permdock 0.16.0 → 0.18.0

package/dist/{types-B6ExllNo.d.ts → types-DGf_cpKF.d.ts}

@@ -1,5 +1,5 @@
-import { j as PolicyVocabulary, on as DecisionEvent } from "./policy-types-DGIO_gxq.js";
-import { a as PermDock } from "./permdock-CprAPN3w.js";
+import { M as PolicyVocabulary, cn as DecisionEvent } from "./policy-types-D-GwfQTc.js";
+import { a as PermDock } from "./permdock-ffY4CMd9.js";
 //#region src/otel/types.d.ts
 declare const GENAI_SEMCONV_PIN = "1.37.0";
 declare const GEN_AI_TOOL_NAME = "gen_ai.tool.name";

package/dist/{types-rCRV4Ge-.d.ts → types-DmbfLu2p.d.ts}

@@ -1,8 +1,8 @@
-import { Hn as ApprovalRequiredDecision, Un as Decision, Yn as GrantedDecision, Zt as Snapshot, ht as TokenVerifier } from "./policy-types-DGIO_gxq.js";
+import { $n as GrantedDecision, $t as Snapshot, Kn as ApprovalRequiredDecision, _t as TokenVerifier, qn as Decision } from "./policy-types-D-GwfQTc.js";
 import { u as Permission } from "./permission-types-CAY-GU7e.js";
-import { s as RowData } from "./permdock-CprAPN3w.js";
-import { n as DescribeMessages } from "./describe-BbFPBSms.js";
-import { _ as ClientStoreOptions } from "./types-tQB2CEnY.js";
+import { s as RowData } from "./permdock-ffY4CMd9.js";
+import { n as DescribeMessages } from "./describe-BKtC_8PG.js";
+import { n as ClientStoreOptions } from "./store-DYeB-_U3.js";
 import { ReactNode } from "react";
 //#region src/react/types.d.ts
 type PermDockProviderProps = ({

package/dist/{types-ZzRGoViD.d.ts → types-NYoj8JBm.d.ts}

@@ -56,12 +56,12 @@ type CatalogBreakGlass = {
 };
 type CatalogApproval = "human" | {
   readonly by?: unknown;
-  readonly mode?: "any" | "all" | "sequential";
+  readonly combine?: "any" | "all" | "sequential";
   readonly stages?: readonly {
     readonly by: unknown;
     readonly quorum?: number;
   }[];
-  readonly distinct?: boolean;
+  readonly mode?: "confirm" | "authorize";
   readonly staleOn?: "resource-change";
   readonly quorum?: number;
   /** Seconds. */

package/dist/{types-CWBsAwqn.d.ts → types-o1vu6Ks3.d.ts}

@@ -1,7 +1,7 @@
-import { Zt as Snapshot, ct as SnapshotSource, ht as TokenVerifier } from "./policy-types-DGIO_gxq.js";
-import { n as DescribeMessages } from "./describe-BbFPBSms.js";
-import { _ as ClientStoreOptions } from "./types-tQB2CEnY.js";
-import { t as PermDockDefaults } from "./types-rCRV4Ge-.js";
+import { $t as Snapshot, _t as TokenVerifier, lt as SnapshotSource } from "./policy-types-D-GwfQTc.js";
+import { n as DescribeMessages } from "./describe-BKtC_8PG.js";
+import { n as ClientStoreOptions } from "./store-DYeB-_U3.js";
+import { t as PermDockDefaults } from "./types-DmbfLu2p.js";
 import { ReactNode } from "react";
 //#region src/react-native/types.d.ts
 type SnapshotStorage = {

package/dist/unplugin/index.d.ts

@@ -1,4 +1,4 @@
-import { s as PermDockPluginOptions } from "../types-Cklw5hJo.js";
+import { s as PermDockPluginOptions } from "../types-3Y8UpFkF.js";
 import { createUnplugin } from "unplugin";
 //#region src/unplugin/index.d.ts
 type CreateUnplugin = typeof createUnplugin<PermDockPluginOptions | undefined>;

package/dist/unplugin/index.js

@@ -1,5 +1,5 @@
-import { n as createCollectScheduler, r as report } from "../watch-DAkjm75Y.js";
-import { r as peerHint } from "../peer-Q0fuZ6hx.js";
+import { n as createCollectScheduler, r as report } from "../watch-CBHADqBH.js";
+import { r as peerHint } from "../peer-BuK9F53f.js";
 import { createRequire } from "node:module";
 //#region src/unplugin/index.ts
 function loadCreateUnplugin() {

package/dist/usage-Cl5eb-e1.js

@@ -0,0 +1 @@
+export { t as runUsage } from "./usage-DC0UKe6C.js";

package/dist/{usage-CPXeuAdT.js → usage-DC0UKe6C.js}

@@ -1,13 +1,13 @@
 import { a as getResource } from "./permission-registry-B8tYxPIt.js";
-import { u as usageResult } from "./errors-Vpu6rKHl.js";
+import { u as usageResult } from "./errors-BhRkoNS7.js";
 import { a as rel, r as listSourceFiles } from "./files-BSjrtIHw.js";
 import { o as USAGE_REPORT_SCHEMA } from "./version-DMQ0dnN5.js";
-import { c as jsonSchemaOf } from "./catalog-doc-DjMKzJp9.js";
-import { a as loadModule, n as asPolicy, s as pickNamed } from "./load-DjSU5KXO.js";
-import { r as runCollect } from "./collect-WCl8cJQV.js";
+import { c as jsonSchemaOf } from "./catalog-doc-C4DGfJCO.js";
+import { a as loadModule, n as asPolicy, s as pickNamed } from "./load-BaEamml-.js";
+import { r as runCollect } from "./collect-D878zLDP.js";
 import { t as beforeFirst } from "./text-BMFRfBqc.js";
-import { t as DOCS_BASE } from "./manifest-Cft51TLK.js";
-import { r as findingOf } from "./output-DlICTjBh.js";
+import { t as DOCS_BASE } from "./manifest-wclLWBVH.js";
+import { r as findingOf } from "./output-BFWLER4r.js";
 import { existsSync, readFileSync, realpathSync } from "node:fs";
 import { dirname, resolve } from "node:path";
 import { fileURLToPath, pathToFileURL } from "node:url";

package/dist/{usage-CfZCQd0F.js → usage-DYtRVkcN.js}

@@ -1,5 +1,5 @@
 import { t as defineLeaf } from "./command-L8EstFNm.js";
-import { a as failOnFlag } from "./flags-DXjoTVbS.js";
+import { a as failOnFlag } from "./flags-BlmpmXoY.js";
 //#region src/cli/commands/usage.ts
 const usage = defineLeaf({
 	flags: {
@@ -16,7 +16,7 @@ const usage = defineLeaf({
 		}
 	},
 	async run(ctx, { flags }) {
-		return (await import("./usage-DmmO_xjJ.js")).runUsage({
+		return (await import("./usage-Cl5eb-e1.js")).runUsage({
 			cwd: ctx.cwd,
 			config: ctx.config,
 			ignore: flags.ignore,

package/dist/{validation-error-uvp-kyfO.d.ts → validation-error-Dx8PipbO.d.ts}

@@ -1,4 +1,4 @@
-import { a as ProblemDetails } from "./errors-BIM4MFsJ.js";
+import { a as ProblemDetails } from "./errors-TpzkEKgJ.js";
 import { StandardSchemaV1 } from "@standard-schema/spec";
 //#region src/core/validation-error.d.ts
 /**

package/dist/{verify-DfT0QYNh.js → verify-Bpj0hauG.js}

@@ -1,35 +1,35 @@
 import { a as sole, r as isRecord } from "./compact-CAf557ZB.js";
 import { l as isConditionRef, o as hasConditionOp } from "./refs-C8BKxc_e.js";
-import { j as memoryCustomRoleSource, x as memoryRelationSource } from "./src-C_pi2Rnh.js";
+import { A as memoryCustomRoleSource, S as memoryRelationSource } from "./src-Brzq_0in.js";
 import { c as listPermissions, h as formerKeys, n as findPermission } from "./permission-registry-B8tYxPIt.js";
 import { c as isEdgeRelation, l as isFieldRelation, u as isPrincipalRelation } from "./resource-relations-8-pCScBO.js";
 import { f as nowMillis, u as isoAt } from "./time-nR1JesoH.js";
 import { t as canonicalJson } from "./canonical-json-DwilZ1iB.js";
-import { f as scopeList, l as rootScope, o as normalizeMemberships } from "./scopes-0Up_UA2t.js";
-import { o as requiresStandIn } from "./delegation-CDB6_keF.js";
-import { p as scopeField } from "./tenancy-5d1zVBvK.js";
-import { l as policyLevels, t as coveredLevels } from "./policy-CLQ8__GF.js";
+import { c as rootScope, d as scopeList, o as normalizeMemberships } from "./scopes-BSdYaGHs.js";
+import { o as requiresStandIn } from "./delegation-aK4T_5WU.js";
+import { p as scopeField } from "./tenancy-DvOHHk3-.js";
+import { l as policyLevels, t as coveredLevels } from "./policy-cV_wwPb8.js";
 import { t as requiresApproval } from "./approval-required-TzNB9oQA.js";
-import { c as andWhere, m as customRoleScope, v as leveled, y as membershipsClaim } from "./evaluate-BAmf_AQd.js";
-import { t as getPermDock } from "./permdock-BvjivVb9.js";
-import { a as describeError, i as configError, u as usageResult } from "./errors-Vpu6rKHl.js";
+import { c as andWhere, m as customRoleScope, v as leveled, y as membershipsClaim } from "./evaluate-Czbj7thS.js";
+import { t as getPermDock } from "./permdock-D-_WrdKu.js";
+import { a as describeError, i as configError, u as usageResult } from "./errors-BhRkoNS7.js";
 import { t as policyRowConditionKeys } from "./row-conditions-BAGHOmVq.js";
 import { s as writeFileEnsuringDir } from "./files-BSjrtIHw.js";
-import { c as jsonSchemaOf } from "./catalog-doc-DjMKzJp9.js";
-import { o as loadPolicyAt } from "./load-DjSU5KXO.js";
-import "./budget-BELja5A9.js";
+import { c as jsonSchemaOf } from "./catalog-doc-C4DGfJCO.js";
+import { o as loadPolicyAt } from "./load-BaEamml-.js";
+import "./budget-BBCPDOGP.js";
 import { i as qualifySqlTable, n as defaultSqlCommand, t as SQL_IDENT } from "./sql-0WjxIp9g.js";
-import { a as scopeMembershipTable, i as scopeColumn } from "./compile-EzEMB-7v.js";
+import { a as scopeMembershipTable, i as scopeColumn } from "./compile-B_oJqmIg.js";
 import "./sources-C4vkzZJV.js";
 import { t as beforeFirst } from "./text-BMFRfBqc.js";
-import { t as DOCS_BASE } from "./manifest-Cft51TLK.js";
-import { n as fixtureSubject, r as loadFixtures, t as fixtureRow } from "./fixtures-Bm4_K1ke.js";
-import { A as quoteQualified, N as arrayColumnsOf, O as quoteIdent, P as columnTypesOf, _ as subjectClaimJsonSql, a as customRolesOn, j as quoteTable, k as quoteLiteral, r as HELPERS, v as subjectClaimSql } from "./shared-DrGLwM3s.js";
-import { C as accessSql, D as tokenScopeAllowsCall, S as requiresSql, ht as scopeTable, k as capabilityAccessSql, n as tableNameOf, o as graphPlan, q as apiKeyAllowsCall, r as tableNames } from "./tables-DimBcVWY.js";
-import { c as breakGlassKey, f as compileConditionSql, l as collectGrants, m as sqlFunctionNames, p as contextRefs, s as breakGlassHolder } from "./ownership-qqBuGJXr.js";
+import { t as DOCS_BASE } from "./manifest-wclLWBVH.js";
+import { n as fixtureSubject, r as loadFixtures, t as fixtureRow } from "./fixtures-Cemqurt8.js";
+import { A as quoteQualified, N as arrayColumnsOf, O as quoteIdent, P as columnTypesOf, _ as subjectClaimJsonSql, a as customRolesOn, j as quoteTable, k as quoteLiteral, r as HELPERS, v as subjectClaimSql } from "./shared-DyYVEjKC.js";
+import { C as accessSql, D as tokenScopeAllowsCall, S as requiresSql, ht as scopeTable, k as capabilityAccessSql, n as tableNameOf, o as graphPlan, q as apiKeyAllowsCall, r as tableNames } from "./tables-BfOk0ymL.js";
+import { c as breakGlassKey, f as compileConditionSql, l as collectGrants, m as sqlFunctionNames, p as contextRefs, s as breakGlassHolder } from "./ownership-D-mIt-w0.js";
 import { t as membershipSourcesOf } from "./sources-qoIJQrJv.js";
-import { n as pgConnector, t as connectPgPool } from "./pg-DQTqRrou.js";
-import { _ as wrapSql, g as validitySql, m as andSql, s as viewName, t as FIELD_VIEWS } from "./fields-DI8s3cPl.js";
+import { n as pgConnector, t as connectPgPool } from "./pg-Ddxsd5ZB.js";
+import { _ as wrapSql, g as validitySql, m as andSql, s as viewName, t as FIELD_VIEWS } from "./fields-CrjL6A49.js";
 import { resolve } from "node:path";
 import { createHash, randomUUID } from "node:crypto";
 //#region src/cli/rls/indexes.ts

package/dist/{version-cache-Df11C2Qp.d.ts → version-cache-DzNKWiI6.d.ts}

@@ -1,4 +1,4 @@
-import { Wt as Instant, yt as VersionQuery } from "./policy-types-DGIO_gxq.js";
+import { Kt as Instant, xt as VersionQuery } from "./policy-types-D-GwfQTc.js";
 //#region src/core/version-cache.d.ts
 type VersionCacheStats = {
   /** Version reads the cache started. */
@@ -20,12 +20,18 @@ type VersionCache = {
   readonly maxStaleMs: number;
   /**
    * The current version of `principal`. With `live: false`, an entry at most
-   * `maxStaleMs` old answers, a read in flight is shared, and a token claim
-   * newer than the entry raises it; with `live: true`, `read` runs.
+   * `maxStaleMs` old answers and a read in flight is shared; with `live: true`,
+   * `read` runs.
    */
   current: (principal: VersionQuery, read: () => number | undefined | Promise<number | undefined>, options: {
     readonly live: boolean;
   }) => number | undefined | Promise<number | undefined>;
+  /**
+   * Stores a version read at `at` (default now): `bsb.bootstrap()`'s
+   * `authz_ver`, or a token claim dated by its `iat`. A seed never lowers a
+   * cached version, and one dated in the future is ignored.
+   */
+  seed: (principal: string, version: number, at?: Instant) => void;
   /** Drops `principal`'s entry, so the next instance reads the version. */
   evict: (principal: string) => void;
   stats: () => VersionCacheStats;

package/dist/{views-CD8wuL4Z.js → views-MWmJ6Y4P.js}

@@ -1,5 +1,5 @@
 import { r as requiredPlans } from "./problem-details-CLDgX1KV.js";
-import { n as describe } from "./describe-Bb4hGK5d.js";
+import { n as describe } from "./describe-BZAlPHxT.js";
 //#region src/client/views.ts
 function permissionSet(store, permissions, data) {
 	const granted = [];

package/dist/vue/index.d.ts

@@ -1,13 +1,13 @@
-import { Hn as ApprovalRequiredDecision, Un as Decision, Zt as Snapshot, fr as Membership, ht as TokenVerifier, j as PolicyVocabulary } from "../policy-types-DGIO_gxq.js";
+import { $t as Snapshot, Kn as ApprovalRequiredDecision, M as PolicyVocabulary, _t as TokenVerifier, gr as Membership, qn as Decision } from "../policy-types-D-GwfQTc.js";
 import { u as Permission } from "../permission-types-CAY-GU7e.js";
 import { r as Role } from "../vocabulary-DEJ5j4mR.js";
-import { d as UncheckedData, s as RowData } from "../permdock-CprAPN3w.js";
-import { c as requiredPlans } from "../errors-BIM4MFsJ.js";
-import { i as describe, r as DescribeOptions, t as DecisionDescription } from "../describe-BbFPBSms.js";
+import { d as UncheckedData, s as RowData } from "../permdock-ffY4CMd9.js";
+import { c as requiredPlans } from "../errors-TpzkEKgJ.js";
+import { i as describe, r as DescribeOptions, t as DecisionDescription } from "../describe-BKtC_8PG.js";
 import { t as PermissionBoundaryState } from "../boundary-C9ck-3uK.js";
-import { n as ProtectedAction, t as ActionResult } from "../action-result-BcudBQOF.js";
+import { _ as TenantView, a as ClientPermDock, c as GateMode, d as PermissionState, g as SubjectView, h as RolesOptions, i as ApprovalState, l as GateView, m as ProviderOptionsBase, o as ClientStatus, p as ProtectedActionView, r as ApprovalHandle, s as FilterResult, u as PermissionSet, v as ActionResult, y as ProtectedAction } from "../store-DYeB-_U3.js";
+import { a as broadcastChannelRefresh, c as visibilityRefresh, i as authzChangeRefresh, n as EventSourceRefreshOptions, o as eventSourceRefresh, r as RefreshTrigger, s as focusRefresh, t as AuthzChangeRefresh } from "../refresh-on-L9UOwATg.js";
 import { t as approvalHeaders } from "../headers-B9jQxjtW.js";
-import { a as FilterResult, b as eventSourceRefresh, c as PermissionSet, d as ProtectedActionView, f as ProviderOptionsBase, h as TenantView, i as ClientStatus, l as PermissionState, m as SubjectView, n as ApprovalState, o as GateMode, p as RolesOptions, r as ClientPermDock, s as GateView, t as ApprovalHandle, v as EventSourceRefreshOptions, y as RefreshTrigger } from "../types-tQB2CEnY.js";
 import { ComputedRef, DefineComponent, MaybeRefOrGetter, Plugin, VNode } from "vue";
 //#region src/vue/types.d.ts
 type PermDockPluginOptions = ProviderOptionsBase & {
@@ -130,4 +130,4 @@ type ProtectedProps = {
 };
 export declare const Protected: DefineComponent<ProtectedProps>;
 //#endregion
-export { type ActionResult, type ApprovalHandle, type ApprovalState, type ClientPermDock, type ClientStatus, type EventSourceRefreshOptions, type FilterResult, type GateMode, type GateView, type PermDockDefaults, type PermDockPluginOptions, type PermissionBoundaryState, type PermissionSet, type PermissionState, type ProtectedAction, type ProtectedActionRefs, type ProtectedActionView, type ProtectedProps, type RefreshTrigger, type RolesOptions, type SubjectView, type TenantView, approvalHeaders, describe, eventSourceRefresh, requiredPlans };
+export { type ActionResult, type ApprovalHandle, type ApprovalState, type AuthzChangeRefresh, type ClientPermDock, type ClientStatus, type EventSourceRefreshOptions, type FilterResult, type GateMode, type GateView, type PermDockDefaults, type PermDockPluginOptions, type PermissionBoundaryState, type PermissionSet, type PermissionState, type ProtectedAction, type ProtectedActionRefs, type ProtectedActionView, type ProtectedProps, type RefreshTrigger, type RolesOptions, type SubjectView, type TenantView, approvalHeaders, authzChangeRefresh, broadcastChannelRefresh, describe, eventSourceRefresh, focusRefresh, requiredPlans, visibilityRefresh };

package/dist/vue/index.js

@@ -1,10 +1,10 @@
 import { r as requiredPlans } from "../problem-details-CLDgX1KV.js";
-import { n as describe } from "../describe-Bb4hGK5d.js";
+import { n as describe } from "../describe-BZAlPHxT.js";
 import { n as boundaryFallback, t as boundaryDigest } from "../boundary-BV3O1eud.js";
-import { n as actionRunner, r as approvalHeaders, t as actionApproval } from "../protected-action-DUYqb-Ma.js";
-import { a as livePermDock, c as rolesView, d as subjectView, f as tenantView, i as gateView, l as scopedTenant, n as describeWith, o as permissionSet, r as filterResult, s as protectedView, t as approvalHandle, u as slotContent } from "../views-CD8wuL4Z.js";
-import { a as isPromiseLike, r as eventSourceRefresh } from "../store-options-Dil3lraY.js";
-import { n as switchTenant, t as providerStore } from "../provider-store-CaTv00tr.js";
+import { n as actionRunner, r as approvalHeaders, t as actionApproval } from "../protected-action-OpOxtTsN.js";
+import { a as livePermDock, c as rolesView, d as subjectView, f as tenantView, i as gateView, l as scopedTenant, n as describeWith, o as permissionSet, r as filterResult, s as protectedView, t as approvalHandle, u as slotContent } from "../views-MWmJ6Y4P.js";
+import { a as eventSourceRefresh, i as broadcastChannelRefresh, l as isPromiseLike, o as focusRefresh, r as authzChangeRefresh, s as visibilityRefresh } from "../store-options--zWn48PK.js";
+import { n as switchTenant, t as providerStore } from "../provider-store-BQP_pp8s.js";
 import { computed, defineComponent, effectScope, getCurrentScope, inject, isRef, onErrorCaptured, onScopeDispose, provide, shallowRef, toValue, watch } from "vue";
 //#region src/vue/context.ts
 const permDockKey = Symbol("permdock");
@@ -246,4 +246,4 @@ const Protected = defineComponent({
 	}
 });
 //#endregion
-export { PermissionBoundary, Protected, approvalHeaders, describe, eventSourceRefresh, permdockPlugin, requiredPlans, useApproval, useAssignablePermissions, useAssignableRoles, useDescribe, useFilter, useGate, useMemberships, usePermDock, usePermission, usePermissionBoundary, usePermissions, useProtectedAction, useRoles, useSubject, useTenant };
+export { PermissionBoundary, Protected, approvalHeaders, authzChangeRefresh, broadcastChannelRefresh, describe, eventSourceRefresh, focusRefresh, permdockPlugin, requiredPlans, useApproval, useAssignablePermissions, useAssignableRoles, useDescribe, useFilter, useGate, useMemberships, usePermDock, usePermission, usePermissionBoundary, usePermissions, useProtectedAction, useRoles, useSubject, useTenant, visibilityRefresh };

package/dist/{waiter-CqUKX6CY.d.ts → waiter-NK_UuZbb.d.ts}

@@ -1,5 +1,5 @@
-import { Wt as Instant } from "./policy-types-DGIO_gxq.js";
-import { m as ApprovalStore } from "./types-DLvhVm1r.js";
+import { Kt as Instant } from "./policy-types-D-GwfQTc.js";
+import { m as ApprovalStore } from "./types-CqcsNCaN.js";
 //#region src/workflow/waiter.d.ts
 type ApprovalWaitOptions = {
   /**

package/dist/{watch-DAkjm75Y.js → watch-CBHADqBH.js}

@@ -1,8 +1,8 @@
 import { i as dateAt } from "./time-nR1JesoH.js";
-import { a as describeError } from "./errors-Vpu6rKHl.js";
+import { a as describeError } from "./errors-BhRkoNS7.js";
 import { t as defaultSrcPath } from "./files-BSjrtIHw.js";
-import { r as runCollect } from "./collect-WCl8cJQV.js";
-import { n as isConfigFile, r as loadConfig } from "./config-CcLlvEYW.js";
+import { r as runCollect } from "./collect-D878zLDP.js";
+import { n as isConfigFile, r as loadConfig } from "./config-COHmivz9.js";
 import { watch } from "node:fs";
 import { basename, dirname, relative, resolve, sep } from "node:path";
 //#region src/cli/watch.ts

package/dist/watch-OYwAPCzx.js

@@ -0,0 +1 @@
+export { i as watchCollect } from "./watch-CBHADqBH.js";

package/dist/webmcp/index.d.ts

@@ -1,4 +1,4 @@
-import { Un as Decision, Zt as Snapshot } from "../policy-types-DGIO_gxq.js";
+import { $t as Snapshot, qn as Decision } from "../policy-types-D-GwfQTc.js";
 import { f as PermissionTree, u as Permission } from "../permission-types-CAY-GU7e.js";
 import { StandardSchemaV1 } from "@standard-schema/spec";
 //#region src/webmcp/types.d.ts

package/dist/webmcp/index.js

@@ -3,7 +3,7 @@ import { n as PermDockValidationError } from "../validation-error-CYg2kJEw.js";
 import { c as listPermissions, f as resourceOfNode, i as getRegistry, m as annotationsFor, s as isRegistryTree } from "../permission-registry-B8tYxPIt.js";
 import { n as isThenable, t as ignoreRejection } from "../thenable-BNSM1U2R.js";
 import { n as resourceRef } from "../resource-ref-CaS9yVPi.js";
-import { n as deniedToolRefusal, r as toolErrorResult, t as approvalToolRefusal } from "../tool-refusal-Qpjs_W6M.js";
+import { n as deniedToolRefusal, r as toolErrorResult, t as approvalToolRefusal } from "../tool-refusal-D4spOJ7I.js";
 //#region src/webmcp/register.ts
 const MISSING_CONTEXT = "permdock/webmcp: document.modelContext is absent; registerTools is a no-op.";
 const CURRENT = Symbol.for("permdock.current");

package/dist/{where-scope-DlCdCM_8.js → where-scope-BKrqUDVk.js}

@@ -2,12 +2,12 @@ import { a as sole, r as isRecord, t as compact } from "./compact-CAf557ZB.js";
 import { n as freezeDeep } from "./freeze-jjan0lCv.js";
 import { t as loadPrincipal } from "./principal-source-C6N60GtM.js";
 import { g as secondsOf, m as rfc3339 } from "./time-nR1JesoH.js";
-import { d as scopeIdOf, f as scopeList, h as tenantOf, r as findScope, s as resolveScope, t as activeFor, u as scopeChain } from "./scopes-0Up_UA2t.js";
-import { a as readOnlyActorRefuses, n as coveredByDelegation } from "./delegation-CDB6_keF.js";
+import { d as scopeList, l as scopeChain, p as tenantOf, r as findScope, s as resolveScope, t as activeFor, u as scopeIdOf } from "./scopes-BSdYaGHs.js";
+import { a as readOnlyActorRefuses, n as coveredByDelegation } from "./delegation-aK4T_5WU.js";
 import { r as readWireValidity, t as isActive } from "./validity-Buc7w8E9.js";
-import { o as resourceRoleCondition } from "./grantee-conditions-BrYPe-w0.js";
-import { c as nowSeconds, n as inTeam, o as membershipField, r as isMembershipExpired } from "./tenancy-5d1zVBvK.js";
-import { a as bindConditionRefs, n as parseSnapshot } from "./snapshot-CXlzi69u.js";
+import { o as resourceRoleCondition } from "./grantee-conditions-DX4K_gGI.js";
+import { c as nowSeconds, n as inTeam, o as membershipField, r as isMembershipExpired } from "./tenancy-DvOHHk3-.js";
+import { a as bindConditionRefs, n as parseSnapshot } from "./snapshot-DN_8J27z.js";
 //#region src/core/snapshot-sign.ts
 /**
 * The claims `signSnapshot` signs for `snapshot`. `issuedAt` and `expiresAt`

package/dist/{who-can-BoDJm0Nc.js → who-can-KhVWMxtf.js}

@@ -5,12 +5,12 @@ import { n as internalsOf } from "./internals-B3IgHrvo.js";
 import { a as getResource } from "./permission-registry-B8tYxPIt.js";
 import { a as expandRelation, c as isEdgeRelation, l as isFieldRelation, u as isPrincipalRelation } from "./resource-relations-8-pCScBO.js";
 import { s as instantAt } from "./time-nR1JesoH.js";
-import { f as scopeList, l as rootScope, o as normalizeMemberships, s as resolveScope } from "./scopes-0Up_UA2t.js";
+import { c as rootScope, d as scopeList, o as normalizeMemberships, s as resolveScope } from "./scopes-BSdYaGHs.js";
 import { o as flattenGrantee } from "./grantee-Dke-9rd1.js";
 import { t as byCodePoint } from "./compare-DTfyUunF.js";
-import { r as relationCondition } from "./grantee-conditions-BrYPe-w0.js";
-import { c as nowSeconds, p as scopeField } from "./tenancy-5d1zVBvK.js";
-import { D as emptyListeners, t as evaluate } from "./evaluate-BAmf_AQd.js";
+import { r as relationCondition } from "./grantee-conditions-DX4K_gGI.js";
+import { c as nowSeconds, p as scopeField } from "./tenancy-DvOHHk3-.js";
+import { D as emptyListeners, t as evaluate } from "./evaluate-Czbj7thS.js";
 import { n as relationId, t as pendingRelations } from "./relations-BxvRvDHK.js";
 import { t as relationWalk } from "./relation-walk-DK_gkgL7.js";
 //#region src/core/who-can.ts

package/dist/workflow/index.d.ts

@@ -1,5 +1,5 @@
-import { a as AutomationSource, i as AutomationRequest, l as memoryAutomationSource, n as AutomationDecision, r as AutomationMode, s as MemoryAutomationSource, t as Automation, u as parseAutomation } from "../automation-C6Jg75xq.js";
-import { i as pollingApprovalWaiter, n as ApprovalWaiter, r as PollingApprovalWaiterOptions, t as ApprovalWaitOptions } from "../waiter-CqUKX6CY.js";
-import { a as WorkflowPermDockOptions, i as WorkflowPermDock, n as AwaitApprovalOptions, o as createPermDock, r as StartAutomationResult, t as AutomationOptions } from "../create-CDd9c22W.js";
+import { a as AutomationSource, i as AutomationRequest, l as memoryAutomationSource, n as AutomationDecision, r as AutomationMode, s as MemoryAutomationSource, t as Automation, u as parseAutomation } from "../automation-Bfa_wD1h.js";
+import { i as pollingApprovalWaiter, n as ApprovalWaiter, r as PollingApprovalWaiterOptions, t as ApprovalWaitOptions } from "../waiter-NK_UuZbb.js";
+import { a as WorkflowPermDockOptions, i as WorkflowPermDock, n as AwaitApprovalOptions, o as createPermDock, r as StartAutomationResult, t as AutomationOptions } from "../create-BrQXL-Wt.js";
 import "../index-CaxrMD1A.js";
 export { type ApprovalWaitOptions, type ApprovalWaiter, type Automation, type AutomationDecision, type AutomationMode, type AutomationOptions, type AutomationRequest, type AutomationSource, type AwaitApprovalOptions, type MemoryAutomationSource, type PollingApprovalWaiterOptions, type StartAutomationResult, type WorkflowPermDock, type WorkflowPermDockOptions, createPermDock, memoryAutomationSource, parseAutomation, pollingApprovalWaiter };

package/dist/workflow/index.js

@@ -4,10 +4,10 @@ import { a as isId } from "../expiry-6XByK0dm.js";
 import { n as findPermission } from "../permission-registry-B8tYxPIt.js";
 import { n as isThenable } from "../thenable-BNSM1U2R.js";
 import { n as memoryAutomationSource, r as parseAutomation } from "../automation-x3KEUusw.js";
-import { l as withApp, t as getPermDock } from "../permdock-BvjivVb9.js";
+import { l as withApp, t as getPermDock } from "../permdock-D-_WrdKu.js";
 import { o as automationEvent } from "../sink-D9_vh372.js";
-import { a as requestApproval, s as resumeDecision } from "../helpers-DJicaG6f.js";
-import { i as subjectFromRunTicket, r as signRunTicket } from "../run-ticket-DfnZCh-u.js";
+import { a as requestApproval, s as resumeDecision } from "../helpers-DmqGy63f.js";
+import { i as subjectFromRunTicket, r as signRunTicket } from "../run-ticket-CjvXr6wj.js";
 import { t as pollingApprovalWaiter } from "../waiter-aBLM63_f.js";
 //#region src/workflow/create.ts
 function writeQuietly(sink, event) {
@@ -83,7 +83,8 @@ function createPermDock(policy, given) {
 				kind: "service",
 				tenant: current.tenant,
 				memberships: [{
-					tenant: current.tenant,
+					scope: "tenant",
+					id: current.tenant,
 					roles: current.roles ?? []
 				}]
 			});

package/dist/workflow-sdk/index.d.ts

@@ -1,8 +1,8 @@
-import { Un as Decision } from "../policy-types-DGIO_gxq.js";
+import { qn as Decision } from "../policy-types-D-GwfQTc.js";
 import { u as Permission } from "../permission-types-CAY-GU7e.js";
-import { a as PermDock } from "../permdock-CprAPN3w.js";
-import { n as ApprovalWaiter } from "../waiter-CqUKX6CY.js";
-import { i as WorkflowPermDock, r as StartAutomationResult, t as AutomationOptions } from "../create-CDd9c22W.js";
+import { a as PermDock } from "../permdock-ffY4CMd9.js";
+import { n as ApprovalWaiter } from "../waiter-NK_UuZbb.js";
+import { i as WorkflowPermDock, r as StartAutomationResult, t as AutomationOptions } from "../create-BrQXL-Wt.js";
 //#region src/workflow-sdk/index.d.ts
 /**
  * The part of a Workflow SDK `Hook` the waiter reads: awaiting it suspends the

package/dist/{wrap-DxXB54Wu.d.ts → wrap-BHGA-SMM.d.ts}

@@ -1,5 +1,5 @@
-import { j as PolicyVocabulary } from "./policy-types-DGIO_gxq.js";
-import { a as PermDock } from "./permdock-CprAPN3w.js";
+import { M as PolicyVocabulary } from "./policy-types-D-GwfQTc.js";
+import { a as PermDock } from "./permdock-ffY4CMd9.js";
 //#region src/core/wrap.d.ts
 /** A wrapper an adapter applies to each instance it builds, as `withOtel` does. */
 type PermDockWrap = <V extends PolicyVocabulary>(permdock: PermDock<V>) => PermDock<V>;

package/dist/{wrap-B2wziJI_.js → wrap-C5PWzgkq.js}

@@ -1,5 +1,5 @@
 import { n as internalsOf, t as attachInternals } from "./internals-B3IgHrvo.js";
-import { i as decideAllWith, n as canAllWith } from "./checks-CGkP3Z7A.js";
+import { i as decideAllWith, n as canAllWith } from "./checks-fyDOhcz0.js";
 //#region src/core/wrap.ts
 /**
 * A frozen copy of `permdock` with the members `overrides` returns replaced.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "permdock",
-  "version": "0.16.0",
+  "version": "0.18.0",
   "description": "Typed permissions for TypeScript apps, APIs, databases, and AI agents, with the permdock CLI and test runners.",
   "keywords": [
     "ai-agents",
@@ -243,6 +243,10 @@
       "types": "./dist/supabase/middleware.d.ts",
       "default": "./dist/supabase/middleware.js"
     },
+    "./supabase/client": {
+      "types": "./dist/supabase/client.d.ts",
+      "default": "./dist/supabase/client.js"
+    },
     "./ssf": {
       "types": "./dist/ssf/index.d.ts",
       "default": "./dist/ssf/index.js"
@@ -333,7 +337,6 @@
     "@orpc/contract": "2.0.0-beta.44",
     "@orpc/openapi": "2.0.0-beta.44",
     "@orpc/server": "2.0.0-beta.44",
-    "@permdock/ox-config": "0.0.0",
     "@permdock/typescript-config": "0.0.0",
     "@solidjs/start": "2.0.6",
     "@supabase/middleware": "1.0.0",
@@ -353,8 +356,8 @@
     "ajv": "8.20.0",
     "astro": "7.4.0",
     "babel-plugin-react-compiler": "1.0.0",
-    "better-supabase": "0.29.0",
-    "better-supabase-floor": "npm:better-supabase@0.29.0",
+    "better-supabase": "0.39.0",
+    "better-supabase-floor": "npm:better-supabase@0.39.0",
     "chat": "4.42.0",
     "diff": "9.0.0",
     "drizzle-orm": "1.0.0-rc.5-5935859",
@@ -411,7 +414,7 @@
     "@trpc/server": ">=11",
     "ai": ">=5",
     "astro": ">=5",
-    "better-supabase": ">=0.29.0",
+    "better-supabase": ">=0.39.0",
     "chat": ">=4",
     "drizzle-orm": ">=0.40 || >=1.0.0-rc.0",
     "elysia": ">=1",

package/schemas/approval-request-v1.json

@@ -102,6 +102,11 @@
     "consumedAt": {
       "$ref": "#/$defs/instant"
     },
+    "fingerprint": {
+      "type": "string",
+      "pattern": "^[0-9a-f]{64}$",
+      "description": "The approvalFingerprint the request was opened under; a resume under another one is refused."
+    },
     "x": {
       "type": "object",
       "description": "The application's own data, set when the request opens: plain JSON, never read by a decision."

package/schemas/catalog-v1.json

@@ -294,9 +294,19 @@
                   "type": "object",
                   "properties": {
                     "by": {},
-                    "mode": {
+                    "combine": {
                       "enum": ["any", "all", "sequential"]
                     },
+                    "mode": {
+                      "description": "confirm or authorize; a catalog written before 0.17 holds any, all or sequential here, read as combine.",
+                      "enum": [
+                        "confirm",
+                        "authorize",
+                        "any",
+                        "all",
+                        "sequential"
+                      ]
+                    },
                     "stages": {
                       "type": "array",
                       "items": {
@@ -312,6 +322,7 @@
                       }
                     },
                     "distinct": {
+                      "description": "Written before 0.17; false reads as mode: confirm.",
                       "type": "boolean"
                     },
                     "staleOn": {
@@ -425,9 +436,13 @@
                 "type": "object",
                 "properties": {
                   "by": {},
-                  "mode": {
+                  "combine": {
                     "enum": ["any", "all", "sequential"]
                   },
+                  "mode": {
+                    "description": "confirm or authorize; a catalog written before 0.17 holds any, all or sequential here, read as combine.",
+                    "enum": ["confirm", "authorize", "any", "all", "sequential"]
+                  },
                   "stages": {
                     "type": "array",
                     "items": {
@@ -443,6 +458,7 @@
                     }
                   },
                   "distinct": {
+                    "description": "Written before 0.17; false reads as mode: confirm.",
                     "type": "boolean"
                   },
                   "staleOn": {

package/schemas/cli-result-v1.json

@@ -64,8 +64,6 @@
             "unknown_command",
             "unknown_flag",
             "invalid_value",
-            "command_moved",
-            "flag_renamed",
             "missing_value",
             "config_not_found",
             "config_invalid",

package/schemas/snapshot-v1.json

@@ -9,6 +9,15 @@
     "v": { "const": 1 },
     "issuedAt": { "$ref": "#/$defs/instant" },
     "expiresAt": { "$ref": "#/$defs/instant" },
+    "authzVersion": {
+      "type": "integer",
+      "minimum": 0,
+      "description": "The token's authz_ver the snapshot was built from."
+    },
+    "sessionId": {
+      "type": "string",
+      "description": "The Auth session_id the snapshot was built for."
+    },
     "subject": {
       "type": "object",
       "required": ["principal", "context"],

package/schemas/supabase-manifest-v1.json

@@ -510,7 +510,7 @@
     },
     "helperName": {
       "type": "string",
-      "pattern": "^(permdock_has(_for)?|permitted_[a-z][a-z0-9_]*_(ids|permission_keys)(_for)?|permitted_[a-z][a-z0-9_]*_users|member_[a-z][a-z0-9_]*_ids(_for|_of)?|permdock_can_assign(_any|_custom_role)?(_for)?|permdock_api_key_allows|permdock_token_scope_allows|permdock_actor_may_write|permdock_is_approver|permdock_user_id)$"
+      "pattern": "^(permdock_has(_for)?|permitted_[a-z][a-z0-9_]*_(ids|permission_keys)(_for)?|permitted_[a-z][a-z0-9_]*_users|member_[a-z][a-z0-9_]*_ids(_for|_of)?|permdock_can_assign(_any|_custom_role)?(_for)?|permdock_api_key_allows|permdock_token_scope_allows|permdock_actor_may_write|permdock_is_approver|permdock_manages|permdock_user_id)$"
     },
     "column": {
       "type": "object",