permdock 0.5.0 → 0.6.0

package/dist/{parse-local-manifest-DgqtruPn.d.ts → parse-local-manifest-5ODwqu8b.d.ts}

@@ -1,4 +1,4 @@
-import { Bt as LocalSnapshotManifest } from "./policy-types-DzwivBgR.js";
+import { Bt as LocalSnapshotManifest } from "./policy-types-n0uRTsW8.js";
 //#region src/core/parse-local-manifest.d.ts
 /**
  * Whether `value` has the shape `localSnapshotManifest(policy)` writes, with

package/dist/pdp/index.d.ts

@@ -1,6 +1,6 @@
-import { K as DecisionProvider, T as Policy, j as PolicyVocabulary, rr as Principal } from "../policy-types-DzwivBgR.js";
-import { i as PermDockOptions } from "../permdock-D7eeLJER.js";
-import { a as RelationMap, c as RemotePdpEndpoints, d as SpiceDbCheck, f as SpiceDbOptions, i as PdpPermDock, l as RemotePdpMapping, n as OpenFgaTuple, o as RemotePdpAuth, r as PdpFactory, s as RemotePdpCache, t as OpenFgaOptions, u as RemotePdpOptions } from "../types-ClZaWzfb.js";
+import { K as DecisionProvider, T as Policy, j as PolicyVocabulary, rr as Principal } from "../policy-types-n0uRTsW8.js";
+import { i as PermDockOptions } from "../permdock-SV8ZINYT.js";
+import { a as RelationMap, c as RemotePdpEndpoints, d as SpiceDbCheck, f as SpiceDbOptions, i as PdpPermDock, l as RemotePdpMapping, n as OpenFgaTuple, o as RemotePdpAuth, r as PdpFactory, s as RemotePdpCache, t as OpenFgaOptions, u as RemotePdpOptions } from "../types-_WhUP7ud.js";
 //#region src/pdp/create.d.ts
 /** The PDP-aware instance, built synchronously like core `getPermDockSync`; use `getPermDock` for asynchronous inputs. */
 export declare function getPermDockSync<TUser, TPrincipal extends Principal = Principal, V extends PolicyVocabulary = PolicyVocabulary>(policy: Policy<TUser, TPrincipal, V>, user: TUser | null, options?: PermDockOptions): PdpPermDock<V>;

package/dist/pdp/index.js

@@ -5,7 +5,7 @@ import { a as deniedMessage, i as approvalMessage, n as PermDockDeniedError, t a
 import { n as internalsOf, t as attachInternals } from "../internals-Dk8A8fX3.js";
 import { a as getResource, c as listPermissions } from "../permission-registry-Br4jSNVi.js";
 import { n as toWireDelegation } from "../wire-delegation-Cv3W2eaM.js";
-import { n as getPermDockSync$1, t as getPermDock$1 } from "../permdock-B9JxkBwC.js";
+import { n as getPermDockSync$1, t as getPermDock$1 } from "../permdock-BrAscV28.js";
 import { a as postJson, c as ttlMs, i as joinUrl, n as denied, o as resourceIdOf, r as granted, s as ttlCache, t as cacheKey } from "../shared-DvvFzYXe.js";
 //#region src/pdp/create.ts
 function withoutProviders(policy) {

package/dist/{permdock-B9JxkBwC.js → permdock-BrAscV28.js}

@@ -9,12 +9,12 @@ import { i as readAppData } from "./app-data-MuyzVqX8.js";
 import { a as normalizeMemberships, d as scopeList, m as tenantOf } from "./scopes-CUPSjo9q.js";
 import { o as pickVisible, s as sanitizeContext } from "./validity-CZ7-y0Cj.js";
 import { c as nowSeconds, d as resolveActiveTenant, m as tenantsOf, p as scopeField, t as heldRoleNamesIn, u as relatesTo } from "./tenancy-DN2QAx9z.js";
-import { l as policyX } from "./policy-DLZJ5gAp.js";
-import { A as isContact, C as emptyListeners, S as emitSafe, i as customRolesFor, k as contactMemberships, o as roleSourceFor, r as assignableNamesFor, s as sourceName, t as evaluate, u as customGrantsFor, w as finish } from "./evaluate-_R8QkWaf.js";
-import { a as whereGrant, c as applyRoleKinds, i as collectSnapshotGrants, l as audiencesOf, o as heldRoleNames, p as asMembershipSource, r as assignableIn, s as roleLeaf, t as snapshotOf } from "./instance-snapshot-Cxq4ygFc.js";
+import { l as policyX } from "./policy-DbM5YYtV.js";
+import { E as finish, M as isContact, T as emptyListeners, i as customRolesFor, j as contactMemberships, o as roleSourceFor, r as assignableNamesFor, s as sourceName, t as evaluate, u as customGrantsFor, w as emitSafe } from "./evaluate-CNClBvcj.js";
+import { a as whereGrant, c as applyRoleKinds, i as collectSnapshotGrants, l as audiencesOf, o as heldRoleNames, p as asMembershipSource, r as assignableIn, s as roleLeaf, t as snapshotOf } from "./instance-snapshot-BOEhcqIF.js";
 import { r as relationReader, t as pendingRelations } from "./relations-BnCWnJGI.js";
-import { r as snapshotGrant } from "./snapshot-CXUWfsNy.js";
-import { i as decideForTarget, n as mayUse, o as signSnapshot, r as permittedIds, t as whereFromGrants } from "./where-scope-Dv-WTP-w.js";
+import { r as snapshotGrant } from "./snapshot-B7DkYg6g.js";
+import { i as decideForTarget, n as mayUse, o as signSnapshot, r as permittedIds, t as whereFromGrants } from "./where-scope-C9vfEphl.js";
 import { r as isSubject, t as anonymousSubject } from "./subject-BGoM5o8B.js";
 //#region src/core/app.ts
 const APP = Symbol.for("permdock.app");

package/dist/{permdock-D7eeLJER.d.ts → permdock-SV8ZINYT.d.ts}

@@ -1,7 +1,7 @@
-import { $n as Delegation, Bn as LimitDetail, G as CustomRoleSourceFactory, Hn as Obligation, J as EntitlementSource, Nn as Decision, Q as LimitStore, Rn as ExplainedDecision, Rt as Instant, T as Policy, Un as Quota, Vt as Snapshot, W as CustomRoleSource, Xt as DecisionEvent, _ as GrantLimit, at as SettingsSource, cn as Scope, et as MembershipSource, h as Grant, i as ApprovalOption, ir as Subject, it as RelationSource, j as PolicyVocabulary, lr as Condition, nr as Membership, q as DecisionSink, qn as Actor, qt as AuthEvent, rr as Principal, sr as AdapterId, ut as TokenSigner } from "./policy-types-DzwivBgR.js";
-import { N as ResourceNode, V as AppData, a as RoleTree, n as PlanTree, r as Role, w as Permission } from "./vocabulary-D6lPdb4Z.js";
-import { i as OperationEffect, s as OperationMeta, t as Operation, u as OperationRisk } from "./operations-CxybZErY.js";
-import { i as HostedPolicies } from "./hosted-DBDX0M-P.js";
+import { $n as Delegation, Bn as LimitDetail, G as CustomRoleSourceFactory, Hn as Obligation, J as EntitlementSource, Nn as Decision, Q as LimitStore, Rn as ExplainedDecision, Rt as Instant, T as Policy, Un as Quota, Vt as Snapshot, W as CustomRoleSource, Xt as DecisionEvent, _ as GrantLimit, ar as Subject, at as SettingsSource, cn as Scope, cr as AdapterId, et as MembershipSource, h as Grant, i as ApprovalOption, it as RelationSource, j as PolicyVocabulary, nr as Membership, q as DecisionSink, qn as Actor, qt as AuthEvent, rr as Principal, ur as Condition, ut as TokenSigner } from "./policy-types-n0uRTsW8.js";
+import { N as ResourceNode, V as AppData, a as RoleTree, n as PlanTree, r as Role, w as Permission } from "./vocabulary-CN8H_9UF.js";
+import { i as OperationEffect, s as OperationMeta, t as Operation, u as OperationRisk } from "./operations-X0VM7F3m.js";
+import { i as HostedPolicies } from "./hosted-BPk51-kX.js";
 //#region src/core/approval-policies.d.ts
 /**
  * One approval requirement kept as data, for a tenant or the whole platform.

package/dist/{permissions-CZKiUfFM.js → permissions-BPxlwVhN.js}

@@ -1,6 +1,6 @@
-import { i as crud } from "./src-DLfUWFAI.js";
+import { i as crud } from "./src-Cu2m75uo.js";
 import { _ as resource } from "./permission-registry-Br4jSNVi.js";
-import { f as definePlans, p as defineRoles } from "./grantee-Cn1HyUsI.js";
+import { f as definePlans, p as defineRoles } from "./grantee-hxrUsbpM.js";
 import { t as definePermissions } from "./permissions-B-wCP5ZC.js";
 //#region src/testing/saas/schema.ts
 function accepts(kind, value) {

package/dist/{permissions-oEWfl-kl.d.ts → permissions-u_KHg-sN.d.ts}

@@ -1,4 +1,4 @@
-import { C as InferPermissionTree, k as ResourceInit, r as Role, t as Plan } from "./vocabulary-D6lPdb4Z.js";
+import { C as InferPermissionTree, k as ResourceInit, r as Role, t as Plan } from "./vocabulary-CN8H_9UF.js";
 import { StandardSchemaV1 } from "@standard-schema/spec";
 //#region src/testing/saas/permissions.d.ts
 declare const SaasProjectSchema: StandardSchemaV1<SaasProject>;

package/dist/{policies-CO1oOymN.js → policies-DP2nqRoF.js}

@@ -1,7 +1,7 @@
 import { a as sole } from "./compact-CAf557ZB.js";
 import { i as configError, n as CliError } from "./errors-CWTY6uih.js";
 import { i as requirePeer } from "./peer-C8swJ2GH.js";
-import { M as qualified, _ as subjectClaimJsonSql } from "./shared-CD11nBbC.js";
+import { M as qualified, _ as subjectClaimJsonSql } from "./shared-BAK8t4Uo.js";
 //#region src/cli/pg.ts
 const CONNECT_TIMEOUT_MS = 1e4;
 const STATEMENT_TIMEOUT_MS = 6e4;

package/dist/{policy-Czo4n3Hs.d.ts → policy-77FSAq_V.d.ts}

@@ -1,5 +1,5 @@
-import { T as Policy, ir as Subject, rr as Principal } from "./policy-types-DzwivBgR.js";
-import { c as saasPlans, l as saasRoles, s as saasPermissions } from "./permissions-oEWfl-kl.js";
+import { T as Policy, ar as Subject, rr as Principal } from "./policy-types-n0uRTsW8.js";
+import { c as saasPlans, l as saasRoles, s as saasPermissions } from "./permissions-u_KHg-sN.js";
 //#region src/testing/saas/policy.d.ts
 /** Daily API-key quota per subject; the bucket should be per tenant too. */
 declare const SAAS_API_KEY_LIMIT = 5;

package/dist/{policy-DLZJ5gAp.js → policy-DbM5YYtV.js}

@@ -1,12 +1,12 @@
 import { t as compact } from "./compact-CAf557ZB.js";
 import { n as freezeDeep } from "./freeze-CrU8nQeX.js";
-import { c as withGrantSchema, d as assertApprovalVersions, i as completeGrant, o as flattenGrants, p as normalizeWhere, s as flattenPermissions, u as assertApprovalRelations } from "./role-builder-CXbis5-X.js";
+import { c as withGrantSchema, d as assertApprovalVersions, i as completeGrant, o as flattenGrants, p as normalizeWhere, s as flattenPermissions, u as assertApprovalRelations } from "./role-builder-uWQZ4v84.js";
 import { c as listPermissions, i as getRegistry, m as annotationsFor, n as findPermission, s as isRegistryTree } from "./permission-registry-Br4jSNVi.js";
 import { d as isSelfParented, l as isFieldRelation } from "./resource-relations-D_jw0BFx.js";
 import { t as canonicalJson } from "./canonical-json-BC8_nMTw.js";
 import { r as sha256Digest } from "./sha256-D9ihqmvd.js";
 import { n as defineScopes, o as resolveScope } from "./scopes-CUPSjo9q.js";
-import { o as flattenGrantee, r as asGrantee, v as listRoles } from "./grantee-Cn1HyUsI.js";
+import { o as flattenGrantee, r as asGrantee, v as listRoles } from "./grantee-hxrUsbpM.js";
 import { n as normalizeValidity } from "./validity-CZ7-y0Cj.js";
 import { a as relationStart, i as relationHops, n as isGraphRelation, t as inheritCondition } from "./grantee-conditions-CcXf8hMM.js";
 import { a as memberOfFields, p as scopeField, u as relatesTo } from "./tenancy-DN2QAx9z.js";

package/dist/{policy-from-catalog-DzhEc3Y9.js → policy-from-catalog-C2gMa2Dj.js}

@@ -1,17 +1,17 @@
 import { r as isRecord, t as compact } from "./compact-CAf557ZB.js";
 import { n as freezeDeep } from "./freeze-CrU8nQeX.js";
-import { p as normalizeWhere } from "./role-builder-CXbis5-X.js";
+import { p as normalizeWhere } from "./role-builder-uWQZ4v84.js";
 import { n as PermDockValidationError } from "./validation-error-ZfUHbKvf.js";
 import { _ as resource, i as getRegistry, n as findPermission } from "./permission-registry-Br4jSNVi.js";
 import { n as defineScopes } from "./scopes-CUPSjo9q.js";
-import { f as definePlans, p as defineRoles } from "./grantee-Cn1HyUsI.js";
+import { f as definePlans, p as defineRoles } from "./grantee-hxrUsbpM.js";
 import { r as readWireValidity } from "./validity-CZ7-y0Cj.js";
-import { i as indexPolicy, u as normalizeDelegation } from "./policy-DLZJ5gAp.js";
-import { r as isPortableCondition } from "./hosted-BZIAYvon.js";
+import { i as indexPolicy, u as normalizeDelegation } from "./policy-DbM5YYtV.js";
+import { r as isPortableCondition } from "./hosted-B46-5LYE.js";
 import { t as definePermissions } from "./permissions-B-wCP5ZC.js";
 import { n as copyJson, t as checkSchema } from "./json-schema-B-vAwlde.js";
 import { t as parseCatalog } from "./parse-Cxq0WxrA.js";
-import { n as parsePushedPolicy } from "./pushed-policy-DobP7AHI.js";
+import { n as parsePushedPolicy } from "./pushed-policy-CqtxkV4G.js";
 //#region src/catalog/json-schema-validator.ts
 const ANNOTATIONS = /* @__PURE__ */ new Set([
 	"$schema",

package/dist/{policy-types-DzwivBgR.d.ts → policy-types-n0uRTsW8.d.ts}

@@ -1,4 +1,4 @@
-import { E as PermissionTree, H as AppDataSchema, N as ResourceNode, T as PermissionKind, U as MetaValue, V as AppData, a as RoleTree, i as RoleMeta, n as PlanTree, r as Role, t as Plan, w as Permission } from "./vocabulary-D6lPdb4Z.js";
+import { E as PermissionTree, H as AppDataSchema, N as ResourceNode, T as PermissionKind, U as MetaValue, V as AppData, a as RoleTree, i as RoleMeta, n as PlanTree, r as Role, t as Plan, w as Permission } from "./vocabulary-CN8H_9UF.js";
 //#region src/conditions/ast.d.ts
 type ConditionRef = {
   readonly ref: string;
@@ -286,6 +286,7 @@ type TenantCustomRole = CustomRoleBody & {
   readonly id?: string;
   /** Input only: `scope` = the second scope, `id` = this team. */
   readonly team?: string;
+  readonly shared?: undefined;
 };
 /**
  * A role the platform defines, held through `principal.roles` like a declared
@@ -297,8 +298,23 @@ type GlobalCustomRole = CustomRoleBody & {
   readonly tenant?: undefined;
   readonly id?: undefined;
   readonly team?: undefined;
+  readonly shared?: undefined;
 };
-type CustomRole = TenantCustomRole | GlobalCustomRole;
+/**
+ * A role the platform defines once for every tenant, held on memberships of
+ * its scope in any tenant. Tenant admins assign it but never edit it. Its
+ * ceiling is the assignable declared roles of its scope; its name wins over
+ * a tenant custom role of the same name.
+ */
+type SharedCustomRole = CustomRoleBody & {
+  readonly shared: true;
+  /** The scope the role is held at, never `'global'`; defaults to the first scope. */
+  readonly scope?: string;
+  readonly tenant?: undefined;
+  readonly id?: undefined;
+  readonly team?: undefined;
+};
+type CustomRole = TenantCustomRole | SharedCustomRole | GlobalCustomRole;
 type Principal = {
   readonly id: string;
   readonly issuer?: string;
@@ -1409,6 +1425,15 @@ type CustomRoleSource = {
   globalRoles?(context?: {
     readonly held: readonly string[];
   }): CustomRole[] | Promise<CustomRole[]>;
+  /**
+   * Shared custom roles (`shared: true`), defined once for every tenant and
+   * read once per subject with a tenant membership, with `held`, the role
+   * names its live memberships hold in any tenant. A role here without
+   * `shared: true` is ignored.
+   */
+  sharedRoles?(context?: {
+    readonly held: readonly string[];
+  }): CustomRole[] | Promise<CustomRole[]>;
 };
 /**
  * A `CustomRoleSource` built for the subject the instance serves, for an adapter
@@ -2147,4 +2172,4 @@ type SubjectOf<P> = {
   readonly expiresAt?: number;
 };
 //#endregion
-export { MemberEntry as $, Delegation as $n, DeliveryFailureCause as $t, PolicyScopes as A, relation as An, CredentialRequest as At, ValidateMode as B, LimitDetail as Bn, LocalSnapshotManifest as Bt, MembershipFixture as C, RelationGrantee as Cn, isConditionRef as Cr, Credential as Ct, PolicyDelegation as D, authenticated as Dn, CredentialPermissionInput as Dt, PolicyAppDataSchemas as E, assurance as En, CredentialPermission as Et, RoleScope as F, DenialDetails as Fn, isFeedId as Ft, CustomRoleSourceFactory as G, TraceSkip as Gn, SnapshotScope as Gt, WireValidity as H, Obligation as Hn, SnapshotAssignable as Ht, SeparationConflict as I, DenialReason as In, parseCredential as It, EntitlementSource as J, Assurance as Jn, AutomationEvent as Jt, DecisionProvider as K, TraceSkipReason as Kn, AccessEvent as Kt, SubjectOf as L, DeniedDecision as Ln, InstanceHandle as Lt, PrincipalOf as M, ApprovalRequiredDecision as Mn, credentialDelegation as Mt, RoleBinding as N, Decision as Nn, credentialPolicyViolation as Nt, PolicyOAuthScope as O, inherit as On, CredentialPolicy as Ot, RoleOptions as P, Denial as Pn, decideCredential as Pt, LimitStore as Q, CustomRoleGrant as Qn, DeliveryEvent as Qt, SupportAccessOptions as R, ExplainedDecision as Rn, Instant as Rt, HostedGrantRef as S, InheritGrantee as Sn, isConditionDate as Sr, ApiKeyPrincipal as St, Policy as T, anyone as Tn, CredentialKind as Tt, CredentialVerifier as U, Quota as Un, SnapshotGrant as Ut, VocabularyFromInput as V, MatchedGrant as Vn, Snapshot as Vt, CustomRoleSource as W, Trace as Wn, SnapshotNotEntitled as Wt, LimitConsumeInput as X, Binding as Xn, DecisionEvent as Xt, JwtClaims as Y, AuthorizationDetail as Yn, CredentialEvent as Yt, LimitRemaining as Z, CustomRole as Zn, DeliveryChannel as Zt, GrantLimit as _, anyOf as _n, RestrictedAncestors as _r, SupportSessionDecision as _t, ApprovalRequirement as a, WireDenial as an, VerifiedClaims as ar, SettingsSource as at, GrantScope as b, Grantee as bn, hasConditionOp as br, decideSupportSession as bt, BreakGlassOptions as c, Scope as cn, MembershipVia as cr, TenantSettings as ct, ClosureContext as d, AnyOfApprover as dn, ConditionValue as dr, TokenVerifier as dt, DirectoryEvent as en, GnapAccess as er, MembershipSource as et, ClosureGrantFn as f, Approver as fn, MemberOfCondition as fr, VerificationFailure as ft, GrantCondition as g, allOf as gn, RelatedHop as gr, SupportSession as gt, Grant as h, UserApprover as hn, RelatedCondition as hr, DecideSupportSessionOptions as ht, ApprovalOption as i, WireDecision as in, Subject as ir, RelationSource as it, PolicyVocabulary as j, AppObligation as jn, DecideCredentialOptions as jt, PolicyOptions as k, plan as kn, CredentialPolicyViolation as kt, BreakGlassRequirements as l, ScopeDeclaration as ln, Condition as lr, TokenFailureCause as lt, DelegationTarget as m, PermissionApprover as mn, OpaqueCondition as mr, WhereCompiler as mt, ApprovalEscalation as n, MembershipEvent as nn, Membership as nr, RelationGroup as nt, ApprovalStage as o, WireDelegation as on, ActorKind as or, SnapshotSource as ot, DelegationInput as p, ApproverInput as pn, MemberOfParent as pr, VerifiedToken as pt, DecisionSink as q, Actor as qn, AuthEvent as qt, ApprovalMode as r, SinkEvent as rn, Principal as rr, RelationHolder as rt, AssuranceRequirement as s, PolicyScopesInput as sn, AdapterId as sr, SubjectResolver as st, ActivationOption as t, EmailCategory as tn, JsonWebKeyLike as tr, RelationChain as tt, BreakGlassSpec as u, ScopeNames as un, ConditionRef as ur, TokenSigner as ut, GrantMeta as v, holder as vn, SqlFunctionArg as vr, SupportSessionPolicy as vt, ObligationInput as w, actor as wn, isSqlFunctionField as wr, CredentialDecision as wt, GrantValidity as x, GranteeInput as xn, isCondition as xr, parseSupportSession as xt, GrantOptions as y, user as yn, SqlFunctionCondition as yr, SupportSessionRequest as yt, SupportConsent as z, GrantedDecision as zn, LocalCustomRoleTable as zt };
+export { MemberEntry as $, Delegation as $n, DeliveryFailureCause as $t, PolicyScopes as A, relation as An, CredentialRequest as At, ValidateMode as B, LimitDetail as Bn, LocalSnapshotManifest as Bt, MembershipFixture as C, RelationGrantee as Cn, isConditionDate as Cr, Credential as Ct, PolicyDelegation as D, authenticated as Dn, CredentialPermissionInput as Dt, PolicyAppDataSchemas as E, assurance as En, CredentialPermission as Et, RoleScope as F, DenialDetails as Fn, isFeedId as Ft, CustomRoleSourceFactory as G, TraceSkip as Gn, SnapshotScope as Gt, WireValidity as H, Obligation as Hn, SnapshotAssignable as Ht, SeparationConflict as I, DenialReason as In, parseCredential as It, EntitlementSource as J, Assurance as Jn, AutomationEvent as Jt, DecisionProvider as K, TraceSkipReason as Kn, AccessEvent as Kt, SubjectOf as L, DeniedDecision as Ln, InstanceHandle as Lt, PrincipalOf as M, ApprovalRequiredDecision as Mn, credentialDelegation as Mt, RoleBinding as N, Decision as Nn, credentialPolicyViolation as Nt, PolicyOAuthScope as O, inherit as On, CredentialPolicy as Ot, RoleOptions as P, Denial as Pn, decideCredential as Pt, LimitStore as Q, CustomRoleGrant as Qn, DeliveryEvent as Qt, SupportAccessOptions as R, ExplainedDecision as Rn, Instant as Rt, HostedGrantRef as S, InheritGrantee as Sn, isCondition as Sr, ApiKeyPrincipal as St, Policy as T, anyone as Tn, isSqlFunctionField as Tr, CredentialKind as Tt, CredentialVerifier as U, Quota as Un, SnapshotGrant as Ut, VocabularyFromInput as V, MatchedGrant as Vn, Snapshot as Vt, CustomRoleSource as W, Trace as Wn, SnapshotNotEntitled as Wt, LimitConsumeInput as X, Binding as Xn, DecisionEvent as Xt, JwtClaims as Y, AuthorizationDetail as Yn, CredentialEvent as Yt, LimitRemaining as Z, CustomRole as Zn, DeliveryChannel as Zt, GrantLimit as _, anyOf as _n, RelatedHop as _r, SupportSessionDecision as _t, ApprovalRequirement as a, WireDenial as an, Subject as ar, SettingsSource as at, GrantScope as b, Grantee as bn, SqlFunctionCondition as br, decideSupportSession as bt, BreakGlassOptions as c, Scope as cn, AdapterId as cr, TenantSettings as ct, ClosureContext as d, AnyOfApprover as dn, ConditionRef as dr, TokenVerifier as dt, DirectoryEvent as en, GnapAccess as er, MembershipSource as et, ClosureGrantFn as f, Approver as fn, ConditionValue as fr, VerificationFailure as ft, GrantCondition as g, allOf as gn, RelatedCondition as gr, SupportSession as gt, Grant as h, UserApprover as hn, OpaqueCondition as hr, DecideSupportSessionOptions as ht, ApprovalOption as i, WireDecision as in, SharedCustomRole as ir, RelationSource as it, PolicyVocabulary as j, AppObligation as jn, DecideCredentialOptions as jt, PolicyOptions as k, plan as kn, CredentialPolicyViolation as kt, BreakGlassRequirements as l, ScopeDeclaration as ln, MembershipVia as lr, TokenFailureCause as lt, DelegationTarget as m, PermissionApprover as mn, MemberOfParent as mr, WhereCompiler as mt, ApprovalEscalation as n, MembershipEvent as nn, Membership as nr, RelationGroup as nt, ApprovalStage as o, WireDelegation as on, VerifiedClaims as or, SnapshotSource as ot, DelegationInput as p, ApproverInput as pn, MemberOfCondition as pr, VerifiedToken as pt, DecisionSink as q, Actor as qn, AuthEvent as qt, ApprovalMode as r, SinkEvent as rn, Principal as rr, RelationHolder as rt, AssuranceRequirement as s, PolicyScopesInput as sn, ActorKind as sr, SubjectResolver as st, ActivationOption as t, EmailCategory as tn, JsonWebKeyLike as tr, RelationChain as tt, BreakGlassSpec as u, ScopeNames as un, Condition as ur, TokenSigner as ut, GrantMeta as v, holder as vn, RestrictedAncestors as vr, SupportSessionPolicy as vt, ObligationInput as w, actor as wn, isConditionRef as wr, CredentialDecision as wt, GrantValidity as x, GranteeInput as xn, hasConditionOp as xr, parseSupportSession as xt, GrantOptions as y, user as yn, SqlFunctionArg as yr, SupportSessionRequest as yt, SupportConsent as z, GrantedDecision as zn, LocalCustomRoleTable as zt };

package/dist/{postgrest-NUqZT-RB.d.ts → postgrest-CEgRbefE.d.ts}

@@ -1,4 +1,4 @@
-import { $ as MemberEntry, T as Policy, W as CustomRoleSource, Zn as CustomRole, et as MembershipSource, ir as Subject, nr as Membership } from "./policy-types-DzwivBgR.js";
+import { $ as MemberEntry, T as Policy, W as CustomRoleSource, Zn as CustomRole, ar as Subject, et as MembershipSource, nr as Membership } from "./policy-types-n0uRTsW8.js";
 //#region src/supabase/postgrest.d.ts
 /** What a supabase-js `rpc` call resolves to: `data` or an `error` with a message. */
 type SupabaseRpcResult = {

package/dist/{postgrest-CW0IqC-U.js → postgrest-DAjUkF9w.js}

@@ -409,10 +409,15 @@ function customRoleOf(value) {
 		grants,
 		...includes.length === 0 ? {} : { includes }
 	};
-	if (value["scope"] === "global") return value["tenant"] === void 0 ? {
+	if (value["scope"] === "global") return value["tenant"] === void 0 && value["shared"] === void 0 ? {
 		...body,
 		scope: "global"
 	} : void 0;
+	if (value["shared"] === true) return value["tenant"] === void 0 && value["id"] === void 0 ? compact({
+		...body,
+		shared: true,
+		scope: typeof value["scope"] === "string" ? value["scope"] : void 0
+	}) : void 0;
 	if (typeof value["tenant"] !== "string") return;
 	return compact({
 		...body,
@@ -540,6 +545,10 @@ function postgrestSources(client, options = {}) {
 				async globalRoles(context) {
 					if (onlyDeclared(context?.held)) return [];
 					return ((await live(principal.id))?.customRoles ?? []).filter((role) => role.scope === "global");
+				},
+				async sharedRoles(context) {
+					if (onlyDeclared(context?.held)) return [];
+					return ((await live(principal.id))?.customRoles ?? []).filter((role) => role.shared === true);
 				}
 			};
 		},

package/dist/{powersync-bYUDLOAO.js → powersync-BkWWCS1K.js}

@@ -1,9 +1,9 @@
 import { c as isConditionRef, s as isConditionDate } from "./refs-K6eWUJ0H.js";
-import { E as memoryCustomRoleSource, f as localSnapshotManifest } from "./src-DLfUWFAI.js";
+import { E as memoryCustomRoleSource, f as localSnapshotManifest } from "./src-Cu2m75uo.js";
 import { n as findPermission } from "./permission-registry-Br4jSNVi.js";
 import { d as scopeList, o as resolveScope } from "./scopes-CUPSjo9q.js";
 import { t as requiresApproval } from "./approval-required-TzNB9oQA.js";
-import { t as getPermDock } from "./permdock-B9JxkBwC.js";
+import { t as getPermDock } from "./permdock-BrAscV28.js";
 import { u as usageResult } from "./errors-CWTY6uih.js";
 import { c as requirePolicy } from "./load-DFS_ry0W.js";
 import { i as scopeMembershipTable, r as scopeColumn } from "./compile-CMqMx_IN.js";
@@ -12,10 +12,10 @@ import "./sources-vs5dGOsS.js";
 import { t as applyFiles } from "./files-C5ZI27eV.js";
 import { i as fileDrift } from "./output-files-DhRBBE4n.js";
 import { n as fixtureSubject, r as loadFixtures, t as fixtureRow } from "./fixtures-B7XrLeY7.js";
-import { N as quoteIdent, a as customRolesOn, t as CUSTOM_ROLES } from "./shared-CD11nBbC.js";
-import { f as pgConnector } from "./policies-CO1oOymN.js";
-import { M as contextRefs, k as collectGrants, t as ownershipRules } from "./ownership-BatFgAA4.js";
-import { m as tableFor, t as canFixture } from "./verify-DbCL9bnB.js";
+import { N as quoteIdent, a as customRolesOn, t as CUSTOM_ROLES } from "./shared-BAK8t4Uo.js";
+import { f as pgConnector } from "./policies-DP2nqRoF.js";
+import { A as collectGrants, N as contextRefs, t as ownershipRules } from "./ownership-DqaJNJPn.js";
+import { m as tableFor, t as canFixture } from "./verify-BaAKx7t6.js";
 import { resolve } from "node:path";
 //#region src/cli/powersync/streams.ts
 function ident(name) {

package/dist/{powersync-BHfuehf3.js → powersync-DISt6SUe.js}

@@ -14,7 +14,7 @@ const generate = defineLeaf({
 	async run(ctx, { flags }) {
 		const out = fileOut("powersync", flags.out);
 		const from = given(flags.policy);
-		const { runPowerSync } = await import("./powersync-CbzkqL_M.js");
+		const { runPowerSync } = await import("./powersync-MMJ2mI2q.js");
 		return runPowerSync({
 			cwd: ctx.cwd,
 			config: ctx.config,
@@ -45,7 +45,7 @@ const verify = defineLeaf({
 		const db = await dbUrl(ctx, flags, { required: true });
 		const fixtures = given(flags.fixtures);
 		const from = given(flags.policy);
-		const { runPowerSync } = await import("./powersync-CbzkqL_M.js");
+		const { runPowerSync } = await import("./powersync-MMJ2mI2q.js");
 		return runPowerSync({
 			cwd: ctx.cwd,
 			config: ctx.config,

package/dist/powersync-MMJ2mI2q.js

@@ -0,0 +1 @@
+export { n as runPowerSync } from "./powersync-BkWWCS1K.js";

package/dist/prisma/index.d.ts

@@ -1,5 +1,5 @@
-import { Rt as Instant, ir as Subject, lr as Condition } from "../policy-types-DzwivBgR.js";
-import { c as WhereResult } from "../permdock-D7eeLJER.js";
+import { Rt as Instant, ar as Subject, ur as Condition } from "../policy-types-n0uRTsW8.js";
+import { c as WhereResult } from "../permdock-SV8ZINYT.js";
 import { r as RelationsMapping } from "../graph-sql-B-dsAT6j.js";
 import { n as WithSubjectOptions, t as RowCheck } from "../row-check-Dt35czLy.js";
 //#region src/prisma/model-fields.d.ts

package/dist/{problem-details-DXlt-vks.d.ts → problem-details-B45V5d2b.d.ts}

@@ -1,4 +1,4 @@
-import { Nn as Decision } from "./policy-types-DzwivBgR.js";
+import { Nn as Decision } from "./policy-types-n0uRTsW8.js";
 //#region src/core/problem-details.d.ts
 type Disclosure = "hide" | "reveal";
 /** The plans a `not-entitled` denial asks for; empty unless every denial is `not-entitled`. */

package/dist/{protected-DfjY5mLA.js → protected-BlF0F6wL.js}

@@ -1,4 +1,4 @@
-import { n as storeOf } from "./store-options-BqEakYRa.js";
+import { n as storeOf } from "./store-options-u0ycEe8s.js";
 import { c as rolesView, d as subjectView, f as tenantView, i as gateView, l as scopedTenant, n as describeWith, o as permissionSet, r as filterResult, s as protectedView, t as approvalHandle, u as slotContent } from "./views-DTIIO-oQ.js";
 import { a as PermDockUiContext, i as PermDockStoreContext, r as PermDockSnapshotPromiseContext } from "./live-options-BaAFCIiu.js";
 import { Suspense, use, useMemo, useSyncExternalStore } from "react";

package/dist/{protected-DEPHc2xV.d.ts → protected-RFGpakN9.d.ts}

@@ -1,8 +1,8 @@
-import { Nn as Decision, j as PolicyVocabulary, nr as Membership } from "./policy-types-DzwivBgR.js";
-import { r as Role, w as Permission } from "./vocabulary-D6lPdb4Z.js";
-import { r as DescribeOptions, t as DecisionDescription } from "./describe-BZUsixiL.js";
-import { a as FilterResult, c as PermissionSet, d as RolesOptions, f as SubjectView, l as PermissionState, o as GateMode, p as TenantView, r as ClientPermDock, s as GateView, t as ApprovalHandle } from "./types-BNORmDM8.js";
-import { r as ProtectedProps } from "./types-tIgIeIKJ.js";
+import { Nn as Decision, j as PolicyVocabulary, nr as Membership } from "./policy-types-n0uRTsW8.js";
+import { r as Role, w as Permission } from "./vocabulary-CN8H_9UF.js";
+import { r as DescribeOptions, t as DecisionDescription } from "./describe-B5qgDvEW.js";
+import { a as FilterResult, c as PermissionSet, d as RolesOptions, f as SubjectView, l as PermissionState, o as GateMode, p as TenantView, r as ClientPermDock, s as GateView, t as ApprovalHandle } from "./types-B3_ooZgZ.js";
+import { r as ProtectedProps } from "./types-CX7AvRqP.js";
 import { ReactNode } from "react";
 //#region src/react/hooks.d.ts
 declare function usePermDock<V extends PolicyVocabulary = PolicyVocabulary>(): ClientPermDock<V>;

package/dist/{provider-CC-u3bYP.js → provider-B1al-AZz.js}

@@ -1,6 +1,6 @@
 import { t as compact } from "./compact-CAf557ZB.js";
-import { t as emptySnapshot } from "./from-snapshot-D2lZt4Dd.js";
-import { t as adapterStore } from "./store-options-BqEakYRa.js";
+import { t as emptySnapshot } from "./from-snapshot-CTCMsFZk.js";
+import { t as adapterStore } from "./store-options-u0ycEe8s.js";
 import { a as PermDockUiContext, i as PermDockStoreContext, n as useKeyed, r as PermDockSnapshotPromiseContext, t as useLiveOptions } from "./live-options-BaAFCIiu.js";
 import { useLayoutEffect, useMemo } from "react";
 import { jsx } from "react/jsx-runtime";

package/dist/{provider-DMVt6yYn.d.ts → provider-DILL9oPK.d.ts}

@@ -1,4 +1,4 @@
-import { n as PermDockProviderProps } from "./types-tIgIeIKJ.js";
+import { n as PermDockProviderProps } from "./types-CX7AvRqP.js";
 import { ReactElement } from "react";
 //#region src/react/provider.d.ts
 declare function PermDockProvider(props: PermDockProviderProps): ReactElement;

package/dist/{provider-store-B5Yrkhzr.js → provider-store-DM6DNcta.js}

@@ -1,6 +1,6 @@
 import { t as compact } from "./compact-CAf557ZB.js";
-import { t as emptySnapshot } from "./from-snapshot-D2lZt4Dd.js";
-import { i as isPromiseLike, t as adapterStore } from "./store-options-BqEakYRa.js";
+import { t as emptySnapshot } from "./from-snapshot-CTCMsFZk.js";
+import { i as isPromiseLike, t as adapterStore } from "./store-options-u0ycEe8s.js";
 //#region src/client/provider-store.ts
 /**
 * Store options that read `read()` on every request, so a rotated token, a

package/dist/pull-CvpINcMK.js

@@ -0,0 +1 @@
+export { n as runCloudPull } from "./pull-jEwbf80J.js";

package/dist/{pull-BgIfno6w.js → pull-jEwbf80J.js}

@@ -3,7 +3,7 @@ import { t as catalogFingerprint } from "./catalog-fingerprint-CCP0-yQS.js";
 import { a as describeError } from "./errors-CWTY6uih.js";
 import { s as writeFileEnsuringDir } from "./files-D_JIzUrP.js";
 import { s as cliVersion } from "./version-CEbQ5UeM.js";
-import { a as formatCatalogJson } from "./catalog-doc-C9wjsfNY.js";
+import { a as formatCatalogJson } from "./catalog-doc-Cdn7-0pQ.js";
 import { t as catalogPath } from "./catalog-path-CnI0XTFK.js";
 import { t as parseSupabaseManifest } from "./manifest-C8IzW3Do.js";
 import { t as parseCatalog } from "./parse-Cxq0WxrA.js";

package/dist/{push-CmFVBOeI.js → push-BD4f15co.js}

@@ -4,8 +4,8 @@ import { s as cliVersion } from "./version-CEbQ5UeM.js";
 import { i as loadConfiguredPolicy } from "./load-DFS_ry0W.js";
 import { t as parseSupabaseManifest } from "./manifest-C8IzW3Do.js";
 import { t as parseCatalog } from "./parse-Cxq0WxrA.js";
-import { r as pushedPolicy } from "./pushed-policy-DobP7AHI.js";
-import { n as runCatalog } from "./catalog-BECMPrwc.js";
+import { r as pushedPolicy } from "./pushed-policy-CqtxkV4G.js";
+import { n as runCatalog } from "./catalog-HD2gf5mY.js";
 import { n as httpRequest, t as authFailure } from "./http-DXJ37RDA.js";
 import { a as pushAuth, l as cloudUrl, n as cliRuntime, u as firstNonEmpty } from "./auth-DRLEizbL.js";
 import "./manifest-json-CAGzls-C.js";

package/dist/{pushed-policy-DobP7AHI.js → pushed-policy-CqtxkV4G.js}

@@ -3,7 +3,7 @@ import { n as freezeDeep } from "./freeze-CrU8nQeX.js";
 import { n as PermDockValidationError } from "./validation-error-ZfUHbKvf.js";
 import { n as RFC3339_PATTERN } from "./time-DkWjdL98.js";
 import { i as wireValidity } from "./validity-CZ7-y0Cj.js";
-import { n as snapshotScopes } from "./instance-snapshot-Cxq4ygFc.js";
+import { n as snapshotScopes } from "./instance-snapshot-BOEhcqIF.js";
 import { n as copyJson, r as forbiddenKeyPath, t as checkSchema } from "./json-schema-B-vAwlde.js";
 //#region src/catalog/pushed-policy.ts
 const strings = {

package/dist/{pushed-policy-BImMTTIM.d.ts → pushed-policy-DCW91KQU.d.ts}

@@ -1,4 +1,4 @@
-import { Gt as SnapshotScope, H as WireValidity, T as Policy, _ as GrantLimit, a as ApprovalRequirement, bn as Grantee, jn as AppObligation, lr as Condition, u as BreakGlassSpec, v as GrantMeta } from "./policy-types-DzwivBgR.js";
+import { Gt as SnapshotScope, H as WireValidity, T as Policy, _ as GrantLimit, a as ApprovalRequirement, bn as Grantee, jn as AppObligation, u as BreakGlassSpec, ur as Condition, v as GrantMeta } from "./policy-types-n0uRTsW8.js";
 import { t as JsonSchemaNode } from "./json-schema-CN_iLFH2.js";
 //#region src/catalog/pushed-policy.d.ts
 /**

package/dist/react/index.d.ts

@@ -1,8 +1,8 @@
-import { n as requiredPlans } from "../problem-details-DXlt-vks.js";
-import { i as describe } from "../describe-BZUsixiL.js";
+import { n as requiredPlans } from "../problem-details-B45V5d2b.js";
+import { i as describe } from "../describe-B5qgDvEW.js";
 import { t as approvalHeaders } from "../headers-CIbDTUTK.js";
-import { a as FilterResult, c as PermissionSet, f as SubjectView, i as ClientStatus, l as PermissionState, n as ApprovalState, o as GateMode, p as TenantView, r as ClientPermDock, s as GateView, t as ApprovalHandle } from "../types-BNORmDM8.js";
-import { n as PermDockProviderProps, r as ProtectedProps, t as PermDockDefaults } from "../types-tIgIeIKJ.js";
-import { a as useDescribe, c as useMemberships, d as usePermissions, f as useRoles, i as useAssignableRoles, l as usePermDock, m as useTenant, n as useApproval, o as useFilter, p as useSubject, r as useAssignablePermissions, s as useGate, t as Protected, u as usePermission } from "../protected-DEPHc2xV.js";
-import { t as PermDockProvider } from "../provider-DMVt6yYn.js";
+import { a as FilterResult, c as PermissionSet, f as SubjectView, i as ClientStatus, l as PermissionState, n as ApprovalState, o as GateMode, p as TenantView, r as ClientPermDock, s as GateView, t as ApprovalHandle } from "../types-B3_ooZgZ.js";
+import { n as PermDockProviderProps, r as ProtectedProps, t as PermDockDefaults } from "../types-CX7AvRqP.js";
+import { a as useDescribe, c as useMemberships, d as usePermissions, f as useRoles, i as useAssignableRoles, l as usePermDock, m as useTenant, n as useApproval, o as useFilter, p as useSubject, r as useAssignablePermissions, s as useGate, t as Protected, u as usePermission } from "../protected-RFGpakN9.js";
+import { t as PermDockProvider } from "../provider-DILL9oPK.js";
 export { type ApprovalHandle, type ApprovalState, type ClientPermDock, type ClientStatus, type FilterResult, type GateMode, type GateView, type PermDockDefaults, PermDockProvider, type PermDockProviderProps, type PermissionSet, type PermissionState, Protected, type ProtectedProps, type SubjectView, type TenantView, approvalHeaders, describe, requiredPlans, useApproval, useAssignablePermissions, useAssignableRoles, useDescribe, useFilter, useGate, useMemberships, usePermDock, usePermission, usePermissions, useRoles, useSubject, useTenant };

package/dist/react/index.js

@@ -2,6 +2,6 @@
 import { r as requiredPlans } from "../problem-details-cn5X30gZ.js";
 import { t as describe } from "../describe-BybMRY7A.js";
 import { t as approvalHeaders } from "../headers-BIjfMaoC.js";
-import { a as useDescribe, c as useMemberships, d as usePermissions, f as useRoles, i as useAssignableRoles, l as usePermDock, m as useTenant, n as useApproval, o as useFilter, p as useSubject, r as useAssignablePermissions, s as useGate, t as Protected, u as usePermission } from "../protected-DfjY5mLA.js";
-import { t as PermDockProvider } from "../provider-CC-u3bYP.js";
+import { a as useDescribe, c as useMemberships, d as usePermissions, f as useRoles, i as useAssignableRoles, l as usePermDock, m as useTenant, n as useApproval, o as useFilter, p as useSubject, r as useAssignablePermissions, s as useGate, t as Protected, u as usePermission } from "../protected-BlF0F6wL.js";
+import { t as PermDockProvider } from "../provider-B1al-AZz.js";
 export { PermDockProvider, Protected, approvalHeaders, describe, requiredPlans, useApproval, useAssignablePermissions, useAssignableRoles, useDescribe, useFilter, useGate, useMemberships, usePermDock, usePermission, usePermissions, useRoles, useSubject, useTenant };

package/dist/react/provider-client.d.ts

@@ -1,2 +1,2 @@
-import { t as PermDockProvider } from "../provider-DMVt6yYn.js";
+import { t as PermDockProvider } from "../provider-DILL9oPK.js";
 export { PermDockProvider };

package/dist/react/provider-client.js

@@ -1,2 +1,2 @@
 "use client";
-export { t as PermDockProvider } from "../provider-CC-u3bYP.js";
+export { t as PermDockProvider } from "../provider-B1al-AZz.js";

package/dist/react-native/index.d.ts

@@ -1,13 +1,13 @@
-import { Bt as LocalSnapshotManifest, Rt as Instant, Vt as Snapshot, Zn as CustomRole, nr as Membership, ot as SnapshotSource } from "../policy-types-DzwivBgR.js";
-import { w as Permission } from "../vocabulary-D6lPdb4Z.js";
-import { n as requiredPlans } from "../problem-details-DXlt-vks.js";
-import { i as describe } from "../describe-BZUsixiL.js";
-import { t as parseLocalSnapshotManifest } from "../parse-local-manifest-DgqtruPn.js";
+import { Bt as LocalSnapshotManifest, Rt as Instant, Vt as Snapshot, Zn as CustomRole, nr as Membership, ot as SnapshotSource } from "../policy-types-n0uRTsW8.js";
+import { w as Permission } from "../vocabulary-CN8H_9UF.js";
+import { n as requiredPlans } from "../problem-details-B45V5d2b.js";
+import { i as describe } from "../describe-B5qgDvEW.js";
+import { t as parseLocalSnapshotManifest } from "../parse-local-manifest-5ODwqu8b.js";
 import { t as approvalHeaders } from "../headers-CIbDTUTK.js";
-import { a as FilterResult, c as PermissionSet, f as SubjectView, i as ClientStatus, l as PermissionState, m as ClientStore, n as ApprovalState, o as GateMode, p as TenantView, r as ClientPermDock, s as GateView, t as ApprovalHandle } from "../types-BNORmDM8.js";
-import { r as ProtectedProps, t as PermDockDefaults } from "../types-tIgIeIKJ.js";
-import { a as useDescribe, c as useMemberships, d as usePermissions, f as useRoles, i as useAssignableRoles, l as usePermDock, m as useTenant, n as useApproval, o as useFilter, p as useSubject, r as useAssignablePermissions, s as useGate, t as Protected, u as usePermission } from "../protected-DEPHc2xV.js";
-import { a as SubscribeOnline, i as SubscribeForeground, n as ReactNativePermDockProviderProps, r as SnapshotStorage, t as NativeRevalidate } from "../types-BjV-fqcA.js";
+import { a as FilterResult, c as PermissionSet, f as SubjectView, i as ClientStatus, l as PermissionState, m as ClientStore, n as ApprovalState, o as GateMode, p as TenantView, r as ClientPermDock, s as GateView, t as ApprovalHandle } from "../types-B3_ooZgZ.js";
+import { r as ProtectedProps, t as PermDockDefaults } from "../types-CX7AvRqP.js";
+import { a as useDescribe, c as useMemberships, d as usePermissions, f as useRoles, i as useAssignableRoles, l as usePermDock, m as useTenant, n as useApproval, o as useFilter, p as useSubject, r as useAssignablePermissions, s as useGate, t as Protected, u as usePermission } from "../protected-RFGpakN9.js";
+import { a as SubscribeOnline, i as SubscribeForeground, n as ReactNativePermDockProviderProps, r as SnapshotStorage, t as NativeRevalidate } from "../types-C863OQiR.js";
 import { ReactElement } from "react";
 //#region src/react-native/guards.d.ts
 /** `true` once the provider has a snapshot to answer from: storage was read or a seed was given. Hide the splash screen on it. */

package/dist/react-native/index.js

@@ -6,15 +6,15 @@ import { t as describe } from "../describe-BybMRY7A.js";
 import { n as isThenable } from "../thenable-yD7SabqG.js";
 import { h as secondsAt, m as rfc3339 } from "../time-DkWjdL98.js";
 import { a as normalizeMemberships, d as scopeList, m as tenantOf$1, o as resolveScope } from "../scopes-CUPSjo9q.js";
-import { o as flattenGrantee } from "../grantee-Cn1HyUsI.js";
+import { o as flattenGrantee } from "../grantee-hxrUsbpM.js";
 import { d as resolveActiveTenant } from "../tenancy-DN2QAx9z.js";
-import { i as bindConditionRefs, n as parseSnapshot } from "../snapshot-CXUWfsNy.js";
-import { r as heldRoleNames, t as emptySnapshot } from "../from-snapshot-D2lZt4Dd.js";
+import { i as bindConditionRefs, n as parseSnapshot } from "../snapshot-B7DkYg6g.js";
+import { r as heldRoleNames, t as emptySnapshot } from "../from-snapshot-CTCMsFZk.js";
 import { t as parseLocalSnapshotManifest } from "../parse-local-manifest-CVSs6J9I.js";
 import { t as approvalHeaders } from "../headers-BIjfMaoC.js";
-import { n as storeOf, r as isJws, t as adapterStore } from "../store-options-BqEakYRa.js";
+import { n as storeOf, r as isJws, t as adapterStore } from "../store-options-u0ycEe8s.js";
 import { a as PermDockUiContext, i as PermDockStoreContext, n as useKeyed, t as useLiveOptions } from "../live-options-BaAFCIiu.js";
-import { a as useDescribe, c as useMemberships, d as usePermissions, f as useRoles, i as useAssignableRoles, l as usePermDock, m as useTenant, n as useApproval, o as useFilter, p as useSubject, r as useAssignablePermissions, s as useGate, t as Protected, u as usePermission } from "../protected-DfjY5mLA.js";
+import { a as useDescribe, c as useMemberships, d as usePermissions, f as useRoles, i as useAssignableRoles, l as usePermDock, m as useTenant, n as useApproval, o as useFilter, p as useSubject, r as useAssignablePermissions, s as useGate, t as Protected, u as usePermission } from "../protected-BlF0F6wL.js";
 import { useEffect, useMemo, useRef } from "react";
 import { jsx } from "react/jsx-runtime";
 //#region src/react-native/guards.ts
@@ -123,7 +123,7 @@ function isList(value) {
 	return Array.isArray(value);
 }
 function customScope(role, scopes) {
-	if (role.scope === "global") return "global";
+	if (role.scope === "global") return role.shared === true ? void 0 : "global";
 	if (role.scope !== void 0) return resolveScope(scopes, role.scope);
 	return role.team === void 0 ? scopes[0]?.name : scopes[1]?.name;
 }
@@ -175,7 +175,9 @@ function buildLocalSnapshot(manifest, data, at) {
 		}
 		for (const membership of memberships) if (scoped.every((item) => declared.has(item.role) && membership.roles.includes(item.role) && (typeof item.scope === "string" ? membership.scope === item.scope : membership.on !== void 0))) attach(grant, membership);
 	}
-	const custom = (data.customRoles ?? []).filter((role) => role !== null && typeof role === "object" && typeof role.name === "string" && !declared.has(role.name));
+	const formed = (data.customRoles ?? []).filter((role) => role !== null && typeof role === "object" && typeof role.name === "string" && !declared.has(role.name));
+	const sharedNames = new Set(formed.filter((role) => role.shared === true).map((role) => role.name));
+	const custom = formed.filter((role) => role.shared === true || role.scope === "global" || !sharedNames.has(role.name));
 	for (const role of custom) {
 		const scope = customScope(role, scopes);
 		const table = scope !== void 0 && Object.hasOwn(manifest.custom, scope) ? manifest.custom[scope] : void 0;
@@ -186,7 +188,7 @@ function buildLocalSnapshot(manifest, data, at) {
 			continue;
 		}
 		const id = role.team ?? role.id;
-		for (const membership of memberships) if (membership.scope === scope && typeof role.tenant === "string" && tenantOf$1(membership, scopes) === role.tenant && (id === void 0 || membership.id === id) && membership.roles.includes(role.name)) for (const grant of resolved) attach(grant, membership);
+		for (const membership of memberships) if (membership.scope === scope && (role.shared === true ? role.tenant === void 0 && id === void 0 && tenantOf$1(membership, scopes) !== void 0 : typeof role.tenant === "string" && tenantOf$1(membership, scopes) === role.tenant) && (id === void 0 || membership.id === id) && membership.roles.includes(role.name)) for (const grant of resolved) attach(grant, membership);
 	}
 	const roles = subject.principal === null ? [] : heldRoleNames(subject, tenant, scopes, { rank: manifest.rank ?? [] }, now);
 	return freezeDeep(compact({

package/dist/{replay-D7iKcLFe.d.ts → replay-Bkm-Ne4l.d.ts}

@@ -1,4 +1,4 @@
-import { l as ReplayStore } from "./types-DiQjupG2.js";
+import { l as ReplayStore } from "./types-C791HFu9.js";
 //#region src/ssf/replay.d.ts
 declare function memoryReplayStore(): ReplayStore;
 //#endregion

package/dist/{request-context-BTRTG7OT.js → request-context-C81Pip9n.js}

@@ -1,6 +1,6 @@
 import { t as assertAppData } from "./app-data-MuyzVqX8.js";
 import { n as wrapPermDock } from "./wrap-gX61EtpB.js";
-import { t as buildInstance } from "./build-instance-BMnAudHn.js";
+import { t as buildInstance } from "./build-instance-Bu_eDqYw.js";
 //#region src/core/request-context.ts
 /**
 * Errors an adapter raises around one instance (a `context` hook that threw,

package/dist/resend/index.d.ts

@@ -1,7 +1,7 @@
-import { q as DecisionSink } from "../policy-types-DzwivBgR.js";
-import { n as ApprovalUrl, t as ApprovalPrompt } from "../approval-prompt-Djo_PyZc.js";
-import { d as EmailTransport, o as DeliveryResult, u as EmailMessage } from "../types-DX0LaKTb.js";
-import { l as ReplayStore } from "../types-DiQjupG2.js";
+import { q as DecisionSink } from "../policy-types-n0uRTsW8.js";
+import { n as ApprovalUrl, t as ApprovalPrompt } from "../approval-prompt-DvSSPQJX.js";
+import { d as EmailTransport, o as DeliveryResult, u as EmailMessage } from "../types-BtHtcKMr.js";
+import { l as ReplayStore } from "../types-C791HFu9.js";
 //#region src/resend/approval-email.d.ts
 type ApprovalEmailOptions = {
   /** The app's approval page: a base the request id is appended to, or a function of the prompt. Must be https. */

package/dist/{rls-BA8an5Ap.js → rls-BAqP4q66.js}

@@ -186,7 +186,7 @@ async function rlsInput(ctx, verb, shape, options) {
 	};
 }
 async function runRls(input) {
-	return (await import("./rls-j6t43t7n.js")).runRls(input);
+	return (await import("./rls-DTvYd-lI.js")).runRls(input);
 }
 const generate = defineLeaf({
 	flags: {