permdock 0.17.0 → 0.18.1

package/dist/{diff-BTsLiW59.js → diff-BnNHqtHj.js}

@@ -1,14 +1,14 @@
-import { M as memoryCustomRoleSource } from "./src-nYNBfmgq.js";
+import { A as memoryCustomRoleSource } from "./src-Brzq_0in.js";
 import { n as findPermission } from "./permission-registry-B8tYxPIt.js";
 import { g as secondsOf } from "./time-nR1JesoH.js";
 import { t as canonicalJson } from "./canonical-json-DwilZ1iB.js";
-import { t as getPermDock } from "./permdock-DdzMv5-F.js";
+import { t as getPermDock } from "./permdock-D-_WrdKu.js";
 import { i as configError, u as usageResult } from "./errors-BhRkoNS7.js";
 import { t as buildCatalog } from "./catalog-doc-C4DGfJCO.js";
 import { a as loadModule, n as asPolicy, s as pickNamed } from "./load-BaEamml-.js";
 import { t as parseCatalog } from "./parse-UTC-sDrt.js";
-import { t as operationFindings } from "./operation-findings-CXtFzlKJ.js";
-import { n as fixtureSubject, r as loadFixtures, t as fixtureRow } from "./fixtures-0VTW5oNq.js";
+import { t as operationFindings } from "./operation-findings-CVwJHEu_.js";
+import { n as fixtureSubject, r as loadFixtures, t as fixtureRow } from "./fixtures-Cemqurt8.js";
 import { existsSync, readFileSync } from "node:fs";
 import { resolve } from "node:path";
 //#region src/cli/diff/format.ts

package/dist/{diff-CcxYooMu.js → diff-CBCzOTWM.js}

@@ -21,7 +21,7 @@ const diff = defineLeaf({
 		}
 	},
 	async run(ctx, { flags, args }) {
-		return (await import("./diff-BTsLiW59.js")).runDiff({
+		return (await import("./diff-BnNHqtHj.js")).runDiff({
 			cwd: ctx.cwd,
 			config: ctx.config,
 			sources: [args["before"], args["after"]].filter((value) => value !== void 0),

package/dist/{doctor-DS-9ApID.js → doctor-CkYKCuX7.js}

@@ -5,8 +5,8 @@ import { u as isPrincipalRelation } from "./resource-relations-8-pCScBO.js";
 import { t as canonicalJson } from "./canonical-json-DwilZ1iB.js";
 import { c as rootScope, d as scopeList, o as normalizeMemberships, s as resolveScope } from "./scopes-BSdYaGHs.js";
 import { o as flattenGrantee } from "./grantee-Dke-9rd1.js";
-import { u as separationConflicts } from "./policy-DxQyHKPB.js";
-import { T as validateCustomRole } from "./evaluate-CsjXeLRo.js";
+import { u as separationConflicts } from "./policy-cV_wwPb8.js";
+import { T as validateCustomRole } from "./evaluate-Czbj7thS.js";
 import { s as parseCredential } from "./credential-B3Hj4puZ.js";
 import { a as describeError } from "./errors-BhRkoNS7.js";
 import { t as policyRowConditionKeys } from "./row-conditions-BAGHOmVq.js";
@@ -15,7 +15,7 @@ import { i as DOCTOR_REPORT_SCHEMA } from "./version-DMQ0dnN5.js";
 import { c as jsonSchemaOf, i as catalogOAuthScopes } from "./catalog-doc-C4DGfJCO.js";
 import { a as loadModule, i as loadConfiguredPolicy, n as asPolicy, s as pickNamed } from "./load-BaEamml-.js";
 import { t as catalogPath } from "./catalog-path-CnI0XTFK.js";
-import { r as runCollect } from "./collect-HfJXl8Tr.js";
+import { r as runCollect } from "./collect-D878zLDP.js";
 import { n as supabaseTenantClaim } from "./budget-BBCPDOGP.js";
 import { a as filesOf, i as betterSupabaseTenantClaim, n as betterSupabaseConfig, o as nodeFiles, r as betterSupabaseDefaults, s as readJson, t as betterSupabaseAuthzVersions } from "./better-supabase-BJtQ-kNf.js";
 import { i as qualifySqlTable, s as quoteSqlLiteral } from "./sql-0WjxIp9g.js";
@@ -25,23 +25,23 @@ import { t as parseCatalog } from "./parse-UTC-sDrt.js";
 import { n as activeTenantMismatch } from "./active-tenant-DVee32-T.js";
 import "./markers-BeHZ4x9Q.js";
 import { t as didYouMean } from "./args-iafbHiXn.js";
-import { t as DOCS_BASE } from "./manifest-Dij1U0hx.js";
+import { t as DOCS_BASE } from "./manifest-wclLWBVH.js";
 import { t as createStyle } from "./style-Ds11Hmk4.js";
-import { a as nonEmptyOr, r as findingOf } from "./output-DhTpe8v1.js";
-import { i as runSkillsInstall } from "./skills-BUuH-QFt.js";
+import { a as nonEmptyOr, r as findingOf } from "./output-BFWLER4r.js";
+import { i as runSkillsInstall } from "./skills-B4MPRxQd.js";
 import { n as MIGRATION_DIRS, t as DEFAULT_SENSITIVE_ACTIONS } from "./constants-DcJABbLW.js";
 import { l as partPath } from "./output-files-CM0BnH05.js";
-import { _ as readSupabaseConfig, a as supabaseHookManifest, c as activeSource, d as resolveSchemas, g as pd074, h as pd045, l as pd039, m as attrsPlan, n as hookOut, v as supabaseConfig } from "./supabase-hook-Cj85nccs.js";
-import { G as byKey, Q as graphSqlName, n as tableNameOf, o as graphPlan, r as tableNames } from "./tables-BsGE6HBR.js";
-import { a as guardedTables, p as contextRefs, r as unsatisfiedKinds, t as ownershipRules } from "./ownership-moSRhxl_.js";
+import { _ as readSupabaseConfig, a as supabaseHookManifest, c as activeSource, d as resolveSchemas, g as pd074, h as pd045, l as pd039, m as attrsPlan, n as hookOut, v as supabaseConfig } from "./supabase-hook-DX38Hj8h.js";
+import { G as byKey, Q as graphSqlName, n as tableNameOf, o as graphPlan, r as tableNames } from "./tables-BfOk0ymL.js";
+import { a as guardedTables, p as contextRefs, r as unsatisfiedKinds, t as ownershipRules } from "./ownership-D-mIt-w0.js";
 import { t as membershipSourcesOf } from "./sources-qoIJQrJv.js";
 import { i as group, n as membershipColumns, o as sqlStatements, r as tableKey } from "./deciding-columns-NB4wcyBf.js";
 import { t as FIELD_VIEWS } from "./fields-CrjL6A49.js";
-import { t as resolveNames } from "./resolve-names-1nCei24V.js";
-import { a as pd010, c as pd014, d as pd038, f as pd041, i as pd008, l as pd015, n as pd001, o as pd011, p as pd057, r as pd007, s as pd013, t as runUsage, u as pd036 } from "./usage-COsGLht5.js";
-import { d as rowConditionMessage, f as commandFor, m as tableFor, p as compileGrants, s as ROW_CONDITION_FIX, u as helperTablePolicies } from "./verify-C8G8D5mk.js";
-import { a as streamOf, i as scopeSourcesOf, r as staleFiles, t as powersyncFiles } from "./powersync-C0nsyULQ.js";
-import { a as buildContext, n as generateOptions, r as isRefusal, s as inheritTargets, t as supautilsRejections } from "./supautils-BP_5WAIc.js";
+import { t as resolveNames } from "./resolve-names-CBl4r4_r.js";
+import { a as pd010, c as pd014, d as pd038, f as pd041, i as pd008, l as pd015, n as pd001, o as pd011, p as pd057, r as pd007, s as pd013, t as runUsage, u as pd036 } from "./usage-DC0UKe6C.js";
+import { d as rowConditionMessage, f as commandFor, m as tableFor, p as compileGrants, s as ROW_CONDITION_FIX, u as helperTablePolicies } from "./verify-Bpj0hauG.js";
+import { a as streamOf, i as scopeSourcesOf, r as staleFiles, t as powersyncFiles } from "./powersync-9PYOE1wt.js";
+import { a as buildContext, n as generateOptions, r as isRefusal, s as inheritTargets, t as supautilsRejections } from "./supautils-BGf6zRvM.js";
 import { n as legacyHelperNames, r as retirePlan, t as legacyHelperCalls } from "./retire-B2xffQgY.js";
 import { basename, dirname, join, resolve } from "node:path";
 import { pathToFileURL } from "node:url";
@@ -877,8 +877,14 @@ async function pd065(input) {
 const SHARED_FACTORIES = {
 	postgrestSources: "PD080",
 	memoryVersionCache: "PD080",
+	claimsFirst: "PD080",
 	instanceCache: "PD081"
 };
+/** Factories whose cost differs from their code's message. */
+const FACTORY_MESSAGES = { claimsFirst: {
+	what: "so every call passes a new memberships source, which the instance cache compares by identity, and no instance is reused",
+	fix: "create claimsFirst(...) once at module scope, or use permdockFor(...).sources(versions), and pass the same object to every adapter"
+} };
 const MESSAGES = {
 	PD080: {
 		what: "so every call starts with no shared version reads",
@@ -952,17 +958,21 @@ function findings(sources, code) {
 		for (const { call, factory } of callsInFunctions(source)) {
 			if (SHARED_FACTORIES[factory] !== code) continue;
 			const line = source.text.slice(0, call.start).split("\n").length;
+			const { what, fix } = FACTORY_MESSAGES[factory] ?? MESSAGES[code];
 			out.push({
 				code,
 				severity: "warning",
-				message: `${source.file}:${String(line)} creates ${factory}() inside a function, ${MESSAGES[code].what}`,
-				fix: MESSAGES[code].fix
+				message: `${source.file}:${String(line)} creates ${factory}() inside a function, ${what}`,
+				fix
 			});
 		}
 	}
 	return out;
 }
-/** PD080: `postgrestSources` or `memoryVersionCache` created per call. */
+/**
+* PD080: `postgrestSources`, `memoryVersionCache` or `claimsFirst` created per
+* call.
+*/
 function pd080(sources) {
 	return findings(sources, "PD080");
 }
@@ -1206,6 +1216,29 @@ async function pd058(input) {
 		fix: "run permdock powersync generate and deploy the files"
 	})), ...gaps];
 }
+/**
+* PD084: a synced stream reads a token claim. PowerSync keeps the claims a
+* connection started with, so after a role or tenant change the device syncs by
+* the old claims until the app refreshes the session and reconnects.
+*/
+async function pd084(input) {
+	const { config } = input;
+	if (config.powersync === void 0 || config.policy === void 0) return [];
+	const policy = await policyOf(input);
+	if (policy === void 0) return [];
+	let claims;
+	try {
+		({claims} = powersyncFiles(policy, config));
+	} catch {
+		return [];
+	}
+	return claims.map((message) => ({
+		code: "PD084",
+		severity: "warning",
+		message,
+		fix: "pass nativeRefresh from permdock/react-native to refreshOn, which refreshes the session and reconnects PowerSync on each authz:<uid> message"
+	}));
+}
 //#endregion
 //#region src/cli/doctor/project.ts
 /**
@@ -2809,6 +2842,11 @@ const DOCTOR_CHECKS = [
 		groups: ["powersync"],
 		run: pd058
 	},
+	{
+		code: "PD084",
+		groups: ["powersync", "react-native"],
+		run: pd084
+	},
 	{
 		code: "PD061",
 		groups: ["rls", "suspension"],

package/dist/{doctor-BNRhJegR.js → doctor-xUpR5rXg.js}

@@ -10,7 +10,7 @@ const doctor = defineLeaf({
 			description: "Check codes or groups to run",
 			valueHint: "code",
 			async complete() {
-				const { DOCTOR_CHECKS } = await import("./doctor-DS-9ApID.js");
+				const { DOCTOR_CHECKS } = await import("./doctor-CkYKCuX7.js");
 				return [.../* @__PURE__ */ new Set([...DOCTOR_CHECKS.map(({ code }) => code), ...DOCTOR_CHECKS.flatMap(({ groups }) => groups)])];
 			}
 		},
@@ -27,7 +27,7 @@ const doctor = defineLeaf({
 			if (answer === void 0) return CANCELLED;
 			fix = answer;
 		}
-		return (await import("./doctor-DS-9ApID.js")).runDoctor({
+		return (await import("./doctor-CkYKCuX7.js")).runDoctor({
 			cwd: ctx.cwd,
 			config: ctx.config,
 			only: flags.only,

package/dist/drizzle/index.d.ts

@@ -1,7 +1,7 @@
-import { Kt as Instant, wr as Condition, yr as Subject } from "../policy-types-IRJVABmm.js";
-import { f as WhereResult } from "../permdock-DUWZEOLR.js";
+import { Kt as Instant, wr as Condition, yr as Subject } from "../policy-types-D-GwfQTc.js";
+import { f as WhereResult } from "../permdock-ffY4CMd9.js";
 import { r as RelationsMapping } from "../graph-sql-BwFC4Qjs.js";
-import { s as MembershipsMapping } from "../compile-BxiwRotu.js";
+import { s as MembershipsMapping } from "../compile-DBm0ub4p.js";
 import { n as RowCheck, t as WithSubjectOptions } from "../subject-settings-vNW8qmUH.js";
 import { SQL, Table } from "drizzle-orm";
 //#region src/drizzle/types.d.ts

package/dist/elysia/index.d.ts

@@ -1,9 +1,9 @@
-import { E as Policy, M as PolicyVocabulary, _r as Principal } from "../policy-types-IRJVABmm.js";
+import { E as Policy, M as PolicyVocabulary, _r as Principal } from "../policy-types-D-GwfQTc.js";
 import { u as Permission } from "../permission-types-CAY-GU7e.js";
-import { a as PermDock } from "../permdock-DUWZEOLR.js";
+import { a as PermDock } from "../permdock-ffY4CMd9.js";
 import { n as RevocationFeed } from "../revocations-BaUXHM1N.js";
-import { D as ConnectionOptions, T as Connection, f as InvalidSignatureError, i as OpenApiHooks, o as ProtectOptions, v as discoverViaSignatureAgent, x as webBotAuthVerifier } from "../server-types-Bw-lWqzR.js";
-import { t as ServerAdapterOptions } from "../bind-DjFNX0Pq.js";
+import { D as ConnectionOptions, T as Connection, f as InvalidSignatureError, i as OpenApiHooks, o as ProtectOptions, v as discoverViaSignatureAgent, x as webBotAuthVerifier } from "../server-types-3OnXjZ2D.js";
+import { t as ServerAdapterOptions } from "../bind-DR6ku3A9.js";
 import { Elysia } from "elysia";
 //#region src/elysia/create.d.ts
 type ElysiaRequestContext = {

package/dist/elysia/index.js

@@ -1,7 +1,7 @@
 import { a as parsedBody, r as hasCredentials } from "../http-DKLXrFGk.js";
-import { l as InvalidSignatureError, p as webBotAuthVerifier, u as discoverViaSignatureAgent } from "../evaluations-DG40eSJa.js";
-import { t as problemFromError } from "../map-error-B_f3C5cs.js";
-import { a as socketConnection, i as decorate, r as bindKernel } from "../bind-BJFeLX1V.js";
+import { l as InvalidSignatureError, p as webBotAuthVerifier, u as discoverViaSignatureAgent } from "../evaluations-h3KoJAPa.js";
+import { t as problemFromError } from "../map-error-BH16Ah8P.js";
+import { a as socketConnection, i as decorate, r as bindKernel } from "../bind-B4pMH9bm.js";
 import { a as onRevoked, n as closeReason, t as POLICY_VIOLATION } from "../stream-CDvF0sJm.js";
 import { Elysia } from "elysia";
 //#region src/elysia/create.ts

package/dist/{errors-Dc9FdamT.d.ts → errors-TpzkEKgJ.d.ts}

@@ -1,4 +1,4 @@
-import { _n as WireDenial, qn as Decision, yr as Subject } from "./policy-types-IRJVABmm.js";
+import { _n as WireDenial, qn as Decision, yr as Subject } from "./policy-types-D-GwfQTc.js";
 import { StandardSchemaV1 } from "@standard-schema/spec";
 //#region src/core/problem-details.d.ts
 type Disclosure = "hide" | "reveal";

package/dist/{evaluate-CsjXeLRo.js → evaluate-Czbj7thS.js}

@@ -1,7 +1,7 @@
 import { a as sole, n as isReadonlyArray, t as compact } from "./compact-CAf557ZB.js";
 import { n as freezeDeep } from "./freeze-jjan0lCv.js";
 import { n as isForbiddenKey } from "./paths-CUvURzHp.js";
-import { n as role, t as normalizeAssurance } from "./role-builder-BrmOcXch.js";
+import { n as role, t as normalizeAssurance } from "./role-builder-CMW4wWzn.js";
 import { n as PermDockValidationError } from "./validation-error-CYg2kJEw.js";
 import { t as wireDenials } from "./wire-denial-C7PaVYEM.js";
 import { o as sameId } from "./expiry-6XByK0dm.js";
@@ -17,7 +17,7 @@ import { a as authenticated, g as isRole, i as assurance, m as findRole, o as fl
 import { a as grantCoversField, i as wireValidity, t as isActive } from "./validity-Buc7w8E9.js";
 import { o as resourceRoleCondition } from "./grantee-conditions-DX4K_gGI.js";
 import { c as nowSeconds, i as matchScopedMembership, l as partitionsOf, n as inTeam, p as scopeField, r as isMembershipExpired } from "./tenancy-DvOHHk3-.js";
-import { i as grantList, n as declaredRoleNames, s as levelCondition } from "./policy-DxQyHKPB.js";
+import { i as grantList, n as declaredRoleNames, s as levelCondition } from "./policy-cV_wwPb8.js";
 import { t as requiresApproval } from "./approval-required-TzNB9oQA.js";
 import { i as rootMembershipId } from "./subject-C7RddW0G.js";
 import { a as versionOf, i as tokenPayload, n as decisionToken } from "./token-DaMnIU9O.js";

package/dist/{evaluations-BasA9zXp.d.ts → evaluations-CisTTURl.d.ts}

@@ -1,6 +1,6 @@
-import { E as Policy } from "./policy-types-IRJVABmm.js";
-import { a as PermDock } from "./permdock-DUWZEOLR.js";
-import { m as ApprovalStore } from "./types-BvBbkAu1.js";
+import { E as Policy } from "./policy-types-D-GwfQTc.js";
+import { a as PermDock } from "./permdock-ffY4CMd9.js";
+import { m as ApprovalStore } from "./types-CqcsNCaN.js";
 //#region src/server/evaluations.d.ts
 /** AuthZEN 1.0 section 7.1.2.1 `options.evaluations_semantic` values. */
 declare const EVALUATIONS_SEMANTICS: readonly ["execute_all", "deny_on_first_deny", "permit_on_first_permit"];

package/dist/{evaluations-DG40eSJa.js → evaluations-h3KoJAPa.js}

@@ -6,7 +6,7 @@ import { h as secondsAt } from "./time-nR1JesoH.js";
 import { n as resourceRef } from "./resource-ref-CaS9yVPi.js";
 import { n as readBodyText } from "./body-text-DQhcmqdY.js";
 import { f as validationProblem, l as problemResponse, n as batchTooLarge } from "./problem-BVLHFK33.js";
-import { i as readApprovalHeader, s as resumeDecision } from "./helpers-DNnZffrI.js";
+import { i as readApprovalHeader, s as resumeDecision } from "./helpers-DmqGy63f.js";
 import { t as bodyTooLarge } from "./body-CJQwYVa8.js";
 import { t as timeoutSignal } from "./timeout-D51niuQP.js";
 import { n as NO_GRANT } from "./decision-CaG5_eNJ.js";

package/dist/eve/index.d.ts

@@ -1,8 +1,8 @@
-import { E as Policy, M as PolicyVocabulary, _r as Principal } from "../policy-types-IRJVABmm.js";
+import { E as Policy, M as PolicyVocabulary, _r as Principal } from "../policy-types-D-GwfQTc.js";
 import { u as Permission } from "../permission-types-CAY-GU7e.js";
-import { a as PermDock } from "../permdock-DUWZEOLR.js";
-import { u as ApprovalRequest } from "../types-BvBbkAu1.js";
-import { o as AgentAdapterOptions, t as AgentPermDock } from "../create-bzQlBzG4.js";
+import { a as PermDock } from "../permdock-ffY4CMd9.js";
+import { u as ApprovalRequest } from "../types-CqcsNCaN.js";
+import { o as AgentAdapterOptions, t as AgentPermDock } from "../create-BzwjZuRS.js";
 //#region src/eve/create.d.ts
 /** Structural `SessionAuthContext` from `eve`. */
 type EvePrincipal = {

package/dist/eve/index.js

@@ -1,8 +1,8 @@
 import { t as compact } from "../compact-CAf557ZB.js";
-import { l as withApp } from "../permdock-DdzMv5-F.js";
+import { l as withApp } from "../permdock-D-_WrdKu.js";
 import { c as isApprovalError } from "../types-CcUXciSj.js";
-import { o as resolveApproval } from "../helpers-DNnZffrI.js";
-import { t as agentRuntime } from "../create-gqtDb1nU.js";
+import { o as resolveApproval } from "../helpers-DmqGy63f.js";
+import { t as agentRuntime } from "../create-C-tm3KIF.js";
 import { t as boundedMap } from "../lru-8q4WZjBV.js";
 //#region src/eve/create.ts
 const TOKENS_PER_PROCESS = 1e3;

package/dist/express/index.d.ts

@@ -1,8 +1,8 @@
-import { E as Policy, M as PolicyVocabulary, _r as Principal } from "../policy-types-IRJVABmm.js";
+import { E as Policy, M as PolicyVocabulary, _r as Principal } from "../policy-types-D-GwfQTc.js";
 import { u as Permission } from "../permission-types-CAY-GU7e.js";
-import { a as PermDock } from "../permdock-DUWZEOLR.js";
-import { f as InvalidSignatureError, i as OpenApiHooks, o as ProtectOptions, v as discoverViaSignatureAgent, x as webBotAuthVerifier } from "../server-types-Bw-lWqzR.js";
-import { t as ServerAdapterOptions } from "../bind-DjFNX0Pq.js";
+import { a as PermDock } from "../permdock-ffY4CMd9.js";
+import { f as InvalidSignatureError, i as OpenApiHooks, o as ProtectOptions, v as discoverViaSignatureAgent, x as webBotAuthVerifier } from "../server-types-3OnXjZ2D.js";
+import { t as ServerAdapterOptions } from "../bind-DR6ku3A9.js";
 import { i as toRequest, r as sendResponse } from "../http-B_LphE5Y.js";
 import { ErrorRequestHandler, Request, RequestHandler, Response, Router } from "express";
 //#region src/express/create.d.ts

package/dist/express/index.js

@@ -1,7 +1,7 @@
 import { r as hasCredentials } from "../http-DKLXrFGk.js";
-import { l as InvalidSignatureError, p as webBotAuthVerifier, u as discoverViaSignatureAgent } from "../evaluations-DG40eSJa.js";
-import { t as problemFromError } from "../map-error-B_f3C5cs.js";
-import { i as decorate, r as bindKernel } from "../bind-BJFeLX1V.js";
+import { l as InvalidSignatureError, p as webBotAuthVerifier, u as discoverViaSignatureAgent } from "../evaluations-h3KoJAPa.js";
+import { t as problemFromError } from "../map-error-BH16Ah8P.js";
+import { i as decorate, r as bindKernel } from "../bind-B4pMH9bm.js";
 import { n as sendResponse, r as toRequest } from "../http-DH94eh6f.js";
 import express from "express";
 //#region src/express/create.ts

package/dist/fastify/index.d.ts

@@ -1,8 +1,8 @@
-import { E as Policy, M as PolicyVocabulary, _r as Principal } from "../policy-types-IRJVABmm.js";
+import { E as Policy, M as PolicyVocabulary, _r as Principal } from "../policy-types-D-GwfQTc.js";
 import { u as Permission } from "../permission-types-CAY-GU7e.js";
-import { a as PermDock } from "../permdock-DUWZEOLR.js";
-import { f as InvalidSignatureError, i as OpenApiHooks, o as ProtectOptions, v as discoverViaSignatureAgent, x as webBotAuthVerifier } from "../server-types-Bw-lWqzR.js";
-import { t as ServerAdapterOptions } from "../bind-DjFNX0Pq.js";
+import { a as PermDock } from "../permdock-ffY4CMd9.js";
+import { f as InvalidSignatureError, i as OpenApiHooks, o as ProtectOptions, v as discoverViaSignatureAgent, x as webBotAuthVerifier } from "../server-types-3OnXjZ2D.js";
+import { t as ServerAdapterOptions } from "../bind-DR6ku3A9.js";
 import { FastifyPluginAsync, FastifyReply, FastifyRequest, FastifySchema, FastifyTypeProvider, FastifyTypeProviderDefault, RawRequestDefaultExpression, RawServerDefault, RouteGenericInterface } from "fastify";
 //#region src/server/http.d.ts
 /** A Fastify-style reply: `code`, `header` and `send`. */

package/dist/fastify/index.js

@@ -1,7 +1,7 @@
 import { c as writeReply, i as headersFrom, n as firstHeader, r as hasCredentials, t as fetchRequest } from "../http-DKLXrFGk.js";
-import { l as InvalidSignatureError, p as webBotAuthVerifier, u as discoverViaSignatureAgent } from "../evaluations-DG40eSJa.js";
-import { t as problemFromError } from "../map-error-B_f3C5cs.js";
-import { i as decorate, r as bindKernel } from "../bind-BJFeLX1V.js";
+import { l as InvalidSignatureError, p as webBotAuthVerifier, u as discoverViaSignatureAgent } from "../evaluations-h3KoJAPa.js";
+import { t as problemFromError } from "../map-error-BH16Ah8P.js";
+import { i as decorate, r as bindKernel } from "../bind-B4pMH9bm.js";
 //#region src/fastify/http.ts
 function toRequest(request) {
 	const host = firstHeader(request.headers.host) ?? "localhost";

package/dist/{fetch-adapter-BgqpOOpd.d.ts → fetch-adapter-BdmfnbJM.d.ts}

@@ -1,8 +1,8 @@
 import { u as Permission } from "./permission-types-CAY-GU7e.js";
 import { a as OperationInput, t as Operation } from "./operations-Ci_rT6Uo.js";
 import { n as RevocationFeed } from "./revocations-BaUXHM1N.js";
-import { o as ProtectOptions } from "./server-types-Bw-lWqzR.js";
-import { t as ServerAdapterOptions } from "./bind-DjFNX0Pq.js";
+import { o as ProtectOptions } from "./server-types-3OnXjZ2D.js";
+import { t as ServerAdapterOptions } from "./bind-DR6ku3A9.js";
 //#region src/server/fetch-adapter.d.ts
 /**
  * What `protect` checks: a permission, an operation from `defineOperations`, or

package/dist/{fetch-adapter-UZOW0PRC.js → fetch-adapter-DH-NJPbL.js}

@@ -2,8 +2,8 @@ import { t as compact } from "./compact-CAf557ZB.js";
 import { o as isPermission } from "./permission-registry-B8tYxPIt.js";
 import { r as hasCredentials } from "./http-DKLXrFGk.js";
 import { o as methodNotAllowed } from "./problem-BVLHFK33.js";
-import { t as problemFromError } from "./map-error-B_f3C5cs.js";
-import { i as decorate, r as bindKernel } from "./bind-BJFeLX1V.js";
+import { t as problemFromError } from "./map-error-BH16Ah8P.js";
+import { i as decorate, r as bindKernel } from "./bind-B4pMH9bm.js";
 //#region src/server/fetch-adapter.ts
 /**
 * `protect(target, data, options)(handler)` for a framework whose routes are

package/dist/{fixtures-0VTW5oNq.js → fixtures-Cemqurt8.js}

@@ -5,12 +5,18 @@ import { a as loadModule, s as pickNamed } from "./load-BaEamml-.js";
 import { existsSync } from "node:fs";
 import { resolve } from "node:path";
 //#region src/cli/fixtures.ts
+function checkChange(item, index) {
+	const after = item["after"];
+	if (!isRecord(after) || item["expected"] !== "changed" || item["action"] !== void 0 || item["table"] !== void 0 || item["stream"] !== void 0 && (typeof item["stream"] !== "string" || item["stream"].length === 0) || after["tenant"] !== void 0 && typeof after["tenant"] !== "string" || after["roles"] !== void 0 && (!Array.isArray(after["roles"]) || !after["roles"].every((name) => typeof name === "string")) || after["memberships"] !== void 0 && !Array.isArray(after["memberships"]) || after["claims"] !== void 0 && !isRecord(after["claims"])) throw configError(`PermDock CLI: fixture ${index} needs after (tenant, roles, memberships, claims) and expected "changed", without action or table`);
+}
 function asFixtures(value, followed = false) {
 	const list = Array.isArray(value) ? value : isRecord(value) && Array.isArray(value["fixtures"]) ? value["fixtures"] : void 0;
 	if (list === void 0) throw configError("PermDock CLI: fixtures must be an array or { fixtures }");
 	return list.map((item, index) => {
-		if (!isRecord(item) || !isRecord(item["subject"]) || item["row"] === void 0) throw configError(`PermDock CLI: fixture ${index} needs subject and row`);
-		if (followed && item["table"] !== void 0) {
+		const change = followed && isRecord(item) && item["after"] !== void 0;
+		if (!isRecord(item) || !isRecord(item["subject"]) || item["row"] === void 0 && !change) throw configError(`PermDock CLI: fixture ${index} needs subject and row`);
+		if (change) checkChange(item, index);
+		else if (followed && item["table"] !== void 0) {
 			if (typeof item["table"] !== "string" || item["table"].length === 0 || item["action"] !== void 0 || item["expected"] !== "granted" && item["expected"] !== "denied") throw configError(`PermDock CLI: fixture ${index} needs table and expected (granted or denied), without action`);
 		} else if (typeof item["action"] !== "string") throw new TypeError(`PermDock CLI: fixture ${index} needs action`);
 		if (typeof item["subject"]["id"] !== "string") throw new TypeError(`PermDock CLI: fixture ${index} subject needs id`);

package/dist/{gen-CNCzG4sB.js → gen-BEIN-DRM.js}

@@ -41,7 +41,7 @@ const gen = defineLeaf({
 		const out = given(flags.out);
 		const outDir = given(flags["out-dir"]);
 		const from = given(flags.policy);
-		const { runGen } = await import("./gen-DnpZwQPo.js");
+		const { runGen } = await import("./gen-mf-MRwVr.js");
 		return runGen({
 			cwd: ctx.cwd,
 			config: ctx.config,

package/dist/{gen-DnpZwQPo.js → gen-mf-MRwVr.js}

@@ -1,5 +1,5 @@
 import { r as isRecord } from "./compact-CAf557ZB.js";
-import { t as DESCRIBE_TITLES } from "./describe-CogP1loh.js";
+import { t as DESCRIBE_TITLES } from "./describe-BZAlPHxT.js";
 import { c as listPermissions } from "./permission-registry-B8tYxPIt.js";
 import { d as scopeList } from "./scopes-BSdYaGHs.js";
 import { v as listRoles } from "./grantee-Dke-9rd1.js";
@@ -7,10 +7,10 @@ import { t as byCodePoint } from "./compare-DTfyUunF.js";
 import { i as configError, n as CliError } from "./errors-BhRkoNS7.js";
 import { c as jsonSchemaOf } from "./catalog-doc-C4DGfJCO.js";
 import { c as requirePolicy } from "./load-BaEamml-.js";
-import { t as loadConfiguredOperations } from "./catalog-operations-DVI5QO5R.js";
+import { t as loadConfiguredOperations } from "./catalog-operations-BD22drQf.js";
 import { n as fileSummary, r as planFiles } from "./files-CfiRtQ-m.js";
 import { f as writeOutputFiles, r as driftOf } from "./output-files-CM0BnH05.js";
-import { t as resolveNames } from "./resolve-names-1nCei24V.js";
+import { t as resolveNames } from "./resolve-names-CBl4r4_r.js";
 import { i as schemaExpression } from "./generate-CezbCaTI.js";
 import { existsSync, readFileSync } from "node:fs";
 import { dirname, extname, relative, resolve } from "node:path";

package/dist/h3/index.d.ts

@@ -1,7 +1,7 @@
-import { $t as Snapshot, E as Policy, M as PolicyVocabulary, _r as Principal } from "../policy-types-IRJVABmm.js";
-import { a as PermDock } from "../permdock-DUWZEOLR.js";
-import { D as ConnectionOptions, T as Connection, f as InvalidSignatureError, i as OpenApiHooks, u as SnapshotQuery, v as discoverViaSignatureAgent, x as webBotAuthVerifier } from "../server-types-Bw-lWqzR.js";
-import { a as ProtectTarget, n as FetchAdapterOptions, r as FetchProtect, t as ContextReader } from "../fetch-adapter-BgqpOOpd.js";
+import { $t as Snapshot, E as Policy, M as PolicyVocabulary, _r as Principal } from "../policy-types-D-GwfQTc.js";
+import { a as PermDock } from "../permdock-ffY4CMd9.js";
+import { D as ConnectionOptions, T as Connection, f as InvalidSignatureError, i as OpenApiHooks, u as SnapshotQuery, v as discoverViaSignatureAgent, x as webBotAuthVerifier } from "../server-types-3OnXjZ2D.js";
+import { a as ProtectTarget, n as FetchAdapterOptions, r as FetchProtect, t as ContextReader } from "../fetch-adapter-BdmfnbJM.js";
 import { EventHandler, H3Event, H3EventContext, Middleware } from "h3";
 //#region src/h3/create.d.ts
 type H3PermDockOptions<TUser = unknown> = FetchAdapterOptions<H3Event, TUser>;

package/dist/h3/index.js

@@ -1,6 +1,6 @@
-import { l as InvalidSignatureError, p as webBotAuthVerifier, u as discoverViaSignatureAgent } from "../evaluations-DG40eSJa.js";
-import { i as decorate } from "../bind-BJFeLX1V.js";
-import { t as fetchAdapter } from "../fetch-adapter-UZOW0PRC.js";
+import { l as InvalidSignatureError, p as webBotAuthVerifier, u as discoverViaSignatureAgent } from "../evaluations-h3KoJAPa.js";
+import { i as decorate } from "../bind-B4pMH9bm.js";
+import { t as fetchAdapter } from "../fetch-adapter-DH-NJPbL.js";
 //#region src/h3/create.ts
 function createPermDock(policy, options) {
 	const adapter = fetchAdapter(policy, options, "h3", (event) => event.req);

package/dist/{helpers-DNnZffrI.js → helpers-DmqGy63f.js}

@@ -1,7 +1,7 @@
 import { t as compact } from "./compact-CAf557ZB.js";
 import { n as freezeDeep } from "./freeze-jjan0lCv.js";
-import { i as approverManagerKey, r as approverLeaves } from "./approvers-CNtl4Vc5.js";
-import { n as describe } from "./describe-CogP1loh.js";
+import { i as approverManagerKey, r as approverLeaves } from "./approvers-BaNwKYgd.js";
+import { n as describe } from "./describe-BZAlPHxT.js";
 import { i as getRegistry, n as findPermission } from "./permission-registry-B8tYxPIt.js";
 import { t as assertAppData } from "./app-data-UNNm07jV.js";
 import { a as durationOf, i as dateAt, u as isoAt } from "./time-nR1JesoH.js";
@@ -9,7 +9,7 @@ import { r as relationReader, t as pendingRelations } from "./relations-BxvRvDHK
 import { n as resolveRelated } from "./relation-walk-DK_gkgL7.js";
 import { n as toWireDelegation } from "./wire-delegation-Cv3W2eaM.js";
 import { i as approverRelationKey, s as ApprovalError, t as APPROVAL_HEADER } from "./types-CcUXciSj.js";
-import { n as assertApprover, u as listAllApprovals } from "./store-XgBMbfDy.js";
+import { n as assertApprover, u as listAllApprovals } from "./store-DmVqy74I.js";
 import { n as parseApprovalHeader } from "./approval-header-8QV6MU4H.js";
 //#region src/approvals/relations.ts
 const DEFAULT_PARENT_DEPTH = 16;
@@ -100,20 +100,28 @@ async function managesWithin(source, requester, approver, levels, now) {
 	}
 	return false;
 }
-/** The `manager()` approvers of `request` that `subject` satisfies. */
-async function managerFacts(request, subject, options) {
-	const approvers = request.approvers;
-	const requester = request.subject.principal?.id;
+/**
+* The `approverManagerKey`s of the `manager()` items in `items` that `approver`
+* satisfies for `requester`. A requester never manages themselves into
+* approving their own request.
+*/
+async function managerKeys(items, requester, approver, options) {
 	const source = options.relations;
-	if (approvers === void 0 || requester === void 0 || source === void 0 || subject.principal === null) return [];
-	const items = /* @__PURE__ */ new Map();
-	for (const item of requestApprovers(approvers)) if (item.kind === "manager") items.set(approverManagerKey(item), item);
-	const approver = subject.principal.id;
+	if (source === void 0 || requester === approver) return [];
+	const managers = /* @__PURE__ */ new Map();
+	for (const item of items) if (item.kind === "manager") managers.set(approverManagerKey(item), item);
 	const now = dateAt(options.now).getTime() / 1e3;
-	const entries = [...items];
+	const entries = [...managers];
 	const verdicts = await Promise.all(entries.map(([, item]) => managesWithin(source, requester, approver, item.levels ?? 1, now)));
 	return entries.flatMap(([key], index) => verdicts[index] === true ? [key] : []);
 }
+/** The `manager()` approvers of `request` that `subject` satisfies. */
+function managerFacts(request, subject, options) {
+	const approvers = request.approvers;
+	const requester = request.subject.principal?.id;
+	if (approvers === void 0 || requester === void 0 || subject.principal === null) return [];
+	return managerKeys(requestApprovers(approvers), requester, subject.principal.id, options);
+}
 /**
 * The relation and `manager()` approvers of `request` that `subject` holds,
 * keyed by `approverRelationKey` and `approverManagerKey`, for
@@ -502,4 +510,4 @@ async function storedApprovalToken(store, decision, options = {}) {
 	}
 }
 //#endregion
-export { requestApproval as a, resumeFromHeader as c, vouchApproval as d, approverPermissions as f, readApprovalHeader as i, storedApprovalToken as l, approverRelations as m, consumeApproval as n, resolveApproval as o, heldPermissions as p, inspectApproval as r, resumeDecision as s, cancelApprovals as t, summarizeSubject as u };
+export { requestApproval as a, resumeFromHeader as c, vouchApproval as d, approverPermissions as f, managerKeys as h, readApprovalHeader as i, storedApprovalToken as l, approverRelations as m, consumeApproval as n, resolveApproval as o, heldPermissions as p, inspectApproval as r, resumeDecision as s, cancelApprovals as t, summarizeSubject as u };

package/dist/hono/index.d.ts

@@ -1,9 +1,9 @@
-import { E as Policy, M as PolicyVocabulary, _r as Principal } from "../policy-types-IRJVABmm.js";
+import { E as Policy, M as PolicyVocabulary, _r as Principal } from "../policy-types-D-GwfQTc.js";
 import { u as Permission } from "../permission-types-CAY-GU7e.js";
-import { a as PermDock } from "../permdock-DUWZEOLR.js";
+import { a as PermDock } from "../permdock-ffY4CMd9.js";
 import { n as RevocationFeed } from "../revocations-BaUXHM1N.js";
-import { D as ConnectionOptions, T as Connection, f as InvalidSignatureError, i as OpenApiHooks, o as ProtectOptions, v as discoverViaSignatureAgent, x as webBotAuthVerifier } from "../server-types-Bw-lWqzR.js";
-import { t as ServerAdapterOptions } from "../bind-DjFNX0Pq.js";
+import { D as ConnectionOptions, T as Connection, f as InvalidSignatureError, i as OpenApiHooks, o as ProtectOptions, v as discoverViaSignatureAgent, x as webBotAuthVerifier } from "../server-types-3OnXjZ2D.js";
+import { t as ServerAdapterOptions } from "../bind-DR6ku3A9.js";
 import { Context, Hono, MiddlewareHandler } from "hono";
 import { SSEMessage, SSEStreamingApi } from "hono/streaming";
 import { WSEvents } from "hono/ws";

package/dist/hono/index.js

@@ -1,8 +1,8 @@
 import { t as compact } from "../compact-CAf557ZB.js";
 import { r as PermDockRevokedError } from "../errors-B6R_lg2a.js";
-import { l as InvalidSignatureError, p as webBotAuthVerifier, u as discoverViaSignatureAgent } from "../evaluations-DG40eSJa.js";
-import { t as problemFromError } from "../map-error-B_f3C5cs.js";
-import { r as bindKernel } from "../bind-BJFeLX1V.js";
+import { l as InvalidSignatureError, p as webBotAuthVerifier, u as discoverViaSignatureAgent } from "../evaluations-h3KoJAPa.js";
+import { t as problemFromError } from "../map-error-BH16Ah8P.js";
+import { r as bindKernel } from "../bind-B4pMH9bm.js";
 import { a as onRevoked, n as closeReason, r as guardIterable, t as POLICY_VIOLATION } from "../stream-CDvF0sJm.js";
 import { Hono } from "hono";
 //#region src/hono/create.ts

package/dist/{hosted-DxRLLiFU.d.ts → hosted-BFNXwcjd.d.ts}

@@ -1,4 +1,4 @@
-import { E as Policy, Pn as Grantee, o as ApprovalRequirement, wr as Condition } from "./policy-types-IRJVABmm.js";
+import { E as Policy, Pn as Grantee, o as ApprovalRequirement, wr as Condition } from "./policy-types-D-GwfQTc.js";
 //#region src/core/hosted.d.ts
 /**
  * One grant authored in PermDock Cloud; its grantee is a declared role, plan or

package/dist/{hosted-tPZnyjQS.js → hosted-waouw2V-.js}

@@ -1,14 +1,14 @@
 import { r as isRecord, t as compact } from "./compact-CAf557ZB.js";
 import { n as freezeDeep } from "./freeze-jjan0lCv.js";
 import { n as isForbiddenKey, s as splitPath } from "./paths-CUvURzHp.js";
-import { a as deny, i as completeGrant, l as normalizeWhere, n as role, r as allow } from "./role-builder-BrmOcXch.js";
+import { a as deny, i as completeGrant, l as normalizeWhere, n as role, r as allow } from "./role-builder-CMW4wWzn.js";
 import { a as getResource, n as findPermission } from "./permission-registry-B8tYxPIt.js";
 import { d as isSelfParented } from "./resource-relations-8-pCScBO.js";
 import { a as durationOf, l as isRfc3339, m as rfc3339 } from "./time-nR1JesoH.js";
 import { r as sha256Digest } from "./sha256-C-4WXKIu.js";
 import { _ as listPlans, m as findRole, o as flattenGrantee } from "./grantee-Dke-9rd1.js";
-import { o as readWireApproval } from "./approval-normalize-4KxMRdJC.js";
-import { a as indexPolicy, n as declaredRoleNames } from "./policy-DxQyHKPB.js";
+import { o as readWireApproval } from "./approval-normalize-CUjgSsOl.js";
+import { a as indexPolicy, n as declaredRoleNames } from "./policy-cV_wwPb8.js";
 //#region src/core/hosted.ts
 function memoryPolicySource(document = null) {
 	const current = document === null ? null : parsePolicyDocument(document);

package/dist/{import-BYVbSKx0.js → import-DObwEota.js}

@@ -4,7 +4,7 @@ import { i as readJsonFile } from "./files-BSjrtIHw.js";
 import { t as applyFiles } from "./files-CfiRtQ-m.js";
 import { n as httpRequest } from "./http-DhMWeB_h.js";
 import { i as schemaExpression, t as emitPermissionsModule } from "./generate-CezbCaTI.js";
-import { t as validateOpenapi } from "./schema-9_NDz8fx.js";
+import { t as validateOpenapi } from "./schema-B_9tXrbG.js";
 import { existsSync, readFileSync } from "node:fs";
 import { resolve } from "node:path";
 //#region ../../node_modules/.pnpm/yaml@2.9.1/node_modules/yaml/browser/dist/nodes/identity.js

package/dist/{index-z44pfWar.d.ts → index-BhnOOnp9.d.ts}

@@ -1,5 +1,5 @@
-import { E as Policy, _r as Principal, gt as TokenSigner } from "./policy-types-IRJVABmm.js";
-import { E as SsfPermDockOptions, O as SsfStreamConfiguration, T as SsfPermDock, _ as SetSubject, c as PushSetOptions, d as SetDelivery, g as SetQueue, h as SetPollHandlerOptions, k as SsfStreamStatus, m as SetEvent, p as SetError, t as CaepCommon, v as SignSetOptions } from "./types-CJC1aaoJ.js";
+import { E as Policy, _r as Principal, gt as TokenSigner } from "./policy-types-D-GwfQTc.js";
+import { E as SsfPermDockOptions, O as SsfStreamConfiguration, T as SsfPermDock, _ as SetSubject, c as PushSetOptions, d as SetDelivery, g as SetQueue, h as SetPollHandlerOptions, k as SsfStreamStatus, m as SetEvent, p as SetError, t as CaepCommon, v as SignSetOptions } from "./types-Ck1KOfug.js";
 //#region src/ssf/create.d.ts
 declare function createPermDock<TUser, TPrincipal extends Principal = Principal>(policy: Policy<TUser, TPrincipal>, options: SsfPermDockOptions): SsfPermDock;
 //#endregion