permdock 0.16.0 → 0.17.0

package/dist/trpc/index.d.ts

@@ -1,10 +1,10 @@
-import { T as Policy, pr as Principal } from "../policy-types-DGIO_gxq.js";
+import { E as Policy, _r as Principal } from "../policy-types-IRJVABmm.js";
 import { u as Permission } from "../permission-types-CAY-GU7e.js";
-import { a as PermDock } from "../permdock-CprAPN3w.js";
+import { a as PermDock } from "../permdock-DUWZEOLR.js";
 import { n as RevocationFeed } from "../revocations-BaUXHM1N.js";
-import { D as ConnectionOptions, T as Connection, i as OpenApiHooks } from "../server-types-CyRN0-Cd.js";
-import { t as ServerAdapterOptions } from "../bind-YYjvfpB9.js";
-import { t as StreamProtectOptions } from "../stream-9y9qw51m.js";
+import { D as ConnectionOptions, T as Connection, i as OpenApiHooks } from "../server-types-Bw-lWqzR.js";
+import { t as ServerAdapterOptions } from "../bind-DjFNX0Pq.js";
+import { t as StreamProtectOptions } from "../stream-BMJg56jU.js";
 import { AnyTRPCMiddlewareFunction } from "@trpc/server";
 //#region src/trpc/create.d.ts
 type TrpcMiddlewareOpts<TCtx = object, TInput = unknown> = {

package/dist/trpc/index.js

@@ -1,8 +1,8 @@
 import { o as problemMessage } from "../http-DKLXrFGk.js";
-import { t as problemFromError } from "../map-error-pasIGqMT.js";
-import { n as attached } from "../bind-BNQA9JK9.js";
+import { t as problemFromError } from "../map-error-B_f3C5cs.js";
+import { n as attached } from "../bind-BJFeLX1V.js";
 import { i as isAsyncIterable, o as reloadAfter } from "../stream-CDvF0sJm.js";
-import { i as rpcCode, n as guardStream, r as problemBody, t as bindRpcKernel } from "../rpc-vHIwyXCp.js";
+import { i as rpcCode, n as guardStream, r as problemBody, t as bindRpcKernel } from "../rpc-BOu3FD6X.js";
 import { TRPCError, isTrackedEnvelope } from "@trpc/server";
 //#region src/trpc/create.ts
 const PROBLEM = Symbol.for("permdock.problem");

package/dist/{type-helpers-c7Xo_2Cu.d.ts → type-helpers-C_OnZW8c.d.ts}

@@ -1,4 +1,4 @@
-import { bn as ScopeNames, j as PolicyVocabulary } from "./policy-types-DGIO_gxq.js";
+import { M as PolicyVocabulary, Sn as ScopeNames } from "./policy-types-IRJVABmm.js";
 import { k as POLICY_SCOPES, u as Permission } from "./permission-types-CAY-GU7e.js";
 import { n as PlanTree } from "./vocabulary-DEJ5j4mR.js";
 import { o as OperationMap } from "./operations-Ci_rT6Uo.js";

package/dist/{types-B2efzoSX.d.ts → types-AOP5HQku.d.ts}

@@ -1,4 +1,4 @@
-import { Sn as Approver } from "./policy-types-DGIO_gxq.js";
+import { wn as Approver } from "./policy-types-IRJVABmm.js";
 //#region src/approvals/access-reviews/types.d.ts
 type AccessReviewStatus = "open" | "closed";
 type AccessReviewItemStatus = "pending" | "kept" | "revoked";

package/dist/{types-DlelvQk4.d.ts → types-B3BOcI0J.d.ts}

@@ -1,6 +1,6 @@
-import { Jn as ExplainedDecision, T as Policy, Un as Decision, fr as Membership, hr as Subject, j as PolicyVocabulary, pr as Principal } from "./policy-types-DGIO_gxq.js";
+import { E as Policy, M as PolicyVocabulary, Qn as ExplainedDecision, _r as Principal, gr as Membership, qn as Decision, yr as Subject } from "./policy-types-IRJVABmm.js";
 import { f as PermissionTree, u as Permission } from "./permission-types-CAY-GU7e.js";
-import { C as PermissionCheck, a as PermDock, f as WhereResult, l as SimulateOptions, n as DecideOptions, o as PermDockOptions, r as DeriveOptions } from "./permdock-CprAPN3w.js";
+import { O as PermissionCheck, a as PermDock, f as WhereResult, l as SimulateOptions, n as DecideOptions, o as PermDockOptions, r as DeriveOptions } from "./permdock-DUWZEOLR.js";
 //#region src/pdp/types.d.ts
 type RemotePdpAuth = {
   readonly bearer: string | (() => string | Promise<string>);

package/dist/{types-DLvhVm1r.d.ts → types-BvBbkAu1.d.ts}

@@ -1,15 +1,18 @@
-import { Nn as RelationGrantee, Sn as Approver, Wt as Instant, fr as Membership, gn as WireDelegation, hr as Subject, o as ApprovalStage, r as ApprovalMode, vr as AdapterId } from "./policy-types-DGIO_gxq.js";
+import { Kt as Instant, Ln as RelationGrantee, Sr as AdapterId, gr as Membership, i as ApprovalMode, n as ApprovalCombine, s as ApprovalStage, vn as WireDelegation, wn as Approver, yr as Subject } from "./policy-types-IRJVABmm.js";
 import { M as AppData } from "./permission-types-CAY-GU7e.js";
 //#region src/approvals/types.d.ts
 type ApprovalStatus = "pending" | "approved" | "rejected" | "expired";
 type ApprovalApprovers = {
-  /** Under `mode: 'any'` (the default). */
+  /** Under `combine: 'any'` (the default). */
   readonly by?: Approver | readonly Approver[];
-  readonly mode?: ApprovalMode;
-  /** Under `mode: 'all'` or `'sequential'`. */
+  readonly combine?: ApprovalCombine;
+  /** Under `combine: 'all'` or `'sequential'`. */
   readonly stages?: readonly ApprovalStage[];
-  /** `false` lets the request's principal approve it; absent means `true`. */
-  readonly distinct?: boolean;
+  /**
+   * `'confirm'` lets the request's principal approve it; absent means
+   * `'authorize'`.
+   */
+  readonly mode?: ApprovalMode;
   /** Set when the approval no longer applies once the row's `version` changes. */
   readonly staleOn?: "resource-change";
   /**
@@ -123,6 +126,12 @@ type ApprovalRequest = {
   readonly vouched?: string;
   readonly note?: string;
   readonly consumedAt?: string;
+  /**
+   * The caller's `approvalFingerprint` of the exact operation, from the
+   * decision's `fingerprint`. Consuming or resuming under another one fails
+   * with `approval-fingerprint-mismatch`.
+   */
+  readonly fingerprint?: string;
   /**
    * The application's own data, set when the request opens; plain JSON, never
    * read by a decision.
@@ -213,7 +222,7 @@ type ApprovalStore = {
   consume: (token: string, now?: Instant) => Promise<ApprovalRequest | null> | ApprovalRequest | null;
   cancel?: (filter: ApprovalListFilter, meta: ApprovalCancelMeta) => Promise<number> | number;
 };
-type ApprovalResumeFailureCause = "approval-not-found" | "approval-pending" | "approval-rejected" | "approval-expired" | "approval-consumed";
+type ApprovalResumeFailureCause = "approval-not-found" | "approval-pending" | "approval-rejected" | "approval-expired" | "approval-consumed" | "approval-fingerprint-mismatch";
 type ApprovalInspectResult = {
   readonly ok: true;
   readonly request: ApprovalRequest;

package/dist/{types-BB-zWDcR.d.ts → types-CA-A33Q5.d.ts}

@@ -1,8 +1,8 @@
-import { J as DecisionSink, ct as SnapshotSource, hr as Subject, ht as TokenVerifier, mt as TokenSigner } from "./policy-types-DGIO_gxq.js";
-import { s as PolicySource } from "./hosted-DVxlLZMe.js";
-import { m as ApprovalStore, u as ApprovalRequest } from "./types-DLvhVm1r.js";
-import { a as CatalogDocument } from "./types-ZzRGoViD.js";
-import { a as CatalogFinding } from "./sink-B5zoUW_O.js";
+import { Y as DecisionSink, _t as TokenVerifier, gt as TokenSigner, lt as SnapshotSource, yr as Subject } from "./policy-types-IRJVABmm.js";
+import { s as PolicySource } from "./hosted-DxRLLiFU.js";
+import { m as ApprovalStore, u as ApprovalRequest } from "./types-BvBbkAu1.js";
+import { a as CatalogDocument } from "./types-NYoj8JBm.js";
+import { a as CatalogFinding } from "./sink-DUzt0e4B.js";
 //#region src/cloud/types.d.ts
 type CloudEndpointOptions = {
   readonly url?: string;

package/dist/{types-Cklw5hJo.d.ts → types-CAAN7evk.d.ts}

@@ -1,4 +1,4 @@
-import { h as RoleThrough, m as RoleMap, s as SqlMembershipSource } from "./sources-oB1Hg1Fm.js";
+import { h as RoleThrough, m as RoleMap, s as SqlMembershipSource } from "./sources-CXY05xtB.js";
 //#region src/cli/core/errors.d.ts
 /**
  * 0 success, 1 failure, 2 usage, 3 action required, 130 interrupted (SIGINT or
@@ -454,6 +454,16 @@ type RlsApprovalsAdopt = {
    * same rows for `approvalsHandler`. Off by default.
    */
   readonly delegations?: boolean;
+  /**
+   * Add `approval_policies`, the approval requirements a tenant keeps as data,
+   * and `permdock_approval_policies_for`, which `tableApprovalPolicySource`
+   * reads. A holder of the `manage` permission key in a tenant writes that
+   * tenant's rows; rows with `tenant` null are platform floors, written only by
+   * the table owner. Off by default.
+   */
+  readonly tenantPolicies?: {
+    readonly manage: string;
+  };
   /** A text column unique per request. Default `token`. */
   readonly token?: string;
   /** A jsonb column holding the `ApprovalRequest`. Default `body`. */
@@ -811,6 +821,19 @@ type SupabaseHookConfig = {
    * `true`.
    */
   readonly version?: boolean;
+  /**
+   * Broadcast every version bump as `{ user_id, version }` with event `changed`
+   * on `topic`, which no user may join, and on the user's own `authz:<uid>`.
+   * `topic` defaults to `better_supabase:authz` in a better-supabase project,
+   * else `permdock:authz`. `receivePolicy` writes the `realtime.messages`
+   * policy that lets a user receive `authz:<uid>`; it defaults to `true`, and
+   * to `false` when better-supabase's `sessions.authzVersions` writes the same
+   * policy. `false` sends nothing.
+   */
+  readonly broadcast?: false | {
+    readonly topic?: string;
+    readonly receivePolicy?: boolean;
+  };
   /**
    * Write PostgREST wrappers for `subject_for`, `members_of` and
    * `authz_version_for` into `schema` (default `public`), named

package/dist/{types-DsHGPtkR.d.ts → types-CJC1aaoJ.d.ts}

@@ -1,5 +1,5 @@
-import { Z as JwtClaims, hr as Subject, ht as TokenVerifier, nt as MembershipSource, pr as Principal, pt as TokenFailureCause, rn as AuthEvent, rr as Actor } from "./policy-types-DGIO_gxq.js";
-import { m as ApprovalStore } from "./types-DLvhVm1r.js";
+import { Q as JwtClaims, _r as Principal, _t as TokenVerifier, an as AuthEvent, ht as TokenFailureCause, rt as MembershipSource, sr as Actor, yr as Subject } from "./policy-types-IRJVABmm.js";
+import { m as ApprovalStore } from "./types-BvBbkAu1.js";
 import { n as RevocationFeed } from "./revocations-BaUXHM1N.js";
 import { t as ClaimsMap } from "./claims-map-D1Pb5oRq.js";
 import { t as ClientNames } from "./clients-C_NOET3z.js";

package/dist/{types-CWBsAwqn.d.ts → types-D29K5ZNP.d.ts}

@@ -1,7 +1,7 @@
-import { Zt as Snapshot, ct as SnapshotSource, ht as TokenVerifier } from "./policy-types-DGIO_gxq.js";
-import { n as DescribeMessages } from "./describe-BbFPBSms.js";
-import { _ as ClientStoreOptions } from "./types-tQB2CEnY.js";
-import { t as PermDockDefaults } from "./types-rCRV4Ge-.js";
+import { $t as Snapshot, _t as TokenVerifier, lt as SnapshotSource } from "./policy-types-IRJVABmm.js";
+import { n as DescribeMessages } from "./describe-nalX_HHE.js";
+import { n as ClientStoreOptions } from "./store-g5ctUrOI.js";
+import { t as PermDockDefaults } from "./types-e82uzrTn.js";
 import { ReactNode } from "react";
 //#region src/react-native/types.d.ts
 type SnapshotStorage = {

package/dist/{types-CEinc15V.d.ts → types-DVZNTkU0.d.ts}

@@ -1,9 +1,8 @@
-import { Hn as ApprovalRequiredDecision, Un as Decision, Yn as GrantedDecision, Zt as Snapshot, ht as TokenVerifier } from "./policy-types-DGIO_gxq.js";
+import { $n as GrantedDecision, $t as Snapshot, Kn as ApprovalRequiredDecision, _t as TokenVerifier, qn as Decision } from "./policy-types-IRJVABmm.js";
 import { u as Permission } from "./permission-types-CAY-GU7e.js";
-import { a as PermDock } from "./permdock-CprAPN3w.js";
+import { a as PermDock } from "./permdock-DUWZEOLR.js";
 import { t as PermissionBoundaryState } from "./boundary-C9ck-3uK.js";
-import { t as ActionResult } from "./action-result-BcudBQOF.js";
-import { d as ProtectedActionView, f as ProviderOptionsBase, g as ClientStore, l as PermissionState } from "./types-tQB2CEnY.js";
+import { d as PermissionState, m as ProviderOptionsBase, p as ProtectedActionView, t as ClientStore, v as ActionResult } from "./store-g5ctUrOI.js";
 import { Snippet } from "svelte";
 import { Readable } from "svelte/store";
 //#region src/client/views.d.ts

package/dist/{types-ZzRGoViD.d.ts → types-NYoj8JBm.d.ts}

@@ -56,12 +56,12 @@ type CatalogBreakGlass = {
 };
 type CatalogApproval = "human" | {
   readonly by?: unknown;
-  readonly mode?: "any" | "all" | "sequential";
+  readonly combine?: "any" | "all" | "sequential";
   readonly stages?: readonly {
     readonly by: unknown;
     readonly quorum?: number;
   }[];
-  readonly distinct?: boolean;
+  readonly mode?: "confirm" | "authorize";
   readonly staleOn?: "resource-change";
   readonly quorum?: number;
   /** Seconds. */

package/dist/{types-B6ExllNo.d.ts → types-Sj1U8HMm.d.ts}

@@ -1,5 +1,5 @@
-import { j as PolicyVocabulary, on as DecisionEvent } from "./policy-types-DGIO_gxq.js";
-import { a as PermDock } from "./permdock-CprAPN3w.js";
+import { M as PolicyVocabulary, cn as DecisionEvent } from "./policy-types-IRJVABmm.js";
+import { a as PermDock } from "./permdock-DUWZEOLR.js";
 //#region src/otel/types.d.ts
 declare const GENAI_SEMCONV_PIN = "1.37.0";
 declare const GEN_AI_TOOL_NAME = "gen_ai.tool.name";

package/dist/{types-CN0LsqbK.d.ts → types-UfpcY575.d.ts}

@@ -1,6 +1,6 @@
-import { Yn as GrantedDecision, cn as DeliveryEvent, dn as EmailCategory, ln as DeliveryFailureCause, sn as DeliveryChannel } from "./policy-types-DGIO_gxq.js";
-import { s as CloudEvent } from "./sink-B5zoUW_O.js";
-import { t as ApprovalPrompt } from "./approval-prompt-3BqWczTt.js";
+import { $n as GrantedDecision, dn as DeliveryFailureCause, ln as DeliveryChannel, pn as EmailCategory, un as DeliveryEvent } from "./policy-types-IRJVABmm.js";
+import { s as CloudEvent } from "./sink-DUzt0e4B.js";
+import { t as ApprovalPrompt } from "./approval-prompt-BSh-yxbH.js";
 //#region src/delivery/types.d.ts
 /**
  * Who a delivery goes to. `{ principal }` names an app principal and the

package/dist/{types-rCRV4Ge-.d.ts → types-e82uzrTn.d.ts}

@@ -1,8 +1,8 @@
-import { Hn as ApprovalRequiredDecision, Un as Decision, Yn as GrantedDecision, Zt as Snapshot, ht as TokenVerifier } from "./policy-types-DGIO_gxq.js";
+import { $n as GrantedDecision, $t as Snapshot, Kn as ApprovalRequiredDecision, _t as TokenVerifier, qn as Decision } from "./policy-types-IRJVABmm.js";
 import { u as Permission } from "./permission-types-CAY-GU7e.js";
-import { s as RowData } from "./permdock-CprAPN3w.js";
-import { n as DescribeMessages } from "./describe-BbFPBSms.js";
-import { _ as ClientStoreOptions } from "./types-tQB2CEnY.js";
+import { s as RowData } from "./permdock-DUWZEOLR.js";
+import { n as DescribeMessages } from "./describe-nalX_HHE.js";
+import { n as ClientStoreOptions } from "./store-g5ctUrOI.js";
 import { ReactNode } from "react";
 //#region src/react/types.d.ts
 type PermDockProviderProps = ({

package/dist/unplugin/index.d.ts

@@ -1,4 +1,4 @@
-import { s as PermDockPluginOptions } from "../types-Cklw5hJo.js";
+import { s as PermDockPluginOptions } from "../types-CAAN7evk.js";
 import { createUnplugin } from "unplugin";
 //#region src/unplugin/index.d.ts
 type CreateUnplugin = typeof createUnplugin<PermDockPluginOptions | undefined>;

package/dist/unplugin/index.js

@@ -1,5 +1,5 @@
-import { n as createCollectScheduler, r as report } from "../watch-DAkjm75Y.js";
-import { r as peerHint } from "../peer-Q0fuZ6hx.js";
+import { n as createCollectScheduler, r as report } from "../watch-DXRDBSCu.js";
+import { r as peerHint } from "../peer-BuK9F53f.js";
 import { createRequire } from "node:module";
 //#region src/unplugin/index.ts
 function loadCreateUnplugin() {

package/dist/{usage-CPXeuAdT.js → usage-COsGLht5.js}

@@ -1,13 +1,13 @@
 import { a as getResource } from "./permission-registry-B8tYxPIt.js";
-import { u as usageResult } from "./errors-Vpu6rKHl.js";
+import { u as usageResult } from "./errors-BhRkoNS7.js";
 import { a as rel, r as listSourceFiles } from "./files-BSjrtIHw.js";
 import { o as USAGE_REPORT_SCHEMA } from "./version-DMQ0dnN5.js";
-import { c as jsonSchemaOf } from "./catalog-doc-DjMKzJp9.js";
-import { a as loadModule, n as asPolicy, s as pickNamed } from "./load-DjSU5KXO.js";
-import { r as runCollect } from "./collect-WCl8cJQV.js";
+import { c as jsonSchemaOf } from "./catalog-doc-C4DGfJCO.js";
+import { a as loadModule, n as asPolicy, s as pickNamed } from "./load-BaEamml-.js";
+import { r as runCollect } from "./collect-HfJXl8Tr.js";
 import { t as beforeFirst } from "./text-BMFRfBqc.js";
-import { t as DOCS_BASE } from "./manifest-Cft51TLK.js";
-import { r as findingOf } from "./output-DlICTjBh.js";
+import { t as DOCS_BASE } from "./manifest-Dij1U0hx.js";
+import { r as findingOf } from "./output-DhTpe8v1.js";
 import { existsSync, readFileSync, realpathSync } from "node:fs";
 import { dirname, resolve } from "node:path";
 import { fileURLToPath, pathToFileURL } from "node:url";

package/dist/{usage-CfZCQd0F.js → usage-CqcMeQgX.js}

@@ -1,5 +1,5 @@
 import { t as defineLeaf } from "./command-L8EstFNm.js";
-import { a as failOnFlag } from "./flags-DXjoTVbS.js";
+import { a as failOnFlag } from "./flags-BlmpmXoY.js";
 //#region src/cli/commands/usage.ts
 const usage = defineLeaf({
 	flags: {
@@ -16,7 +16,7 @@ const usage = defineLeaf({
 		}
 	},
 	async run(ctx, { flags }) {
-		return (await import("./usage-DmmO_xjJ.js")).runUsage({
+		return (await import("./usage-D1cpHO7p.js")).runUsage({
 			cwd: ctx.cwd,
 			config: ctx.config,
 			ignore: flags.ignore,

package/dist/usage-D1cpHO7p.js

@@ -0,0 +1 @@
+export { t as runUsage } from "./usage-COsGLht5.js";

package/dist/{validation-error-uvp-kyfO.d.ts → validation-error-DpvsBwZJ.d.ts}

@@ -1,4 +1,4 @@
-import { a as ProblemDetails } from "./errors-BIM4MFsJ.js";
+import { a as ProblemDetails } from "./errors-Dc9FdamT.js";
 import { StandardSchemaV1 } from "@standard-schema/spec";
 //#region src/core/validation-error.d.ts
 /**

package/dist/{verify-DfT0QYNh.js → verify-C8G8D5mk.js}

@@ -1,35 +1,35 @@
 import { a as sole, r as isRecord } from "./compact-CAf557ZB.js";
 import { l as isConditionRef, o as hasConditionOp } from "./refs-C8BKxc_e.js";
-import { j as memoryCustomRoleSource, x as memoryRelationSource } from "./src-C_pi2Rnh.js";
+import { M as memoryCustomRoleSource, S as memoryRelationSource } from "./src-nYNBfmgq.js";
 import { c as listPermissions, h as formerKeys, n as findPermission } from "./permission-registry-B8tYxPIt.js";
 import { c as isEdgeRelation, l as isFieldRelation, u as isPrincipalRelation } from "./resource-relations-8-pCScBO.js";
 import { f as nowMillis, u as isoAt } from "./time-nR1JesoH.js";
 import { t as canonicalJson } from "./canonical-json-DwilZ1iB.js";
-import { f as scopeList, l as rootScope, o as normalizeMemberships } from "./scopes-0Up_UA2t.js";
-import { o as requiresStandIn } from "./delegation-CDB6_keF.js";
-import { p as scopeField } from "./tenancy-5d1zVBvK.js";
-import { l as policyLevels, t as coveredLevels } from "./policy-CLQ8__GF.js";
+import { c as rootScope, d as scopeList, o as normalizeMemberships } from "./scopes-BSdYaGHs.js";
+import { o as requiresStandIn } from "./delegation-aK4T_5WU.js";
+import { p as scopeField } from "./tenancy-DvOHHk3-.js";
+import { l as policyLevels, t as coveredLevels } from "./policy-DxQyHKPB.js";
 import { t as requiresApproval } from "./approval-required-TzNB9oQA.js";
-import { c as andWhere, m as customRoleScope, v as leveled, y as membershipsClaim } from "./evaluate-BAmf_AQd.js";
-import { t as getPermDock } from "./permdock-BvjivVb9.js";
-import { a as describeError, i as configError, u as usageResult } from "./errors-Vpu6rKHl.js";
+import { c as andWhere, m as customRoleScope, v as leveled, y as membershipsClaim } from "./evaluate-CsjXeLRo.js";
+import { t as getPermDock } from "./permdock-DdzMv5-F.js";
+import { a as describeError, i as configError, u as usageResult } from "./errors-BhRkoNS7.js";
 import { t as policyRowConditionKeys } from "./row-conditions-BAGHOmVq.js";
 import { s as writeFileEnsuringDir } from "./files-BSjrtIHw.js";
-import { c as jsonSchemaOf } from "./catalog-doc-DjMKzJp9.js";
-import { o as loadPolicyAt } from "./load-DjSU5KXO.js";
-import "./budget-BELja5A9.js";
+import { c as jsonSchemaOf } from "./catalog-doc-C4DGfJCO.js";
+import { o as loadPolicyAt } from "./load-BaEamml-.js";
+import "./budget-BBCPDOGP.js";
 import { i as qualifySqlTable, n as defaultSqlCommand, t as SQL_IDENT } from "./sql-0WjxIp9g.js";
-import { a as scopeMembershipTable, i as scopeColumn } from "./compile-EzEMB-7v.js";
+import { a as scopeMembershipTable, i as scopeColumn } from "./compile-B_oJqmIg.js";
 import "./sources-C4vkzZJV.js";
 import { t as beforeFirst } from "./text-BMFRfBqc.js";
-import { t as DOCS_BASE } from "./manifest-Cft51TLK.js";
-import { n as fixtureSubject, r as loadFixtures, t as fixtureRow } from "./fixtures-Bm4_K1ke.js";
-import { A as quoteQualified, N as arrayColumnsOf, O as quoteIdent, P as columnTypesOf, _ as subjectClaimJsonSql, a as customRolesOn, j as quoteTable, k as quoteLiteral, r as HELPERS, v as subjectClaimSql } from "./shared-DrGLwM3s.js";
-import { C as accessSql, D as tokenScopeAllowsCall, S as requiresSql, ht as scopeTable, k as capabilityAccessSql, n as tableNameOf, o as graphPlan, q as apiKeyAllowsCall, r as tableNames } from "./tables-DimBcVWY.js";
-import { c as breakGlassKey, f as compileConditionSql, l as collectGrants, m as sqlFunctionNames, p as contextRefs, s as breakGlassHolder } from "./ownership-qqBuGJXr.js";
+import { t as DOCS_BASE } from "./manifest-Dij1U0hx.js";
+import { n as fixtureSubject, r as loadFixtures, t as fixtureRow } from "./fixtures-0VTW5oNq.js";
+import { A as quoteQualified, N as arrayColumnsOf, O as quoteIdent, P as columnTypesOf, _ as subjectClaimJsonSql, a as customRolesOn, j as quoteTable, k as quoteLiteral, r as HELPERS, v as subjectClaimSql } from "./shared-DyYVEjKC.js";
+import { C as accessSql, D as tokenScopeAllowsCall, S as requiresSql, ht as scopeTable, k as capabilityAccessSql, n as tableNameOf, o as graphPlan, q as apiKeyAllowsCall, r as tableNames } from "./tables-BsGE6HBR.js";
+import { c as breakGlassKey, f as compileConditionSql, l as collectGrants, m as sqlFunctionNames, p as contextRefs, s as breakGlassHolder } from "./ownership-moSRhxl_.js";
 import { t as membershipSourcesOf } from "./sources-qoIJQrJv.js";
-import { n as pgConnector, t as connectPgPool } from "./pg-DQTqRrou.js";
-import { _ as wrapSql, g as validitySql, m as andSql, s as viewName, t as FIELD_VIEWS } from "./fields-DI8s3cPl.js";
+import { n as pgConnector, t as connectPgPool } from "./pg-Ddxsd5ZB.js";
+import { _ as wrapSql, g as validitySql, m as andSql, s as viewName, t as FIELD_VIEWS } from "./fields-CrjL6A49.js";
 import { resolve } from "node:path";
 import { createHash, randomUUID } from "node:crypto";
 //#region src/cli/rls/indexes.ts

package/dist/{version-cache-Df11C2Qp.d.ts → version-cache-9Vq5QVFC.d.ts}

@@ -1,4 +1,4 @@
-import { Wt as Instant, yt as VersionQuery } from "./policy-types-DGIO_gxq.js";
+import { Kt as Instant, xt as VersionQuery } from "./policy-types-IRJVABmm.js";
 //#region src/core/version-cache.d.ts
 type VersionCacheStats = {
   /** Version reads the cache started. */
@@ -20,12 +20,18 @@ type VersionCache = {
   readonly maxStaleMs: number;
   /**
    * The current version of `principal`. With `live: false`, an entry at most
-   * `maxStaleMs` old answers, a read in flight is shared, and a token claim
-   * newer than the entry raises it; with `live: true`, `read` runs.
+   * `maxStaleMs` old answers and a read in flight is shared; with `live: true`,
+   * `read` runs.
    */
   current: (principal: VersionQuery, read: () => number | undefined | Promise<number | undefined>, options: {
     readonly live: boolean;
   }) => number | undefined | Promise<number | undefined>;
+  /**
+   * Stores a version read at `at` (default now): `bsb.bootstrap()`'s
+   * `authz_ver`, or a token claim dated by its `iat`. A seed never lowers a
+   * cached version, and one dated in the future is ignored.
+   */
+  seed: (principal: string, version: number, at?: Instant) => void;
   /** Drops `principal`'s entry, so the next instance reads the version. */
   evict: (principal: string) => void;
   stats: () => VersionCacheStats;

package/dist/{views-CD8wuL4Z.js → views-TrZYlDnM.js}

@@ -1,5 +1,5 @@
 import { r as requiredPlans } from "./problem-details-CLDgX1KV.js";
-import { n as describe } from "./describe-Bb4hGK5d.js";
+import { n as describe } from "./describe-CogP1loh.js";
 //#region src/client/views.ts
 function permissionSet(store, permissions, data) {
 	const granted = [];

package/dist/vue/index.d.ts

@@ -1,13 +1,13 @@
-import { Hn as ApprovalRequiredDecision, Un as Decision, Zt as Snapshot, fr as Membership, ht as TokenVerifier, j as PolicyVocabulary } from "../policy-types-DGIO_gxq.js";
+import { $t as Snapshot, Kn as ApprovalRequiredDecision, M as PolicyVocabulary, _t as TokenVerifier, gr as Membership, qn as Decision } from "../policy-types-IRJVABmm.js";
 import { u as Permission } from "../permission-types-CAY-GU7e.js";
 import { r as Role } from "../vocabulary-DEJ5j4mR.js";
-import { d as UncheckedData, s as RowData } from "../permdock-CprAPN3w.js";
-import { c as requiredPlans } from "../errors-BIM4MFsJ.js";
-import { i as describe, r as DescribeOptions, t as DecisionDescription } from "../describe-BbFPBSms.js";
+import { d as UncheckedData, s as RowData } from "../permdock-DUWZEOLR.js";
+import { c as requiredPlans } from "../errors-Dc9FdamT.js";
+import { i as describe, r as DescribeOptions, t as DecisionDescription } from "../describe-nalX_HHE.js";
 import { t as PermissionBoundaryState } from "../boundary-C9ck-3uK.js";
-import { n as ProtectedAction, t as ActionResult } from "../action-result-BcudBQOF.js";
+import { _ as TenantView, a as ClientPermDock, c as GateMode, d as PermissionState, g as SubjectView, h as RolesOptions, i as ApprovalState, l as GateView, m as ProviderOptionsBase, o as ClientStatus, p as ProtectedActionView, r as ApprovalHandle, s as FilterResult, u as PermissionSet, v as ActionResult, y as ProtectedAction } from "../store-g5ctUrOI.js";
+import { a as broadcastChannelRefresh, c as visibilityRefresh, i as authzChangeRefresh, n as EventSourceRefreshOptions, o as eventSourceRefresh, r as RefreshTrigger, s as focusRefresh, t as AuthzChangeRefresh } from "../refresh-on-L9UOwATg.js";
 import { t as approvalHeaders } from "../headers-B9jQxjtW.js";
-import { a as FilterResult, b as eventSourceRefresh, c as PermissionSet, d as ProtectedActionView, f as ProviderOptionsBase, h as TenantView, i as ClientStatus, l as PermissionState, m as SubjectView, n as ApprovalState, o as GateMode, p as RolesOptions, r as ClientPermDock, s as GateView, t as ApprovalHandle, v as EventSourceRefreshOptions, y as RefreshTrigger } from "../types-tQB2CEnY.js";
 import { ComputedRef, DefineComponent, MaybeRefOrGetter, Plugin, VNode } from "vue";
 //#region src/vue/types.d.ts
 type PermDockPluginOptions = ProviderOptionsBase & {
@@ -130,4 +130,4 @@ type ProtectedProps = {
 };
 export declare const Protected: DefineComponent<ProtectedProps>;
 //#endregion
-export { type ActionResult, type ApprovalHandle, type ApprovalState, type ClientPermDock, type ClientStatus, type EventSourceRefreshOptions, type FilterResult, type GateMode, type GateView, type PermDockDefaults, type PermDockPluginOptions, type PermissionBoundaryState, type PermissionSet, type PermissionState, type ProtectedAction, type ProtectedActionRefs, type ProtectedActionView, type ProtectedProps, type RefreshTrigger, type RolesOptions, type SubjectView, type TenantView, approvalHeaders, describe, eventSourceRefresh, requiredPlans };
+export { type ActionResult, type ApprovalHandle, type ApprovalState, type AuthzChangeRefresh, type ClientPermDock, type ClientStatus, type EventSourceRefreshOptions, type FilterResult, type GateMode, type GateView, type PermDockDefaults, type PermDockPluginOptions, type PermissionBoundaryState, type PermissionSet, type PermissionState, type ProtectedAction, type ProtectedActionRefs, type ProtectedActionView, type ProtectedProps, type RefreshTrigger, type RolesOptions, type SubjectView, type TenantView, approvalHeaders, authzChangeRefresh, broadcastChannelRefresh, describe, eventSourceRefresh, focusRefresh, requiredPlans, visibilityRefresh };

package/dist/vue/index.js

@@ -1,10 +1,10 @@
 import { r as requiredPlans } from "../problem-details-CLDgX1KV.js";
-import { n as describe } from "../describe-Bb4hGK5d.js";
+import { n as describe } from "../describe-CogP1loh.js";
 import { n as boundaryFallback, t as boundaryDigest } from "../boundary-BV3O1eud.js";
-import { n as actionRunner, r as approvalHeaders, t as actionApproval } from "../protected-action-DUYqb-Ma.js";
-import { a as livePermDock, c as rolesView, d as subjectView, f as tenantView, i as gateView, l as scopedTenant, n as describeWith, o as permissionSet, r as filterResult, s as protectedView, t as approvalHandle, u as slotContent } from "../views-CD8wuL4Z.js";
-import { a as isPromiseLike, r as eventSourceRefresh } from "../store-options-Dil3lraY.js";
-import { n as switchTenant, t as providerStore } from "../provider-store-CaTv00tr.js";
+import { n as actionRunner, r as approvalHeaders, t as actionApproval } from "../protected-action-B6n6w7Rl.js";
+import { a as livePermDock, c as rolesView, d as subjectView, f as tenantView, i as gateView, l as scopedTenant, n as describeWith, o as permissionSet, r as filterResult, s as protectedView, t as approvalHandle, u as slotContent } from "../views-TrZYlDnM.js";
+import { a as eventSourceRefresh, i as broadcastChannelRefresh, l as isPromiseLike, o as focusRefresh, r as authzChangeRefresh, s as visibilityRefresh } from "../store-options--zWn48PK.js";
+import { n as switchTenant, t as providerStore } from "../provider-store-BQP_pp8s.js";
 import { computed, defineComponent, effectScope, getCurrentScope, inject, isRef, onErrorCaptured, onScopeDispose, provide, shallowRef, toValue, watch } from "vue";
 //#region src/vue/context.ts
 const permDockKey = Symbol("permdock");
@@ -246,4 +246,4 @@ const Protected = defineComponent({
 	}
 });
 //#endregion
-export { PermissionBoundary, Protected, approvalHeaders, describe, eventSourceRefresh, permdockPlugin, requiredPlans, useApproval, useAssignablePermissions, useAssignableRoles, useDescribe, useFilter, useGate, useMemberships, usePermDock, usePermission, usePermissionBoundary, usePermissions, useProtectedAction, useRoles, useSubject, useTenant };
+export { PermissionBoundary, Protected, approvalHeaders, authzChangeRefresh, broadcastChannelRefresh, describe, eventSourceRefresh, focusRefresh, permdockPlugin, requiredPlans, useApproval, useAssignablePermissions, useAssignableRoles, useDescribe, useFilter, useGate, useMemberships, usePermDock, usePermission, usePermissionBoundary, usePermissions, useProtectedAction, useRoles, useSubject, useTenant, visibilityRefresh };

package/dist/{waiter-CqUKX6CY.d.ts → waiter-C2cXXLFZ.d.ts}

@@ -1,5 +1,5 @@
-import { Wt as Instant } from "./policy-types-DGIO_gxq.js";
-import { m as ApprovalStore } from "./types-DLvhVm1r.js";
+import { Kt as Instant } from "./policy-types-IRJVABmm.js";
+import { m as ApprovalStore } from "./types-BvBbkAu1.js";
 //#region src/workflow/waiter.d.ts
 type ApprovalWaitOptions = {
   /**

package/dist/{watch-DAkjm75Y.js → watch-DXRDBSCu.js}

@@ -1,8 +1,8 @@
 import { i as dateAt } from "./time-nR1JesoH.js";
-import { a as describeError } from "./errors-Vpu6rKHl.js";
+import { a as describeError } from "./errors-BhRkoNS7.js";
 import { t as defaultSrcPath } from "./files-BSjrtIHw.js";
-import { r as runCollect } from "./collect-WCl8cJQV.js";
-import { n as isConfigFile, r as loadConfig } from "./config-CcLlvEYW.js";
+import { r as runCollect } from "./collect-HfJXl8Tr.js";
+import { n as isConfigFile, r as loadConfig } from "./config-COHmivz9.js";
 import { watch } from "node:fs";
 import { basename, dirname, relative, resolve, sep } from "node:path";
 //#region src/cli/watch.ts

package/dist/watch-DnymTAfe.js

@@ -0,0 +1 @@
+export { i as watchCollect } from "./watch-DXRDBSCu.js";

package/dist/webmcp/index.d.ts

@@ -1,4 +1,4 @@
-import { Un as Decision, Zt as Snapshot } from "../policy-types-DGIO_gxq.js";
+import { $t as Snapshot, qn as Decision } from "../policy-types-IRJVABmm.js";
 import { f as PermissionTree, u as Permission } from "../permission-types-CAY-GU7e.js";
 import { StandardSchemaV1 } from "@standard-schema/spec";
 //#region src/webmcp/types.d.ts

package/dist/webmcp/index.js

@@ -3,7 +3,7 @@ import { n as PermDockValidationError } from "../validation-error-CYg2kJEw.js";
 import { c as listPermissions, f as resourceOfNode, i as getRegistry, m as annotationsFor, s as isRegistryTree } from "../permission-registry-B8tYxPIt.js";
 import { n as isThenable, t as ignoreRejection } from "../thenable-BNSM1U2R.js";
 import { n as resourceRef } from "../resource-ref-CaS9yVPi.js";
-import { n as deniedToolRefusal, r as toolErrorResult, t as approvalToolRefusal } from "../tool-refusal-Qpjs_W6M.js";
+import { n as deniedToolRefusal, r as toolErrorResult, t as approvalToolRefusal } from "../tool-refusal-C1UlhU0V.js";
 //#region src/webmcp/register.ts
 const MISSING_CONTEXT = "permdock/webmcp: document.modelContext is absent; registerTools is a no-op.";
 const CURRENT = Symbol.for("permdock.current");

package/dist/{where-scope-DlCdCM_8.js → where-scope-BKrqUDVk.js}

@@ -2,12 +2,12 @@ import { a as sole, r as isRecord, t as compact } from "./compact-CAf557ZB.js";
 import { n as freezeDeep } from "./freeze-jjan0lCv.js";
 import { t as loadPrincipal } from "./principal-source-C6N60GtM.js";
 import { g as secondsOf, m as rfc3339 } from "./time-nR1JesoH.js";
-import { d as scopeIdOf, f as scopeList, h as tenantOf, r as findScope, s as resolveScope, t as activeFor, u as scopeChain } from "./scopes-0Up_UA2t.js";
-import { a as readOnlyActorRefuses, n as coveredByDelegation } from "./delegation-CDB6_keF.js";
+import { d as scopeList, l as scopeChain, p as tenantOf, r as findScope, s as resolveScope, t as activeFor, u as scopeIdOf } from "./scopes-BSdYaGHs.js";
+import { a as readOnlyActorRefuses, n as coveredByDelegation } from "./delegation-aK4T_5WU.js";
 import { r as readWireValidity, t as isActive } from "./validity-Buc7w8E9.js";
-import { o as resourceRoleCondition } from "./grantee-conditions-BrYPe-w0.js";
-import { c as nowSeconds, n as inTeam, o as membershipField, r as isMembershipExpired } from "./tenancy-5d1zVBvK.js";
-import { a as bindConditionRefs, n as parseSnapshot } from "./snapshot-CXlzi69u.js";
+import { o as resourceRoleCondition } from "./grantee-conditions-DX4K_gGI.js";
+import { c as nowSeconds, n as inTeam, o as membershipField, r as isMembershipExpired } from "./tenancy-DvOHHk3-.js";
+import { a as bindConditionRefs, n as parseSnapshot } from "./snapshot-DN_8J27z.js";
 //#region src/core/snapshot-sign.ts
 /**
 * The claims `signSnapshot` signs for `snapshot`. `issuedAt` and `expiresAt`

package/dist/{who-can-BoDJm0Nc.js → who-can-BY5d3HPw.js}

@@ -5,12 +5,12 @@ import { n as internalsOf } from "./internals-B3IgHrvo.js";
 import { a as getResource } from "./permission-registry-B8tYxPIt.js";
 import { a as expandRelation, c as isEdgeRelation, l as isFieldRelation, u as isPrincipalRelation } from "./resource-relations-8-pCScBO.js";
 import { s as instantAt } from "./time-nR1JesoH.js";
-import { f as scopeList, l as rootScope, o as normalizeMemberships, s as resolveScope } from "./scopes-0Up_UA2t.js";
+import { c as rootScope, d as scopeList, o as normalizeMemberships, s as resolveScope } from "./scopes-BSdYaGHs.js";
 import { o as flattenGrantee } from "./grantee-Dke-9rd1.js";
 import { t as byCodePoint } from "./compare-DTfyUunF.js";
-import { r as relationCondition } from "./grantee-conditions-BrYPe-w0.js";
-import { c as nowSeconds, p as scopeField } from "./tenancy-5d1zVBvK.js";
-import { D as emptyListeners, t as evaluate } from "./evaluate-BAmf_AQd.js";
+import { r as relationCondition } from "./grantee-conditions-DX4K_gGI.js";
+import { c as nowSeconds, p as scopeField } from "./tenancy-DvOHHk3-.js";
+import { D as emptyListeners, t as evaluate } from "./evaluate-CsjXeLRo.js";
 import { n as relationId, t as pendingRelations } from "./relations-BxvRvDHK.js";
 import { t as relationWalk } from "./relation-walk-DK_gkgL7.js";
 //#region src/core/who-can.ts

package/dist/workflow/index.d.ts

@@ -1,5 +1,5 @@
-import { a as AutomationSource, i as AutomationRequest, l as memoryAutomationSource, n as AutomationDecision, r as AutomationMode, s as MemoryAutomationSource, t as Automation, u as parseAutomation } from "../automation-C6Jg75xq.js";
-import { i as pollingApprovalWaiter, n as ApprovalWaiter, r as PollingApprovalWaiterOptions, t as ApprovalWaitOptions } from "../waiter-CqUKX6CY.js";
-import { a as WorkflowPermDockOptions, i as WorkflowPermDock, n as AwaitApprovalOptions, o as createPermDock, r as StartAutomationResult, t as AutomationOptions } from "../create-CDd9c22W.js";
+import { a as AutomationSource, i as AutomationRequest, l as memoryAutomationSource, n as AutomationDecision, r as AutomationMode, s as MemoryAutomationSource, t as Automation, u as parseAutomation } from "../automation-DCWuVKtd.js";
+import { i as pollingApprovalWaiter, n as ApprovalWaiter, r as PollingApprovalWaiterOptions, t as ApprovalWaitOptions } from "../waiter-C2cXXLFZ.js";
+import { a as WorkflowPermDockOptions, i as WorkflowPermDock, n as AwaitApprovalOptions, o as createPermDock, r as StartAutomationResult, t as AutomationOptions } from "../create-DrHUmKvG.js";
 import "../index-CaxrMD1A.js";
 export { type ApprovalWaitOptions, type ApprovalWaiter, type Automation, type AutomationDecision, type AutomationMode, type AutomationOptions, type AutomationRequest, type AutomationSource, type AwaitApprovalOptions, type MemoryAutomationSource, type PollingApprovalWaiterOptions, type StartAutomationResult, type WorkflowPermDock, type WorkflowPermDockOptions, createPermDock, memoryAutomationSource, parseAutomation, pollingApprovalWaiter };

package/dist/workflow/index.js

@@ -4,10 +4,10 @@ import { a as isId } from "../expiry-6XByK0dm.js";
 import { n as findPermission } from "../permission-registry-B8tYxPIt.js";
 import { n as isThenable } from "../thenable-BNSM1U2R.js";
 import { n as memoryAutomationSource, r as parseAutomation } from "../automation-x3KEUusw.js";
-import { l as withApp, t as getPermDock } from "../permdock-BvjivVb9.js";
+import { l as withApp, t as getPermDock } from "../permdock-DdzMv5-F.js";
 import { o as automationEvent } from "../sink-D9_vh372.js";
-import { a as requestApproval, s as resumeDecision } from "../helpers-DJicaG6f.js";
-import { i as subjectFromRunTicket, r as signRunTicket } from "../run-ticket-DfnZCh-u.js";
+import { a as requestApproval, s as resumeDecision } from "../helpers-DNnZffrI.js";
+import { i as subjectFromRunTicket, r as signRunTicket } from "../run-ticket-CjvXr6wj.js";
 import { t as pollingApprovalWaiter } from "../waiter-aBLM63_f.js";
 //#region src/workflow/create.ts
 function writeQuietly(sink, event) {
@@ -83,7 +83,8 @@ function createPermDock(policy, given) {
 				kind: "service",
 				tenant: current.tenant,
 				memberships: [{
-					tenant: current.tenant,
+					scope: "tenant",
+					id: current.tenant,
 					roles: current.roles ?? []
 				}]
 			});