permdock 0.15.0 → 0.17.0

package/dist/drizzle/index.d.ts

@@ -1,7 +1,7 @@
-import { Wt as Instant, br as Condition, hr as Subject } from "../policy-types-DGIO_gxq.js";
-import { f as WhereResult } from "../permdock-CprAPN3w.js";
+import { Kt as Instant, wr as Condition, yr as Subject } from "../policy-types-IRJVABmm.js";
+import { f as WhereResult } from "../permdock-DUWZEOLR.js";
 import { r as RelationsMapping } from "../graph-sql-BwFC4Qjs.js";
-import { s as MembershipsMapping } from "../compile-BEklRUYo.js";
+import { s as MembershipsMapping } from "../compile-BxiwRotu.js";
 import { n as RowCheck, t as WithSubjectOptions } from "../subject-settings-vNW8qmUH.js";
 import { SQL, Table } from "drizzle-orm";
 //#region src/drizzle/types.d.ts

package/dist/drizzle/index.js

@@ -1,6 +1,6 @@
 import { t as compact } from "../compact-CAf557ZB.js";
 import { t as assertSafeKey } from "../paths-CUvURzHp.js";
-import { n as compileWhere, r as escapeLike } from "../compile-EzEMB-7v.js";
+import { n as compileWhere, r as escapeLike } from "../compile-B_oJqmIg.js";
 import { a as rowCheckFrom, i as templateOf, r as subjectStatements, s as loadPeer, t as statementTemplate } from "../subject-settings-8sH5HlII.js";
 //#region src/drizzle/to-where.ts
 function loadOperators(injected) {

package/dist/elysia/index.d.ts

@@ -1,9 +1,9 @@
-import { T as Policy, j as PolicyVocabulary, pr as Principal } from "../policy-types-DGIO_gxq.js";
+import { E as Policy, M as PolicyVocabulary, _r as Principal } from "../policy-types-IRJVABmm.js";
 import { u as Permission } from "../permission-types-CAY-GU7e.js";
-import { a as PermDock } from "../permdock-CprAPN3w.js";
+import { a as PermDock } from "../permdock-DUWZEOLR.js";
 import { n as RevocationFeed } from "../revocations-BaUXHM1N.js";
-import { D as ConnectionOptions, T as Connection, f as InvalidSignatureError, i as OpenApiHooks, o as ProtectOptions, v as discoverViaSignatureAgent, x as webBotAuthVerifier } from "../server-types-CyRN0-Cd.js";
-import { t as ServerAdapterOptions } from "../bind-YYjvfpB9.js";
+import { D as ConnectionOptions, T as Connection, f as InvalidSignatureError, i as OpenApiHooks, o as ProtectOptions, v as discoverViaSignatureAgent, x as webBotAuthVerifier } from "../server-types-Bw-lWqzR.js";
+import { t as ServerAdapterOptions } from "../bind-DjFNX0Pq.js";
 import { Elysia } from "elysia";
 //#region src/elysia/create.d.ts
 type ElysiaRequestContext = {

package/dist/elysia/index.js

@@ -1,7 +1,7 @@
 import { a as parsedBody, r as hasCredentials } from "../http-DKLXrFGk.js";
-import { l as InvalidSignatureError, p as webBotAuthVerifier, u as discoverViaSignatureAgent } from "../evaluations-IBceAeKT.js";
-import { t as problemFromError } from "../map-error-pasIGqMT.js";
-import { a as socketConnection, i as decorate, r as bindKernel } from "../bind-BNQA9JK9.js";
+import { l as InvalidSignatureError, p as webBotAuthVerifier, u as discoverViaSignatureAgent } from "../evaluations-DG40eSJa.js";
+import { t as problemFromError } from "../map-error-B_f3C5cs.js";
+import { a as socketConnection, i as decorate, r as bindKernel } from "../bind-BJFeLX1V.js";
 import { a as onRevoked, n as closeReason, t as POLICY_VIOLATION } from "../stream-CDvF0sJm.js";
 import { Elysia } from "elysia";
 //#region src/elysia/create.ts

package/dist/{errors-Vpu6rKHl.js → errors-BhRkoNS7.js}

@@ -5,8 +5,6 @@ const CODES = {
 	unknown_command: ["Unknown command", 2],
 	unknown_flag: ["Unknown flag", 2],
 	invalid_value: ["Invalid value", 2],
-	command_moved: ["Command moved", 2],
-	flag_renamed: ["Flag renamed", 2],
 	missing_value: ["Missing value", 2],
 	config_not_found: ["Config file not found", 2],
 	config_invalid: ["Invalid config", 2],

package/dist/{errors-BIM4MFsJ.d.ts → errors-Dc9FdamT.d.ts}

@@ -1,4 +1,4 @@
-import { Un as Decision, hn as WireDenial, hr as Subject } from "./policy-types-DGIO_gxq.js";
+import { _n as WireDenial, qn as Decision, yr as Subject } from "./policy-types-IRJVABmm.js";
 import { StandardSchemaV1 } from "@standard-schema/spec";
 //#region src/core/problem-details.d.ts
 type Disclosure = "hide" | "reveal";

package/dist/{evaluate-BAmf_AQd.js → evaluate-CsjXeLRo.js}

@@ -1,7 +1,7 @@
 import { a as sole, n as isReadonlyArray, t as compact } from "./compact-CAf557ZB.js";
 import { n as freezeDeep } from "./freeze-jjan0lCv.js";
 import { n as isForbiddenKey } from "./paths-CUvURzHp.js";
-import { n as role, t as normalizeAssurance } from "./role-builder-BK2-T6oD.js";
+import { n as role, t as normalizeAssurance } from "./role-builder-BrmOcXch.js";
 import { n as PermDockValidationError } from "./validation-error-CYg2kJEw.js";
 import { t as wireDenials } from "./wire-denial-C7PaVYEM.js";
 import { o as sameId } from "./expiry-6XByK0dm.js";
@@ -11,19 +11,20 @@ import { n as isThenable, t as ignoreRejection } from "./thenable-BNSM1U2R.js";
 import { i as readAppData } from "./app-data-UNNm07jV.js";
 import { a as durationOf, d as isoNow, o as epochSeconds, r as assertDuration, s as instantAt, t as INVALID_NOW } from "./time-nR1JesoH.js";
 import { t as canonicalJson } from "./canonical-json-DwilZ1iB.js";
-import { c as rootMembershipId, f as scopeList, h as tenantOf, i as keepsPermission, o as normalizeMemberships, p as subjectForPermission, s as resolveScope } from "./scopes-0Up_UA2t.js";
-import { a as readOnlyActorRefuses, c as rowIdOf, i as delegatedPermissions, l as rowValues, n as coveredByDelegation, o as requiresStandIn, r as coversRequirements, s as isRowPair, u as evaluateCondition } from "./delegation-CDB6_keF.js";
+import { d as scopeList, f as subjectForPermission, i as keepsPermission, o as normalizeMemberships, p as tenantOf, s as resolveScope } from "./scopes-BSdYaGHs.js";
+import { a as readOnlyActorRefuses, c as rowIdOf, i as delegatedPermissions, l as rowValues, n as coveredByDelegation, o as requiresStandIn, r as coversRequirements, s as isRowPair, u as evaluateCondition } from "./delegation-aK4T_5WU.js";
 import { a as authenticated, g as isRole, i as assurance, m as findRole, o as flattenGrantee, r as asGrantee } from "./grantee-Dke-9rd1.js";
 import { a as grantCoversField, i as wireValidity, t as isActive } from "./validity-Buc7w8E9.js";
-import { o as resourceRoleCondition } from "./grantee-conditions-BrYPe-w0.js";
-import { c as nowSeconds, i as matchScopedMembership, l as partitionsOf, n as inTeam, p as scopeField, r as isMembershipExpired } from "./tenancy-5d1zVBvK.js";
-import { i as grantList, n as declaredRoleNames, s as levelCondition } from "./policy-CLQ8__GF.js";
+import { o as resourceRoleCondition } from "./grantee-conditions-DX4K_gGI.js";
+import { c as nowSeconds, i as matchScopedMembership, l as partitionsOf, n as inTeam, p as scopeField, r as isMembershipExpired } from "./tenancy-DvOHHk3-.js";
+import { i as grantList, n as declaredRoleNames, s as levelCondition } from "./policy-DxQyHKPB.js";
 import { t as requiresApproval } from "./approval-required-TzNB9oQA.js";
-import { i as versionOf, r as tokenPayload, t as decisionToken } from "./token-DC9EQiet.js";
+import { i as rootMembershipId } from "./subject-C7RddW0G.js";
+import { a as versionOf, i as tokenPayload, n as decisionToken } from "./token-DaMnIU9O.js";
 import { n as resolveRelated } from "./relation-walk-DK_gkgL7.js";
 import { t as eventInstant } from "./event-time-BGy48400.js";
 import { n as toWireDelegation } from "./wire-delegation-Cv3W2eaM.js";
-import { n as matchGrantee, t as combineWhere } from "./grantee-match-7RZZvoT_.js";
+import { n as matchGrantee, t as combineWhere } from "./grantee-match-BP-k4vRJ.js";
 import { t as resourceIdOf } from "./resource-ref-CaS9yVPi.js";
 //#region src/core/approval-state.ts
 /**
@@ -298,7 +299,7 @@ function activateFor(policy, subject, input, now = nowSeconds()) {
 		resourceId: within === void 0 ? `${scope}:${input.id}` : `${scope}:${input.id}@${canonicalJson(within)}`,
 		principal,
 		actor: subject.actor,
-		fingerprint: policy.fingerprint
+		source: policy.fingerprint
 	});
 	if (activation.approval !== void 0) return freezeDeep({
 		outcome: "approval-required",
@@ -671,9 +672,10 @@ function allowedDecision(state, allow, approval, quotaState) {
 		resourceId,
 		principal: subject.principal,
 		actor: subject.actor,
-		fingerprint: policy.fingerprint,
+		source: policy.fingerprint,
 		version,
-		payload: tokenPayload(resourceId, next ?? current, state.options.args)
+		payload: tokenPayload(resourceId, next ?? current, state.options.args),
+		fingerprint: state.options.fingerprint
 	});
 	const matched = compact({
 		...matchedOf(allow.grant, permission.key, allow.breakGlass),
@@ -684,12 +686,13 @@ function allowedDecision(state, allow, approval, quotaState) {
 		...allow.obligations ?? [],
 		...allow.grant.obligations ?? []
 	];
-	return complete(state, requiresApproval(approval) ? {
+	return complete(state, requiresApproval(approval) ? compact({
 		outcome: "approval-required",
 		grant: matched,
 		reason: "human",
-		token
-	} : {
+		token,
+		fingerprint: state.options.fingerprint
+	}) : {
 		outcome: "granted",
 		subject,
 		matched,
@@ -1896,4 +1899,4 @@ function evaluate(policy, given, permission, data, options, env) {
 	return allowedDecision(state, chosen.allow, chosen.approval, chosen.quota);
 }
 //#endregion
-export { breakGlass as A, tenantCustomRoles as C, emptyListeners as D, emitSafe as E, APPROVAL_POLICY_UNAVAILABLE as F, contactMayUse as M, contactMemberships as N, finish as O, isContact as P, roleAllowKeys as S, validateCustomRole as T, isSharedCustomRole as _, expandRoleNames as a, parseCustomRoleEntry as b, andWhere as c, customRoleClaim as d, customRoleId as f, holdsGlobalCustomRole as g, holdsCustomRole as h, customRolesFor as i, supportAccess as j, activate as k, ceilingGrants as l, customRoleScope as m, requirementCondition as n, roleSourceFor as o, customRoleOf as p, assignableNamesFor as r, sourceName as s, evaluate as t, customGrantsFor as u, leveled as v, unknownLevelsFor as w, resolveCustomRole as x, membershipsClaim as y };
+export { breakGlass as A, tenantCustomRoles as C, emptyListeners as D, emitSafe as E, APPROVAL_POLICY_UNAVAILABLE as F, decisionTenant as I, contactMayUse as M, contactMemberships as N, finish as O, isContact as P, roleAllowKeys as S, validateCustomRole as T, isSharedCustomRole as _, expandRoleNames as a, parseCustomRoleEntry as b, andWhere as c, customRoleClaim as d, customRoleId as f, holdsGlobalCustomRole as g, holdsCustomRole as h, customRolesFor as i, supportAccess as j, activate as k, ceilingGrants as l, customRoleScope as m, requirementCondition as n, roleSourceFor as o, customRoleOf as p, assignableNamesFor as r, sourceName as s, evaluate as t, customGrantsFor as u, leveled as v, unknownLevelsFor as w, resolveCustomRole as x, membershipsClaim as y };

package/dist/{evaluations-DOWuBpWv.d.ts → evaluations-BasA9zXp.d.ts}

@@ -1,6 +1,6 @@
-import { T as Policy } from "./policy-types-DGIO_gxq.js";
-import { a as PermDock } from "./permdock-CprAPN3w.js";
-import { m as ApprovalStore } from "./types-DLvhVm1r.js";
+import { E as Policy } from "./policy-types-IRJVABmm.js";
+import { a as PermDock } from "./permdock-DUWZEOLR.js";
+import { m as ApprovalStore } from "./types-BvBbkAu1.js";
 //#region src/server/evaluations.d.ts
 /** AuthZEN 1.0 section 7.1.2.1 `options.evaluations_semantic` values. */
 declare const EVALUATIONS_SEMANTICS: readonly ["execute_all", "deny_on_first_deny", "permit_on_first_permit"];

package/dist/{evaluations-IBceAeKT.js → evaluations-DG40eSJa.js}

@@ -6,29 +6,10 @@ import { h as secondsAt } from "./time-nR1JesoH.js";
 import { n as resourceRef } from "./resource-ref-CaS9yVPi.js";
 import { n as readBodyText } from "./body-text-DQhcmqdY.js";
 import { f as validationProblem, l as problemResponse, n as batchTooLarge } from "./problem-BVLHFK33.js";
-import { i as readApprovalHeader, s as resumeDecision } from "./helpers-DJicaG6f.js";
+import { i as readApprovalHeader, s as resumeDecision } from "./helpers-DNnZffrI.js";
 import { t as bodyTooLarge } from "./body-CJQwYVa8.js";
 import { t as timeoutSignal } from "./timeout-D51niuQP.js";
-//#region src/core/decision.ts
-/** The denial for a check that failed or named no declared permission. */
-const NO_GRANT = Object.freeze({
-	outcome: "denied",
-	denials: Object.freeze([Object.freeze({
-		role: null,
-		reason: "no-grant"
-	})]),
-	alternatives: Object.freeze([])
-});
-/** The denial for a check whose row loader threw: it fails closed. */
-const LOAD_FAILED = Object.freeze({
-	outcome: "denied",
-	denials: Object.freeze([Object.freeze({
-		role: null,
-		reason: "validation"
-	})]),
-	alternatives: Object.freeze([])
-});
-//#endregion
+import { n as NO_GRANT } from "./decision-CaG5_eNJ.js";
 //#region src/server/evaluation-items.ts
 function firstWins(map, name, leaf) {
 	if (!map.has(name)) map.set(name, leaf);
@@ -628,4 +609,4 @@ function evaluationsHandler(options) {
 	};
 }
 //#endregion
-export { LOAD_FAILED as _, evaluationReasons as a, withRequestId as c, invalidSignatureProblem as d, invalidSignatureResponse as f, wireResourceId as g, permissionLookup as h, evaluateBatch as i, InvalidSignatureError as l, itemResourceData as m, applyApprovalResume as n, evaluationsHandler as o, webBotAuthVerifier as p, authzenMetadata as r, evaluationsSemantic as s, EVALUATIONS_SEMANTICS as t, discoverViaSignatureAgent as u, NO_GRANT as v };
+export { evaluationReasons as a, withRequestId as c, invalidSignatureProblem as d, invalidSignatureResponse as f, wireResourceId as g, permissionLookup as h, evaluateBatch as i, InvalidSignatureError as l, itemResourceData as m, applyApprovalResume as n, evaluationsHandler as o, webBotAuthVerifier as p, authzenMetadata as r, evaluationsSemantic as s, EVALUATIONS_SEMANTICS as t, discoverViaSignatureAgent as u };

package/dist/eve/index.d.ts

@@ -1,8 +1,8 @@
-import { T as Policy, j as PolicyVocabulary, pr as Principal } from "../policy-types-DGIO_gxq.js";
+import { E as Policy, M as PolicyVocabulary, _r as Principal } from "../policy-types-IRJVABmm.js";
 import { u as Permission } from "../permission-types-CAY-GU7e.js";
-import { a as PermDock } from "../permdock-CprAPN3w.js";
-import { u as ApprovalRequest } from "../types-DLvhVm1r.js";
-import { o as AgentAdapterOptions, t as AgentPermDock } from "../create-BPUopdfL.js";
+import { a as PermDock } from "../permdock-DUWZEOLR.js";
+import { u as ApprovalRequest } from "../types-BvBbkAu1.js";
+import { o as AgentAdapterOptions, t as AgentPermDock } from "../create-bzQlBzG4.js";
 //#region src/eve/create.d.ts
 /** Structural `SessionAuthContext` from `eve`. */
 type EvePrincipal = {

package/dist/eve/index.js

@@ -1,8 +1,8 @@
 import { t as compact } from "../compact-CAf557ZB.js";
-import { l as withApp } from "../permdock-BvjivVb9.js";
+import { l as withApp } from "../permdock-DdzMv5-F.js";
 import { c as isApprovalError } from "../types-CcUXciSj.js";
-import { o as resolveApproval } from "../helpers-DJicaG6f.js";
-import { t as agentRuntime } from "../create-Coq5fIrq.js";
+import { o as resolveApproval } from "../helpers-DNnZffrI.js";
+import { t as agentRuntime } from "../create-gqtDb1nU.js";
 import { t as boundedMap } from "../lru-8q4WZjBV.js";
 //#region src/eve/create.ts
 const TOKENS_PER_PROCESS = 1e3;

package/dist/express/index.d.ts

@@ -1,8 +1,8 @@
-import { T as Policy, j as PolicyVocabulary, pr as Principal } from "../policy-types-DGIO_gxq.js";
+import { E as Policy, M as PolicyVocabulary, _r as Principal } from "../policy-types-IRJVABmm.js";
 import { u as Permission } from "../permission-types-CAY-GU7e.js";
-import { a as PermDock } from "../permdock-CprAPN3w.js";
-import { f as InvalidSignatureError, i as OpenApiHooks, o as ProtectOptions, v as discoverViaSignatureAgent, x as webBotAuthVerifier } from "../server-types-CyRN0-Cd.js";
-import { t as ServerAdapterOptions } from "../bind-YYjvfpB9.js";
+import { a as PermDock } from "../permdock-DUWZEOLR.js";
+import { f as InvalidSignatureError, i as OpenApiHooks, o as ProtectOptions, v as discoverViaSignatureAgent, x as webBotAuthVerifier } from "../server-types-Bw-lWqzR.js";
+import { t as ServerAdapterOptions } from "../bind-DjFNX0Pq.js";
 import { i as toRequest, r as sendResponse } from "../http-B_LphE5Y.js";
 import { ErrorRequestHandler, Request, RequestHandler, Response, Router } from "express";
 //#region src/express/create.d.ts

package/dist/express/index.js

@@ -1,7 +1,7 @@
 import { r as hasCredentials } from "../http-DKLXrFGk.js";
-import { l as InvalidSignatureError, p as webBotAuthVerifier, u as discoverViaSignatureAgent } from "../evaluations-IBceAeKT.js";
-import { t as problemFromError } from "../map-error-pasIGqMT.js";
-import { i as decorate, r as bindKernel } from "../bind-BNQA9JK9.js";
+import { l as InvalidSignatureError, p as webBotAuthVerifier, u as discoverViaSignatureAgent } from "../evaluations-DG40eSJa.js";
+import { t as problemFromError } from "../map-error-B_f3C5cs.js";
+import { i as decorate, r as bindKernel } from "../bind-BJFeLX1V.js";
 import { n as sendResponse, r as toRequest } from "../http-DH94eh6f.js";
 import express from "express";
 //#region src/express/create.ts

package/dist/fastify/index.d.ts

@@ -1,8 +1,8 @@
-import { T as Policy, j as PolicyVocabulary, pr as Principal } from "../policy-types-DGIO_gxq.js";
+import { E as Policy, M as PolicyVocabulary, _r as Principal } from "../policy-types-IRJVABmm.js";
 import { u as Permission } from "../permission-types-CAY-GU7e.js";
-import { a as PermDock } from "../permdock-CprAPN3w.js";
-import { f as InvalidSignatureError, i as OpenApiHooks, o as ProtectOptions, v as discoverViaSignatureAgent, x as webBotAuthVerifier } from "../server-types-CyRN0-Cd.js";
-import { t as ServerAdapterOptions } from "../bind-YYjvfpB9.js";
+import { a as PermDock } from "../permdock-DUWZEOLR.js";
+import { f as InvalidSignatureError, i as OpenApiHooks, o as ProtectOptions, v as discoverViaSignatureAgent, x as webBotAuthVerifier } from "../server-types-Bw-lWqzR.js";
+import { t as ServerAdapterOptions } from "../bind-DjFNX0Pq.js";
 import { FastifyPluginAsync, FastifyReply, FastifyRequest, FastifySchema, FastifyTypeProvider, FastifyTypeProviderDefault, RawRequestDefaultExpression, RawServerDefault, RouteGenericInterface } from "fastify";
 //#region src/server/http.d.ts
 /** A Fastify-style reply: `code`, `header` and `send`. */

package/dist/fastify/index.js

@@ -1,7 +1,7 @@
 import { c as writeReply, i as headersFrom, n as firstHeader, r as hasCredentials, t as fetchRequest } from "../http-DKLXrFGk.js";
-import { l as InvalidSignatureError, p as webBotAuthVerifier, u as discoverViaSignatureAgent } from "../evaluations-IBceAeKT.js";
-import { t as problemFromError } from "../map-error-pasIGqMT.js";
-import { i as decorate, r as bindKernel } from "../bind-BNQA9JK9.js";
+import { l as InvalidSignatureError, p as webBotAuthVerifier, u as discoverViaSignatureAgent } from "../evaluations-DG40eSJa.js";
+import { t as problemFromError } from "../map-error-B_f3C5cs.js";
+import { i as decorate, r as bindKernel } from "../bind-BJFeLX1V.js";
 //#region src/fastify/http.ts
 function toRequest(request) {
 	const host = firstHeader(request.headers.host) ?? "localhost";

package/dist/{fetch-adapter-BIbBAtPZ.d.ts → fetch-adapter-BgqpOOpd.d.ts}

@@ -1,8 +1,8 @@
 import { u as Permission } from "./permission-types-CAY-GU7e.js";
 import { a as OperationInput, t as Operation } from "./operations-Ci_rT6Uo.js";
 import { n as RevocationFeed } from "./revocations-BaUXHM1N.js";
-import { o as ProtectOptions } from "./server-types-CyRN0-Cd.js";
-import { t as ServerAdapterOptions } from "./bind-YYjvfpB9.js";
+import { o as ProtectOptions } from "./server-types-Bw-lWqzR.js";
+import { t as ServerAdapterOptions } from "./bind-DjFNX0Pq.js";
 //#region src/server/fetch-adapter.d.ts
 /**
  * What `protect` checks: a permission, an operation from `defineOperations`, or

package/dist/{fetch-adapter-dPTgJVHd.js → fetch-adapter-UZOW0PRC.js}

@@ -2,8 +2,8 @@ import { t as compact } from "./compact-CAf557ZB.js";
 import { o as isPermission } from "./permission-registry-B8tYxPIt.js";
 import { r as hasCredentials } from "./http-DKLXrFGk.js";
 import { o as methodNotAllowed } from "./problem-BVLHFK33.js";
-import { t as problemFromError } from "./map-error-pasIGqMT.js";
-import { i as decorate, r as bindKernel } from "./bind-BNQA9JK9.js";
+import { t as problemFromError } from "./map-error-B_f3C5cs.js";
+import { i as decorate, r as bindKernel } from "./bind-BJFeLX1V.js";
 //#region src/server/fetch-adapter.ts
 /**
 * `protect(target, data, options)(handler)` for a framework whose routes are

package/dist/{fields-DI8s3cPl.js → fields-CrjL6A49.js}

@@ -1,7 +1,7 @@
 import { a as sole } from "./compact-CAf557ZB.js";
-import { i as configError } from "./errors-Vpu6rKHl.js";
-import { c as jsonSchemaOf } from "./catalog-doc-DjMKzJp9.js";
-import { A as quoteQualified, D as qualified, E as helperSchema, O as quoteIdent, _ as subjectClaimJsonSql, k as quoteLiteral, s as signedIn } from "./shared-DrGLwM3s.js";
+import { i as configError } from "./errors-BhRkoNS7.js";
+import { c as jsonSchemaOf } from "./catalog-doc-C4DGfJCO.js";
+import { A as quoteQualified, D as qualified, E as helperSchema, O as quoteIdent, _ as subjectClaimJsonSql, k as quoteLiteral, s as signedIn } from "./shared-DyYVEjKC.js";
 //#region src/cli/sql/clauses.ts
 /**
 * True when `sql` is one parenthesised expression, so AND / OR need not wrap it

package/dist/{files-B3AA05f1.js → files-CfiRtQ-m.js}

@@ -1,4 +1,4 @@
-import { n as CliError } from "./errors-Vpu6rKHl.js";
+import { n as CliError } from "./errors-BhRkoNS7.js";
 import { existsSync, mkdirSync, readFileSync, realpathSync, renameSync, rmSync, statSync, writeFileSync } from "node:fs";
 import { dirname, relative, resolve } from "node:path";
 import { execFileSync } from "node:child_process";

package/dist/{fixtures-Bm4_K1ke.js → fixtures-0VTW5oNq.js}

@@ -1,7 +1,7 @@
 import { r as isRecord } from "./compact-CAf557ZB.js";
-import { i as configError } from "./errors-Vpu6rKHl.js";
+import { i as configError } from "./errors-BhRkoNS7.js";
 import { i as readJsonFile } from "./files-BSjrtIHw.js";
-import { a as loadModule, s as pickNamed } from "./load-DjSU5KXO.js";
+import { a as loadModule, s as pickNamed } from "./load-BaEamml-.js";
 import { existsSync } from "node:fs";
 import { resolve } from "node:path";
 //#region src/cli/fixtures.ts

package/dist/{flags-DXjoTVbS.js → flags-BlmpmXoY.js}

@@ -1,5 +1,5 @@
-import { n as CliError } from "./errors-Vpu6rKHl.js";
-import { n as secretInput } from "./credentials-CdDxp7jN.js";
+import { n as CliError } from "./errors-BhRkoNS7.js";
+import { n as secretInput } from "./credentials-dkycUsY3.js";
 //#region src/cli/core/flags.ts
 /** The flag vocabulary shared with better-supabase: one spelling per meaning. */
 const dbUrlFlags = { "db-url-stdin": {

package/dist/{from-snapshot-DCakWRsr.js → from-snapshot-DMlSSo9b.js}

@@ -4,18 +4,18 @@ import { a as deniedMessage, i as approvalMessage, n as PermDockDeniedError, t a
 import { o as sameId } from "./expiry-6XByK0dm.js";
 import { c as listPermissions } from "./permission-registry-B8tYxPIt.js";
 import { g as secondsOf, o as epochSeconds, t as INVALID_NOW } from "./time-nR1JesoH.js";
-import { f as scopeList, h as tenantOf, o as normalizeMemberships, s as resolveScope, t as activeFor } from "./scopes-0Up_UA2t.js";
-import { a as readOnlyActorRefuses, c as rowIdOf, l as rowValues, n as coveredByDelegation, u as evaluateCondition } from "./delegation-CDB6_keF.js";
+import { d as scopeList, o as normalizeMemberships, p as tenantOf, s as resolveScope, t as activeFor } from "./scopes-BSdYaGHs.js";
+import { a as readOnlyActorRefuses, c as rowIdOf, l as rowValues, n as coveredByDelegation, u as evaluateCondition } from "./delegation-aK4T_5WU.js";
 import { b as synthesiseRole, m as findRole, v as listRoles } from "./grantee-Dke-9rd1.js";
 import { a as grantCoversField, o as pickVisible, r as readWireValidity, t as isActive } from "./validity-Buc7w8E9.js";
-import { c as nowSeconds, d as resolveActiveTenant, f as rowInScope, n as inTeam, r as isMembershipExpired, s as nestedAppliesWithoutRow } from "./tenancy-5d1zVBvK.js";
+import { c as nowSeconds, d as resolveActiveTenant, f as rowInScope, n as inTeam, r as isMembershipExpired, s as nestedAppliesWithoutRow } from "./tenancy-DvOHHk3-.js";
 import { t as requiresApproval } from "./approval-required-TzNB9oQA.js";
-import { r as tokenPayload, t as decisionToken } from "./token-DC9EQiet.js";
+import { i as tokenPayload, n as decisionToken } from "./token-DaMnIU9O.js";
 import { t as fromWireDelegation } from "./wire-delegation-Cv3W2eaM.js";
-import { n as matchGrantee } from "./grantee-match-7RZZvoT_.js";
+import { n as matchGrantee } from "./grantee-match-BP-k4vRJ.js";
 import { t as resourceIdOf } from "./resource-ref-CaS9yVPi.js";
-import { i as permittedIds, o as deniedFor, r as mayUse, s as signSnapshot, t as whereFromGrants } from "./where-scope-DlCdCM_8.js";
-import { i as decideAllWith, n as canAllWith } from "./checks-CGkP3Z7A.js";
+import { i as permittedIds, o as deniedFor, r as mayUse, s as signSnapshot, t as whereFromGrants } from "./where-scope-BKrqUDVk.js";
+import { i as decideAllWith, n as canAllWith } from "./checks-fyDOhcz0.js";
 //#region src/core/snapshot-evaluate.ts
 function coveredByInclude(snapshot, permission) {
 	const include = snapshot.include;
@@ -324,16 +324,18 @@ function evaluateSnapshot(snapshot, subject, permission, data, team, options, ou
 		resourceId,
 		principal: subject.principal,
 		actor: subject.actor,
-		fingerprint: `snapshot:${snapshot.issuedAt}`,
-		payload: tokenPayload(resourceId, next ?? current, options.args)
+		source: `snapshot:${snapshot.issuedAt}`,
+		payload: tokenPayload(resourceId, next ?? current, options.args),
+		fingerprint: options.fingerprint
 	});
 	const grant = matchedOf(matched);
-	if (requiresApproval(matched.approval)) return done({
+	if (requiresApproval(matched.approval)) return done(compact({
 		outcome: "approval-required",
 		grant,
 		reason: "human",
-		token
-	});
+		token,
+		fingerprint: options.fingerprint
+	}));
 	return done(compact({
 		outcome: "granted",
 		subject,

package/dist/{gen-DwgCSC6V.js → gen-CNCzG4sB.js}

@@ -1,5 +1,5 @@
 import { t as defineLeaf } from "./command-L8EstFNm.js";
-import { c as given, d as policyFlag, i as dryRunFlag, t as checkFlag } from "./flags-DXjoTVbS.js";
+import { c as given, d as policyFlag, i as dryRunFlag, t as checkFlag } from "./flags-BlmpmXoY.js";
 //#region src/cli/commands/gen.ts
 const gen = defineLeaf({
 	flags: {
@@ -41,7 +41,7 @@ const gen = defineLeaf({
 		const out = given(flags.out);
 		const outDir = given(flags["out-dir"]);
 		const from = given(flags.policy);
-		const { runGen } = await import("./gen-DuAhghDw.js");
+		const { runGen } = await import("./gen-DnpZwQPo.js");
 		return runGen({
 			cwd: ctx.cwd,
 			config: ctx.config,

package/dist/{gen-DuAhghDw.js → gen-DnpZwQPo.js}

@@ -1,16 +1,16 @@
 import { r as isRecord } from "./compact-CAf557ZB.js";
-import { t as DESCRIBE_TITLES } from "./describe-Bb4hGK5d.js";
+import { t as DESCRIBE_TITLES } from "./describe-CogP1loh.js";
 import { c as listPermissions } from "./permission-registry-B8tYxPIt.js";
-import { f as scopeList } from "./scopes-0Up_UA2t.js";
+import { d as scopeList } from "./scopes-BSdYaGHs.js";
 import { v as listRoles } from "./grantee-Dke-9rd1.js";
 import { t as byCodePoint } from "./compare-DTfyUunF.js";
-import { i as configError, n as CliError } from "./errors-Vpu6rKHl.js";
-import { c as jsonSchemaOf } from "./catalog-doc-DjMKzJp9.js";
-import { c as requirePolicy } from "./load-DjSU5KXO.js";
-import { t as loadConfiguredOperations } from "./catalog-operations-DeHTrJSV.js";
-import { n as fileSummary, r as planFiles } from "./files-B3AA05f1.js";
-import { f as writeOutputFiles, r as driftOf } from "./output-files-BIQ_9pIs.js";
-import { t as resolveNames } from "./resolve-names-Y1Cb22cp.js";
+import { i as configError, n as CliError } from "./errors-BhRkoNS7.js";
+import { c as jsonSchemaOf } from "./catalog-doc-C4DGfJCO.js";
+import { c as requirePolicy } from "./load-BaEamml-.js";
+import { t as loadConfiguredOperations } from "./catalog-operations-DVI5QO5R.js";
+import { n as fileSummary, r as planFiles } from "./files-CfiRtQ-m.js";
+import { f as writeOutputFiles, r as driftOf } from "./output-files-CM0BnH05.js";
+import { t as resolveNames } from "./resolve-names-1nCei24V.js";
 import { i as schemaExpression } from "./generate-CezbCaTI.js";
 import { existsSync, readFileSync } from "node:fs";
 import { dirname, extname, relative, resolve } from "node:path";

package/dist/{generate-CRVV5V7l.js → generate-BqkZq8Dr.js}

@@ -1,7 +1,7 @@
 import { n as SCIM_TABLES, r as SCIM_UNIQUE } from "./postgres-store-DcyrPS-r.js";
 import { o as quoteSqlIdent } from "./sql-0WjxIp9g.js";
-import { n as fileSummary, t as applyFiles } from "./files-B3AA05f1.js";
-import { r as driftOf } from "./output-files-BIQ_9pIs.js";
+import { n as fileSummary, t as applyFiles } from "./files-CfiRtQ-m.js";
+import { r as driftOf } from "./output-files-CM0BnH05.js";
 //#region src/cli/scim/generate.ts
 const SCIM_MARKER = "-- generated by permdock scim generate";
 /**

package/dist/{grantee-conditions-BrYPe-w0.js → grantee-conditions-DX4K_gGI.js}

@@ -1,7 +1,7 @@
 import { a as sole, t as compact } from "./compact-CAf557ZB.js";
 import { a as expandRelation, c as isEdgeRelation, d as isSelfParented, l as isFieldRelation, m as restrictedStops, p as restrictedFor, s as isComputedRelation, u as isPrincipalRelation } from "./resource-relations-8-pCScBO.js";
 import { d as isoNow } from "./time-nR1JesoH.js";
-import { f as scopeList, l as rootScope, s as resolveScope } from "./scopes-0Up_UA2t.js";
+import { c as rootScope, d as scopeList, s as resolveScope } from "./scopes-BSdYaGHs.js";
 //#region src/core/grantee-conditions.ts
 /**
 * Where a graph relation starts on the row: its own id when the relation is on

package/dist/{grantee-match-7RZZvoT_.js → grantee-match-BP-k4vRJ.js}

@@ -1,8 +1,8 @@
 import { t as compact } from "./compact-CAf557ZB.js";
 import { u as isoAt } from "./time-nR1JesoH.js";
-import { f as scopeList, t as activeFor } from "./scopes-0Up_UA2t.js";
+import { d as scopeList, t as activeFor } from "./scopes-BSdYaGHs.js";
 import { o as flattenGrantee } from "./grantee-Dke-9rd1.js";
-import { r as relationCondition, t as inheritCondition } from "./grantee-conditions-BrYPe-w0.js";
+import { r as relationCondition, t as inheritCondition } from "./grantee-conditions-DX4K_gGI.js";
 //#region src/core/grantee-match.ts
 function combineWhere(left, right) {
 	if (left === void 0) return right;

package/dist/h3/index.d.ts

@@ -1,7 +1,7 @@
-import { T as Policy, Zt as Snapshot, j as PolicyVocabulary, pr as Principal } from "../policy-types-DGIO_gxq.js";
-import { a as PermDock } from "../permdock-CprAPN3w.js";
-import { D as ConnectionOptions, T as Connection, f as InvalidSignatureError, i as OpenApiHooks, u as SnapshotQuery, v as discoverViaSignatureAgent, x as webBotAuthVerifier } from "../server-types-CyRN0-Cd.js";
-import { a as ProtectTarget, n as FetchAdapterOptions, r as FetchProtect, t as ContextReader } from "../fetch-adapter-BIbBAtPZ.js";
+import { $t as Snapshot, E as Policy, M as PolicyVocabulary, _r as Principal } from "../policy-types-IRJVABmm.js";
+import { a as PermDock } from "../permdock-DUWZEOLR.js";
+import { D as ConnectionOptions, T as Connection, f as InvalidSignatureError, i as OpenApiHooks, u as SnapshotQuery, v as discoverViaSignatureAgent, x as webBotAuthVerifier } from "../server-types-Bw-lWqzR.js";
+import { a as ProtectTarget, n as FetchAdapterOptions, r as FetchProtect, t as ContextReader } from "../fetch-adapter-BgqpOOpd.js";
 import { EventHandler, H3Event, H3EventContext, Middleware } from "h3";
 //#region src/h3/create.d.ts
 type H3PermDockOptions<TUser = unknown> = FetchAdapterOptions<H3Event, TUser>;

package/dist/h3/index.js

@@ -1,6 +1,6 @@
-import { l as InvalidSignatureError, p as webBotAuthVerifier, u as discoverViaSignatureAgent } from "../evaluations-IBceAeKT.js";
-import { i as decorate } from "../bind-BNQA9JK9.js";
-import { t as fetchAdapter } from "../fetch-adapter-dPTgJVHd.js";
+import { l as InvalidSignatureError, p as webBotAuthVerifier, u as discoverViaSignatureAgent } from "../evaluations-DG40eSJa.js";
+import { i as decorate } from "../bind-BJFeLX1V.js";
+import { t as fetchAdapter } from "../fetch-adapter-UZOW0PRC.js";
 //#region src/h3/create.ts
 function createPermDock(policy, options) {
 	const adapter = fetchAdapter(policy, options, "h3", (event) => event.req);