permdock 0.5.0 → 0.6.0

package/dist/{evaluate-_R8QkWaf.js → evaluate-CNClBvcj.js}

@@ -1,7 +1,7 @@
 import { a as sole, n as isReadonlyArray, t as compact } from "./compact-CAf557ZB.js";
 import { n as freezeDeep } from "./freeze-CrU8nQeX.js";
 import { n as isForbiddenKey } from "./paths-DXSHAMIa.js";
-import { n as role, t as normalizeAssurance } from "./role-builder-CXbis5-X.js";
+import { n as role, t as normalizeAssurance } from "./role-builder-uWQZ4v84.js";
 import { n as PermDockValidationError } from "./validation-error-ZfUHbKvf.js";
 import { t as wireDenials } from "./wire-denial-C7PaVYEM.js";
 import { o as sameId } from "./expiry-D4_YKRKD.js";
@@ -12,18 +12,18 @@ import { i as readAppData } from "./app-data-MuyzVqX8.js";
 import { a as durationOf, d as isoNow, o as epochSeconds, r as assertDuration, s as instantAt, t as INVALID_NOW } from "./time-DkWjdL98.js";
 import { t as canonicalJson } from "./canonical-json-BC8_nMTw.js";
 import { a as normalizeMemberships, d as scopeList, f as subjectForPermission, i as keepsPermission, m as tenantOf, o as resolveScope, s as rootMembershipId } from "./scopes-CUPSjo9q.js";
-import { a as readOnlyActorRefuses, c as rowIdOf, i as delegatedPermissions, l as rowValues, n as coveredByDelegation, o as requiresStandIn, r as coversRequirements, s as isRowPair, u as evaluateCondition } from "./delegation-DaXVdDhM.js";
-import { a as authenticated, g as isRole, i as assurance, m as findRole, o as flattenGrantee, r as asGrantee } from "./grantee-Cn1HyUsI.js";
+import { a as readOnlyActorRefuses, c as rowIdOf, i as delegatedPermissions, l as rowValues, n as coveredByDelegation, o as requiresStandIn, r as coversRequirements, s as isRowPair, u as evaluateCondition } from "./delegation-j6-rc37o.js";
+import { a as authenticated, g as isRole, i as assurance, m as findRole, o as flattenGrantee, r as asGrantee } from "./grantee-hxrUsbpM.js";
 import { a as grantCoversField, i as wireValidity, t as isActive } from "./validity-CZ7-y0Cj.js";
 import { o as resourceRoleCondition } from "./grantee-conditions-CcXf8hMM.js";
 import { c as nowSeconds, i as matchScopedMembership, l as partitionsOf, n as inTeam, p as scopeField, r as isMembershipExpired } from "./tenancy-DN2QAx9z.js";
-import { a as levelCondition, r as grantList, t as declaredRoleNames } from "./policy-DLZJ5gAp.js";
+import { a as levelCondition, r as grantList, t as declaredRoleNames } from "./policy-DbM5YYtV.js";
 import { t as requiresApproval } from "./approval-required-TzNB9oQA.js";
 import { i as versionOf, r as tokenPayload, t as decisionToken } from "./token-BLZcjQgt.js";
 import { n as resolveRelated } from "./relation-walk-3OyDBF0S.js";
 import { t as eventInstant } from "./event-time-CsegxXxB.js";
 import { n as toWireDelegation } from "./wire-delegation-Cv3W2eaM.js";
-import { n as matchGrantee, t as combineWhere } from "./grantee-match-DHArqY82.js";
+import { n as matchGrantee, t as combineWhere } from "./grantee-match-DbENBHLB.js";
 import { t as resourceIdOf } from "./resource-ref-CaS9yVPi.js";
 //#region src/core/approval-state.ts
 /** The denial detail when an `ApprovalPolicySource` threw or returned an invalid entry. */
@@ -715,7 +715,7 @@ function leveled(grant, level, condition) {
 * the policy does not declare it; such a role resolves to nothing.
 */
 function customRoleScope(role, scopes) {
-	if (role.scope === "global") return "global";
+	if (role.scope === "global") return role.shared === true ? void 0 : "global";
 	if (role.scope !== void 0) return resolveScope(scopes, role.scope);
 	return resolveScope(scopes, role.team === void 0 ? "tenant" : "team");
 }
@@ -727,6 +727,10 @@ function customRoleId(role) {
 function isGlobalCustomRole(role) {
 	return role.scope === "global";
 }
+/** A shared custom role: defined once for every tenant, held on memberships of its scope in any tenant. */
+function isSharedCustomRole(role) {
+	return role.shared === true;
+}
 function isCeilingScope(scope) {
 	return typeof scope === "string";
 }
@@ -929,7 +933,16 @@ function resolveCustomRole(policy, role) {
 		renamed
 	});
 }
-function validateCustomRole(policy, role) {
+function validateCustomRole(policy, role, options = {}) {
+	if (!isSharedCustomRole(role) && !isGlobalCustomRole(role) && (options.shared ?? []).some((item) => wellFormed(item) && isSharedCustomRole(item) && item.name === role.name)) return freezeDeep({
+		ok: false,
+		permissions: [],
+		dropped: [{
+			role: role.name,
+			reason: "name-taken"
+		}],
+		renamed: []
+	});
 	const resolved = resolveCustomRole(policy, role);
 	const permissions = [...new Set(resolved.grants.filter((grant) => grant.effect === "allow").map((grant) => grant.permission.key))].toSorted();
 	return freezeDeep({
@@ -941,15 +954,25 @@ function validateCustomRole(policy, role) {
 }
 function wellFormed(role) {
 	if (role === null || typeof role !== "object" || typeof role.name !== "string") return false;
+	if (role.shared !== void 0) return role.shared === true && role.tenant === void 0 && role.team === void 0 && role.id === void 0 && (role.scope === void 0 || typeof role.scope === "string" && role.scope !== "global");
 	if (role.scope === "global") return role.tenant === void 0 && role.team === void 0 && role.id === void 0;
 	return typeof role.tenant === "string" && (role.team === void 0 || typeof role.team === "string") && (role.scope === void 0 || typeof role.scope === "string") && (role.id === void 0 || typeof role.id === "string");
 }
+/**
+* The well-formed roles, without a tenant role that a shared role of the same
+* name shadows: the shared role is the one every tenant sees.
+*/
+function effectiveCustomRoles(roles) {
+	const formed = roles.filter(wellFormed);
+	const shared = new Set(formed.filter(isSharedCustomRole).map((role) => role.name));
+	return shared.size === 0 ? formed : formed.filter((role) => isSharedCustomRole(role) || isGlobalCustomRole(role) || !shared.has(role.name));
+}
 /** Every custom role's resolved grants, once per instance. Malformed roles resolve to nothing. */
 function customGrantsFor(policy, roles) {
 	const declared = declaredRoleNames(policy);
 	const out = [];
-	for (const role of roles) {
-		if (!wellFormed(role) || declared.has(role.name)) continue;
+	for (const role of effectiveCustomRoles(roles)) {
+		if (declared.has(role.name)) continue;
 		for (const grant of resolveCustomRole(policy, role).grants) out.push({
 			grant,
 			role
@@ -957,25 +980,37 @@ function customGrantsFor(policy, roles) {
 	}
 	return out;
 }
-/** The well-formed tenant (not platform) custom roles; a declared role name is never one. */
+/**
+* The well-formed custom roles held on memberships: tenant and shared, not
+* platform. A declared role name is never one, and a shared role shadows a
+* tenant role of the same name.
+*/
 function tenantCustomRoles(policy, roles) {
 	const declared = declaredRoleNames(policy);
-	return roles.filter((role) => wellFormed(role) && !isGlobalCustomRole(role) && !declared.has(role.name));
+	return effectiveCustomRoles(roles).filter((role) => !isGlobalCustomRole(role) && !declared.has(role.name));
+}
+/** Whether a custom role held on memberships belongs to `tenant`: its own, or shared by every tenant. */
+function customRoleOf(role, tenant) {
+	return isSharedCustomRole(role) || sameId(role.tenant, tenant);
 }
-/** A membership at the role's scope, inside its tenant (and instance, when pinned), naming it. */
+/**
+* A membership at the role's scope, inside its tenant (and instance, when
+* pinned), naming it. A shared role is held at its scope in any tenant.
+*/
 function holdsCustomRole(membership, role, scopes) {
-	if (isGlobalCustomRole(role)) return false;
+	if (isGlobalCustomRole(role) || !wellFormed(role)) return false;
 	const scope = customRoleScope(role, scopes);
 	const id = customRoleId(role);
-	return scope !== void 0 && membership.scope === scope && sameId(tenantOf(membership, scopes), role.tenant) && (id === void 0 || sameId(membership.id, id)) && membership.roles.includes(role.name);
+	const tenant = tenantOf(membership, scopes);
+	return scope !== void 0 && membership.scope === scope && (isSharedCustomRole(role) ? tenant !== void 0 : sameId(tenant, role.tenant)) && (id === void 0 || sameId(membership.id, id)) && membership.roles.includes(role.name);
 }
 /** Whether `principal.roles` names the platform custom role. */
 function holdsGlobalCustomRole(roles, role) {
 	return isGlobalCustomRole(role) && (roles ?? []).includes(role.name);
 }
-/** A tenant's custom role inside that tenant, or a platform custom role anywhere. */
+/** A tenant's custom role inside that tenant, a shared role in any tenant, or a platform custom role anywhere. */
 function isCustomRoleName(name, roles, tenant) {
-	return roles.some((item) => wellFormed(item) && item.name === name && (isGlobalCustomRole(item) || tenant !== void 0 && sameId(item.tenant, tenant)));
+	return effectiveCustomRoles(roles).some((item) => item.name === name && (isGlobalCustomRole(item) || tenant !== void 0 && customRoleOf(item, tenant)));
 }
 /**
 * The compact JWT form of custom roles for the `memberships[].grants` claim
@@ -1010,8 +1045,9 @@ function customRoleClaim(roles, policy) {
 */
 function membershipsClaim(memberships, customRoles, scopes) {
 	const claim = [];
+	const effective = effectiveCustomRoles(customRoles);
 	for (const membership of normalizeMemberships(memberships, scopes)) {
-		const held = customRoles.filter((role) => wellFormed(role) && holdsCustomRole(membership, role, scopes));
+		const held = effective.filter((role) => holdsCustomRole(membership, role, scopes));
 		claim.push(held.length === 0 ? membership : Object.assign({}, membership, { grants: customRoleClaim(held) }));
 	}
 	return claim;
@@ -1030,6 +1066,12 @@ function isGlobalRole(value) {
 function onlyGlobal(roles) {
 	return Array.isArray(roles) ? roles.filter(isGlobalRole) : [];
 }
+function isSharedRole(value) {
+	return value !== null && typeof value === "object" && Reflect.get(value, "shared") === true;
+}
+function onlyShared(roles) {
+	return Array.isArray(roles) ? roles.filter(isSharedRole) : [];
+}
 /** The `customRoles` option as a source: a factory is called with the resolved subject, and a throw reads none. */
 function roleSourceFor(option, subject, auth) {
 	if (typeof option !== "function") return option;
@@ -1056,16 +1098,27 @@ function customRolesFor(source, tenants, auth, globalHeld, heldIn) {
 		});
 		loaded.push([]);
 	}
-	if (globalHeld !== void 0 && source.globalRoles !== void 0) try {
-		const roles = source.globalRoles({ held: globalHeld });
-		loaded.push(isThenable(roles) ? roles.then(onlyGlobal) : onlyGlobal(roles));
-	} catch {
-		auth.push({
-			reason: "source-threw",
-			source: "customRoles",
-			...sourceName(source)
-		});
-		loaded.push([]);
+	const once = (read, keep) => {
+		try {
+			const roles = read();
+			loaded.push(isThenable(roles) ? roles.then(keep) : keep(roles));
+		} catch {
+			auth.push({
+				reason: "source-threw",
+				source: "customRoles",
+				...sourceName(source)
+			});
+			loaded.push([]);
+		}
+	};
+	if (globalHeld !== void 0 && source.globalRoles !== void 0) {
+		const read = source.globalRoles.bind(source);
+		once(() => read({ held: globalHeld }), onlyGlobal);
+	}
+	if (tenants.length > 0 && source.sharedRoles !== void 0) {
+		const read = source.sharedRoles.bind(source);
+		const held = [...new Set(tenants.flatMap((tenant) => heldIn(tenant)))];
+		once(() => read({ held }), onlyShared);
 	}
 	if (loaded.some((item) => isThenable(item))) return Promise.all(loaded.map((item) => Promise.resolve(item).catch(() => {
 		auth.push({
@@ -1729,4 +1782,4 @@ function evaluate(policy, given, permission, data, options, env) {
 	return allowedDecision(state, chosen.allow, chosen.approval, chosen.quota);
 }
 //#endregion
-export { isContact as A, emptyListeners as C, supportAccess as D, breakGlass as E, contactMayUse as O, emitSafe as S, activate as T, membershipsClaim as _, expandRoleNames as a, tenantCustomRoles as b, andWhere as c, customRoleClaim as d, customRoleId as f, leveled as g, holdsGlobalCustomRole as h, customRolesFor as i, APPROVAL_POLICY_UNAVAILABLE as j, contactMemberships as k, ceilingGrants as l, holdsCustomRole as m, requirementCondition as n, roleSourceFor as o, customRoleScope as p, assignableNamesFor as r, sourceName as s, evaluate as t, customGrantsFor as u, resolveCustomRole as v, finish as w, validateCustomRole as x, roleAllowKeys as y };
+export { contactMayUse as A, validateCustomRole as C, activate as D, finish as E, isContact as M, APPROVAL_POLICY_UNAVAILABLE as N, breakGlass as O, tenantCustomRoles as S, emptyListeners as T, isSharedCustomRole as _, expandRoleNames as a, resolveCustomRole as b, andWhere as c, customRoleClaim as d, customRoleId as f, holdsGlobalCustomRole as g, holdsCustomRole as h, customRolesFor as i, contactMemberships as j, supportAccess as k, ceilingGrants as l, customRoleScope as m, requirementCondition as n, roleSourceFor as o, customRoleOf as p, assignableNamesFor as r, sourceName as s, evaluate as t, customGrantsFor as u, leveled as v, emitSafe as w, roleAllowKeys as x, membershipsClaim as y };

package/dist/{evaluations-16UqqQ6W.d.ts → evaluations-C_1vdSZc.d.ts}

@@ -1,6 +1,6 @@
-import { T as Policy } from "./policy-types-DzwivBgR.js";
-import { r as PermDock } from "./permdock-D7eeLJER.js";
-import { m as ApprovalStore } from "./types-CCpc2Dcv.js";
+import { T as Policy } from "./policy-types-n0uRTsW8.js";
+import { r as PermDock } from "./permdock-SV8ZINYT.js";
+import { m as ApprovalStore } from "./types-BdtSDbBO.js";
 //#region src/server/evaluations.d.ts
 /** AuthZEN 1.0 section 7.1.2.1 `options.evaluations_semantic` values. */
 declare const EVALUATIONS_SEMANTICS: readonly ["execute_all", "deny_on_first_deny", "permit_on_first_permit"];

package/dist/{evaluations-DZ2CbV5k.js → evaluations-beAooV0n.js}

@@ -6,7 +6,7 @@ import { h as secondsAt } from "./time-DkWjdL98.js";
 import { n as resourceRef } from "./resource-ref-CaS9yVPi.js";
 import { n as readBodyText } from "./body-text-QcXok_SI.js";
 import { c as problemResponse, d as validationProblem, n as batchTooLarge } from "./problem-CTviyH5L.js";
-import { i as readApprovalHeader, s as resumeDecision } from "./helpers-DTcZOzhF.js";
+import { i as readApprovalHeader, s as resumeDecision } from "./helpers-CBYVMjwh.js";
 import { t as bodyTooLarge } from "./body-CH5of8Ne.js";
 import { t as timeoutSignal } from "./timeout-D51niuQP.js";
 //#region src/core/decision.ts

package/dist/eve/index.d.ts

@@ -1,8 +1,8 @@
-import { T as Policy, j as PolicyVocabulary, rr as Principal } from "../policy-types-DzwivBgR.js";
-import { w as Permission } from "../vocabulary-D6lPdb4Z.js";
-import { r as PermDock } from "../permdock-D7eeLJER.js";
-import { u as ApprovalRequest } from "../types-CCpc2Dcv.js";
-import { o as AgentAdapterOptions, t as AgentPermDock } from "../create-BDS7wc3y.js";
+import { T as Policy, j as PolicyVocabulary, rr as Principal } from "../policy-types-n0uRTsW8.js";
+import { w as Permission } from "../vocabulary-CN8H_9UF.js";
+import { r as PermDock } from "../permdock-SV8ZINYT.js";
+import { u as ApprovalRequest } from "../types-BdtSDbBO.js";
+import { o as AgentAdapterOptions, t as AgentPermDock } from "../create-CBMmFie-.js";
 //#region src/eve/create.d.ts
 /** Structural `SessionAuthContext` from `eve`. */
 type EvePrincipal = {

package/dist/eve/index.js

@@ -1,8 +1,8 @@
 import { t as compact } from "../compact-CAf557ZB.js";
-import { c as withApp } from "../permdock-B9JxkBwC.js";
+import { c as withApp } from "../permdock-BrAscV28.js";
 import { c as isApprovalError } from "../types-DqzsnlSA.js";
-import { o as resolveApproval } from "../helpers-DTcZOzhF.js";
-import { t as agentRuntime } from "../create-C3b4B5eF.js";
+import { o as resolveApproval } from "../helpers-CBYVMjwh.js";
+import { t as agentRuntime } from "../create-CGm28gyI.js";
 import { t as boundedMap } from "../lru-8q4WZjBV.js";
 //#region src/eve/create.ts
 const TOKENS_PER_PROCESS = 1e3;

package/dist/express/index.d.ts

@@ -1,8 +1,8 @@
-import { T as Policy, j as PolicyVocabulary, rr as Principal } from "../policy-types-DzwivBgR.js";
-import { w as Permission } from "../vocabulary-D6lPdb4Z.js";
-import { r as PermDock } from "../permdock-D7eeLJER.js";
-import { f as InvalidSignatureError, i as OpenApiHooks, o as ProtectOptions, v as discoverViaSignatureAgent, x as webBotAuthVerifier } from "../server-types-BLd4MnBX.js";
-import { t as ServerAdapterOptions } from "../bind--9EFVYWF.js";
+import { T as Policy, j as PolicyVocabulary, rr as Principal } from "../policy-types-n0uRTsW8.js";
+import { w as Permission } from "../vocabulary-CN8H_9UF.js";
+import { r as PermDock } from "../permdock-SV8ZINYT.js";
+import { f as InvalidSignatureError, i as OpenApiHooks, o as ProtectOptions, v as discoverViaSignatureAgent, x as webBotAuthVerifier } from "../server-types-CKQiCnON.js";
+import { t as ServerAdapterOptions } from "../bind-DOyrv6zi.js";
 import { i as toRequest, r as sendResponse } from "../http-B_LphE5Y.js";
 import { ErrorRequestHandler, Request, RequestHandler, Response, Router } from "express";
 //#region src/express/create.d.ts

package/dist/express/index.js

@@ -1,7 +1,7 @@
 import { r as hasCredentials } from "../http-BBoKefeS.js";
-import { d as discoverViaSignatureAgent, m as webBotAuthVerifier, u as InvalidSignatureError } from "../evaluations-DZ2CbV5k.js";
-import { t as problemFromError } from "../map-error-TCAdw-eW.js";
-import { i as decorate, r as bindKernel } from "../bind-CZzhx-Vj.js";
+import { d as discoverViaSignatureAgent, m as webBotAuthVerifier, u as InvalidSignatureError } from "../evaluations-beAooV0n.js";
+import { t as problemFromError } from "../map-error-Dr70oA_3.js";
+import { i as decorate, r as bindKernel } from "../bind-CAvgUuKs.js";
 import { n as sendResponse, r as toRequest } from "../http-ujKm0JXE.js";
 import express from "express";
 //#region src/express/create.ts

package/dist/fastify/index.d.ts

@@ -1,8 +1,8 @@
-import { T as Policy, j as PolicyVocabulary, rr as Principal } from "../policy-types-DzwivBgR.js";
-import { w as Permission } from "../vocabulary-D6lPdb4Z.js";
-import { r as PermDock } from "../permdock-D7eeLJER.js";
-import { f as InvalidSignatureError, i as OpenApiHooks, o as ProtectOptions, v as discoverViaSignatureAgent, x as webBotAuthVerifier } from "../server-types-BLd4MnBX.js";
-import { t as ServerAdapterOptions } from "../bind--9EFVYWF.js";
+import { T as Policy, j as PolicyVocabulary, rr as Principal } from "../policy-types-n0uRTsW8.js";
+import { w as Permission } from "../vocabulary-CN8H_9UF.js";
+import { r as PermDock } from "../permdock-SV8ZINYT.js";
+import { f as InvalidSignatureError, i as OpenApiHooks, o as ProtectOptions, v as discoverViaSignatureAgent, x as webBotAuthVerifier } from "../server-types-CKQiCnON.js";
+import { t as ServerAdapterOptions } from "../bind-DOyrv6zi.js";
 import { FastifyPluginAsync, FastifyReply, FastifyRequest, FastifySchema, FastifyTypeProvider, FastifyTypeProviderDefault, RawRequestDefaultExpression, RawServerDefault, RouteGenericInterface } from "fastify";
 //#region src/server/http.d.ts
 /** A Fastify-style reply: `code`, `header` and `send`. */

package/dist/fastify/index.js

@@ -1,7 +1,7 @@
 import { c as writeReply, i as headersFrom, n as firstHeader, r as hasCredentials, t as fetchRequest } from "../http-BBoKefeS.js";
-import { d as discoverViaSignatureAgent, m as webBotAuthVerifier, u as InvalidSignatureError } from "../evaluations-DZ2CbV5k.js";
-import { t as problemFromError } from "../map-error-TCAdw-eW.js";
-import { i as decorate, r as bindKernel } from "../bind-CZzhx-Vj.js";
+import { d as discoverViaSignatureAgent, m as webBotAuthVerifier, u as InvalidSignatureError } from "../evaluations-beAooV0n.js";
+import { t as problemFromError } from "../map-error-Dr70oA_3.js";
+import { i as decorate, r as bindKernel } from "../bind-CAvgUuKs.js";
 //#region src/fastify/http.ts
 function toRequest(request) {
 	const host = firstHeader(request.headers.host) ?? "localhost";

package/dist/{fetch-adapter-g0ypLkID.js → fetch-adapter-DD_gfmrC.js}

@@ -2,8 +2,8 @@ import { t as compact } from "./compact-CAf557ZB.js";
 import { o as isPermission } from "./permission-registry-Br4jSNVi.js";
 import { r as hasCredentials } from "./http-BBoKefeS.js";
 import { a as methodNotAllowed } from "./problem-CTviyH5L.js";
-import { t as problemFromError } from "./map-error-TCAdw-eW.js";
-import { i as decorate, r as bindKernel } from "./bind-CZzhx-Vj.js";
+import { t as problemFromError } from "./map-error-Dr70oA_3.js";
+import { i as decorate, r as bindKernel } from "./bind-CAvgUuKs.js";
 //#region src/server/fetch-adapter.ts
 /**
 * `protect(target, data, options)(handler)` for a framework whose routes are

package/dist/{fetch-adapter-qKJBuRqy.d.ts → fetch-adapter-Dw0MTS3D.d.ts}

@@ -1,8 +1,8 @@
-import { w as Permission } from "./vocabulary-D6lPdb4Z.js";
-import { a as OperationInput, t as Operation } from "./operations-CxybZErY.js";
+import { w as Permission } from "./vocabulary-CN8H_9UF.js";
+import { a as OperationInput, t as Operation } from "./operations-X0VM7F3m.js";
 import { n as RevocationFeed } from "./revocations-R07lFBnX.js";
-import { o as ProtectOptions } from "./server-types-BLd4MnBX.js";
-import { t as ServerAdapterOptions } from "./bind--9EFVYWF.js";
+import { o as ProtectOptions } from "./server-types-CKQiCnON.js";
+import { t as ServerAdapterOptions } from "./bind-DOyrv6zi.js";
 //#region src/server/fetch-adapter.d.ts
 /** What `protect` checks: a permission, an operation from `defineOperations`, or `null` for a route that needs only OAuth scopes. */
 type ProtectTarget = Permission | Operation | null;

package/dist/{fields-D9tPVUUS.js → fields-OYG_JR78.js}

@@ -1,7 +1,7 @@
 import { i as configError } from "./errors-CWTY6uih.js";
-import { s as jsonSchemaOf } from "./catalog-doc-C9wjsfNY.js";
-import { F as quoteQualified, N as quoteIdent, P as quoteLiteral, j as helperSchema, s as signedIn } from "./shared-CD11nBbC.js";
-import { c as branchClauses, i as orSql, s as andSql, u as wrapSql } from "./policies-CO1oOymN.js";
+import { s as jsonSchemaOf } from "./catalog-doc-Cdn7-0pQ.js";
+import { F as quoteQualified, N as quoteIdent, P as quoteLiteral, j as helperSchema, s as signedIn } from "./shared-BAK8t4Uo.js";
+import { c as branchClauses, i as orSql, s as andSql, u as wrapSql } from "./policies-DP2nqRoF.js";
 //#region src/cli/rls/fields.ts
 /** Names of the field-view objects. Part of the SQL contract. */
 const FIELD_VIEWS = {

package/dist/{from-snapshot-D2lZt4Dd.js → from-snapshot-CTCMsFZk.js}

@@ -5,16 +5,16 @@ import { o as sameId } from "./expiry-D4_YKRKD.js";
 import { c as listPermissions } from "./permission-registry-Br4jSNVi.js";
 import { g as secondsOf, o as epochSeconds, t as INVALID_NOW } from "./time-DkWjdL98.js";
 import { a as normalizeMemberships, d as scopeList, m as tenantOf, o as resolveScope, t as activeFor } from "./scopes-CUPSjo9q.js";
-import { a as readOnlyActorRefuses, c as rowIdOf, l as rowValues, n as coveredByDelegation, u as evaluateCondition } from "./delegation-DaXVdDhM.js";
-import { b as synthesiseRole, m as findRole, v as listRoles } from "./grantee-Cn1HyUsI.js";
+import { a as readOnlyActorRefuses, c as rowIdOf, l as rowValues, n as coveredByDelegation, u as evaluateCondition } from "./delegation-j6-rc37o.js";
+import { b as synthesiseRole, m as findRole, v as listRoles } from "./grantee-hxrUsbpM.js";
 import { a as grantCoversField, o as pickVisible, r as readWireValidity, t as isActive } from "./validity-CZ7-y0Cj.js";
 import { c as nowSeconds, d as resolveActiveTenant, f as rowInScope, n as inTeam, r as isMembershipExpired, s as nestedAppliesWithoutRow } from "./tenancy-DN2QAx9z.js";
 import { t as requiresApproval } from "./approval-required-TzNB9oQA.js";
 import { r as tokenPayload, t as decisionToken } from "./token-BLZcjQgt.js";
 import { t as fromWireDelegation } from "./wire-delegation-Cv3W2eaM.js";
-import { n as matchGrantee } from "./grantee-match-DHArqY82.js";
+import { n as matchGrantee } from "./grantee-match-DbENBHLB.js";
 import { t as resourceIdOf } from "./resource-ref-CaS9yVPi.js";
-import { a as deniedFor, n as mayUse, o as signSnapshot, r as permittedIds, t as whereFromGrants } from "./where-scope-Dv-WTP-w.js";
+import { a as deniedFor, n as mayUse, o as signSnapshot, r as permittedIds, t as whereFromGrants } from "./where-scope-C9vfEphl.js";
 //#region src/core/snapshot-evaluate.ts
 function coveredByInclude(snapshot, permission) {
 	const include = snapshot.include;

package/dist/{grantee-Cn1HyUsI.js → grantee-hxrUsbpM.js}

@@ -133,11 +133,10 @@ function synthesiseRole(key, options) {
 	const on = options?.on;
 	const assignable = options?.assignable ?? false;
 	const meta = options?.meta;
-	if (on === void 0) return makeRole(key, meta === void 0 ? { assignable } : {
+	const leaf = on === void 0 ? makeRole(key, meta === void 0 ? { assignable } : {
 		assignable,
 		meta
-	});
-	return makeRole(key, meta === void 0 ? {
+	}) : makeRole(key, meta === void 0 ? {
 		on,
 		assignable
 	} : {
@@ -145,6 +144,17 @@ function synthesiseRole(key, options) {
 		assignable,
 		meta
 	});
+	if (options?.shared !== true) return leaf;
+	const shared = Object.defineProperty({
+		...leaf,
+		shared: true
+	}, "kind", {
+		value: ROLE_KIND,
+		enumerable: false,
+		writable: false,
+		configurable: false
+	});
+	return Object.freeze(shared);
 }
 function isGrantee(value) {
 	return value !== null && typeof value === "object" && "kind" in value && typeof value.kind === "string";

package/dist/{grantee-match-DHArqY82.js → grantee-match-DbENBHLB.js}

@@ -1,7 +1,7 @@
 import { t as compact } from "./compact-CAf557ZB.js";
 import { u as isoAt } from "./time-DkWjdL98.js";
 import { d as scopeList, t as activeFor } from "./scopes-CUPSjo9q.js";
-import { o as flattenGrantee } from "./grantee-Cn1HyUsI.js";
+import { o as flattenGrantee } from "./grantee-hxrUsbpM.js";
 import { r as relationCondition, t as inheritCondition } from "./grantee-conditions-CcXf8hMM.js";
 //#region src/core/grantee-match.ts
 function combineWhere(left, right) {

package/dist/h3/index.d.ts

@@ -1,7 +1,7 @@
-import { T as Policy, Vt as Snapshot, j as PolicyVocabulary, rr as Principal } from "../policy-types-DzwivBgR.js";
-import { r as PermDock } from "../permdock-D7eeLJER.js";
-import { D as ConnectionOptions, T as Connection, f as InvalidSignatureError, i as OpenApiHooks, u as SnapshotQuery, v as discoverViaSignatureAgent, x as webBotAuthVerifier } from "../server-types-BLd4MnBX.js";
-import { a as ProtectTarget, n as FetchAdapterOptions, r as FetchProtect, t as ContextReader } from "../fetch-adapter-qKJBuRqy.js";
+import { T as Policy, Vt as Snapshot, j as PolicyVocabulary, rr as Principal } from "../policy-types-n0uRTsW8.js";
+import { r as PermDock } from "../permdock-SV8ZINYT.js";
+import { D as ConnectionOptions, T as Connection, f as InvalidSignatureError, i as OpenApiHooks, u as SnapshotQuery, v as discoverViaSignatureAgent, x as webBotAuthVerifier } from "../server-types-CKQiCnON.js";
+import { a as ProtectTarget, n as FetchAdapterOptions, r as FetchProtect, t as ContextReader } from "../fetch-adapter-Dw0MTS3D.js";
 import { EventHandler, H3Event, H3EventContext, Middleware } from "h3";
 //#region src/h3/create.d.ts
 type H3PermDockOptions<TUser = unknown> = FetchAdapterOptions<H3Event, TUser>;

package/dist/h3/index.js

@@ -1,6 +1,6 @@
-import { d as discoverViaSignatureAgent, m as webBotAuthVerifier, u as InvalidSignatureError } from "../evaluations-DZ2CbV5k.js";
-import { i as decorate } from "../bind-CZzhx-Vj.js";
-import { t as fetchAdapter } from "../fetch-adapter-g0ypLkID.js";
+import { d as discoverViaSignatureAgent, m as webBotAuthVerifier, u as InvalidSignatureError } from "../evaluations-beAooV0n.js";
+import { i as decorate } from "../bind-CAvgUuKs.js";
+import { t as fetchAdapter } from "../fetch-adapter-DD_gfmrC.js";
 //#region src/h3/create.ts
 function createPermDock(policy, options) {
 	const adapter = fetchAdapter(policy, options, "h3", (event) => event.req);

package/dist/{helpers-DTcZOzhF.js → helpers-CBYVMjwh.js}

@@ -9,7 +9,7 @@ import { r as relationReader, t as pendingRelations } from "./relations-BnCWnJGI
 import { n as resolveRelated } from "./relation-walk-3OyDBF0S.js";
 import { n as toWireDelegation } from "./wire-delegation-Cv3W2eaM.js";
 import { i as approverRelationKey, s as ApprovalError, t as APPROVAL_HEADER } from "./types-DqzsnlSA.js";
-import { c as listAllApprovals, n as assertApprover } from "./store-4u_hxjWa.js";
+import { c as listAllApprovals, n as assertApprover } from "./store-BDutJkDL.js";
 import { n as parseApprovalHeader } from "./approval-header-CJACtHkv.js";
 //#region src/approvals/relations.ts
 const DEFAULT_PARENT_DEPTH = 16;

package/dist/hono/index.d.ts

@@ -1,9 +1,9 @@
-import { T as Policy, j as PolicyVocabulary, rr as Principal } from "../policy-types-DzwivBgR.js";
-import { w as Permission } from "../vocabulary-D6lPdb4Z.js";
-import { r as PermDock } from "../permdock-D7eeLJER.js";
+import { T as Policy, j as PolicyVocabulary, rr as Principal } from "../policy-types-n0uRTsW8.js";
+import { w as Permission } from "../vocabulary-CN8H_9UF.js";
+import { r as PermDock } from "../permdock-SV8ZINYT.js";
 import { n as RevocationFeed } from "../revocations-R07lFBnX.js";
-import { D as ConnectionOptions, T as Connection, f as InvalidSignatureError, i as OpenApiHooks, o as ProtectOptions, v as discoverViaSignatureAgent, x as webBotAuthVerifier } from "../server-types-BLd4MnBX.js";
-import { t as ServerAdapterOptions } from "../bind--9EFVYWF.js";
+import { D as ConnectionOptions, T as Connection, f as InvalidSignatureError, i as OpenApiHooks, o as ProtectOptions, v as discoverViaSignatureAgent, x as webBotAuthVerifier } from "../server-types-CKQiCnON.js";
+import { t as ServerAdapterOptions } from "../bind-DOyrv6zi.js";
 import { Context, Hono, MiddlewareHandler } from "hono";
 import { SSEMessage, SSEStreamingApi } from "hono/streaming";
 import { WSEvents } from "hono/ws";

package/dist/hono/index.js

@@ -1,8 +1,8 @@
 import { t as compact } from "../compact-CAf557ZB.js";
 import { r as PermDockRevokedError } from "../errors-BKy0EfhN.js";
-import { d as discoverViaSignatureAgent, m as webBotAuthVerifier, u as InvalidSignatureError } from "../evaluations-DZ2CbV5k.js";
-import { t as problemFromError } from "../map-error-TCAdw-eW.js";
-import { r as bindKernel } from "../bind-CZzhx-Vj.js";
+import { d as discoverViaSignatureAgent, m as webBotAuthVerifier, u as InvalidSignatureError } from "../evaluations-beAooV0n.js";
+import { t as problemFromError } from "../map-error-Dr70oA_3.js";
+import { r as bindKernel } from "../bind-CAvgUuKs.js";
 import { a as onRevoked, n as closeReason, r as guardIterable, t as POLICY_VIOLATION } from "../stream-CvdUS9V1.js";
 import { Hono } from "hono";
 //#region src/hono/create.ts

package/dist/{hosted-BZIAYvon.js → hosted-B46-5LYE.js}

@@ -1,13 +1,13 @@
 import { r as isRecord, t as compact } from "./compact-CAf557ZB.js";
 import { n as freezeDeep } from "./freeze-CrU8nQeX.js";
 import { n as isForbiddenKey, s as splitPath } from "./paths-DXSHAMIa.js";
-import { a as deny, i as completeGrant, n as role, p as normalizeWhere, r as allow } from "./role-builder-CXbis5-X.js";
+import { a as deny, i as completeGrant, n as role, p as normalizeWhere, r as allow } from "./role-builder-uWQZ4v84.js";
 import { a as getResource, n as findPermission } from "./permission-registry-Br4jSNVi.js";
 import { d as isSelfParented } from "./resource-relations-D_jw0BFx.js";
 import { a as durationOf, l as isRfc3339, m as rfc3339 } from "./time-DkWjdL98.js";
 import { r as sha256Digest } from "./sha256-D9ihqmvd.js";
-import { _ as listPlans, m as findRole, o as flattenGrantee } from "./grantee-Cn1HyUsI.js";
-import { i as indexPolicy, t as declaredRoleNames } from "./policy-DLZJ5gAp.js";
+import { _ as listPlans, m as findRole, o as flattenGrantee } from "./grantee-hxrUsbpM.js";
+import { i as indexPolicy, t as declaredRoleNames } from "./policy-DbM5YYtV.js";
 //#region src/core/hosted.ts
 function memoryPolicySource(document = null) {
 	const current = document === null ? null : parsePolicyDocument(document);

package/dist/{hosted-DBDX0M-P.d.ts → hosted-BPk51-kX.d.ts}

@@ -1,4 +1,4 @@
-import { T as Policy, a as ApprovalRequirement, bn as Grantee, lr as Condition } from "./policy-types-DzwivBgR.js";
+import { T as Policy, a as ApprovalRequirement, bn as Grantee, ur as Condition } from "./policy-types-n0uRTsW8.js";
 //#region src/core/hosted.d.ts
 /** One grant authored in PermDock Cloud; its grantee is a declared role, plan or relation. */
 type HostedGrant = {

package/dist/{import-DMmOG27O.js → import-wyqXUyjm.js}

@@ -2,9 +2,9 @@ import { r as isRecord } from "./compact-CAf557ZB.js";
 import { i as configError, u as usageResult } from "./errors-CWTY6uih.js";
 import { s as writeFileEnsuringDir } from "./files-D_JIzUrP.js";
 import { r as escapeSqlIdent, s as quoteSqlLiteral } from "./sql-B5T1IL83.js";
-import { C as parseMembershipsFlag, r as HELPERS } from "./shared-CD11nBbC.js";
-import { f as pgConnector } from "./policies-CO1oOymN.js";
-import { t as FIELD_VIEWS } from "./fields-D9tPVUUS.js";
+import { C as parseMembershipsFlag, r as HELPERS } from "./shared-BAK8t4Uo.js";
+import { f as pgConnector } from "./policies-DP2nqRoF.js";
+import { t as FIELD_VIEWS } from "./fields-OYG_JR78.js";
 import { n as emptySchema, r as isSchemaKind, t as emitPermissionsModule } from "./generate-CNU1pIOo.js";
 import { existsSync, readFileSync } from "node:fs";
 import { resolve } from "node:path";

package/dist/{index-Chrs5fQ-.d.ts → index-B8YjkEZ4.d.ts}

@@ -1,9 +1,9 @@
-import { Ct as Credential, Nn as Decision, St as ApiKeyPrincipal, T as Policy, Tt as CredentialKind, U as CredentialVerifier, at as SettingsSource, dt as TokenVerifier, gt as SupportSession, ir as Subject, j as PolicyVocabulary, lt as TokenFailureCause, q as DecisionSink, qt as AuthEvent, rr as Principal, ut as TokenSigner } from "./policy-types-DzwivBgR.js";
-import { E as PermissionTree, w as Permission } from "./vocabulary-D6lPdb4Z.js";
-import { p as PrincipalSource } from "./permdock-D7eeLJER.js";
-import { t as Disclosure } from "./problem-details-DXlt-vks.js";
-import { a as ProblemDetails, t as ApprovalHint } from "./errors-C2PXIv4c.js";
-import { c as ServerPermDock, l as ServerPermDockOptions } from "./server-types-BLd4MnBX.js";
+import { Ct as Credential, Nn as Decision, St as ApiKeyPrincipal, T as Policy, Tt as CredentialKind, U as CredentialVerifier, ar as Subject, at as SettingsSource, dt as TokenVerifier, gt as SupportSession, j as PolicyVocabulary, lt as TokenFailureCause, q as DecisionSink, qt as AuthEvent, rr as Principal, ut as TokenSigner } from "./policy-types-n0uRTsW8.js";
+import { E as PermissionTree, w as Permission } from "./vocabulary-CN8H_9UF.js";
+import { p as PrincipalSource } from "./permdock-SV8ZINYT.js";
+import { t as Disclosure } from "./problem-details-B45V5d2b.js";
+import { a as ProblemDetails, t as ApprovalHint } from "./errors-DH5QEGXh.js";
+import { c as ServerPermDock, l as ServerPermDockOptions } from "./server-types-CKQiCnON.js";
 //#region src/server/create.d.ts
 /**
  * The Fetch factory behind every HTTP adapter. The subject and actor are

package/dist/{index-CxGUswIC.d.ts → index-C-6Letxg.d.ts}

@@ -1,8 +1,8 @@
-import { Nn as Decision, Rt as Instant, T as Policy, Yn as AuthorizationDetail, et as MembershipSource, fn as Approver, ir as Subject, it as RelationSource, nr as Membership, ut as TokenSigner } from "./policy-types-DzwivBgR.js";
-import { E as PermissionTree, V as AppData, w as Permission } from "./vocabulary-D6lPdb4Z.js";
-import { r as PermDock } from "./permdock-D7eeLJER.js";
-import { a as ApprovalDelegationSource, c as ApprovalListQuery, g as ApprovalVerdict, i as ApprovalDelegation, l as ApprovalPage, m as ApprovalStore, o as ApprovalInspectResult, r as ApprovalCancelMeta, s as ApprovalListFilter, u as ApprovalRequest } from "./types-CCpc2Dcv.js";
-import { a as AccessReviewItemQuery, c as AccessReviewStore, i as AccessReviewItemPage, n as AccessReviewDecision, r as AccessReviewItem, t as AccessReview } from "./types-_sHy8BQf.js";
+import { Nn as Decision, Rt as Instant, T as Policy, Yn as AuthorizationDetail, ar as Subject, et as MembershipSource, fn as Approver, it as RelationSource, nr as Membership, ut as TokenSigner } from "./policy-types-n0uRTsW8.js";
+import { E as PermissionTree, V as AppData, w as Permission } from "./vocabulary-CN8H_9UF.js";
+import { r as PermDock } from "./permdock-SV8ZINYT.js";
+import { a as ApprovalDelegationSource, c as ApprovalListQuery, g as ApprovalVerdict, i as ApprovalDelegation, l as ApprovalPage, m as ApprovalStore, o as ApprovalInspectResult, r as ApprovalCancelMeta, s as ApprovalListFilter, u as ApprovalRequest } from "./types-BdtSDbBO.js";
+import { a as AccessReviewItemQuery, c as AccessReviewStore, i as AccessReviewItemPage, n as AccessReviewDecision, r as AccessReviewItem, t as AccessReview } from "./types-C_IiEs64.js";
 import { t as JsonSchemaNode } from "./json-schema-CN_iLFH2.js";
 //#region src/approvals/access-reviews/handler.d.ts
 type AccessReviewsHandlerOptions = {

package/dist/{index-SGdIQyzc.d.ts → index-Ch8LpNDp.d.ts}

@@ -1,5 +1,5 @@
-import { dt as TokenVerifier, et as MembershipSource, q as DecisionSink } from "./policy-types-DzwivBgR.js";
-import { V as AppData } from "./vocabulary-D6lPdb4Z.js";
+import { dt as TokenVerifier, et as MembershipSource, q as DecisionSink } from "./policy-types-n0uRTsW8.js";
+import { V as AppData } from "./vocabulary-CN8H_9UF.js";
 import { n as RevocationFeed } from "./revocations-R07lFBnX.js";
 import { t as ClaimsMap } from "./claims-map-Ca-QX8C6.js";
 //#region src/scim/types.d.ts

package/dist/{index-D8EovfsP.d.ts → index-Cp_ilKi1.d.ts}

@@ -1,5 +1,5 @@
-import { T as Policy, rr as Principal, ut as TokenSigner } from "./policy-types-DzwivBgR.js";
-import { E as SsfPermDockOptions, T as SsfPermDock, _ as SetSubject, c as PushSetOptions, d as SetDelivery, g as SetQueue, h as SetPollHandlerOptions, m as SetEvent, t as CaepCommon, v as SignSetOptions } from "./types-DiQjupG2.js";
+import { T as Policy, rr as Principal, ut as TokenSigner } from "./policy-types-n0uRTsW8.js";
+import { E as SsfPermDockOptions, T as SsfPermDock, _ as SetSubject, c as PushSetOptions, d as SetDelivery, g as SetQueue, h as SetPollHandlerOptions, m as SetEvent, t as CaepCommon, v as SignSetOptions } from "./types-C791HFu9.js";
 //#region src/ssf/create.d.ts
 declare function createPermDock<TUser, TPrincipal extends Principal = Principal>(policy: Policy<TUser, TPrincipal>, options: SsfPermDockOptions): SsfPermDock;
 //#endregion

package/dist/{index-BcHcPyIo.d.ts → index-CueFnxQc.d.ts}

@@ -1,9 +1,9 @@
-import { T as Policy, Zt as DeliveryChannel, j as PolicyVocabulary, q as DecisionSink, rr as Principal } from "./policy-types-DzwivBgR.js";
-import { w as Permission } from "./vocabulary-D6lPdb4Z.js";
-import { t as Operation } from "./operations-CxybZErY.js";
-import { p as PrincipalSource, r as PermDock } from "./permdock-D7eeLJER.js";
-import { _ as TransportOptions, a as DeliveryReport, c as DeliveryTransport, g as TransportMessages, i as DeliveryMessages, l as DeliveryTransports, m as Recipient, o as DeliveryResult, r as DeliverOptions, s as DeliveryTarget, y as WebhookTransport } from "./types-DX0LaKTb.js";
-import { l as WebhookSigner } from "./standard-webhooks-6lg8v_is.js";
+import { T as Policy, Zt as DeliveryChannel, j as PolicyVocabulary, q as DecisionSink, rr as Principal } from "./policy-types-n0uRTsW8.js";
+import { w as Permission } from "./vocabulary-CN8H_9UF.js";
+import { t as Operation } from "./operations-X0VM7F3m.js";
+import { p as PrincipalSource, r as PermDock } from "./permdock-SV8ZINYT.js";
+import { _ as TransportOptions, a as DeliveryReport, c as DeliveryTransport, g as TransportMessages, i as DeliveryMessages, l as DeliveryTransports, m as Recipient, o as DeliveryResult, r as DeliverOptions, s as DeliveryTarget, y as WebhookTransport } from "./types-BtHtcKMr.js";
+import { l as WebhookSigner } from "./standard-webhooks-rbD7LS6h.js";
 //#region src/delivery/audience.d.ts
 type Audience = {
   /** Principal ids `decideFor` grants, in discovery or candidate order, each once. */