permdock 0.16.0 → 0.18.0

package/dist/{server-types-CyRN0-Cd.d.ts → server-types-3OnXjZ2D.d.ts}

@@ -1,14 +1,14 @@
-import { Un as Decision, Wt as Instant, X as Intent, Zt as Snapshot, dr as JsonWebKeyLike, hr as Subject, j as PolicyVocabulary, rr as Actor } from "./policy-types-DGIO_gxq.js";
+import { $t as Snapshot, Kt as Instant, M as PolicyVocabulary, Z as Intent, hr as JsonWebKeyLike, qn as Decision, sr as Actor, yr as Subject } from "./policy-types-D-GwfQTc.js";
 import { u as Permission } from "./permission-types-CAY-GU7e.js";
-import { a as PermDock, u as SnapshotOptions } from "./permdock-CprAPN3w.js";
-import { m as ApprovalStore } from "./types-DLvhVm1r.js";
-import { a as ProblemDetails, t as ApprovalHint } from "./errors-BIM4MFsJ.js";
-import { t as InstanceOptions } from "./instance-options-CoHn-0e8.js";
+import { a as PermDock, u as SnapshotOptions } from "./permdock-ffY4CMd9.js";
+import { m as ApprovalStore } from "./types-CqcsNCaN.js";
+import { a as ProblemDetails, t as ApprovalHint } from "./errors-TpzkEKgJ.js";
+import { t as InstanceOptions } from "./instance-options-2sFGSdsf.js";
 import { t as RequestContext } from "./request-context-C2_1lchh.js";
-import { n as PermDockWrap } from "./wrap-DxXB54Wu.js";
+import { n as PermDockWrap } from "./wrap-BHGA-SMM.js";
 import { n as RevocationFeed } from "./revocations-BaUXHM1N.js";
-import { r as PdpFactory } from "./types-DlelvQk4.js";
-import { i as evaluationsHandler } from "./evaluations-DOWuBpWv.js";
+import { r as PdpFactory } from "./types-B8qUkGja.js";
+import { i as evaluationsHandler } from "./evaluations-CisTTURl.js";
 //#region src/server/connection.d.ts
 type ConnectionData<T> = T | (() => T | null | undefined | Promise<T | null | undefined>);
 type ConnectionOptions<T = unknown> = {

package/dist/{shared-l0oGGetg.js → shared-BRmCJxDK.js}

@@ -1,5 +1,5 @@
 import { a as durationOf, f as nowMillis } from "./time-nR1JesoH.js";
-import { t as decisionToken } from "./token-DC9EQiet.js";
+import { n as decisionToken } from "./token-DaMnIU9O.js";
 //#region src/pdp/shared.ts
 const MAX_CACHE_TTL = 30;
 const CACHE_MAX = 1e3;
@@ -46,7 +46,7 @@ function granted(provider, permission, subject, data) {
 			resourceId: resourceIdOf(data),
 			principal,
 			actor: subject.actor,
-			fingerprint: provider
+			source: provider
 		})
 	};
 }

package/dist/{shared-DrGLwM3s.js → shared-DyYVEjKC.js}

@@ -1,9 +1,9 @@
 import { r as isRecord } from "./compact-CAf557ZB.js";
 import { n as isForbiddenKey } from "./paths-CUvURzHp.js";
 import { t as byCodePoint } from "./compare-DTfyUunF.js";
-import { i as configError } from "./errors-Vpu6rKHl.js";
+import { i as configError } from "./errors-BhRkoNS7.js";
 import { a as quoteQualifiedTable, c as quoteSqlTable, o as quoteSqlIdent, s as quoteSqlLiteral, t as SQL_IDENT } from "./sql-0WjxIp9g.js";
-import { t as byScope } from "./compile-EzEMB-7v.js";
+import { t as byScope } from "./compile-B_oJqmIg.js";
 import "./sources-C4vkzZJV.js";
 //#region src/cli/sql/columns.ts
 /**

package/dist/{sink-B5zoUW_O.d.ts → sink-ogbVkyeo.d.ts}

@@ -1,7 +1,7 @@
-import { J as DecisionSink, St as SupportSession, an as CredentialEvent, fn as MembershipEvent, in as AutomationEvent, kt as Credential, mt as TokenSigner, nn as AccessEvent, pn as SinkEvent } from "./policy-types-DGIO_gxq.js";
+import { Y as DecisionSink, gt as TokenSigner, hn as SinkEvent, in as AccessEvent, jt as Credential, mn as MembershipEvent, on as AutomationEvent, sn as CredentialEvent, wt as SupportSession } from "./policy-types-D-GwfQTc.js";
 import { M as AppData } from "./permission-types-CAY-GU7e.js";
 import { u as OperationRisk } from "./operations-Ci_rT6Uo.js";
-import { t as Automation } from "./automation-C6Jg75xq.js";
+import { t as Automation } from "./automation-Bfa_wD1h.js";
 //#region src/core/sink.d.ts
 /**
  * The closed list of CloudEvents `type` values, `com.permdock.<family>` or

package/dist/{skills-Celu2W6v.js → skills-B4MPRxQd.js}

@@ -1,8 +1,8 @@
 import { t as byCodePoint } from "./compare-DTfyUunF.js";
 import { i as readJsonFile } from "./files-BSjrtIHw.js";
 import { l as packageRoot } from "./version-DMQ0dnN5.js";
-import { t as didYouMean } from "./args-0FrVs5EH.js";
-import { a as nonEmptyOr } from "./output-DlICTjBh.js";
+import { t as didYouMean } from "./args-iafbHiXn.js";
+import { a as nonEmptyOr } from "./output-BFWLER4r.js";
 import { cpSync, existsSync, lstatSync, mkdirSync, readFileSync, readdirSync, readlinkSync, realpathSync, writeFileSync } from "node:fs";
 import { basename, dirname, join, relative, resolve } from "node:path";
 import { pathToFileURL } from "node:url";

package/dist/{skills-B2qTbaQa.js → skills-C9sTD70r.js}

@@ -1,7 +1,7 @@
 import { t as defineLeaf } from "./command-L8EstFNm.js";
-import { t as checkFlag } from "./flags-DXjoTVbS.js";
+import { t as checkFlag } from "./flags-BlmpmXoY.js";
 import { r as pick, t as CANCELLED } from "./prompt-BYc6drYW.js";
-import { n as detectedAgents, r as runSkills, t as SKILL_AGENTS } from "./skills-Celu2W6v.js";
+import { n as detectedAgents, r as runSkills, t as SKILL_AGENTS } from "./skills-B4MPRxQd.js";
 //#region src/cli/commands/skills.ts
 const forFlag = { for: {
 	type: "string",

package/dist/{snapshot-CXlzi69u.js → snapshot-DN_8J27z.js}

@@ -3,10 +3,10 @@ import { n as freezeDeep } from "./freeze-jjan0lCv.js";
 import { n as isForbiddenKey } from "./paths-CUvURzHp.js";
 import { a as resolveConditionRef, l as isConditionRef } from "./refs-C8BKxc_e.js";
 import { l as isRfc3339, m as rfc3339, p as nowSeconds } from "./time-nR1JesoH.js";
-import { f as scopeList } from "./scopes-0Up_UA2t.js";
+import { d as scopeList } from "./scopes-BSdYaGHs.js";
 import { _ as listPlans, v as listRoles } from "./grantee-Dke-9rd1.js";
 import { i as wireValidity } from "./validity-Buc7w8E9.js";
-import { m as tenantsOf } from "./tenancy-5d1zVBvK.js";
+import { m as tenantsOf } from "./tenancy-DvOHHk3-.js";
 import { n as toWireDelegation } from "./wire-delegation-Cv3W2eaM.js";
 //#region src/conditions/bind.ts
 function isPrimitive(value) {
@@ -220,6 +220,8 @@ function buildSnapshot(input) {
 		include,
 		simulated: input.simulated === true ? true : void 0,
 		expiresAt: input.subject.expiresAt === void 0 ? void 0 : rfc3339(input.subject.expiresAt),
+		authzVersion: principal?.authzVersion,
+		sessionId: input.subject.session,
 		scopes: input.scopes,
 		ids: Object.keys(ids).length === 0 ? void 0 : ids,
 		assignable: assignable.length > 0 ? assignable : void 0,
@@ -266,6 +268,8 @@ function parseSnapshot(json) {
 	const version = record["v"];
 	if (version !== 1) throw new Error(`PermDock: unsupported snapshot version '${String(version)}'`);
 	if (!isRfc3339(record["issuedAt"]) || record["expiresAt"] !== void 0 && !isRfc3339(record["expiresAt"])) throw new Error("PermDock: snapshot times must be RFC 3339");
+	const authzVersion = record["authzVersion"];
+	if (authzVersion !== void 0 && (typeof authzVersion !== "number" || !Number.isSafeInteger(authzVersion) || authzVersion < 0) || record["sessionId"] !== void 0 && typeof record["sessionId"] !== "string") throw new Error("PermDock: snapshot authzVersion must be a non-negative integer and sessionId a string");
 	return freezeDeep(value);
 }
 //#endregion

package/dist/{snapshot-cache-BjAWkchD.d.ts → snapshot-cache-B4YvlGG_.d.ts}

@@ -1,4 +1,4 @@
-import { Wt as Instant, Zt as Snapshot } from "./policy-types-DGIO_gxq.js";
+import { $t as Snapshot, Kt as Instant } from "./policy-types-D-GwfQTc.js";
 //#region src/core/snapshot-cache.d.ts
 type CacheLifeForOptions = {
   /**
@@ -8,14 +8,21 @@ type CacheLifeForOptions = {
   readonly min?: number;
   /** Upper bound in seconds. Next.js keeps a per-session App Shell entry from 300. */
   readonly max?: number;
+  /**
+   * Cap the lifetime at the seconds the token has left, as `bsb.cached()` does.
+   * Off by default: a proxy that refreshes the session on every request keeps
+   * the token ahead of the entry. `snapshotHeaders` turns it on, since an HTTP
+   * cache sees no refresh.
+   */
+  readonly capToToken?: boolean;
   /** Defaults to the snapshot's `issuedAt`, then the clock. */
   readonly now?: Instant;
 };
 /**
- * `{ stale }` in seconds: `max` when the value never expires, otherwise the
- * seconds left, clamped to `[min, max]`. A value with less than `min` seconds
- * left gets its real remainder, so Next.js leaves it out of prefetches and an
- * HTTP cache does not serve it past `expiresAt`.
+ * `{ stale }` in seconds: `max` (default 300). With `capToToken`, the seconds
+ * the value has left, clamped to `[min, max]`; a value with less than `min`
+ * seconds left gets its real remainder, so Next.js leaves it out of prefetches
+ * and an HTTP cache does not serve it past `expiresAt`.
  */
 declare function cacheLifeFor(value: {
   /** RFC 3339, or a NumericDate. */
@@ -25,6 +32,13 @@ declare function cacheLifeFor(value: {
 } | null, options?: CacheLifeForOptions): {
   readonly stale: number;
 };
+/**
+ * The key of one subject's snapshot in a server cache:
+ * `<sub>:<authzVersion>:<tenant>`, with `anon` for no subject and an empty part
+ * for a missing version or tenant. It carries no claims, so a refreshed token
+ * at the same version keeps the key.
+ */
+declare function snapshotKey(snapshot: Snapshot): string;
 /**
  * The `cacheTag` for one subject's cached snapshots: `permdock:<sub>`, or
  * `permdock:anon` without a subject. Tag the private cache with it and pass it
@@ -53,4 +67,4 @@ type SnapshotHeaders = {
  */
 declare function snapshotHeaders(snapshot: Snapshot, options?: SnapshotHeadersOptions): SnapshotHeaders;
 //#endregion
-export { snapshotHeaders as a, cacheLifeFor as i, SnapshotHeaders as n, snapshotTag as o, SnapshotHeadersOptions as r, CacheLifeForOptions as t };
+export { snapshotHeaders as a, cacheLifeFor as i, SnapshotHeaders as n, snapshotKey as o, SnapshotHeadersOptions as r, snapshotTag as s, CacheLifeForOptions as t };

package/dist/{snapshot-cache-Bx_4xC_6.js → snapshot-cache-B66h7FBK.js}

@@ -1,20 +1,20 @@
 import { g as secondsOf, p as nowSeconds } from "./time-nR1JesoH.js";
-import { n as payloadDigest } from "./token-DC9EQiet.js";
+import { r as payloadDigest } from "./token-DaMnIU9O.js";
 //#region src/core/snapshot-cache.ts
 /** Seconds since the epoch of a NumericDate or an RFC 3339 instant. */
 function epochSeconds(value) {
 	return typeof value === "number" ? value : secondsOf(value);
 }
 /**
-* `{ stale }` in seconds: `max` when the value never expires, otherwise the
-* seconds left, clamped to `[min, max]`. A value with less than `min` seconds
-* left gets its real remainder, so Next.js leaves it out of prefetches and an
-* HTTP cache does not serve it past `expiresAt`.
+* `{ stale }` in seconds: `max` (default 300). With `capToToken`, the seconds
+* the value has left, clamped to `[min, max]`; a value with less than `min`
+* seconds left gets its real remainder, so Next.js leaves it out of prefetches
+* and an HTTP cache does not serve it past `expiresAt`.
 */
 function cacheLifeFor(value, options = {}) {
 	const min = options.min ?? 30;
 	const max = Math.max(options.max ?? 300, min);
-	const expiresAt = epochSeconds(value?.expiresAt);
+	const expiresAt = options.capToToken === true ? epochSeconds(value?.expiresAt) : void 0;
 	if (expiresAt === void 0) return { stale: max };
 	const issued = epochSeconds(value?.issuedAt);
 	const issuedAt = issued !== void 0 && issued > 0 ? issued : void 0;
@@ -24,6 +24,20 @@ function cacheLifeFor(value, options = {}) {
 	return { stale: Math.min(max, remaining) };
 }
 /**
+* The key of one subject's snapshot in a server cache:
+* `<sub>:<authzVersion>:<tenant>`, with `anon` for no subject and an empty part
+* for a missing version or tenant. It carries no claims, so a refreshed token
+* at the same version keeps the key.
+*/
+function snapshotKey(snapshot) {
+	const principal = snapshot.subject.principal;
+	return [
+		principal?.id ?? "anon",
+		snapshot.authzVersion ?? "",
+		principal?.tenant ?? ""
+	].join(":");
+}
+/**
 * The `cacheTag` for one subject's cached snapshots: `permdock:<sub>`, or
 * `permdock:anon` without a subject. Tag the private cache with it and pass it
 * to `updateTag` or `revalidateTag` on every write that changes the subject's
@@ -43,11 +57,14 @@ function snapshotHeaders(snapshot, options = {}) {
 	for (const [key, value] of Object.entries(snapshot)) if (key !== "issuedAt") content[key] = value;
 	const { tags, ...life } = options;
 	return {
-		"Cache-Control": `private, max-age=${cacheLifeFor(snapshot, life).stale}`,
+		"Cache-Control": `private, max-age=${cacheLifeFor(snapshot, {
+			capToToken: true,
+			...life
+		}).stale}`,
 		Vary: "Authorization, Cookie",
 		ETag: `"${payloadDigest(content)}"`,
 		"Cache-Tag": [snapshotTag(snapshot.subject.principal?.id), ...tags ?? []].join(",")
 	};
 }
 //#endregion
-export { snapshotHeaders as n, snapshotTag as r, cacheLifeFor as t };
+export { snapshotTag as i, snapshotHeaders as n, snapshotKey as r, cacheLifeFor as t };

package/dist/solid/index.d.ts

@@ -1,13 +1,13 @@
-import { Hn as ApprovalRequiredDecision, Un as Decision, Yn as GrantedDecision, Zt as Snapshot, fr as Membership, ht as TokenVerifier, j as PolicyVocabulary } from "../policy-types-DGIO_gxq.js";
+import { $n as GrantedDecision, $t as Snapshot, Kn as ApprovalRequiredDecision, M as PolicyVocabulary, _t as TokenVerifier, gr as Membership, qn as Decision } from "../policy-types-D-GwfQTc.js";
 import { u as Permission } from "../permission-types-CAY-GU7e.js";
 import { r as Role } from "../vocabulary-DEJ5j4mR.js";
-import { d as UncheckedData, s as RowData } from "../permdock-CprAPN3w.js";
-import { c as requiredPlans } from "../errors-BIM4MFsJ.js";
-import { i as describe, r as DescribeOptions, t as DecisionDescription } from "../describe-BbFPBSms.js";
+import { d as UncheckedData, s as RowData } from "../permdock-ffY4CMd9.js";
+import { c as requiredPlans } from "../errors-TpzkEKgJ.js";
+import { i as describe, r as DescribeOptions, t as DecisionDescription } from "../describe-BKtC_8PG.js";
 import { t as PermissionBoundaryState } from "../boundary-C9ck-3uK.js";
-import { n as ProtectedAction, t as ActionResult } from "../action-result-BcudBQOF.js";
+import { _ as TenantView, a as ClientPermDock, c as GateMode, d as PermissionState, g as SubjectView, h as RolesOptions, i as ApprovalState, l as GateView, m as ProviderOptionsBase, o as ClientStatus, p as ProtectedActionView, r as ApprovalHandle, s as FilterResult, u as PermissionSet, v as ActionResult, y as ProtectedAction } from "../store-DYeB-_U3.js";
+import { a as broadcastChannelRefresh, c as visibilityRefresh, i as authzChangeRefresh, n as EventSourceRefreshOptions, o as eventSourceRefresh, r as RefreshTrigger, s as focusRefresh, t as AuthzChangeRefresh } from "../refresh-on-L9UOwATg.js";
 import { t as approvalHeaders } from "../headers-B9jQxjtW.js";
-import { a as FilterResult, b as eventSourceRefresh, c as PermissionSet, d as ProtectedActionView, f as ProviderOptionsBase, h as TenantView, i as ClientStatus, l as PermissionState, m as SubjectView, n as ApprovalState, o as GateMode, p as RolesOptions, r as ClientPermDock, s as GateView, t as ApprovalHandle, v as EventSourceRefreshOptions, y as RefreshTrigger } from "../types-tQB2CEnY.js";
 import { Accessor, Accessor as Accessor$1, JSX } from "solid-js";
 //#region src/solid/types.d.ts
 /** Structural `JSX.Element`: text, a DOM node or a list of children. */
@@ -129,4 +129,4 @@ export declare function Protected(props: ProtectedProps): JSX.Element;
 //#region src/solid/provider.d.ts
 export declare function PermDockProvider(props: PermDockProviderProps): JSX.Element;
 //#endregion
-export { type ActionResult, type ApprovalHandle, type ApprovalState, type ClientPermDock, type ClientStatus, type EventSourceRefreshOptions, type FilterResult, type GateMode, type GateView, type PermDockDefaults, type PermDockProviderProps, type PermissionBoundaryProps, type PermissionBoundaryState, type PermissionSet, type PermissionState, type ProtectedAction, type ProtectedActionAccessors, type ProtectedActionView, type ProtectedProps, type RefreshTrigger, type RolesOptions, type SolidChild, type SubjectView, type TenantView, approvalHeaders, describe, eventSourceRefresh, requiredPlans };
+export { type ActionResult, type ApprovalHandle, type ApprovalState, type AuthzChangeRefresh, type ClientPermDock, type ClientStatus, type EventSourceRefreshOptions, type FilterResult, type GateMode, type GateView, type PermDockDefaults, type PermDockProviderProps, type PermissionBoundaryProps, type PermissionBoundaryState, type PermissionSet, type PermissionState, type ProtectedAction, type ProtectedActionAccessors, type ProtectedActionView, type ProtectedProps, type RefreshTrigger, type RolesOptions, type SolidChild, type SubjectView, type TenantView, approvalHeaders, authzChangeRefresh, broadcastChannelRefresh, describe, eventSourceRefresh, focusRefresh, requiredPlans, visibilityRefresh };

package/dist/solid/index.js

@@ -1,11 +1,11 @@
 import { t as compact } from "../compact-CAf557ZB.js";
 import { r as requiredPlans } from "../problem-details-CLDgX1KV.js";
-import { n as describe } from "../describe-Bb4hGK5d.js";
+import { n as describe } from "../describe-BZAlPHxT.js";
 import { n as boundaryFallback, t as boundaryDigest } from "../boundary-BV3O1eud.js";
-import { n as actionRunner, r as approvalHeaders, t as actionApproval } from "../protected-action-DUYqb-Ma.js";
-import { a as livePermDock, c as rolesView, d as subjectView, f as tenantView, i as gateView, l as scopedTenant, n as describeWith, o as permissionSet, r as filterResult, s as protectedView, t as approvalHandle, u as slotContent } from "../views-CD8wuL4Z.js";
-import { a as isPromiseLike, r as eventSourceRefresh } from "../store-options-Dil3lraY.js";
-import { n as switchTenant, t as providerStore } from "../provider-store-CaTv00tr.js";
+import { n as actionRunner, r as approvalHeaders, t as actionApproval } from "../protected-action-OpOxtTsN.js";
+import { a as livePermDock, c as rolesView, d as subjectView, f as tenantView, i as gateView, l as scopedTenant, n as describeWith, o as permissionSet, r as filterResult, s as protectedView, t as approvalHandle, u as slotContent } from "../views-MWmJ6Y4P.js";
+import { a as eventSourceRefresh, i as broadcastChannelRefresh, l as isPromiseLike, o as focusRefresh, r as authzChangeRefresh, s as visibilityRefresh } from "../store-options--zWn48PK.js";
+import { n as switchTenant, t as providerStore } from "../provider-store-BQP_pp8s.js";
 import { ErrorBoundary, createComponent, createComputed, createContext, createMemo, createSignal, getOwner, on, onCleanup, useContext } from "solid-js";
 //#region src/solid/context.ts
 const PermDockContext = createContext(void 0);
@@ -249,4 +249,4 @@ function uiProvider(ui, props) {
 	});
 }
 //#endregion
-export { PermDockProvider, PermissionBoundary, Protected, approvalHeaders, describe, eventSourceRefresh, requiredPlans, useApproval, useAssignablePermissions, useAssignableRoles, useDescribe, useFilter, useGate, useMemberships, usePermDock, usePermission, usePermissionBoundary, usePermissions, useProtectedAction, useRoles, useSubject, useTenant };
+export { PermDockProvider, PermissionBoundary, Protected, approvalHeaders, authzChangeRefresh, broadcastChannelRefresh, describe, eventSourceRefresh, focusRefresh, requiredPlans, useApproval, useAssignablePermissions, useAssignableRoles, useDescribe, useFilter, useGate, useMemberships, usePermDock, usePermission, usePermissionBoundary, usePermissions, useProtectedAction, useRoles, useSubject, useTenant, visibilityRefresh };

package/dist/solid-start/index.d.ts

@@ -1,9 +1,9 @@
-import { T as Policy, Zt as Snapshot, j as PolicyVocabulary, pr as Principal } from "../policy-types-DGIO_gxq.js";
+import { $t as Snapshot, E as Policy, M as PolicyVocabulary, _r as Principal } from "../policy-types-D-GwfQTc.js";
 import { u as Permission } from "../permission-types-CAY-GU7e.js";
 import { a as OperationInput, t as Operation } from "../operations-Ci_rT6Uo.js";
-import { a as PermDock } from "../permdock-CprAPN3w.js";
-import { D as ConnectionOptions, T as Connection, f as InvalidSignatureError, i as OpenApiHooks, o as ProtectOptions, u as SnapshotQuery, v as discoverViaSignatureAgent, x as webBotAuthVerifier } from "../server-types-CyRN0-Cd.js";
-import { a as ProtectTarget, n as FetchAdapterOptions, t as ContextReader } from "../fetch-adapter-BIbBAtPZ.js";
+import { a as PermDock } from "../permdock-ffY4CMd9.js";
+import { D as ConnectionOptions, T as Connection, f as InvalidSignatureError, i as OpenApiHooks, o as ProtectOptions, u as SnapshotQuery, v as discoverViaSignatureAgent, x as webBotAuthVerifier } from "../server-types-3OnXjZ2D.js";
+import { a as ProtectTarget, n as FetchAdapterOptions, t as ContextReader } from "../fetch-adapter-BdmfnbJM.js";
 import { APIEvent, FetchEvent } from "@solidjs/start/server";
 //#region src/solid-start/create.d.ts
 /** The h3 event under every SolidStart request; `subject` and `scope` read it. */

package/dist/solid-start/index.js

@@ -1,6 +1,6 @@
-import { l as InvalidSignatureError, p as webBotAuthVerifier, u as discoverViaSignatureAgent } from "../evaluations-IBceAeKT.js";
-import { i as decorate } from "../bind-BNQA9JK9.js";
-import { n as guardedRoute, t as fetchAdapter } from "../fetch-adapter-dPTgJVHd.js";
+import { l as InvalidSignatureError, p as webBotAuthVerifier, u as discoverViaSignatureAgent } from "../evaluations-h3KoJAPa.js";
+import { i as decorate } from "../bind-B4pMH9bm.js";
+import { n as guardedRoute, t as fetchAdapter } from "../fetch-adapter-DH-NJPbL.js";
 //#region src/solid-start/create.ts
 /**
 * `event.locals`. Its type, `App.RequestEventLocals`, is declared by

package/dist/{sources-oB1Hg1Fm.d.ts → sources-xdQShLDU.d.ts}

@@ -1,4 +1,4 @@
-import { nt as MembershipSource, pr as Principal, rn as AuthEvent } from "./policy-types-DGIO_gxq.js";
+import { _r as Principal, an as AuthEvent, rt as MembershipSource } from "./policy-types-D-GwfQTc.js";
 import { t as ClaimsMap } from "./claims-map-D1Pb5oRq.js";
 import { t as ClientNames } from "./clients-C_NOET3z.js";
 import { c as SupabaseManifestMembership } from "./manifest-B5yF3CIq.js";