permdock 0.16.0 → 0.18.0

package/dist/{supautils-SwE642N1.js → supautils-BGf6zRvM.js}

@@ -1,22 +1,22 @@
 import { c as listPermissions, u as renamedKeys } from "./permission-registry-B8tYxPIt.js";
-import { f as scopeList, s as resolveScope } from "./scopes-0Up_UA2t.js";
+import { d as scopeList, s as resolveScope } from "./scopes-BSdYaGHs.js";
 import { o as flattenGrantee } from "./grantee-Dke-9rd1.js";
-import { l as policyLevels } from "./policy-CLQ8__GF.js";
-import { a as describeError, i as configError } from "./errors-Vpu6rKHl.js";
-import "./budget-BELja5A9.js";
+import { l as policyLevels } from "./policy-cV_wwPb8.js";
+import { a as describeError, i as configError } from "./errors-BhRkoNS7.js";
+import "./budget-BBCPDOGP.js";
 import { d as sqlTextArray, i as qualifySqlTable } from "./sql-0WjxIp9g.js";
 import { l as roleColumn } from "./sources-C4vkzZJV.js";
 import { t as beforeFirst } from "./text-BMFRfBqc.js";
-import { c as parseSplit } from "./output-files-BIQ_9pIs.js";
-import { x as resolveAuthorize } from "./supabase-hook-HPgwYb9V.js";
-import { A as quoteQualified, C as parseMembershipsFlag, D as qualified, F as firstScopeType, O as quoteIdent, R as tenantTypeOf, a as customRolesOn, j as quoteTable, k as quoteLiteral, s as signedIn, t as CUSTOM_ROLES } from "./shared-DrGLwM3s.js";
-import { G as byKey, H as rolesTableScope, O as tokenScopesPlan, Q as graphSqlName, V as raiseSql, W as byCodeUnit, Y as apiKeysPlan, a as closureDepths, bt as checkSuspension, i as tablelessResources, o as graphPlan, r as tableNames, t as resolveVias, z as currentKeyExpr } from "./tables-DimBcVWY.js";
-import { o as assignableRoles, r as unsatisfiedKinds, t as ownershipRules, u as roleNames } from "./ownership-qqBuGJXr.js";
+import { c as parseSplit } from "./output-files-CM0BnH05.js";
+import { x as resolveAuthorize } from "./supabase-hook-DX38Hj8h.js";
+import { A as quoteQualified, C as parseMembershipsFlag, D as qualified, F as firstScopeType, O as quoteIdent, R as tenantTypeOf, a as customRolesOn, j as quoteTable, k as quoteLiteral, s as signedIn, t as CUSTOM_ROLES } from "./shared-DyYVEjKC.js";
+import { G as byKey, H as rolesTableScope, O as tokenScopesPlan, Q as graphSqlName, V as raiseSql, W as byCodeUnit, Y as apiKeysPlan, a as closureDepths, bt as checkSuspension, i as tablelessResources, o as graphPlan, r as tableNames, t as resolveVias, z as currentKeyExpr } from "./tables-BfOk0ymL.js";
+import { o as assignableRoles, r as unsatisfiedKinds, t as ownershipRules, u as roleNames } from "./ownership-D-mIt-w0.js";
 import { t as membershipSourcesOf } from "./sources-qoIJQrJv.js";
 import { i as group, o as sqlStatements } from "./deciding-columns-NB4wcyBf.js";
-import { d as orSql, h as branchClauses } from "./fields-DI8s3cPl.js";
-import { t as resolveNames } from "./resolve-names-Y1Cb22cp.js";
-import { m as tableFor } from "./verify-DfT0QYNh.js";
+import { d as orSql, h as branchClauses } from "./fields-CrjL6A49.js";
+import { t as resolveNames } from "./resolve-names-CBl4r4_r.js";
+import { m as tableFor } from "./verify-Bpj0hauG.js";
 //#region src/cli/rls/custom-role-rebuild.ts
 const PREFIX = "PermDock CLI";
 /** A column of the roles-table row `r`. */

package/dist/svelte/index.d.ts

@@ -1,14 +1,14 @@
-import { c as requiredPlans } from "../errors-BIM4MFsJ.js";
-import { i as describe } from "../describe-BbFPBSms.js";
+import { c as requiredPlans } from "../errors-TpzkEKgJ.js";
+import { i as describe } from "../describe-BKtC_8PG.js";
 import { t as PermissionBoundaryState } from "../boundary-C9ck-3uK.js";
-import { n as ProtectedAction, t as ActionResult } from "../action-result-BcudBQOF.js";
+import { _ as TenantView, a as ClientPermDock, c as GateMode, d as PermissionState, g as SubjectView, h as RolesOptions, i as ApprovalState, l as GateView, o as ClientStatus, p as ProtectedActionView, r as ApprovalHandle, s as FilterResult, u as PermissionSet, v as ActionResult, y as ProtectedAction } from "../store-DYeB-_U3.js";
+import { a as broadcastChannelRefresh, c as visibilityRefresh, i as authzChangeRefresh, n as EventSourceRefreshOptions, o as eventSourceRefresh, r as RefreshTrigger, s as focusRefresh, t as AuthzChangeRefresh } from "../refresh-on-L9UOwATg.js";
 import { t as approvalHeaders } from "../headers-B9jQxjtW.js";
-import { a as FilterResult, b as eventSourceRefresh, c as PermissionSet, d as ProtectedActionView, h as TenantView, i as ClientStatus, l as PermissionState, m as SubjectView, n as ApprovalState, o as GateMode, p as RolesOptions, r as ClientPermDock, s as GateView, t as ApprovalHandle, v as EventSourceRefreshOptions, y as RefreshTrigger } from "../types-tQB2CEnY.js";
-import { i as ProtectedProps, n as ProtectedActionReadable, r as SveltePermDockOptions, s as PermissionBoundaryProps, t as PermDockDefaults } from "../types-CEinc15V.js";
-import { a as gate, c as memberships, d as protectedAction, f as roles, h as tenant, i as filtered, l as permission, m as subject, n as assignable, o as getDescribe, p as setPermDock, r as assignablePermissions, s as getPermDock, t as approval, u as permissions } from "../stores-DZJvxFIZ.js";
+import { i as ProtectedProps, n as ProtectedActionReadable, r as SveltePermDockOptions, s as PermissionBoundaryProps, t as PermDockDefaults } from "../types-D19MK4t-.js";
+import { a as gate, c as memberships, d as protectedAction, f as roles, h as tenant, i as filtered, l as permission, m as subject, n as assignable, o as getDescribe, p as setPermDock, r as assignablePermissions, s as getPermDock, t as approval, u as permissions } from "../stores-EPul_8MN.js";
 import { Component } from "svelte";
 //#region src/svelte/index.d.ts
 export declare const Protected: Component<ProtectedProps>;
 export declare const PermissionBoundary: Component<PermissionBoundaryProps>;
 //#endregion
-export { type ActionResult, type ApprovalHandle, type ApprovalState, type ClientPermDock, type ClientStatus, type EventSourceRefreshOptions, type FilterResult, type GateMode, type GateView, type PermDockDefaults, type PermissionBoundaryProps, type PermissionBoundaryState, type PermissionSet, type PermissionState, type ProtectedAction, type ProtectedActionReadable, type ProtectedActionView, type ProtectedProps, type RefreshTrigger, type RolesOptions, type SubjectView, type SveltePermDockOptions, type TenantView, approval, approvalHeaders, assignable, assignablePermissions, describe, eventSourceRefresh, filtered, gate, getDescribe, getPermDock, memberships, permission, permissions, protectedAction, requiredPlans, roles, setPermDock, subject, tenant };
+export { type ActionResult, type ApprovalHandle, type ApprovalState, type AuthzChangeRefresh, type ClientPermDock, type ClientStatus, type EventSourceRefreshOptions, type FilterResult, type GateMode, type GateView, type PermDockDefaults, type PermissionBoundaryProps, type PermissionBoundaryState, type PermissionSet, type PermissionState, type ProtectedAction, type ProtectedActionReadable, type ProtectedActionView, type ProtectedProps, type RefreshTrigger, type RolesOptions, type SubjectView, type SveltePermDockOptions, type TenantView, approval, approvalHeaders, assignable, assignablePermissions, authzChangeRefresh, broadcastChannelRefresh, describe, eventSourceRefresh, filtered, focusRefresh, gate, getDescribe, getPermDock, memberships, permission, permissions, protectedAction, requiredPlans, roles, setPermDock, subject, tenant, visibilityRefresh };

package/dist/svelte/index.js

@@ -1,12 +1,12 @@
 import { r as requiredPlans } from "../problem-details-CLDgX1KV.js";
-import { n as describe } from "../describe-Bb4hGK5d.js";
+import { n as describe } from "../describe-BZAlPHxT.js";
 import { n as boundaryFallback, t as boundaryDigest } from "../boundary-BV3O1eud.js";
-import { r as approvalHeaders } from "../protected-action-DUYqb-Ma.js";
-import { u as slotContent } from "../views-CD8wuL4Z.js";
-import { r as eventSourceRefresh } from "../store-options-Dil3lraY.js";
-import { n as getUi, t as getStore } from "../context-BnIzxTNE.js";
-import { n as viewFor, t as scopedFor } from "../runtime-BGnrOkVH.js";
-import { a as gate, c as memberships, d as protectedAction, f as roles, h as tenant, i as filtered, l as permission, m as subject, n as assignable, o as getDescribe, p as setPermDock, r as assignablePermissions, s as getPermDock, t as approval, u as permissions } from "../stores-DxZWDXCs.js";
+import { r as approvalHeaders } from "../protected-action-OpOxtTsN.js";
+import { u as slotContent } from "../views-MWmJ6Y4P.js";
+import { a as eventSourceRefresh, i as broadcastChannelRefresh, o as focusRefresh, r as authzChangeRefresh, s as visibilityRefresh } from "../store-options--zWn48PK.js";
+import { n as getUi, t as getStore } from "../context-DeammvFl.js";
+import { n as viewFor, t as scopedFor } from "../runtime-rf0ZuyF3.js";
+import { a as gate, c as memberships, d as protectedAction, f as roles, h as tenant, i as filtered, l as permission, m as subject, n as assignable, o as getDescribe, p as setPermDock, r as assignablePermissions, s as getPermDock, t as approval, u as permissions } from "../stores-BYFopOm1.js";
 import "svelte/internal/disclose-version";
 import * as $ from "svelte/internal/client";
 import { onDestroy } from "svelte";
@@ -119,4 +119,4 @@ function Protected$1($$anchor, $$props) {
 const Protected = Protected$1;
 const PermissionBoundary = PermissionBoundary$1;
 //#endregion
-export { PermissionBoundary, Protected, approval, approvalHeaders, assignable, assignablePermissions, describe, eventSourceRefresh, filtered, gate, getDescribe, getPermDock, memberships, permission, permissions, protectedAction, requiredPlans, roles, setPermDock, subject, tenant };
+export { PermissionBoundary, Protected, approval, approvalHeaders, assignable, assignablePermissions, authzChangeRefresh, broadcastChannelRefresh, describe, eventSourceRefresh, filtered, focusRefresh, gate, getDescribe, getPermDock, memberships, permission, permissions, protectedAction, requiredPlans, roles, setPermDock, subject, tenant, visibilityRefresh };

package/dist/svelte/runtime.d.ts

@@ -1,7 +1,7 @@
-import { n as DescribeMessages } from "../describe-BbFPBSms.js";
+import { n as DescribeMessages } from "../describe-BKtC_8PG.js";
 import { n as boundaryDigest, r as boundaryFallback, t as PermissionBoundaryState } from "../boundary-C9ck-3uK.js";
-import { g as ClientStore } from "../types-tQB2CEnY.js";
-import { a as scopedFor, c as slotContent, i as ProtectedProps, o as viewFor, s as PermissionBoundaryProps, t as PermDockDefaults } from "../types-CEinc15V.js";
+import { t as ClientStore } from "../store-DYeB-_U3.js";
+import { a as scopedFor, c as slotContent, i as ProtectedProps, o as viewFor, s as PermissionBoundaryProps, t as PermDockDefaults } from "../types-D19MK4t-.js";
 //#region src/svelte/context.d.ts
 /** The provider's `defaults` and `messages`. */
 type PermDockUi = {

package/dist/svelte/runtime.js

@@ -1,5 +1,5 @@
 import { n as boundaryFallback, t as boundaryDigest } from "../boundary-BV3O1eud.js";
-import { u as slotContent } from "../views-CD8wuL4Z.js";
-import { n as getUi, t as getStore } from "../context-BnIzxTNE.js";
-import { n as viewFor, t as scopedFor } from "../runtime-BGnrOkVH.js";
+import { u as slotContent } from "../views-MWmJ6Y4P.js";
+import { n as getUi, t as getStore } from "../context-DeammvFl.js";
+import { n as viewFor, t as scopedFor } from "../runtime-rf0ZuyF3.js";
 export { boundaryDigest, boundaryFallback, getStore, getUi, scopedFor, slotContent, viewFor };

package/dist/svelte/source.d.ts

@@ -1,14 +1,14 @@
-import { c as requiredPlans } from "../errors-BIM4MFsJ.js";
-import { i as describe } from "../describe-BbFPBSms.js";
+import { c as requiredPlans } from "../errors-TpzkEKgJ.js";
+import { i as describe } from "../describe-BKtC_8PG.js";
 import { t as PermissionBoundaryState } from "../boundary-C9ck-3uK.js";
-import { n as ProtectedAction, t as ActionResult } from "../action-result-BcudBQOF.js";
+import { _ as TenantView, a as ClientPermDock, c as GateMode, d as PermissionState, g as SubjectView, h as RolesOptions, i as ApprovalState, l as GateView, o as ClientStatus, p as ProtectedActionView, r as ApprovalHandle, s as FilterResult, u as PermissionSet, v as ActionResult, y as ProtectedAction } from "../store-DYeB-_U3.js";
+import { a as broadcastChannelRefresh, c as visibilityRefresh, i as authzChangeRefresh, n as EventSourceRefreshOptions, o as eventSourceRefresh, r as RefreshTrigger, s as focusRefresh, t as AuthzChangeRefresh } from "../refresh-on-L9UOwATg.js";
 import { t as approvalHeaders } from "../headers-B9jQxjtW.js";
-import { a as FilterResult, b as eventSourceRefresh, c as PermissionSet, d as ProtectedActionView, h as TenantView, i as ClientStatus, l as PermissionState, m as SubjectView, n as ApprovalState, o as GateMode, p as RolesOptions, r as ClientPermDock, s as GateView, t as ApprovalHandle, v as EventSourceRefreshOptions, y as RefreshTrigger } from "../types-tQB2CEnY.js";
-import { i as ProtectedProps, n as ProtectedActionReadable, r as SveltePermDockOptions, s as PermissionBoundaryProps, t as PermDockDefaults } from "../types-CEinc15V.js";
-import { a as gate, c as memberships, d as protectedAction, f as roles, h as tenant, i as filtered, l as permission, m as subject, n as assignable, o as getDescribe, p as setPermDock, r as assignablePermissions, s as getPermDock, t as approval, u as permissions } from "../stores-DZJvxFIZ.js";
+import { i as ProtectedProps, n as ProtectedActionReadable, r as SveltePermDockOptions, s as PermissionBoundaryProps, t as PermDockDefaults } from "../types-D19MK4t-.js";
+import { a as gate, c as memberships, d as protectedAction, f as roles, h as tenant, i as filtered, l as permission, m as subject, n as assignable, o as getDescribe, p as setPermDock, r as assignablePermissions, s as getPermDock, t as approval, u as permissions } from "../stores-EPul_8MN.js";
 import { Component } from "svelte";
 //#region src/svelte/source.d.ts
 export declare const Protected: Component<ProtectedProps>;
 export declare const PermissionBoundary: Component<PermissionBoundaryProps>;
 //#endregion
-export { type ActionResult, type ApprovalHandle, type ApprovalState, type ClientPermDock, type ClientStatus, type EventSourceRefreshOptions, type FilterResult, type GateMode, type GateView, type PermDockDefaults, type PermissionBoundaryProps, type PermissionBoundaryState, type PermissionSet, type PermissionState, type ProtectedAction, type ProtectedActionReadable, type ProtectedActionView, type ProtectedProps, type RefreshTrigger, type RolesOptions, type SubjectView, type SveltePermDockOptions, type TenantView, approval, approvalHeaders, assignable, assignablePermissions, describe, eventSourceRefresh, filtered, gate, getDescribe, getPermDock, memberships, permission, permissions, protectedAction, requiredPlans, roles, setPermDock, subject, tenant };
+export { type ActionResult, type ApprovalHandle, type ApprovalState, type AuthzChangeRefresh, type ClientPermDock, type ClientStatus, type EventSourceRefreshOptions, type FilterResult, type GateMode, type GateView, type PermDockDefaults, type PermissionBoundaryProps, type PermissionBoundaryState, type PermissionSet, type PermissionState, type ProtectedAction, type ProtectedActionReadable, type ProtectedActionView, type ProtectedProps, type RefreshTrigger, type RolesOptions, type SubjectView, type SveltePermDockOptions, type TenantView, approval, approvalHeaders, assignable, assignablePermissions, authzChangeRefresh, broadcastChannelRefresh, describe, eventSourceRefresh, filtered, focusRefresh, gate, getDescribe, getPermDock, memberships, permission, permissions, protectedAction, requiredPlans, roles, setPermDock, subject, tenant, visibilityRefresh };

package/dist/svelte/source.js

@@ -1,12 +1,12 @@
 import { r as requiredPlans } from "../problem-details-CLDgX1KV.js";
-import { n as describe } from "../describe-Bb4hGK5d.js";
-import { r as approvalHeaders } from "../protected-action-DUYqb-Ma.js";
-import { r as eventSourceRefresh } from "../store-options-Dil3lraY.js";
-import { a as gate, c as memberships, d as protectedAction, f as roles, h as tenant, i as filtered, l as permission, m as subject, n as assignable, o as getDescribe, p as setPermDock, r as assignablePermissions, s as getPermDock, t as approval, u as permissions } from "../stores-DxZWDXCs.js";
+import { n as describe } from "../describe-BZAlPHxT.js";
+import { r as approvalHeaders } from "../protected-action-OpOxtTsN.js";
+import { a as eventSourceRefresh, i as broadcastChannelRefresh, o as focusRefresh, r as authzChangeRefresh, s as visibilityRefresh } from "../store-options--zWn48PK.js";
+import { a as gate, c as memberships, d as protectedAction, f as roles, h as tenant, i as filtered, l as permission, m as subject, n as assignable, o as getDescribe, p as setPermDock, r as assignablePermissions, s as getPermDock, t as approval, u as permissions } from "../stores-BYFopOm1.js";
 import PermissionBoundaryComponent from "./PermissionBoundary.svelte";
 import ProtectedComponent from "./Protected.svelte";
 //#region src/svelte/source.ts
 const Protected = ProtectedComponent;
 const PermissionBoundary = PermissionBoundaryComponent;
 //#endregion
-export { PermissionBoundary, Protected, approval, approvalHeaders, assignable, assignablePermissions, describe, eventSourceRefresh, filtered, gate, getDescribe, getPermDock, memberships, permission, permissions, protectedAction, requiredPlans, roles, setPermDock, subject, tenant };
+export { PermissionBoundary, Protected, approval, approvalHeaders, assignable, assignablePermissions, authzChangeRefresh, broadcastChannelRefresh, describe, eventSourceRefresh, filtered, focusRefresh, gate, getDescribe, getPermDock, memberships, permission, permissions, protectedAction, requiredPlans, roles, setPermDock, subject, tenant, visibilityRefresh };

package/dist/sveltekit/index.d.ts

@@ -1,9 +1,9 @@
-import { T as Policy, Zt as Snapshot, j as PolicyVocabulary, pr as Principal } from "../policy-types-DGIO_gxq.js";
+import { $t as Snapshot, E as Policy, M as PolicyVocabulary, _r as Principal } from "../policy-types-D-GwfQTc.js";
 import { u as Permission } from "../permission-types-CAY-GU7e.js";
 import { a as OperationInput, t as Operation } from "../operations-Ci_rT6Uo.js";
-import { a as PermDock } from "../permdock-CprAPN3w.js";
-import { D as ConnectionOptions, T as Connection, f as InvalidSignatureError, i as OpenApiHooks, o as ProtectOptions, u as SnapshotQuery, v as discoverViaSignatureAgent, x as webBotAuthVerifier } from "../server-types-CyRN0-Cd.js";
-import { a as ProtectTarget, i as PermDockHandlers, n as FetchAdapterOptions, t as ContextReader } from "../fetch-adapter-BIbBAtPZ.js";
+import { a as PermDock } from "../permdock-ffY4CMd9.js";
+import { D as ConnectionOptions, T as Connection, f as InvalidSignatureError, i as OpenApiHooks, o as ProtectOptions, u as SnapshotQuery, v as discoverViaSignatureAgent, x as webBotAuthVerifier } from "../server-types-3OnXjZ2D.js";
+import { a as ProtectTarget, i as PermDockHandlers, n as FetchAdapterOptions, t as ContextReader } from "../fetch-adapter-BdmfnbJM.js";
 import { RequestEvent } from "@sveltejs/kit";
 //#region src/sveltekit/create.d.ts
 /**

package/dist/sveltekit/index.js

@@ -1,5 +1,5 @@
-import { l as InvalidSignatureError, p as webBotAuthVerifier, u as discoverViaSignatureAgent } from "../evaluations-IBceAeKT.js";
-import { n as guardedRoute, r as instanceRoute, t as fetchAdapter } from "../fetch-adapter-dPTgJVHd.js";
+import { l as InvalidSignatureError, p as webBotAuthVerifier, u as discoverViaSignatureAgent } from "../evaluations-h3KoJAPa.js";
+import { n as guardedRoute, r as instanceRoute, t as fetchAdapter } from "../fetch-adapter-DH-NJPbL.js";
 //#region src/sveltekit/create.ts
 const route = {
 	context: (event) => event,

package/dist/{tables-DimBcVWY.js → tables-BfOk0ymL.js}

@@ -1,15 +1,15 @@
 import { c as listPermissions, h as formerKeys } from "./permission-registry-B8tYxPIt.js";
 import { a as expandRelation, c as isEdgeRelation, d as isSelfParented, l as isFieldRelation, o as groupEntries, p as restrictedFor, u as isPrincipalRelation } from "./resource-relations-8-pCScBO.js";
-import { f as scopeList, l as rootScope, s as resolveScope, u as scopeChain } from "./scopes-0Up_UA2t.js";
+import { c as rootScope, d as scopeList, l as scopeChain, s as resolveScope } from "./scopes-BSdYaGHs.js";
 import { o as flattenGrantee } from "./grantee-Dke-9rd1.js";
-import { r as relationCondition, t as inheritCondition } from "./grantee-conditions-BrYPe-w0.js";
-import { l as partitionsOf, p as scopeField } from "./tenancy-5d1zVBvK.js";
-import { a as delegatedScopeMap } from "./permdock-BvjivVb9.js";
-import { i as configError } from "./errors-Vpu6rKHl.js";
+import { r as relationCondition, t as inheritCondition } from "./grantee-conditions-DX4K_gGI.js";
+import { l as partitionsOf, p as scopeField } from "./tenancy-DvOHHk3-.js";
+import { a as delegatedScopeMap } from "./permdock-D-_WrdKu.js";
+import { i as configError } from "./errors-BhRkoNS7.js";
 import { d as sqlTextArray, i as qualifySqlTable, t as SQL_IDENT } from "./sql-0WjxIp9g.js";
-import { a as scopeMembershipTable, d as restrictedRowsSql, i as scopeColumn, l as relationArmSql } from "./compile-EzEMB-7v.js";
+import { a as scopeMembershipTable, d as restrictedRowsSql, i as scopeColumn, l as relationArmSql } from "./compile-B_oJqmIg.js";
 import { d as keptKeys, l as roleColumn, u as roleManifest } from "./sources-C4vkzZJV.js";
-import { A as quoteQualified, D as qualified, E as helperSchema, I as scopeTypeOf, O as quoteIdent, R as tenantTypeOf, _ as subjectClaimJsonSql, d as keyTenantSql, f as kindFilterSql, h as roleKindSql, i as allowEntry, j as quoteTable, k as quoteLiteral, m as memberVia, n as GLOBAL_ROLES, o as rootName, r as HELPERS, s as signedIn, t as CUSTOM_ROLES, u as globalKindFilterSql, v as subjectClaimSql, w as CLI, x as userIdHelperSql, y as subjectIdSql } from "./shared-DrGLwM3s.js";
+import { A as quoteQualified, D as qualified, E as helperSchema, I as scopeTypeOf, O as quoteIdent, R as tenantTypeOf, _ as subjectClaimJsonSql, d as keyTenantSql, f as kindFilterSql, h as roleKindSql, i as allowEntry, j as quoteTable, k as quoteLiteral, m as memberVia, n as GLOBAL_ROLES, o as rootName, r as HELPERS, s as signedIn, t as CUSTOM_ROLES, u as globalKindFilterSql, v as subjectClaimSql, w as CLI, x as userIdHelperSql, y as subjectIdSql } from "./shared-DyYVEjKC.js";
 //#region src/cli/sql/active.ts
 function checkActiveRow(label, row) {
 	quoteTable(row.table);

package/dist/tanstack-start/index.d.ts

@@ -1,9 +1,9 @@
-import { T as Policy, Zt as Snapshot, j as PolicyVocabulary, pr as Principal } from "../policy-types-DGIO_gxq.js";
+import { $t as Snapshot, E as Policy, M as PolicyVocabulary, _r as Principal } from "../policy-types-D-GwfQTc.js";
 import { u as Permission } from "../permission-types-CAY-GU7e.js";
 import { a as OperationInput, t as Operation } from "../operations-Ci_rT6Uo.js";
-import { a as PermDock } from "../permdock-CprAPN3w.js";
-import { D as ConnectionOptions, T as Connection, f as InvalidSignatureError, i as OpenApiHooks, o as ProtectOptions, u as SnapshotQuery, v as discoverViaSignatureAgent, x as webBotAuthVerifier } from "../server-types-CyRN0-Cd.js";
-import { a as ProtectTarget, n as FetchAdapterOptions, t as ContextReader } from "../fetch-adapter-BIbBAtPZ.js";
+import { a as PermDock } from "../permdock-ffY4CMd9.js";
+import { D as ConnectionOptions, T as Connection, f as InvalidSignatureError, i as OpenApiHooks, o as ProtectOptions, u as SnapshotQuery, v as discoverViaSignatureAgent, x as webBotAuthVerifier } from "../server-types-3OnXjZ2D.js";
+import { a as ProtectTarget, n as FetchAdapterOptions, t as ContextReader } from "../fetch-adapter-BdmfnbJM.js";
 import { RequestMiddleware, RequestMiddlewareAfterServer, createMiddleware } from "@tanstack/react-start";
 //#region src/tanstack-start/create.d.ts
 type TanStackStartPermDockOptions<TUser = unknown> = FetchAdapterOptions<Request, TUser>;

package/dist/tanstack-start/index.js

@@ -1,5 +1,5 @@
-import { l as InvalidSignatureError, p as webBotAuthVerifier, u as discoverViaSignatureAgent } from "../evaluations-IBceAeKT.js";
-import { t as fetchAdapter } from "../fetch-adapter-dPTgJVHd.js";
+import { l as InvalidSignatureError, p as webBotAuthVerifier, u as discoverViaSignatureAgent } from "../evaluations-h3KoJAPa.js";
+import { t as fetchAdapter } from "../fetch-adapter-DH-NJPbL.js";
 import { createMiddleware } from "@tanstack/react-start";
 //#region src/tanstack-start/create.ts
 function createPermDock(policy, options) {

package/dist/{tenancy-5d1zVBvK.js → tenancy-DvOHHk3-.js}

@@ -1,7 +1,7 @@
 import { o as sameId, t as expiredAt } from "./expiry-6XByK0dm.js";
 import { l as isFieldRelation } from "./resource-relations-8-pCScBO.js";
 import { o as epochSeconds } from "./time-nR1JesoH.js";
-import { d as scopeIdOf, h as tenantOf, l as rootScope, r as findScope, s as resolveScope, t as activeFor, u as scopeChain } from "./scopes-0Up_UA2t.js";
+import { c as rootScope, l as scopeChain, p as tenantOf, r as findScope, s as resolveScope, t as activeFor, u as scopeIdOf } from "./scopes-BSdYaGHs.js";
 //#region src/core/tenancy.ts
 function nowSeconds(now) {
 	return now ?? epochSeconds();

package/dist/terminal/index.d.ts

@@ -1,9 +1,9 @@
-import { T as Policy, Un as Decision, Wt as Instant, hr as Subject, j as PolicyVocabulary, pr as Principal } from "../policy-types-DGIO_gxq.js";
+import { E as Policy, Kt as Instant, M as PolicyVocabulary, _r as Principal, qn as Decision, yr as Subject } from "../policy-types-D-GwfQTc.js";
 import { u as Permission } from "../permission-types-CAY-GU7e.js";
-import { a as PermDock } from "../permdock-CprAPN3w.js";
-import { m as ApprovalStore } from "../types-DLvhVm1r.js";
-import { a as ProblemDetails, t as ApprovalHint } from "../errors-BIM4MFsJ.js";
-import { t as InstanceOptions } from "../instance-options-CoHn-0e8.js";
+import { a as PermDock } from "../permdock-ffY4CMd9.js";
+import { m as ApprovalStore } from "../types-CqcsNCaN.js";
+import { a as ProblemDetails, t as ApprovalHint } from "../errors-TpzkEKgJ.js";
+import { t as InstanceOptions } from "../instance-options-2sFGSdsf.js";
 //#region src/terminal/types.d.ts
 type TokenSourceName = "device" | "keychain" | "env" | "ci-oidc";
 type TokenSource = TokenSourceName | {

package/dist/terminal/index.js

@@ -1,13 +1,13 @@
 import { t as compact } from "../compact-CAf557ZB.js";
 import { a as deniedMessage, i as approvalMessage, n as PermDockDeniedError, t as PermDockApprovalRequiredError } from "../errors-B6R_lg2a.js";
 import { h as secondsAt } from "../time-nR1JesoH.js";
+import { r as isSubject } from "../subject-C7RddW0G.js";
 import { n as resourceRef } from "../resource-ref-CaS9yVPi.js";
-import { l as withApp } from "../permdock-BvjivVb9.js";
-import { r as isSubject } from "../subject-BGoM5o8B.js";
+import { l as withApp } from "../permdock-D-_WrdKu.js";
 import { n as readBodyText } from "../body-text-DQhcmqdY.js";
-import { l as storedApprovalToken, s as resumeDecision } from "../helpers-DJicaG6f.js";
+import { l as storedApprovalToken, s as resumeDecision } from "../helpers-DmqGy63f.js";
 import { t as timeoutSignal } from "../timeout-D51niuQP.js";
-import { n as resolveOrNull, t as buildInstance } from "../build-instance-BWXqwQYU.js";
+import { n as resolveOrNull, t as buildInstance } from "../build-instance-BFMFQdE_.js";
 import { a as refreshCredential, o as revokeCredential, s as runDeviceFlow, t as TERMINAL_TIMEOUT_MS } from "../device-BwbJNmb2.js";
 import { i as writeCredentials, n as deleteCredentials, r as readCredentials } from "../storage-C2bWdvJH.js";
 import { createInterface } from "node:readline";
@@ -241,12 +241,12 @@ function envOf(options) {
 }
 /**
 * The local y/N is the requester answering for themselves, so it stands in for
-* an approval only where the grant allows that (`distinct: false`) and no agent
+* an approval only where the grant allows that (`mode: 'confirm'`) and no agent
 * is acting for the user.
 */
 function answersLocally(decision, subject) {
 	const approval = decision.grant.approval;
-	return typeof approval === "object" && approval.distinct === false && subject.actor === void 0;
+	return typeof approval === "object" && approval.mode === "confirm" && subject.actor === void 0;
 }
 function isInteractive(options) {
 	if (typeof options.interactive === "boolean") return options.interactive;

package/dist/testing/core.d.ts

@@ -1,2 +1,2 @@
-import { S as policyMatrix, _ as DescribePolicyConfig, a as OrmParityScenario, b as PolicyMatrixCell, c as RlsFieldsOutcome, d as RlsParityOptions, f as RlsParityReport, g as testRlsParity, h as RlsQueryResult, i as OrmParityRunInput, l as RlsParityCase, m as RlsQueryFn, n as OrmParityOptions, o as testOrmParity, p as RlsParitySubject, r as OrmParityReport, s as RlsDbOutcome, t as OrmParityCase, u as RlsParityFixture, v as MatrixCell, x as PolicyMatrixReport, y as MatrixOutcome } from "../core-CFepFiDP.js";
+import { S as policyMatrix, _ as DescribePolicyConfig, a as OrmParityScenario, b as PolicyMatrixCell, c as RlsFieldsOutcome, d as RlsParityOptions, f as RlsParityReport, g as testRlsParity, h as RlsQueryResult, i as OrmParityRunInput, l as RlsParityCase, m as RlsQueryFn, n as OrmParityOptions, o as testOrmParity, p as RlsParitySubject, r as OrmParityReport, s as RlsDbOutcome, t as OrmParityCase, u as RlsParityFixture, v as MatrixCell, x as PolicyMatrixReport, y as MatrixOutcome } from "../core-D87h2kpR.js";
 export { type DescribePolicyConfig, type MatrixCell, type MatrixOutcome, type OrmParityCase, type OrmParityOptions, type OrmParityReport, type OrmParityRunInput, type OrmParityScenario, type PolicyMatrixCell, type PolicyMatrixReport, type RlsDbOutcome, type RlsFieldsOutcome, type RlsParityCase, type RlsParityFixture, type RlsParityOptions, type RlsParityReport, type RlsParitySubject, type RlsQueryFn, type RlsQueryResult, policyMatrix, testOrmParity, testRlsParity };

package/dist/testing/core.js

@@ -1 +1 @@
-export { r as policyMatrix, t as testOrmParity, n as testRlsParity } from "../core-lxoANyai.js";
+export { r as policyMatrix, t as testOrmParity, n as testRlsParity } from "../core-B8sLve3z.js";

package/dist/testing/fixtures/index.d.ts

@@ -1,4 +1,4 @@
-import { a as CatalogDocument } from "../../types-ZzRGoViD.js";
+import { a as CatalogDocument } from "../../types-NYoj8JBm.js";
 import { i as SupabaseManifest } from "../../manifest-B5yF3CIq.js";
 //#region src/testing/fixtures/index.d.ts
 /**

package/dist/testing/fixtures/index.js

@@ -1,5 +1,5 @@
-import { n as parseSupabaseManifest } from "../../manifest-BXTbHNIV.js";
-import { t as parseCatalog } from "../../parse-1_ZheTW5.js";
+import { n as parseSupabaseManifest } from "../../manifest-BdzBobNK.js";
+import { t as parseCatalog } from "../../parse-UTC-sDrt.js";
 //#region src/testing/fixtures/better-supabase.catalog.json
 var better_supabase_catalog_default = {
 	$schema: "https://permdock.com/schemas/catalog-v1.json",

package/dist/testing/index.d.ts

@@ -1,30 +1,31 @@
-import { G as CustomRoleSource, J as DecisionSink, T as Policy, U as CredentialVerifier, Y as EntitlementSource, Zt as Snapshot, bt as WhereCompiler, ct as SnapshotSource, dt as SubjectResolver, et as LimitStore, fr as Membership, hr as Subject, ht as TokenVerifier, mt as TokenSigner, nt as MembershipSource, ot as RelationSource, pr as Principal, q as DecisionProvider, sn as DeliveryChannel, st as SettingsSource } from "../policy-types-DGIO_gxq.js";
+import { $t as Snapshot, E as Policy, J as DecisionProvider, K as CustomRoleSource, St as WhereCompiler, W as CredentialVerifier, X as EntitlementSource, Y as DecisionSink, _r as Principal, _t as TokenVerifier, ct as SettingsSource, gr as Membership, gt as TokenSigner, ln as DeliveryChannel, lt as SnapshotSource, pt as SubjectResolver, rt as MembershipSource, st as RelationSource, tt as LimitStore, yr as Subject } from "../policy-types-D-GwfQTc.js";
 import { g as ResourceInit, l as InferPermissionTree, u as Permission } from "../permission-types-CAY-GU7e.js";
 import { r as Role } from "../vocabulary-DEJ5j4mR.js";
-import { st as LegacyCheck } from "../index-Cay5-Kvx.js";
-import { D as ApprovalPolicySource, _ as PrincipalSource, a as PermDock, b as Limits, h as PrincipalIdentity } from "../permdock-CprAPN3w.js";
-import { s as PolicySource } from "../hosted-DVxlLZMe.js";
-import { a as ApprovalDelegationSource, m as ApprovalStore } from "../types-DLvhVm1r.js";
-import { a as ProblemDetails } from "../errors-BIM4MFsJ.js";
-import { c as ModelMap, t as AgentPermDock, u as ToolMap } from "../create-BPUopdfL.js";
-import { c as AccessReviewStore } from "../types-B2efzoSX.js";
-import { R as IdempotencyStore } from "../index-DJwEgYzA.js";
+import { st as LegacyCheck } from "../index-CdUTE6qd.js";
+import { i as ApprovalPolicySource } from "../approval-policies-oNnckT12.js";
+import { _ as PrincipalSource, a as PermDock, b as Limits, h as PrincipalIdentity, w as InstanceCache } from "../permdock-ffY4CMd9.js";
+import { s as PolicySource } from "../hosted-BFNXwcjd.js";
+import { a as ApprovalDelegationSource, m as ApprovalStore } from "../types-CqcsNCaN.js";
+import { a as ProblemDetails } from "../errors-TpzkEKgJ.js";
+import { c as ModelMap, t as AgentPermDock, u as ToolMap } from "../create-BzwjZuRS.js";
+import { c as AccessReviewStore } from "../types-CDVXR6YD.js";
+import { R as IdempotencyStore } from "../index-CdMOd-GY.js";
 import { n as RevocationFeed } from "../revocations-BaUXHM1N.js";
-import { s as SupportSessionSource } from "../index-CV-7DWeD.js";
+import { s as SupportSessionSource } from "../index-rFp6X_QP.js";
+import { n as VersionCache } from "../version-cache-DzNKWiI6.js";
 import { r as SupabaseHookManifest } from "../manifest-B5yF3CIq.js";
-import { n as VersionCache } from "../version-cache-Df11C2Qp.js";
-import { t as supabaseMembershipsBudget } from "../budget-hYsPz_yE.js";
-import { a as AutomationSource, t as Automation } from "../automation-C6Jg75xq.js";
-import { c as DeliveryTransport, g as TransportMessages } from "../types-CN0LsqbK.js";
-import { t as CloudApproverOptions } from "../types-BB-zWDcR.js";
-import { n as ApprovalWaiter } from "../waiter-CqUKX6CY.js";
-import { g as SetQueue, l as ReplayStore } from "../types-DsHGPtkR.js";
-import { r as SnapshotStorage } from "../types-CWBsAwqn.js";
-import { x as DirectoryStore } from "../index-Dj2qF9VC.js";
-import { S as SsfStreamStore } from "../index-BinlXeU-.js";
-import { S as policyMatrix, _ as DescribePolicyConfig, a as OrmParityScenario, b as PolicyMatrixCell, c as RlsFieldsOutcome, d as RlsParityOptions, f as RlsParityReport, g as testRlsParity, h as RlsQueryResult, i as OrmParityRunInput, l as RlsParityCase, m as RlsQueryFn, n as OrmParityOptions, o as testOrmParity, p as RlsParitySubject, r as OrmParityReport, s as RlsDbOutcome, t as OrmParityCase, u as RlsParityFixture, v as MatrixCell, x as PolicyMatrixReport, y as MatrixOutcome } from "../core-CFepFiDP.js";
+import { t as supabaseMembershipsBudget } from "../budget-CNLsV2SL.js";
+import { a as AutomationSource, t as Automation } from "../automation-Bfa_wD1h.js";
+import { c as DeliveryTransport, g as TransportMessages } from "../types-CCEeSCMB.js";
+import { t as CloudApproverOptions } from "../types-D-JO7lh8.js";
+import { n as ApprovalWaiter } from "../waiter-NK_UuZbb.js";
+import { g as SetQueue, l as ReplayStore } from "../types-Ck1KOfug.js";
+import { r as SnapshotStorage } from "../types-o1vu6Ks3.js";
+import { x as DirectoryStore } from "../index-Dfv9Toct.js";
+import { S as SsfStreamStore } from "../index-BhnOOnp9.js";
+import { S as policyMatrix, _ as DescribePolicyConfig, a as OrmParityScenario, b as PolicyMatrixCell, c as RlsFieldsOutcome, d as RlsParityOptions, f as RlsParityReport, g as testRlsParity, h as RlsQueryResult, i as OrmParityRunInput, l as RlsParityCase, m as RlsQueryFn, n as OrmParityOptions, o as testOrmParity, p as RlsParitySubject, r as OrmParityReport, s as RlsDbOutcome, t as OrmParityCase, u as RlsParityFixture, v as MatrixCell, x as PolicyMatrixReport, y as MatrixOutcome } from "../core-D87h2kpR.js";
 import { a as SaasProject } from "../permissions-Bx6UI8n1.js";
-import { n as saasPolicy } from "../policy-BycVKnXv.js";
+import { n as saasPolicy } from "../policy-BtKSApSt.js";
 import { expectTypeOf } from "vitest";
 //#region src/testing/describe-policy.d.ts
 /** `policyMatrix` under Vitest: one test per cell, plus the exhaustive check. */
@@ -642,6 +643,12 @@ export declare function testPolicySource(source: PolicySource, options?: {
   readonly policy?: Policy;
 }): void;
 export declare function testVersionCache(cache: VersionCache): void;
+/**
+ * The `InstanceCache` contract: one build per key while it lives, a shared
+ * build in flight, no stored rejection, and `evict` dropping a principal's
+ * entries.
+ */
+export declare function testInstanceCache(cache: InstanceCache): void;
 //#endregion
 //#region src/testing/conformance/providers.d.ts
 type DecisionProviderRunnerOptions = {