permdock 0.16.0 → 0.18.0

package/dist/testing/index.js

@@ -1,44 +1,45 @@
 import { r as isRecord } from "../compact-CAf557ZB.js";
 import { n as freezeDeep } from "../freeze-jjan0lCv.js";
 import { i as principal } from "../refs-C8BKxc_e.js";
-import { n as role, r as allow } from "../role-builder-BK2-T6oD.js";
-import { C as memoryLimitStore, E as approvalPoliciesFor, S as limits, d as snapshotFor, j as memoryCustomRoleSource } from "../src-C_pi2Rnh.js";
+import { n as role, r as allow } from "../role-builder-CMW4wWzn.js";
+import { A as memoryCustomRoleSource, C as limits, D as approvalPoliciesFor, d as snapshotFor, w as memoryLimitStore } from "../src-Brzq_0in.js";
 import { t as memoryRevocationFeed } from "../revocations-Bhr0aMIC.js";
 import { n as loadPrincipalByIdentity, t as loadPrincipal } from "../principal-source-C6N60GtM.js";
 import { v as resource } from "../permission-registry-B8tYxPIt.js";
 import { d as isoNow, f as nowMillis, p as nowSeconds, u as isoAt } from "../time-nR1JesoH.js";
 import { r as parseAutomation } from "../automation-x3KEUusw.js";
-import { f as scopeList, o as normalizeMemberships } from "../scopes-0Up_UA2t.js";
-import { u as evaluateCondition } from "../delegation-CDB6_keF.js";
+import { d as scopeList, o as normalizeMemberships } from "../scopes-BSdYaGHs.js";
+import { u as evaluateCondition } from "../delegation-aK4T_5WU.js";
 import { a as authenticated } from "../grantee-Dke-9rd1.js";
 import { t as byCodePoint } from "../compare-DTfyUunF.js";
-import { r as definePolicy } from "../policy-CLQ8__GF.js";
-import { c as mergeHostedGrants, l as parsePolicyDocument } from "../hosted-D0IzESu_.js";
-import { t as definePermissions } from "../permissions-CVXmRILq.js";
-import { T as validateCustomRole } from "../evaluate-BAmf_AQd.js";
-import { n as parseSnapshot } from "../snapshot-CXlzi69u.js";
-import { n as fromSnapshot } from "../from-snapshot-DCakWRsr.js";
-import { t as getPermDock } from "../permdock-BvjivVb9.js";
+import { r as definePolicy } from "../policy-cV_wwPb8.js";
+import { c as mergeHostedGrants, l as parsePolicyDocument } from "../hosted-waouw2V-.js";
+import { i as rootMembershipId } from "../subject-C7RddW0G.js";
+import { T as validateCustomRole } from "../evaluate-Czbj7thS.js";
+import { n as parseSnapshot } from "../snapshot-DN_8J27z.js";
+import { n as fromSnapshot } from "../from-snapshot-DMlSSo9b.js";
+import { t as getPermDock } from "../permdock-D-_WrdKu.js";
 import { t as APPROVAL_HEADER } from "../types-CcUXciSj.js";
-import { i as memoryApprovalStore } from "../store-RNFvaJJv.js";
+import { i as memoryApprovalStore } from "../store-DmVqy74I.js";
+import { t as definePermissions } from "../permissions-BaoLxy66.js";
 import { t as catalogFingerprint } from "../catalog-fingerprint-e6aCWosn.js";
-import { s as parseCredential } from "../credential-CyyyvCsL.js";
+import { s as parseCredential } from "../credential-B3Hj4puZ.js";
 import { c as problemFromDecision } from "../problem-BVLHFK33.js";
-import { o as resolveApproval } from "../helpers-DJicaG6f.js";
-import { t as APPROVAL_REQUEST_SCHEMA } from "../request-schema-DhX7UbfQ.js";
-import { t as catalogSchema } from "../schema-BOJjqlWL.js";
-import { t as supabaseMembershipsBudget } from "../budget-BELja5A9.js";
-import { c as parseApiKey } from "../server-3cVlTLde.js";
+import { o as resolveApproval } from "../helpers-DmqGy63f.js";
+import { t as APPROVAL_REQUEST_SCHEMA } from "../request-schema-CMP8Cmxd.js";
+import { t as catalogSchema } from "../schema-CuX70xgH.js";
+import { t as supabaseMembershipsBudget } from "../budget-BBCPDOGP.js";
+import { c as parseApiKey } from "../server-D0PW6ZCw.js";
 import { n as discoverAuthorizationServer } from "../device-BwbJNmb2.js";
 import { t as CONNECTOR_SCHEMA } from "../connector-schema-CYLQNMYq.js";
-import { l as sha256Hex, n as scimHandler, t as directoryMembershipSource } from "../scim-jJBJ7g1Z.js";
+import { l as sha256Hex, n as scimHandler, t as directoryMembershipSource } from "../scim-C30QBBoF.js";
 import { c as quoteSqlTable, o as quoteSqlIdent } from "../sql-0WjxIp9g.js";
-import { i as cloudEndpoints, n as cloud, s as approverHeaders, t as bearerChallenge } from "../challenge-DImNcR7B.js";
-import { t as supabaseManifestSchema } from "../manifest-schema-DQkBK2Mr.js";
-import { t as PUSHED_POLICY_SCHEMA } from "../pushed-policy-CDuOL2de.js";
-import { i as policyMatrixLayout, n as testRlsParity, r as policyMatrix, t as testOrmParity } from "../core-lxoANyai.js";
-import { i as saasPermissions } from "../permissions-CYcHj_w7.js";
-import { C as saasOrg, E as saasSeed, S as saasMemberships, a as saasProject, g as verifySaasSession, h as signSaasToken, k as saasPolicy, t as saasDoc, w as saasPrincipal, x as saasCustomRoles } from "../saas-DK4V-3Is.js";
+import { i as cloudEndpoints, n as cloud, s as approverHeaders, t as bearerChallenge } from "../challenge-B2O2OLEk.js";
+import { t as supabaseManifestSchema } from "../manifest-schema-CsFsYLF-.js";
+import { t as PUSHED_POLICY_SCHEMA } from "../pushed-policy-BecMsTtM.js";
+import { i as policyMatrixLayout, n as testRlsParity, r as policyMatrix, t as testOrmParity } from "../core-B8sLve3z.js";
+import { i as saasPermissions } from "../permissions-B3ggI88M.js";
+import { C as saasOrg, E as saasSeed, S as saasMemberships, a as saasProject, g as verifySaasSession, h as signSaasToken, k as saasPolicy, t as saasDoc, w as saasPrincipal, x as saasCustomRoles } from "../saas-B8H1MsQ3.js";
 import { t as POLICY_NOT_PUBLISHED } from "../problem-types-DSsRfONQ.js";
 import { t as require__2020 } from "../2020-CJbO8Bvz.js";
 import { afterAll, assert, beforeAll, describe, expect, expectTypeOf, it, vi } from "vitest";
@@ -135,12 +136,14 @@ function leadSnapshot() {
 		memberships: [
 			...saasMemberships("gina"),
 			{
-				tenant: "globex",
+				scope: "tenant",
+				id: "globex",
 				roles: ["viewer"]
 			},
 			{
-				tenant: "globex",
-				team: "team-a",
+				within: { tenant: "globex" },
+				scope: "team",
+				id: "team-a",
 				roles: ["lead"]
 			}
 		]
@@ -573,7 +576,10 @@ function createDomain$2() {
 		const principal = saasPrincipal(sub, orgOf(path));
 		return {
 			...principal,
-			memberships: (principal.memberships ?? []).filter((membership) => membership.tenant === void 0 || !demoted.has(demotionKey(sub, membership.tenant)))
+			memberships: (principal.memberships ?? []).filter((membership) => {
+				const tenant = membership.within?.["tenant"] ?? rootMembershipId(membership);
+				return tenant === void 0 || !demoted.has(demotionKey(sub, tenant));
+			})
 		};
 	};
 	return {
@@ -1874,7 +1880,8 @@ function tenantApprover(tenant) {
 			id: "u_9",
 			roles: [],
 			memberships: [{
-				tenant,
+				scope: "tenant",
+				id: tenant,
 				roles: ["admin"]
 			}]
 		},
@@ -2013,7 +2020,7 @@ function testApprovalStore(store, options = {}) {
 			by: member
 		}))).rejects.toThrow(/eligible|not pending|not found/u);
 	});
-	it("refuses the principal as approver unless the grant sets distinct: false", async () => {
+	it("refuses the principal as approver unless the grant sets mode: confirm", async () => {
 		const principal = {
 			principal: {
 				id: "u_1",
@@ -2024,9 +2031,9 @@ function testApprovalStore(store, options = {}) {
 		const shapes = [
 			["self-human", void 0],
 			["self-by", { by: admin$2 }],
-			["self-distinct", {
+			["self-authorize", {
 				by: admin$2,
-				distinct: true
+				mode: "authorize"
 			}]
 		];
 		for (const [token, approvers] of shapes) {
@@ -2044,7 +2051,7 @@ function testApprovalStore(store, options = {}) {
 			...sampleApproval("self-optout"),
 			approvers: {
 				by: admin$2,
-				distinct: false
+				mode: "confirm"
 			}
 		});
 		const resolved = await store.resolve("self-optout", {
@@ -2183,7 +2190,7 @@ function testApprovalStore(store, options = {}) {
 		await store.create({
 			...sampleApproval("stages-token"),
 			approvers: {
-				mode: "sequential",
+				combine: "sequential",
 				stages: [{ by: {
 					kind: "user",
 					id: "u_10"
@@ -2499,6 +2506,16 @@ function testVersionCache(cache) {
 		expect(await cache.current(principal, read, { live: false })).toBe(1);
 		expect(calls.count).toBe(1);
 	});
+	it("answers a read from a seed and never lowers a seeded version", async () => {
+		const { calls, read } = counted(1);
+		const principal = { id: "u-version-seed" };
+		cache.seed(principal.id, 6);
+		cache.seed(principal.id, 5);
+		if (cache.maxStaleMs > 0) {
+			expect(await cache.current(principal, read, { live: false })).toBe(6);
+			expect(calls.count).toBe(0);
+		}
+	});
 	it("reads again after evict", async () => {
 		const { calls, read } = counted(3);
 		const principal = { id: "u-version-evict" };
@@ -2509,6 +2526,60 @@ function testVersionCache(cache) {
 		expect(cache.stats().reads).toBeGreaterThanOrEqual(2);
 	});
 }
+/**
+* The `InstanceCache` contract: one build per key while it lives, a shared
+* build in flight, no stored rejection, and `evict` dropping a principal's
+* entries.
+*/
+function testInstanceCache(cache) {
+	const key = (principal, version = 1) => ({
+		principal,
+		version,
+		intent: "read",
+		parts: {}
+	});
+	const counted = () => {
+		const calls = { count: 0 };
+		const build = async () => {
+			calls.count += 1;
+			return { n: calls.count };
+		};
+		return {
+			calls,
+			build
+		};
+	};
+	it("builds once per key and keys versions apart", async () => {
+		const { calls, build } = counted();
+		const first = await cache.instance(key("u-instance-key"), [], build);
+		const again = await cache.instance(key("u-instance-key"), [], build);
+		const next = await cache.instance(key("u-instance-key", 2), [], build);
+		if (cache.maxAgeMs > 0) {
+			expect(again).toBe(first);
+			expect(calls.count).toBe(2);
+		}
+		expect(next).not.toBe(first);
+	});
+	it("shares one build between concurrent calls", async () => {
+		const { calls, build } = counted();
+		const built = await Promise.all(Array.from({ length: 5 }, async () => cache.instance(key("u-instance-shared"), [], build)));
+		expect(new Set(built).size).toBe(1);
+		expect(calls.count).toBe(1);
+	});
+	it("stores no rejected build", async () => {
+		await expect(cache.instance(key("u-instance-failed"), [], () => Promise.reject(/* @__PURE__ */ new Error("down")))).rejects.toThrow("down");
+		const { calls, build } = counted();
+		await cache.instance(key("u-instance-failed"), [], build);
+		expect(calls.count).toBe(1);
+	});
+	it("builds again after evict", async () => {
+		const { calls, build } = counted();
+		await cache.instance(key("u-instance-evict"), [], build);
+		cache.evict("u-instance-evict");
+		await cache.instance(key("u-instance-evict"), [], build);
+		expect(calls.count).toBe(2);
+	});
+}
 //#endregion
 //#region src/testing/cloud-api/platform.ts
 const CATALOG = "https://permdock.com/schemas/catalog-v1.json";
@@ -5657,12 +5728,7 @@ function testMembershipSource(source, options) {
 				memberships = [];
 			}
 			for (const membership of memberships) {
-				const shapes = [
-					membership.scope !== void 0,
-					membership.tenant !== void 0 || membership.team !== void 0,
-					membership.on !== void 0
-				].filter(Boolean);
-				expect(shapes.length).toBe(1);
+				expect(membership.scope === void 0 !== (membership.on === void 0)).toBe(true);
 				expect(Array.isArray(membership.roles)).toBe(true);
 				if (options.policy !== void 0) expect(normalizeMemberships([membership], scopeList(options.policy.scopes))).toHaveLength(1);
 			}
@@ -5781,7 +5847,8 @@ function testDirectoryStore(store, options) {
 			value: true
 		}]);
 		expect(await source.membershipsFor({ id: "00u1" }, { tenant: home })).toStrictEqual([{
-			tenant: home,
+			scope: "tenant",
+			id: home,
 			roles: ["editor"],
 			via: `group:${group.id}`,
 			managedBy: "idp"
@@ -6001,7 +6068,8 @@ const supabaseClaimFixtures = {
 			user_metadata: {
 				user_role: "admin",
 				memberships: [{
-					tenant: "acme",
+					scope: "tenant",
+					id: "acme",
 					roles: ["owner"]
 				}]
 			}
@@ -6017,10 +6085,12 @@ const supabaseClaimFixtures = {
 			...base,
 			tenant_id: "acme",
 			memberships: [{
-				tenant: "acme",
+				scope: "tenant",
+				id: "acme",
 				roles: ["admin"]
 			}, {
-				tenant: "globex",
+				scope: "tenant",
+				id: "globex",
 				roles: ["viewer"]
 			}]
 		},
@@ -6029,10 +6099,12 @@ const supabaseClaimFixtures = {
 			roles: [],
 			tenant: "acme",
 			memberships: [{
-				tenant: "acme",
+				scope: "tenant",
+				id: "acme",
 				roles: ["admin"]
 			}, {
-				tenant: "globex",
+				scope: "tenant",
+				id: "globex",
 				roles: ["viewer"]
 			}]
 		}
@@ -6586,4 +6658,4 @@ const PROBLEM_EXAMPLES = Object.freeze({
 	}
 });
 //#endregion
-export { AGENT_THROWING_ROW, AGENT_THROWING_USER, PROBLEM_EXAMPLES, authzenTodoData, authzenTodoPermissions, authzenTodoPolicy, authzenTodoUsers, authzenTodoVectors, describePolicy, expectTypeOf, jwtFixtureAudience, jwtFixtureIssuer, jwtFixtureJwks, jwtFixtureTokens, policyMatrix, seedRows, snapshotFixture, supabaseClaimFixtures, supabaseClaimVectors, supabaseHookManifestFixture, supabaseMembershipsBudget, testAccessReviewStore, testAgentAdapter, testAgentRuntime, testApprovalDelegationSource, testApprovalPolicySource, testApprovalStore, testApprovalWaiter, testAuthzen, testAutomationSource, testClientParity, testClientStore, testCloudApi, testCredentialVerifier, testCustomRoleSource, testDecisionProvider, testDecisionSink, testDeliveryTransport, testDirectoryStore, testEntitlementSource, testHttpAdapter, testIdempotencyStore, testLegacyParity, testLimitStore, testMembershipSource, testOrmParity, testPolicySource, testPrincipalSource, testRelationSource, testReplayStore, testRevocationFeed, testRlsParity, testSetQueue, testSettingsSource, testSnapshotSource, testSnapshotStorage, testSsfStreamStore, testSubjectResolver, testSupportSessionSource, testTokenSigner, testTokenVerifier, testVersionCache, testWhereCompiler };
+export { AGENT_THROWING_ROW, AGENT_THROWING_USER, PROBLEM_EXAMPLES, authzenTodoData, authzenTodoPermissions, authzenTodoPolicy, authzenTodoUsers, authzenTodoVectors, describePolicy, expectTypeOf, jwtFixtureAudience, jwtFixtureIssuer, jwtFixtureJwks, jwtFixtureTokens, policyMatrix, seedRows, snapshotFixture, supabaseClaimFixtures, supabaseClaimVectors, supabaseHookManifestFixture, supabaseMembershipsBudget, testAccessReviewStore, testAgentAdapter, testAgentRuntime, testApprovalDelegationSource, testApprovalPolicySource, testApprovalStore, testApprovalWaiter, testAuthzen, testAutomationSource, testClientParity, testClientStore, testCloudApi, testCredentialVerifier, testCustomRoleSource, testDecisionProvider, testDecisionSink, testDeliveryTransport, testDirectoryStore, testEntitlementSource, testHttpAdapter, testIdempotencyStore, testInstanceCache, testLegacyParity, testLimitStore, testMembershipSource, testOrmParity, testPolicySource, testPrincipalSource, testRelationSource, testReplayStore, testRevocationFeed, testRlsParity, testSetQueue, testSettingsSource, testSnapshotSource, testSnapshotStorage, testSsfStreamStore, testSubjectResolver, testSupportSessionSource, testTokenSigner, testTokenVerifier, testVersionCache, testWhereCompiler };

package/dist/testing/saas/index.d.ts

@@ -1,8 +1,8 @@
-import { Wt as Instant, et as LimitStore, fr as Membership, hr as Subject, lr as Delegation, ot as RelationSource, pr as Principal, rr as Actor, sr as CustomRole } from "../../policy-types-DGIO_gxq.js";
+import { Kt as Instant, _r as Principal, dr as CustomRole, gr as Membership, pr as Delegation, sr as Actor, st as RelationSource, tt as LimitStore, yr as Subject } from "../../policy-types-D-GwfQTc.js";
 import { u as Permission } from "../../permission-types-CAY-GU7e.js";
-import { o as PermDockOptions } from "../../permdock-CprAPN3w.js";
+import { o as PermDockOptions } from "../../permdock-ffY4CMd9.js";
 import { a as SaasProject, c as saasPlans, i as SaasFolderSchema, l as saasRoles, n as SaasDocSchema, o as SaasProjectSchema, r as SaasFolder, s as saasPermissions, t as SaasDoc, u as saasTenantRoleNames } from "../../permissions-Bx6UI8n1.js";
-import { n as saasPolicy, t as SAAS_API_KEY_LIMIT } from "../../policy-BycVKnXv.js";
+import { n as saasPolicy, t as SAAS_API_KEY_LIMIT } from "../../policy-BtKSApSt.js";
 import { StandardSchemaV1 } from "@standard-schema/spec";
 //#region src/testing/saas/schema.d.ts
 type FieldKind = "string" | "boolean" | "nullable-string";

package/dist/testing/saas/index.js

@@ -1,3 +1,3 @@
-import { a as saasPlans, c as rowSchema, i as saasPermissions, n as SaasFolderSchema, o as saasRoles, r as SaasProjectSchema, s as saasTenantRoleNames, t as SaasDocSchema } from "../../permissions-CYcHj_w7.js";
-import { C as saasOrg, D as saasUsers, E as saasSeed, O as SAAS_API_KEY_LIMIT, S as saasMemberships, T as saasRelations, _ as verifySaasToken, a as saasProject, b as SAAS_EXPIRED_AT, c as saasUser, d as saasIssuer, f as saasJwks, g as verifySaasSession, h as signSaasToken, i as saasLimitStore, k as saasPolicy, l as SAAS_TOKEN_TTL_SECONDS, m as saasPublicJwk, n as saasFolder, o as saasScenarioOptions, p as saasPrivateJwk, r as saasFolderScenarios, s as saasScenarios, t as saasDoc, u as saasAudience, v as saasSchemaSql, w as saasPrincipal, x as saasCustomRoles, y as saasSeedSql } from "../../saas-DK4V-3Is.js";
+import { a as saasPlans, c as rowSchema, i as saasPermissions, n as SaasFolderSchema, o as saasRoles, r as SaasProjectSchema, s as saasTenantRoleNames, t as SaasDocSchema } from "../../permissions-B3ggI88M.js";
+import { C as saasOrg, D as saasUsers, E as saasSeed, O as SAAS_API_KEY_LIMIT, S as saasMemberships, T as saasRelations, _ as verifySaasToken, a as saasProject, b as SAAS_EXPIRED_AT, c as saasUser, d as saasIssuer, f as saasJwks, g as verifySaasSession, h as signSaasToken, i as saasLimitStore, k as saasPolicy, l as SAAS_TOKEN_TTL_SECONDS, m as saasPublicJwk, n as saasFolder, o as saasScenarioOptions, p as saasPrivateJwk, r as saasFolderScenarios, s as saasScenarios, t as saasDoc, u as saasAudience, v as saasSchemaSql, w as saasPrincipal, x as saasCustomRoles, y as saasSeedSql } from "../../saas-B8H1MsQ3.js";
 export { SAAS_API_KEY_LIMIT, SAAS_EXPIRED_AT, SAAS_TOKEN_TTL_SECONDS, SaasDocSchema, SaasFolderSchema, SaasProjectSchema, rowSchema, saasAudience, saasCustomRoles, saasDoc, saasFolder, saasFolderScenarios, saasIssuer, saasJwks, saasLimitStore, saasMemberships, saasOrg, saasPermissions, saasPlans, saasPolicy, saasPrincipal, saasPrivateJwk, saasProject, saasPublicJwk, saasRelations, saasRoles, saasScenarioOptions, saasScenarios, saasSchemaSql, saasSeed, saasSeedSql, saasTenantRoleNames, saasUser, saasUsers, signSaasToken, verifySaasSession, verifySaasToken };

package/dist/testing/saas/permissions.js

@@ -1 +1 @@
-export { t as SaasDocSchema, n as SaasFolderSchema, r as SaasProjectSchema, i as saasPermissions, a as saasPlans, o as saasRoles, s as saasTenantRoleNames } from "../../permissions-CYcHj_w7.js";
+export { t as SaasDocSchema, n as SaasFolderSchema, r as SaasProjectSchema, i as saasPermissions, a as saasPlans, o as saasRoles, s as saasTenantRoleNames } from "../../permissions-B3ggI88M.js";

package/dist/token-D6pWn8Uj.d.ts

@@ -0,0 +1,11 @@
+//#region src/core/token.d.ts
+/**
+ * The hex SHA-256 of `value` as sorted-key JSON: the same string
+ * better-supabase's `approvalFingerprint` resolves to, returned synchronously.
+ * Pass the exact operation an approval covers (the subject, the action and its
+ * arguments) as `fingerprint` so an approval for one change cannot run
+ * another.
+ */
+declare function approvalFingerprint(value: unknown): string;
+//#endregion
+export { approvalFingerprint as t };

package/dist/{token-DC9EQiet.js → token-DaMnIU9O.js}

@@ -1,5 +1,5 @@
 import { t as canonicalJson } from "./canonical-json-DwilZ1iB.js";
-import { r as sha256Digest } from "./sha256-C-4WXKIu.js";
+import { n as sha256, r as sha256Digest } from "./sha256-C-4WXKIu.js";
 //#region src/core/token.ts
 /**
 * Only stable identity goes into the token, so refreshing a session (new roles,
@@ -23,6 +23,18 @@ function versionOf(row, field) {
 	if (value instanceof Date) return Number.isNaN(value.getTime()) ? null : value.toISOString();
 	return typeof value === "string" || typeof value === "number" || typeof value === "bigint" || typeof value === "boolean" ? String(value) : null;
 }
+/**
+* The hex SHA-256 of `value` as sorted-key JSON: the same string
+* better-supabase's `approvalFingerprint` resolves to, returned synchronously.
+* Pass the exact operation an approval covers (the subject, the action and its
+* arguments) as `fingerprint` so an approval for one change cannot run
+* another.
+*/
+function approvalFingerprint(value) {
+	let hex = "";
+	for (const byte of sha256(canonicalJson(value))) hex += byte.toString(16).padStart(2, "0");
+	return hex;
+}
 /** The digest that binds a token to the call's data when no row id does. */
 function payloadDigest(data) {
 	return sha256Digest(canonicalJson(data));
@@ -37,10 +49,13 @@ function tokenPayload(resourceId, data, args) {
 	return resourceId === "*" && data !== void 0 ? payloadDigest(data) : void 0;
 }
 /**
-* `version` is set only for an approval that goes stale on a resource change;
-* without it the payload, and so every other token, is unchanged. `payload` is
-* set when `resourceId` is `*` (a collection action or a row without an id), so
-* an approval covers the arguments it was given and no others.
+* `source` names what decided: the policy fingerprint, `snapshot:<issuedAt>` or
+* the PDP provider. `version` is set only for an approval that goes stale on a
+* resource change; without it the payload, and so every other token, is
+* unchanged. `payload` is set when `resourceId` is `*` (a collection action or
+* a row without an id), so an approval covers the arguments it was given and no
+* others. `fingerprint` is the caller's `approvalFingerprint` of the exact
+* operation, bound only when given.
 */
 function decisionToken(input) {
 	const payload = canonicalJson({
@@ -51,11 +66,12 @@ function decisionToken(input) {
 			id: input.actor.id,
 			kind: input.actor.kind
 		},
-		fingerprint: input.fingerprint,
+		source: input.source,
 		...input.version === void 0 ? {} : { version: input.version },
-		...input.payload === void 0 ? {} : { payload: input.payload }
+		...input.payload === void 0 ? {} : { payload: input.payload },
+		...input.fingerprint === void 0 ? {} : { fingerprint: input.fingerprint }
 	});
 	return sha256Digest(payload);
 }
 //#endregion
-export { versionOf as i, payloadDigest as n, tokenPayload as r, decisionToken as t };
+export { versionOf as a, tokenPayload as i, decisionToken as n, payloadDigest as r, approvalFingerprint as t };

package/dist/{tool-refusal-Qpjs_W6M.js → tool-refusal-D4spOJ7I.js}

@@ -1,5 +1,5 @@
 import { t as wireDenials } from "./wire-denial-C7PaVYEM.js";
-import { n as describe } from "./describe-Bb4hGK5d.js";
+import { n as describe } from "./describe-BZAlPHxT.js";
 //#region src/core/tool-refusal.ts
 function deniedToolRefusal(decision, permission, resource) {
 	const alternatives = decision.alternatives.map((leaf) => leaf.key);

package/dist/trpc/index.d.ts

@@ -1,10 +1,10 @@
-import { T as Policy, pr as Principal } from "../policy-types-DGIO_gxq.js";
+import { E as Policy, _r as Principal } from "../policy-types-D-GwfQTc.js";
 import { u as Permission } from "../permission-types-CAY-GU7e.js";
-import { a as PermDock } from "../permdock-CprAPN3w.js";
+import { a as PermDock } from "../permdock-ffY4CMd9.js";
 import { n as RevocationFeed } from "../revocations-BaUXHM1N.js";
-import { D as ConnectionOptions, T as Connection, i as OpenApiHooks } from "../server-types-CyRN0-Cd.js";
-import { t as ServerAdapterOptions } from "../bind-YYjvfpB9.js";
-import { t as StreamProtectOptions } from "../stream-9y9qw51m.js";
+import { D as ConnectionOptions, T as Connection, i as OpenApiHooks } from "../server-types-3OnXjZ2D.js";
+import { t as ServerAdapterOptions } from "../bind-DR6ku3A9.js";
+import { t as StreamProtectOptions } from "../stream-W2RuUYly.js";
 import { AnyTRPCMiddlewareFunction } from "@trpc/server";
 //#region src/trpc/create.d.ts
 type TrpcMiddlewareOpts<TCtx = object, TInput = unknown> = {

package/dist/trpc/index.js

@@ -1,8 +1,8 @@
 import { o as problemMessage } from "../http-DKLXrFGk.js";
-import { t as problemFromError } from "../map-error-pasIGqMT.js";
-import { n as attached } from "../bind-BNQA9JK9.js";
+import { t as problemFromError } from "../map-error-BH16Ah8P.js";
+import { n as attached } from "../bind-B4pMH9bm.js";
 import { i as isAsyncIterable, o as reloadAfter } from "../stream-CDvF0sJm.js";
-import { i as rpcCode, n as guardStream, r as problemBody, t as bindRpcKernel } from "../rpc-vHIwyXCp.js";
+import { i as rpcCode, n as guardStream, r as problemBody, t as bindRpcKernel } from "../rpc-KwX_Jcxz.js";
 import { TRPCError, isTrackedEnvelope } from "@trpc/server";
 //#region src/trpc/create.ts
 const PROBLEM = Symbol.for("permdock.problem");

package/dist/{type-helpers-c7Xo_2Cu.d.ts → type-helpers-i1EJ3Eb1.d.ts}

@@ -1,4 +1,4 @@
-import { bn as ScopeNames, j as PolicyVocabulary } from "./policy-types-DGIO_gxq.js";
+import { M as PolicyVocabulary, Sn as ScopeNames } from "./policy-types-D-GwfQTc.js";
 import { k as POLICY_SCOPES, u as Permission } from "./permission-types-CAY-GU7e.js";
 import { n as PlanTree } from "./vocabulary-DEJ5j4mR.js";
 import { o as OperationMap } from "./operations-Ci_rT6Uo.js";

package/dist/{types-Cklw5hJo.d.ts → types-3Y8UpFkF.d.ts}

@@ -1,4 +1,4 @@
-import { h as RoleThrough, m as RoleMap, s as SqlMembershipSource } from "./sources-oB1Hg1Fm.js";
+import { h as RoleThrough, m as RoleMap, s as SqlMembershipSource } from "./sources-xdQShLDU.js";
 //#region src/cli/core/errors.d.ts
 /**
  * 0 success, 1 failure, 2 usage, 3 action required, 130 interrupted (SIGINT or
@@ -435,6 +435,15 @@ type RlsConfig = {
    */
   readonly shims?: boolean | RlsShimsConfig;
 };
+/** `rls.approvals.managers`: one row per user and manager. */
+type RlsApprovalManagers = {
+  /** `table` or `schema.table`. */
+  readonly table: string;
+  /** The column holding the user's id. */
+  readonly user: string;
+  /** The column holding the id of that user's manager. */
+  readonly manager: string;
+};
 /**
  * `rls.approvals` on a table the app already has: the store functions keep each
  * request's body in `body` and its token in `token` (both added when missing)
@@ -442,6 +451,7 @@ type RlsConfig = {
  * app's own columns on each write, converted to their types.
  */
 type RlsApprovalsAdopt = {
+  readonly store?: boolean;
   /**
    * `table` or `schema.table`. Without it the store is the generated
    * `approval_requests`.
@@ -454,6 +464,22 @@ type RlsApprovalsAdopt = {
    * same rows for `approvalsHandler`. Off by default.
    */
   readonly delegations?: boolean;
+  /**
+   * Add `approval_policies`, the approval requirements a tenant keeps as data,
+   * and `permdock_approval_policies_for`, which `tableApprovalPolicySource`
+   * reads. A holder of the `manage` permission key in a tenant writes that
+   * tenant's rows; rows with `tenant` null are platform floors, written only by
+   * the table owner. Off by default.
+   */
+  readonly tenantPolicies?: {
+    readonly manage: string;
+  };
+  /**
+   * The app's table that names each user's manager, so `manager()` approvers
+   * match in SQL: `permdock_manages` walks it and the four-argument
+   * `permdock_is_approver` calls it. Off by default.
+   */
+  readonly managers?: RlsApprovalManagers;
   /** A text column unique per request. Default `token`. */
   readonly token?: string;
   /** A jsonb column holding the `ApprovalRequest`. Default `body`. */
@@ -811,6 +837,19 @@ type SupabaseHookConfig = {
    * `true`.
    */
   readonly version?: boolean;
+  /**
+   * Broadcast every version bump as `{ user_id, version }` with event `changed`
+   * on `topic`, which no user may join, and on the user's own `authz:<uid>`.
+   * `topic` defaults to `better_supabase:authz` in a better-supabase project,
+   * else `permdock:authz`. `receivePolicy` writes the `realtime.messages`
+   * policy that lets a user receive `authz:<uid>`; it defaults to `true`, and
+   * to `false` when better-supabase's `sessions.authzVersions` writes the same
+   * policy. `false` sends nothing.
+   */
+  readonly broadcast?: false | {
+    readonly topic?: string;
+    readonly receivePolicy?: boolean;
+  };
   /**
    * Write PostgREST wrappers for `subject_for`, `members_of` and
    * `authz_version_for` into `schema` (default `public`), named

package/dist/{types-DlelvQk4.d.ts → types-B8qUkGja.d.ts}

@@ -1,6 +1,6 @@
-import { Jn as ExplainedDecision, T as Policy, Un as Decision, fr as Membership, hr as Subject, j as PolicyVocabulary, pr as Principal } from "./policy-types-DGIO_gxq.js";
+import { E as Policy, M as PolicyVocabulary, Qn as ExplainedDecision, _r as Principal, gr as Membership, qn as Decision, yr as Subject } from "./policy-types-D-GwfQTc.js";
 import { f as PermissionTree, u as Permission } from "./permission-types-CAY-GU7e.js";
-import { C as PermissionCheck, a as PermDock, f as WhereResult, l as SimulateOptions, n as DecideOptions, o as PermDockOptions, r as DeriveOptions } from "./permdock-CprAPN3w.js";
+import { a as PermDock, f as WhereResult, k as PermissionCheck, l as SimulateOptions, n as DecideOptions, o as PermDockOptions, r as DeriveOptions } from "./permdock-ffY4CMd9.js";
 //#region src/pdp/types.d.ts
 type RemotePdpAuth = {
   readonly bearer: string | (() => string | Promise<string>);

package/dist/{types-CN0LsqbK.d.ts → types-CCEeSCMB.d.ts}

@@ -1,6 +1,6 @@
-import { Yn as GrantedDecision, cn as DeliveryEvent, dn as EmailCategory, ln as DeliveryFailureCause, sn as DeliveryChannel } from "./policy-types-DGIO_gxq.js";
-import { s as CloudEvent } from "./sink-B5zoUW_O.js";
-import { t as ApprovalPrompt } from "./approval-prompt-3BqWczTt.js";
+import { $n as GrantedDecision, dn as DeliveryFailureCause, ln as DeliveryChannel, pn as EmailCategory, un as DeliveryEvent } from "./policy-types-D-GwfQTc.js";
+import { s as CloudEvent } from "./sink-ogbVkyeo.js";
+import { t as ApprovalPrompt } from "./approval-prompt-Bg7gDSqd.js";
 //#region src/delivery/types.d.ts
 /**
  * Who a delivery goes to. `{ principal }` names an app principal and the

package/dist/{types-B2efzoSX.d.ts → types-CDVXR6YD.d.ts}

@@ -1,4 +1,4 @@
-import { Sn as Approver } from "./policy-types-DGIO_gxq.js";
+import { wn as Approver } from "./policy-types-D-GwfQTc.js";
 //#region src/approvals/access-reviews/types.d.ts
 type AccessReviewStatus = "open" | "closed";
 type AccessReviewItemStatus = "pending" | "kept" | "revoked";

package/dist/{types-DsHGPtkR.d.ts → types-Ck1KOfug.d.ts}

@@ -1,5 +1,5 @@
-import { Z as JwtClaims, hr as Subject, ht as TokenVerifier, nt as MembershipSource, pr as Principal, pt as TokenFailureCause, rn as AuthEvent, rr as Actor } from "./policy-types-DGIO_gxq.js";
-import { m as ApprovalStore } from "./types-DLvhVm1r.js";
+import { Q as JwtClaims, _r as Principal, _t as TokenVerifier, an as AuthEvent, ht as TokenFailureCause, rt as MembershipSource, sr as Actor, yr as Subject } from "./policy-types-D-GwfQTc.js";
+import { m as ApprovalStore } from "./types-CqcsNCaN.js";
 import { n as RevocationFeed } from "./revocations-BaUXHM1N.js";
 import { t as ClaimsMap } from "./claims-map-D1Pb5oRq.js";
 import { t as ClientNames } from "./clients-C_NOET3z.js";

package/dist/{types-DLvhVm1r.d.ts → types-CqcsNCaN.d.ts}

@@ -1,15 +1,18 @@
-import { Nn as RelationGrantee, Sn as Approver, Wt as Instant, fr as Membership, gn as WireDelegation, hr as Subject, o as ApprovalStage, r as ApprovalMode, vr as AdapterId } from "./policy-types-DGIO_gxq.js";
+import { Kt as Instant, Ln as RelationGrantee, Sr as AdapterId, gr as Membership, i as ApprovalMode, n as ApprovalCombine, s as ApprovalStage, vn as WireDelegation, wn as Approver, yr as Subject } from "./policy-types-D-GwfQTc.js";
 import { M as AppData } from "./permission-types-CAY-GU7e.js";
 //#region src/approvals/types.d.ts
 type ApprovalStatus = "pending" | "approved" | "rejected" | "expired";
 type ApprovalApprovers = {
-  /** Under `mode: 'any'` (the default). */
+  /** Under `combine: 'any'` (the default). */
   readonly by?: Approver | readonly Approver[];
-  readonly mode?: ApprovalMode;
-  /** Under `mode: 'all'` or `'sequential'`. */
+  readonly combine?: ApprovalCombine;
+  /** Under `combine: 'all'` or `'sequential'`. */
   readonly stages?: readonly ApprovalStage[];
-  /** `false` lets the request's principal approve it; absent means `true`. */
-  readonly distinct?: boolean;
+  /**
+   * `'confirm'` lets the request's principal approve it; absent means
+   * `'authorize'`.
+   */
+  readonly mode?: ApprovalMode;
   /** Set when the approval no longer applies once the row's `version` changes. */
   readonly staleOn?: "resource-change";
   /**
@@ -123,6 +126,12 @@ type ApprovalRequest = {
   readonly vouched?: string;
   readonly note?: string;
   readonly consumedAt?: string;
+  /**
+   * The caller's `approvalFingerprint` of the exact operation, from the
+   * decision's `fingerprint`. Consuming or resuming under another one fails
+   * with `approval-fingerprint-mismatch`.
+   */
+  readonly fingerprint?: string;
   /**
    * The application's own data, set when the request opens; plain JSON, never
    * read by a decision.
@@ -213,7 +222,7 @@ type ApprovalStore = {
   consume: (token: string, now?: Instant) => Promise<ApprovalRequest | null> | ApprovalRequest | null;
   cancel?: (filter: ApprovalListFilter, meta: ApprovalCancelMeta) => Promise<number> | number;
 };
-type ApprovalResumeFailureCause = "approval-not-found" | "approval-pending" | "approval-rejected" | "approval-expired" | "approval-consumed";
+type ApprovalResumeFailureCause = "approval-not-found" | "approval-pending" | "approval-rejected" | "approval-expired" | "approval-consumed" | "approval-fingerprint-mismatch";
 type ApprovalInspectResult = {
   readonly ok: true;
   readonly request: ApprovalRequest;

package/dist/{types-BB-zWDcR.d.ts → types-D-JO7lh8.d.ts}

@@ -1,8 +1,8 @@
-import { J as DecisionSink, ct as SnapshotSource, hr as Subject, ht as TokenVerifier, mt as TokenSigner } from "./policy-types-DGIO_gxq.js";
-import { s as PolicySource } from "./hosted-DVxlLZMe.js";
-import { m as ApprovalStore, u as ApprovalRequest } from "./types-DLvhVm1r.js";
-import { a as CatalogDocument } from "./types-ZzRGoViD.js";
-import { a as CatalogFinding } from "./sink-B5zoUW_O.js";
+import { Y as DecisionSink, _t as TokenVerifier, gt as TokenSigner, lt as SnapshotSource, yr as Subject } from "./policy-types-D-GwfQTc.js";
+import { s as PolicySource } from "./hosted-BFNXwcjd.js";
+import { m as ApprovalStore, u as ApprovalRequest } from "./types-CqcsNCaN.js";
+import { a as CatalogDocument } from "./types-NYoj8JBm.js";
+import { a as CatalogFinding } from "./sink-ogbVkyeo.js";
 //#region src/cloud/types.d.ts
 type CloudEndpointOptions = {
   readonly url?: string;

package/dist/{types-CEinc15V.d.ts → types-D19MK4t-.d.ts}

@@ -1,9 +1,8 @@
-import { Hn as ApprovalRequiredDecision, Un as Decision, Yn as GrantedDecision, Zt as Snapshot, ht as TokenVerifier } from "./policy-types-DGIO_gxq.js";
+import { $n as GrantedDecision, $t as Snapshot, Kn as ApprovalRequiredDecision, _t as TokenVerifier, qn as Decision } from "./policy-types-D-GwfQTc.js";
 import { u as Permission } from "./permission-types-CAY-GU7e.js";
-import { a as PermDock } from "./permdock-CprAPN3w.js";
+import { a as PermDock } from "./permdock-ffY4CMd9.js";
 import { t as PermissionBoundaryState } from "./boundary-C9ck-3uK.js";
-import { t as ActionResult } from "./action-result-BcudBQOF.js";
-import { d as ProtectedActionView, f as ProviderOptionsBase, g as ClientStore, l as PermissionState } from "./types-tQB2CEnY.js";
+import { d as PermissionState, m as ProviderOptionsBase, p as ProtectedActionView, t as ClientStore, v as ActionResult } from "./store-DYeB-_U3.js";
 import { Snippet } from "svelte";
 import { Readable } from "svelte/store";
 //#region src/client/views.d.ts