permdock 0.16.0 → 0.17.0

package/dist/{core-CFepFiDP.d.ts → core-0iYZ5HUx.d.ts}

@@ -1,6 +1,6 @@
-import { T as Policy, Un as Decision, fr as Membership, sr as CustomRole } from "./policy-types-DGIO_gxq.js";
+import { E as Policy, dr as CustomRole, gr as Membership, qn as Decision } from "./policy-types-IRJVABmm.js";
 import { u as Permission } from "./permission-types-CAY-GU7e.js";
-import { f as WhereResult, o as PermDockOptions } from "./permdock-CprAPN3w.js";
+import { f as WhereResult, o as PermDockOptions } from "./permdock-DUWZEOLR.js";
 //#region src/testing/policy-matrix.d.ts
 type MatrixOutcome = "granted" | "denied" | "approval-required";
 type MatrixCell = MatrixOutcome | {

package/dist/{core-lxoANyai.js → core-W5f4Rjt0.js}

@@ -1,11 +1,11 @@
-import { j as memoryCustomRoleSource } from "./src-C_pi2Rnh.js";
+import { M as memoryCustomRoleSource } from "./src-nYNBfmgq.js";
 import { c as listPermissions } from "./permission-registry-B8tYxPIt.js";
-import { f as scopeList } from "./scopes-0Up_UA2t.js";
-import { y as membershipsClaim } from "./evaluate-BAmf_AQd.js";
-import { n as parseSnapshot } from "./snapshot-CXlzi69u.js";
-import { n as fromSnapshot } from "./from-snapshot-DCakWRsr.js";
-import { t as getPermDock } from "./permdock-BvjivVb9.js";
-import "./budget-BELja5A9.js";
+import { d as scopeList } from "./scopes-BSdYaGHs.js";
+import { y as membershipsClaim } from "./evaluate-CsjXeLRo.js";
+import { n as parseSnapshot } from "./snapshot-DN_8J27z.js";
+import { n as fromSnapshot } from "./from-snapshot-DMlSSo9b.js";
+import { t as getPermDock } from "./permdock-DdzMv5-F.js";
+import "./budget-BBCPDOGP.js";
 import { c as quoteSqlTable, n as defaultSqlCommand, o as quoteSqlIdent, t as SQL_IDENT } from "./sql-0WjxIp9g.js";
 //#region src/testing/policy-matrix.ts
 function isOutcomeCell(value) {

package/dist/{create-DBvUsgzK.d.ts → create-DNN3OtsO.d.ts}

@@ -1,9 +1,9 @@
-import { Hn as ApprovalRequiredDecision, T as Policy, Yn as GrantedDecision, hr as Subject, j as PolicyVocabulary, pr as Principal, qn as DeniedDecision } from "./policy-types-DGIO_gxq.js";
+import { $n as GrantedDecision, E as Policy, Kn as ApprovalRequiredDecision, M as PolicyVocabulary, Zn as DeniedDecision, _r as Principal, yr as Subject } from "./policy-types-IRJVABmm.js";
 import { t as Operation } from "./operations-Ci_rT6Uo.js";
-import { _ as PrincipalSource, a as PermDock, o as PermDockOptions } from "./permdock-CprAPN3w.js";
-import { m as ApprovalStore, p as ApprovalStatus } from "./types-DLvhVm1r.js";
+import { _ as PrincipalSource, a as PermDock, o as PermDockOptions } from "./permdock-DUWZEOLR.js";
+import { m as ApprovalStore, p as ApprovalStatus } from "./types-BvBbkAu1.js";
 import { n as ApprovalErrorCode } from "./errors-CHwoRRpB.js";
-import { t as ApprovalPrompt } from "./approval-prompt-3BqWczTt.js";
+import { t as ApprovalPrompt } from "./approval-prompt-BSh-yxbH.js";
 //#region src/chat/subject.d.ts
 /**
  * The platform user behind a chat message or action. Fill it only from an event

package/dist/{create-CDd9c22W.d.ts → create-DrHUmKvG.d.ts}

@@ -1,10 +1,10 @@
-import { T as Policy, Un as Decision, Wn as Denial, Wt as Instant, ht as TokenVerifier, j as PolicyVocabulary, mt as TokenSigner, pr as Principal, rn as AuthEvent } from "./policy-types-DGIO_gxq.js";
+import { E as Policy, Jn as Denial, Kt as Instant, M as PolicyVocabulary, _r as Principal, _t as TokenVerifier, an as AuthEvent, gt as TokenSigner, qn as Decision } from "./policy-types-IRJVABmm.js";
 import { u as Permission } from "./permission-types-CAY-GU7e.js";
-import { _ as PrincipalSource, a as PermDock, n as DecideOptions, o as PermDockOptions } from "./permdock-CprAPN3w.js";
-import { m as ApprovalStore } from "./types-DLvhVm1r.js";
-import { a as AutomationSource } from "./automation-C6Jg75xq.js";
-import { n as ApprovalWaiter } from "./waiter-CqUKX6CY.js";
-import { c as RunResource, i as RunBinding, r as RunAutomation } from "./run-ticket-ylovhyFQ.js";
+import { _ as PrincipalSource, a as PermDock, n as DecideOptions, o as PermDockOptions } from "./permdock-DUWZEOLR.js";
+import { m as ApprovalStore } from "./types-BvBbkAu1.js";
+import { a as AutomationSource } from "./automation-DCWuVKtd.js";
+import { n as ApprovalWaiter } from "./waiter-C2cXXLFZ.js";
+import { c as RunResource, i as RunBinding, r as RunAutomation } from "./run-ticket-C6lXvHM_.js";
 //#region src/workflow/create.d.ts
 type WorkflowPermDockOptions = PermDockOptions & {
   /** Signs the run tickets `start` mints. */

package/dist/{create-BPUopdfL.d.ts → create-bzQlBzG4.d.ts}

@@ -1,13 +1,13 @@
-import { T as Policy, Un as Decision, hr as Subject, j as PolicyVocabulary, lr as Delegation, pr as Principal } from "./policy-types-DGIO_gxq.js";
+import { E as Policy, M as PolicyVocabulary, _r as Principal, pr as Delegation, qn as Decision, yr as Subject } from "./policy-types-IRJVABmm.js";
 import { u as Permission } from "./permission-types-CAY-GU7e.js";
 import { t as Operation } from "./operations-Ci_rT6Uo.js";
-import { a as PermDock } from "./permdock-CprAPN3w.js";
-import { m as ApprovalStore } from "./types-DLvhVm1r.js";
-import { t as InstanceOptions } from "./instance-options-CoHn-0e8.js";
+import { a as PermDock } from "./permdock-DUWZEOLR.js";
+import { m as ApprovalStore } from "./types-BvBbkAu1.js";
+import { t as InstanceOptions } from "./instance-options-BOCRxEFb.js";
 import { t as RequestContext } from "./request-context-C2_1lchh.js";
-import { n as PermDockWrap } from "./wrap-DxXB54Wu.js";
-import { o as OtelWrap } from "./types-B6ExllNo.js";
-import { t as DeniedText } from "./denied-text-DHldhVUv.js";
+import { n as PermDockWrap } from "./wrap-DpZAbxuD.js";
+import { o as OtelWrap } from "./types-Sj1U8HMm.js";
+import { t as DeniedText } from "./denied-text-DyzWwxEB.js";
 //#region src/agent/step-up.d.ts
 /**
  * What the user can do to lift a denial: authenticate again with the `acr` and

package/dist/{create-Coq5fIrq.js → create-gqtDb1nU.js}

@@ -1,10 +1,10 @@
 import { t as compact } from "./compact-CAf557ZB.js";
 import { n as freezeDeep } from "./freeze-jjan0lCv.js";
-import { o as deniedFor } from "./where-scope-DlCdCM_8.js";
-import { l as withApp } from "./permdock-BvjivVb9.js";
-import { t as composeWraps } from "./wrap-B2wziJI_.js";
-import { r as instanceOptions } from "./build-instance-BWXqwQYU.js";
-import { n as createAgentKernel } from "./kernel-BD8QuMnv.js";
+import { o as deniedFor } from "./where-scope-BKrqUDVk.js";
+import { l as withApp } from "./permdock-DdzMv5-F.js";
+import { t as composeWraps } from "./wrap-C5PWzgkq.js";
+import { r as instanceOptions } from "./build-instance-lye7oEqf.js";
+import { n as createAgentKernel } from "./kernel-CDDU93dI.js";
 //#region src/agent/create.ts
 function modelRow(modelId) {
 	return { id: modelId };

package/dist/{create-BLPKnJKa.js → create-jCPwPWXf.js}

@@ -3,13 +3,14 @@ import { n as freezeDeep } from "./freeze-jjan0lCv.js";
 import { n as problemDetails } from "./problem-details-CLDgX1KV.js";
 import { c as listPermissions } from "./permission-registry-B8tYxPIt.js";
 import { n as resourceRef } from "./resource-ref-CaS9yVPi.js";
-import { i as challengeScope, l as withApp } from "./permdock-BvjivVb9.js";
+import { i as challengeScope, l as withApp } from "./permdock-DdzMv5-F.js";
 import { r as hasCredentials } from "./http-DKLXrFGk.js";
 import { a as decisionResponse, c as problemFromDecision, d as unauthenticatedProblem, s as notFoundProblem, t as ANONYMOUS } from "./problem-BVLHFK33.js";
-import { n as resolveOrNull } from "./build-instance-BWXqwQYU.js";
-import { _ as LOAD_FAILED, l as InvalidSignatureError, n as applyApprovalResume, o as evaluationsHandler } from "./evaluations-IBceAeKT.js";
-import { n as tenantScope, t as actorFrom } from "./adapter-context-CIQpQxbE.js";
-import { n as requestContext, t as buildReportingInstance } from "./request-context-Duzdf0cd.js";
+import { n as resolveOrNull } from "./build-instance-lye7oEqf.js";
+import { t as LOAD_FAILED } from "./decision-CaG5_eNJ.js";
+import { l as InvalidSignatureError, n as applyApprovalResume, o as evaluationsHandler } from "./evaluations-DG40eSJa.js";
+import { n as tenantScope, t as actorFrom } from "./adapter-context-OHikyRqV.js";
+import { n as requestContext, t as buildReportingInstance } from "./request-context-Ch052blg.js";
 //#region src/server/kernel-problems.ts
 const NOT_DELEGATED = freezeDeep({
 	outcome: "denied",

package/dist/{credential-CyyyvCsL.js → credential-B3Hj4puZ.js}

@@ -7,9 +7,9 @@ import { c as listPermissions, h as formerKeys } from "./permission-registry-B8t
 import { g as secondsOf, l as isRfc3339, m as rfc3339, p as nowSeconds } from "./time-nR1JesoH.js";
 import { t as canonicalJson } from "./canonical-json-DwilZ1iB.js";
 import { r as sha256Digest } from "./sha256-C-4WXKIu.js";
-import { n as coveredByDelegation } from "./delegation-CDB6_keF.js";
+import { n as coveredByDelegation } from "./delegation-aK4T_5WU.js";
 import { o as flattenGrantee } from "./grantee-Dke-9rd1.js";
-import { t as anonymousSubject } from "./subject-BGoM5o8B.js";
+import { t as anonymousSubject } from "./subject-C7RddW0G.js";
 //#region src/core/credential.ts
 /**
 * A feed id: lowercase, so a mail system that lowercases a local part still
@@ -181,7 +181,8 @@ function credentialSubject(credential, options) {
 		});
 	} else {
 		const membership = compact({
-			tenant: credential.tenant,
+			scope: "tenant",
+			id: credential.tenant,
 			roles: credential.roles ?? [],
 			via: "credential"
 		});

package/dist/{credentials-CdDxp7jN.js → credentials-dkycUsY3.js}

@@ -1,4 +1,4 @@
-import { n as CliError } from "./errors-Vpu6rKHl.js";
+import { n as CliError } from "./errors-BhRkoNS7.js";
 //#region src/cli/core/io.ts
 const FRAMES = [
 	"⠋",

package/dist/decision-CaG5_eNJ.js

@@ -0,0 +1,21 @@
+//#region src/core/decision.ts
+/** The denial for a check that failed or named no declared permission. */
+const NO_GRANT = Object.freeze({
+	outcome: "denied",
+	denials: Object.freeze([Object.freeze({
+		role: null,
+		reason: "no-grant"
+	})]),
+	alternatives: Object.freeze([])
+});
+/** The denial for a check whose row loader threw: it fails closed. */
+const LOAD_FAILED = Object.freeze({
+	outcome: "denied",
+	denials: Object.freeze([Object.freeze({
+		role: null,
+		reason: "validation"
+	})]),
+	alternatives: Object.freeze([])
+});
+//#endregion
+export { NO_GRANT as n, LOAD_FAILED as t };

package/dist/{delegation-CDB6_keF.js → delegation-aK4T_5WU.js}

@@ -4,11 +4,11 @@ import { a as resolveConditionRef, c as isConditionDate, d as parentHop, l as is
 import { o as sameId, t as expiredAt } from "./expiry-6XByK0dm.js";
 import { g as formerScopes, m as annotationsFor, n as findPermission } from "./permission-registry-B8tYxPIt.js";
 import { o as epochSeconds } from "./time-nR1JesoH.js";
-import { f as scopeList, h as tenantOf, m as subjectMemberships, s as resolveScope } from "./scopes-0Up_UA2t.js";
+import { d as scopeList, p as tenantOf, s as resolveScope } from "./scopes-BSdYaGHs.js";
 import { t as isoInstant } from "./instant-DK3Iz83e.js";
 import { o as flattenGrantee } from "./grantee-Dke-9rd1.js";
 import { t as isActive } from "./validity-Buc7w8E9.js";
-import { n as matchGrantee } from "./grantee-match-7RZZvoT_.js";
+import { n as matchGrantee } from "./grantee-match-BP-k4vRJ.js";
 //#region src/conditions/evaluate.ts
 function resolveRef(ref, subject) {
 	return resolveConditionRef(ref, subject);
@@ -73,7 +73,7 @@ function evaluateMemberOf(condition, data, subject, now, scopes) {
 	if (data === null || typeof data !== "object") return false;
 	const rowValue = ownGet(data, condition.field);
 	if (rowValue === void 0 || rowValue === null) return false;
-	const memberships = subjectMemberships(subject.principal?.memberships, scopes);
+	const memberships = subject.principal?.memberships ?? [];
 	const wanted = new Set(condition.roles);
 	const active = subject.principal?.tenant === "" ? void 0 : subject.principal?.tenant;
 	const scope = condition.scope === "resource" ? void 0 : resolveScope(scopes, condition.scope);

package/dist/delivery/index.d.ts

@@ -1,5 +1,5 @@
-import { dn as EmailCategory, ln as DeliveryFailureCause, sn as DeliveryChannel } from "../policy-types-DGIO_gxq.js";
-import { i as approvalUrlFor, n as ApprovalUrl, r as approvalPrompt, t as ApprovalPrompt } from "../approval-prompt-3BqWczTt.js";
-import { _ as TransportOptions, a as DeliveryReport, c as DeliveryTransport, d as EmailTransport, f as EmailUnsubscribe, g as TransportMessages, h as TransportItem, i as DeliveryMessages, l as DeliveryTransports, m as Recipient, n as ChatTransport, o as DeliveryResult, p as OutgoingEmail, r as DeliverOptions, s as DeliveryTarget, t as ChatMessage, u as EmailMessage, v as WebhookMessage, y as WebhookTransport } from "../types-CN0LsqbK.js";
-import { C as audience, S as SubscriberEvent, _ as ParseConnectorResult, a as DeliveryPermDock, b as Audience, c as MemoryDelivery, d as memoryDeliveryTransport, f as CONNECTOR_SCHEMA, g as ConnectorKind, h as ConnectorIssue, i as isDeliveryTarget, l as MemoryDeliveryTransport, m as Connector, n as webhookTransport, o as DeliveryPermDockOptions, p as CONNECTOR_KINDS, r as isAddrSpec, s as createPermDock, t as WebhookTransportOptions, u as MemoryDeliveryTransportOptions, v as SiemDestination, w as subscribersFor, x as AudienceOptions, y as parseConnector } from "../index-ymept53A.js";
+import { dn as DeliveryFailureCause, ln as DeliveryChannel, pn as EmailCategory } from "../policy-types-IRJVABmm.js";
+import { i as approvalUrlFor, n as ApprovalUrl, r as approvalPrompt, t as ApprovalPrompt } from "../approval-prompt-BSh-yxbH.js";
+import { _ as TransportOptions, a as DeliveryReport, c as DeliveryTransport, d as EmailTransport, f as EmailUnsubscribe, g as TransportMessages, h as TransportItem, i as DeliveryMessages, l as DeliveryTransports, m as Recipient, n as ChatTransport, o as DeliveryResult, p as OutgoingEmail, r as DeliverOptions, s as DeliveryTarget, t as ChatMessage, u as EmailMessage, v as WebhookMessage, y as WebhookTransport } from "../types-UfpcY575.js";
+import { C as audience, S as SubscriberEvent, _ as ParseConnectorResult, a as DeliveryPermDock, b as Audience, c as MemoryDelivery, d as memoryDeliveryTransport, f as CONNECTOR_SCHEMA, g as ConnectorKind, h as ConnectorIssue, i as isDeliveryTarget, l as MemoryDeliveryTransport, m as Connector, n as webhookTransport, o as DeliveryPermDockOptions, p as CONNECTOR_KINDS, r as isAddrSpec, s as createPermDock, t as WebhookTransportOptions, u as MemoryDeliveryTransportOptions, v as SiemDestination, w as subscribersFor, x as AudienceOptions, y as parseConnector } from "../index-DFwUOkvt.js";
 export { type ApprovalPrompt, type ApprovalUrl, type Audience, type AudienceOptions, CONNECTOR_KINDS, CONNECTOR_SCHEMA, type ChatMessage, type ChatTransport, type Connector, type ConnectorIssue, type ConnectorKind, type DeliverOptions, type DeliveryChannel, type DeliveryFailureCause, type DeliveryMessages, type DeliveryPermDock, type DeliveryPermDockOptions, type DeliveryReport, type DeliveryResult, type DeliveryTarget, type DeliveryTransport, type DeliveryTransports, type EmailCategory, type EmailMessage, type EmailTransport, type EmailUnsubscribe, type MemoryDelivery, type MemoryDeliveryTransport, type MemoryDeliveryTransportOptions, type OutgoingEmail, type ParseConnectorResult, type Recipient, type SiemDestination, type SubscriberEvent, type TransportItem, type TransportMessages, type TransportOptions, type WebhookMessage, type WebhookTransport, type WebhookTransportOptions, approvalPrompt, approvalUrlFor, audience, createPermDock, isAddrSpec, isDeliveryTarget, memoryDeliveryTransport, parseConnector, subscribersFor, webhookTransport };

package/dist/delivery/index.js

@@ -1,5 +1,5 @@
 import { n as approvalUrlFor, t as approvalPrompt } from "../approval-prompt-B8hQY69x.js";
-import { n as subscribersFor, t as audience } from "../audience-DTjR8xet.js";
+import { n as subscribersFor, t as audience } from "../audience-jRO819i3.js";
 import { t as CONNECTOR_SCHEMA } from "../connector-schema-CYLQNMYq.js";
 import { a as parseConnector, i as CONNECTOR_KINDS, n as createPermDock, r as memoryDeliveryTransport, t as webhookTransport } from "../delivery-BupfvJIV.js";
 import { i as isDeliveryTarget, n as isAddrSpec } from "../target-qdEAnnhU.js";

package/dist/{denied-text-DHldhVUv.d.ts → denied-text-DyzWwxEB.d.ts}

@@ -1,4 +1,4 @@
-import { Un as Decision } from "./policy-types-DGIO_gxq.js";
+import { qn as Decision } from "./policy-types-IRJVABmm.js";
 import { u as Permission } from "./permission-types-CAY-GU7e.js";
 //#region src/agent/denied-text.d.ts
 /**

package/dist/{describe-Bb4hGK5d.js → describe-CogP1loh.js}

@@ -1,4 +1,4 @@
-import { i as flattenApprovers } from "./approvers-B4r0N_Uz.js";
+import { a as flattenApprovers } from "./approvers-CNtl4Vc5.js";
 import { r as requiredPlans } from "./problem-details-CLDgX1KV.js";
 //#region src/core/describe.ts
 const TENANT_REASONS = /* @__PURE__ */ new Set([
@@ -43,6 +43,7 @@ const DESCRIBE_TITLES = {
 function labelApprover(approver) {
 	if (approver.kind === "user") return `user ${approver.id}`;
 	if (approver.kind === "permission") return `a holder of ${approver.permission}`;
+	if (approver.kind === "manager") return approver.levels === void 0 ? "the requester's manager" : `a manager up to ${approver.levels} levels above the requester`;
 	if (approver.kind === "any-of") return `one of (${approver.of.map((entry) => flattenApprovers(entry).map(labelApprover).join(" and ")).join(", ")})`;
 	return labelGrantee(approver);
 }

package/dist/{describe-BbFPBSms.d.ts → describe-nalX_HHE.d.ts}

@@ -1,4 +1,4 @@
-import { Kn as DenialReason, Un as Decision, qn as DeniedDecision } from "./policy-types-DGIO_gxq.js";
+import { Xn as DenialReason, Zn as DeniedDecision, qn as Decision } from "./policy-types-IRJVABmm.js";
 import { u as Permission } from "./permission-types-CAY-GU7e.js";
 //#region src/core/describe.d.ts
 type DecisionDescription = {

package/dist/{diff-DfmYaIhB.js → diff-BTsLiW59.js}

@@ -1,14 +1,14 @@
-import { j as memoryCustomRoleSource } from "./src-C_pi2Rnh.js";
+import { M as memoryCustomRoleSource } from "./src-nYNBfmgq.js";
 import { n as findPermission } from "./permission-registry-B8tYxPIt.js";
 import { g as secondsOf } from "./time-nR1JesoH.js";
 import { t as canonicalJson } from "./canonical-json-DwilZ1iB.js";
-import { t as getPermDock } from "./permdock-BvjivVb9.js";
-import { i as configError, u as usageResult } from "./errors-Vpu6rKHl.js";
-import { t as buildCatalog } from "./catalog-doc-DjMKzJp9.js";
-import { a as loadModule, n as asPolicy, s as pickNamed } from "./load-DjSU5KXO.js";
-import { t as parseCatalog } from "./parse-1_ZheTW5.js";
+import { t as getPermDock } from "./permdock-DdzMv5-F.js";
+import { i as configError, u as usageResult } from "./errors-BhRkoNS7.js";
+import { t as buildCatalog } from "./catalog-doc-C4DGfJCO.js";
+import { a as loadModule, n as asPolicy, s as pickNamed } from "./load-BaEamml-.js";
+import { t as parseCatalog } from "./parse-UTC-sDrt.js";
 import { t as operationFindings } from "./operation-findings-CXtFzlKJ.js";
-import { n as fixtureSubject, r as loadFixtures, t as fixtureRow } from "./fixtures-Bm4_K1ke.js";
+import { n as fixtureSubject, r as loadFixtures, t as fixtureRow } from "./fixtures-0VTW5oNq.js";
 import { existsSync, readFileSync } from "node:fs";
 import { resolve } from "node:path";
 //#region src/cli/diff/format.ts

package/dist/{diff-CxtbOi2l.js → diff-CcxYooMu.js}

@@ -1,5 +1,5 @@
 import { t as defineLeaf } from "./command-L8EstFNm.js";
-import { c as given } from "./flags-DXjoTVbS.js";
+import { c as given } from "./flags-BlmpmXoY.js";
 //#region src/cli/commands/diff.ts
 const diff = defineLeaf({
 	positionals: [{
@@ -21,7 +21,7 @@ const diff = defineLeaf({
 		}
 	},
 	async run(ctx, { flags, args }) {
-		return (await import("./diff-DfmYaIhB.js")).runDiff({
+		return (await import("./diff-BTsLiW59.js")).runDiff({
 			cwd: ctx.cwd,
 			config: ctx.config,
 			sources: [args["before"], args["after"]].filter((value) => value !== void 0),

package/dist/{doctor-CwYc2lJb.js → doctor-BNRhJegR.js}

@@ -1,5 +1,5 @@
 import { t as defineLeaf } from "./command-L8EstFNm.js";
-import { a as failOnFlag } from "./flags-DXjoTVbS.js";
+import { a as failOnFlag } from "./flags-BlmpmXoY.js";
 import { n as ask, t as CANCELLED } from "./prompt-BYc6drYW.js";
 //#region src/cli/commands/doctor.ts
 const doctor = defineLeaf({
@@ -10,7 +10,7 @@ const doctor = defineLeaf({
 			description: "Check codes or groups to run",
 			valueHint: "code",
 			async complete() {
-				const { DOCTOR_CHECKS } = await import("./doctor-D1Xnmy6u.js");
+				const { DOCTOR_CHECKS } = await import("./doctor-DS-9ApID.js");
 				return [.../* @__PURE__ */ new Set([...DOCTOR_CHECKS.map(({ code }) => code), ...DOCTOR_CHECKS.flatMap(({ groups }) => groups)])];
 			}
 		},
@@ -27,7 +27,7 @@ const doctor = defineLeaf({
 			if (answer === void 0) return CANCELLED;
 			fix = answer;
 		}
-		return (await import("./doctor-D1Xnmy6u.js")).runDoctor({
+		return (await import("./doctor-DS-9ApID.js")).runDoctor({
 			cwd: ctx.cwd,
 			config: ctx.config,
 			only: flags.only,

package/dist/{doctor-D1Xnmy6u.js → doctor-DS-9ApID.js}

@@ -3,48 +3,49 @@ import { o as hasConditionOp } from "./refs-C8BKxc_e.js";
 import { c as listPermissions, h as formerKeys } from "./permission-registry-B8tYxPIt.js";
 import { u as isPrincipalRelation } from "./resource-relations-8-pCScBO.js";
 import { t as canonicalJson } from "./canonical-json-DwilZ1iB.js";
-import { f as scopeList, l as rootScope, o as normalizeMemberships, s as resolveScope } from "./scopes-0Up_UA2t.js";
+import { c as rootScope, d as scopeList, o as normalizeMemberships, s as resolveScope } from "./scopes-BSdYaGHs.js";
 import { o as flattenGrantee } from "./grantee-Dke-9rd1.js";
-import { u as separationConflicts } from "./policy-CLQ8__GF.js";
-import { T as validateCustomRole } from "./evaluate-BAmf_AQd.js";
-import { s as parseCredential } from "./credential-CyyyvCsL.js";
-import { a as describeError } from "./errors-Vpu6rKHl.js";
+import { u as separationConflicts } from "./policy-DxQyHKPB.js";
+import { T as validateCustomRole } from "./evaluate-CsjXeLRo.js";
+import { s as parseCredential } from "./credential-B3Hj4puZ.js";
+import { a as describeError } from "./errors-BhRkoNS7.js";
 import { t as policyRowConditionKeys } from "./row-conditions-BAGHOmVq.js";
 import { a as rel, n as doctorSrcPath, o as sqlFiles, r as listSourceFiles } from "./files-BSjrtIHw.js";
 import { i as DOCTOR_REPORT_SCHEMA } from "./version-DMQ0dnN5.js";
-import { c as jsonSchemaOf, i as catalogOAuthScopes } from "./catalog-doc-DjMKzJp9.js";
-import { a as loadModule, i as loadConfiguredPolicy, n as asPolicy, s as pickNamed } from "./load-DjSU5KXO.js";
+import { c as jsonSchemaOf, i as catalogOAuthScopes } from "./catalog-doc-C4DGfJCO.js";
+import { a as loadModule, i as loadConfiguredPolicy, n as asPolicy, s as pickNamed } from "./load-BaEamml-.js";
 import { t as catalogPath } from "./catalog-path-CnI0XTFK.js";
-import { r as runCollect } from "./collect-WCl8cJQV.js";
-import { n as supabaseTenantClaim } from "./budget-BELja5A9.js";
-import { a as nodeFiles, i as filesOf, n as betterSupabaseDefaults, o as readJson, r as betterSupabaseTenantClaim, t as betterSupabaseConfig } from "./better-supabase-Dirf_8Ec.js";
+import { r as runCollect } from "./collect-HfJXl8Tr.js";
+import { n as supabaseTenantClaim } from "./budget-BBCPDOGP.js";
+import { a as filesOf, i as betterSupabaseTenantClaim, n as betterSupabaseConfig, o as nodeFiles, r as betterSupabaseDefaults, s as readJson, t as betterSupabaseAuthzVersions } from "./better-supabase-BJtQ-kNf.js";
 import { i as qualifySqlTable, s as quoteSqlLiteral } from "./sql-0WjxIp9g.js";
-import { a as scopeMembershipTable } from "./compile-EzEMB-7v.js";
+import { a as scopeMembershipTable } from "./compile-B_oJqmIg.js";
 import { d as keptKeys, r as PERMDOCK_SCHEMA } from "./sources-C4vkzZJV.js";
-import { t as parseCatalog } from "./parse-1_ZheTW5.js";
+import { t as parseCatalog } from "./parse-UTC-sDrt.js";
 import { n as activeTenantMismatch } from "./active-tenant-DVee32-T.js";
 import "./markers-BeHZ4x9Q.js";
-import { t as didYouMean } from "./args-0FrVs5EH.js";
-import { t as DOCS_BASE } from "./manifest-Cft51TLK.js";
+import { t as didYouMean } from "./args-iafbHiXn.js";
+import { t as DOCS_BASE } from "./manifest-Dij1U0hx.js";
 import { t as createStyle } from "./style-Ds11Hmk4.js";
-import { a as nonEmptyOr, r as findingOf } from "./output-DlICTjBh.js";
-import { i as runSkillsInstall } from "./skills-Celu2W6v.js";
+import { a as nonEmptyOr, r as findingOf } from "./output-DhTpe8v1.js";
+import { i as runSkillsInstall } from "./skills-BUuH-QFt.js";
 import { n as MIGRATION_DIRS, t as DEFAULT_SENSITIVE_ACTIONS } from "./constants-DcJABbLW.js";
-import { l as partPath } from "./output-files-BIQ_9pIs.js";
-import { _ as readSupabaseConfig, a as supabaseHookManifest, c as activeSource, d as resolveSchemas, g as pd074, h as pd045, l as pd039, m as attrsPlan, n as hookOut, v as supabaseConfig } from "./supabase-hook-HPgwYb9V.js";
-import { G as byKey, Q as graphSqlName, n as tableNameOf, o as graphPlan, r as tableNames } from "./tables-DimBcVWY.js";
-import { a as guardedTables, p as contextRefs, r as unsatisfiedKinds, t as ownershipRules } from "./ownership-qqBuGJXr.js";
+import { l as partPath } from "./output-files-CM0BnH05.js";
+import { _ as readSupabaseConfig, a as supabaseHookManifest, c as activeSource, d as resolveSchemas, g as pd074, h as pd045, l as pd039, m as attrsPlan, n as hookOut, v as supabaseConfig } from "./supabase-hook-Cj85nccs.js";
+import { G as byKey, Q as graphSqlName, n as tableNameOf, o as graphPlan, r as tableNames } from "./tables-BsGE6HBR.js";
+import { a as guardedTables, p as contextRefs, r as unsatisfiedKinds, t as ownershipRules } from "./ownership-moSRhxl_.js";
 import { t as membershipSourcesOf } from "./sources-qoIJQrJv.js";
 import { i as group, n as membershipColumns, o as sqlStatements, r as tableKey } from "./deciding-columns-NB4wcyBf.js";
-import { t as FIELD_VIEWS } from "./fields-DI8s3cPl.js";
-import { t as resolveNames } from "./resolve-names-Y1Cb22cp.js";
-import { a as pd010, c as pd014, d as pd038, f as pd041, i as pd008, l as pd015, n as pd001, o as pd011, p as pd057, r as pd007, s as pd013, t as runUsage, u as pd036 } from "./usage-CPXeuAdT.js";
-import { d as rowConditionMessage, f as commandFor, m as tableFor, p as compileGrants, s as ROW_CONDITION_FIX, u as helperTablePolicies } from "./verify-DfT0QYNh.js";
-import { a as streamOf, i as scopeSourcesOf, r as staleFiles, t as powersyncFiles } from "./powersync-CBhTBhG2.js";
-import { a as buildContext, n as generateOptions, r as isRefusal, s as inheritTargets, t as supautilsRejections } from "./supautils-SwE642N1.js";
+import { t as FIELD_VIEWS } from "./fields-CrjL6A49.js";
+import { t as resolveNames } from "./resolve-names-1nCei24V.js";
+import { a as pd010, c as pd014, d as pd038, f as pd041, i as pd008, l as pd015, n as pd001, o as pd011, p as pd057, r as pd007, s as pd013, t as runUsage, u as pd036 } from "./usage-COsGLht5.js";
+import { d as rowConditionMessage, f as commandFor, m as tableFor, p as compileGrants, s as ROW_CONDITION_FIX, u as helperTablePolicies } from "./verify-C8G8D5mk.js";
+import { a as streamOf, i as scopeSourcesOf, r as staleFiles, t as powersyncFiles } from "./powersync-C0nsyULQ.js";
+import { a as buildContext, n as generateOptions, r as isRefusal, s as inheritTargets, t as supautilsRejections } from "./supautils-BP_5WAIc.js";
 import { n as legacyHelperNames, r as retirePlan, t as legacyHelperCalls } from "./retire-B2xffQgY.js";
 import { basename, dirname, join, resolve } from "node:path";
 import { pathToFileURL } from "node:url";
+import { Visitor, parseSync } from "oxc-parser";
 import { createRequire } from "node:module";
 //#region src/cli/project/project.ts
 function loadProject(input) {
@@ -295,6 +296,23 @@ async function pd079(input) {
 		fix: `declare ${key} in the policy and run permdock collect, or map the block action to a key the catalog lists`
 	}));
 }
+/**
+* PermDock's hook keeps `permdock_authz_version` and better-supabase's
+* `sessions.authzVersions` keeps `user_authz_versions`: two tables bump on
+* different triggers, and only one reaches the `authz_ver` claim.
+*/
+async function pd082(input) {
+	const hook = input.config.supabase?.hook;
+	if (hook === void 0 || hook.version === false) return [];
+	const config = await betterSupabaseConfig(input);
+	if (config === void 0 || !betterSupabaseAuthzVersions(config)) return [];
+	return [{
+		code: "PD082",
+		severity: "warning",
+		message: "supabase.hook keeps permdock_authz_version and better-supabase's blocks.sessions.authzVersions keeps user_authz_versions: two version tables bump on different triggers, and only PermDock's reaches the authz_ver claim",
+		fix: "turn blocks.sessions.authzVersions off; PermDock's trigger broadcasts on better_supabase:authz and authz:<uid>, which better-supabase's subscribeAuthzVersions and SessionProvider read"
+	}];
+}
 //#endregion
 //#region src/cli/doctor/catalog.ts
 /**
@@ -761,7 +779,7 @@ async function pd025(input) {
 		findings.push({
 			code: "PD025",
 			severity: "warning",
-			message: `membership ${membership.principal ?? String(index)} grants nothing: its scope is not one of ${names}, a parent id is missing from within, or it mixes shapes`,
+			message: `membership ${membership.principal ?? String(index)} grants nothing: its scope is not one of ${names}, a parent id is missing from within, it mixes shapes, or it uses the { tenant, team } form 0.17.0 removed (permdock codemod 0.17 rewrites it)`,
 			fix: "use { scope, id, within: { <parent>: id }, roles } with a declared scope, or { on: { resource, id }, roles }"
 		});
 	}
@@ -854,6 +872,105 @@ async function pd065(input) {
 	})));
 }
 //#endregion
+//#region src/cli/doctor/per-request.ts
+/** Factories whose answers or entries only pay off when one is shared. */
+const SHARED_FACTORIES = {
+	postgrestSources: "PD080",
+	memoryVersionCache: "PD080",
+	instanceCache: "PD081"
+};
+const MESSAGES = {
+	PD080: {
+		what: "so every call starts with no shared version reads",
+		fix: "create it once at module scope and pass the same object to every getPermDock call"
+	},
+	PD081: {
+		what: "so every call gets an empty cache and no instance is reused",
+		fix: "create one instanceCache() at module scope and pass it as instances to every adapter"
+	}
+};
+function isPermDockSpecifier(value) {
+	return value === "permdock" || value.startsWith("permdock/");
+}
+/**
+* The calls to `postgrestSources`, `memoryVersionCache` and `instanceCache`
+* imported from PermDock that sit inside a function body, except the right side
+* of a `??=`, which builds the object once.
+*/
+function callsInFunctions(source) {
+	const { program } = parseSync(source.file, source.text);
+	const names = /* @__PURE__ */ new Map();
+	const namespaces = /* @__PURE__ */ new Set();
+	const lazy = [];
+	const found = [];
+	let depth = 0;
+	const enter = () => {
+		depth += 1;
+	};
+	const exit = () => {
+		depth -= 1;
+	};
+	new Visitor({
+		ImportDeclaration(node) {
+			if (node.importKind === "type" || !isPermDockSpecifier(node.source.value)) return;
+			for (const specifier of node.specifiers) if (specifier.type === "ImportNamespaceSpecifier") namespaces.add(specifier.local.name);
+			else if (specifier.type === "ImportSpecifier" && specifier.importKind !== "type") {
+				const imported = specifier.imported.type === "Identifier" ? specifier.imported.name : specifier.imported.value;
+				if (Object.hasOwn(SHARED_FACTORIES, imported)) names.set(specifier.local.name, imported);
+			}
+		},
+		FunctionDeclaration: enter,
+		"FunctionDeclaration:exit": exit,
+		FunctionExpression: enter,
+		"FunctionExpression:exit": exit,
+		ArrowFunctionExpression: enter,
+		"ArrowFunctionExpression:exit": exit,
+		AssignmentExpression(node) {
+			if (node.operator === "??=") lazy.push({
+				start: node.right.start,
+				end: node.right.end
+			});
+		},
+		CallExpression(node) {
+			if (depth === 0) return;
+			const { callee } = node;
+			let factory;
+			if (callee.type === "Identifier") factory = names.get(callee.name);
+			else if (callee.type === "MemberExpression" && callee.object.type === "Identifier" && namespaces.has(callee.object.name) && callee.property.type === "Identifier" && Object.hasOwn(SHARED_FACTORIES, callee.property.name)) factory = callee.property.name;
+			if (factory !== void 0) found.push({
+				call: node,
+				factory
+			});
+		}
+	}).visit(program);
+	return found.filter(({ call }) => !lazy.some((range) => call.start >= range.start && call.end <= range.end));
+}
+function findings(sources, code) {
+	const out = [];
+	for (const source of sources) {
+		if (!source.text.includes("permdock")) continue;
+		for (const { call, factory } of callsInFunctions(source)) {
+			if (SHARED_FACTORIES[factory] !== code) continue;
+			const line = source.text.slice(0, call.start).split("\n").length;
+			out.push({
+				code,
+				severity: "warning",
+				message: `${source.file}:${String(line)} creates ${factory}() inside a function, ${MESSAGES[code].what}`,
+				fix: MESSAGES[code].fix
+			});
+		}
+	}
+	return out;
+}
+/** PD080: `postgrestSources` or `memoryVersionCache` created per call. */
+function pd080(sources) {
+	return findings(sources, "PD080");
+}
+/** PD081: `instanceCache` created per call. */
+function pd081(sources) {
+	return findings(sources, "PD081");
+}
+//#endregion
 //#region src/cli/doctor/policy.ts
 async function pd017(input) {
 	if (input.config.policy === void 0) return [];
@@ -886,12 +1003,12 @@ async function pd024(input) {
 	const findings = [];
 	for (const grant of policy.grants) {
 		const approval = grant.approval;
-		if (grant.effect !== "allow" || approval === void 0 || approval === "human" || approval.distinct !== false) continue;
+		if (grant.effect !== "allow" || approval === void 0 || approval === "human" || approval.mode !== "confirm") continue;
 		findings.push({
 			code: "PD024",
 			severity: "warning",
-			message: `${grant.permission.key}${grant.role === null ? "" : ` (role ${grant.role})`} sets approval.distinct: false, so the requester can approve their own request`,
-			fix: "remove distinct: false unless the requester confirming their own call (an agent asking its user) is the intent"
+			message: `${grant.permission.key}${grant.role === null ? "" : ` (role ${grant.role})`} sets approval.mode: 'confirm', so the requester can approve their own request`,
+			fix: "remove mode: 'confirm' unless the requester confirming their own call (an agent asking its user) is the intent"
 		});
 	}
 	return findings;
@@ -1008,6 +1125,33 @@ async function pd035(input) {
 	return findings;
 }
 //#endregion
+//#region src/cli/doctor/postgrest.ts
+const POSTGREST_IMPORT = /import\s*\{[^}]*\bpostgrestSources\b[^}]*\}\s*from\s*["']permdock\/supabase["']/u;
+function definesFunction(sql, suffix) {
+	return new RegExp(String.raw`create\s+(?:or\s+replace\s+)?function\s+(?:(?:"[^"]+"|\w+)\.)?"?\w*${suffix}"?\s*\(`, "iu").test(sql);
+}
+/**
+* PD083: `postgrestSources` from `permdock/supabase` with a hook file that
+* defines `subject_for` and no `authz_version_for`. Since 0.17.0 `version`
+* calls only the version function, so every `claimsFirst` check fails closed.
+*/
+function pd083(cwd, config, sources, files = nodeFiles) {
+	const user = sources.find((source) => POSTGREST_IMPORT.test(source.text));
+	if (user === void 0) return [];
+	const sql = sqlFiles(cwd, config.doctor?.migrations ?? MIGRATION_DIRS).map((file) => ({
+		file,
+		text: files.read(file)
+	}));
+	const subject = sql.find((item) => definesFunction(item.text, "subject_for"));
+	if (subject === void 0 || sql.some((item) => definesFunction(item.text, "authz_version_for"))) return [];
+	return [{
+		code: "PD083",
+		severity: "error",
+		message: `${rel(cwd, user.file)} uses postgrestSources and ${rel(cwd, subject.file)} defines subject_for but no authz_version_for, so every version read fails and claimsFirst denies`,
+		fix: "run permdock supabase hook generate (with supabase.hook.api for the PostgREST wrappers) and apply the migration it writes"
+	}];
+}
+//#endregion
 //#region src/cli/doctor/powersync.ts
 /**
 * Why each membership source of a scope the streams read through sources has no
@@ -2345,6 +2489,27 @@ const DOCTOR_CHECKS = [
 		groups: ["catalog", "better-supabase"],
 		run: pd079
 	},
+	{
+		code: "PD080",
+		groups: ["caching"],
+		run: (project) => pd080(project.sources())
+	},
+	{
+		code: "PD081",
+		groups: ["caching"],
+		run: (project) => pd081(project.sources())
+	},
+	{
+		code: "PD082",
+		groups: ["supabase", "better-supabase"],
+		when: (config) => config.supabase?.hook !== void 0,
+		run: pd082
+	},
+	{
+		code: "PD083",
+		groups: ["supabase"],
+		run: (project) => pd083(project.cwd, project.config, project.sources())
+	},
 	{
 		code: "PD005",
 		groups: ["skills"],