permdock 0.5.0 → 0.6.0

package/dist/{rls-j6t43t7n.js → rls-DTvYd-lI.js}

@@ -2,7 +2,7 @@ import { t as compact } from "./compact-CAf557ZB.js";
 import { c as listPermissions, u as renamedKeys } from "./permission-registry-Br4jSNVi.js";
 import { i as dateAt } from "./time-DkWjdL98.js";
 import { d as scopeList, o as resolveScope } from "./scopes-CUPSjo9q.js";
-import { o as flattenGrantee, v as listRoles } from "./grantee-Cn1HyUsI.js";
+import { o as flattenGrantee, v as listRoles } from "./grantee-hxrUsbpM.js";
 import { p as scopeField } from "./tenancy-DN2QAx9z.js";
 import { a as describeError, i as configError, o as exitCodeOfError, u as usageResult } from "./errors-CWTY6uih.js";
 import { t as policyRowConditionKeys } from "./row-conditions-h2HythXQ.js";
@@ -10,20 +10,20 @@ import { c as requirePolicy } from "./load-DFS_ry0W.js";
 import "./budget-NbEtbJC_.js";
 import { i as qualifySqlTable, r as escapeSqlIdent, u as sqlTextArray } from "./sql-B5T1IL83.js";
 import { l as roleColumn } from "./sources-vs5dGOsS.js";
-import { t as policyFromCatalog } from "./policy-from-catalog-DzhEc3Y9.js";
+import { t as policyFromCatalog } from "./policy-from-catalog-C2gMa2Dj.js";
 import { t as beforeFirst } from "./text-BMFRfBqc.js";
 import { i as INDEXES_MARKER, n as GRANTS_MARKER, o as SEEDS_MARKER, t as BACKFILL_MARKER } from "./markers-C6joDI3o.js";
 import { i as requirePeer, n as packageManagerOf, t as addLine } from "./peer-C8swJ2GH.js";
 import { t as POLICY_NOT_PUBLISHED } from "./problem-types-CJ2325SZ.js";
-import { t as fetchProjectPolicy } from "./pull-BgIfno6w.js";
+import { t as fetchProjectPolicy } from "./pull-jEwbf80J.js";
 import { a as isSeedsDirectory, c as parseSplit, d as seedsMigration, f as writeOutputFiles, l as partPath, n as dataMigrationFile, r as driftOf, u as pgDeltaPath } from "./output-files-DhRBBE4n.js";
-import { c as approvalsSql, d as resolveAuthorize, h as schemasRefusal, l as parseRbacAuthorize, m as resolveSchemas, o as supabaseHookSql, p as isSupabaseSchemas, s as permissionHoldersSql, t as grantsLabel, u as rbacScaffold } from "./supabase-hook-DdDQhMlw.js";
-import { C as parseMembershipsFlag, E as scopeTypeOf, F as quoteQualified, I as quoteTable, M as qualified, N as quoteIdent$1, O as tenantTypeOf, P as quoteLiteral, _ as subjectClaimJsonSql, a as customRolesOn, c as SESSION_LIVE_HELPER, g as sessionLiveHelperSql, r as HELPERS, t as CUSTOM_ROLES, y as subjectIdSql } from "./shared-CD11nBbC.js";
+import { c as approvalsSql, d as resolveAuthorize, h as schemasRefusal, l as parseRbacAuthorize, m as resolveSchemas, o as supabaseHookSql, p as isSupabaseSchemas, s as permissionHoldersSql, t as grantsLabel, u as rbacScaffold } from "./supabase-hook-BMoEhZir.js";
+import { C as parseMembershipsFlag, E as scopeTypeOf, F as quoteQualified, I as quoteTable, M as qualified, N as quoteIdent$1, O as tenantTypeOf, P as quoteLiteral, _ as subjectClaimJsonSql, a as customRolesOn, c as SESSION_LIVE_HELPER, g as sessionLiveHelperSql, r as HELPERS, t as CUSTOM_ROLES, y as subjectIdSql } from "./shared-BAK8t4Uo.js";
 import { a as splitUndiffed } from "./deciding-columns-Sq12mEA6.js";
-import { a as readOnlyActorKinds, c as branchClauses, d as connectPgPool, i as orSql, n as actorMayWriteSql, o as readOnlyActorPolicies, r as assemblePolicies, t as ACTOR_MAY_WRITE } from "./policies-CO1oOymN.js";
-import { $ as checkSuspension, A as roleNames, D as breakGlassHolder, E as apiKeysPlan, F as graphHelper, I as graphSqlName, O as breakGlassKey, S as byKey, W as memberIdsHelper, X as scopeTable, Y as scopeSources, _ as currentKeyExpr, f as permittedByPermissionHelper, g as seedSql, h as helpersSql, i as assignmentSql, k as collectGrants, m as accessSql, n as ownershipSql, q as permittedIdsHelper, t as ownershipRules, u as permissionHelpersSql, x as byCodeUnit } from "./ownership-BatFgAA4.js";
-import { _ as indexesSql, a as graphSql, c as callsHelper, g as indexTargets, h as COLUMNS_SQL, i as graphPlan, l as helperCallKeys, m as tableFor, n as runRlsVerify, o as HELPER_TABLES, p as compileGrants, r as closureDepths, v as pruneIndexTargets, y as readTableIndexFacts } from "./verify-DbCL9bnB.js";
-import { a as fieldViewsSql, i as fieldViews, n as columnGrantSql, o as rowBranches, r as columnRevokeSql } from "./fields-D9tPVUUS.js";
+import { a as readOnlyActorKinds, c as branchClauses, d as connectPgPool, i as orSql, n as actorMayWriteSql, o as readOnlyActorPolicies, r as assemblePolicies, t as ACTOR_MAY_WRITE } from "./policies-DP2nqRoF.js";
+import { A as collectGrants, C as byKey, D as apiKeysPlan, G as memberIdsHelper, I as graphHelper, J as permittedIdsHelper, L as graphSqlName, O as breakGlassHolder, S as byCodeUnit, X as scopeSources, Z as scopeTable, b as currentKeyExpr, et as checkSuspension, f as permittedByPermissionHelper, g as seedSql, h as helpersSql, i as assignmentSql, j as roleNames, k as breakGlassKey, m as accessSql, n as ownershipSql, t as ownershipRules, u as permissionHelpersSql, x as rolesTableScope } from "./ownership-DqaJNJPn.js";
+import { _ as indexesSql, a as graphSql, c as callsHelper, g as indexTargets, h as COLUMNS_SQL, i as graphPlan, l as helperCallKeys, m as tableFor, n as runRlsVerify, o as HELPER_TABLES, p as compileGrants, r as closureDepths, v as pruneIndexTargets, y as readTableIndexFacts } from "./verify-BaAKx7t6.js";
+import { a as fieldViewsSql, i as fieldViews, n as columnGrantSql, o as rowBranches, r as columnRevokeSql } from "./fields-OYG_JR78.js";
 import { t as supautilsRejections } from "./supautils-B6HYL9eL.js";
 import { basename, delimiter, join } from "node:path";
 import { spawn } from "node:child_process";
@@ -509,7 +509,7 @@ function backfillSql(ctx, from, migrate) {
 	const tenantType = tenantTypeOf(ctx);
 	const rolesTable = quoteQualified(roles.table);
 	const tenant = roles.tenant === void 0 ? `null::${tenantType}` : `${col(roles.tenant)}::${tenantType}`;
-	const scope = roles.scope === void 0 ? `case when ${tenant} is null then 'global' else ${quoteLiteral(root)} end` : `case when ${tenant} is null then 'global' else ${col(roles.scope)}::text end`;
+	const scope = rolesTableScope(roles, tenant, root, col);
 	const scopeId = roles.id === void 0 ? "null::text" : `${col(roles.id)}::text`;
 	const skipped = roles.skip === void 0 ? "false" : `coalesce(${col(roles.skip)}, false)`;
 	const renamed = custom.renamed ?? {};
@@ -2348,7 +2348,7 @@ async function migrate(input) {
 		output: generated.output
 	};
 	await requirePeer(() => import("pgsql-parser"), "pgsql-parser", "permdock rls migrate", input.cwd);
-	const { migrateTarget, runRlsMigrate } = await import("./migrate-BShP7Vf4.js");
+	const { migrateTarget, runRlsMigrate } = await import("./migrate-CIq4-E9F.js");
 	return runRlsMigrate({
 		cwd: input.cwd,
 		sql: input.sql,
@@ -2468,7 +2468,7 @@ async function runRls(input) {
 		}
 		case "import": {
 			await requirePeer(() => import("pgsql-parser"), "pgsql-parser", "permdock rls import", input.cwd);
-			const { runRlsImport } = await import("./import-DMmOG27O.js");
+			const { runRlsImport } = await import("./import-wyqXUyjm.js");
 			return runRlsImport({
 				cwd: input.cwd,
 				config: input.config,

package/dist/{role-builder-CXbis5-X.js → role-builder-uWQZ4v84.js}

@@ -7,7 +7,7 @@ import { c as listPermissions, o as isPermission } from "./permission-registry-B
 import { n as assertMetaValue, r as parseAppData, t as assertAppData } from "./app-data-MuyzVqX8.js";
 import { d as isSelfParented } from "./resource-relations-D_jw0BFx.js";
 import { a as durationOf, r as assertDuration } from "./time-DkWjdL98.js";
-import { a as authenticated, d as roleScopeOf, g as isRole, o as flattenGrantee, r as asGrantee, u as roleNameOf } from "./grantee-Cn1HyUsI.js";
+import { a as authenticated, d as roleScopeOf, g as isRole, o as flattenGrantee, r as asGrantee, u as roleNameOf } from "./grantee-hxrUsbpM.js";
 import { c as sanitizeFields, n as normalizeValidity } from "./validity-CZ7-y0Cj.js";
 //#region src/conditions/opaque.ts
 function opaque(input) {

package/dist/{rpc-aPyNi6tA.js → rpc-VSl5ylaQ.js}

@@ -1,7 +1,7 @@
 import { t as compact } from "./compact-CAf557ZB.js";
 import { s as requestFromContext } from "./http-BBoKefeS.js";
 import { n as tenantScope } from "./adapter-context-CRhqyzCk.js";
-import { t as adapterKernel } from "./bind-CZzhx-Vj.js";
+import { t as adapterKernel } from "./bind-CAvgUuKs.js";
 import { r as guardIterable } from "./stream-CvdUS9V1.js";
 //#region src/server/rpc.ts
 /** The tRPC and oRPC error code for a Problem Details status. */

package/dist/{run-DOfMtc9V.js → run-CUKuz0A8.js}

@@ -5,9 +5,9 @@ import { a as resolveCwd, i as readConfig } from "./config-bs_kZeYq.js";
 import { t as beforeFirst } from "./text-BMFRfBqc.js";
 import { a as suggestion, i as parseLeaf, n as flagSpellings, o as GLOBAL_FLAGS, r as parseFlags } from "./args-IIolxxKA.js";
 import { r as progressReporter, t as redact } from "./credentials-DPyHmYz5.js";
-import { a as resolve, i as leaves, n as ROOT, r as SECTIONS, t as DOCS_BASE } from "./manifest-CtKR3GXL.js";
+import { a as resolve, i as leaves, n as ROOT, r as SECTIONS, t as DOCS_BASE } from "./manifest-dvL2XEe1.js";
 import { t as createStyle } from "./style-Uao76wO7.js";
-import { a as sarifLog, i as githubAnnotations, n as envelope, t as dataOf } from "./output-Dyw8fyPF.js";
+import { a as sarifLog, i as githubAnnotations, n as envelope, t as dataOf } from "./output-1im__-08.js";
 import { i as renameMessage, r as flagRename, t as COMMAND_MOVES } from "./renames-CGj7YwcQ.js";
 import { stripVTControlCharacters } from "node:util";
 import { existsSync, statSync } from "node:fs";

package/dist/run-DDwUaJDU.js

@@ -0,0 +1 @@
+export { t as run } from "./run-CUKuz0A8.js";

package/dist/{run-ticket-BjhTOi6u.d.ts → run-ticket-DocwaTKn.d.ts}

@@ -1,5 +1,5 @@
-import { $n as Delegation, Rt as Instant, Yn as AuthorizationDetail, dt as TokenVerifier, ir as Subject, lt as TokenFailureCause, qn as Actor, qt as AuthEvent, rr as Principal, ut as TokenSigner } from "./policy-types-DzwivBgR.js";
-import { p as PrincipalSource } from "./permdock-D7eeLJER.js";
+import { $n as Delegation, Rt as Instant, Yn as AuthorizationDetail, ar as Subject, dt as TokenVerifier, lt as TokenFailureCause, qn as Actor, qt as AuthEvent, rr as Principal, ut as TokenSigner } from "./policy-types-n0uRTsW8.js";
+import { p as PrincipalSource } from "./permdock-SV8ZINYT.js";
 //#region src/server/run-ticket.d.ts
 /** What started the run: a saved automation, a background job, or a caller's own request. */
 type RunKind = "automation" | "job" | "caller";

package/dist/{saas-FO-Q8oj0.js → saas-BCXRuXca.js}

@@ -1,12 +1,12 @@
 import { r as isRecord } from "./compact-CAf557ZB.js";
 import { r as principal } from "./refs-K6eWUJ0H.js";
-import { a as deny, n as role, r as allow } from "./role-builder-CXbis5-X.js";
-import { E as memoryCustomRoleSource, _ as limits, g as memoryRelationSource, v as memoryLimitStore } from "./src-DLfUWFAI.js";
+import { a as deny, n as role, r as allow } from "./role-builder-uWQZ4v84.js";
+import { E as memoryCustomRoleSource, _ as limits, g as memoryRelationSource, v as memoryLimitStore } from "./src-Cu2m75uo.js";
 import { h as secondsAt } from "./time-DkWjdL98.js";
-import { l as relation, n as anyone } from "./grantee-Cn1HyUsI.js";
-import { n as definePolicy } from "./policy-DLZJ5gAp.js";
+import { l as relation, n as anyone } from "./grantee-hxrUsbpM.js";
+import { n as definePolicy } from "./policy-DbM5YYtV.js";
 import { s as quoteSqlLiteral } from "./sql-B5T1IL83.js";
-import { a as saasPlans, i as saasPermissions, o as saasRoles } from "./permissions-CZKiUfFM.js";
+import { a as saasPlans, i as saasPermissions, o as saasRoles } from "./permissions-BPxlwVhN.js";
 //#region src/testing/saas/policy.ts
 function isSubject(user) {
 	return user !== null && "context" in user && "principal" in user;

package/dist/{scan-BOI5tJ-6.js → scan-qvOe0hS3.js}

@@ -16,7 +16,7 @@ const scan = defineLeaf({
 		}
 	},
 	async run(ctx, { flags }) {
-		const { runAdoptionScan } = await import("./adoption-scan-B4R5fnMU.js");
+		const { runAdoptionScan } = await import("./adoption-scan-DCYe60Pi.js");
 		return runAdoptionScan({
 			cwd: ctx.cwd,
 			srcPath: flags.src.length > 0 ? flags.src : ctx.config.collect?.srcPath ?? ["src"],

package/dist/scim/index.d.ts

@@ -1,2 +1,2 @@
-import { A as ScimPage, C as GROUP_SCHEMA, D as SCIM_CONTENT_TYPE, E as ROLES_EXTENSION, F as isDirectoryNotFoundError, I as isDirectoryUniquenessError, M as ScimPatchOp, N as ScimTokenOptions, O as ScimFilter, P as USER_SCHEMA, S as ERROR_SCHEMA, T as PATCH_SCHEMA, _ as DirectoryMembershipSourceOptions, a as scimHandler, b as DirectoryUniquenessError, c as parseScimFilter, d as serviceProviderConfig, f as authenticateScim, g as DirectoryGroup, h as DirectoryChange, i as tenantFromPath, j as ScimPageResult, k as ScimHandlerOptions, l as resourceTypes, m as APP_DATA_EXTENSION, n as directoryMembershipSource, o as filterSupported, p as sha256Hex, r as normalizePatchOps, s as matchFilter, t as memoryDirectoryStore, u as schemas, v as DirectoryNotFoundError, w as LIST_SCHEMA, x as DirectoryUser, y as DirectoryStore } from "../index-SGdIQyzc.js";
+import { A as ScimPage, C as GROUP_SCHEMA, D as SCIM_CONTENT_TYPE, E as ROLES_EXTENSION, F as isDirectoryNotFoundError, I as isDirectoryUniquenessError, M as ScimPatchOp, N as ScimTokenOptions, O as ScimFilter, P as USER_SCHEMA, S as ERROR_SCHEMA, T as PATCH_SCHEMA, _ as DirectoryMembershipSourceOptions, a as scimHandler, b as DirectoryUniquenessError, c as parseScimFilter, d as serviceProviderConfig, f as authenticateScim, g as DirectoryGroup, h as DirectoryChange, i as tenantFromPath, j as ScimPageResult, k as ScimHandlerOptions, l as resourceTypes, m as APP_DATA_EXTENSION, n as directoryMembershipSource, o as filterSupported, p as sha256Hex, r as normalizePatchOps, s as matchFilter, t as memoryDirectoryStore, u as schemas, v as DirectoryNotFoundError, w as LIST_SCHEMA, x as DirectoryUser, y as DirectoryStore } from "../index-Ch8LpNDp.js";
 export { APP_DATA_EXTENSION, type DirectoryChange, type DirectoryGroup, type DirectoryMembershipSourceOptions, DirectoryNotFoundError, type DirectoryStore, DirectoryUniquenessError, type DirectoryUser, ERROR_SCHEMA, GROUP_SCHEMA, LIST_SCHEMA, PATCH_SCHEMA, ROLES_EXTENSION, SCIM_CONTENT_TYPE, type ScimFilter, type ScimHandlerOptions, type ScimPage, type ScimPageResult, type ScimPatchOp, type ScimTokenOptions, USER_SCHEMA, authenticateScim, directoryMembershipSource, filterSupported, isDirectoryNotFoundError, isDirectoryUniquenessError, matchFilter, memoryDirectoryStore, normalizePatchOps, parseScimFilter, resourceTypes, schemas, scimHandler, serviceProviderConfig, sha256Hex, tenantFromPath };

package/dist/server/index.d.ts

@@ -1,13 +1,13 @@
-import { n as PermDockValidationError, t as PROBLEM_BASE } from "../validation-error-Bg5Tpluk.js";
-import { i as PermDockRevokedError, n as PermDockApprovalRequiredError, r as PermDockDeniedError, t as ApprovalHint } from "../errors-C2PXIv4c.js";
+import { n as PermDockValidationError, t as PROBLEM_BASE } from "../validation-error-DHUrAkku.js";
+import { i as PermDockRevokedError, n as PermDockApprovalRequiredError, r as PermDockDeniedError, t as ApprovalHint } from "../errors-DH5QEGXh.js";
 import { t as RequestContext } from "../request-context-C2_1lchh.js";
 import { i as memoryRevocationFeed, n as RevocationFeed, t as RevocationEvent } from "../revocations-R07lFBnX.js";
-import { C as TenantScope, D as ConnectionOptions, E as ConnectionData, S as TenantOption, T as Connection, _ as WebBotAuthVerifier, a as OperationScopes, b as invalidSignatureResponse, c as ServerPermDock, d as DiscoverViaSignatureAgentOptions, f as InvalidSignatureError, g as WebBotAuthOptions, h as WebBotAuthKeys, i as OpenApiHooks, l as ServerPermDockOptions, m as WebBotAuthKeyLookup, n as DeniedResponseEvent, o as ProtectOptions, p as WebBotAuthJwk, r as Guard, s as ScopeGuard, t as DeniedResponse, u as SnapshotQuery, v as discoverViaSignatureAgent, w as tenantScope, x as webBotAuthVerifier, y as invalidSignatureProblem } from "../server-types-BLd4MnBX.js";
-import { i as evaluationsHandler } from "../evaluations-16UqqQ6W.js";
-import { C as subjectFromApiKey, E as createPermDock, S as parseFeedKey, T as problemFromError, _ as generateApiKey, a as SupportSessionContext, b as memoryCredentialStore, c as SupportSessionSubjectOptions, d as ApiKeyFailureCause, f as ApiKeyParts, g as apiKeyVerifier, h as StoredCredential, i as wwwAuthenticate, l as signSupportSession, m as MemoryCredentialStore, n as problemResponse, o as SupportSessionFailureCause, p as ApiKeySubjectOptions, r as validationProblem, s as SupportSessionSource, t as problemFromDecision, u as subjectFromSupportSession, v as generateFeedKey, w as ProblemFromErrorOptions, x as parseApiKey, y as hashApiKey } from "../index-Chrs5fQ-.js";
-import { l as ReplayStore } from "../types-DiQjupG2.js";
-import { a as WebhookInput, c as WebhookMessage, d as WebhookSigningKey, f as WebhookVerifier, h as webhookVerifier, i as WebhookHeaders, l as WebhookSigner, m as webhookSigner, n as WebhookAlgorithm, o as WebhookJwk, p as WebhookVerifierOptions, r as WebhookFailureCause, s as WebhookJwks, t as VerifiedWebhookMessage, u as WebhookSignerOptions } from "../standard-webhooks-6lg8v_is.js";
-import { t as memoryReplayStore } from "../replay-D7iKcLFe.js";
-import { a as snapshotHeaders, i as cacheLifeFor, n as SnapshotHeaders, o as snapshotTag, r as SnapshotHeadersOptions, t as CacheLifeForOptions } from "../snapshot-cache-DqK9eDmM.js";
-import { a as RunKind, c as RunTicketAutomations, d as RunTicketOptions, f as RunTicketSubjectOptions, h as subjectFromRunTicket, i as RunContext, l as RunTicketFailureCause, m as signRunTicket, n as RunAutomation, o as RunPrincipal, p as parseRunTicket, r as RunBinding, s as RunTicket, t as RunActClaim, u as RunTicketInput } from "../run-ticket-BjhTOi6u.js";
+import { C as TenantScope, D as ConnectionOptions, E as ConnectionData, S as TenantOption, T as Connection, _ as WebBotAuthVerifier, a as OperationScopes, b as invalidSignatureResponse, c as ServerPermDock, d as DiscoverViaSignatureAgentOptions, f as InvalidSignatureError, g as WebBotAuthOptions, h as WebBotAuthKeys, i as OpenApiHooks, l as ServerPermDockOptions, m as WebBotAuthKeyLookup, n as DeniedResponseEvent, o as ProtectOptions, p as WebBotAuthJwk, r as Guard, s as ScopeGuard, t as DeniedResponse, u as SnapshotQuery, v as discoverViaSignatureAgent, w as tenantScope, x as webBotAuthVerifier, y as invalidSignatureProblem } from "../server-types-CKQiCnON.js";
+import { i as evaluationsHandler } from "../evaluations-C_1vdSZc.js";
+import { C as subjectFromApiKey, E as createPermDock, S as parseFeedKey, T as problemFromError, _ as generateApiKey, a as SupportSessionContext, b as memoryCredentialStore, c as SupportSessionSubjectOptions, d as ApiKeyFailureCause, f as ApiKeyParts, g as apiKeyVerifier, h as StoredCredential, i as wwwAuthenticate, l as signSupportSession, m as MemoryCredentialStore, n as problemResponse, o as SupportSessionFailureCause, p as ApiKeySubjectOptions, r as validationProblem, s as SupportSessionSource, t as problemFromDecision, u as subjectFromSupportSession, v as generateFeedKey, w as ProblemFromErrorOptions, x as parseApiKey, y as hashApiKey } from "../index-B8YjkEZ4.js";
+import { l as ReplayStore } from "../types-C791HFu9.js";
+import { a as WebhookInput, c as WebhookMessage, d as WebhookSigningKey, f as WebhookVerifier, h as webhookVerifier, i as WebhookHeaders, l as WebhookSigner, m as webhookSigner, n as WebhookAlgorithm, o as WebhookJwk, p as WebhookVerifierOptions, r as WebhookFailureCause, s as WebhookJwks, t as VerifiedWebhookMessage, u as WebhookSignerOptions } from "../standard-webhooks-rbD7LS6h.js";
+import { t as memoryReplayStore } from "../replay-Bkm-Ne4l.js";
+import { a as snapshotHeaders, i as cacheLifeFor, n as SnapshotHeaders, o as snapshotTag, r as SnapshotHeadersOptions, t as CacheLifeForOptions } from "../snapshot-cache-PXI-vGpY.js";
+import { a as RunKind, c as RunTicketAutomations, d as RunTicketOptions, f as RunTicketSubjectOptions, h as subjectFromRunTicket, i as RunContext, l as RunTicketFailureCause, m as signRunTicket, n as RunAutomation, o as RunPrincipal, p as parseRunTicket, r as RunBinding, s as RunTicket, t as RunActClaim, u as RunTicketInput } from "../run-ticket-DocwaTKn.js";
 export { type ApiKeyFailureCause, type ApiKeyParts, type ApiKeySubjectOptions, type ApprovalHint, type CacheLifeForOptions, type Connection, type ConnectionData, type ConnectionOptions, type DeniedResponse, type DeniedResponseEvent, type DiscoverViaSignatureAgentOptions, type Guard, InvalidSignatureError, type MemoryCredentialStore, type OpenApiHooks, type OperationScopes, PROBLEM_BASE, PermDockApprovalRequiredError, PermDockDeniedError, PermDockRevokedError, PermDockValidationError, type ProblemFromErrorOptions, type ProtectOptions, type ReplayStore, type RequestContext, type RevocationEvent, type RevocationFeed, type RunActClaim, type RunAutomation, type RunBinding, type RunContext, type RunKind, type RunPrincipal, type RunTicket, type RunTicketAutomations, type RunTicketFailureCause, type RunTicketInput, type RunTicketOptions, type RunTicketSubjectOptions, type ScopeGuard, type ServerPermDock, type ServerPermDockOptions, type SnapshotHeaders, type SnapshotHeadersOptions, type SnapshotQuery, type StoredCredential, type SupportSessionContext, type SupportSessionFailureCause, type SupportSessionSource, type SupportSessionSubjectOptions, type TenantOption, type TenantScope, type VerifiedWebhookMessage, type WebBotAuthJwk, type WebBotAuthKeyLookup, type WebBotAuthKeys, type WebBotAuthOptions, type WebBotAuthVerifier, type WebhookAlgorithm, type WebhookFailureCause, type WebhookHeaders, type WebhookInput, type WebhookJwk, type WebhookJwks, type WebhookMessage, type WebhookSigner, type WebhookSignerOptions, type WebhookSigningKey, type WebhookVerifier, type WebhookVerifierOptions, apiKeyVerifier, cacheLifeFor, createPermDock, discoverViaSignatureAgent, evaluationsHandler, generateApiKey, generateFeedKey, hashApiKey, invalidSignatureProblem, invalidSignatureResponse, memoryCredentialStore, memoryReplayStore, memoryRevocationFeed, parseApiKey, parseFeedKey, parseRunTicket, problemFromDecision, problemFromError, problemResponse, signRunTicket, signSupportSession, snapshotHeaders, snapshotTag, subjectFromApiKey, subjectFromRunTicket, subjectFromSupportSession, tenantScope, validationProblem, webBotAuthVerifier, webhookSigner, webhookVerifier, wwwAuthenticate };

package/dist/server/index.js

@@ -4,11 +4,11 @@ import { t as memoryRevocationFeed } from "../revocations-Bhr0aMIC.js";
 import { c as problemResponse, d as validationProblem, f as wwwAuthenticate, s as problemFromDecision } from "../problem-CTviyH5L.js";
 import { t as memoryReplayStore } from "../replay-Du1tJjG7.js";
 import { n as snapshotHeaders, r as snapshotTag, t as cacheLifeFor } from "../snapshot-cache-DZHQ0KF6.js";
-import { d as discoverViaSignatureAgent, f as invalidSignatureProblem, m as webBotAuthVerifier, o as evaluationsHandler, p as invalidSignatureResponse, u as InvalidSignatureError } from "../evaluations-DZ2CbV5k.js";
+import { d as discoverViaSignatureAgent, f as invalidSignatureProblem, m as webBotAuthVerifier, o as evaluationsHandler, p as invalidSignatureResponse, u as InvalidSignatureError } from "../evaluations-beAooV0n.js";
 import { n as tenantScope } from "../adapter-context-CRhqyzCk.js";
-import { t as createPermDock } from "../create-DnrmLnLW.js";
-import { a as generateFeedKey, c as parseApiKey, i as generateApiKey, l as parseFeedKey, n as subjectFromSupportSession, o as hashApiKey, r as apiKeyVerifier, s as memoryCredentialStore, t as signSupportSession, u as subjectFromApiKey } from "../server-DqCT4CgZ.js";
+import { t as createPermDock } from "../create-DCF2SvoT.js";
+import { a as generateFeedKey, c as parseApiKey, i as generateApiKey, l as parseFeedKey, n as subjectFromSupportSession, o as hashApiKey, r as apiKeyVerifier, s as memoryCredentialStore, t as signSupportSession, u as subjectFromApiKey } from "../server-C3WXAHZj.js";
 import { n as signRunTicket, r as subjectFromRunTicket, t as parseRunTicket } from "../run-ticket-sxFI6LAk.js";
-import { t as problemFromError } from "../map-error-TCAdw-eW.js";
+import { t as problemFromError } from "../map-error-Dr70oA_3.js";
 import { n as webhookVerifier, t as webhookSigner } from "../standard-webhooks-DgFFD-Ga.js";
 export { InvalidSignatureError, PROBLEM_BASE, PermDockApprovalRequiredError, PermDockDeniedError, PermDockRevokedError, PermDockValidationError, apiKeyVerifier, cacheLifeFor, createPermDock, discoverViaSignatureAgent, evaluationsHandler, generateApiKey, generateFeedKey, hashApiKey, invalidSignatureProblem, invalidSignatureResponse, memoryCredentialStore, memoryReplayStore, memoryRevocationFeed, parseApiKey, parseFeedKey, parseRunTicket, problemFromDecision, problemFromError, problemResponse, signRunTicket, signSupportSession, snapshotHeaders, snapshotTag, subjectFromApiKey, subjectFromRunTicket, subjectFromSupportSession, tenantScope, validationProblem, webBotAuthVerifier, webhookSigner, webhookVerifier, wwwAuthenticate };

package/dist/{server-DqCT4CgZ.js → server-C3WXAHZj.js}

@@ -7,7 +7,7 @@ import { t as bytesToBase64Url } from "./sha256-D9ihqmvd.js";
 import { n as parseSupportSession } from "./support-session-C6xJQYut.js";
 import { t as anonymousSubject } from "./subject-BGoM5o8B.js";
 import { c as credentialEvent } from "./sink-BEZSlMS_.js";
-import { i as credentialTenant, n as credentialPolicyViolation, o as isFeedId, r as credentialSubject, s as parseCredential } from "./credential-DM2um3ha.js";
+import { i as credentialTenant, n as credentialPolicyViolation, o as isFeedId, r as credentialSubject, s as parseCredential } from "./credential-BcoiejpY.js";
 //#region src/server/credentials.ts
 const PREFIX = "pdk_";
 const ID = /^[\w-]{1,128}$/u;

package/dist/{server-types-BLd4MnBX.d.ts → server-types-CKQiCnON.d.ts}

@@ -1,14 +1,14 @@
-import { Nn as Decision, Rt as Instant, Vt as Snapshot, ir as Subject, j as PolicyVocabulary, qn as Actor, tr as JsonWebKeyLike } from "./policy-types-DzwivBgR.js";
-import { w as Permission } from "./vocabulary-D6lPdb4Z.js";
-import { r as PermDock, s as SnapshotOptions } from "./permdock-D7eeLJER.js";
-import { m as ApprovalStore } from "./types-CCpc2Dcv.js";
-import { a as ProblemDetails, t as ApprovalHint } from "./errors-C2PXIv4c.js";
-import { t as InstanceOptions } from "./instance-options-Omfd793B.js";
+import { Nn as Decision, Rt as Instant, Vt as Snapshot, ar as Subject, j as PolicyVocabulary, qn as Actor, tr as JsonWebKeyLike } from "./policy-types-n0uRTsW8.js";
+import { w as Permission } from "./vocabulary-CN8H_9UF.js";
+import { r as PermDock, s as SnapshotOptions } from "./permdock-SV8ZINYT.js";
+import { m as ApprovalStore } from "./types-BdtSDbBO.js";
+import { a as ProblemDetails, t as ApprovalHint } from "./errors-DH5QEGXh.js";
+import { t as InstanceOptions } from "./instance-options-BsVpyGIk.js";
 import { t as RequestContext } from "./request-context-C2_1lchh.js";
-import { n as PermDockWrap } from "./wrap-Bd1Tejur.js";
+import { n as PermDockWrap } from "./wrap-C5jC6sKI.js";
 import { n as RevocationFeed } from "./revocations-R07lFBnX.js";
-import { r as PdpFactory } from "./types-ClZaWzfb.js";
-import { i as evaluationsHandler } from "./evaluations-16UqqQ6W.js";
+import { r as PdpFactory } from "./types-_WhUP7ud.js";
+import { i as evaluationsHandler } from "./evaluations-C_1vdSZc.js";
 //#region src/server/connection.d.ts
 type ConnectionData<T> = T | (() => T | null | undefined | Promise<T | null | undefined>);
 type ConnectionOptions<T = unknown> = {

package/dist/{shared-CD11nBbC.js → shared-BAK8t4Uo.js}

@@ -285,7 +285,8 @@ const CUSTOM_ROLES = {
 	trustedReplace: "permdock_trusted_replace_custom_role_grants",
 	trustedRename: "permdock_trusted_rename_custom_role_grants",
 	trustedRemove: "permdock_trusted_delete_custom_role_grants",
-	cascade: "permdock_cascade_custom_role"
+	cascade: "permdock_cascade_custom_role",
+	shared: "permdock_is_shared_role"
 };
 /** The function `rls.roles` adds. The name is part of the SQL contract. */
 const GLOBAL_ROLES = { replace: "permdock_replace_global_roles" };

package/dist/{sink-Bj_lDUDq.d.ts → sink-4-eQIRWf.d.ts}

@@ -1,7 +1,7 @@
-import { Ct as Credential, Jt as AutomationEvent, Kt as AccessEvent, Yt as CredentialEvent, gt as SupportSession, nn as MembershipEvent, q as DecisionSink, rn as SinkEvent, ut as TokenSigner } from "./policy-types-DzwivBgR.js";
-import { V as AppData } from "./vocabulary-D6lPdb4Z.js";
-import { u as OperationRisk } from "./operations-CxybZErY.js";
-import { t as Automation } from "./automation-BMZPIVUM.js";
+import { Ct as Credential, Jt as AutomationEvent, Kt as AccessEvent, Yt as CredentialEvent, gt as SupportSession, nn as MembershipEvent, q as DecisionSink, rn as SinkEvent, ut as TokenSigner } from "./policy-types-n0uRTsW8.js";
+import { V as AppData } from "./vocabulary-CN8H_9UF.js";
+import { u as OperationRisk } from "./operations-X0VM7F3m.js";
+import { t as Automation } from "./automation-BNM3TtDo.js";
 //#region src/core/sink.d.ts
 /**
  * The closed list of CloudEvents `type` values, `com.permdock.<family>` or

package/dist/{snapshot-CXUWfsNy.js → snapshot-B7DkYg6g.js}

@@ -4,7 +4,7 @@ import { n as isForbiddenKey } from "./paths-DXSHAMIa.js";
 import { c as isConditionRef, i as resolveConditionRef } from "./refs-K6eWUJ0H.js";
 import { l as isRfc3339, m as rfc3339, p as nowSeconds } from "./time-DkWjdL98.js";
 import { d as scopeList } from "./scopes-CUPSjo9q.js";
-import { _ as listPlans, v as listRoles } from "./grantee-Cn1HyUsI.js";
+import { _ as listPlans, v as listRoles } from "./grantee-hxrUsbpM.js";
 import { i as wireValidity } from "./validity-CZ7-y0Cj.js";
 import { m as tenantsOf } from "./tenancy-DN2QAx9z.js";
 import { n as toWireDelegation } from "./wire-delegation-Cv3W2eaM.js";

package/dist/{snapshot-cache-DqK9eDmM.d.ts → snapshot-cache-PXI-vGpY.d.ts}

@@ -1,4 +1,4 @@
-import { Rt as Instant, Vt as Snapshot } from "./policy-types-DzwivBgR.js";
+import { Rt as Instant, Vt as Snapshot } from "./policy-types-n0uRTsW8.js";
 //#region src/core/snapshot-cache.d.ts
 type CacheLifeForOptions = {
   /** Lower bound in seconds. Next.js includes a private entry in per-link prefetches from 30. */

package/dist/solid/index.d.ts

@@ -1,10 +1,10 @@
-import { Mn as ApprovalRequiredDecision, Nn as Decision, Vt as Snapshot, dt as TokenVerifier, nr as Membership, zn as GrantedDecision } from "../policy-types-DzwivBgR.js";
-import { r as Role, w as Permission } from "../vocabulary-D6lPdb4Z.js";
-import { n as requiredPlans } from "../problem-details-DXlt-vks.js";
-import { i as describe, r as DescribeOptions, t as DecisionDescription } from "../describe-BZUsixiL.js";
+import { Mn as ApprovalRequiredDecision, Nn as Decision, Vt as Snapshot, dt as TokenVerifier, nr as Membership, zn as GrantedDecision } from "../policy-types-n0uRTsW8.js";
+import { r as Role, w as Permission } from "../vocabulary-CN8H_9UF.js";
+import { n as requiredPlans } from "../problem-details-B45V5d2b.js";
+import { i as describe, r as DescribeOptions, t as DecisionDescription } from "../describe-B5qgDvEW.js";
 import { t as PermissionBoundaryState } from "../boundary-BmHxVH1J.js";
 import { t as approvalHeaders } from "../headers-CIbDTUTK.js";
-import { a as FilterResult, c as PermissionSet, d as RolesOptions, f as SubjectView, i as ClientStatus, l as PermissionState, n as ApprovalState, p as TenantView, r as ClientPermDock, t as ApprovalHandle, u as ProviderOptionsBase } from "../types-BNORmDM8.js";
+import { a as FilterResult, c as PermissionSet, d as RolesOptions, f as SubjectView, i as ClientStatus, l as PermissionState, n as ApprovalState, p as TenantView, r as ClientPermDock, t as ApprovalHandle, u as ProviderOptionsBase } from "../types-B3_ooZgZ.js";
 import { Accessor, Accessor as Accessor$1, JSX } from "solid-js";
 //#region src/solid/types.d.ts
 /** Structural `JSX.Element`: text, a DOM node or a list of children. */

package/dist/solid/index.js

@@ -3,8 +3,8 @@ import { r as requiredPlans } from "../problem-details-cn5X30gZ.js";
 import { t as describe } from "../describe-BybMRY7A.js";
 import { n as boundaryFallback, t as boundaryDigest } from "../boundary-BM8a_P6E.js";
 import { t as approvalHeaders } from "../headers-BIjfMaoC.js";
-import { i as isPromiseLike } from "../store-options-BqEakYRa.js";
-import { n as switchTenant, t as providerStore } from "../provider-store-B5Yrkhzr.js";
+import { i as isPromiseLike } from "../store-options-u0ycEe8s.js";
+import { n as switchTenant, t as providerStore } from "../provider-store-DM6DNcta.js";
 import { a as livePermDock, c as rolesView, d as subjectView, f as tenantView, l as scopedTenant, n as describeWith, o as permissionSet, r as filterResult, s as protectedView, t as approvalHandle, u as slotContent } from "../views-DTIIO-oQ.js";
 import { ErrorBoundary, createComponent, createComputed, createContext, createMemo, createSignal, getOwner, on, onCleanup, useContext } from "solid-js";
 //#region src/solid/context.ts

package/dist/solid-start/index.d.ts

@@ -1,9 +1,9 @@
-import { T as Policy, Vt as Snapshot, j as PolicyVocabulary, rr as Principal } from "../policy-types-DzwivBgR.js";
-import { w as Permission } from "../vocabulary-D6lPdb4Z.js";
-import { a as OperationInput, t as Operation } from "../operations-CxybZErY.js";
-import { r as PermDock } from "../permdock-D7eeLJER.js";
-import { D as ConnectionOptions, T as Connection, f as InvalidSignatureError, i as OpenApiHooks, o as ProtectOptions, u as SnapshotQuery, v as discoverViaSignatureAgent, x as webBotAuthVerifier } from "../server-types-BLd4MnBX.js";
-import { a as ProtectTarget, n as FetchAdapterOptions, t as ContextReader } from "../fetch-adapter-qKJBuRqy.js";
+import { T as Policy, Vt as Snapshot, j as PolicyVocabulary, rr as Principal } from "../policy-types-n0uRTsW8.js";
+import { w as Permission } from "../vocabulary-CN8H_9UF.js";
+import { a as OperationInput, t as Operation } from "../operations-X0VM7F3m.js";
+import { r as PermDock } from "../permdock-SV8ZINYT.js";
+import { D as ConnectionOptions, T as Connection, f as InvalidSignatureError, i as OpenApiHooks, o as ProtectOptions, u as SnapshotQuery, v as discoverViaSignatureAgent, x as webBotAuthVerifier } from "../server-types-CKQiCnON.js";
+import { a as ProtectTarget, n as FetchAdapterOptions, t as ContextReader } from "../fetch-adapter-Dw0MTS3D.js";
 import { APIEvent, FetchEvent } from "@solidjs/start/server";
 //#region src/solid-start/create.d.ts
 /** The h3 event under every SolidStart request; `subject` and `scope` read it. */

package/dist/solid-start/index.js

@@ -1,6 +1,6 @@
-import { d as discoverViaSignatureAgent, m as webBotAuthVerifier, u as InvalidSignatureError } from "../evaluations-DZ2CbV5k.js";
-import { i as decorate } from "../bind-CZzhx-Vj.js";
-import { n as guardedRoute, t as fetchAdapter } from "../fetch-adapter-g0ypLkID.js";
+import { d as discoverViaSignatureAgent, m as webBotAuthVerifier, u as InvalidSignatureError } from "../evaluations-beAooV0n.js";
+import { i as decorate } from "../bind-CAvgUuKs.js";
+import { n as guardedRoute, t as fetchAdapter } from "../fetch-adapter-DD_gfmrC.js";
 //#region src/solid-start/create.ts
 /**
 * `event.locals`. Its type, `App.RequestEventLocals`, is declared by

package/dist/{sources-BV9j0DeZ.d.ts → sources-Xc4zkszI.d.ts}

@@ -1,5 +1,5 @@
-import { et as MembershipSource } from "./policy-types-DzwivBgR.js";
-import { n as RoleThrough, y as SupabaseSuspension } from "./types-CdlxsYQh.js";
+import { et as MembershipSource } from "./policy-types-n0uRTsW8.js";
+import { n as RoleThrough, y as SupabaseSuspension } from "./types-BzzaHxt3.js";
 import { o as SupabaseManifestMembership } from "./manifest-mx5ghSFM.js";
 //#region src/supabase/roles.d.ts
 /** A roles table a role column references, by `schema.table`. */

package/dist/{src-DLfUWFAI.js → src-Cu2m75uo.js}

@@ -1,7 +1,7 @@
 import { n as isReadonlyArray, r as isRecord, t as compact } from "./compact-CAf557ZB.js";
 import { n as freezeDeep } from "./freeze-CrU8nQeX.js";
 import { n as isForbiddenKey, r as ownGet } from "./paths-DXSHAMIa.js";
-import { f as normalizeApproval, g as assertSqlFunctionName, h as assertSqlFunctionArg, m as assertPortableTwin, p as normalizeWhere, u as assertApprovalRelations } from "./role-builder-CXbis5-X.js";
+import { f as normalizeApproval, g as assertSqlFunctionName, h as assertSqlFunctionArg, m as assertPortableTwin, p as normalizeWhere, u as assertApprovalRelations } from "./role-builder-uWQZ4v84.js";
 import { n as PermDockDeniedError } from "./errors-BKy0EfhN.js";
 import { o as sameId } from "./expiry-D4_YKRKD.js";
 import { n as internalsOf } from "./internals-Dk8A8fX3.js";
@@ -10,19 +10,19 @@ import { n as isThenable$1 } from "./thenable-yD7SabqG.js";
 import { c as isEdgeRelation, m as restrictedStops, o as groupEntries, s as isComputedRelation, u as isPrincipalRelation } from "./resource-relations-D_jw0BFx.js";
 import { a as durationOf, g as secondsOf, m as rfc3339, p as nowSeconds } from "./time-DkWjdL98.js";
 import { d as scopeList, l as scopeChain, m as tenantOf, o as resolveScope, u as scopeIdOf } from "./scopes-CUPSjo9q.js";
-import { u as evaluateCondition } from "./delegation-DaXVdDhM.js";
-import { _ as listPlans, a as authenticated, m as findRole, o as flattenGrantee } from "./grantee-Cn1HyUsI.js";
+import { u as evaluateCondition } from "./delegation-j6-rc37o.js";
+import { _ as listPlans, a as authenticated, m as findRole, o as flattenGrantee } from "./grantee-hxrUsbpM.js";
 import { m as tenantsOf, r as isMembershipExpired } from "./tenancy-DN2QAx9z.js";
-import { o as levelNames, r as grantList, t as declaredRoleNames } from "./policy-DLZJ5gAp.js";
-import { r as isPortableCondition } from "./hosted-BZIAYvon.js";
+import { o as levelNames, r as grantList, t as declaredRoleNames } from "./policy-DbM5YYtV.js";
+import { r as isPortableCondition } from "./hosted-B46-5LYE.js";
 import { n as OPERATION_RISKS, r as isOperationRisk } from "./permissions-B-wCP5ZC.js";
-import { b as tenantCustomRoles, f as customRoleId, l as ceilingGrants, p as customRoleScope, v as resolveCustomRole } from "./evaluate-_R8QkWaf.js";
-import { d as rankRoles, f as usesAssigns, i as collectSnapshotGrants, n as snapshotScopes, t as snapshotOf, u as bindingOf } from "./instance-snapshot-Cxq4ygFc.js";
+import { S as tenantCustomRoles, b as resolveCustomRole, f as customRoleId, l as ceilingGrants, m as customRoleScope, p as customRoleOf } from "./evaluate-CNClBvcj.js";
+import { d as rankRoles, f as usesAssigns, i as collectSnapshotGrants, n as snapshotScopes, t as snapshotOf, u as bindingOf } from "./instance-snapshot-BOEhcqIF.js";
 import { n as relationId } from "./relations-BnCWnJGI.js";
-import { r as snapshotGrant, t as buildSnapshot } from "./snapshot-CXUWfsNy.js";
+import { r as snapshotGrant, t as buildSnapshot } from "./snapshot-B7DkYg6g.js";
 import { n as LOCAL_CUSTOM_ROLE } from "./parse-local-manifest-CVSs6J9I.js";
-import { r as resolveSubject, s as APP } from "./permdock-B9JxkBwC.js";
-import { i as memoryApprovalStore } from "./store-4u_hxjWa.js";
+import { r as resolveSubject, s as APP } from "./permdock-BrAscV28.js";
+import { i as memoryApprovalStore } from "./store-BDutJkDL.js";
 import { n as wrapPermDock } from "./wrap-gX61EtpB.js";
 //#region src/conditions/sql-function.ts
 function sqlFunction(name, options) {
@@ -89,7 +89,12 @@ function memorySnapshotSource(initial) {
 function memoryCustomRoleSource(customRoles) {
 	const byTenant = /* @__PURE__ */ new Map();
 	const global = [];
+	const shared = [];
 	for (const role of customRoles) {
+		if (role.shared === true) {
+			shared.push(role);
+			continue;
+		}
 		if (role.tenant === void 0) {
 			global.push(role);
 			continue;
@@ -104,6 +109,9 @@ function memoryCustomRoleSource(customRoles) {
 		},
 		globalRoles() {
 			return [...global];
+		},
+		sharedRoles() {
+			return [...shared];
 		}
 	};
 }
@@ -1460,8 +1468,8 @@ function ofTenant(tenant, roles) {
 /**
 * A `CustomRoleSource` over a reader that returns every custom role of a tenant.
 * It keeps only the roles of the requested tenant. With `read: 'held'` it
-* skips a tenant's read, and `globalRoles`, when the subject holds only
-* declared roles there.
+* skips a tenant's read, and `globalRoles` and `sharedRoles`, when the
+* subject holds only declared roles there.
 */
 function customRoleSource(reader, options = {}) {
 	const declared = options.read === "held" ? declaredRoleNames(options.policy) : void 0;
@@ -1472,7 +1480,8 @@ function customRoleSource(reader, options = {}) {
 			return isThenable$1(roles) ? roles.then((list) => ofTenant(tenant, list)) : ofTenant(tenant, roles);
 		},
 		...reader.assignable === void 0 ? {} : { assignable: (tenant) => reader.assignable?.(tenant) ?? [] },
-		...reader.globalRoles === void 0 ? {} : { globalRoles: (context) => declared !== void 0 && context?.held.every((name) => declared.has(name)) === true ? [] : reader.globalRoles?.() ?? [] }
+		...reader.globalRoles === void 0 ? {} : { globalRoles: (context) => declared !== void 0 && context?.held.every((name) => declared.has(name)) === true ? [] : reader.globalRoles?.() ?? [] },
+		...reader.sharedRoles === void 0 ? {} : { sharedRoles: (context) => declared !== void 0 && context?.held.every((name) => declared.has(name)) === true ? [] : reader.sharedRoles?.() ?? [] }
 	});
 }
 //#endregion
@@ -1503,7 +1512,7 @@ function snapshotFor(policy, user, options = {}) {
 	if (isThenable$1(resolved)) throw new TypeError("PermDock: snapshotFor() needs synchronous subject and context mappers. Resolve async data first and pass it as a Subject, or use (await getPermDock(...)).snapshot().");
 	const subject = withPlans(resolved, options.plans);
 	const tenants = new Set(tenantsOf(subject.principal, scopeList(policy.scopes)));
-	const customRoles = (options.customRoles ?? []).filter((item) => item.scope === "global" || item.tenant !== void 0 && tenants.has(item.tenant));
+	const customRoles = (options.customRoles ?? []).filter((item) => item.scope === "global" || item.shared === true && tenants.size > 0 || item.tenant !== void 0 && tenants.has(item.tenant));
 	const names = options.assignable;
 	const assignable = names === void 0 ? void 0 : new Map([...tenants].map((tenant) => [tenant, Object.hasOwn(names, tenant) ? names[tenant] ?? [] : []]));
 	return snapshotOf(policy, subject, compact({
@@ -1767,7 +1776,7 @@ function decideRoleChangeWith(policy, principal, scopes, change, customRoles, au
 			return done(null);
 		}
 		const found = tenant;
-		custom = named.find((role) => sameId(role.tenant, found) && customRoleScope(role, scopes) === scope && sameId(customRoleId(role) ?? id, id));
+		custom = named.find((role) => customRoleOf(role, found) && customRoleScope(role, scopes) === scope && sameId(customRoleId(role) ?? id, id));
 	}
 	if (!declared && custom === void 0) {
 		deny("unknown-role");

package/dist/ssf/index.d.ts

@@ -1,4 +1,4 @@
-import { A as SsfSubject, C as SsfEventName, D as SsfReceiver, E as SsfPermDockOptions, M as SsfTransmitterConfiguration, N as SsfVerification, O as SsfStreamConfiguration, S as SsfEventListener, T as SsfPermDock, _ as SetSubject, a as PollHandle, b as SsfEventHandler, c as PushSetOptions, d as SetDelivery, f as SetDeliveryFailureCause, g as SetQueue, h as SetPollHandlerOptions, i as CaepReason, j as SsfSubjectResolver, k as SsfStreamStatus, l as ReplayStore, m as SetEvent, n as CaepEventName, o as PollOptions, p as SetError, r as CaepInitiatingEntity, s as PollResult, t as CaepCommon, u as RiscEventName, v as SignSetOptions, w as SsfOnEvent, x as SsfEventInput, y as SsfAuditEvent } from "../types-DiQjupG2.js";
-import { t as memoryReplayStore } from "../replay-D7iKcLFe.js";
-import { _ as setPollHandler, a as CaepTokenClaimsChange, c as RiscEvents, d as caepEvents, f as pushSet, g as memorySetQueue, h as streamVerificationEvent, i as CaepEvents, l as SSF_POLL_DELIVERY, m as signSet, n as CaepCredentialChange, o as RiscAccountDisabled, p as riscEvents, r as CaepDeviceComplianceChange, s as RiscCredentialCompromise, t as CaepAssuranceLevelChange, u as SSF_PUSH_DELIVERY, v as createPermDock } from "../index-D8EovfsP.js";
+import { A as SsfSubject, C as SsfEventName, D as SsfReceiver, E as SsfPermDockOptions, M as SsfTransmitterConfiguration, N as SsfVerification, O as SsfStreamConfiguration, S as SsfEventListener, T as SsfPermDock, _ as SetSubject, a as PollHandle, b as SsfEventHandler, c as PushSetOptions, d as SetDelivery, f as SetDeliveryFailureCause, g as SetQueue, h as SetPollHandlerOptions, i as CaepReason, j as SsfSubjectResolver, k as SsfStreamStatus, l as ReplayStore, m as SetEvent, n as CaepEventName, o as PollOptions, p as SetError, r as CaepInitiatingEntity, s as PollResult, t as CaepCommon, u as RiscEventName, v as SignSetOptions, w as SsfOnEvent, x as SsfEventInput, y as SsfAuditEvent } from "../types-C791HFu9.js";
+import { t as memoryReplayStore } from "../replay-Bkm-Ne4l.js";
+import { _ as setPollHandler, a as CaepTokenClaimsChange, c as RiscEvents, d as caepEvents, f as pushSet, g as memorySetQueue, h as streamVerificationEvent, i as CaepEvents, l as SSF_POLL_DELIVERY, m as signSet, n as CaepCredentialChange, o as RiscAccountDisabled, p as riscEvents, r as CaepDeviceComplianceChange, s as RiscCredentialCompromise, t as CaepAssuranceLevelChange, u as SSF_PUSH_DELIVERY, v as createPermDock } from "../index-Cp_ilKi1.js";
 export { type CaepAssuranceLevelChange, type CaepCommon, type CaepCredentialChange, type CaepDeviceComplianceChange, type CaepEventName, type CaepEvents, type CaepInitiatingEntity, type CaepReason, type CaepTokenClaimsChange, type PollHandle, type PollOptions, type PollResult, type PushSetOptions, type ReplayStore, type RiscAccountDisabled, type RiscCredentialCompromise, type RiscEventName, type RiscEvents, SSF_POLL_DELIVERY, SSF_PUSH_DELIVERY, type SetDelivery, type SetDeliveryFailureCause, type SetError, type SetEvent, type SetPollHandlerOptions, type SetQueue, type SetSubject, type SignSetOptions, type SsfAuditEvent, type SsfEventHandler, type SsfEventInput, type SsfEventListener, type SsfEventName, type SsfOnEvent, type SsfPermDock, type SsfPermDockOptions, type SsfReceiver, type SsfStreamConfiguration, type SsfStreamStatus, type SsfSubject, type SsfSubjectResolver, type SsfTransmitterConfiguration, type SsfVerification, caepEvents, createPermDock, memoryReplayStore, memorySetQueue, pushSet, riscEvents, setPollHandler, signSet, streamVerificationEvent };

package/dist/ssf/index.js

@@ -1,7 +1,7 @@
 import { r as isRecord, t as compact } from "../compact-CAf557ZB.js";
 import { o as epochSeconds } from "../time-DkWjdL98.js";
 import { n as readBodyText } from "../body-text-QcXok_SI.js";
-import { t as cancelApprovals } from "../helpers-DTcZOzhF.js";
+import { t as cancelApprovals } from "../helpers-CBYVMjwh.js";
 import { i as issuerFromDiscovery, t as joseTokenVerifier } from "../verifier-DHuh-okk.js";
 import { t as memoryReplayStore } from "../replay-Du1tJjG7.js";
 import { t as timeoutSignal } from "../timeout-D51niuQP.js";

package/dist/{standard-webhooks-6lg8v_is.d.ts → standard-webhooks-rbD7LS6h.d.ts}

@@ -1,5 +1,5 @@
-import { Rt as Instant, tr as JsonWebKeyLike } from "./policy-types-DzwivBgR.js";
-import { l as ReplayStore } from "./types-DiQjupG2.js";
+import { Rt as Instant, tr as JsonWebKeyLike } from "./policy-types-n0uRTsW8.js";
+import { l as ReplayStore } from "./types-C791HFu9.js";
 //#region src/server/standard-webhooks.d.ts
 /** The three Standard Webhooks headers a delivery carries. */
 type WebhookHeaders = {

package/dist/{store-4u_hxjWa.js → store-BDutJkDL.js}

@@ -3,7 +3,7 @@ import { n as freezeDeep } from "./freeze-CrU8nQeX.js";
 import { i as flattenApprovers } from "./approvers-CqPOLD-o.js";
 import { a as durationOf, i as dateAt } from "./time-DkWjdL98.js";
 import { s as rootMembershipId } from "./scopes-CUPSjo9q.js";
-import { n as matchGrantee } from "./grantee-match-DHArqY82.js";
+import { n as matchGrantee } from "./grantee-match-DbENBHLB.js";
 import { a as escalationOpenAt, i as approverRelationKey, o as stageEscalationOpenAt, r as approvalQuorum, s as ApprovalError } from "./types-DqzsnlSA.js";
 //#region src/approvals/page.ts
 const DEFAULT_PAGE_SIZE = 50;

package/dist/{store-options-BqEakYRa.js → store-options-u0ycEe8s.js}

@@ -1,11 +1,11 @@
 import { t as compact } from "./compact-CAf557ZB.js";
 import { g as secondsOf } from "./time-DkWjdL98.js";
-import { c as rowIdOf } from "./delegation-DaXVdDhM.js";
+import { c as rowIdOf } from "./delegation-j6-rc37o.js";
 import { c as nowSeconds } from "./tenancy-DN2QAx9z.js";
 import { n as payloadDigest } from "./token-BLZcjQgt.js";
-import { n as parseSnapshot } from "./snapshot-CXUWfsNy.js";
-import { s as snapshotClaim } from "./where-scope-Dv-WTP-w.js";
-import { n as fromSnapshot, t as emptySnapshot } from "./from-snapshot-D2lZt4Dd.js";
+import { n as parseSnapshot } from "./snapshot-B7DkYg6g.js";
+import { s as snapshotClaim } from "./where-scope-C9vfEphl.js";
+import { n as fromSnapshot, t as emptySnapshot } from "./from-snapshot-CTCMsFZk.js";
 import { t as timeoutSignal } from "./timeout-D51niuQP.js";
 //#region src/client/source.ts
 /** A compact JWS: three non-empty dot-separated parts. */

package/dist/{stores-ClZUgeoP.d.ts → stores-BUGNbJTt.d.ts}

@@ -1,8 +1,8 @@
-import { Nn as Decision, nr as Membership } from "./policy-types-DzwivBgR.js";
-import { r as Role, w as Permission } from "./vocabulary-D6lPdb4Z.js";
-import { r as DescribeOptions, t as DecisionDescription } from "./describe-BZUsixiL.js";
-import { a as FilterResult, c as PermissionSet, d as RolesOptions, f as SubjectView, l as PermissionState, p as TenantView, r as ClientPermDock, t as ApprovalHandle } from "./types-BNORmDM8.js";
-import { n as SveltePermDockOptions } from "./types-fbZ7JEXr.js";
+import { Nn as Decision, nr as Membership } from "./policy-types-n0uRTsW8.js";
+import { r as Role, w as Permission } from "./vocabulary-CN8H_9UF.js";
+import { r as DescribeOptions, t as DecisionDescription } from "./describe-B5qgDvEW.js";
+import { a as FilterResult, c as PermissionSet, d as RolesOptions, f as SubjectView, l as PermissionState, p as TenantView, r as ClientPermDock, t as ApprovalHandle } from "./types-B3_ooZgZ.js";
+import { n as SveltePermDockOptions } from "./types-CVZSNocA.js";
 import { Readable } from "svelte/store";
 //#region src/svelte/stores.d.ts
 declare function setPermDock(options: SveltePermDockOptions): ClientPermDock;

package/dist/{stores-BbsD4fAR.js → stores-CGhM8BN_.js}

@@ -1,5 +1,5 @@
 import { a as livePermDock, c as rolesView, d as subjectView, f as tenantView, n as describeWith, o as permissionSet, r as filterResult, t as approvalHandle } from "./views-DTIIO-oQ.js";
-import { n as getUi, r as providePermDock, t as getStore } from "./context-bbFHR-0D.js";
+import { n as getUi, r as providePermDock, t as getStore } from "./context-B_u3_bDJ.js";
 import { readable, toStore } from "svelte/store";
 //#region src/svelte/stores.ts
 function fromStore(store, compute) {

package/dist/{stream-7-xmnf3U.d.ts → stream-CeCMJmBB.d.ts}

@@ -1,5 +1,5 @@
-import { w as Permission } from "./vocabulary-D6lPdb4Z.js";
-import { o as ProtectOptions } from "./server-types-BLd4MnBX.js";
+import { w as Permission } from "./vocabulary-CN8H_9UF.js";
+import { o as ProtectOptions } from "./server-types-CKQiCnON.js";
 //#region src/server/stream.d.ts
 type StreamProtectOptions = ProtectOptions & {
   /**

package/dist/supabase/index.d.ts

@@ -1,9 +1,9 @@
-import { Rt as Instant, ir as Subject } from "../policy-types-DzwivBgR.js";
-import { a as ApprovalDelegationSource, m as ApprovalStore, u as ApprovalRequest } from "../types-CCpc2Dcv.js";
-import { a as SupabaseRpcClient, c as readSubjectRecord, i as SupabaseRpcCaller, n as PostgrestSourcesOptions, o as SupabaseRpcResult, r as SubjectRecord, s as postgrestSources, t as PostgrestSources } from "../postgrest-NUqZT-RB.js";
-import { C as SupabaseClaimsSchema, E as supabaseClaims, S as SupabaseClaimsOptions, T as SupabasePermDockClaims, _ as SupabaseSuspendedMembership, a as SupabaseActorResult, b as SupabaseActClaim, c as SupabaseMembershipTable, d as SupabaseRealtime, f as SupabaseRlsConfig, g as SupabaseSubjectOptions, h as SupabaseStorage, i as SupabaseActor, l as SupabasePermissionRef, m as SupabaseSessionLike, n as RoleThrough, o as SupabaseDelegation, p as SupabaseRlsOptions, r as SupabaseActiveRow, s as SupabaseInclude, t as AuthorizeSqlOptions, u as SupabasePrincipal, v as SupabaseSuspendedScope, w as SupabaseMembershipClaim, x as SupabaseClaims, y as SupabaseSuspension } from "../types-CdlxsYQh.js";
+import { Rt as Instant, ar as Subject } from "../policy-types-n0uRTsW8.js";
+import { a as ApprovalDelegationSource, m as ApprovalStore, u as ApprovalRequest } from "../types-BdtSDbBO.js";
+import { a as SupabaseRpcClient, c as readSubjectRecord, i as SupabaseRpcCaller, n as PostgrestSourcesOptions, o as SupabaseRpcResult, r as SubjectRecord, s as postgrestSources, t as PostgrestSources } from "../postgrest-CEgRbefE.js";
+import { C as SupabaseClaimsSchema, E as supabaseClaims, S as SupabaseClaimsOptions, T as SupabasePermDockClaims, _ as SupabaseSuspendedMembership, a as SupabaseActorResult, b as SupabaseActClaim, c as SupabaseMembershipTable, d as SupabaseRealtime, f as SupabaseRlsConfig, g as SupabaseSubjectOptions, h as SupabaseStorage, i as SupabaseActor, l as SupabasePermissionRef, m as SupabaseSessionLike, n as RoleThrough, o as SupabaseDelegation, p as SupabaseRlsOptions, r as SupabaseActiveRow, s as SupabaseInclude, t as AuthorizeSqlOptions, u as SupabasePrincipal, v as SupabaseSuspendedScope, w as SupabaseMembershipClaim, x as SupabaseClaims, y as SupabaseSuspension } from "../types-BzzaHxt3.js";
 import { a as SupabaseManifestHelper, c as SupabaseManifestRls, d as SupabaseManifestValue, f as parseSupabaseManifest, i as SupabaseManifestColumn, l as SupabaseManifestRole, n as SupabaseHookManifest, o as SupabaseManifestMembership, r as SupabaseManifestActiveRow, s as SupabaseManifestRequires, t as SupabaseHookClaim, u as SupabaseManifestThrough } from "../manifest-mx5ghSFM.js";
-import { a as MembershipTableOptions, c as SupabasePostgres, d as supabasePostgresQuery, f as tableMembershipSource, i as MembershipSql, l as authzVersion, n as MembershipHolders, o as SqlMembershipSource, r as MembershipJunctionOptions, s as SqlQuery, t as AUTHZ_VERSION_TABLE, u as junctionMembershipSource } from "../sources-BV9j0DeZ.js";
+import { a as MembershipTableOptions, c as SupabasePostgres, d as supabasePostgresQuery, f as tableMembershipSource, i as MembershipSql, l as authzVersion, n as MembershipHolders, o as SqlMembershipSource, r as MembershipJunctionOptions, s as SqlQuery, t as AUTHZ_VERSION_TABLE, u as junctionMembershipSource } from "../sources-Xc4zkszI.js";
 import { n as supabaseTenantClaim, t as supabaseMembershipsBudget } from "../budget-JqcRqyhK.js";
 //#region src/supabase/capability.d.ts
 type ExchangeCapabilityOptions = {