permdock 0.16.0 → 0.17.0

package/dist/{better-supabase-Dirf_8Ec.js → better-supabase-BJtQ-kNf.js}

@@ -1,5 +1,5 @@
 import { r as isRecord } from "./compact-CAf557ZB.js";
-import "./budget-BELja5A9.js";
+import "./budget-BBCPDOGP.js";
 import { existsSync, readFileSync, readdirSync, statSync } from "node:fs";
 import { resolve } from "node:path";
 //#region src/cli/shared/doctor-files.ts
@@ -30,7 +30,7 @@ async function betterSupabaseConfig(input) {
 	const path = CONFIG_FILES.map((name) => resolve(input.cwd, name)).find((file) => files.exists(file));
 	if (path === void 0) return;
 	try {
-		const { loadModule } = await import("./load-Dm0pSYH3.js");
+		const { loadModule } = await import("./load-CjnlPxpL.js");
 		const loaded = (await loadModule(path))["default"];
 		return isRecord(loaded) ? loaded : void 0;
 	} catch {
@@ -46,27 +46,43 @@ function stringAt(value, ...path) {
 	return typeof at === "string" && at !== "" ? at : void 0;
 }
 /**
-* The claim better-supabase writes the active tenant to:
-* `auth.organization.claim` in a grouped config, `claims.tenant` in a flat one,
-* then `rls.tenantClaim` and `tenant_id`.
+* The claim better-supabase writes the active tenant to: `auth.tenant.claim` in
+* a grouped config, `claims.tenant` in a flat one, then `rls.tenantClaim` and
+* `tenant_id`.
 */
 function betterSupabaseTenantClaim(config, betterSupabase) {
-	return stringAt(betterSupabase, "auth", "organization", "claim") ?? stringAt(betterSupabase, "claims", "tenant") ?? config.rls?.tenantClaim ?? "tenant_id";
+	return stringAt(betterSupabase, "auth", "tenant", "claim") ?? stringAt(betterSupabase, "claims", "tenant") ?? config.rls?.tenantClaim ?? "tenant_id";
 }
-/** Resolve the hook default once for generation, inspection and doctor. */
+/**
+* Whether better-supabase's sessions block writes its own version table and the
+* `authz:<uid>` receive policy (`blocks.sessions.authzVersions`).
+*/
+function betterSupabaseAuthzVersions(betterSupabase) {
+	const blocks = betterSupabase["blocks"];
+	const sessions = isRecord(blocks) ? blocks["sessions"] : void 0;
+	if (!isRecord(sessions)) return false;
+	const options = sessions["options"];
+	return sessions["authzVersions"] === true || isRecord(options) && options["authzVersions"] === true;
+}
+/** Resolve the hook defaults once for generation, inspection and doctor. */
 function betterSupabaseDefaults(config, betterSupabase) {
 	const hook = config.supabase?.hook;
-	if (betterSupabase === void 0 || hook === void 0 || hook.activeFrom !== void 0) return config;
+	if (betterSupabase === void 0 || hook === void 0) return config;
+	const broadcast = hook.broadcast === false ? false : {
+		topic: hook.broadcast?.topic ?? "better_supabase:authz",
+		receivePolicy: hook.broadcast?.receivePolicy ?? !betterSupabaseAuthzVersions(betterSupabase)
+	};
 	return {
 		...config,
 		supabase: {
 			...config.supabase,
 			hook: {
 				...hook,
-				activeFrom: `app_metadata.${betterSupabaseTenantClaim(config, betterSupabase)}`
+				activeFrom: hook.activeFrom ?? `app_metadata.${betterSupabaseTenantClaim(config, betterSupabase)}`,
+				broadcast
 			}
 		}
 	};
 }
 //#endregion
-export { nodeFiles as a, filesOf as i, betterSupabaseDefaults as n, readJson as o, betterSupabaseTenantClaim as r, betterSupabaseConfig as t };
+export { filesOf as a, betterSupabaseTenantClaim as i, betterSupabaseConfig as n, nodeFiles as o, betterSupabaseDefaults as r, readJson as s, betterSupabaseAuthzVersions as t };

package/dist/{bind-BNQA9JK9.js → bind-BJFeLX1V.js}

@@ -1,10 +1,10 @@
 import { t as compact } from "./compact-CAf557ZB.js";
-import { l as withApp } from "./permdock-BvjivVb9.js";
-import { t as composeWraps } from "./wrap-B2wziJI_.js";
-import { r as instanceOptions } from "./build-instance-BWXqwQYU.js";
-import { f as invalidSignatureResponse } from "./evaluations-IBceAeKT.js";
-import { n as tenantScope } from "./adapter-context-CIQpQxbE.js";
-import { t as createPermDock } from "./create-BLPKnJKa.js";
+import { l as withApp } from "./permdock-DdzMv5-F.js";
+import { t as composeWraps } from "./wrap-C5PWzgkq.js";
+import { r as instanceOptions } from "./build-instance-lye7oEqf.js";
+import { f as invalidSignatureResponse } from "./evaluations-DG40eSJa.js";
+import { n as tenantScope } from "./adapter-context-OHikyRqV.js";
+import { t as createPermDock } from "./create-jCPwPWXf.js";
 //#region src/server/bind.ts
 /**
 * The server kernel with the subject and actor callbacks reading the context

package/dist/{bind-YYjvfpB9.d.ts → bind-DjFNX0Pq.d.ts}

@@ -1,11 +1,11 @@
-import { X as Intent, hr as Subject } from "./policy-types-DGIO_gxq.js";
-import { m as ApprovalStore } from "./types-DLvhVm1r.js";
-import { t as InstanceOptions } from "./instance-options-CoHn-0e8.js";
+import { Z as Intent, yr as Subject } from "./policy-types-IRJVABmm.js";
+import { m as ApprovalStore } from "./types-BvBbkAu1.js";
+import { t as InstanceOptions } from "./instance-options-BOCRxEFb.js";
 import { t as RequestContext } from "./request-context-C2_1lchh.js";
-import { n as PermDockWrap } from "./wrap-DxXB54Wu.js";
-import { o as OtelWrap } from "./types-B6ExllNo.js";
-import { r as PdpFactory } from "./types-DlelvQk4.js";
-import { S as TenantOption, _ as WebBotAuthVerifier, t as DeniedResponse } from "./server-types-CyRN0-Cd.js";
+import { n as PermDockWrap } from "./wrap-DpZAbxuD.js";
+import { o as OtelWrap } from "./types-Sj1U8HMm.js";
+import { r as PdpFactory } from "./types-B3BOcI0J.js";
+import { S as TenantOption, _ as WebBotAuthVerifier, t as DeniedResponse } from "./server-types-Bw-lWqzR.js";
 //#region src/server/bind.d.ts
 /**
  * The options of every framework adapter; `TContext` is what its callbacks

package/dist/{budget-BELja5A9.js → budget-BBCPDOGP.js}

@@ -1,7 +1,7 @@
 //#region src/supabase/budget.ts
 /**
 * The default size budget, in bytes of JSON, for the hook's `memberships`
-* claim: about 15 UUID-keyed single-role memberships.
+* claim: about 12 UUID-keyed single-role memberships.
 */
 const supabaseMembershipsBudget = 1024;
 /**

package/dist/{budget-hYsPz_yE.d.ts → budget-CNLsV2SL.d.ts}

@@ -1,7 +1,7 @@
 //#region src/supabase/budget.d.ts
 /**
  * The default size budget, in bytes of JSON, for the hook's `memberships`
- * claim: about 15 UUID-keyed single-role memberships.
+ * claim: about 12 UUID-keyed single-role memberships.
  */
 declare const supabaseMembershipsBudget = 1024;
 /**

package/dist/{build-instance-BWXqwQYU.js → build-instance-lye7oEqf.js}

@@ -1,5 +1,5 @@
 import { t as compact } from "./compact-CAf557ZB.js";
-import { t as getPermDock } from "./permdock-BvjivVb9.js";
+import { t as getPermDock } from "./permdock-DdzMv5-F.js";
 //#region src/core/instance-options.ts
 const INSTANCE_KEYS = {
 	memberships: true,
@@ -10,7 +10,8 @@ const INSTANCE_KEYS = {
 	approvalPolicies: true,
 	sink: true,
 	limits: true,
-	principals: true
+	principals: true,
+	instances: true
 };
 /** The `InstanceOptions` set on `options`, without the adapter's own keys. */
 function instanceOptions(options) {

package/dist/{capability-Di9tiUvi.d.ts → capability-BzjWdKmP.d.ts}

@@ -1,4 +1,4 @@
-import { Wt as Instant, mt as TokenSigner, pr as Principal } from "./policy-types-DGIO_gxq.js";
+import { Kt as Instant, _r as Principal, gt as TokenSigner } from "./policy-types-IRJVABmm.js";
 import { f as PermissionTree, u as Permission } from "./permission-types-CAY-GU7e.js";
 //#region src/core/capability.d.ts
 /**

package/dist/{capability-BqX94r07.js → capability-zN6T9fxe.js}

@@ -4,7 +4,7 @@ import { a as ownRecord } from "./paths-CUvURzHp.js";
 import { a as isId, o as sameId, r as idList, t as expiredAt } from "./expiry-6XByK0dm.js";
 import { c as listPermissions } from "./permission-registry-B8tYxPIt.js";
 import { o as epochSeconds, p as nowSeconds } from "./time-nR1JesoH.js";
-import { t as anonymousSubject } from "./subject-BGoM5o8B.js";
+import { t as anonymousSubject } from "./subject-C7RddW0G.js";
 //#region src/core/capability.ts
 function redeemerKind(redeemer) {
 	if (redeemer === void 0 || typeof redeemer === "string") return redeemer ?? "anyone";
@@ -159,8 +159,7 @@ function signCapability(input, signer, options = {}) {
 }
 function holdsScope(membership, scope, id, now) {
 	if (expiredAt(membership, now)) return false;
-	if (membership.scope === scope && sameId(membership.id, id)) return true;
-	return scope === "tenant" && sameId(membership.tenant, id) || scope === "team" && sameId(membership.team, id);
+	return membership.scope === scope && sameId(membership.id, id);
 }
 /**
 * Whether `viewer`, the request's own verified subject, may redeem a

package/dist/{casbin-C9EvElBb.js → casbin-C3O_O9nu.js}

@@ -1,5 +1,5 @@
-import { a as nonEmptyOr } from "./output-DlICTjBh.js";
-import { t as applyFiles } from "./files-B3AA05f1.js";
+import { a as nonEmptyOr } from "./output-DhTpe8v1.js";
+import { t as applyFiles } from "./files-CfiRtQ-m.js";
 import { n as isIdentifier, t as emitPolicyModule } from "./policy-module-xym9fnSq.js";
 import { existsSync, readFileSync } from "node:fs";
 import { resolve } from "node:path";

package/dist/{casbin-D_rVQ31U.js → casbin-DFzk_so3.js}

@@ -1,5 +1,5 @@
 import { t as defineLeaf } from "./command-L8EstFNm.js";
-import { c as given, l as outFlag, o as fileOut } from "./flags-DXjoTVbS.js";
+import { c as given, l as outFlag, o as fileOut } from "./flags-BlmpmXoY.js";
 //#region src/cli/commands/casbin.ts
 const casbinImport = defineLeaf({
 	flags: {
@@ -16,7 +16,7 @@ const casbinImport = defineLeaf({
 		...outFlag
 	},
 	async run(ctx, { flags }) {
-		const { runCasbinImport } = await import("./casbin-C9EvElBb.js");
+		const { runCasbinImport } = await import("./casbin-C3O_O9nu.js");
 		return runCasbinImport({
 			cwd: ctx.cwd,
 			model: given(flags.model),

package/dist/{casl-C4OINZHI.js → casl-CjBVJj8R.js}

@@ -1,5 +1,5 @@
 import { t as defineLeaf } from "./command-L8EstFNm.js";
-import { c as given, l as outFlag, o as fileOut } from "./flags-DXjoTVbS.js";
+import { c as given, l as outFlag, o as fileOut } from "./flags-BlmpmXoY.js";
 //#region src/cli/commands/casl.ts
 const caslImport = defineLeaf({
 	flags: {
@@ -11,7 +11,7 @@ const caslImport = defineLeaf({
 		...outFlag
 	},
 	async run(ctx, { flags }) {
-		const { runCaslImport } = await import("./casl-CHHoCldP.js");
+		const { runCaslImport } = await import("./casl-CkBssiB1.js");
 		return runCaslImport({
 			cwd: ctx.cwd,
 			rules: given(flags.rules),

package/dist/{casl-CHHoCldP.js → casl-CkBssiB1.js}

@@ -1,5 +1,5 @@
 import { r as isRecord } from "./compact-CAf557ZB.js";
-import { t as applyFiles } from "./files-B3AA05f1.js";
+import { t as applyFiles } from "./files-CfiRtQ-m.js";
 import { n as isIdentifier, t as emitPolicyModule } from "./policy-module-xym9fnSq.js";
 import { existsSync, readFileSync } from "node:fs";
 import { resolve } from "node:path";

package/dist/catalog/index.d.ts

@@ -1,8 +1,8 @@
-import { T as Policy, a as ApprovalRequirement, pr as Principal } from "../policy-types-DGIO_gxq.js";
-import { c as checkHostedGrant, n as HostedGrantCheck, o as PolicyDocument } from "../hosted-DVxlLZMe.js";
-import { a as CatalogDocument, c as CatalogOperation, d as CatalogRole, f as CatalogScope, h as CatalogValidity, i as CatalogDelegation, l as CatalogPermission, m as CatalogUsage, n as CatalogApproval, o as CatalogGrant, p as CatalogSupportAccess, r as CatalogBreakGlass, s as CatalogOAuthScope, t as CatalogActivation, u as CatalogResource } from "../types-ZzRGoViD.js";
-import { a as CatalogFinding, i as CatalogEventData } from "../sink-B5zoUW_O.js";
-import { a as pushedPolicy, i as parsePushedPolicy, n as PushedGrant, r as PushedPolicy, t as PUSHED_POLICY_SCHEMA } from "../pushed-policy-CryQheKq.js";
+import { E as Policy, _r as Principal, o as ApprovalRequirement } from "../policy-types-IRJVABmm.js";
+import { c as checkHostedGrant, n as HostedGrantCheck, o as PolicyDocument } from "../hosted-DxRLLiFU.js";
+import { a as CatalogDocument, c as CatalogOperation, d as CatalogRole, f as CatalogScope, h as CatalogValidity, i as CatalogDelegation, l as CatalogPermission, m as CatalogUsage, n as CatalogApproval, o as CatalogGrant, p as CatalogSupportAccess, r as CatalogBreakGlass, s as CatalogOAuthScope, t as CatalogActivation, u as CatalogResource } from "../types-NYoj8JBm.js";
+import { a as CatalogFinding, i as CatalogEventData } from "../sink-DUzt0e4B.js";
+import { a as pushedPolicy, i as parsePushedPolicy, n as PushedGrant, r as PushedPolicy, t as PUSHED_POLICY_SCHEMA } from "../pushed-policy-CUQuvlS3.js";
 import { StandardSchemaV1 } from "@standard-schema/spec";
 //#region src/catalog/drift.d.ts
 /**

package/dist/catalog/index.js

@@ -3,12 +3,12 @@ import { n as freezeDeep } from "../freeze-jjan0lCv.js";
 import { a as getResource, n as findPermission } from "../permission-registry-B8tYxPIt.js";
 import { d as isSelfParented } from "../resource-relations-8-pCScBO.js";
 import { _ as listPlans, m as findRole } from "../grantee-Dke-9rd1.js";
-import { n as declaredRoleNames } from "../policy-CLQ8__GF.js";
-import { i as hostedGrantDrops, n as codeApprovals, r as declaredGrantee, t as checkHostedGrant } from "../hosted-D0IzESu_.js";
-import { n as rowConditionKeys, t as parseCatalog } from "../parse-1_ZheTW5.js";
+import { n as declaredRoleNames } from "../policy-DxQyHKPB.js";
+import { i as hostedGrantDrops, n as codeApprovals, r as declaredGrantee, t as checkHostedGrant } from "../hosted-tPZnyjQS.js";
+import { n as rowConditionKeys, t as parseCatalog } from "../parse-UTC-sDrt.js";
 import { t as operationFindings } from "../operation-findings-CXtFzlKJ.js";
-import { n as resourceSchemaFromJson, t as policyFromCatalog } from "../policy-from-catalog-CU3An8uP.js";
-import { n as parsePushedPolicy, r as pushedPolicy, t as PUSHED_POLICY_SCHEMA } from "../pushed-policy-CDuOL2de.js";
+import { n as resourceSchemaFromJson, t as policyFromCatalog } from "../policy-from-catalog-DVa1faOr.js";
+import { n as parsePushedPolicy, r as pushedPolicy, t as PUSHED_POLICY_SCHEMA } from "../pushed-policy-DMXAOmEW.js";
 //#region src/catalog/drift.ts
 /**
 * The finding a drop reason becomes; `null` for a reason the catalog did not
@@ -126,8 +126,8 @@ function optionFor(policy, key) {
 			modes: ["human", "any"],
 			fields: [
 				"by",
-				"distinct",
 				"escalation",
+				"mode",
 				"quorum",
 				...node?.version === void 0 ? [] : ["staleOn"],
 				"ttl"

package/dist/catalog-BpnjesqX.js

@@ -0,0 +1 @@
+export { t as catalogFile, n as runCatalog } from "./catalog-DGDd_ww1.js";

package/dist/{catalog-CGlSwU6j.js → catalog-DGDd_ww1.js}

@@ -1,10 +1,10 @@
 import { r as isRecord } from "./compact-CAf557ZB.js";
 import { r as listSourceFiles, t as defaultSrcPath } from "./files-BSjrtIHw.js";
-import { a as catalogSchemaDocument, n as catalogForCompare, o as formatCatalogJson, r as catalogForDrift, s as formatCatalogMarkdown, t as buildCatalog } from "./catalog-doc-DjMKzJp9.js";
-import { a as loadModule, i as loadConfiguredPolicy, r as leavesOf, s as pickNamed, t as asPermissionTree } from "./load-DjSU5KXO.js";
-import { t as loadConfiguredOperations } from "./catalog-operations-DeHTrJSV.js";
-import { i as scanSources, r as runCollect } from "./collect-WCl8cJQV.js";
-import { n as fileSummary, t as applyFiles } from "./files-B3AA05f1.js";
+import { a as catalogSchemaDocument, n as catalogForCompare, o as formatCatalogJson, r as catalogForDrift, s as formatCatalogMarkdown, t as buildCatalog } from "./catalog-doc-C4DGfJCO.js";
+import { a as loadModule, i as loadConfiguredPolicy, r as leavesOf, s as pickNamed, t as asPermissionTree } from "./load-BaEamml-.js";
+import { t as loadConfiguredOperations } from "./catalog-operations-DVI5QO5R.js";
+import { i as scanSources, r as runCollect } from "./collect-HfJXl8Tr.js";
+import { n as fileSummary, t as applyFiles } from "./files-CfiRtQ-m.js";
 import { existsSync, readFileSync } from "node:fs";
 import { resolve } from "node:path";
 //#region src/cli/catalog.ts

package/dist/{catalog-amPDr0JQ.js → catalog-DJJIkR9P.js}

@@ -1,6 +1,6 @@
-import { c as missingInput } from "./errors-Vpu6rKHl.js";
+import { c as missingInput } from "./errors-BhRkoNS7.js";
 import { t as defineLeaf } from "./command-L8EstFNm.js";
-import { c as given, l as outFlag, t as checkFlag, u as permissionsFlag } from "./flags-DXjoTVbS.js";
+import { c as given, l as outFlag, t as checkFlag, u as permissionsFlag } from "./flags-BlmpmXoY.js";
 //#region src/cli/commands/catalog.ts
 const RUN_FORMAT = {
 	catalog: "json",
@@ -30,7 +30,7 @@ const catalog = defineLeaf({
 		...checkFlag
 	},
 	async run(ctx, { flags }) {
-		const { catalogFile, runCatalog } = await import("./catalog-D3oS2GH3.js");
+		const { catalogFile, runCatalog } = await import("./catalog-BpnjesqX.js");
 		const result = await runCatalog({
 			cwd: ctx.cwd,
 			config: ctx.config,

package/dist/{catalog-doc-DjMKzJp9.js → catalog-doc-C4DGfJCO.js}

@@ -5,7 +5,7 @@ import { m as findRole, v as listRoles } from "./grantee-Dke-9rd1.js";
 import { i as wireValidity } from "./validity-Buc7w8E9.js";
 import { t as byCodePoint } from "./compare-DTfyUunF.js";
 import { t as catalogFingerprint } from "./catalog-fingerprint-e6aCWosn.js";
-import { t as catalogSchema } from "./schema-BOJjqlWL.js";
+import { t as catalogSchema } from "./schema-CuX70xgH.js";
 import { t as policyRowConditionKeys } from "./row-conditions-BAGHOmVq.js";
 import { c as generatorBanner, n as CATALOG_SCHEMA } from "./version-DMQ0dnN5.js";
 //#region src/cli/catalog-doc.ts
@@ -88,9 +88,9 @@ function catalogApproval(approval) {
 	if (approval === void 0) return;
 	return approval === "human" ? "human" : withDefined({
 		by: approval.by,
-		mode: approval.mode,
+		combine: approval.combine,
 		stages: approval.stages,
-		distinct: approval.distinct,
+		mode: approval.mode,
 		staleOn: approval.staleOn,
 		quorum: approval.quorum,
 		ttl: approval.ttl,

package/dist/{catalog-operations-DeHTrJSV.js → catalog-operations-DVI5QO5R.js}

@@ -1,10 +1,10 @@
 import { r as isRecord } from "./compact-CAf557ZB.js";
-import { A as isOperationEffect } from "./src-C_pi2Rnh.js";
+import { j as isOperationEffect } from "./src-nYNBfmgq.js";
 import { o as isPermission } from "./permission-registry-B8tYxPIt.js";
 import { r as isOperationRisk } from "./permissions-CVXmRILq.js";
-import { i as configError } from "./errors-Vpu6rKHl.js";
+import { i as configError } from "./errors-BhRkoNS7.js";
 import { a as rel } from "./files-BSjrtIHw.js";
-import { a as loadModule, s as pickNamed } from "./load-DjSU5KXO.js";
+import { a as loadModule, s as pickNamed } from "./load-BaEamml-.js";
 import { existsSync } from "node:fs";
 import { resolve } from "node:path";
 //#region src/cli/catalog-operations.ts

package/dist/{challenge-DImNcR7B.js → challenge-M_ghKJnT.js}

@@ -1,11 +1,11 @@
 import { r as isRecord, t as compact } from "./compact-CAf557ZB.js";
 import { n as freezeDeep } from "./freeze-jjan0lCv.js";
 import { i as dateAt, p as nowSeconds } from "./time-nR1JesoH.js";
-import { u as policyDocumentFromClaims } from "./hosted-D0IzESu_.js";
+import { u as policyDocumentFromClaims } from "./hosted-tPZnyjQS.js";
 import { l as isApprovalErrorCode, s as ApprovalError, t as APPROVAL_HEADER } from "./types-CcUXciSj.js";
 import { h as toCloudEvent, l as isAbsoluteUri } from "./sink-D9_vh372.js";
 import { n as parseCatalogEventData, t as catalogFingerprint } from "./catalog-fingerprint-e6aCWosn.js";
-import { t as parseApprovalRequest } from "./parse-request-CwCZpyjV.js";
+import { t as parseApprovalRequest } from "./parse-request-DOBVaeiQ.js";
 import { t as timeoutSignal } from "./timeout-D51niuQP.js";
 import { t as CLOUD_BASE_URL } from "./base-url-BQbddZO5.js";
 //#region src/cloud/approver.ts

package/dist/chat/index.d.ts

@@ -1,2 +1,2 @@
-import { a as ChatCommandResult, c as createPermDock, d as SubjectFromChatOptions, f as isChatAuthor, i as ChatCommandContext, l as ChatAuthor, n as ChatActionResult, o as ChatPermDock, p as subjectFromChat, r as ChatCommand, s as ChatPermDockOptions, t as ChatAction, u as ChatPrincipal } from "../create-DBvUsgzK.js";
+import { a as ChatCommandResult, c as createPermDock, d as SubjectFromChatOptions, f as isChatAuthor, i as ChatCommandContext, l as ChatAuthor, n as ChatActionResult, o as ChatPermDock, p as subjectFromChat, r as ChatCommand, s as ChatPermDockOptions, t as ChatAction, u as ChatPrincipal } from "../create-DNN3OtsO.js";
 export { type ChatAction, type ChatActionResult, type ChatAuthor, type ChatCommand, type ChatCommandContext, type ChatCommandResult, type ChatPermDock, type ChatPermDockOptions, type ChatPrincipal, type SubjectFromChatOptions, createPermDock, isChatAuthor, subjectFromChat };

package/dist/chat/index.js

@@ -2,9 +2,9 @@ import { t as compact } from "../compact-CAf557ZB.js";
 import { n as freezeDeep } from "../freeze-jjan0lCv.js";
 import { n as loadPrincipalByIdentity } from "../principal-source-C6N60GtM.js";
 import { f as nowMillis } from "../time-nR1JesoH.js";
-import { l as withApp, t as getPermDock } from "../permdock-BvjivVb9.js";
+import { l as withApp, t as getPermDock } from "../permdock-DdzMv5-F.js";
 import { c as isApprovalError } from "../types-CcUXciSj.js";
-import { a as requestApproval, o as resolveApproval, s as resumeDecision } from "../helpers-DJicaG6f.js";
+import { a as requestApproval, o as resolveApproval, s as resumeDecision } from "../helpers-DNnZffrI.js";
 import { t as approvalPrompt } from "../approval-prompt-B8hQY69x.js";
 //#region src/chat/subject.ts
 function nonEmpty(value) {

package/dist/chat-sdk/index.d.ts

@@ -1,6 +1,6 @@
-import { n as ApprovalUrl, t as ApprovalPrompt } from "../approval-prompt-3BqWczTt.js";
-import { l as ChatAuthor, n as ChatActionResult, o as ChatPermDock } from "../create-DBvUsgzK.js";
-import { n as ChatTransport } from "../types-CN0LsqbK.js";
+import { n as ApprovalUrl, t as ApprovalPrompt } from "../approval-prompt-BSh-yxbH.js";
+import { l as ChatAuthor, n as ChatActionResult, o as ChatPermDock } from "../create-DNN3OtsO.js";
+import { n as ChatTransport } from "../types-UfpcY575.js";
 import { ActionEvent, Author, CardElement } from "chat";
 //#region src/chat-sdk/author.d.ts
 type ChatSdkAuthorOptions = {

package/dist/{checks-CGkP3Z7A.js → checks-fyDOhcz0.js}

@@ -36,5 +36,37 @@ async function decideAllAsync(decide, checks, options) {
 		return decide(permission, data, options);
 	})));
 }
+/**
+* One frozen `PermissionState` per named check. A check that throws denies that
+* entry with `validation` and leaves the others.
+*/
+function permissionStates(decide, checks, options) {
+	const states = {};
+	for (const name of Object.keys(checks)) {
+		const key = name;
+		let state;
+		try {
+			const [permission, data] = partsOf(checks[key]);
+			const decision = decide(permission, data, options);
+			const reason = decision.outcome === "denied" ? decision.denials[0]?.reason : void 0;
+			state = Object.freeze({
+				allowed: decision.outcome === "granted",
+				outcome: decision.outcome,
+				...reason === void 0 ? {} : { reason }
+			});
+		} catch {
+			state = Object.freeze({
+				allowed: false,
+				outcome: "denied",
+				reason: "validation"
+			});
+		}
+		Object.defineProperty(states, key, {
+			value: state,
+			enumerable: true
+		});
+	}
+	return Object.freeze(states);
+}
 //#endregion
-export { decideAllWith as i, canAllWith as n, decideAllAsync as r, canAllAsync as t };
+export { permissionStates as a, decideAllWith as i, canAllWith as n, decideAllAsync as r, canAllAsync as t };

package/dist/claude-agent/index.d.ts

@@ -1,6 +1,6 @@
-import { T as Policy, j as PolicyVocabulary, pr as Principal } from "../policy-types-DGIO_gxq.js";
-import { a as PermDock } from "../permdock-CprAPN3w.js";
-import { o as AgentAdapterOptions, t as AgentPermDock } from "../create-BPUopdfL.js";
+import { E as Policy, M as PolicyVocabulary, _r as Principal } from "../policy-types-IRJVABmm.js";
+import { a as PermDock } from "../permdock-DUWZEOLR.js";
+import { o as AgentAdapterOptions, t as AgentPermDock } from "../create-bzQlBzG4.js";
 //#region src/claude-agent/create.d.ts
 /** Structural `McpServerProvenance` from `@anthropic-ai/claude-agent-sdk`. */
 type ClaudeMcpServer = {

package/dist/claude-agent/index.js

@@ -1,6 +1,6 @@
 import { r as isRecord, t as compact } from "../compact-CAf557ZB.js";
-import { l as withApp } from "../permdock-BvjivVb9.js";
-import { t as agentRuntime } from "../create-Coq5fIrq.js";
+import { l as withApp } from "../permdock-DdzMv5-F.js";
+import { t as agentRuntime } from "../create-gqtDb1nU.js";
 //#region src/claude-agent/create.ts
 const MCP_PREFIX = "mcp__";
 function asInput(input) {

package/dist/clerk/index.d.ts

@@ -1,6 +1,6 @@
-import { G as CustomRoleSource, hr as Subject, pr as Principal } from "../policy-types-DGIO_gxq.js";
+import { K as CustomRoleSource, _r as Principal, yr as Subject } from "../policy-types-IRJVABmm.js";
 import { u as Permission } from "../permission-types-CAY-GU7e.js";
-import { s as RemotePdpCache } from "../types-DlelvQk4.js";
+import { s as RemotePdpCache } from "../types-B3BOcI0J.js";
 import { t as ClaimsMap } from "../claims-map-D1Pb5oRq.js";
 import { StandardSchemaV1 } from "@standard-schema/spec";
 //#region src/clerk/types.d.ts

package/dist/clerk/index.js

@@ -1,9 +1,9 @@
 import { i as omitKeys, r as isRecord, t as compact } from "../compact-CAf557ZB.js";
 import { n as freezeDeep } from "../freeze-jjan0lCv.js";
 import { r as validateRecord } from "../thenable-BNSM1U2R.js";
-import { t as anonymousSubject } from "../subject-BGoM5o8B.js";
+import { i as rootMembershipId, t as anonymousSubject } from "../subject-C7RddW0G.js";
 import { t as readClaim } from "../claims-map-CKkoAAYF.js";
-import { c as ttlMs, s as ttlCache } from "../shared-l0oGGetg.js";
+import { c as ttlMs, s as ttlCache } from "../shared-BRmCJxDK.js";
 //#region src/clerk/subject.ts
 function asRoles(value) {
 	if (typeof value === "string") return value === "" ? [] : [value];
@@ -164,7 +164,8 @@ function membershipRow(item, userId) {
 	const roles = asRoles(item["role"]);
 	if (tenant === void 0 || roles.length === 0) return;
 	return compact({
-		tenant,
+		scope: "tenant",
+		id: tenant,
 		roles
 	});
 }
@@ -231,15 +232,17 @@ async function fromClerk(authObject, options, loadMemberships) {
 			...features.org
 		];
 		const sessionMembership = mapped.tenant !== void 0 && (membershipRoles.length > 0 || plans.org.length > 0) ? [compact({
-			tenant: mapped.tenant,
+			scope: "tenant",
+			id: mapped.tenant,
 			roles: membershipRoles,
 			entitlements: plans.org.length === 0 ? void 0 : plans.org
 		})] : [];
 		const loaded = options.memberships === "all" ? await loadMemberships(options.backend, mapped.id) ?? [] : [];
-		const seen = new Set(sessionMembership.map((item) => item.tenant));
+		const seen = new Set(sessionMembership.map(rootMembershipId));
 		const memberships = [...sessionMembership, ...loaded.filter((item) => {
-			if (seen.has(item.tenant)) return false;
-			seen.add(item.tenant);
+			const tenant = rootMembershipId(item);
+			if (seen.has(tenant)) return false;
+			seen.add(tenant);
 			return true;
 		})];
 		let claims = extraClaims(mapped.claims);

package/dist/cli/bin.js

@@ -11,7 +11,7 @@ if (argv.length === 1 && (argv[0] === "--version" || argv[0] === "-v")) {
 	const [{ isCi }, { trapSignals }, { run }, { streamHasColors }] = await Promise.all([
 		import("../env-DJZrPjRi.js"),
 		import("../signals-B1vHR3fN.js"),
-		import("../run-C5P3x1EI.js"),
+		import("../run-D9N6V5WQ.js"),
 		import("../style-DblOtSga.js")
 	]);
 	const signals = trapSignals();

package/dist/cli/index.d.ts

@@ -1,10 +1,10 @@
-import { T as Policy } from "../policy-types-DGIO_gxq.js";
+import { E as Policy } from "../policy-types-IRJVABmm.js";
 import { f as PermissionTree } from "../permission-types-CAY-GU7e.js";
 import { o as OperationMap } from "../operations-Ci_rT6Uo.js";
-import { a as CatalogDocument, d as CatalogRole, f as CatalogScope, l as CatalogPermission, m as CatalogUsage, n as CatalogApproval, p as CatalogSupportAccess, r as CatalogBreakGlass, t as CatalogActivation, u as CatalogResource } from "../types-ZzRGoViD.js";
-import { a as pushedPolicy, i as parsePushedPolicy, n as PushedGrant, r as PushedPolicy, t as PUSHED_POLICY_SCHEMA } from "../pushed-policy-CryQheKq.js";
-import { _ as RlsSuspension, a as GenKind, c as RlsActiveRow, d as RlsDialect, f as RlsFunctionMapping, g as RlsSuspendedScope, h as RlsSuspendedMembership, i as GenConfig, l as RlsApiKeys, m as RlsMemberships, n as CliIo, o as PermDockConfig, p as RlsMembershipTable, r as CollectConfig, t as CatalogConfig, u as RlsConfig, v as RlsTarget, y as RunResult } from "../types-Cklw5hJo.js";
-import { o as ResourceNameOf, r as PermissionKeyOf, s as ScopeNameOf, t as ActionNameOf } from "../type-helpers-c7Xo_2Cu.js";
+import { a as CatalogDocument, d as CatalogRole, f as CatalogScope, l as CatalogPermission, m as CatalogUsage, n as CatalogApproval, p as CatalogSupportAccess, r as CatalogBreakGlass, t as CatalogActivation, u as CatalogResource } from "../types-NYoj8JBm.js";
+import { a as pushedPolicy, i as parsePushedPolicy, n as PushedGrant, r as PushedPolicy, t as PUSHED_POLICY_SCHEMA } from "../pushed-policy-CUQuvlS3.js";
+import { _ as RlsSuspension, a as GenKind, c as RlsActiveRow, d as RlsDialect, f as RlsFunctionMapping, g as RlsSuspendedScope, h as RlsSuspendedMembership, i as GenConfig, l as RlsApiKeys, m as RlsMemberships, n as CliIo, o as PermDockConfig, p as RlsMembershipTable, r as CollectConfig, t as CatalogConfig, u as RlsConfig, v as RlsTarget, y as RunResult } from "../types-CAAN7evk.js";
+import { o as ResourceNameOf, r as PermissionKeyOf, s as ScopeNameOf, t as ActionNameOf } from "../type-helpers-C_OnZW8c.js";
 //#region src/cli/catalog-path.d.ts
 /**
  * The absolute path `permdock collect` writes the catalog to: `collect.out`,

package/dist/cli/index.js

@@ -1,8 +1,8 @@
 import { t as catalogPath } from "../catalog-path-CnI0XTFK.js";
-import { t as defineConfig } from "../config-CcLlvEYW.js";
-import { n as parsePushedPolicy, r as pushedPolicy, t as PUSHED_POLICY_SCHEMA } from "../pushed-policy-CDuOL2de.js";
+import { t as defineConfig } from "../config-COHmivz9.js";
+import { n as parsePushedPolicy, r as pushedPolicy, t as PUSHED_POLICY_SCHEMA } from "../pushed-policy-DMXAOmEW.js";
 import { c as parseGrantsMarker, l as parseHookMarker } from "../markers-BeHZ4x9Q.js";
-import { t as run } from "../run-DUq1xU4K.js";
+import { t as run } from "../run-CnCaTjWX.js";
 //#region src/cli/token-schemas.ts
 const ID = {
 	type: "string",

package/dist/cloud/index.d.ts

@@ -1,11 +1,11 @@
-import { Wt as Instant, an as CredentialEvent, cn as DeliveryEvent, fn as MembershipEvent, in as AutomationEvent, mt as TokenSigner, nn as AccessEvent, on as DecisionEvent, sn as DeliveryChannel, un as DirectoryEvent } from "../policy-types-DGIO_gxq.js";
-import { m as ApprovalStore } from "../types-DLvhVm1r.js";
-import { i as CatalogEventData, l as CloudEventType, r as CLOUD_EVENT_TYPES, s as CloudEvent } from "../sink-B5zoUW_O.js";
-import { c as DeliveryTransport } from "../types-CN0LsqbK.js";
-import { a as CloudConnectionOptions, c as CloudOptions, i as CloudClient, l as CloudSignerOptions, n as CloudCatalog, o as CloudEndpointOptions, r as CloudCatalogPush, s as CloudEndpoints, t as CloudApproverOptions } from "../types-BB-zWDcR.js";
-import { n as ApprovalWaiter } from "../waiter-CqUKX6CY.js";
-import { l as ReplayStore } from "../types-DsHGPtkR.js";
-import { f as WebhookVerifier, r as WebhookFailureCause$1, s as WebhookJwks } from "../standard-webhooks-DOYEuOLx.js";
+import { Kt as Instant, cn as DecisionEvent, fn as DirectoryEvent, gt as TokenSigner, in as AccessEvent, ln as DeliveryChannel, mn as MembershipEvent, on as AutomationEvent, sn as CredentialEvent, un as DeliveryEvent } from "../policy-types-IRJVABmm.js";
+import { m as ApprovalStore } from "../types-BvBbkAu1.js";
+import { i as CatalogEventData, l as CloudEventType, r as CLOUD_EVENT_TYPES, s as CloudEvent } from "../sink-DUzt0e4B.js";
+import { c as DeliveryTransport } from "../types-UfpcY575.js";
+import { a as CloudConnectionOptions, c as CloudOptions, i as CloudClient, l as CloudSignerOptions, n as CloudCatalog, o as CloudEndpointOptions, r as CloudCatalogPush, s as CloudEndpoints, t as CloudApproverOptions } from "../types-CA-A33Q5.js";
+import { n as ApprovalWaiter } from "../waiter-C2cXXLFZ.js";
+import { l as ReplayStore } from "../types-CJC1aaoJ.js";
+import { f as WebhookVerifier, r as WebhookFailureCause$1, s as WebhookJwks } from "../standard-webhooks-BFeEpjxy.js";
 //#region src/cloud/base-url.d.ts
 /**
  * The one base URL of PermDock Cloud. The platform issuer is this URL; its

package/dist/cloud/index.js

@@ -12,7 +12,7 @@ import { c as stringField, n as discoverAuthorizationServer, r as parseToken } f
 import { t as pollingApprovalWaiter } from "../waiter-aBLM63_f.js";
 import { i as isDeliveryTarget } from "../target-qdEAnnhU.js";
 import { t as CLOUD_BASE_URL } from "../base-url-BQbddZO5.js";
-import { a as isCompactJws, i as cloudEndpoints, n as cloud, o as resolveCloudEndpoints, r as cloudConnection, t as bearerChallenge } from "../challenge-DImNcR7B.js";
+import { a as isCompactJws, i as cloudEndpoints, n as cloud, o as resolveCloudEndpoints, r as cloudConnection, t as bearerChallenge } from "../challenge-M_ghKJnT.js";
 import { n as randomToken, t as pkce } from "../pkce-CnmmYqUZ.js";
 //#region src/cloud/oauth-error.ts
 /**

package/dist/{cloud-DdaJ7ILM.js → cloud-DYqzmh5i.js}

@@ -1,6 +1,6 @@
-import { n as secretInput } from "./credentials-CdDxp7jN.js";
+import { n as secretInput } from "./credentials-dkycUsY3.js";
 import { t as defineLeaf } from "./command-L8EstFNm.js";
-import { c as given, i as dryRunFlag } from "./flags-DXjoTVbS.js";
+import { c as given, i as dryRunFlag } from "./flags-BlmpmXoY.js";
 //#region src/cli/commands/cloud.ts
 const sharedFlags = {
 	url: {
@@ -41,7 +41,7 @@ const push = defineLeaf({
 	},
 	async run(ctx, { flags }) {
 		const env = await withStdinSecret(ctx, "key", flags["key-stdin"], "PERMDOCK_CLOUD_KEY");
-		return (await import("./push-Dq_ca4-j.js")).runCloud({
+		return (await import("./push-eJl1Tvqm.js")).runCloud({
 			cwd: ctx.cwd,
 			config: ctx.config,
 			url: given(flags.url),
@@ -70,7 +70,7 @@ const pull = defineLeaf({
 	},
 	async run(ctx, { flags }) {
 		const env = await withStdinSecret(ctx, "token", flags["token-stdin"], "PERMDOCK_CLOUD_TOKEN");
-		return (await import("./pull-CCAChKuy.js")).runCloudPull({
+		return (await import("./pull-CUVdB04v.js")).runCloudPull({
 			cwd: ctx.cwd,
 			config: ctx.config,
 			url: given(flags.url),