMs: number;
   /**
    * The current version of `principal`. With `live: false`, an entry at most
-   * `maxStaleMs` old answers, a read in flight is shared, and a token claim
-   * newer than the entry raises it; with `live: true`, `read` runs.
+   * `maxStaleMs` old answers and a read in flight is shared; with `live: true`,
+   * `read` runs.
    */
   current: (principal: VersionQuery, read: () => number | undefined | Promise<number | undefined>, options: {
     readonly live: boolean;
   }) => number | undefined | Promise<number | undefined>;
+  /**
+   * Stores a version read at `at` (default now): `bsb.bootstrap()`'s
+   * `authz_ver`, or a token claim dated by its `iat`. A seed never lowers a
+   * cached version, and one dated in the future is ignored.
+   */
+  seed: (principal: string, version: number, at?: Instant) => void;
   /** Drops `principal`'s entry, so the next instance reads the version. */
   evict: (principal: string) => void;
   stats: () => VersionCacheStats;

package/dist/{views-CD8wuL4Z.js → views-TrZYlDnM.js}

@@ -1,5 +1,5 @@
 import { r as requiredPlans } from "./problem-details-CLDgX1KV.js";
-import { n as describe } from "./describe-Bb4hGK5d.js";
+import { n as describe } from "./describe-CogP1loh.js";
 //#region src/client/views.ts
 function permissionSet(store, permissions, data) {
 	const granted = [];

package/dist/vue/index.d.ts

@@ -1,13 +1,13 @@
-import { Hn as ApprovalRequiredDecision, Un as Decision, Zt as Snapshot, fr as Membership, ht as TokenVerifier, j as PolicyVocabulary } from "../policy-types-DGIO_gxq.js";
+import { $t as Snapshot, Kn as ApprovalRequiredDecision, M as PolicyVocabulary, _t as TokenVerifier, gr as Membership, qn as Decision } from "../policy-types-IRJVABmm.js";
 import { u as Permission } from "../permission-types-CAY-GU7e.js";
 import { r as Role } from "../vocabulary-DEJ5j4mR.js";
-import { d as UncheckedData, s as RowData } from "../permdock-CprAPN3w.js";
-import { c as requiredPlans } from "../errors-BIM4MFsJ.js";
-import { i as describe, r as DescribeOptions, t as DecisionDescription } from "../describe-BbFPBSms.js";
+import { d as UncheckedData, s as RowData } from "../permdock-DUWZEOLR.js";
+import { c as requiredPlans } from "../errors-Dc9FdamT.js";
+import { i as describe, r as DescribeOptions, t as DecisionDescription } from "../describe-nalX_HHE.js";
 import { t as PermissionBoundaryState } from "../boundary-C9ck-3uK.js";
-import { n as ProtectedAction, t as ActionResult } from "../action-result-BcudBQOF.js";
+import { _ as TenantView, a as ClientPermDock, c as GateMode, d as PermissionState, g as SubjectView, h as RolesOptions, i as ApprovalState, l as GateView, m as ProviderOptionsBase, o as ClientStatus, p as ProtectedActionView, r as ApprovalHandle, s as FilterResult, u as PermissionSet, v as ActionResult, y as ProtectedAction } from "../store-g5ctUrOI.js";
+import { a as broadcastChannelRefresh, c as visibilityRefresh, i as authzChangeRefresh, n as EventSourceRefreshOptions, o as eventSourceRefresh, r as RefreshTrigger, s as focusRefresh, t as AuthzChangeRefresh } from "../refresh-on-L9UOwATg.js";
 import { t as approvalHeaders } from "../headers-B9jQxjtW.js";
-import { a as FilterResult, b as eventSourceRefresh, c as PermissionSet, d as ProtectedActionView, f as ProviderOptionsBase, h as TenantView, i as ClientStatus, l as PermissionState, m as SubjectView, n as ApprovalState, o as GateMode, p as RolesOptions, r as ClientPermDock, s as GateView, t as ApprovalHandle, v as EventSourceRefreshOptions, y as RefreshTrigger } from "../types-tQB2CEnY.js";
 import { ComputedRef, DefineComponent, MaybeRefOrGetter, Plugin, VNode } from "vue";
 //#region src/vue/types.d.ts
 type PermDockPluginOptions = ProviderOptionsBase & {
@@ -130,4 +130,4 @@ type ProtectedProps = {
 };
 export declare const Protected: DefineComponent<ProtectedProps>;
 //#endregion
-export { type ActionResult, type ApprovalHandle, type ApprovalState, type ClientPermDock, type ClientStatus, type EventSourceRefreshOptions, type FilterResult, type GateMode, type GateView, type PermDockDefaults, type PermDockPluginOptions, type PermissionBoundaryState, type PermissionSet, type PermissionState, type ProtectedAction, type ProtectedActionRefs, type ProtectedActionView, type ProtectedProps, type RefreshTrigger, type RolesOptions, type SubjectView, type TenantView, approvalHeaders, describe, eventSourceRefresh, requiredPlans };
+export { type ActionResult, type ApprovalHandle, type ApprovalState, type AuthzChangeRefresh, type ClientPermDock, type ClientStatus, type EventSourceRefreshOptions, type FilterResult, type GateMode, type GateView, type PermDockDefaults, type PermDockPluginOptions, type PermissionBoundaryState, type PermissionSet, type PermissionState, type ProtectedAction, type ProtectedActionRefs, type ProtectedActionView, type ProtectedProps, type RefreshTrigger, type RolesOptions, type SubjectView, type TenantView, approvalHeaders, authzChangeRefresh, broadcastChannelRefresh, describe, eventSourceRefresh, focusRefresh, requiredPlans, visibilityRefresh };

package/dist/vue/index.js

@@ -1,10 +1,10 @@
 import { r as requiredPlans } from "../problem-details-CLDgX1KV.js";
-import { n as describe } from "../describe-Bb4hGK5d.js";
+import { n as describe } from "../describe-CogP1loh.js";
 import { n as boundaryFallback, t as boundaryDigest } from "../boundary-BV3O1eud.js";
-import { n as actionRunner, r as approvalHeaders, t as actionApproval } from "../protected-action-DUYqb-Ma.js";
-import { a as livePermDock, c as rolesView, d as subjectView, f as tenantView, i as gateView, l as scopedTenant, n as describeWith, o as permissionSet, r as filterResult, s as protectedView, t as approvalHandle, u as slotContent } from "../views-CD8wuL4Z.js";
-import { a as isPromiseLike, r as eventSourceRefresh } from "../store-options-Dil3lraY.js";
-import { n as switchTenant, t as providerStore } from "../provider-store-CaTv00tr.js";
+import { n as actionRunner, r as approvalHeaders, t as actionApproval } from "../protected-action-B6n6w7Rl.js";
+import { a as livePermDock, c as rolesView, d as subjectView, f as tenantView, i as gateView, l as scopedTenant, n as describeWith, o as permissionSet, r as filterResult, s as protectedView, t as approvalHandle, u as slotContent } from "../views-TrZYlDnM.js";
+import { a as eventSourceRefresh, i as broadcastChannelRefresh, l as isPromiseLike, o as focusRefresh, r as authzChangeRefresh, s as visibilityRefresh } from "../store-options--zWn48PK.js";
+import { n as switchTenant, t as providerStore } from "../provider-store-BQP_pp8s.js";
 import { computed, defineComponent, effectScope, getCurrentScope, inject, isRef, onErrorCaptured, onScopeDispose, provide, shallowRef, toValue, watch } from "vue";
 //#region src/vue/context.ts
 const permDockKey = Symbol("permdock");
@@ -246,4 +246,4 @@ const Protected = defineComponent({
 	}
 });
 //#endregion
-export { PermissionBoundary, Protected, approvalHeaders, describe, eventSourceRefresh, permdockPlugin, requiredPlans, useApproval, useAssignablePermissions, useAssignableRoles, useDescribe, useFilter, useGate, useMemberships, usePermDock, usePermission, usePermissionBoundary, usePermissions, useProtectedAction, useRoles, useSubject, useTenant };
+export { PermissionBoundary, Protected, approvalHeaders, authzChangeRefresh, broadcastChannelRefresh, describe, eventSourceRefresh, focusRefresh, permdockPlugin, requiredPlans, useApproval, useAssignablePermissions, useAssignableRoles, useDescribe, useFilter, useGate, useMemberships, usePermDock, usePermission, usePermissionBoundary, usePermissions, useProtectedAction, useRoles, useSubject, useTenant, visibilityRefresh };

package/dist/{waiter-CqUKX6CY.d.ts → waiter-C2cXXLFZ.d.ts}

@@ -1,5 +1,5 @@
-import { Wt as Instant } from "./policy-types-DGIO_gxq.js";
-import { m as ApprovalStore } from "./types-DLvhVm1r.js";
+import { Kt as Instant } from "./policy-types-IRJVABmm.js";
+import { m as ApprovalStore } from "./types-BvBbkAu1.js";
 //#region src/workflow/waiter.d.ts
 type ApprovalWaitOptions = {
   /**

package/dist/{watch-DAkjm75Y.js → watch-DXRDBSCu.js}

@@ -1,8 +1,8 @@
 import { i as dateAt } from "./time-nR1JesoH.js";
-import { a as describeError } from "./errors-Vpu6rKHl.js";
+import { a as describeError } from "./errors-BhRkoNS7.js";
 import { t as defaultSrcPath } from "./files-BSjrtIHw.js";
-import { r as runCollect } from "./collect-WCl8cJQV.js";
-import { n as isConfigFile, r as loadConfig } from "./config-CcLlvEYW.js";
+import { r as runCollect } from "./collect-HfJXl8Tr.js";
+import { n as isConfigFile, r as loadConfig } from "./config-COHmivz9.js";
 import { watch } from "node:fs";
 import { basename, dirname, relative, resolve, sep } from "node:path";
 //#region src/cli/watch.ts

package/dist/watch-DnymTAfe.js

@@ -0,0 +1 @@
+export { i as watchCollect } from "./watch-DXRDBSCu.js";

package/dist/webmcp/index.d.ts

@@ -1,4 +1,4 @@
-import { Un as Decision, Zt as Snapshot } from "../policy-types-DGIO_gxq.js";
+import { $t as Snapshot, qn as Decision } from "../policy-types-IRJVABmm.js";
 import { f as PermissionTree, u as Permission } from "../permission-types-CAY-GU7e.js";
 import { StandardSchemaV1 } from "@standard-schema/spec";
 //#region src/webmcp/types.d.ts

package/dist/webmcp/index.js

@@ -3,7 +3,7 @@ import { n as PermDockValidationError } from "../validation-error-CYg2kJEw.js";
 import { c as listPermissions, f as resourceOfNode, i as getRegistry, m as annotationsFor, s as isRegistryTree } from "../permission-registry-B8tYxPIt.js";
 import { n as isThenable, t as ignoreRejection } from "../thenable-BNSM1U2R.js";
 import { n as resourceRef } from "../resource-ref-CaS9yVPi.js";
-import { n as deniedToolRefusal, r as toolErrorResult, t as approvalToolRefusal } from "../tool-refusal-Qpjs_W6M.js";
+import { n as deniedToolRefusal, r as toolErrorResult, t as approvalToolRefusal } from "../tool-refusal-C1UlhU0V.js";
 //#region src/webmcp/register.ts
 const MISSING_CONTEXT = "permdock/webmcp: document.modelContext is absent; registerTools is a no-op.";
 const CURRENT = Symbol.for("permdock.current");

package/dist/{where-scope-DlCdCM_8.js → where-scope-BKrqUDVk.js}

@@ -2,12 +2,12 @@ import { a as sole, r as isRecord, t as compact } from "./compact-CAf557ZB.js";
 import { n as freezeDeep } from "./freeze-jjan0lCv.js";
 import { t as loadPrincipal } from "./principal-source-C6N60GtM.js";
 import { g as secondsOf, m as rfc3339 } from "./time-nR1JesoH.js";
-import { d as scopeIdOf, f as scopeList, h as tenantOf, r as findScope, s as resolveScope, t as activeFor, u as scopeChain } from "./scopes-0Up_UA2t.js";
-import { a as readOnlyActorRefuses, n as coveredByDelegation } from "./delegation-CDB6_keF.js";
+import { d as scopeList, l as scopeChain, p as tenantOf, r as findScope, s as resolveScope, t as activeFor, u as scopeIdOf } from "./scopes-BSdYaGHs.js";
+import { a as readOnlyActorRefuses, n as coveredByDelegation } from "./delegation-aK4T_5WU.js";
 import { r as readWireValidity, t as isActive } from "./validity-Buc7w8E9.js";
-import { o as resourceRoleCondition } from "./grantee-conditions-BrYPe-w0.js";
-import { c as nowSeconds, n as inTeam, o as membershipField, r as isMembershipExpired } from "./tenancy-5d1zVBvK.js";
-import { a as bindConditionRefs, n as parseSnapshot } from "./snapshot-CXlzi69u.js";
+import { o as resourceRoleCondition } from "./grantee-conditions-DX4K_gGI.js";
+import { c as nowSeconds, n as inTeam, o as membershipField, r as isMembershipExpired } from "./tenancy-DvOHHk3-.js";
+import { a as bindConditionRefs, n as parseSnapshot } from "./snapshot-DN_8J27z.js";
 //#region src/core/snapshot-sign.ts
 /**
 * The claims `signSnapshot` signs for `snapshot`. `issuedAt` and `expiresAt`