permdock 0.16.0 → 0.18.0

package/dist/{doctor-D1Xnmy6u.js → doctor-CkYKCuX7.js}

@@ -3,48 +3,49 @@ import { o as hasConditionOp } from "./refs-C8BKxc_e.js";
 import { c as listPermissions, h as formerKeys } from "./permission-registry-B8tYxPIt.js";
 import { u as isPrincipalRelation } from "./resource-relations-8-pCScBO.js";
 import { t as canonicalJson } from "./canonical-json-DwilZ1iB.js";
-import { f as scopeList, l as rootScope, o as normalizeMemberships, s as resolveScope } from "./scopes-0Up_UA2t.js";
+import { c as rootScope, d as scopeList, o as normalizeMemberships, s as resolveScope } from "./scopes-BSdYaGHs.js";
 import { o as flattenGrantee } from "./grantee-Dke-9rd1.js";
-import { u as separationConflicts } from "./policy-CLQ8__GF.js";
-import { T as validateCustomRole } from "./evaluate-BAmf_AQd.js";
-import { s as parseCredential } from "./credential-CyyyvCsL.js";
-import { a as describeError } from "./errors-Vpu6rKHl.js";
+import { u as separationConflicts } from "./policy-cV_wwPb8.js";
+import { T as validateCustomRole } from "./evaluate-Czbj7thS.js";
+import { s as parseCredential } from "./credential-B3Hj4puZ.js";
+import { a as describeError } from "./errors-BhRkoNS7.js";
 import { t as policyRowConditionKeys } from "./row-conditions-BAGHOmVq.js";
 import { a as rel, n as doctorSrcPath, o as sqlFiles, r as listSourceFiles } from "./files-BSjrtIHw.js";
 import { i as DOCTOR_REPORT_SCHEMA } from "./version-DMQ0dnN5.js";
-import { c as jsonSchemaOf, i as catalogOAuthScopes } from "./catalog-doc-DjMKzJp9.js";
-import { a as loadModule, i as loadConfiguredPolicy, n as asPolicy, s as pickNamed } from "./load-DjSU5KXO.js";
+import { c as jsonSchemaOf, i as catalogOAuthScopes } from "./catalog-doc-C4DGfJCO.js";
+import { a as loadModule, i as loadConfiguredPolicy, n as asPolicy, s as pickNamed } from "./load-BaEamml-.js";
 import { t as catalogPath } from "./catalog-path-CnI0XTFK.js";
-import { r as runCollect } from "./collect-WCl8cJQV.js";
-import { n as supabaseTenantClaim } from "./budget-BELja5A9.js";
-import { a as nodeFiles, i as filesOf, n as betterSupabaseDefaults, o as readJson, r as betterSupabaseTenantClaim, t as betterSupabaseConfig } from "./better-supabase-Dirf_8Ec.js";
+import { r as runCollect } from "./collect-D878zLDP.js";
+import { n as supabaseTenantClaim } from "./budget-BBCPDOGP.js";
+import { a as filesOf, i as betterSupabaseTenantClaim, n as betterSupabaseConfig, o as nodeFiles, r as betterSupabaseDefaults, s as readJson, t as betterSupabaseAuthzVersions } from "./better-supabase-BJtQ-kNf.js";
 import { i as qualifySqlTable, s as quoteSqlLiteral } from "./sql-0WjxIp9g.js";
-import { a as scopeMembershipTable } from "./compile-EzEMB-7v.js";
+import { a as scopeMembershipTable } from "./compile-B_oJqmIg.js";
 import { d as keptKeys, r as PERMDOCK_SCHEMA } from "./sources-C4vkzZJV.js";
-import { t as parseCatalog } from "./parse-1_ZheTW5.js";
+import { t as parseCatalog } from "./parse-UTC-sDrt.js";
 import { n as activeTenantMismatch } from "./active-tenant-DVee32-T.js";
 import "./markers-BeHZ4x9Q.js";
-import { t as didYouMean } from "./args-0FrVs5EH.js";
-import { t as DOCS_BASE } from "./manifest-Cft51TLK.js";
+import { t as didYouMean } from "./args-iafbHiXn.js";
+import { t as DOCS_BASE } from "./manifest-wclLWBVH.js";
 import { t as createStyle } from "./style-Ds11Hmk4.js";
-import { a as nonEmptyOr, r as findingOf } from "./output-DlICTjBh.js";
-import { i as runSkillsInstall } from "./skills-Celu2W6v.js";
+import { a as nonEmptyOr, r as findingOf } from "./output-BFWLER4r.js";
+import { i as runSkillsInstall } from "./skills-B4MPRxQd.js";
 import { n as MIGRATION_DIRS, t as DEFAULT_SENSITIVE_ACTIONS } from "./constants-DcJABbLW.js";
-import { l as partPath } from "./output-files-BIQ_9pIs.js";
-import { _ as readSupabaseConfig, a as supabaseHookManifest, c as activeSource, d as resolveSchemas, g as pd074, h as pd045, l as pd039, m as attrsPlan, n as hookOut, v as supabaseConfig } from "./supabase-hook-HPgwYb9V.js";
-import { G as byKey, Q as graphSqlName, n as tableNameOf, o as graphPlan, r as tableNames } from "./tables-DimBcVWY.js";
-import { a as guardedTables, p as contextRefs, r as unsatisfiedKinds, t as ownershipRules } from "./ownership-qqBuGJXr.js";
+import { l as partPath } from "./output-files-CM0BnH05.js";
+import { _ as readSupabaseConfig, a as supabaseHookManifest, c as activeSource, d as resolveSchemas, g as pd074, h as pd045, l as pd039, m as attrsPlan, n as hookOut, v as supabaseConfig } from "./supabase-hook-DX38Hj8h.js";
+import { G as byKey, Q as graphSqlName, n as tableNameOf, o as graphPlan, r as tableNames } from "./tables-BfOk0ymL.js";
+import { a as guardedTables, p as contextRefs, r as unsatisfiedKinds, t as ownershipRules } from "./ownership-D-mIt-w0.js";
 import { t as membershipSourcesOf } from "./sources-qoIJQrJv.js";
 import { i as group, n as membershipColumns, o as sqlStatements, r as tableKey } from "./deciding-columns-NB4wcyBf.js";
-import { t as FIELD_VIEWS } from "./fields-DI8s3cPl.js";
-import { t as resolveNames } from "./resolve-names-Y1Cb22cp.js";
-import { a as pd010, c as pd014, d as pd038, f as pd041, i as pd008, l as pd015, n as pd001, o as pd011, p as pd057, r as pd007, s as pd013, t as runUsage, u as pd036 } from "./usage-CPXeuAdT.js";
-import { d as rowConditionMessage, f as commandFor, m as tableFor, p as compileGrants, s as ROW_CONDITION_FIX, u as helperTablePolicies } from "./verify-DfT0QYNh.js";
-import { a as streamOf, i as scopeSourcesOf, r as staleFiles, t as powersyncFiles } from "./powersync-CBhTBhG2.js";
-import { a as buildContext, n as generateOptions, r as isRefusal, s as inheritTargets, t as supautilsRejections } from "./supautils-SwE642N1.js";
+import { t as FIELD_VIEWS } from "./fields-CrjL6A49.js";
+import { t as resolveNames } from "./resolve-names-CBl4r4_r.js";
+import { a as pd010, c as pd014, d as pd038, f as pd041, i as pd008, l as pd015, n as pd001, o as pd011, p as pd057, r as pd007, s as pd013, t as runUsage, u as pd036 } from "./usage-DC0UKe6C.js";
+import { d as rowConditionMessage, f as commandFor, m as tableFor, p as compileGrants, s as ROW_CONDITION_FIX, u as helperTablePolicies } from "./verify-Bpj0hauG.js";
+import { a as streamOf, i as scopeSourcesOf, r as staleFiles, t as powersyncFiles } from "./powersync-9PYOE1wt.js";
+import { a as buildContext, n as generateOptions, r as isRefusal, s as inheritTargets, t as supautilsRejections } from "./supautils-BGf6zRvM.js";
 import { n as legacyHelperNames, r as retirePlan, t as legacyHelperCalls } from "./retire-B2xffQgY.js";
 import { basename, dirname, join, resolve } from "node:path";
 import { pathToFileURL } from "node:url";
+import { Visitor, parseSync } from "oxc-parser";
 import { createRequire } from "node:module";
 //#region src/cli/project/project.ts
 function loadProject(input) {
@@ -295,6 +296,23 @@ async function pd079(input) {
 		fix: `declare ${key} in the policy and run permdock collect, or map the block action to a key the catalog lists`
 	}));
 }
+/**
+* PermDock's hook keeps `permdock_authz_version` and better-supabase's
+* `sessions.authzVersions` keeps `user_authz_versions`: two tables bump on
+* different triggers, and only one reaches the `authz_ver` claim.
+*/
+async function pd082(input) {
+	const hook = input.config.supabase?.hook;
+	if (hook === void 0 || hook.version === false) return [];
+	const config = await betterSupabaseConfig(input);
+	if (config === void 0 || !betterSupabaseAuthzVersions(config)) return [];
+	return [{
+		code: "PD082",
+		severity: "warning",
+		message: "supabase.hook keeps permdock_authz_version and better-supabase's blocks.sessions.authzVersions keeps user_authz_versions: two version tables bump on different triggers, and only PermDock's reaches the authz_ver claim",
+		fix: "turn blocks.sessions.authzVersions off; PermDock's trigger broadcasts on better_supabase:authz and authz:<uid>, which better-supabase's subscribeAuthzVersions and SessionProvider read"
+	}];
+}
 //#endregion
 //#region src/cli/doctor/catalog.ts
 /**
@@ -761,7 +779,7 @@ async function pd025(input) {
 		findings.push({
 			code: "PD025",
 			severity: "warning",
-			message: `membership ${membership.principal ?? String(index)} grants nothing: its scope is not one of ${names}, a parent id is missing from within, or it mixes shapes`,
+			message: `membership ${membership.principal ?? String(index)} grants nothing: its scope is not one of ${names}, a parent id is missing from within, it mixes shapes, or it uses the { tenant, team } form 0.17.0 removed (permdock codemod 0.17 rewrites it)`,
 			fix: "use { scope, id, within: { <parent>: id }, roles } with a declared scope, or { on: { resource, id }, roles }"
 		});
 	}
@@ -854,6 +872,115 @@ async function pd065(input) {
 	})));
 }
 //#endregion
+//#region src/cli/doctor/per-request.ts
+/** Factories whose answers or entries only pay off when one is shared. */
+const SHARED_FACTORIES = {
+	postgrestSources: "PD080",
+	memoryVersionCache: "PD080",
+	claimsFirst: "PD080",
+	instanceCache: "PD081"
+};
+/** Factories whose cost differs from their code's message. */
+const FACTORY_MESSAGES = { claimsFirst: {
+	what: "so every call passes a new memberships source, which the instance cache compares by identity, and no instance is reused",
+	fix: "create claimsFirst(...) once at module scope, or use permdockFor(...).sources(versions), and pass the same object to every adapter"
+} };
+const MESSAGES = {
+	PD080: {
+		what: "so every call starts with no shared version reads",
+		fix: "create it once at module scope and pass the same object to every getPermDock call"
+	},
+	PD081: {
+		what: "so every call gets an empty cache and no instance is reused",
+		fix: "create one instanceCache() at module scope and pass it as instances to every adapter"
+	}
+};
+function isPermDockSpecifier(value) {
+	return value === "permdock" || value.startsWith("permdock/");
+}
+/**
+* The calls to `postgrestSources`, `memoryVersionCache` and `instanceCache`
+* imported from PermDock that sit inside a function body, except the right side
+* of a `??=`, which builds the object once.
+*/
+function callsInFunctions(source) {
+	const { program } = parseSync(source.file, source.text);
+	const names = /* @__PURE__ */ new Map();
+	const namespaces = /* @__PURE__ */ new Set();
+	const lazy = [];
+	const found = [];
+	let depth = 0;
+	const enter = () => {
+		depth += 1;
+	};
+	const exit = () => {
+		depth -= 1;
+	};
+	new Visitor({
+		ImportDeclaration(node) {
+			if (node.importKind === "type" || !isPermDockSpecifier(node.source.value)) return;
+			for (const specifier of node.specifiers) if (specifier.type === "ImportNamespaceSpecifier") namespaces.add(specifier.local.name);
+			else if (specifier.type === "ImportSpecifier" && specifier.importKind !== "type") {
+				const imported = specifier.imported.type === "Identifier" ? specifier.imported.name : specifier.imported.value;
+				if (Object.hasOwn(SHARED_FACTORIES, imported)) names.set(specifier.local.name, imported);
+			}
+		},
+		FunctionDeclaration: enter,
+		"FunctionDeclaration:exit": exit,
+		FunctionExpression: enter,
+		"FunctionExpression:exit": exit,
+		ArrowFunctionExpression: enter,
+		"ArrowFunctionExpression:exit": exit,
+		AssignmentExpression(node) {
+			if (node.operator === "??=") lazy.push({
+				start: node.right.start,
+				end: node.right.end
+			});
+		},
+		CallExpression(node) {
+			if (depth === 0) return;
+			const { callee } = node;
+			let factory;
+			if (callee.type === "Identifier") factory = names.get(callee.name);
+			else if (callee.type === "MemberExpression" && callee.object.type === "Identifier" && namespaces.has(callee.object.name) && callee.property.type === "Identifier" && Object.hasOwn(SHARED_FACTORIES, callee.property.name)) factory = callee.property.name;
+			if (factory !== void 0) found.push({
+				call: node,
+				factory
+			});
+		}
+	}).visit(program);
+	return found.filter(({ call }) => !lazy.some((range) => call.start >= range.start && call.end <= range.end));
+}
+function findings(sources, code) {
+	const out = [];
+	for (const source of sources) {
+		if (!source.text.includes("permdock")) continue;
+		for (const { call, factory } of callsInFunctions(source)) {
+			if (SHARED_FACTORIES[factory] !== code) continue;
+			const line = source.text.slice(0, call.start).split("\n").length;
+			const { what, fix } = FACTORY_MESSAGES[factory] ?? MESSAGES[code];
+			out.push({
+				code,
+				severity: "warning",
+				message: `${source.file}:${String(line)} creates ${factory}() inside a function, ${what}`,
+				fix
+			});
+		}
+	}
+	return out;
+}
+/**
+* PD080: `postgrestSources`, `memoryVersionCache` or `claimsFirst` created per
+* call.
+*/
+function pd080(sources) {
+	return findings(sources, "PD080");
+}
+/** PD081: `instanceCache` created per call. */
+function pd081(sources) {
+	return findings(sources, "PD081");
+}
+//#endregion
 //#region src/cli/doctor/policy.ts
 async function pd017(input) {
 	if (input.config.policy === void 0) return [];
@@ -886,12 +1013,12 @@ async function pd024(input) {
 	const findings = [];
 	for (const grant of policy.grants) {
 		const approval = grant.approval;
-		if (grant.effect !== "allow" || approval === void 0 || approval === "human" || approval.distinct !== false) continue;
+		if (grant.effect !== "allow" || approval === void 0 || approval === "human" || approval.mode !== "confirm") continue;
 		findings.push({
 			code: "PD024",
 			severity: "warning",
-			message: `${grant.permission.key}${grant.role === null ? "" : ` (role ${grant.role})`} sets approval.distinct: false, so the requester can approve their own request`,
-			fix: "remove distinct: false unless the requester confirming their own call (an agent asking its user) is the intent"
+			message: `${grant.permission.key}${grant.role === null ? "" : ` (role ${grant.role})`} sets approval.mode: 'confirm', so the requester can approve their own request`,
+			fix: "remove mode: 'confirm' unless the requester confirming their own call (an agent asking its user) is the intent"
 		});
 	}
 	return findings;
@@ -1008,6 +1135,33 @@ async function pd035(input) {
 	return findings;
 }
 //#endregion
+//#region src/cli/doctor/postgrest.ts
+const POSTGREST_IMPORT = /import\s*\{[^}]*\bpostgrestSources\b[^}]*\}\s*from\s*["']permdock\/supabase["']/u;
+function definesFunction(sql, suffix) {
+	return new RegExp(String.raw`create\s+(?:or\s+replace\s+)?function\s+(?:(?:"[^"]+"|\w+)\.)?"?\w*${suffix}"?\s*\(`, "iu").test(sql);
+}
+/**
+* PD083: `postgrestSources` from `permdock/supabase` with a hook file that
+* defines `subject_for` and no `authz_version_for`. Since 0.17.0 `version`
+* calls only the version function, so every `claimsFirst` check fails closed.
+*/
+function pd083(cwd, config, sources, files = nodeFiles) {
+	const user = sources.find((source) => POSTGREST_IMPORT.test(source.text));
+	if (user === void 0) return [];
+	const sql = sqlFiles(cwd, config.doctor?.migrations ?? MIGRATION_DIRS).map((file) => ({
+		file,
+		text: files.read(file)
+	}));
+	const subject = sql.find((item) => definesFunction(item.text, "subject_for"));
+	if (subject === void 0 || sql.some((item) => definesFunction(item.text, "authz_version_for"))) return [];
+	return [{
+		code: "PD083",
+		severity: "error",
+		message: `${rel(cwd, user.file)} uses postgrestSources and ${rel(cwd, subject.file)} defines subject_for but no authz_version_for, so every version read fails and claimsFirst denies`,
+		fix: "run permdock supabase hook generate (with supabase.hook.api for the PostgREST wrappers) and apply the migration it writes"
+	}];
+}
+//#endregion
 //#region src/cli/doctor/powersync.ts
 /**
 * Why each membership source of a scope the streams read through sources has no
@@ -1062,6 +1216,29 @@ async function pd058(input) {
 		fix: "run permdock powersync generate and deploy the files"
 	})), ...gaps];
 }
+/**
+* PD084: a synced stream reads a token claim. PowerSync keeps the claims a
+* connection started with, so after a role or tenant change the device syncs by
+* the old claims until the app refreshes the session and reconnects.
+*/
+async function pd084(input) {
+	const { config } = input;
+	if (config.powersync === void 0 || config.policy === void 0) return [];
+	const policy = await policyOf(input);
+	if (policy === void 0) return [];
+	let claims;
+	try {
+		({claims} = powersyncFiles(policy, config));
+	} catch {
+		return [];
+	}
+	return claims.map((message) => ({
+		code: "PD084",
+		severity: "warning",
+		message,
+		fix: "pass nativeRefresh from permdock/react-native to refreshOn, which refreshes the session and reconnects PowerSync on each authz:<uid> message"
+	}));
+}
 //#endregion
 //#region src/cli/doctor/project.ts
 /**
@@ -2345,6 +2522,27 @@ const DOCTOR_CHECKS = [
 		groups: ["catalog", "better-supabase"],
 		run: pd079
 	},
+	{
+		code: "PD080",
+		groups: ["caching"],
+		run: (project) => pd080(project.sources())
+	},
+	{
+		code: "PD081",
+		groups: ["caching"],
+		run: (project) => pd081(project.sources())
+	},
+	{
+		code: "PD082",
+		groups: ["supabase", "better-supabase"],
+		when: (config) => config.supabase?.hook !== void 0,
+		run: pd082
+	},
+	{
+		code: "PD083",
+		groups: ["supabase"],
+		run: (project) => pd083(project.cwd, project.config, project.sources())
+	},
 	{
 		code: "PD005",
 		groups: ["skills"],
@@ -2644,6 +2842,11 @@ const DOCTOR_CHECKS = [
 		groups: ["powersync"],
 		run: pd058
 	},
+	{
+		code: "PD084",
+		groups: ["powersync", "react-native"],
+		run: pd084
+	},
 	{
 		code: "PD061",
 		groups: ["rls", "suspension"],

package/dist/{doctor-CwYc2lJb.js → doctor-xUpR5rXg.js}

@@ -1,5 +1,5 @@
 import { t as defineLeaf } from "./command-L8EstFNm.js";
-import { a as failOnFlag } from "./flags-DXjoTVbS.js";
+import { a as failOnFlag } from "./flags-BlmpmXoY.js";
 import { n as ask, t as CANCELLED } from "./prompt-BYc6drYW.js";
 //#region src/cli/commands/doctor.ts
 const doctor = defineLeaf({
@@ -10,7 +10,7 @@ const doctor = defineLeaf({
 			description: "Check codes or groups to run",
 			valueHint: "code",
 			async complete() {
-				const { DOCTOR_CHECKS } = await import("./doctor-D1Xnmy6u.js");
+				const { DOCTOR_CHECKS } = await import("./doctor-CkYKCuX7.js");
 				return [.../* @__PURE__ */ new Set([...DOCTOR_CHECKS.map(({ code }) => code), ...DOCTOR_CHECKS.flatMap(({ groups }) => groups)])];
 			}
 		},
@@ -27,7 +27,7 @@ const doctor = defineLeaf({
 			if (answer === void 0) return CANCELLED;
 			fix = answer;
 		}
-		return (await import("./doctor-D1Xnmy6u.js")).runDoctor({
+		return (await import("./doctor-CkYKCuX7.js")).runDoctor({
 			cwd: ctx.cwd,
 			config: ctx.config,
 			only: flags.only,

package/dist/drizzle/index.d.ts

@@ -1,7 +1,7 @@
-import { Wt as Instant, br as Condition, hr as Subject } from "../policy-types-DGIO_gxq.js";
-import { f as WhereResult } from "../permdock-CprAPN3w.js";
+import { Kt as Instant, wr as Condition, yr as Subject } from "../policy-types-D-GwfQTc.js";
+import { f as WhereResult } from "../permdock-ffY4CMd9.js";
 import { r as RelationsMapping } from "../graph-sql-BwFC4Qjs.js";
-import { s as MembershipsMapping } from "../compile-BEklRUYo.js";
+import { s as MembershipsMapping } from "../compile-DBm0ub4p.js";
 import { n as RowCheck, t as WithSubjectOptions } from "../subject-settings-vNW8qmUH.js";
 import { SQL, Table } from "drizzle-orm";
 //#region src/drizzle/types.d.ts

package/dist/drizzle/index.js

@@ -1,6 +1,6 @@
 import { t as compact } from "../compact-CAf557ZB.js";
 import { t as assertSafeKey } from "../paths-CUvURzHp.js";
-import { n as compileWhere, r as escapeLike } from "../compile-EzEMB-7v.js";
+import { n as compileWhere, r as escapeLike } from "../compile-B_oJqmIg.js";
 import { a as rowCheckFrom, i as templateOf, r as subjectStatements, s as loadPeer, t as statementTemplate } from "../subject-settings-8sH5HlII.js";
 //#region src/drizzle/to-where.ts
 function loadOperators(injected) {

package/dist/elysia/index.d.ts

@@ -1,9 +1,9 @@
-import { T as Policy, j as PolicyVocabulary, pr as Principal } from "../policy-types-DGIO_gxq.js";
+import { E as Policy, M as PolicyVocabulary, _r as Principal } from "../policy-types-D-GwfQTc.js";
 import { u as Permission } from "../permission-types-CAY-GU7e.js";
-import { a as PermDock } from "../permdock-CprAPN3w.js";
+import { a as PermDock } from "../permdock-ffY4CMd9.js";
 import { n as RevocationFeed } from "../revocations-BaUXHM1N.js";
-import { D as ConnectionOptions, T as Connection, f as InvalidSignatureError, i as OpenApiHooks, o as ProtectOptions, v as discoverViaSignatureAgent, x as webBotAuthVerifier } from "../server-types-CyRN0-Cd.js";
-import { t as ServerAdapterOptions } from "../bind-YYjvfpB9.js";
+import { D as ConnectionOptions, T as Connection, f as InvalidSignatureError, i as OpenApiHooks, o as ProtectOptions, v as discoverViaSignatureAgent, x as webBotAuthVerifier } from "../server-types-3OnXjZ2D.js";
+import { t as ServerAdapterOptions } from "../bind-DR6ku3A9.js";
 import { Elysia } from "elysia";
 //#region src/elysia/create.d.ts
 type ElysiaRequestContext = {

package/dist/elysia/index.js

@@ -1,7 +1,7 @@
 import { a as parsedBody, r as hasCredentials } from "../http-DKLXrFGk.js";
-import { l as InvalidSignatureError, p as webBotAuthVerifier, u as discoverViaSignatureAgent } from "../evaluations-IBceAeKT.js";
-import { t as problemFromError } from "../map-error-pasIGqMT.js";
-import { a as socketConnection, i as decorate, r as bindKernel } from "../bind-BNQA9JK9.js";
+import { l as InvalidSignatureError, p as webBotAuthVerifier, u as discoverViaSignatureAgent } from "../evaluations-h3KoJAPa.js";
+import { t as problemFromError } from "../map-error-BH16Ah8P.js";
+import { a as socketConnection, i as decorate, r as bindKernel } from "../bind-B4pMH9bm.js";
 import { a as onRevoked, n as closeReason, t as POLICY_VIOLATION } from "../stream-CDvF0sJm.js";
 import { Elysia } from "elysia";
 //#region src/elysia/create.ts

package/dist/{errors-Vpu6rKHl.js → errors-BhRkoNS7.js}

@@ -5,8 +5,6 @@ const CODES = {
 	unknown_command: ["Unknown command", 2],
 	unknown_flag: ["Unknown flag", 2],
 	invalid_value: ["Invalid value", 2],
-	command_moved: ["Command moved", 2],
-	flag_renamed: ["Flag renamed", 2],
 	missing_value: ["Missing value", 2],
 	config_not_found: ["Config file not found", 2],
 	config_invalid: ["Invalid config", 2],

package/dist/{errors-BIM4MFsJ.d.ts → errors-TpzkEKgJ.d.ts}

@@ -1,4 +1,4 @@
-import { Un as Decision, hn as WireDenial, hr as Subject } from "./policy-types-DGIO_gxq.js";
+import { _n as WireDenial, qn as Decision, yr as Subject } from "./policy-types-D-GwfQTc.js";
 import { StandardSchemaV1 } from "@standard-schema/spec";
 //#region src/core/problem-details.d.ts
 type Disclosure = "hide" | "reveal";

package/dist/{evaluate-BAmf_AQd.js → evaluate-Czbj7thS.js}

@@ -1,7 +1,7 @@
 import { a as sole, n as isReadonlyArray, t as compact } from "./compact-CAf557ZB.js";
 import { n as freezeDeep } from "./freeze-jjan0lCv.js";
 import { n as isForbiddenKey } from "./paths-CUvURzHp.js";
-import { n as role, t as normalizeAssurance } from "./role-builder-BK2-T6oD.js";
+import { n as role, t as normalizeAssurance } from "./role-builder-CMW4wWzn.js";
 import { n as PermDockValidationError } from "./validation-error-CYg2kJEw.js";
 import { t as wireDenials } from "./wire-denial-C7PaVYEM.js";
 import { o as sameId } from "./expiry-6XByK0dm.js";
@@ -11,19 +11,20 @@ import { n as isThenable, t as ignoreRejection } from "./thenable-BNSM1U2R.js";
 import { i as readAppData } from "./app-data-UNNm07jV.js";
 import { a as durationOf, d as isoNow, o as epochSeconds, r as assertDuration, s as instantAt, t as INVALID_NOW } from "./time-nR1JesoH.js";
 import { t as canonicalJson } from "./canonical-json-DwilZ1iB.js";
-import { c as rootMembershipId, f as scopeList, h as tenantOf, i as keepsPermission, o as normalizeMemberships, p as subjectForPermission, s as resolveScope } from "./scopes-0Up_UA2t.js";
-import { a as readOnlyActorRefuses, c as rowIdOf, i as delegatedPermissions, l as rowValues, n as coveredByDelegation, o as requiresStandIn, r as coversRequirements, s as isRowPair, u as evaluateCondition } from "./delegation-CDB6_keF.js";
+import { d as scopeList, f as subjectForPermission, i as keepsPermission, o as normalizeMemberships, p as tenantOf, s as resolveScope } from "./scopes-BSdYaGHs.js";
+import { a as readOnlyActorRefuses, c as rowIdOf, i as delegatedPermissions, l as rowValues, n as coveredByDelegation, o as requiresStandIn, r as coversRequirements, s as isRowPair, u as evaluateCondition } from "./delegation-aK4T_5WU.js";
 import { a as authenticated, g as isRole, i as assurance, m as findRole, o as flattenGrantee, r as asGrantee } from "./grantee-Dke-9rd1.js";
 import { a as grantCoversField, i as wireValidity, t as isActive } from "./validity-Buc7w8E9.js";
-import { o as resourceRoleCondition } from "./grantee-conditions-BrYPe-w0.js";
-import { c as nowSeconds, i as matchScopedMembership, l as partitionsOf, n as inTeam, p as scopeField, r as isMembershipExpired } from "./tenancy-5d1zVBvK.js";
-import { i as grantList, n as declaredRoleNames, s as levelCondition } from "./policy-CLQ8__GF.js";
+import { o as resourceRoleCondition } from "./grantee-conditions-DX4K_gGI.js";
+import { c as nowSeconds, i as matchScopedMembership, l as partitionsOf, n as inTeam, p as scopeField, r as isMembershipExpired } from "./tenancy-DvOHHk3-.js";
+import { i as grantList, n as declaredRoleNames, s as levelCondition } from "./policy-cV_wwPb8.js";
 import { t as requiresApproval } from "./approval-required-TzNB9oQA.js";
-import { i as versionOf, r as tokenPayload, t as decisionToken } from "./token-DC9EQiet.js";
+import { i as rootMembershipId } from "./subject-C7RddW0G.js";
+import { a as versionOf, i as tokenPayload, n as decisionToken } from "./token-DaMnIU9O.js";
 import { n as resolveRelated } from "./relation-walk-DK_gkgL7.js";
 import { t as eventInstant } from "./event-time-BGy48400.js";
 import { n as toWireDelegation } from "./wire-delegation-Cv3W2eaM.js";
-import { n as matchGrantee, t as combineWhere } from "./grantee-match-7RZZvoT_.js";
+import { n as matchGrantee, t as combineWhere } from "./grantee-match-BP-k4vRJ.js";
 import { t as resourceIdOf } from "./resource-ref-CaS9yVPi.js";
 //#region src/core/approval-state.ts
 /**
@@ -298,7 +299,7 @@ function activateFor(policy, subject, input, now = nowSeconds()) {
 		resourceId: within === void 0 ? `${scope}:${input.id}` : `${scope}:${input.id}@${canonicalJson(within)}`,
 		principal,
 		actor: subject.actor,
-		fingerprint: policy.fingerprint
+		source: policy.fingerprint
 	});
 	if (activation.approval !== void 0) return freezeDeep({
 		outcome: "approval-required",
@@ -671,9 +672,10 @@ function allowedDecision(state, allow, approval, quotaState) {
 		resourceId,
 		principal: subject.principal,
 		actor: subject.actor,
-		fingerprint: policy.fingerprint,
+		source: policy.fingerprint,
 		version,
-		payload: tokenPayload(resourceId, next ?? current, state.options.args)
+		payload: tokenPayload(resourceId, next ?? current, state.options.args),
+		fingerprint: state.options.fingerprint
 	});
 	const matched = compact({
 		...matchedOf(allow.grant, permission.key, allow.breakGlass),
@@ -684,12 +686,13 @@ function allowedDecision(state, allow, approval, quotaState) {
 		...allow.obligations ?? [],
 		...allow.grant.obligations ?? []
 	];
-	return complete(state, requiresApproval(approval) ? {
+	return complete(state, requiresApproval(approval) ? compact({
 		outcome: "approval-required",
 		grant: matched,
 		reason: "human",
-		token
-	} : {
+		token,
+		fingerprint: state.options.fingerprint
+	}) : {
 		outcome: "granted",
 		subject,
 		matched,
@@ -1896,4 +1899,4 @@ function evaluate(policy, given, permission, data, options, env) {
 	return allowedDecision(state, chosen.allow, chosen.approval, chosen.quota);
 }
 //#endregion
-export { breakGlass as A, tenantCustomRoles as C, emptyListeners as D, emitSafe as E, APPROVAL_POLICY_UNAVAILABLE as F, contactMayUse as M, contactMemberships as N, finish as O, isContact as P, roleAllowKeys as S, validateCustomRole as T, isSharedCustomRole as _, expandRoleNames as a, parseCustomRoleEntry as b, andWhere as c, customRoleClaim as d, customRoleId as f, holdsGlobalCustomRole as g, holdsCustomRole as h, customRolesFor as i, supportAccess as j, activate as k, ceilingGrants as l, customRoleScope as m, requirementCondition as n, roleSourceFor as o, customRoleOf as p, assignableNamesFor as r, sourceName as s, evaluate as t, customGrantsFor as u, leveled as v, unknownLevelsFor as w, resolveCustomRole as x, membershipsClaim as y };
+export { breakGlass as A, tenantCustomRoles as C, emptyListeners as D, emitSafe as E, APPROVAL_POLICY_UNAVAILABLE as F, decisionTenant as I, contactMayUse as M, contactMemberships as N, finish as O, isContact as P, roleAllowKeys as S, validateCustomRole as T, isSharedCustomRole as _, expandRoleNames as a, parseCustomRoleEntry as b, andWhere as c, customRoleClaim as d, customRoleId as f, holdsGlobalCustomRole as g, holdsCustomRole as h, customRolesFor as i, supportAccess as j, activate as k, ceilingGrants as l, customRoleScope as m, requirementCondition as n, roleSourceFor as o, customRoleOf as p, assignableNamesFor as r, sourceName as s, evaluate as t, customGrantsFor as u, leveled as v, unknownLevelsFor as w, resolveCustomRole as x, membershipsClaim as y };

package/dist/{evaluations-DOWuBpWv.d.ts → evaluations-CisTTURl.d.ts}

@@ -1,6 +1,6 @@
-import { T as Policy } from "./policy-types-DGIO_gxq.js";
-import { a as PermDock } from "./permdock-CprAPN3w.js";
-import { m as ApprovalStore } from "./types-DLvhVm1r.js";
+import { E as Policy } from "./policy-types-D-GwfQTc.js";
+import { a as PermDock } from "./permdock-ffY4CMd9.js";
+import { m as ApprovalStore } from "./types-CqcsNCaN.js";
 //#region src/server/evaluations.d.ts
 /** AuthZEN 1.0 section 7.1.2.1 `options.evaluations_semantic` values. */
 declare const EVALUATIONS_SEMANTICS: readonly ["execute_all", "deny_on_first_deny", "permit_on_first_permit"];

package/dist/{evaluations-IBceAeKT.js → evaluations-h3KoJAPa.js}

@@ -6,29 +6,10 @@ import { h as secondsAt } from "./time-nR1JesoH.js";
 import { n as resourceRef } from "./resource-ref-CaS9yVPi.js";
 import { n as readBodyText } from "./body-text-DQhcmqdY.js";
 import { f as validationProblem, l as problemResponse, n as batchTooLarge } from "./problem-BVLHFK33.js";
-import { i as readApprovalHeader, s as resumeDecision } from "./helpers-DJicaG6f.js";
+import { i as readApprovalHeader, s as resumeDecision } from "./helpers-DmqGy63f.js";
 import { t as bodyTooLarge } from "./body-CJQwYVa8.js";
 import { t as timeoutSignal } from "./timeout-D51niuQP.js";
-//#region src/core/decision.ts
-/** The denial for a check that failed or named no declared permission. */
-const NO_GRANT = Object.freeze({
-	outcome: "denied",
-	denials: Object.freeze([Object.freeze({
-		role: null,
-		reason: "no-grant"
-	})]),
-	alternatives: Object.freeze([])
-});
-/** The denial for a check whose row loader threw: it fails closed. */
-const LOAD_FAILED = Object.freeze({
-	outcome: "denied",
-	denials: Object.freeze([Object.freeze({
-		role: null,
-		reason: "validation"
-	})]),
-	alternatives: Object.freeze([])
-});
-//#endregion
+import { n as NO_GRANT } from "./decision-CaG5_eNJ.js";
 //#region src/server/evaluation-items.ts
 function firstWins(map, name, leaf) {
 	if (!map.has(name)) map.set(name, leaf);
@@ -628,4 +609,4 @@ function evaluationsHandler(options) {
 	};
 }
 //#endregion
-export { LOAD_FAILED as _, evaluationReasons as a, withRequestId as c, invalidSignatureProblem as d, invalidSignatureResponse as f, wireResourceId as g, permissionLookup as h, evaluateBatch as i, InvalidSignatureError as l, itemResourceData as m, applyApprovalResume as n, evaluationsHandler as o, webBotAuthVerifier as p, authzenMetadata as r, evaluationsSemantic as s, EVALUATIONS_SEMANTICS as t, discoverViaSignatureAgent as u, NO_GRANT as v };
+export { evaluationReasons as a, withRequestId as c, invalidSignatureProblem as d, invalidSignatureResponse as f, wireResourceId as g, permissionLookup as h, evaluateBatch as i, InvalidSignatureError as l, itemResourceData as m, applyApprovalResume as n, evaluationsHandler as o, webBotAuthVerifier as p, authzenMetadata as r, evaluationsSemantic as s, EVALUATIONS_SEMANTICS as t, discoverViaSignatureAgent as u };

package/dist/eve/index.d.ts

@@ -1,8 +1,8 @@
-import { T as Policy, j as PolicyVocabulary, pr as Principal } from "../policy-types-DGIO_gxq.js";
+import { E as Policy, M as PolicyVocabulary, _r as Principal } from "../policy-types-D-GwfQTc.js";
 import { u as Permission } from "../permission-types-CAY-GU7e.js";
-import { a as PermDock } from "../permdock-CprAPN3w.js";
-import { u as ApprovalRequest } from "../types-DLvhVm1r.js";
-import { o as AgentAdapterOptions, t as AgentPermDock } from "../create-BPUopdfL.js";
+import { a as PermDock } from "../permdock-ffY4CMd9.js";
+import { u as ApprovalRequest } from "../types-CqcsNCaN.js";
+import { o as AgentAdapterOptions, t as AgentPermDock } from "../create-BzwjZuRS.js";
 //#region src/eve/create.d.ts
 /** Structural `SessionAuthContext` from `eve`. */
 type EvePrincipal = {

package/dist/eve/index.js

@@ -1,8 +1,8 @@
 import { t as compact } from "../compact-CAf557ZB.js";
-import { l as withApp } from "../permdock-BvjivVb9.js";
+import { l as withApp } from "../permdock-D-_WrdKu.js";
 import { c as isApprovalError } from "../types-CcUXciSj.js";
-import { o as resolveApproval } from "../helpers-DJicaG6f.js";
-import { t as agentRuntime } from "../create-Coq5fIrq.js";
+import { o as resolveApproval } from "../helpers-DmqGy63f.js";
+import { t as agentRuntime } from "../create-C-tm3KIF.js";
 import { t as boundedMap } from "../lru-8q4WZjBV.js";
 //#region src/eve/create.ts
 const TOKENS_PER_PROCESS = 1e3;

package/dist/express/index.d.ts

@@ -1,8 +1,8 @@
-import { T as Policy, j as PolicyVocabulary, pr as Principal } from "../policy-types-DGIO_gxq.js";
+import { E as Policy, M as PolicyVocabulary, _r as Principal } from "../policy-types-D-GwfQTc.js";
 import { u as Permission } from "../permission-types-CAY-GU7e.js";
-import { a as PermDock } from "../permdock-CprAPN3w.js";
-import { f as InvalidSignatureError, i as OpenApiHooks, o as ProtectOptions, v as discoverViaSignatureAgent, x as webBotAuthVerifier } from "../server-types-CyRN0-Cd.js";
-import { t as ServerAdapterOptions } from "../bind-YYjvfpB9.js";
+import { a as PermDock } from "../permdock-ffY4CMd9.js";
+import { f as InvalidSignatureError, i as OpenApiHooks, o as ProtectOptions, v as discoverViaSignatureAgent, x as webBotAuthVerifier } from "../server-types-3OnXjZ2D.js";
+import { t as ServerAdapterOptions } from "../bind-DR6ku3A9.js";
 import { i as toRequest, r as sendResponse } from "../http-B_LphE5Y.js";
 import { ErrorRequestHandler, Request, RequestHandler, Response, Router } from "express";
 //#region src/express/create.d.ts

package/dist/express/index.js

@@ -1,7 +1,7 @@
 import { r as hasCredentials } from "../http-DKLXrFGk.js";
-import { l as InvalidSignatureError, p as webBotAuthVerifier, u as discoverViaSignatureAgent } from "../evaluations-IBceAeKT.js";
-import { t as problemFromError } from "../map-error-pasIGqMT.js";
-import { i as decorate, r as bindKernel } from "../bind-BNQA9JK9.js";
+import { l as InvalidSignatureError, p as webBotAuthVerifier, u as discoverViaSignatureAgent } from "../evaluations-h3KoJAPa.js";
+import { t as problemFromError } from "../map-error-BH16Ah8P.js";
+import { i as decorate, r as bindKernel } from "../bind-B4pMH9bm.js";
 import { n as sendResponse, r as toRequest } from "../http-DH94eh6f.js";
 import express from "express";
 //#region src/express/create.ts