permdock 0.16.0 → 0.18.0

package/dist/fastify/index.d.ts

@@ -1,8 +1,8 @@
-import { T as Policy, j as PolicyVocabulary, pr as Principal } from "../policy-types-DGIO_gxq.js";
+import { E as Policy, M as PolicyVocabulary, _r as Principal } from "../policy-types-D-GwfQTc.js";
 import { u as Permission } from "../permission-types-CAY-GU7e.js";
-import { a as PermDock } from "../permdock-CprAPN3w.js";
-import { f as InvalidSignatureError, i as OpenApiHooks, o as ProtectOptions, v as discoverViaSignatureAgent, x as webBotAuthVerifier } from "../server-types-CyRN0-Cd.js";
-import { t as ServerAdapterOptions } from "../bind-YYjvfpB9.js";
+import { a as PermDock } from "../permdock-ffY4CMd9.js";
+import { f as InvalidSignatureError, i as OpenApiHooks, o as ProtectOptions, v as discoverViaSignatureAgent, x as webBotAuthVerifier } from "../server-types-3OnXjZ2D.js";
+import { t as ServerAdapterOptions } from "../bind-DR6ku3A9.js";
 import { FastifyPluginAsync, FastifyReply, FastifyRequest, FastifySchema, FastifyTypeProvider, FastifyTypeProviderDefault, RawRequestDefaultExpression, RawServerDefault, RouteGenericInterface } from "fastify";
 //#region src/server/http.d.ts
 /** A Fastify-style reply: `code`, `header` and `send`. */

package/dist/fastify/index.js

@@ -1,7 +1,7 @@
 import { c as writeReply, i as headersFrom, n as firstHeader, r as hasCredentials, t as fetchRequest } from "../http-DKLXrFGk.js";
-import { l as InvalidSignatureError, p as webBotAuthVerifier, u as discoverViaSignatureAgent } from "../evaluations-IBceAeKT.js";
-import { t as problemFromError } from "../map-error-pasIGqMT.js";
-import { i as decorate, r as bindKernel } from "../bind-BNQA9JK9.js";
+import { l as InvalidSignatureError, p as webBotAuthVerifier, u as discoverViaSignatureAgent } from "../evaluations-h3KoJAPa.js";
+import { t as problemFromError } from "../map-error-BH16Ah8P.js";
+import { i as decorate, r as bindKernel } from "../bind-B4pMH9bm.js";
 //#region src/fastify/http.ts
 function toRequest(request) {
 	const host = firstHeader(request.headers.host) ?? "localhost";

package/dist/{fetch-adapter-BIbBAtPZ.d.ts → fetch-adapter-BdmfnbJM.d.ts}

@@ -1,8 +1,8 @@
 import { u as Permission } from "./permission-types-CAY-GU7e.js";
 import { a as OperationInput, t as Operation } from "./operations-Ci_rT6Uo.js";
 import { n as RevocationFeed } from "./revocations-BaUXHM1N.js";
-import { o as ProtectOptions } from "./server-types-CyRN0-Cd.js";
-import { t as ServerAdapterOptions } from "./bind-YYjvfpB9.js";
+import { o as ProtectOptions } from "./server-types-3OnXjZ2D.js";
+import { t as ServerAdapterOptions } from "./bind-DR6ku3A9.js";
 //#region src/server/fetch-adapter.d.ts
 /**
  * What `protect` checks: a permission, an operation from `defineOperations`, or

package/dist/{fetch-adapter-dPTgJVHd.js → fetch-adapter-DH-NJPbL.js}

@@ -2,8 +2,8 @@ import { t as compact } from "./compact-CAf557ZB.js";
 import { o as isPermission } from "./permission-registry-B8tYxPIt.js";
 import { r as hasCredentials } from "./http-DKLXrFGk.js";
 import { o as methodNotAllowed } from "./problem-BVLHFK33.js";
-import { t as problemFromError } from "./map-error-pasIGqMT.js";
-import { i as decorate, r as bindKernel } from "./bind-BNQA9JK9.js";
+import { t as problemFromError } from "./map-error-BH16Ah8P.js";
+import { i as decorate, r as bindKernel } from "./bind-B4pMH9bm.js";
 //#region src/server/fetch-adapter.ts
 /**
 * `protect(target, data, options)(handler)` for a framework whose routes are

package/dist/{fields-DI8s3cPl.js → fields-CrjL6A49.js}

@@ -1,7 +1,7 @@
 import { a as sole } from "./compact-CAf557ZB.js";
-import { i as configError } from "./errors-Vpu6rKHl.js";
-import { c as jsonSchemaOf } from "./catalog-doc-DjMKzJp9.js";
-import { A as quoteQualified, D as qualified, E as helperSchema, O as quoteIdent, _ as subjectClaimJsonSql, k as quoteLiteral, s as signedIn } from "./shared-DrGLwM3s.js";
+import { i as configError } from "./errors-BhRkoNS7.js";
+import { c as jsonSchemaOf } from "./catalog-doc-C4DGfJCO.js";
+import { A as quoteQualified, D as qualified, E as helperSchema, O as quoteIdent, _ as subjectClaimJsonSql, k as quoteLiteral, s as signedIn } from "./shared-DyYVEjKC.js";
 //#region src/cli/sql/clauses.ts
 /**
 * True when `sql` is one parenthesised expression, so AND / OR need not wrap it

package/dist/{files-B3AA05f1.js → files-CfiRtQ-m.js}

@@ -1,4 +1,4 @@
-import { n as CliError } from "./errors-Vpu6rKHl.js";
+import { n as CliError } from "./errors-BhRkoNS7.js";
 import { existsSync, mkdirSync, readFileSync, realpathSync, renameSync, rmSync, statSync, writeFileSync } from "node:fs";
 import { dirname, relative, resolve } from "node:path";
 import { execFileSync } from "node:child_process";

package/dist/{fixtures-Bm4_K1ke.js → fixtures-Cemqurt8.js}

@@ -1,16 +1,22 @@
 import { r as isRecord } from "./compact-CAf557ZB.js";
-import { i as configError } from "./errors-Vpu6rKHl.js";
+import { i as configError } from "./errors-BhRkoNS7.js";
 import { i as readJsonFile } from "./files-BSjrtIHw.js";
-import { a as loadModule, s as pickNamed } from "./load-DjSU5KXO.js";
+import { a as loadModule, s as pickNamed } from "./load-BaEamml-.js";
 import { existsSync } from "node:fs";
 import { resolve } from "node:path";
 //#region src/cli/fixtures.ts
+function checkChange(item, index) {
+	const after = item["after"];
+	if (!isRecord(after) || item["expected"] !== "changed" || item["action"] !== void 0 || item["table"] !== void 0 || item["stream"] !== void 0 && (typeof item["stream"] !== "string" || item["stream"].length === 0) || after["tenant"] !== void 0 && typeof after["tenant"] !== "string" || after["roles"] !== void 0 && (!Array.isArray(after["roles"]) || !after["roles"].every((name) => typeof name === "string")) || after["memberships"] !== void 0 && !Array.isArray(after["memberships"]) || after["claims"] !== void 0 && !isRecord(after["claims"])) throw configError(`PermDock CLI: fixture ${index} needs after (tenant, roles, memberships, claims) and expected "changed", without action or table`);
+}
 function asFixtures(value, followed = false) {
 	const list = Array.isArray(value) ? value : isRecord(value) && Array.isArray(value["fixtures"]) ? value["fixtures"] : void 0;
 	if (list === void 0) throw configError("PermDock CLI: fixtures must be an array or { fixtures }");
 	return list.map((item, index) => {
-		if (!isRecord(item) || !isRecord(item["subject"]) || item["row"] === void 0) throw configError(`PermDock CLI: fixture ${index} needs subject and row`);
-		if (followed && item["table"] !== void 0) {
+		const change = followed && isRecord(item) && item["after"] !== void 0;
+		if (!isRecord(item) || !isRecord(item["subject"]) || item["row"] === void 0 && !change) throw configError(`PermDock CLI: fixture ${index} needs subject and row`);
+		if (change) checkChange(item, index);
+		else if (followed && item["table"] !== void 0) {
 			if (typeof item["table"] !== "string" || item["table"].length === 0 || item["action"] !== void 0 || item["expected"] !== "granted" && item["expected"] !== "denied") throw configError(`PermDock CLI: fixture ${index} needs table and expected (granted or denied), without action`);
 		} else if (typeof item["action"] !== "string") throw new TypeError(`PermDock CLI: fixture ${index} needs action`);
 		if (typeof item["subject"]["id"] !== "string") throw new TypeError(`PermDock CLI: fixture ${index} subject needs id`);

package/dist/{flags-DXjoTVbS.js → flags-BlmpmXoY.js}

@@ -1,5 +1,5 @@
-import { n as CliError } from "./errors-Vpu6rKHl.js";
-import { n as secretInput } from "./credentials-CdDxp7jN.js";
+import { n as CliError } from "./errors-BhRkoNS7.js";
+import { n as secretInput } from "./credentials-dkycUsY3.js";
 //#region src/cli/core/flags.ts
 /** The flag vocabulary shared with better-supabase: one spelling per meaning. */
 const dbUrlFlags = { "db-url-stdin": {

package/dist/{from-snapshot-DCakWRsr.js → from-snapshot-DMlSSo9b.js}

@@ -4,18 +4,18 @@ import { a as deniedMessage, i as approvalMessage, n as PermDockDeniedError, t a
 import { o as sameId } from "./expiry-6XByK0dm.js";
 import { c as listPermissions } from "./permission-registry-B8tYxPIt.js";
 import { g as secondsOf, o as epochSeconds, t as INVALID_NOW } from "./time-nR1JesoH.js";
-import { f as scopeList, h as tenantOf, o as normalizeMemberships, s as resolveScope, t as activeFor } from "./scopes-0Up_UA2t.js";
-import { a as readOnlyActorRefuses, c as rowIdOf, l as rowValues, n as coveredByDelegation, u as evaluateCondition } from "./delegation-CDB6_keF.js";
+import { d as scopeList, o as normalizeMemberships, p as tenantOf, s as resolveScope, t as activeFor } from "./scopes-BSdYaGHs.js";
+import { a as readOnlyActorRefuses, c as rowIdOf, l as rowValues, n as coveredByDelegation, u as evaluateCondition } from "./delegation-aK4T_5WU.js";
 import { b as synthesiseRole, m as findRole, v as listRoles } from "./grantee-Dke-9rd1.js";
 import { a as grantCoversField, o as pickVisible, r as readWireValidity, t as isActive } from "./validity-Buc7w8E9.js";
-import { c as nowSeconds, d as resolveActiveTenant, f as rowInScope, n as inTeam, r as isMembershipExpired, s as nestedAppliesWithoutRow } from "./tenancy-5d1zVBvK.js";
+import { c as nowSeconds, d as resolveActiveTenant, f as rowInScope, n as inTeam, r as isMembershipExpired, s as nestedAppliesWithoutRow } from "./tenancy-DvOHHk3-.js";
 import { t as requiresApproval } from "./approval-required-TzNB9oQA.js";
-import { r as tokenPayload, t as decisionToken } from "./token-DC9EQiet.js";
+import { i as tokenPayload, n as decisionToken } from "./token-DaMnIU9O.js";
 import { t as fromWireDelegation } from "./wire-delegation-Cv3W2eaM.js";
-import { n as matchGrantee } from "./grantee-match-7RZZvoT_.js";
+import { n as matchGrantee } from "./grantee-match-BP-k4vRJ.js";
 import { t as resourceIdOf } from "./resource-ref-CaS9yVPi.js";
-import { i as permittedIds, o as deniedFor, r as mayUse, s as signSnapshot, t as whereFromGrants } from "./where-scope-DlCdCM_8.js";
-import { i as decideAllWith, n as canAllWith } from "./checks-CGkP3Z7A.js";
+import { i as permittedIds, o as deniedFor, r as mayUse, s as signSnapshot, t as whereFromGrants } from "./where-scope-BKrqUDVk.js";
+import { i as decideAllWith, n as canAllWith } from "./checks-fyDOhcz0.js";
 //#region src/core/snapshot-evaluate.ts
 function coveredByInclude(snapshot, permission) {
 	const include = snapshot.include;
@@ -324,16 +324,18 @@ function evaluateSnapshot(snapshot, subject, permission, data, team, options, ou
 		resourceId,
 		principal: subject.principal,
 		actor: subject.actor,
-		fingerprint: `snapshot:${snapshot.issuedAt}`,
-		payload: tokenPayload(resourceId, next ?? current, options.args)
+		source: `snapshot:${snapshot.issuedAt}`,
+		payload: tokenPayload(resourceId, next ?? current, options.args),
+		fingerprint: options.fingerprint
 	});
 	const grant = matchedOf(matched);
-	if (requiresApproval(matched.approval)) return done({
+	if (requiresApproval(matched.approval)) return done(compact({
 		outcome: "approval-required",
 		grant,
 		reason: "human",
-		token
-	});
+		token,
+		fingerprint: options.fingerprint
+	}));
 	return done(compact({
 		outcome: "granted",
 		subject,

package/dist/{gen-DwgCSC6V.js → gen-BEIN-DRM.js}

@@ -1,5 +1,5 @@
 import { t as defineLeaf } from "./command-L8EstFNm.js";
-import { c as given, d as policyFlag, i as dryRunFlag, t as checkFlag } from "./flags-DXjoTVbS.js";
+import { c as given, d as policyFlag, i as dryRunFlag, t as checkFlag } from "./flags-BlmpmXoY.js";
 //#region src/cli/commands/gen.ts
 const gen = defineLeaf({
 	flags: {
@@ -41,7 +41,7 @@ const gen = defineLeaf({
 		const out = given(flags.out);
 		const outDir = given(flags["out-dir"]);
 		const from = given(flags.policy);
-		const { runGen } = await import("./gen-DuAhghDw.js");
+		const { runGen } = await import("./gen-mf-MRwVr.js");
 		return runGen({
 			cwd: ctx.cwd,
 			config: ctx.config,

package/dist/{gen-DuAhghDw.js → gen-mf-MRwVr.js}

@@ -1,16 +1,16 @@
 import { r as isRecord } from "./compact-CAf557ZB.js";
-import { t as DESCRIBE_TITLES } from "./describe-Bb4hGK5d.js";
+import { t as DESCRIBE_TITLES } from "./describe-BZAlPHxT.js";
 import { c as listPermissions } from "./permission-registry-B8tYxPIt.js";
-import { f as scopeList } from "./scopes-0Up_UA2t.js";
+import { d as scopeList } from "./scopes-BSdYaGHs.js";
 import { v as listRoles } from "./grantee-Dke-9rd1.js";
 import { t as byCodePoint } from "./compare-DTfyUunF.js";
-import { i as configError, n as CliError } from "./errors-Vpu6rKHl.js";
-import { c as jsonSchemaOf } from "./catalog-doc-DjMKzJp9.js";
-import { c as requirePolicy } from "./load-DjSU5KXO.js";
-import { t as loadConfiguredOperations } from "./catalog-operations-DeHTrJSV.js";
-import { n as fileSummary, r as planFiles } from "./files-B3AA05f1.js";
-import { f as writeOutputFiles, r as driftOf } from "./output-files-BIQ_9pIs.js";
-import { t as resolveNames } from "./resolve-names-Y1Cb22cp.js";
+import { i as configError, n as CliError } from "./errors-BhRkoNS7.js";
+import { c as jsonSchemaOf } from "./catalog-doc-C4DGfJCO.js";
+import { c as requirePolicy } from "./load-BaEamml-.js";
+import { t as loadConfiguredOperations } from "./catalog-operations-BD22drQf.js";
+import { n as fileSummary, r as planFiles } from "./files-CfiRtQ-m.js";
+import { f as writeOutputFiles, r as driftOf } from "./output-files-CM0BnH05.js";
+import { t as resolveNames } from "./resolve-names-CBl4r4_r.js";
 import { i as schemaExpression } from "./generate-CezbCaTI.js";
 import { existsSync, readFileSync } from "node:fs";
 import { dirname, extname, relative, resolve } from "node:path";

package/dist/{generate-CRVV5V7l.js → generate-BqkZq8Dr.js}

@@ -1,7 +1,7 @@
 import { n as SCIM_TABLES, r as SCIM_UNIQUE } from "./postgres-store-DcyrPS-r.js";
 import { o as quoteSqlIdent } from "./sql-0WjxIp9g.js";
-import { n as fileSummary, t as applyFiles } from "./files-B3AA05f1.js";
-import { r as driftOf } from "./output-files-BIQ_9pIs.js";
+import { n as fileSummary, t as applyFiles } from "./files-CfiRtQ-m.js";
+import { r as driftOf } from "./output-files-CM0BnH05.js";
 //#region src/cli/scim/generate.ts
 const SCIM_MARKER = "-- generated by permdock scim generate";
 /**

package/dist/{grantee-conditions-BrYPe-w0.js → grantee-conditions-DX4K_gGI.js}

@@ -1,7 +1,7 @@
 import { a as sole, t as compact } from "./compact-CAf557ZB.js";
 import { a as expandRelation, c as isEdgeRelation, d as isSelfParented, l as isFieldRelation, m as restrictedStops, p as restrictedFor, s as isComputedRelation, u as isPrincipalRelation } from "./resource-relations-8-pCScBO.js";
 import { d as isoNow } from "./time-nR1JesoH.js";
-import { f as scopeList, l as rootScope, s as resolveScope } from "./scopes-0Up_UA2t.js";
+import { c as rootScope, d as scopeList, s as resolveScope } from "./scopes-BSdYaGHs.js";
 //#region src/core/grantee-conditions.ts
 /**
 * Where a graph relation starts on the row: its own id when the relation is on

package/dist/{grantee-match-7RZZvoT_.js → grantee-match-BP-k4vRJ.js}

@@ -1,8 +1,8 @@
 import { t as compact } from "./compact-CAf557ZB.js";
 import { u as isoAt } from "./time-nR1JesoH.js";
-import { f as scopeList, t as activeFor } from "./scopes-0Up_UA2t.js";
+import { d as scopeList, t as activeFor } from "./scopes-BSdYaGHs.js";
 import { o as flattenGrantee } from "./grantee-Dke-9rd1.js";
-import { r as relationCondition, t as inheritCondition } from "./grantee-conditions-BrYPe-w0.js";
+import { r as relationCondition, t as inheritCondition } from "./grantee-conditions-DX4K_gGI.js";
 //#region src/core/grantee-match.ts
 function combineWhere(left, right) {
 	if (left === void 0) return right;

package/dist/h3/index.d.ts

@@ -1,7 +1,7 @@
-import { T as Policy, Zt as Snapshot, j as PolicyVocabulary, pr as Principal } from "../policy-types-DGIO_gxq.js";
-import { a as PermDock } from "../permdock-CprAPN3w.js";
-import { D as ConnectionOptions, T as Connection, f as InvalidSignatureError, i as OpenApiHooks, u as SnapshotQuery, v as discoverViaSignatureAgent, x as webBotAuthVerifier } from "../server-types-CyRN0-Cd.js";
-import { a as ProtectTarget, n as FetchAdapterOptions, r as FetchProtect, t as ContextReader } from "../fetch-adapter-BIbBAtPZ.js";
+import { $t as Snapshot, E as Policy, M as PolicyVocabulary, _r as Principal } from "../policy-types-D-GwfQTc.js";
+import { a as PermDock } from "../permdock-ffY4CMd9.js";
+import { D as ConnectionOptions, T as Connection, f as InvalidSignatureError, i as OpenApiHooks, u as SnapshotQuery, v as discoverViaSignatureAgent, x as webBotAuthVerifier } from "../server-types-3OnXjZ2D.js";
+import { a as ProtectTarget, n as FetchAdapterOptions, r as FetchProtect, t as ContextReader } from "../fetch-adapter-BdmfnbJM.js";
 import { EventHandler, H3Event, H3EventContext, Middleware } from "h3";
 //#region src/h3/create.d.ts
 type H3PermDockOptions<TUser = unknown> = FetchAdapterOptions<H3Event, TUser>;

package/dist/h3/index.js

@@ -1,6 +1,6 @@
-import { l as InvalidSignatureError, p as webBotAuthVerifier, u as discoverViaSignatureAgent } from "../evaluations-IBceAeKT.js";
-import { i as decorate } from "../bind-BNQA9JK9.js";
-import { t as fetchAdapter } from "../fetch-adapter-dPTgJVHd.js";
+import { l as InvalidSignatureError, p as webBotAuthVerifier, u as discoverViaSignatureAgent } from "../evaluations-h3KoJAPa.js";
+import { i as decorate } from "../bind-B4pMH9bm.js";
+import { t as fetchAdapter } from "../fetch-adapter-DH-NJPbL.js";
 //#region src/h3/create.ts
 function createPermDock(policy, options) {
 	const adapter = fetchAdapter(policy, options, "h3", (event) => event.req);

package/dist/{helpers-DJicaG6f.js → helpers-DmqGy63f.js}

@@ -1,7 +1,7 @@
 import { t as compact } from "./compact-CAf557ZB.js";
 import { n as freezeDeep } from "./freeze-jjan0lCv.js";
-import { r as approverLeaves } from "./approvers-B4r0N_Uz.js";
-import { n as describe } from "./describe-Bb4hGK5d.js";
+import { i as approverManagerKey, r as approverLeaves } from "./approvers-BaNwKYgd.js";
+import { n as describe } from "./describe-BZAlPHxT.js";
 import { i as getRegistry, n as findPermission } from "./permission-registry-B8tYxPIt.js";
 import { t as assertAppData } from "./app-data-UNNm07jV.js";
 import { a as durationOf, i as dateAt, u as isoAt } from "./time-nR1JesoH.js";
@@ -9,7 +9,7 @@ import { r as relationReader, t as pendingRelations } from "./relations-BxvRvDHK
 import { n as resolveRelated } from "./relation-walk-DK_gkgL7.js";
 import { n as toWireDelegation } from "./wire-delegation-Cv3W2eaM.js";
 import { i as approverRelationKey, s as ApprovalError, t as APPROVAL_HEADER } from "./types-CcUXciSj.js";
-import { n as assertApprover, u as listAllApprovals } from "./store-RNFvaJJv.js";
+import { n as assertApprover, u as listAllApprovals } from "./store-DmVqy74I.js";
 import { n as parseApprovalHeader } from "./approval-header-8QV6MU4H.js";
 //#region src/approvals/relations.ts
 const DEFAULT_PARENT_DEPTH = 16;
@@ -64,13 +64,76 @@ function depthOf(item) {
 	if (item.through === "parent") return item.depth ?? DEFAULT_PARENT_DEPTH;
 	return item.depth ?? 0;
 }
+function inPeriod(holder, now) {
+	return (holder.startsAt === void 0 || holder.startsAt <= now) && (holder.expiresAt === void 0 || now < holder.expiresAt);
+}
+/**
+* Whether `approver` holds `manager` on the requester's `user` record, or on a
+* manager's within `levels` steps. Group holders and a read that fails count as
+* nobody.
+*/
+async function managesWithin(source, requester, approver, levels, now) {
+	const seen = /* @__PURE__ */ new Set([requester]);
+	let frontier = [requester];
+	for (let level = 0; level < levels && frontier.length > 0; level += 1) {
+		let lists;
+		try {
+			lists = await Promise.all(frontier.map((id) => Promise.resolve(source.related({
+				resource: "user",
+				id,
+				relation: "manager"
+			}))));
+		} catch {
+			return false;
+		}
+		const next = [];
+		for (const holder of lists.flat()) {
+			if (!("principal" in holder) || !inPeriod(holder, now)) continue;
+			const id = holder.principal.id;
+			if (id === approver) return true;
+			if (!seen.has(id)) {
+				seen.add(id);
+				next.push(id);
+			}
+		}
+		frontier = next;
+	}
+	return false;
+}
+/**
+* The `approverManagerKey`s of the `manager()` items in `items` that `approver`
+* satisfies for `requester`. A requester never manages themselves into
+* approving their own request.
+*/
+async function managerKeys(items, requester, approver, options) {
+	const source = options.relations;
+	if (source === void 0 || requester === approver) return [];
+	const managers = /* @__PURE__ */ new Map();
+	for (const item of items) if (item.kind === "manager") managers.set(approverManagerKey(item), item);
+	const now = dateAt(options.now).getTime() / 1e3;
+	const entries = [...managers];
+	const verdicts = await Promise.all(entries.map(([, item]) => managesWithin(source, requester, approver, item.levels ?? 1, now)));
+	return entries.flatMap(([key], index) => verdicts[index] === true ? [key] : []);
+}
+/** The `manager()` approvers of `request` that `subject` satisfies. */
+function managerFacts(request, subject, options) {
+	const approvers = request.approvers;
+	const requester = request.subject.principal?.id;
+	if (approvers === void 0 || requester === void 0 || subject.principal === null) return [];
+	return managerKeys(requestApprovers(approvers), requester, subject.principal.id, options);
+}
 /**
-* The relation approvers of `request` that `subject` holds on its resource,
-* keyed by `approverRelationKey`, for `ApprovalVerdict.relations`. Reads go
-* through `relations` by the request's resource id; a request without an id, a
-* missing source or a read that fails holds nothing.
+* The relation and `manager()` approvers of `request` that `subject` holds,
+* keyed by `approverRelationKey` and `approverManagerKey`, for
+* `ApprovalVerdict.relations`. Relation reads go through `relations` by the
+* request's resource id, manager reads by the requester's principal id; a
+* request without an id, a missing source or a read that fails holds nothing.
 */
 async function approverRelations(request, subject, options) {
+	const [onRow, managers] = await Promise.all([rowRelations(request, subject, options), managerFacts(request, subject, options)]);
+	return [...onRow, ...managers];
+}
+async function rowRelations(request, subject, options) {
 	const approvers = request.approvers;
 	const id = request.resource.id;
 	if (approvers === void 0 || id === void 0 || options.relations === void 0 || options.permissions === void 0 || subject.principal === null) return [];
@@ -182,9 +245,9 @@ async function requestApproval(store, decision, meta) {
 	const approval = decision.grant.approval;
 	const approvers = approval === void 0 || approval === "human" ? void 0 : compact({
 		by: approval.by,
-		mode: approval.mode,
+		combine: approval.combine,
 		stages: approval.stages,
-		distinct: approval.distinct,
+		mode: approval.mode,
 		staleOn: approval.staleOn,
 		quorum: approval.quorum,
 		escalation: approval.escalation
@@ -205,6 +268,7 @@ async function requestApproval(store, decision, meta) {
 		createdAt: now.toISOString(),
 		expiresAt: isoAt(now.getTime() + ttl * 1e3),
 		status: "pending",
+		fingerprint: decision.fingerprint,
 		x: meta.x
 	}));
 	await store.create(request);
@@ -264,11 +328,18 @@ async function inspectApproval(store, token, at) {
 		request
 	};
 }
-/** Inspects `token` and, when it is approved, consumes it so it resumes once. */
-async function consumeApproval(store, token, at) {
+/**
+* Inspects `token` and, when it is approved, consumes it so it resumes once. A
+* request opened under a `fingerprint` is consumed only under the same one.
+*/
+async function consumeApproval(store, token, at, options = {}) {
 	const now = { epochMilliseconds: dateAt(at).getTime() };
 	const inspected = await inspectApproval(store, token, now);
 	if (!inspected.ok) return inspected;
+	if (inspected.request.fingerprint !== void 0 && inspected.request.fingerprint !== options.fingerprint) return {
+		ok: false,
+		cause: "approval-fingerprint-mismatch"
+	};
 	if (typeof store.consume !== "function") return {
 		ok: false,
 		cause: "approval-not-found"
@@ -350,7 +421,8 @@ async function resumeDecision(input) {
 		if (inspected.ok) {
 			const { request } = inspected;
 			if (request.permission !== input.permission.key || request.resource.id !== void 0 && request.resource.id !== input.resource.id || request.subject.principal?.id !== input.subject.principal?.id) return approvalDenied("approval-mismatch");
-			if (input.consume !== false) inspected = await consumeApproval(store, token, input.now);
+			if (request.fingerprint !== void 0 && request.fingerprint !== decision.fingerprint) return approvalDenied("approval-fingerprint-mismatch");
+			if (input.consume !== false) inspected = await consumeApproval(store, token, input.now, { fingerprint: decision.fingerprint });
 		}
 	} catch {
 		return approvalDenied("approval-not-found");
@@ -438,4 +510,4 @@ async function storedApprovalToken(store, decision, options = {}) {
 	}
 }
 //#endregion
-export { requestApproval as a, resumeFromHeader as c, vouchApproval as d, approverPermissions as f, readApprovalHeader as i, storedApprovalToken as l, approverRelations as m, consumeApproval as n, resolveApproval as o, heldPermissions as p, inspectApproval as r, resumeDecision as s, cancelApprovals as t, summarizeSubject as u };
+export { requestApproval as a, resumeFromHeader as c, vouchApproval as d, approverPermissions as f, managerKeys as h, readApprovalHeader as i, storedApprovalToken as l, approverRelations as m, consumeApproval as n, resolveApproval as o, heldPermissions as p, inspectApproval as r, resumeDecision as s, cancelApprovals as t, summarizeSubject as u };

package/dist/hono/index.d.ts

@@ -1,9 +1,9 @@
-import { T as Policy, j as PolicyVocabulary, pr as Principal } from "../policy-types-DGIO_gxq.js";
+import { E as Policy, M as PolicyVocabulary, _r as Principal } from "../policy-types-D-GwfQTc.js";
 import { u as Permission } from "../permission-types-CAY-GU7e.js";
-import { a as PermDock } from "../permdock-CprAPN3w.js";
+import { a as PermDock } from "../permdock-ffY4CMd9.js";
 import { n as RevocationFeed } from "../revocations-BaUXHM1N.js";
-import { D as ConnectionOptions, T as Connection, f as InvalidSignatureError, i as OpenApiHooks, o as ProtectOptions, v as discoverViaSignatureAgent, x as webBotAuthVerifier } from "../server-types-CyRN0-Cd.js";
-import { t as ServerAdapterOptions } from "../bind-YYjvfpB9.js";
+import { D as ConnectionOptions, T as Connection, f as InvalidSignatureError, i as OpenApiHooks, o as ProtectOptions, v as discoverViaSignatureAgent, x as webBotAuthVerifier } from "../server-types-3OnXjZ2D.js";
+import { t as ServerAdapterOptions } from "../bind-DR6ku3A9.js";
 import { Context, Hono, MiddlewareHandler } from "hono";
 import { SSEMessage, SSEStreamingApi } from "hono/streaming";
 import { WSEvents } from "hono/ws";

package/dist/hono/index.js

@@ -1,8 +1,8 @@
 import { t as compact } from "../compact-CAf557ZB.js";
 import { r as PermDockRevokedError } from "../errors-B6R_lg2a.js";
-import { l as InvalidSignatureError, p as webBotAuthVerifier, u as discoverViaSignatureAgent } from "../evaluations-IBceAeKT.js";
-import { t as problemFromError } from "../map-error-pasIGqMT.js";
-import { r as bindKernel } from "../bind-BNQA9JK9.js";
+import { l as InvalidSignatureError, p as webBotAuthVerifier, u as discoverViaSignatureAgent } from "../evaluations-h3KoJAPa.js";
+import { t as problemFromError } from "../map-error-BH16Ah8P.js";
+import { r as bindKernel } from "../bind-B4pMH9bm.js";
 import { a as onRevoked, n as closeReason, r as guardIterable, t as POLICY_VIOLATION } from "../stream-CDvF0sJm.js";
 import { Hono } from "hono";
 //#region src/hono/create.ts

package/dist/{hosted-DVxlLZMe.d.ts → hosted-BFNXwcjd.d.ts}

@@ -1,4 +1,4 @@
-import { An as Grantee, T as Policy, a as ApprovalRequirement, br as Condition } from "./policy-types-DGIO_gxq.js";
+import { E as Policy, Pn as Grantee, o as ApprovalRequirement, wr as Condition } from "./policy-types-D-GwfQTc.js";
 //#region src/core/hosted.d.ts
 /**
  * One grant authored in PermDock Cloud; its grantee is a declared role, plan or

package/dist/{hosted-D0IzESu_.js → hosted-waouw2V-.js}

@@ -1,13 +1,14 @@
 import { r as isRecord, t as compact } from "./compact-CAf557ZB.js";
 import { n as freezeDeep } from "./freeze-jjan0lCv.js";
 import { n as isForbiddenKey, s as splitPath } from "./paths-CUvURzHp.js";
-import { a as deny, i as completeGrant, n as role, p as normalizeWhere, r as allow } from "./role-builder-BK2-T6oD.js";
+import { a as deny, i as completeGrant, l as normalizeWhere, n as role, r as allow } from "./role-builder-CMW4wWzn.js";
 import { a as getResource, n as findPermission } from "./permission-registry-B8tYxPIt.js";
 import { d as isSelfParented } from "./resource-relations-8-pCScBO.js";
 import { a as durationOf, l as isRfc3339, m as rfc3339 } from "./time-nR1JesoH.js";
 import { r as sha256Digest } from "./sha256-C-4WXKIu.js";
 import { _ as listPlans, m as findRole, o as flattenGrantee } from "./grantee-Dke-9rd1.js";
-import { a as indexPolicy, n as declaredRoleNames } from "./policy-CLQ8__GF.js";
+import { o as readWireApproval } from "./approval-normalize-CUjgSsOl.js";
+import { a as indexPolicy, n as declaredRoleNames } from "./policy-cV_wwPb8.js";
 //#region src/core/hosted.ts
 function memoryPolicySource(document = null) {
 	const current = document === null ? null : parsePolicyDocument(document);
@@ -96,15 +97,15 @@ function isPortableCondition(value) {
 function approvalRank(approval) {
 	if (approval === void 0) return;
 	if (approval === "human") return {
-		distinct: true,
+		authorize: true,
 		stale: false,
 		quorum: 1,
 		ttl: Number.POSITIVE_INFINITY,
 		escalates: false
 	};
 	return {
-		by: approval.stages === void 0 ? JSON.stringify(approval.by) : JSON.stringify([approval.mode, approval.stages]),
-		distinct: approval.distinct !== false,
+		by: approval.stages === void 0 ? JSON.stringify(approval.by) : JSON.stringify([approval.combine, approval.stages]),
+		authorize: approval.mode !== "confirm",
 		stale: approval.staleOn === "resource-change",
 		quorum: approval.quorum ?? 1,
 		ttl: durationOf(approval.ttl) ?? Number.POSITIVE_INFINITY,
@@ -121,7 +122,7 @@ function approvalAtLeast(hosted, code) {
 		const theirs = approvalRank(required);
 		if (theirs === void 0) continue;
 		if (mine === void 0) return false;
-		if (theirs.distinct && !mine.distinct) return false;
+		if (theirs.authorize && !mine.authorize) return false;
 		if (theirs.stale && !mine.stale) return false;
 		if (theirs.by !== void 0 && mine.by !== theirs.by) return false;
 		if (mine.quorum < theirs.quorum || mine.ttl > theirs.ttl) return false;
@@ -157,8 +158,8 @@ function declaredGrantee(policy, grantee, permissionResource) {
 function approvalAcceptable(policy, approval, permissionResource) {
 	if (approval === void 0 || approval === "human") return true;
 	if (!isRecord(approval)) return false;
-	if (approval["mode"] !== void 0 || approval["stages"] !== void 0) return false;
-	if (approval["distinct"] !== void 0 && typeof approval["distinct"] !== "boolean") return false;
+	if (approval["combine"] !== void 0 || approval["stages"] !== void 0 || approval["distinct"] !== void 0) return false;
+	if (approval["mode"] !== void 0 && approval["mode"] !== "confirm" && approval["mode"] !== "authorize") return false;
 	if (approval["staleOn"] !== void 0 && (approval["staleOn"] !== "resource-change" || getResource(policy.permissions, permissionResource)?.version === void 0)) return false;
 	if (approval["quorum"] !== void 0 && (!Number.isInteger(approval["quorum"]) || approval["quorum"] < 1)) return false;
 	if (approval["ttl"] !== void 0 && durationOf(approval["ttl"]) === void 0) return false;
@@ -202,7 +203,8 @@ function buildGrant(policy, document, raw) {
 		ok: false,
 		reason: "non-portable"
 	};
-	if (!approvalAcceptable(policy, raw["approval"], permission.resource)) return {
+	const approval = readWireApproval(raw["approval"]);
+	if (!approvalAcceptable(policy, approval, permission.resource)) return {
 		ok: false,
 		reason: "invalid"
 	};
@@ -214,7 +216,7 @@ function buildGrant(policy, document, raw) {
 	const options = compact({
 		where: raw["where"] === void 0 ? void 0 : normalizeWhere(raw["where"]),
 		check: raw["check"] === void 0 ? void 0 : normalizeWhere(raw["check"]),
-		approval: raw["approval"],
+		approval,
 		fields: raw["fields"]
 	});
 	let built;

package/dist/{http-DOL33cO0.js → http-DhMWeB_h.js}

@@ -1,5 +1,5 @@
 import { t as timeoutSignal } from "./timeout-D51niuQP.js";
-import { a as describeError, n as CliError } from "./errors-Vpu6rKHl.js";
+import { a as describeError, n as CliError } from "./errors-BhRkoNS7.js";
 import { s as cliVersion } from "./version-DMQ0dnN5.js";
 import "./device-BwbJNmb2.js";
 //#region src/cli/core/http.ts

package/dist/{import-CNBF96hB.js → import-C1XXpG_m.js}

@@ -1,10 +1,10 @@
 import { r as isRecord } from "./compact-CAf557ZB.js";
-import { i as configError, u as usageResult } from "./errors-Vpu6rKHl.js";
+import { i as configError, u as usageResult } from "./errors-BhRkoNS7.js";
 import { s as writeFileEnsuringDir } from "./files-BSjrtIHw.js";
 import { r as escapeSqlIdent, s as quoteSqlLiteral } from "./sql-0WjxIp9g.js";
-import { C as parseMembershipsFlag, r as HELPERS } from "./shared-DrGLwM3s.js";
-import { n as pgConnector } from "./pg-DQTqRrou.js";
-import { t as FIELD_VIEWS } from "./fields-DI8s3cPl.js";
+import { C as parseMembershipsFlag, r as HELPERS } from "./shared-DyYVEjKC.js";
+import { n as pgConnector } from "./pg-Ddxsd5ZB.js";
+import { t as FIELD_VIEWS } from "./fields-CrjL6A49.js";
 import { n as emptySchema, r as isSchemaKind, t as emitPermissionsModule } from "./generate-CezbCaTI.js";
 import { existsSync, readFileSync } from "node:fs";
 import { resolve } from "node:path";

package/dist/{import-Dfe2unKO.js → import-DObwEota.js}

@@ -1,10 +1,10 @@
 import { r as isRecord } from "./compact-CAf557ZB.js";
 import { t as byCodePoint } from "./compare-DTfyUunF.js";
 import { i as readJsonFile } from "./files-BSjrtIHw.js";
-import { t as applyFiles } from "./files-B3AA05f1.js";
-import { n as httpRequest } from "./http-DOL33cO0.js";
+import { t as applyFiles } from "./files-CfiRtQ-m.js";
+import { n as httpRequest } from "./http-DhMWeB_h.js";
 import { i as schemaExpression, t as emitPermissionsModule } from "./generate-CezbCaTI.js";
-import { t as validateOpenapi } from "./schema-DvXvxPhQ.js";
+import { t as validateOpenapi } from "./schema-B_9tXrbG.js";
 import { existsSync, readFileSync } from "node:fs";
 import { resolve } from "node:path";
 //#region ../../node_modules/.pnpm/yaml@2.9.1/node_modules/yaml/browser/dist/nodes/identity.js

package/dist/{index-BinlXeU-.d.ts → index-BhnOOnp9.d.ts}

@@ -1,5 +1,5 @@
-import { T as Policy, mt as TokenSigner, pr as Principal } from "./policy-types-DGIO_gxq.js";
-import { E as SsfPermDockOptions, O as SsfStreamConfiguration, T as SsfPermDock, _ as SetSubject, c as PushSetOptions, d as SetDelivery, g as SetQueue, h as SetPollHandlerOptions, k as SsfStreamStatus, m as SetEvent, p as SetError, t as CaepCommon, v as SignSetOptions } from "./types-DsHGPtkR.js";
+import { E as Policy, _r as Principal, gt as TokenSigner } from "./policy-types-D-GwfQTc.js";
+import { E as SsfPermDockOptions, O as SsfStreamConfiguration, T as SsfPermDock, _ as SetSubject, c as PushSetOptions, d as SetDelivery, g as SetQueue, h as SetPollHandlerOptions, k as SsfStreamStatus, m as SetEvent, p as SetError, t as CaepCommon, v as SignSetOptions } from "./types-Ck1KOfug.js";
 //#region src/ssf/create.d.ts
 declare function createPermDock<TUser, TPrincipal extends Principal = Principal>(policy: Policy<TUser, TPrincipal>, options: SsfPermDockOptions): SsfPermDock;
 //#endregion

package/dist/{index-ymept53A.d.ts → index-CVGio3cH.d.ts}

@@ -1,10 +1,10 @@
-import { J as DecisionSink, T as Policy, j as PolicyVocabulary, pr as Principal, sn as DeliveryChannel } from "./policy-types-DGIO_gxq.js";
+import { E as Policy, M as PolicyVocabulary, Y as DecisionSink, _r as Principal, ln as DeliveryChannel } from "./policy-types-D-GwfQTc.js";
 import { u as Permission } from "./permission-types-CAY-GU7e.js";
 import { t as Operation } from "./operations-Ci_rT6Uo.js";
-import { _ as PrincipalSource, a as PermDock } from "./permdock-CprAPN3w.js";
+import { _ as PrincipalSource, a as PermDock } from "./permdock-ffY4CMd9.js";
 import { t as JsonSchemaNode } from "./json-schema-BfXgnRNT.js";
-import { _ as TransportOptions, a as DeliveryReport, c as DeliveryTransport, g as TransportMessages, i as DeliveryMessages, l as DeliveryTransports, m as Recipient, o as DeliveryResult, r as DeliverOptions, s as DeliveryTarget, y as WebhookTransport } from "./types-CN0LsqbK.js";
-import { l as WebhookSigner } from "./standard-webhooks-DOYEuOLx.js";
+import { _ as TransportOptions, a as DeliveryReport, c as DeliveryTransport, g as TransportMessages, i as DeliveryMessages, l as DeliveryTransports, m as Recipient, o as DeliveryResult, r as DeliverOptions, s as DeliveryTarget, y as WebhookTransport } from "./types-CCEeSCMB.js";
+import { l as WebhookSigner } from "./standard-webhooks-BfPaZ6T1.js";
 //#region src/delivery/audience.d.ts
 type Audience = {
   /**