permdock 0.17.0 → 0.18.1

package/dist/solid/index.d.ts

@@ -1,11 +1,11 @@
-import { $n as GrantedDecision, $t as Snapshot, Kn as ApprovalRequiredDecision, M as PolicyVocabulary, _t as TokenVerifier, gr as Membership, qn as Decision } from "../policy-types-IRJVABmm.js";
+import { $n as GrantedDecision, $t as Snapshot, Kn as ApprovalRequiredDecision, M as PolicyVocabulary, _t as TokenVerifier, gr as Membership, qn as Decision } from "../policy-types-D-GwfQTc.js";
 import { u as Permission } from "../permission-types-CAY-GU7e.js";
 import { r as Role } from "../vocabulary-DEJ5j4mR.js";
-import { d as UncheckedData, s as RowData } from "../permdock-DUWZEOLR.js";
-import { c as requiredPlans } from "../errors-Dc9FdamT.js";
-import { i as describe, r as DescribeOptions, t as DecisionDescription } from "../describe-nalX_HHE.js";
+import { d as UncheckedData, s as RowData } from "../permdock-ffY4CMd9.js";
+import { c as requiredPlans } from "../errors-TpzkEKgJ.js";
+import { i as describe, r as DescribeOptions, t as DecisionDescription } from "../describe-BKtC_8PG.js";
 import { t as PermissionBoundaryState } from "../boundary-C9ck-3uK.js";
-import { _ as TenantView, a as ClientPermDock, c as GateMode, d as PermissionState, g as SubjectView, h as RolesOptions, i as ApprovalState, l as GateView, m as ProviderOptionsBase, o as ClientStatus, p as ProtectedActionView, r as ApprovalHandle, s as FilterResult, u as PermissionSet, v as ActionResult, y as ProtectedAction } from "../store-g5ctUrOI.js";
+import { _ as TenantView, a as ClientPermDock, c as GateMode, d as PermissionState, g as SubjectView, h as RolesOptions, i as ApprovalState, l as GateView, m as ProviderOptionsBase, o as ClientStatus, p as ProtectedActionView, r as ApprovalHandle, s as FilterResult, u as PermissionSet, v as ActionResult, y as ProtectedAction } from "../store-DYeB-_U3.js";
 import { a as broadcastChannelRefresh, c as visibilityRefresh, i as authzChangeRefresh, n as EventSourceRefreshOptions, o as eventSourceRefresh, r as RefreshTrigger, s as focusRefresh, t as AuthzChangeRefresh } from "../refresh-on-L9UOwATg.js";
 import { t as approvalHeaders } from "../headers-B9jQxjtW.js";
 import { Accessor, Accessor as Accessor$1, JSX } from "solid-js";

package/dist/solid/index.js

@@ -1,9 +1,9 @@
 import { t as compact } from "../compact-CAf557ZB.js";
 import { r as requiredPlans } from "../problem-details-CLDgX1KV.js";
-import { n as describe } from "../describe-CogP1loh.js";
+import { n as describe } from "../describe-BZAlPHxT.js";
 import { n as boundaryFallback, t as boundaryDigest } from "../boundary-BV3O1eud.js";
-import { n as actionRunner, r as approvalHeaders, t as actionApproval } from "../protected-action-B6n6w7Rl.js";
-import { a as livePermDock, c as rolesView, d as subjectView, f as tenantView, i as gateView, l as scopedTenant, n as describeWith, o as permissionSet, r as filterResult, s as protectedView, t as approvalHandle, u as slotContent } from "../views-TrZYlDnM.js";
+import { n as actionRunner, r as approvalHeaders, t as actionApproval } from "../protected-action-OpOxtTsN.js";
+import { a as livePermDock, c as rolesView, d as subjectView, f as tenantView, i as gateView, l as scopedTenant, n as describeWith, o as permissionSet, r as filterResult, s as protectedView, t as approvalHandle, u as slotContent } from "../views-MWmJ6Y4P.js";
 import { a as eventSourceRefresh, i as broadcastChannelRefresh, l as isPromiseLike, o as focusRefresh, r as authzChangeRefresh, s as visibilityRefresh } from "../store-options--zWn48PK.js";
 import { n as switchTenant, t as providerStore } from "../provider-store-BQP_pp8s.js";
 import { ErrorBoundary, createComponent, createComputed, createContext, createMemo, createSignal, getOwner, on, onCleanup, useContext } from "solid-js";

package/dist/solid-start/index.d.ts

@@ -1,9 +1,9 @@
-import { $t as Snapshot, E as Policy, M as PolicyVocabulary, _r as Principal } from "../policy-types-IRJVABmm.js";
+import { $t as Snapshot, E as Policy, M as PolicyVocabulary, _r as Principal } from "../policy-types-D-GwfQTc.js";
 import { u as Permission } from "../permission-types-CAY-GU7e.js";
 import { a as OperationInput, t as Operation } from "../operations-Ci_rT6Uo.js";
-import { a as PermDock } from "../permdock-DUWZEOLR.js";
-import { D as ConnectionOptions, T as Connection, f as InvalidSignatureError, i as OpenApiHooks, o as ProtectOptions, u as SnapshotQuery, v as discoverViaSignatureAgent, x as webBotAuthVerifier } from "../server-types-Bw-lWqzR.js";
-import { a as ProtectTarget, n as FetchAdapterOptions, t as ContextReader } from "../fetch-adapter-BgqpOOpd.js";
+import { a as PermDock } from "../permdock-ffY4CMd9.js";
+import { D as ConnectionOptions, T as Connection, f as InvalidSignatureError, i as OpenApiHooks, o as ProtectOptions, u as SnapshotQuery, v as discoverViaSignatureAgent, x as webBotAuthVerifier } from "../server-types-3OnXjZ2D.js";
+import { a as ProtectTarget, n as FetchAdapterOptions, t as ContextReader } from "../fetch-adapter-BdmfnbJM.js";
 import { APIEvent, FetchEvent } from "@solidjs/start/server";
 //#region src/solid-start/create.d.ts
 /** The h3 event under every SolidStart request; `subject` and `scope` read it. */

package/dist/solid-start/index.js

@@ -1,6 +1,6 @@
-import { l as InvalidSignatureError, p as webBotAuthVerifier, u as discoverViaSignatureAgent } from "../evaluations-DG40eSJa.js";
-import { i as decorate } from "../bind-BJFeLX1V.js";
-import { n as guardedRoute, t as fetchAdapter } from "../fetch-adapter-UZOW0PRC.js";
+import { l as InvalidSignatureError, p as webBotAuthVerifier, u as discoverViaSignatureAgent } from "../evaluations-h3KoJAPa.js";
+import { i as decorate } from "../bind-B4pMH9bm.js";
+import { n as guardedRoute, t as fetchAdapter } from "../fetch-adapter-DH-NJPbL.js";
 //#region src/solid-start/create.ts
 /**
 * `event.locals`. Its type, `App.RequestEventLocals`, is declared by

package/dist/{sources-CXY05xtB.d.ts → sources-xdQShLDU.d.ts}

@@ -1,4 +1,4 @@
-import { _r as Principal, an as AuthEvent, rt as MembershipSource } from "./policy-types-IRJVABmm.js";
+import { _r as Principal, an as AuthEvent, rt as MembershipSource } from "./policy-types-D-GwfQTc.js";
 import { t as ClaimsMap } from "./claims-map-D1Pb5oRq.js";
 import { t as ClientNames } from "./clients-C_NOET3z.js";
 import { c as SupabaseManifestMembership } from "./manifest-B5yF3CIq.js";

package/dist/{src-nYNBfmgq.js → src-Brzq_0in.js}

@@ -1,11 +1,11 @@
 import { n as isReadonlyArray, r as isRecord, t as compact } from "./compact-CAf557ZB.js";
 import { n as freezeDeep } from "./freeze-jjan0lCv.js";
-import { n as isForbiddenKey, r as ownGet } from "./paths-CUvURzHp.js";
-import { d as assertSqlFunctionArg, f as assertSqlFunctionName, l as normalizeWhere, u as assertPortableTwin } from "./role-builder-BrmOcXch.js";
+import { r as ownGet } from "./paths-CUvURzHp.js";
+import { d as assertSqlFunctionArg, f as assertSqlFunctionName, l as normalizeWhere, u as assertPortableTwin } from "./role-builder-CMW4wWzn.js";
 import { n as PermDockDeniedError } from "./errors-B6R_lg2a.js";
 import { o as sameId } from "./expiry-6XByK0dm.js";
 import { n as internalsOf } from "./internals-B3IgHrvo.js";
-import { c as listPermissions, i as getRegistry, n as findPermission, o as isPermission } from "./permission-registry-B8tYxPIt.js";
+import { c as listPermissions, i as getRegistry, n as findPermission } from "./permission-registry-B8tYxPIt.js";
 import { n as isThenable$1 } from "./thenable-BNSM1U2R.js";
 import { c as isEdgeRelation, m as restrictedStops, o as groupEntries, s as isComputedRelation, u as isPrincipalRelation } from "./resource-relations-8-pCScBO.js";
 import { a as durationOf, f as nowMillis, g as secondsOf, m as rfc3339, p as nowSeconds } from "./time-nR1JesoH.js";
@@ -13,18 +13,19 @@ import { t as canonicalJson } from "./canonical-json-DwilZ1iB.js";
 import { a as normalizeMembership$1, c as rootScope, d as scopeList, l as scopeChain, o as normalizeMemberships$1, p as tenantOf, s as resolveScope$1, u as scopeIdOf } from "./scopes-BSdYaGHs.js";
 import { u as evaluateCondition } from "./delegation-aK4T_5WU.js";
 import { _ as listPlans, a as authenticated, m as findRole, o as flattenGrantee } from "./grantee-Dke-9rd1.js";
-import { a as normalizeApproval, r as assertApprovalRelations } from "./approval-normalize-4KxMRdJC.js";
+import { a as normalizeApproval, r as assertApprovalRelations } from "./approval-normalize-CUjgSsOl.js";
 import { m as tenantsOf, r as isMembershipExpired } from "./tenancy-DvOHHk3-.js";
-import { c as levelNames, i as grantList, n as declaredRoleNames } from "./policy-DxQyHKPB.js";
-import { o as isPortableCondition } from "./hosted-tPZnyjQS.js";
-import { n as OPERATION_RISKS, r as isOperationRisk } from "./permissions-CVXmRILq.js";
-import { C as tenantCustomRoles, S as roleAllowKeys, f as customRoleId, l as ceilingGrants, m as customRoleScope, p as customRoleOf, x as resolveCustomRole } from "./evaluate-CsjXeLRo.js";
-import { a as heldLevels, f as bindingOf, h as usesAssigns, m as roleMeta, n as snapshotScopes, o as collectSnapshotGrants, p as rankRoles, r as assignableCandidates, t as snapshotOf } from "./instance-snapshot-BgOGtyCy.js";
+import { c as levelNames, i as grantList, n as declaredRoleNames } from "./policy-cV_wwPb8.js";
+import { o as isPortableCondition } from "./hosted-waouw2V-.js";
+import { n as isOperationRisk } from "./operation-risks-BKOcTv8J.js";
+import { n as isOperationEffect } from "./operations-Bm9HFecz.js";
+import { C as tenantCustomRoles, S as roleAllowKeys, f as customRoleId, l as ceilingGrants, m as customRoleScope, p as customRoleOf, x as resolveCustomRole } from "./evaluate-Czbj7thS.js";
+import { a as heldLevels, f as bindingOf, h as usesAssigns, m as roleMeta, n as snapshotScopes, o as collectSnapshotGrants, p as rankRoles, r as assignableCandidates, t as snapshotOf } from "./instance-snapshot-BWa71my8.js";
 import { n as relationId } from "./relations-BxvRvDHK.js";
 import { i as snapshotGrant, r as plainPermission, t as buildSnapshot } from "./snapshot-DN_8J27z.js";
-import { n as LOCAL_CUSTOM_ROLE } from "./parse-local-manifest-DEiCF4ah.js";
-import { c as APP, r as resolveSubject } from "./permdock-DdzMv5-F.js";
-import { i as memoryApprovalStore } from "./store-XgBMbfDy.js";
+import { n as LOCAL_CUSTOM_ROLE } from "./parse-local-manifest-CxcSMQgl.js";
+import { c as APP, r as resolveSubject } from "./permdock-D-_WrdKu.js";
+import { i as memoryApprovalStore } from "./store-DmVqy74I.js";
 import { n as wrapPermDock } from "./wrap-C5PWzgkq.js";
 //#region src/conditions/sql-function.ts
 function sqlFunction(name, options) {
@@ -121,91 +122,6 @@ function memoryCustomRoleSource(customRoles) {
 	};
 }
 //#endregion
-//#region src/core/operations.ts
-const OPERATION_EFFECTS = Object.freeze([
-	"read",
-	"write",
-	"delete",
-	"send",
-	"spend",
-	"external"
-]);
-/**
-* MCP tool-name characters (MCP 2025-11-25, Tools: Tool names), so a name works
-* as a tool name unchanged.
-*/
-const NAME = /^[A-Za-z0-9_.-]{1,128}$/u;
-const META_KEYS = /* @__PURE__ */ new Set([
-	"risk",
-	"effects",
-	"title"
-]);
-function isOperationEffect(value) {
-	return OPERATION_EFFECTS.some((effect) => effect === value);
-}
-function readMeta(name, value) {
-	if (value === void 0) return Object.freeze({});
-	if (value === null || typeof value !== "object" || Array.isArray(value)) throw new TypeError(`Operation "${name}": meta must be an object.`);
-	for (const key of Object.keys(value)) if (!META_KEYS.has(key)) throw new TypeError(`Operation "${name}": meta.${key} is not one of risk, effects, title.`);
-	const meta = {};
-	const risk = Reflect.get(value, "risk");
-	if (risk !== void 0) {
-		if (!isOperationRisk(risk)) throw new TypeError(`Operation "${name}": meta.risk must be one of ${OPERATION_RISKS.join(", ")}.`);
-		meta.risk = risk;
-	}
-	const effects = Reflect.get(value, "effects");
-	if (effects !== void 0) {
-		if (!Array.isArray(effects) || !effects.every(isOperationEffect) || new Set(effects).size !== effects.length) throw new TypeError(`Operation "${name}": meta.effects must list distinct values of ${OPERATION_EFFECTS.join(", ")}.`);
-		meta.effects = Object.freeze([...effects]);
-	}
-	const title = Reflect.get(value, "title");
-	if (title !== void 0) {
-		if (typeof title !== "string" || title.trim() === "") throw new TypeError(`Operation "${name}": meta.title must be a non-empty string.`);
-		meta.title = title;
-	}
-	return Object.freeze(meta);
-}
-function treeLeaf(keys, name, field, value) {
-	if (!isPermission(value)) throw new TypeError(`Operation "${name}": ${field} must be a permission from the tree.`);
-	if (!keys.has(value.key)) throw new TypeError(`Operation "${name}": ${field} ${value.key} is not a permission of the tree passed to defineOperations.`);
-	return value;
-}
-/**
-* Binds each named operation to a permission of `permissions`. Throws at
-* definition time for a permission or `results` outside the tree, a name that
-* is not 1 to 128 of `A-Z a-z 0-9 _ . -` or repeats another case-insensitively,
-* a `data` that is not a function, or meta outside the closed lists.
-*/
-function defineOperations(permissions, definitions) {
-	const keys = new Map(listPermissions(permissions).map((leaf) => [leaf.key, leaf]));
-	const seen = /* @__PURE__ */ new Map();
-	const out = {};
-	for (const name of Object.keys(definitions)) {
-		if (!NAME.test(name) || isForbiddenKey(name)) throw new TypeError(`Operation name "${name}" must be 1 to 128 of A-Z a-z 0-9 _ . -.`);
-		const folded = name.toLowerCase();
-		const previous = seen.get(folded);
-		if (previous !== void 0) throw new TypeError(`Operation name "${name}" is a duplicate of "${previous}".`);
-		seen.set(folded, name);
-		const definition = definitions[name];
-		if (definition === null || typeof definition !== "object" || Array.isArray(definition)) throw new TypeError(`Operation "${name}" must be an object.`);
-		const permission = treeLeaf(keys, name, "permission", Reflect.get(definition, "permission"));
-		const value = Reflect.get(definition, "data");
-		if (value !== void 0 && typeof value !== "function") throw new TypeError(`Operation "${name}": data must be a function.`);
-		const data = value;
-		const resultsValue = Reflect.get(definition, "results");
-		const results = resultsValue === void 0 ? void 0 : treeLeaf(keys, name, "results", resultsValue);
-		const meta = readMeta(name, Reflect.get(definition, "meta"));
-		out[name] = Object.freeze({
-			name,
-			permission,
-			...data === void 0 ? {} : { data },
-			...results === void 0 ? {} : { results },
-			meta
-		});
-	}
-	return Object.freeze(out);
-}
-//#endregion
 //#region src/core/approval-policies.ts
 /**
 * The denial detail when an `ApprovalPolicySource` fails: every call an allow
@@ -931,15 +847,16 @@ function instanceCache(options = {}) {
 			])}`;
 			return Promise.resolve(through(id, key.principal, build));
 		},
-		customRoles(source) {
-			const sourceId = ownerId(source);
+		customRoles(source, of) {
+			const sourceId = of === void 0 ? String(ownerId(source)) : `${String(ownerId(of.owner))}:${canonicalJson(of.principal)}`;
+			const principal = of?.principal;
 			const { globalRoles, sharedRoles, assignable } = source;
 			return Object.freeze({
 				...source.name === void 0 ? {} : { name: source.name },
-				rolesFor: (tenant, context) => through(roleKey(`${sourceId}:rolesFor`, [tenant, withoutMemo(context)]), void 0, () => source.rolesFor(tenant, context)),
-				...assignable === void 0 ? {} : { assignable: (tenant) => through(roleKey(`${sourceId}:assignable`, [tenant]), void 0, () => assignable.call(source, tenant)) },
-				...globalRoles === void 0 ? {} : { globalRoles: (context) => through(roleKey(`${sourceId}:globalRoles`, [withoutMemo(context)]), void 0, () => globalRoles.call(source, context)) },
-				...sharedRoles === void 0 ? {} : { sharedRoles: (context) => through(roleKey(`${sourceId}:sharedRoles`, [withoutMemo(context)]), void 0, () => sharedRoles.call(source, context)) }
+				rolesFor: (tenant, context) => through(roleKey(`${sourceId}:rolesFor`, [tenant, withoutMemo(context)]), principal, () => source.rolesFor(tenant, context)),
+				...assignable === void 0 ? {} : { assignable: (tenant) => through(roleKey(`${sourceId}:assignable`, [tenant]), principal, () => assignable.call(source, tenant)) },
+				...globalRoles === void 0 ? {} : { globalRoles: (context) => through(roleKey(`${sourceId}:globalRoles`, [withoutMemo(context)]), principal, () => globalRoles.call(source, context)) },
+				...sharedRoles === void 0 ? {} : { sharedRoles: (context) => through(roleKey(`${sourceId}:sharedRoles`, [withoutMemo(context)]), principal, () => sharedRoles.call(source, context)) }
 			});
 		},
 		entitlements(source) {
@@ -2288,4 +2205,4 @@ function toCsvRow(event) {
 	].map(field).join(",");
 }
 //#endregion
-export { defineOperations as A, limits as C, approvalPoliciesFor as D, approvalPolicies as E, memorySettingsSource as F, memorySnapshotSource as I, sqlFunction as L, memoryCustomRoleSource as M, memoryEntitlementSource as N, memoryApprovalPolicySource as O, memoryMembershipSource as P, memoryRelationSource as S, stripeEntitlementSource as T, arazzoFindings as _, normalizeMembership as a, instanceCache as b, crud as c, snapshotFor as d, customRoleSource as f, localSnapshotManifest as g, defineApp as h, decideRoleChange as i, isOperationEffect as j, validateApprovalPolicy as k, readable as l, shadowMode as m, toCsvRow as n, normalizeMemberships as o, mayAccess as p, checkRoleChange as r, resolveScope as s, CSV_COLUMNS as t, writable as u, simulateArazzo as v, memoryLimitStore as w, signPolicyDocument as x, memoryVersionCache as y };
+export { memoryCustomRoleSource as A, limits as C, approvalPoliciesFor as D, approvalPolicies as E, sqlFunction as F, memoryMembershipSource as M, memorySettingsSource as N, memoryApprovalPolicySource as O, memorySnapshotSource as P, memoryRelationSource as S, stripeEntitlementSource as T, arazzoFindings as _, normalizeMembership as a, instanceCache as b, crud as c, snapshotFor as d, customRoleSource as f, localSnapshotManifest as g, defineApp as h, decideRoleChange as i, memoryEntitlementSource as j, validateApprovalPolicy as k, readable as l, shadowMode as m, toCsvRow as n, normalizeMemberships as o, mayAccess as p, checkRoleChange as r, resolveScope as s, CSV_COLUMNS as t, writable as u, simulateArazzo as v, memoryLimitStore as w, signPolicyDocument as x, memoryVersionCache as y };

package/dist/ssf/index.d.ts

@@ -1,4 +1,4 @@
-import { A as SsfSubject, C as SsfEventName, D as SsfReceiver, E as SsfPermDockOptions, M as SsfTransmitterConfiguration, N as SsfVerification, O as SsfStreamConfiguration, S as SsfEventListener, T as SsfPermDock, _ as SetSubject, a as PollHandle, b as SsfEventHandler, c as PushSetOptions, d as SetDelivery, f as SetDeliveryFailureCause, g as SetQueue, h as SetPollHandlerOptions, i as CaepReason, j as SsfSubjectResolver, k as SsfStreamStatus, l as ReplayStore, m as SetEvent, n as CaepEventName, o as PollOptions, p as SetError, r as CaepInitiatingEntity, s as PollResult, t as CaepCommon, u as RiscEventName, v as SignSetOptions, w as SsfOnEvent, x as SsfEventInput, y as SsfAuditEvent } from "../types-CJC1aaoJ.js";
-import { t as memoryReplayStore } from "../replay-Dc3d8LhG.js";
-import { A as createPermDock, C as memorySsfStreamStore, D as PollSetsResult, E as PollSetsOptions, O as PolledSet, S as SsfStreamStore, T as setPollHandler, _ as SsfFanOut, a as CaepTokenClaimsChange, b as ssfTransmitter, c as RiscEvents, d as caepEvents, f as pushSet, g as FanOutSetOptions, h as streamVerificationEvent, i as CaepEvents, k as pollSets, l as SSF_POLL_DELIVERY, m as signSet, n as CaepCredentialChange, o as RiscAccountDisabled, p as riscEvents, r as CaepDeviceComplianceChange, s as RiscCredentialCompromise, t as CaepAssuranceLevelChange, u as SSF_PUSH_DELIVERY, v as SsfTransmitterOptions, w as memorySetQueue, x as SsfStream, y as fanOutSet } from "../index-z44pfWar.js";
+import { A as SsfSubject, C as SsfEventName, D as SsfReceiver, E as SsfPermDockOptions, M as SsfTransmitterConfiguration, N as SsfVerification, O as SsfStreamConfiguration, S as SsfEventListener, T as SsfPermDock, _ as SetSubject, a as PollHandle, b as SsfEventHandler, c as PushSetOptions, d as SetDelivery, f as SetDeliveryFailureCause, g as SetQueue, h as SetPollHandlerOptions, i as CaepReason, j as SsfSubjectResolver, k as SsfStreamStatus, l as ReplayStore, m as SetEvent, n as CaepEventName, o as PollOptions, p as SetError, r as CaepInitiatingEntity, s as PollResult, t as CaepCommon, u as RiscEventName, v as SignSetOptions, w as SsfOnEvent, x as SsfEventInput, y as SsfAuditEvent } from "../types-Ck1KOfug.js";
+import { t as memoryReplayStore } from "../replay-E5X9E1lC.js";
+import { A as createPermDock, C as memorySsfStreamStore, D as PollSetsResult, E as PollSetsOptions, O as PolledSet, S as SsfStreamStore, T as setPollHandler, _ as SsfFanOut, a as CaepTokenClaimsChange, b as ssfTransmitter, c as RiscEvents, d as caepEvents, f as pushSet, g as FanOutSetOptions, h as streamVerificationEvent, i as CaepEvents, k as pollSets, l as SSF_POLL_DELIVERY, m as signSet, n as CaepCredentialChange, o as RiscAccountDisabled, p as riscEvents, r as CaepDeviceComplianceChange, s as RiscCredentialCompromise, t as CaepAssuranceLevelChange, u as SSF_PUSH_DELIVERY, v as SsfTransmitterOptions, w as memorySetQueue, x as SsfStream, y as fanOutSet } from "../index-BhnOOnp9.js";
 export { type CaepAssuranceLevelChange, type CaepCommon, type CaepCredentialChange, type CaepDeviceComplianceChange, type CaepEventName, type CaepEvents, type CaepInitiatingEntity, type CaepReason, type CaepTokenClaimsChange, type FanOutSetOptions, type PollHandle, type PollOptions, type PollResult, type PollSetsOptions, type PollSetsResult, type PolledSet, type PushSetOptions, type ReplayStore, type RiscAccountDisabled, type RiscCredentialCompromise, type RiscEventName, type RiscEvents, SSF_POLL_DELIVERY, SSF_PUSH_DELIVERY, type SetDelivery, type SetDeliveryFailureCause, type SetError, type SetEvent, type SetPollHandlerOptions, type SetQueue, type SetSubject, type SignSetOptions, type SsfAuditEvent, type SsfEventHandler, type SsfEventInput, type SsfEventListener, type SsfEventName, type SsfFanOut, type SsfOnEvent, type SsfPermDock, type SsfPermDockOptions, type SsfReceiver, type SsfStream, type SsfStreamConfiguration, type SsfStreamStatus, type SsfStreamStore, type SsfSubject, type SsfSubjectResolver, type SsfTransmitterConfiguration, type SsfTransmitterOptions, type SsfVerification, caepEvents, createPermDock, fanOutSet, memoryReplayStore, memorySetQueue, memorySsfStreamStore, pollSets, pushSet, riscEvents, setPollHandler, signSet, ssfTransmitter, streamVerificationEvent };

package/dist/ssf/index.js

@@ -3,7 +3,7 @@ import { o as statusProblem } from "../problem-details-CLDgX1KV.js";
 import { o as epochSeconds } from "../time-nR1JesoH.js";
 import { n as readBodyText } from "../body-text-DQhcmqdY.js";
 import { f as validationProblem, l as problemResponse, o as methodNotAllowed, s as notFoundProblem } from "../problem-BVLHFK33.js";
-import { t as cancelApprovals } from "../helpers-DNnZffrI.js";
+import { t as cancelApprovals } from "../helpers-DmqGy63f.js";
 import { i as issuerFromDiscovery, t as joseTokenVerifier } from "../verifier-DUV6pLqZ.js";
 import { t as memoryReplayStore } from "../replay-BU09ad4L.js";
 import { t as timeoutSignal } from "../timeout-D51niuQP.js";

package/dist/{standard-webhooks-BFeEpjxy.d.ts → standard-webhooks-BfPaZ6T1.d.ts}

@@ -1,5 +1,5 @@
-import { Kt as Instant, hr as JsonWebKeyLike } from "./policy-types-IRJVABmm.js";
-import { l as ReplayStore } from "./types-CJC1aaoJ.js";
+import { Kt as Instant, hr as JsonWebKeyLike } from "./policy-types-D-GwfQTc.js";
+import { l as ReplayStore } from "./types-Ck1KOfug.js";
 //#region src/server/standard-webhooks.d.ts
 /** The three Standard Webhooks headers a delivery carries. */
 type WebhookHeaders = {

package/dist/{store-g5ctUrOI.d.ts → store-DYeB-_U3.d.ts}

@@ -1,8 +1,8 @@
-import { $t as Snapshot, M as PolicyVocabulary, _r as Principal, _t as TokenVerifier, pr as Delegation, qn as Decision, sr as Actor } from "./policy-types-IRJVABmm.js";
+import { $t as Snapshot, M as PolicyVocabulary, _r as Principal, _t as TokenVerifier, pr as Delegation, qn as Decision, sr as Actor } from "./policy-types-D-GwfQTc.js";
 import { u as Permission } from "./permission-types-CAY-GU7e.js";
-import { a as PermDock } from "./permdock-DUWZEOLR.js";
-import { a as ProblemDetails } from "./errors-Dc9FdamT.js";
-import { n as DescribeMessages, t as DecisionDescription } from "./describe-nalX_HHE.js";
+import { a as PermDock } from "./permdock-ffY4CMd9.js";
+import { a as ProblemDetails } from "./errors-TpzkEKgJ.js";
+import { n as DescribeMessages, t as DecisionDescription } from "./describe-BKtC_8PG.js";
 import { r as RefreshTrigger } from "./refresh-on-L9UOwATg.js";
 //#region src/core/action-result.d.ts
 /** What a `protectAction` action resolves to; both members cross to the client. */

package/dist/{store-XgBMbfDy.js → store-DmVqy74I.js}

@@ -1,8 +1,8 @@
 import { t as compact } from "./compact-CAf557ZB.js";
 import { n as freezeDeep } from "./freeze-jjan0lCv.js";
-import { a as flattenApprovers, i as approverManagerKey } from "./approvers-CNtl4Vc5.js";
+import { a as flattenApprovers, i as approverManagerKey } from "./approvers-BaNwKYgd.js";
 import { a as durationOf, i as dateAt } from "./time-nR1JesoH.js";
-import { o as readWireApproval } from "./approval-normalize-4KxMRdJC.js";
+import { o as readWireApproval } from "./approval-normalize-CUjgSsOl.js";
 import { i as rootMembershipId } from "./subject-C7RddW0G.js";
 import { n as matchGrantee } from "./grantee-match-BP-k4vRJ.js";
 import { a as escalationOpenAt, i as approverRelationKey, o as stageEscalationOpenAt, r as approvalQuorum, s as ApprovalError } from "./types-CcUXciSj.js";

package/dist/{stores-53_kOwPi.js → stores-BYFopOm1.js}

@@ -1,5 +1,5 @@
-import { n as actionRunner, t as actionApproval } from "./protected-action-B6n6w7Rl.js";
-import { a as livePermDock, c as rolesView, d as subjectView, f as tenantView, i as gateView, n as describeWith, o as permissionSet, r as filterResult, t as approvalHandle } from "./views-TrZYlDnM.js";
+import { n as actionRunner, t as actionApproval } from "./protected-action-OpOxtTsN.js";
+import { a as livePermDock, c as rolesView, d as subjectView, f as tenantView, i as gateView, n as describeWith, o as permissionSet, r as filterResult, t as approvalHandle } from "./views-MWmJ6Y4P.js";
 import { n as getUi, r as providePermDock, t as getStore } from "./context-DeammvFl.js";
 import { derived, readable, toStore, writable } from "svelte/store";
 //#region src/svelte/stores.ts

package/dist/{stores-BtdN3eDO.d.ts → stores-EPul_8MN.d.ts}

@@ -1,10 +1,10 @@
-import { M as PolicyVocabulary, gr as Membership, qn as Decision } from "./policy-types-IRJVABmm.js";
+import { M as PolicyVocabulary, gr as Membership, qn as Decision } from "./policy-types-D-GwfQTc.js";
 import { u as Permission } from "./permission-types-CAY-GU7e.js";
 import { r as Role } from "./vocabulary-DEJ5j4mR.js";
-import { d as UncheckedData, s as RowData } from "./permdock-DUWZEOLR.js";
-import { r as DescribeOptions, t as DecisionDescription } from "./describe-nalX_HHE.js";
-import { _ as TenantView, a as ClientPermDock, c as GateMode, d as PermissionState, g as SubjectView, h as RolesOptions, l as GateView, r as ApprovalHandle, s as FilterResult, u as PermissionSet, y as ProtectedAction } from "./store-g5ctUrOI.js";
-import { n as ProtectedActionReadable, r as SveltePermDockOptions } from "./types-DVZNTkU0.js";
+import { d as UncheckedData, s as RowData } from "./permdock-ffY4CMd9.js";
+import { r as DescribeOptions, t as DecisionDescription } from "./describe-BKtC_8PG.js";
+import { _ as TenantView, a as ClientPermDock, c as GateMode, d as PermissionState, g as SubjectView, h as RolesOptions, l as GateView, r as ApprovalHandle, s as FilterResult, u as PermissionSet, y as ProtectedAction } from "./store-DYeB-_U3.js";
+import { n as ProtectedActionReadable, r as SveltePermDockOptions } from "./types-D19MK4t-.js";
 import { Readable } from "svelte/store";
 //#region src/svelte/stores.d.ts
 declare function setPermDock(options: SveltePermDockOptions): ClientPermDock;

package/dist/{stream-BMJg56jU.d.ts → stream-W2RuUYly.d.ts}

@@ -1,5 +1,5 @@
 import { u as Permission } from "./permission-types-CAY-GU7e.js";
-import { o as ProtectOptions } from "./server-types-Bw-lWqzR.js";
+import { o as ProtectOptions } from "./server-types-3OnXjZ2D.js";
 //#region src/server/stream.d.ts
 type StreamProtectOptions = ProtectOptions & {
   /**

package/dist/supabase/client.d.ts

@@ -1,31 +1,2 @@
-import { r as RefreshTrigger } from "../refresh-on-L9UOwATg.js";
-//#region src/supabase/client.d.ts
-/** The part of a supabase-js `RealtimeChannel` the trigger uses. */
-export type RealtimeRefreshChannel = {
-  readonly on: (type: "broadcast", filter: {
-    readonly event: string;
-  }, callback: (message: unknown) => void) => unknown;
-  readonly subscribe: () => unknown;
-};
-/** The part of a browser supabase-js client the trigger uses. */
-export type RealtimeRefreshClient<C extends RealtimeRefreshChannel = RealtimeRefreshChannel> = {
-  readonly channel: (topic: string, options: {
-    readonly config: {
-      readonly private: boolean;
-    };
-  }) => C;
-  readonly removeChannel: (channel: C) => unknown;
-};
-export type SupabaseRealtimeRefreshOptions = {
-  /** The signed-in user's id, the `sub` of their token. */
-  readonly userId: string;
-};
-/**
- * A `refreshOn` trigger on the user's private `authz:<uid>` Realtime topic,
- * where the generated version trigger sends each bump, for apps without
- * better-supabase. The `realtime.messages` receive policy from
- * `supabase.hook.broadcast` lets each user join only their own topic. With
- * better-supabase, use `authzChangeRefresh` on `SessionProvider` instead.
- */
-export declare function supabaseRealtimeRefresh<C extends RealtimeRefreshChannel>(client: RealtimeRefreshClient<C>, options: SupabaseRealtimeRefreshOptions): RefreshTrigger;
-//#endregion
+import { i as supabaseRealtimeRefresh, n as RealtimeRefreshClient, r as SupabaseRealtimeRefreshOptions, t as RealtimeRefreshChannel } from "../client-CH7vzSAY.js";
+export { RealtimeRefreshChannel, RealtimeRefreshClient, SupabaseRealtimeRefreshOptions, supabaseRealtimeRefresh };

package/dist/supabase/index.d.ts

@@ -1,8 +1,8 @@
-import { Kt as Instant, yr as Subject } from "../policy-types-IRJVABmm.js";
-import { i as ApprovalPolicySource } from "../approval-policies-9VagPixq.js";
-import { a as ApprovalDelegationSource, m as ApprovalStore, u as ApprovalRequest } from "../types-BvBbkAu1.js";
-import { a as SupabaseRpcClient, c as readSubjectRecord, i as SupabaseRpcCaller, n as PostgrestSourcesOptions, o as SupabaseRpcResult, r as SubjectRecord, s as postgrestSources, t as PostgrestSources } from "../postgrest-B_cEDd4e.js";
-import { A as SupabaseSubjectOptions, B as supabaseClaims, C as SupabasePrincipal, D as SupabaseRlsOptions, E as SupabaseRlsMembershipTable, F as SupabaseClaims, I as SupabaseClaimsOptions, L as SupabaseClaimsSchema, M as SupabaseSuspendedScope, N as SupabaseSuspension, O as SupabaseSessionLike, P as SupabaseActClaim, R as SupabaseMembershipClaim, S as SupabasePermissionRef, T as SupabaseRlsConfig, _ as SupabaseActor, a as MembershipStream, b as SupabaseInclude, c as SupabasePostgres, d as supabasePostgresQuery, f as tableMembershipSource, g as SupabaseActiveRow, h as RoleThrough, i as MembershipSql, j as SupabaseSuspendedMembership, k as SupabaseStorage, l as authzVersion, n as MembershipHolders, o as MembershipTableOptions, p as AuthorizeSqlOptions, r as MembershipJunctionOptions, s as SqlMembershipSource, t as AUTHZ_VERSION_TABLE, u as junctionMembershipSource, v as SupabaseActorResult, w as SupabaseRealtime, x as SupabaseMembershipTable, y as SupabaseDelegation, z as SupabasePermDockClaims } from "../sources-CXY05xtB.js";
+import { Kt as Instant, yr as Subject } from "../policy-types-D-GwfQTc.js";
+import { i as ApprovalPolicySource } from "../approval-policies-oNnckT12.js";
+import { a as ApprovalDelegationSource, m as ApprovalStore, u as ApprovalRequest } from "../types-CqcsNCaN.js";
+import { a as SupabaseRpcClient, c as readSubjectRecord, i as SupabaseRpcCaller, n as PostgrestSourcesOptions, o as SupabaseRpcResult, r as SubjectRecord, s as postgrestSources, t as PostgrestSources } from "../postgrest-D84p5dbA.js";
+import { A as SupabaseSubjectOptions, B as supabaseClaims, C as SupabasePrincipal, D as SupabaseRlsOptions, E as SupabaseRlsMembershipTable, F as SupabaseClaims, I as SupabaseClaimsOptions, L as SupabaseClaimsSchema, M as SupabaseSuspendedScope, N as SupabaseSuspension, O as SupabaseSessionLike, P as SupabaseActClaim, R as SupabaseMembershipClaim, S as SupabasePermissionRef, T as SupabaseRlsConfig, _ as SupabaseActor, a as MembershipStream, b as SupabaseInclude, c as SupabasePostgres, d as supabasePostgresQuery, f as tableMembershipSource, g as SupabaseActiveRow, h as RoleThrough, i as MembershipSql, j as SupabaseSuspendedMembership, k as SupabaseStorage, l as authzVersion, n as MembershipHolders, o as MembershipTableOptions, p as AuthorizeSqlOptions, r as MembershipJunctionOptions, s as SqlMembershipSource, t as AUTHZ_VERSION_TABLE, u as junctionMembershipSource, v as SupabaseActorResult, w as SupabaseRealtime, x as SupabaseMembershipTable, y as SupabaseDelegation, z as SupabasePermDockClaims } from "../sources-xdQShLDU.js";
 import { _ as hasTokenHook, a as SupabaseManifestActiveRow, c as SupabaseManifestMembership, d as SupabaseManifestResourceNames, f as SupabaseManifestRls, g as SupabaseManifestValue, h as SupabaseManifestThrough, i as SupabaseManifest, l as SupabaseManifestNames, m as SupabaseManifestScopeNames, n as SupabaseHookClaim, o as SupabaseManifestColumn, p as SupabaseManifestRole, r as SupabaseHookManifest, s as SupabaseManifestHelper, t as SupabaseDatabaseManifest, u as SupabaseManifestRequires, v as parseSupabaseManifest } from "../manifest-B5yF3CIq.js";
 import { t as SqlQuery } from "../sql-B80DFdpG.js";
 import { n as supabaseTenantClaim, t as supabaseMembershipsBudget } from "../budget-CNLsV2SL.js";

package/dist/supabase/index.js

@@ -1,7 +1,7 @@
-import { n as supabaseTenantClaim, t as supabaseMembershipsBudget } from "../budget-BBCPDOGP.js";
 import { n as AUTHZ_TOPIC, r as authzUserTopic, t as AUTHZ_EVENT } from "../authz-topic-Dbc-HDOS.js";
-import { a as supabaseApprovalStore, i as tableApprovalPolicySource, n as supabaseRls, o as supabaseClaims, r as tableApprovalDelegationSource, s as exchangeCapability, t as authorizeSql } from "../supabase-C8cNzp4i.js";
+import { n as supabaseTenantClaim, t as supabaseMembershipsBudget } from "../budget-BBCPDOGP.js";
+import { a as supabaseApprovalStore, i as tableApprovalPolicySource, n as supabaseRls, o as supabaseClaims, r as tableApprovalDelegationSource, s as exchangeCapability, t as authorizeSql } from "../supabase-BiViJpQ4.js";
 import { c as tableMembershipSource, i as authzVersion, o as junctionMembershipSource, s as supabasePostgresQuery, t as AUTHZ_VERSION_TABLE } from "../sources-C4vkzZJV.js";
 import { a as delegationOf, c as subjectFromSupabaseSession, i as actorOf, n as postgrestSources, r as readSubjectRecord, s as subjectFromSupabase } from "../postgrest-BrjrckDG.js";
-import { n as parseSupabaseManifest, t as hasTokenHook } from "../manifest-BXTbHNIV.js";
+import { n as parseSupabaseManifest, t as hasTokenHook } from "../manifest-BdzBobNK.js";
 export { AUTHZ_EVENT, AUTHZ_TOPIC, AUTHZ_VERSION_TABLE, actorOf, authorizeSql, authzUserTopic, authzVersion, delegationOf, exchangeCapability, hasTokenHook, junctionMembershipSource, parseSupabaseManifest, postgrestSources, readSubjectRecord, subjectFromSupabase, subjectFromSupabaseSession, supabaseApprovalStore, supabaseClaims, supabaseMembershipsBudget, supabasePostgresQuery, supabaseRls, supabaseTenantClaim, tableApprovalDelegationSource, tableApprovalPolicySource, tableMembershipSource };

package/dist/supabase/middleware.d.ts

@@ -1,10 +1,10 @@
-import { E as Policy, M as PolicyVocabulary, _r as Principal, yr as Subject } from "../policy-types-IRJVABmm.js";
+import { E as Policy, M as PolicyVocabulary, _r as Principal, yr as Subject } from "../policy-types-D-GwfQTc.js";
 import { u as Permission } from "../permission-types-CAY-GU7e.js";
-import { a as PermDock } from "../permdock-DUWZEOLR.js";
-import { t as InstanceOptions } from "../instance-options-BOCRxEFb.js";
+import { a as PermDock } from "../permdock-ffY4CMd9.js";
+import { t as InstanceOptions } from "../instance-options-2sFGSdsf.js";
 import { t as RequestContext } from "../request-context-C2_1lchh.js";
-import { i as OpenApiHooks } from "../server-types-Bw-lWqzR.js";
-import { n as ServerAdapterServices } from "../bind-DjFNX0Pq.js";
+import { i as OpenApiHooks } from "../server-types-3OnXjZ2D.js";
+import { n as ServerAdapterServices } from "../bind-DR6ku3A9.js";
 import { FetchHandler, Middleware } from "@supabase/middleware";
 //#region src/supabase/middleware.d.ts
 /**

package/dist/supabase/middleware.js

@@ -1,11 +1,11 @@
 import { t as compact } from "../compact-CAf557ZB.js";
-import { l as withApp } from "../permdock-DdzMv5-F.js";
+import { l as withApp } from "../permdock-D-_WrdKu.js";
 import { t as composeWraps } from "../wrap-C5PWzgkq.js";
 import { r as credentialSubject } from "../credential-B3Hj4puZ.js";
 import { o as methodNotAllowed } from "../problem-BVLHFK33.js";
-import { r as instanceOptions } from "../build-instance-lye7oEqf.js";
-import { t as createPermDock$1 } from "../create-jCPwPWXf.js";
-import { n as attached } from "../bind-BJFeLX1V.js";
+import { r as instanceOptions } from "../build-instance-BFMFQdE_.js";
+import { t as createPermDock$1 } from "../create-3A7J9KRR.js";
+import { n as attached } from "../bind-B4pMH9bm.js";
 import { defineMiddleware } from "@supabase/middleware";
 //#region src/supabase/middleware.ts
 const SECRET_KEY_NAME = /^[A-Za-z0-9_-]+$/u;

package/dist/{supabase-C8cNzp4i.js → supabase-BiViJpQ4.js}

@@ -2,7 +2,7 @@ import { r as isRecord, t as compact } from "./compact-CAf557ZB.js";
 import { d as isoNow, i as dateAt, p as nowSeconds, u as isoAt } from "./time-nR1JesoH.js";
 import { t as canonicalJson } from "./canonical-json-DwilZ1iB.js";
 import { s as ApprovalError } from "./types-CcUXciSj.js";
-import { c as decodeApprovalCursor, l as encodeApprovalCursor, s as approvalPageSize, t as applyApprovalVerdict } from "./store-XgBMbfDy.js";
+import { c as decodeApprovalCursor, l as encodeApprovalCursor, s as approvalPageSize, t as applyApprovalVerdict } from "./store-DmVqy74I.js";
 import { a as parseCapability } from "./capability-zN6T9fxe.js";
 import { t as loadJose } from "./load-jose-DZ4dnjri.js";
 import "./budget-BBCPDOGP.js";

package/dist/{supabase-C6FyUeSh.js → supabase-CogTyJH2.js}

@@ -47,7 +47,7 @@ const hookGenerate = defineLeaf({
 		const budget = given(flags.budget);
 		const schema = given(flags.schema);
 		const grantsOut = given(flags["grants-out"]);
-		const { runSupabase } = await import("./supabase-hook-CPBX4dy5.js");
+		const { runSupabase } = await import("./supabase-hook-BN46IrVI.js");
 		return runSupabase({
 			cwd: ctx.cwd,
 			config: ctx.config,
@@ -76,7 +76,7 @@ const inspect = defineLeaf({
 	},
 	async run(ctx, { flags }) {
 		const out = flags.out === "" ? true : flags.out === "-" ? void 0 : flags.out;
-		const { runSupabase } = await import("./supabase-hook-CPBX4dy5.js");
+		const { runSupabase } = await import("./supabase-hook-BN46IrVI.js");
 		return runSupabase({
 			cwd: ctx.cwd,
 			config: ctx.config,

package/dist/supabase-hook-BN46IrVI.js

@@ -0,0 +1 @@
+export { i as runSupabase } from "./supabase-hook-DX38Hj8h.js";