permdock 0.5.0 → 0.7.0

package/dist/{evaluate-_R8QkWaf.js → evaluate-B_oqFbWC.js}

@@ -1,29 +1,29 @@
 import { a as sole, n as isReadonlyArray, t as compact } from "./compact-CAf557ZB.js";
 import { n as freezeDeep } from "./freeze-CrU8nQeX.js";
 import { n as isForbiddenKey } from "./paths-DXSHAMIa.js";
-import { n as role, t as normalizeAssurance } from "./role-builder-CXbis5-X.js";
+import { n as role, t as normalizeAssurance } from "./role-builder-C1VJzvcr.js";
 import { n as PermDockValidationError } from "./validation-error-ZfUHbKvf.js";
 import { t as wireDenials } from "./wire-denial-C7PaVYEM.js";
 import { o as sameId } from "./expiry-D4_YKRKD.js";
 import { n as internalsOf } from "./internals-Dk8A8fX3.js";
-import { a as getResource, c as listPermissions, h as formerKeys, m as annotationsFor, n as findPermission } from "./permission-registry-Br4jSNVi.js";
+import { a as getResource, c as listPermissions, h as formerKeys, m as annotationsFor, n as findPermission } from "./permission-registry-DpPtSKNZ.js";
 import { n as isThenable, t as ignoreRejection } from "./thenable-yD7SabqG.js";
 import { i as readAppData } from "./app-data-MuyzVqX8.js";
 import { a as durationOf, d as isoNow, o as epochSeconds, r as assertDuration, s as instantAt, t as INVALID_NOW } from "./time-DkWjdL98.js";
-import { t as canonicalJson } from "./canonical-json-BC8_nMTw.js";
-import { a as normalizeMemberships, d as scopeList, f as subjectForPermission, i as keepsPermission, m as tenantOf, o as resolveScope, s as rootMembershipId } from "./scopes-CUPSjo9q.js";
-import { a as readOnlyActorRefuses, c as rowIdOf, i as delegatedPermissions, l as rowValues, n as coveredByDelegation, o as requiresStandIn, r as coversRequirements, s as isRowPair, u as evaluateCondition } from "./delegation-DaXVdDhM.js";
-import { a as authenticated, g as isRole, i as assurance, m as findRole, o as flattenGrantee, r as asGrantee } from "./grantee-Cn1HyUsI.js";
+import { t as canonicalJson } from "./canonical-json-DwilZ1iB.js";
+import { c as rootMembershipId, f as scopeList, h as tenantOf, i as keepsPermission, o as normalizeMemberships, p as subjectForPermission, s as resolveScope } from "./scopes-BHsc-wp-.js";
+import { a as readOnlyActorRefuses, c as rowIdOf, i as delegatedPermissions, l as rowValues, n as coveredByDelegation, o as requiresStandIn, r as coversRequirements, s as isRowPair, u as evaluateCondition } from "./delegation-C5rOdTp5.js";
+import { a as authenticated, g as isRole, i as assurance, m as findRole, o as flattenGrantee, r as asGrantee } from "./grantee-BrRANrpT.js";
 import { a as grantCoversField, i as wireValidity, t as isActive } from "./validity-CZ7-y0Cj.js";
-import { o as resourceRoleCondition } from "./grantee-conditions-CcXf8hMM.js";
-import { c as nowSeconds, i as matchScopedMembership, l as partitionsOf, n as inTeam, p as scopeField, r as isMembershipExpired } from "./tenancy-DN2QAx9z.js";
-import { a as levelCondition, r as grantList, t as declaredRoleNames } from "./policy-DLZJ5gAp.js";
+import { o as resourceRoleCondition } from "./grantee-conditions-C6P1Tvol.js";
+import { c as nowSeconds, i as matchScopedMembership, l as partitionsOf, n as inTeam, p as scopeField, r as isMembershipExpired } from "./tenancy-CmeBQ6Nv.js";
+import { o as levelCondition, r as grantList, t as declaredRoleNames } from "./policy-DaJy4nK4.js";
 import { t as requiresApproval } from "./approval-required-TzNB9oQA.js";
-import { i as versionOf, r as tokenPayload, t as decisionToken } from "./token-BLZcjQgt.js";
+import { i as versionOf, r as tokenPayload, t as decisionToken } from "./token-2qYDvXz2.js";
 import { n as resolveRelated } from "./relation-walk-3OyDBF0S.js";
 import { t as eventInstant } from "./event-time-CsegxXxB.js";
 import { n as toWireDelegation } from "./wire-delegation-Cv3W2eaM.js";
-import { n as matchGrantee, t as combineWhere } from "./grantee-match-DHArqY82.js";
+import { n as matchGrantee, t as combineWhere } from "./grantee-match-0RtHWQDx.js";
 import { t as resourceIdOf } from "./resource-ref-CaS9yVPi.js";
 //#region src/core/approval-state.ts
 /** The denial detail when an `ApprovalPolicySource` threw or returned an invalid entry. */
@@ -715,7 +715,7 @@ function leveled(grant, level, condition) {
 * the policy does not declare it; such a role resolves to nothing.
 */
 function customRoleScope(role, scopes) {
-	if (role.scope === "global") return "global";
+	if (role.scope === "global") return role.shared === true ? void 0 : "global";
 	if (role.scope !== void 0) return resolveScope(scopes, role.scope);
 	return resolveScope(scopes, role.team === void 0 ? "tenant" : "team");
 }
@@ -727,6 +727,10 @@ function customRoleId(role) {
 function isGlobalCustomRole(role) {
 	return role.scope === "global";
 }
+/** A shared custom role: defined once for every tenant, held on memberships of its scope in any tenant. */
+function isSharedCustomRole(role) {
+	return role.shared === true;
+}
 function isCeilingScope(scope) {
 	return typeof scope === "string";
 }
@@ -929,7 +933,16 @@ function resolveCustomRole(policy, role) {
 		renamed
 	});
 }
-function validateCustomRole(policy, role) {
+function validateCustomRole(policy, role, options = {}) {
+	if (!isSharedCustomRole(role) && !isGlobalCustomRole(role) && (options.shared ?? []).some((item) => wellFormed(item) && isSharedCustomRole(item) && item.name === role.name)) return freezeDeep({
+		ok: false,
+		permissions: [],
+		dropped: [{
+			role: role.name,
+			reason: "name-taken"
+		}],
+		renamed: []
+	});
 	const resolved = resolveCustomRole(policy, role);
 	const permissions = [...new Set(resolved.grants.filter((grant) => grant.effect === "allow").map((grant) => grant.permission.key))].toSorted();
 	return freezeDeep({
@@ -939,17 +952,70 @@ function validateCustomRole(policy, role) {
 		renamed: resolved.renamed
 	});
 }
+/**
+* Checks one stored allow entry, `<permission>[@<level>]`, the way
+* `permdock_custom_role_entry_problem` does in SQL. `scope` defaults to the
+* first scope; its ceiling is the allows of that scope's assignable roles.
+*/
+function parseCustomRoleEntry(policy, entry, options = {}) {
+	const at = entry.indexOf("@");
+	const raw = at === -1 ? entry : entry.slice(0, at);
+	const level = at === -1 ? void 0 : entry.slice(at + 1);
+	const checked = validateCustomRole(policy, {
+		name: "entry",
+		tenant: "entry",
+		...options.scope === void 0 ? {} : { scope: options.scope },
+		grants: [{
+			permission: raw,
+			...level === void 0 ? {} : { level }
+		}]
+	});
+	const dropped = checked.dropped[0];
+	if (dropped !== void 0) return {
+		ok: false,
+		cause: dropped.reason === "unknown-level" || dropped.reason === "outside-ceiling" ? dropped.reason : "unknown-permission"
+	};
+	return {
+		ok: true,
+		permission: checked.renamed[0]?.to ?? raw,
+		...level === void 0 ? {} : { level }
+	};
+}
 function wellFormed(role) {
 	if (role === null || typeof role !== "object" || typeof role.name !== "string") return false;
+	if (role.shared !== void 0) return role.shared === true && role.tenant === void 0 && role.team === void 0 && role.id === void 0 && (role.scope === void 0 || typeof role.scope === "string" && role.scope !== "global");
 	if (role.scope === "global") return role.tenant === void 0 && role.team === void 0 && role.id === void 0;
 	return typeof role.tenant === "string" && (role.team === void 0 || typeof role.team === "string") && (role.scope === void 0 || typeof role.scope === "string") && (role.id === void 0 || typeof role.id === "string");
 }
+/**
+* The well-formed roles, without a tenant role that a shared role of the same
+* name shadows: the shared role is the one every tenant sees.
+*/
+function effectiveCustomRoles(roles) {
+	const formed = roles.filter(wellFormed);
+	const shared = new Set(formed.filter(isSharedCustomRole).map((role) => role.name));
+	return shared.size === 0 ? formed : formed.filter((role) => isSharedCustomRole(role) || isGlobalCustomRole(role) || !shared.has(role.name));
+}
+/** The grants of `roles` that name a level their resource does not declare. */
+function unknownLevelsFor(policy, roles) {
+	const declared = declaredRoleNames(policy);
+	const out = [];
+	for (const role of effectiveCustomRoles(roles)) {
+		if (declared.has(role.name)) continue;
+		for (const entry of resolveCustomRole(policy, role).dropped) if ("permission" in entry && entry.reason === "unknown-level") out.push({
+			role: role.name,
+			permission: entry.permission,
+			level: entry.level ?? ""
+		});
+	}
+	return out;
+}
 /** Every custom role's resolved grants, once per instance. Malformed roles resolve to nothing. */
 function customGrantsFor(policy, roles) {
 	const declared = declaredRoleNames(policy);
 	const out = [];
-	for (const role of roles) {
-		if (!wellFormed(role) || declared.has(role.name)) continue;
+	for (const role of effectiveCustomRoles(roles)) {
+		if (declared.has(role.name)) continue;
 		for (const grant of resolveCustomRole(policy, role).grants) out.push({
 			grant,
 			role
@@ -957,25 +1023,37 @@ function customGrantsFor(policy, roles) {
 	}
 	return out;
 }
-/** The well-formed tenant (not platform) custom roles; a declared role name is never one. */
+/**
+* The well-formed custom roles held on memberships: tenant and shared, not
+* platform. A declared role name is never one, and a shared role shadows a
+* tenant role of the same name.
+*/
 function tenantCustomRoles(policy, roles) {
 	const declared = declaredRoleNames(policy);
-	return roles.filter((role) => wellFormed(role) && !isGlobalCustomRole(role) && !declared.has(role.name));
+	return effectiveCustomRoles(roles).filter((role) => !isGlobalCustomRole(role) && !declared.has(role.name));
 }
-/** A membership at the role's scope, inside its tenant (and instance, when pinned), naming it. */
+/** Whether a custom role held on memberships belongs to `tenant`: its own, or shared by every tenant. */
+function customRoleOf(role, tenant) {
+	return isSharedCustomRole(role) || sameId(role.tenant, tenant);
+}
+/**
+* A membership at the role's scope, inside its tenant (and instance, when
+* pinned), naming it. A shared role is held at its scope in any tenant.
+*/
 function holdsCustomRole(membership, role, scopes) {
-	if (isGlobalCustomRole(role)) return false;
+	if (isGlobalCustomRole(role) || !wellFormed(role)) return false;
 	const scope = customRoleScope(role, scopes);
 	const id = customRoleId(role);
-	return scope !== void 0 && membership.scope === scope && sameId(tenantOf(membership, scopes), role.tenant) && (id === void 0 || sameId(membership.id, id)) && membership.roles.includes(role.name);
+	const tenant = tenantOf(membership, scopes);
+	return scope !== void 0 && membership.scope === scope && (isSharedCustomRole(role) ? tenant !== void 0 : sameId(tenant, role.tenant)) && (id === void 0 || sameId(membership.id, id)) && membership.roles.includes(role.name);
 }
 /** Whether `principal.roles` names the platform custom role. */
 function holdsGlobalCustomRole(roles, role) {
 	return isGlobalCustomRole(role) && (roles ?? []).includes(role.name);
 }
-/** A tenant's custom role inside that tenant, or a platform custom role anywhere. */
+/** A tenant's custom role inside that tenant, a shared role in any tenant, or a platform custom role anywhere. */
 function isCustomRoleName(name, roles, tenant) {
-	return roles.some((item) => wellFormed(item) && item.name === name && (isGlobalCustomRole(item) || tenant !== void 0 && sameId(item.tenant, tenant)));
+	return effectiveCustomRoles(roles).some((item) => item.name === name && (isGlobalCustomRole(item) || tenant !== void 0 && customRoleOf(item, tenant)));
 }
 /**
 * The compact JWT form of custom roles for the `memberships[].grants` claim
@@ -1010,8 +1088,9 @@ function customRoleClaim(roles, policy) {
 */
 function membershipsClaim(memberships, customRoles, scopes) {
 	const claim = [];
+	const effective = effectiveCustomRoles(customRoles);
 	for (const membership of normalizeMemberships(memberships, scopes)) {
-		const held = customRoles.filter((role) => wellFormed(role) && holdsCustomRole(membership, role, scopes));
+		const held = effective.filter((role) => holdsCustomRole(membership, role, scopes));
 		claim.push(held.length === 0 ? membership : Object.assign({}, membership, { grants: customRoleClaim(held) }));
 	}
 	return claim;
@@ -1030,6 +1109,12 @@ function isGlobalRole(value) {
 function onlyGlobal(roles) {
 	return Array.isArray(roles) ? roles.filter(isGlobalRole) : [];
 }
+function isSharedRole(value) {
+	return value !== null && typeof value === "object" && Reflect.get(value, "shared") === true;
+}
+function onlyShared(roles) {
+	return Array.isArray(roles) ? roles.filter(isSharedRole) : [];
+}
 /** The `customRoles` option as a source: a factory is called with the resolved subject, and a throw reads none. */
 function roleSourceFor(option, subject, auth) {
 	if (typeof option !== "function") return option;
@@ -1056,16 +1141,27 @@ function customRolesFor(source, tenants, auth, globalHeld, heldIn) {
 		});
 		loaded.push([]);
 	}
-	if (globalHeld !== void 0 && source.globalRoles !== void 0) try {
-		const roles = source.globalRoles({ held: globalHeld });
-		loaded.push(isThenable(roles) ? roles.then(onlyGlobal) : onlyGlobal(roles));
-	} catch {
-		auth.push({
-			reason: "source-threw",
-			source: "customRoles",
-			...sourceName(source)
-		});
-		loaded.push([]);
+	const once = (read, keep) => {
+		try {
+			const roles = read();
+			loaded.push(isThenable(roles) ? roles.then(keep) : keep(roles));
+		} catch {
+			auth.push({
+				reason: "source-threw",
+				source: "customRoles",
+				...sourceName(source)
+			});
+			loaded.push([]);
+		}
+	};
+	if (globalHeld !== void 0 && source.globalRoles !== void 0) {
+		const read = source.globalRoles.bind(source);
+		once(() => read({ held: globalHeld }), onlyGlobal);
+	}
+	if (tenants.length > 0 && source.sharedRoles !== void 0) {
+		const read = source.sharedRoles.bind(source);
+		const held = [...new Set(tenants.flatMap((tenant) => heldIn(tenant)))];
+		once(() => read({ held }), onlyShared);
 	}
 	if (loaded.some((item) => isThenable(item))) return Promise.all(loaded.map((item) => Promise.resolve(item).catch(() => {
 		auth.push({
@@ -1729,4 +1825,4 @@ function evaluate(policy, given, permission, data, options, env) {
 	return allowedDecision(state, chosen.allow, chosen.approval, chosen.quota);
 }
 //#endregion
-export { isContact as A, emptyListeners as C, supportAccess as D, breakGlass as E, contactMayUse as O, emitSafe as S, activate as T, membershipsClaim as _, expandRoleNames as a, tenantCustomRoles as b, andWhere as c, customRoleClaim as d, customRoleId as f, leveled as g, holdsGlobalCustomRole as h, customRolesFor as i, APPROVAL_POLICY_UNAVAILABLE as j, contactMemberships as k, ceilingGrants as l, holdsCustomRole as m, requirementCondition as n, roleSourceFor as o, customRoleScope as p, assignableNamesFor as r, sourceName as s, evaluate as t, customGrantsFor as u, resolveCustomRole as v, finish as w, validateCustomRole as x, roleAllowKeys as y };
+export { breakGlass as A, tenantCustomRoles as C, emptyListeners as D, emitSafe as E, APPROVAL_POLICY_UNAVAILABLE as F, contactMayUse as M, contactMemberships as N, finish as O, isContact as P, roleAllowKeys as S, validateCustomRole as T, isSharedCustomRole as _, expandRoleNames as a, parseCustomRoleEntry as b, andWhere as c, customRoleClaim as d, customRoleId as f, holdsGlobalCustomRole as g, holdsCustomRole as h, customRolesFor as i, supportAccess as j, activate as k, ceilingGrants as l, customRoleScope as m, requirementCondition as n, roleSourceFor as o, customRoleOf as p, assignableNamesFor as r, sourceName as s, evaluate as t, customGrantsFor as u, leveled as v, unknownLevelsFor as w, resolveCustomRole as x, membershipsClaim as y };

package/dist/{evaluations-16UqqQ6W.d.ts → evaluations-BCddEOfO.d.ts}

@@ -1,6 +1,6 @@
-import { T as Policy } from "./policy-types-DzwivBgR.js";
-import { r as PermDock } from "./permdock-D7eeLJER.js";
-import { m as ApprovalStore } from "./types-CCpc2Dcv.js";
+import { T as Policy } from "./policy-types-B-F-qAZk.js";
+import { a as PermDock } from "./permdock-Dco6dyCK.js";
+import { m as ApprovalStore } from "./types-DC44-hqb.js";
 //#region src/server/evaluations.d.ts
 /** AuthZEN 1.0 section 7.1.2.1 `options.evaluations_semantic` values. */
 declare const EVALUATIONS_SEMANTICS: readonly ["execute_all", "deny_on_first_deny", "permit_on_first_permit"];
@@ -13,7 +13,7 @@ declare function evaluationsSemantic(body: Readonly<Record<string, unknown>>): E
  */
 declare function evaluateBatch<T extends {
   readonly decision: boolean;
-}>(items: readonly unknown[], semantic: EvaluationsSemantic, rowOf: (item: unknown) => Promise<T>): Promise<T[]>;
+}, I = unknown>(items: readonly I[], semantic: EvaluationsSemantic, rowOf: (item: I) => Promise<T>): Promise<T[]>;
 declare function evaluationsHandler(options: {
   readonly policy: Policy;
   readonly resolve?: (request: Request) => Promise<PermDock>;

package/dist/{evaluations-DZ2CbV5k.js → evaluations-DReoiVBw.js}

@@ -1,12 +1,12 @@
 import { r as isRecord, t as compact } from "./compact-CAf557ZB.js";
 import { t as PROBLEM_BASE } from "./validation-error-ZfUHbKvf.js";
 import { t as wireDenials } from "./wire-denial-C7PaVYEM.js";
-import { c as listPermissions, g as formerScopes, h as formerKeys } from "./permission-registry-Br4jSNVi.js";
+import { c as listPermissions, g as formerScopes, h as formerKeys } from "./permission-registry-DpPtSKNZ.js";
 import { h as secondsAt } from "./time-DkWjdL98.js";
 import { n as resourceRef } from "./resource-ref-CaS9yVPi.js";
 import { n as readBodyText } from "./body-text-QcXok_SI.js";
 import { c as problemResponse, d as validationProblem, n as batchTooLarge } from "./problem-CTviyH5L.js";
-import { i as readApprovalHeader, s as resumeDecision } from "./helpers-DTcZOzhF.js";
+import { i as readApprovalHeader, s as resumeDecision } from "./helpers-DY3vXuGs.js";
 import { t as bodyTooLarge } from "./body-CH5of8Ne.js";
 import { t as timeoutSignal } from "./timeout-D51niuQP.js";
 //#region src/core/decision.ts
@@ -420,7 +420,7 @@ function unknownSemanticProblem() {
 * order, stopping after the first deny or permit.
 */
 async function evaluateBatch(items, semantic, rowOf) {
-	if (semantic === "execute_all") return Promise.all(items.map(rowOf));
+	if (semantic === "execute_all") return Promise.all(items.map((item) => rowOf(item)));
 	const stopOn = semantic === "permit_on_first_permit";
 	const rows = [];
 	for (const item of items) {
@@ -607,4 +607,4 @@ function evaluationsHandler(options) {
 	};
 }
 //#endregion
-export { wireResourceId as _, evaluationReasons as a, unknownSemanticProblem as c, discoverViaSignatureAgent as d, invalidSignatureProblem as f, permissionLookup as g, itemResourceData as h, evaluateBatch as i, withRequestId as l, webBotAuthVerifier as m, applyApprovalResume as n, evaluationsHandler as o, invalidSignatureResponse as p, authzenMetadata as r, evaluationsSemantic as s, EVALUATIONS_SEMANTICS as t, InvalidSignatureError as u, NO_GRANT as v };
+export { NO_GRANT as _, evaluationReasons as a, withRequestId as c, invalidSignatureProblem as d, invalidSignatureResponse as f, wireResourceId as g, permissionLookup as h, evaluateBatch as i, InvalidSignatureError as l, itemResourceData as m, applyApprovalResume as n, evaluationsHandler as o, webBotAuthVerifier as p, authzenMetadata as r, evaluationsSemantic as s, EVALUATIONS_SEMANTICS as t, discoverViaSignatureAgent as u };

package/dist/eve/index.d.ts

@@ -1,8 +1,8 @@
-import { T as Policy, j as PolicyVocabulary, rr as Principal } from "../policy-types-DzwivBgR.js";
-import { w as Permission } from "../vocabulary-D6lPdb4Z.js";
-import { r as PermDock } from "../permdock-D7eeLJER.js";
-import { u as ApprovalRequest } from "../types-CCpc2Dcv.js";
-import { o as AgentAdapterOptions, t as AgentPermDock } from "../create-BDS7wc3y.js";
+import { T as Policy, j as PolicyVocabulary, sr as Principal } from "../policy-types-B-F-qAZk.js";
+import { u as Permission } from "../permission-types-DhNEmoRG.js";
+import { a as PermDock } from "../permdock-Dco6dyCK.js";
+import { u as ApprovalRequest } from "../types-DC44-hqb.js";
+import { o as AgentAdapterOptions, t as AgentPermDock } from "../create-UTnUVETj.js";
 //#region src/eve/create.d.ts
 /** Structural `SessionAuthContext` from `eve`. */
 type EvePrincipal = {

package/dist/eve/index.js

@@ -1,8 +1,8 @@
 import { t as compact } from "../compact-CAf557ZB.js";
-import { c as withApp } from "../permdock-B9JxkBwC.js";
+import { l as withApp } from "../permdock-BfWEeMqk.js";
 import { c as isApprovalError } from "../types-DqzsnlSA.js";
-import { o as resolveApproval } from "../helpers-DTcZOzhF.js";
-import { t as agentRuntime } from "../create-C3b4B5eF.js";
+import { o as resolveApproval } from "../helpers-DY3vXuGs.js";
+import { t as agentRuntime } from "../create-Cb86Z8Im.js";
 import { t as boundedMap } from "../lru-8q4WZjBV.js";
 //#region src/eve/create.ts
 const TOKENS_PER_PROCESS = 1e3;

package/dist/express/index.d.ts

@@ -1,8 +1,8 @@
-import { T as Policy, j as PolicyVocabulary, rr as Principal } from "../policy-types-DzwivBgR.js";
-import { w as Permission } from "../vocabulary-D6lPdb4Z.js";
-import { r as PermDock } from "../permdock-D7eeLJER.js";
-import { f as InvalidSignatureError, i as OpenApiHooks, o as ProtectOptions, v as discoverViaSignatureAgent, x as webBotAuthVerifier } from "../server-types-BLd4MnBX.js";
-import { t as ServerAdapterOptions } from "../bind--9EFVYWF.js";
+import { T as Policy, j as PolicyVocabulary, sr as Principal } from "../policy-types-B-F-qAZk.js";
+import { u as Permission } from "../permission-types-DhNEmoRG.js";
+import { a as PermDock } from "../permdock-Dco6dyCK.js";
+import { f as InvalidSignatureError, i as OpenApiHooks, o as ProtectOptions, v as discoverViaSignatureAgent, x as webBotAuthVerifier } from "../server-types-C4gZUEZy.js";
+import { t as ServerAdapterOptions } from "../bind-JDuvxjuW.js";
 import { i as toRequest, r as sendResponse } from "../http-B_LphE5Y.js";
 import { ErrorRequestHandler, Request, RequestHandler, Response, Router } from "express";
 //#region src/express/create.d.ts

package/dist/express/index.js

@@ -1,7 +1,7 @@
 import { r as hasCredentials } from "../http-BBoKefeS.js";
-import { d as discoverViaSignatureAgent, m as webBotAuthVerifier, u as InvalidSignatureError } from "../evaluations-DZ2CbV5k.js";
-import { t as problemFromError } from "../map-error-TCAdw-eW.js";
-import { i as decorate, r as bindKernel } from "../bind-CZzhx-Vj.js";
+import { l as InvalidSignatureError, p as webBotAuthVerifier, u as discoverViaSignatureAgent } from "../evaluations-DReoiVBw.js";
+import { t as problemFromError } from "../map-error-BQGyDm_M.js";
+import { i as decorate, r as bindKernel } from "../bind-D1nO6fiC.js";
 import { n as sendResponse, r as toRequest } from "../http-ujKm0JXE.js";
 import express from "express";
 //#region src/express/create.ts

package/dist/fastify/index.d.ts

@@ -1,8 +1,8 @@
-import { T as Policy, j as PolicyVocabulary, rr as Principal } from "../policy-types-DzwivBgR.js";
-import { w as Permission } from "../vocabulary-D6lPdb4Z.js";
-import { r as PermDock } from "../permdock-D7eeLJER.js";
-import { f as InvalidSignatureError, i as OpenApiHooks, o as ProtectOptions, v as discoverViaSignatureAgent, x as webBotAuthVerifier } from "../server-types-BLd4MnBX.js";
-import { t as ServerAdapterOptions } from "../bind--9EFVYWF.js";
+import { T as Policy, j as PolicyVocabulary, sr as Principal } from "../policy-types-B-F-qAZk.js";
+import { u as Permission } from "../permission-types-DhNEmoRG.js";
+import { a as PermDock } from "../permdock-Dco6dyCK.js";
+import { f as InvalidSignatureError, i as OpenApiHooks, o as ProtectOptions, v as discoverViaSignatureAgent, x as webBotAuthVerifier } from "../server-types-C4gZUEZy.js";
+import { t as ServerAdapterOptions } from "../bind-JDuvxjuW.js";
 import { FastifyPluginAsync, FastifyReply, FastifyRequest, FastifySchema, FastifyTypeProvider, FastifyTypeProviderDefault, RawRequestDefaultExpression, RawServerDefault, RouteGenericInterface } from "fastify";
 //#region src/server/http.d.ts
 /** A Fastify-style reply: `code`, `header` and `send`. */

package/dist/fastify/index.js

@@ -1,7 +1,7 @@
 import { c as writeReply, i as headersFrom, n as firstHeader, r as hasCredentials, t as fetchRequest } from "../http-BBoKefeS.js";
-import { d as discoverViaSignatureAgent, m as webBotAuthVerifier, u as InvalidSignatureError } from "../evaluations-DZ2CbV5k.js";
-import { t as problemFromError } from "../map-error-TCAdw-eW.js";
-import { i as decorate, r as bindKernel } from "../bind-CZzhx-Vj.js";
+import { l as InvalidSignatureError, p as webBotAuthVerifier, u as discoverViaSignatureAgent } from "../evaluations-DReoiVBw.js";
+import { t as problemFromError } from "../map-error-BQGyDm_M.js";
+import { i as decorate, r as bindKernel } from "../bind-D1nO6fiC.js";
 //#region src/fastify/http.ts
 function toRequest(request) {
 	const host = firstHeader(request.headers.host) ?? "localhost";

package/dist/{fetch-adapter-qKJBuRqy.d.ts → fetch-adapter-CuhyYwC1.d.ts}

@@ -1,8 +1,8 @@
-import { w as Permission } from "./vocabulary-D6lPdb4Z.js";
-import { a as OperationInput, t as Operation } from "./operations-CxybZErY.js";
+import { u as Permission } from "./permission-types-DhNEmoRG.js";
+import { a as OperationInput, t as Operation } from "./operations-BNLes61x.js";
 import { n as RevocationFeed } from "./revocations-R07lFBnX.js";
-import { o as ProtectOptions } from "./server-types-BLd4MnBX.js";
-import { t as ServerAdapterOptions } from "./bind--9EFVYWF.js";
+import { o as ProtectOptions } from "./server-types-C4gZUEZy.js";
+import { t as ServerAdapterOptions } from "./bind-JDuvxjuW.js";
 //#region src/server/fetch-adapter.d.ts
 /** What `protect` checks: a permission, an operation from `defineOperations`, or `null` for a route that needs only OAuth scopes. */
 type ProtectTarget = Permission | Operation | null;

package/dist/{fetch-adapter-g0ypLkID.js → fetch-adapter-De-u6vhJ.js}

@@ -1,9 +1,9 @@
 import { t as compact } from "./compact-CAf557ZB.js";
-import { o as isPermission } from "./permission-registry-Br4jSNVi.js";
+import { o as isPermission } from "./permission-registry-DpPtSKNZ.js";
 import { r as hasCredentials } from "./http-BBoKefeS.js";
 import { a as methodNotAllowed } from "./problem-CTviyH5L.js";
-import { t as problemFromError } from "./map-error-TCAdw-eW.js";
-import { i as decorate, r as bindKernel } from "./bind-CZzhx-Vj.js";
+import { t as problemFromError } from "./map-error-BQGyDm_M.js";
+import { i as decorate, r as bindKernel } from "./bind-D1nO6fiC.js";
 //#region src/server/fetch-adapter.ts
 /**
 * `protect(target, data, options)(handler)` for a framework whose routes are

package/dist/{fields-D9tPVUUS.js → fields-ClcQLrVc.js}

@@ -1,7 +1,7 @@
-import { i as configError } from "./errors-CWTY6uih.js";
-import { s as jsonSchemaOf } from "./catalog-doc-C9wjsfNY.js";
-import { F as quoteQualified, N as quoteIdent, P as quoteLiteral, j as helperSchema, s as signedIn } from "./shared-CD11nBbC.js";
-import { c as branchClauses, i as orSql, s as andSql, u as wrapSql } from "./policies-CO1oOymN.js";
+import { i as configError } from "./errors-DpP_U6Bf.js";
+import { c as jsonSchemaOf } from "./catalog-doc-CV9s6B1S.js";
+import { A as quoteQualified, E as helperSchema, O as quoteIdent, k as quoteLiteral, s as signedIn } from "./shared-fMKOv8hP.js";
+import { c as branchClauses, i as orSql, s as andSql, u as wrapSql } from "./policies-B2lZIurj.js";
 //#region src/cli/rls/fields.ts
 /** Names of the field-view objects. Part of the SQL contract. */
 const FIELD_VIEWS = {
@@ -12,7 +12,9 @@ const FIELD_VIEWS = {
 	/** The companion's row-key column, joined to the base table's key. */
 	key: "permdock_key",
 	/** Marks the companion so doctor PD022 knows it reads as its owner on purpose. */
-	comment: "permdock:field-companion"
+	comment: "permdock:field-companion",
+	/** `<table>_mask(p_row)`: the row-masking function `fields: 'mask'` adds. */
+	mask: "_mask"
 };
 function covers(branch, column) {
 	return branch.fields === void 0 || branch.fields.includes(column);
@@ -67,12 +69,13 @@ function viewName(table, suffix) {
 	return `${table}${suffix}`;
 }
 /**
-* `<helper schema>.<table>_visible_fields`: outside the Data API's schemas,
-* so its owner rights reach clients only through the `_visible` join.
+* `<helper schema>.<table><suffix>`: outside the Data API's schemas, so the
+* companion's owner rights reach clients only through the `_visible` join and
+* the mask function is neither an RPC nor a computed field.
 */
-function companionName(ctx, table) {
+function helperObjectName(ctx, table, suffix) {
 	const base = table.startsWith("public.") ? table.slice(7) : table.replaceAll(".", "_");
-	return `${helperSchema(ctx)}.${viewName(base, FIELD_VIEWS.companion)}`;
+	return `${helperSchema(ctx)}.${viewName(base, suffix)}`;
 }
 /**
 * One view per table whose read grants limit fields. A column is restricted
@@ -93,7 +96,7 @@ function fieldViews(policy, ctx, branches, options, warnings) {
 		const resource = reads.find((branch) => branch.resource !== void 0)?.resource;
 		if (!limited || allows.length === 0 || resource === void 0) continue;
 		const names = schemaColumns(policy, resource);
-		if (names === void 0) throw configError(`PermDock CLI: --fields views needs the ${resource} schema's JSON Schema (Standard JSON Schema) to list the columns of ${table}`);
+		if (names === void 0) throw configError(`PermDock CLI: --fields ${options.mask === true ? "mask" : "views"} needs the ${resource} schema's JSON Schema (Standard JSON Schema) to list the columns of ${table}`);
 		const key = policy.resources.get(resource)?.id ?? "id";
 		const restricted = (column) => column !== key && (allows.some((branch) => branch.fields !== void 0 && !branch.fields.includes(column)) || denies.some((branch) => branch.fields?.includes(column) === true));
 		const columns = names.map((name) => {
@@ -116,7 +119,8 @@ function fieldViews(policy, ctx, branches, options, warnings) {
 			key,
 			columns,
 			roles: reads.some((branch) => branch.roles.includes("anon")) ? ["anon", "authenticated"] : ["authenticated"],
-			...options.revokeColumns ? { companion: companionName(ctx, table) } : {}
+			...options.revokeColumns ? { companion: helperObjectName(ctx, table, FIELD_VIEWS.companion) } : {},
+			...options.mask === true ? { maskFunction: helperObjectName(ctx, table, FIELD_VIEWS.mask) } : {}
 		});
 	}
 	return views;
@@ -176,6 +180,34 @@ function columnRevokeSql(view) {
 	return `revoke select (${columnList(restrictedColumns(view))}) on table ${quoteQualified(view.table)} from anon, authenticated;`;
 }
 /**
+* `<table>_mask(p_row)`: the row with each restricted column the caller may
+* not read set to null, by the same masks as the view. It reads only the row
+* it is given, so its caller decides which rows; `security invoker`, because
+* it needs nothing beyond the helpers the masks call. The body names the
+* parameter `$1`, since a column called `p_row` would shadow the name.
+*/
+function maskFunctionSql(view, fn) {
+	const table = quoteQualified(view.table);
+	const name = quoteQualified(fn);
+	const nulls = view.columns.flatMap((column) => column.mask === void 0 ? [] : [`case when ${column.mask} then '{}'::jsonb else pg_catalog.jsonb_build_object(${quoteLiteral(column.name)}, null) end`]);
+	return `-- ${fn}: a row of ${view.table} with ${restrictedColumns(view).join(", ")} null unless a read grant covers the column for the row, for SQL that reads ${view.table} without ${view.view}
+create or replace function ${name}(p_row ${table})
+returns ${table}
+language sql
+stable
+security invoker
+set search_path = ''
+as $$
+  select pg_catalog.jsonb_populate_record(
+    $1,
+    ${nulls.join("\n    || ")}
+  )
+  from (select ($1).*) r
+$$;
+revoke all on function ${name}(${table}) from public, anon, authenticated;
+grant execute on function ${name}(${table}) to ${view.roles.join(", ")};`;
+}
+/**
 * The view SQL: the `security_invoker` view, and with `--revoke-columns` the
 * owner-rights companion it joins for the restricted columns. The companion
 * masks every column with the full field decision and keeps only rows where
@@ -184,10 +216,12 @@ function columnRevokeSql(view) {
 function fieldViewsSql(views) {
 	return views.map((view) => {
 		const head = `-- field view over ${view.table}: ${restrictedColumns(view).join(", ")} read as null unless a read grant covers the column for the row`;
+		const mask = view.maskFunction === void 0 ? [] : [maskFunctionSql(view, view.maskFunction)];
 		if (view.companion === void 0) return [
 			head,
 			inlineViewSql(view),
-			grantView(view.view, view.roles)
+			grantView(view.view, view.roles),
+			...mask
 		].join("\n");
 		return [
 			head,
@@ -195,7 +229,8 @@ function fieldViewsSql(views) {
 			companionSql(view, view.companion),
 			grantView(view.companion, view.roles),
 			joinedViewSql(view, view.companion),
-			grantView(view.view, view.roles)
+			grantView(view.view, view.roles),
+			...mask
 		].join("\n");
 	}).join("\n\n");
 }

package/dist/{files-C5ZI27eV.js → files-acUbNwWt.js}

@@ -1,10 +1,19 @@
-import { n as CliError } from "./errors-CWTY6uih.js";
-import { existsSync, mkdirSync, readFileSync, realpathSync, renameSync, rmSync, writeFileSync } from "node:fs";
+import { n as CliError } from "./errors-DpP_U6Bf.js";
+import { existsSync, mkdirSync, readFileSync, realpathSync, renameSync, rmSync, statSync, writeFileSync } from "node:fs";
 import { dirname, relative, resolve } from "node:path";
 import { execFileSync } from "node:child_process";
 //#region src/cli/core/files.ts
+/** `/dev/null` and its kin: a rename over a device is refused, so it is written in place. */
+function isCharacterDevice(abs) {
+	try {
+		return statSync(abs).isCharacterDevice();
+	} catch {
+		return false;
+	}
+}
 function outcomeOf(abs, text) {
 	if (!existsSync(abs)) return "created";
+	if (isCharacterDevice(abs)) return "updated";
 	return readFileSync(abs, "utf8") === text ? "unchanged" : "updated";
 }
 /** What writing `files` would do, without writing. */
@@ -27,6 +36,10 @@ function applyFiles(cwd, files, options = {}) {
 		for (const [index, file] of files.entries()) {
 			if (planned[index]?.outcome === "unchanged") continue;
 			const target = resolve(cwd, file.path);
+			if (isCharacterDevice(target)) {
+				writeFileSync(target, file.text);
+				continue;
+			}
 			const temp = `${target}.permdock-${String(process.pid)}.tmp`;
 			mkdirSync(dirname(target), { recursive: true });
 			writeFileSync(temp, file.text);

package/dist/{fixtures-B7XrLeY7.js → fixtures-BTMW6zgU.js}

@@ -1,7 +1,7 @@
 import { r as isRecord } from "./compact-CAf557ZB.js";
-import { i as configError } from "./errors-CWTY6uih.js";
+import { i as configError } from "./errors-DpP_U6Bf.js";
 import { i as readJsonFile } from "./files-D_JIzUrP.js";
-import { a as loadModule, s as pickNamed } from "./load-DFS_ry0W.js";
+import { a as loadModule, s as pickNamed } from "./load-DxroEzH1.js";
 import { existsSync } from "node:fs";
 import { resolve } from "node:path";
 //#region src/cli/fixtures.ts

package/dist/{flags-C3DktBDY.js → flags-aaeRAdiD.js}

@@ -1,5 +1,5 @@
-import { n as CliError } from "./errors-CWTY6uih.js";
-import { n as secretInput } from "./credentials-DPyHmYz5.js";
+import { n as CliError } from "./errors-DpP_U6Bf.js";
+import { n as secretInput } from "./credentials-BpuTwd7a.js";
 //#region src/cli/core/flags.ts
 /** The flag vocabulary shared with better-supabase: one spelling per meaning. */
 const dbUrlFlags = { "db-url-stdin": {