permdock 0.5.0 → 0.7.0

package/dist/{from-snapshot-D2lZt4Dd.js → from-snapshot-Bz469dIh.js}

@@ -2,19 +2,20 @@ import { t as compact } from "./compact-CAf557ZB.js";
 import { n as freezeDeep } from "./freeze-CrU8nQeX.js";
 import { a as deniedMessage, i as approvalMessage, n as PermDockDeniedError, t as PermDockApprovalRequiredError } from "./errors-BKy0EfhN.js";
 import { o as sameId } from "./expiry-D4_YKRKD.js";
-import { c as listPermissions } from "./permission-registry-Br4jSNVi.js";
+import { c as listPermissions } from "./permission-registry-DpPtSKNZ.js";
 import { g as secondsOf, o as epochSeconds, t as INVALID_NOW } from "./time-DkWjdL98.js";
-import { a as normalizeMemberships, d as scopeList, m as tenantOf, o as resolveScope, t as activeFor } from "./scopes-CUPSjo9q.js";
-import { a as readOnlyActorRefuses, c as rowIdOf, l as rowValues, n as coveredByDelegation, u as evaluateCondition } from "./delegation-DaXVdDhM.js";
-import { b as synthesiseRole, m as findRole, v as listRoles } from "./grantee-Cn1HyUsI.js";
+import { f as scopeList, h as tenantOf, o as normalizeMemberships, s as resolveScope, t as activeFor } from "./scopes-BHsc-wp-.js";
+import { a as readOnlyActorRefuses, c as rowIdOf, l as rowValues, n as coveredByDelegation, u as evaluateCondition } from "./delegation-C5rOdTp5.js";
+import { b as synthesiseRole, m as findRole, v as listRoles } from "./grantee-BrRANrpT.js";
 import { a as grantCoversField, o as pickVisible, r as readWireValidity, t as isActive } from "./validity-CZ7-y0Cj.js";
-import { c as nowSeconds, d as resolveActiveTenant, f as rowInScope, n as inTeam, r as isMembershipExpired, s as nestedAppliesWithoutRow } from "./tenancy-DN2QAx9z.js";
+import { c as nowSeconds, d as resolveActiveTenant, f as rowInScope, n as inTeam, r as isMembershipExpired, s as nestedAppliesWithoutRow } from "./tenancy-CmeBQ6Nv.js";
 import { t as requiresApproval } from "./approval-required-TzNB9oQA.js";
-import { r as tokenPayload, t as decisionToken } from "./token-BLZcjQgt.js";
+import { r as tokenPayload, t as decisionToken } from "./token-2qYDvXz2.js";
 import { t as fromWireDelegation } from "./wire-delegation-Cv3W2eaM.js";
-import { n as matchGrantee } from "./grantee-match-DHArqY82.js";
+import { n as matchGrantee } from "./grantee-match-0RtHWQDx.js";
 import { t as resourceIdOf } from "./resource-ref-CaS9yVPi.js";
-import { a as deniedFor, n as mayUse, o as signSnapshot, r as permittedIds, t as whereFromGrants } from "./where-scope-Dv-WTP-w.js";
+import { i as permittedIds, o as deniedFor, r as mayUse, s as signSnapshot, t as whereFromGrants } from "./where-scope-wq2coopv.js";
+import { i as decideAllWith, n as canAllWith } from "./checks-BC_0mPIq.js";
 //#region src/core/snapshot-evaluate.ts
 function coveredByInclude(snapshot, permission) {
 	const include = snapshot.include;
@@ -51,7 +52,7 @@ function scopeOk(snapshot, grant, permission, subject, data, team, now, only) {
 		};
 		if (!activeFor(membership, scopes, principal.tenant)) return {
 			ok: false,
-			reason: principal.tenant === void 0 ? "no-membership" : "tenant-mismatch"
+			reason: principal.tenant === void 0 && principal.unheldTenant === void 0 ? "no-tenant" : principal.tenant === void 0 ? "no-membership" : "tenant-mismatch"
 		};
 		if (!inTeam(membership, scopes, team)) return {
 			ok: false,
@@ -361,7 +362,8 @@ function subjectFromSnapshot(snapshot, tenant) {
 	return freezeDeep(compact({
 		principal: principal === null ? null : compact({
 			...principal,
-			tenant: nextTenant
+			tenant: nextTenant,
+			unheldTenant: nextTenant === void 0 ? tenant : void 0
 		}),
 		delegation: fromWireDelegation(snapshot.subject.delegation),
 		context: snapshot.subject.context,
@@ -440,9 +442,14 @@ function fromSnapshot(snapshot, options = {}) {
 	const instance = {
 		can,
 		decide,
+		canAll: (checks, decideOptions) => canAllWith(can, checks, decideOptions),
+		decideAll: (checks, decideOptions) => decideAllWith(decide, checks, decideOptions),
 		decideEach(permission, rows, decideOptions) {
 			return Object.freeze(rows.map((row) => run(permission, row, decideOptions)));
 		},
+		decideIds(permission, ids) {
+			return Promise.resolve(Object.freeze(ids.map(() => deniedFor(permission, "unsupported"))));
+		},
 		decideFor(_principalId, permission) {
 			return Promise.resolve(deniedFor(permission, "unsupported"));
 		},

package/dist/generate-3FNO5P5Q.js

@@ -0,0 +1,159 @@
+import { n as SCIM_TABLES, r as SCIM_UNIQUE } from "./postgres-store-BL9M_CA1.js";
+import { o as quoteSqlIdent } from "./sql-B96movIM.js";
+import { n as fileSummary, t as applyFiles } from "./files-acUbNwWt.js";
+import { r as driftOf } from "./output-files-CCMdcFWb.js";
+//#region src/cli/scim/generate.ts
+const SCIM_MARKER = "-- generated by permdock scim generate";
+/** The client roles each dialect's data API connects as; none may reach the directory. */
+function clientRoles(dialect) {
+	switch (dialect) {
+		case "supabase": return [
+			"public",
+			"anon",
+			"authenticated"
+		];
+		case "neon": return [
+			"public",
+			"anonymous",
+			"authenticated"
+		];
+		case "guc": return ["public"];
+		default: return dialect;
+	}
+}
+/**
+* The directory `postgresDirectoryStore` reads and writes: users, groups and
+* group members keyed on `(tenant, id)`, with `userName` and `externalId`
+* unique per tenant. Member values are SCIM `value`s, not a foreign key to
+* users, because a member may be a nested group. No client role may read
+* or write the tables.
+*/
+function scimSchemaSql(input) {
+	const schema = quoteSqlIdent(input.schema);
+	const table = (name) => `${schema}.${quoteSqlIdent(name)}`;
+	const users = table(SCIM_TABLES.users);
+	const groups = table(SCIM_TABLES.groups);
+	const members = table(SCIM_TABLES.members);
+	const all = [
+		users,
+		groups,
+		members
+	].join(", ");
+	return `${SCIM_MARKER} (--dialect ${input.dialect})
+-- the SCIM directory postgresDirectoryStore reads and writes for scimHandler; every row belongs to one tenant
+create schema if not exists ${schema};
+
+create table if not exists ${users} (
+  seq bigint generated always as identity unique,
+  tenant text not null check (tenant <> ''),
+  id text not null check (id <> ''),
+  user_name text not null,
+  external_id text,
+  active boolean not null default true,
+  emails jsonb,
+  x jsonb,
+  created_at timestamptz not null default now(),
+  updated_at timestamptz not null default now(),
+  revision bigint not null default 1,
+  primary key (tenant, id),
+  constraint ${quoteSqlIdent(SCIM_UNIQUE.userName)} unique (tenant, user_name),
+  constraint ${quoteSqlIdent(SCIM_UNIQUE.userExternalId)} unique (tenant, external_id)
+);
+
+create table if not exists ${groups} (
+  seq bigint generated always as identity unique,
+  tenant text not null check (tenant <> ''),
+  id text not null check (id <> ''),
+  display_name text not null,
+  external_id text,
+  roles text[],
+  x jsonb,
+  created_at timestamptz not null default now(),
+  updated_at timestamptz not null default now(),
+  revision bigint not null default 1,
+  primary key (tenant, id),
+  constraint ${quoteSqlIdent(SCIM_UNIQUE.groupExternalId)} unique (tenant, external_id)
+);
+
+create table if not exists ${members} (
+  tenant text not null,
+  group_id text not null,
+  user_id text not null,
+  position integer not null default 0,
+  primary key (tenant, group_id, user_id),
+  foreign key (tenant, group_id) references ${groups} (tenant, id) on delete cascade
+);
+create index if not exists ${quoteSqlIdent(`${SCIM_TABLES.members}_user_idx`)} on ${members} (tenant, user_id);
+
+-- server only: grant select, insert, update and delete on these tables to the role postgresDirectoryStore
+-- connects as when it does not own them
+alter table ${users} enable row level security;
+alter table ${groups} enable row level security;
+alter table ${members} enable row level security;
+revoke all on table ${all} from ${clientRoles(input.dialect).join(", ")};
+`;
+}
+/** `supabase/schemas/<schema>/scim.sql` for Supabase, the pg-delta per-schema layout; `permdock_scim.sql` otherwise. */
+function scimOut(dialect, schema) {
+	return dialect === "supabase" ? `supabase/schemas/${schema}/scim.sql` : "permdock_scim.sql";
+}
+function runScimGenerate(input) {
+	const dialect = input.dialect ?? input.config.rls?.dialect ?? "supabase";
+	const schema = input.schema ?? input.config.rls?.schema ?? "permdock";
+	const sql = scimSchemaSql({
+		schema,
+		dialect
+	});
+	const out = input.out ?? scimOut(dialect, schema);
+	const data = {
+		out,
+		dialect,
+		schema,
+		tables: Object.values(SCIM_TABLES).map((name) => `${schema}.${name}`)
+	};
+	if (out === "-") return {
+		code: 0,
+		output: sql.trimEnd(),
+		data: {
+			...data,
+			sql
+		}
+	};
+	if (input.check) {
+		const drift = driftOf(input.cwd, [{
+			part: "scim",
+			rel: out,
+			text: sql
+		}]);
+		return drift.length === 0 ? {
+			code: 0,
+			output: `${out} is current`,
+			data
+		} : {
+			code: 1,
+			output: `${drift.join("\n")}\nrun permdock scim generate`,
+			data: {
+				...data,
+				drift
+			}
+		};
+	}
+	const applied = applyFiles(input.cwd, [{
+		path: out,
+		text: sql
+	}], { dryRun: input.dryRun });
+	return {
+		code: 0,
+		output: fileSummary(applied, input.dryRun),
+		data: {
+			...data,
+			files: applied
+		},
+		next: [{
+			when: "in CI, to fail when the file is stale",
+			command: "permdock scim generate --check"
+		}]
+	};
+}
+//#endregion
+export { runScimGenerate };

package/dist/{grantee-Cn1HyUsI.js → grantee-BrRANrpT.js}

@@ -1,7 +1,7 @@
 import { t as compact } from "./compact-CAf557ZB.js";
 import { n as freezeDeep, t as freezeCopy } from "./freeze-CrU8nQeX.js";
 import { i as ownKeys, n as isForbiddenKey, t as assertSafeKey } from "./paths-DXSHAMIa.js";
-import { c as listPermissions, o as isPermission } from "./permission-registry-Br4jSNVi.js";
+import { c as listPermissions, o as isPermission } from "./permission-registry-DpPtSKNZ.js";
 import { i as readAppData, r as parseAppData, t as assertAppData } from "./app-data-MuyzVqX8.js";
 //#region src/core/vocabulary.ts
 const ROLE_KIND = "role";
@@ -133,11 +133,10 @@ function synthesiseRole(key, options) {
 	const on = options?.on;
 	const assignable = options?.assignable ?? false;
 	const meta = options?.meta;
-	if (on === void 0) return makeRole(key, meta === void 0 ? { assignable } : {
+	const leaf = on === void 0 ? makeRole(key, meta === void 0 ? { assignable } : {
 		assignable,
 		meta
-	});
-	return makeRole(key, meta === void 0 ? {
+	}) : makeRole(key, meta === void 0 ? {
 		on,
 		assignable
 	} : {
@@ -145,6 +144,17 @@ function synthesiseRole(key, options) {
 		assignable,
 		meta
 	});
+	if (options?.shared !== true) return leaf;
+	const shared = Object.defineProperty({
+		...leaf,
+		shared: true
+	}, "kind", {
+		value: ROLE_KIND,
+		enumerable: false,
+		writable: false,
+		configurable: false
+	});
+	return Object.freeze(shared);
 }
 function isGrantee(value) {
 	return value !== null && typeof value === "object" && "kind" in value && typeof value.kind === "string";

package/dist/{grantee-conditions-CcXf8hMM.js → grantee-conditions-C6P1Tvol.js}

@@ -1,7 +1,7 @@
 import { a as sole, t as compact } from "./compact-CAf557ZB.js";
 import { a as expandRelation, c as isEdgeRelation, d as isSelfParented, l as isFieldRelation, m as restrictedStops, p as restrictedFor, s as isComputedRelation, u as isPrincipalRelation } from "./resource-relations-D_jw0BFx.js";
 import { d as isoNow } from "./time-DkWjdL98.js";
-import { c as rootScope, d as scopeList, o as resolveScope } from "./scopes-CUPSjo9q.js";
+import { f as scopeList, l as rootScope, s as resolveScope } from "./scopes-BHsc-wp-.js";
 //#region src/core/grantee-conditions.ts
 /**
 * Where a graph relation starts on the row: its own id when the relation is

package/dist/{grantee-match-DHArqY82.js → grantee-match-0RtHWQDx.js}

@@ -1,8 +1,8 @@
 import { t as compact } from "./compact-CAf557ZB.js";
 import { u as isoAt } from "./time-DkWjdL98.js";
-import { d as scopeList, t as activeFor } from "./scopes-CUPSjo9q.js";
-import { o as flattenGrantee } from "./grantee-Cn1HyUsI.js";
-import { r as relationCondition, t as inheritCondition } from "./grantee-conditions-CcXf8hMM.js";
+import { f as scopeList, t as activeFor } from "./scopes-BHsc-wp-.js";
+import { o as flattenGrantee } from "./grantee-BrRANrpT.js";
+import { r as relationCondition, t as inheritCondition } from "./grantee-conditions-C6P1Tvol.js";
 //#region src/core/grantee-match.ts
 function combineWhere(left, right) {
 	if (left === void 0) return right;

package/dist/h3/index.d.ts

@@ -1,7 +1,7 @@
-import { T as Policy, Vt as Snapshot, j as PolicyVocabulary, rr as Principal } from "../policy-types-DzwivBgR.js";
-import { r as PermDock } from "../permdock-D7eeLJER.js";
-import { D as ConnectionOptions, T as Connection, f as InvalidSignatureError, i as OpenApiHooks, u as SnapshotQuery, v as discoverViaSignatureAgent, x as webBotAuthVerifier } from "../server-types-BLd4MnBX.js";
-import { a as ProtectTarget, n as FetchAdapterOptions, r as FetchProtect, t as ContextReader } from "../fetch-adapter-qKJBuRqy.js";
+import { Gt as Snapshot, T as Policy, j as PolicyVocabulary, sr as Principal } from "../policy-types-B-F-qAZk.js";
+import { a as PermDock } from "../permdock-Dco6dyCK.js";
+import { D as ConnectionOptions, T as Connection, f as InvalidSignatureError, i as OpenApiHooks, u as SnapshotQuery, v as discoverViaSignatureAgent, x as webBotAuthVerifier } from "../server-types-C4gZUEZy.js";
+import { a as ProtectTarget, n as FetchAdapterOptions, r as FetchProtect, t as ContextReader } from "../fetch-adapter-CuhyYwC1.js";
 import { EventHandler, H3Event, H3EventContext, Middleware } from "h3";
 //#region src/h3/create.d.ts
 type H3PermDockOptions<TUser = unknown> = FetchAdapterOptions<H3Event, TUser>;

package/dist/h3/index.js

@@ -1,6 +1,6 @@
-import { d as discoverViaSignatureAgent, m as webBotAuthVerifier, u as InvalidSignatureError } from "../evaluations-DZ2CbV5k.js";
-import { i as decorate } from "../bind-CZzhx-Vj.js";
-import { t as fetchAdapter } from "../fetch-adapter-g0ypLkID.js";
+import { l as InvalidSignatureError, p as webBotAuthVerifier, u as discoverViaSignatureAgent } from "../evaluations-DReoiVBw.js";
+import { i as decorate } from "../bind-D1nO6fiC.js";
+import { t as fetchAdapter } from "../fetch-adapter-De-u6vhJ.js";
 //#region src/h3/create.ts
 function createPermDock(policy, options) {
 	const adapter = fetchAdapter(policy, options, "h3", (event) => event.req);

package/dist/{helpers-DTcZOzhF.js → helpers-DY3vXuGs.js}

@@ -1,15 +1,15 @@
 import { t as compact } from "./compact-CAf557ZB.js";
 import { n as freezeDeep } from "./freeze-CrU8nQeX.js";
 import { r as approverLeaves } from "./approvers-CqPOLD-o.js";
-import { t as describe } from "./describe-BybMRY7A.js";
-import { i as getRegistry, n as findPermission } from "./permission-registry-Br4jSNVi.js";
+import { t as describe } from "./describe-DZlnEtLy.js";
+import { i as getRegistry, n as findPermission } from "./permission-registry-DpPtSKNZ.js";
 import { t as assertAppData } from "./app-data-MuyzVqX8.js";
 import { a as durationOf, i as dateAt, u as isoAt } from "./time-DkWjdL98.js";
 import { r as relationReader, t as pendingRelations } from "./relations-BnCWnJGI.js";
 import { n as resolveRelated } from "./relation-walk-3OyDBF0S.js";
 import { n as toWireDelegation } from "./wire-delegation-Cv3W2eaM.js";
 import { i as approverRelationKey, s as ApprovalError, t as APPROVAL_HEADER } from "./types-DqzsnlSA.js";
-import { c as listAllApprovals, n as assertApprover } from "./store-4u_hxjWa.js";
+import { n as assertApprover, u as listAllApprovals } from "./store-DSP9oGvh.js";
 import { n as parseApprovalHeader } from "./approval-header-CJACtHkv.js";
 //#region src/approvals/relations.ts
 const DEFAULT_PARENT_DEPTH = 16;

package/dist/hono/index.d.ts

@@ -1,9 +1,9 @@
-import { T as Policy, j as PolicyVocabulary, rr as Principal } from "../policy-types-DzwivBgR.js";
-import { w as Permission } from "../vocabulary-D6lPdb4Z.js";
-import { r as PermDock } from "../permdock-D7eeLJER.js";
+import { T as Policy, j as PolicyVocabulary, sr as Principal } from "../policy-types-B-F-qAZk.js";
+import { u as Permission } from "../permission-types-DhNEmoRG.js";
+import { a as PermDock } from "../permdock-Dco6dyCK.js";
 import { n as RevocationFeed } from "../revocations-R07lFBnX.js";
-import { D as ConnectionOptions, T as Connection, f as InvalidSignatureError, i as OpenApiHooks, o as ProtectOptions, v as discoverViaSignatureAgent, x as webBotAuthVerifier } from "../server-types-BLd4MnBX.js";
-import { t as ServerAdapterOptions } from "../bind--9EFVYWF.js";
+import { D as ConnectionOptions, T as Connection, f as InvalidSignatureError, i as OpenApiHooks, o as ProtectOptions, v as discoverViaSignatureAgent, x as webBotAuthVerifier } from "../server-types-C4gZUEZy.js";
+import { t as ServerAdapterOptions } from "../bind-JDuvxjuW.js";
 import { Context, Hono, MiddlewareHandler } from "hono";
 import { SSEMessage, SSEStreamingApi } from "hono/streaming";
 import { WSEvents } from "hono/ws";

package/dist/hono/index.js

@@ -1,8 +1,8 @@
 import { t as compact } from "../compact-CAf557ZB.js";
 import { r as PermDockRevokedError } from "../errors-BKy0EfhN.js";
-import { d as discoverViaSignatureAgent, m as webBotAuthVerifier, u as InvalidSignatureError } from "../evaluations-DZ2CbV5k.js";
-import { t as problemFromError } from "../map-error-TCAdw-eW.js";
-import { r as bindKernel } from "../bind-CZzhx-Vj.js";
+import { l as InvalidSignatureError, p as webBotAuthVerifier, u as discoverViaSignatureAgent } from "../evaluations-DReoiVBw.js";
+import { t as problemFromError } from "../map-error-BQGyDm_M.js";
+import { r as bindKernel } from "../bind-D1nO6fiC.js";
 import { a as onRevoked, n as closeReason, r as guardIterable, t as POLICY_VIOLATION } from "../stream-CvdUS9V1.js";
 import { Hono } from "hono";
 //#region src/hono/create.ts

package/dist/{hosted-DBDX0M-P.d.ts → hosted-BmjzxQhp.d.ts}

@@ -1,4 +1,4 @@
-import { T as Policy, a as ApprovalRequirement, bn as Grantee, lr as Condition } from "./policy-types-DzwivBgR.js";
+import { T as Policy, a as ApprovalRequirement, mr as Condition, wn as Grantee } from "./policy-types-B-F-qAZk.js";
 //#region src/core/hosted.d.ts
 /** One grant authored in PermDock Cloud; its grantee is a declared role, plan or relation. */
 type HostedGrant = {
@@ -51,6 +51,18 @@ declare function parsePolicyDocument(json: unknown): PolicyDocument;
 declare function policyDocumentFromClaims(claims: Readonly<Record<string, unknown>>): PolicyDocument;
 /** True for the portable subset only: no `opaque`, no `sqlFunction`, no unknown op. */
 declare function isPortableCondition(value: unknown): value is Condition;
+type HostedGrantCheck = {
+  readonly ok: true;
+} | {
+  readonly ok: false;
+  readonly reason: HostedGrantDropReason;
+};
+/**
+ * Whether `mergeHostedGrants` would keep one candidate hosted grant, and the
+ * drop reason it would report when not. Needs no `PolicyDocument`, so a
+ * grant form can check a grant before it publishes one.
+ */
+declare function checkHostedGrant(policy: Policy, grant: unknown): HostedGrantCheck;
 /**
  * The code policy plus the hosted grants that pass every rule. Hosted
  * allows OR with code allows and any deny still wins, so a hosted grant can
@@ -75,4 +87,4 @@ type HostedPolicies = {
 };
 declare function hostedPolicies(source: PolicySource): HostedPolicies;
 //#endregion
-export { PolicyDocument as a, isPortableCondition as c, parsePolicyDocument as d, policyDocumentFromClaims as f, HostedPolicies as i, memoryPolicySource as l, HostedGrantDropReason as n, PolicySource as o, HostedGrantDropped as r, hostedPolicies as s, HostedGrant as t, mergeHostedGrants as u };
+export { HostedPolicies as a, checkHostedGrant as c, memoryPolicySource as d, mergeHostedGrants as f, HostedGrantDropped as i, hostedPolicies as l, policyDocumentFromClaims as m, HostedGrantCheck as n, PolicyDocument as o, parsePolicyDocument as p, HostedGrantDropReason as r, PolicySource as s, HostedGrant as t, isPortableCondition as u };

package/dist/{hosted-BZIAYvon.js → hosted-XBgU6RGT.js}

@@ -1,13 +1,13 @@
 import { r as isRecord, t as compact } from "./compact-CAf557ZB.js";
 import { n as freezeDeep } from "./freeze-CrU8nQeX.js";
 import { n as isForbiddenKey, s as splitPath } from "./paths-DXSHAMIa.js";
-import { a as deny, i as completeGrant, n as role, p as normalizeWhere, r as allow } from "./role-builder-CXbis5-X.js";
-import { a as getResource, n as findPermission } from "./permission-registry-Br4jSNVi.js";
+import { a as deny, i as completeGrant, n as role, p as normalizeWhere, r as allow } from "./role-builder-C1VJzvcr.js";
+import { a as getResource, n as findPermission } from "./permission-registry-DpPtSKNZ.js";
 import { d as isSelfParented } from "./resource-relations-D_jw0BFx.js";
 import { a as durationOf, l as isRfc3339, m as rfc3339 } from "./time-DkWjdL98.js";
 import { r as sha256Digest } from "./sha256-D9ihqmvd.js";
-import { _ as listPlans, m as findRole, o as flattenGrantee } from "./grantee-Cn1HyUsI.js";
-import { i as indexPolicy, t as declaredRoleNames } from "./policy-DLZJ5gAp.js";
+import { _ as listPlans, m as findRole, o as flattenGrantee } from "./grantee-BrRANrpT.js";
+import { i as indexPolicy, t as declaredRoleNames } from "./policy-DaJy4nK4.js";
 //#region src/core/hosted.ts
 function memoryPolicySource(document = null) {
 	const current = document === null ? null : parsePolicyDocument(document);
@@ -124,6 +124,7 @@ function approvalAtLeast(hosted, code) {
 function undeclaredKind(_grantee) {
 	return false;
 }
+/** Whether a hosted grant may name `grantee` on a permission of `permissionResource`. */
 function declaredGrantee(policy, grantee, permissionResource) {
 	switch (grantee.kind) {
 		case "role": return declaredRoleNames(policy).has(grantee.role);
@@ -156,6 +157,10 @@ function granteesAcceptable(policy, raw, permissionResource) {
 	const items = flattenGrantee(raw);
 	return items.length > 0 && items.every((item) => isRecord(item) && item.kind !== "relation" && (item.kind === "authenticated" || declaredGrantee(policy, item, permissionResource)));
 }
+/** The approvals the code allows on `key` carry; a hosted allow must meet each one. */
+function codeApprovals(policy, key) {
+	return policy.grants.filter((grant) => grant.effect === "allow" && grant.hosted === void 0 && grant.permission.key === key).map((grant) => grant.approval);
+}
 function buildGrant(policy, document, raw) {
 	if (!isRecord(raw) || typeof raw["id"] !== "string" || typeof raw["permission"] !== "string" || raw["effect"] !== void 0 && raw["effect"] !== "allow" && raw["effect"] !== "deny" || raw["to"] === void 0) return {
 		ok: false,
@@ -216,13 +221,10 @@ function buildGrant(policy, document, raw) {
 			reason: "invalid"
 		};
 	}
-	if (effect === "allow") {
-		const codeApprovals = policy.grants.filter((grant) => grant.effect === "allow" && grant.hosted === void 0 && grant.permission.key === permission.key).map((grant) => grant.approval);
-		if (!approvalAtLeast(built.approval, codeApprovals)) return {
-			ok: false,
-			reason: "weaker-approval"
-		};
-	}
+	if (effect === "allow" && !approvalAtLeast(built.approval, codeApprovals(policy, permission.key))) return {
+		ok: false,
+		reason: "weaker-approval"
+	};
 	return {
 		ok: true,
 		grant: freezeDeep({
@@ -234,6 +236,26 @@ function buildGrant(policy, document, raw) {
 		})
 	};
 }
+const CHECKED_DOCUMENT = Object.freeze({
+	v: 1,
+	id: "",
+	fingerprint: "",
+	catalog: "",
+	issuedAt: "",
+	grants: Object.freeze([])
+});
+/**
+* Whether `mergeHostedGrants` would keep one candidate hosted grant, and the
+* drop reason it would report when not. Needs no `PolicyDocument`, so a
+* grant form can check a grant before it publishes one.
+*/
+function checkHostedGrant(policy, grant) {
+	const result = buildGrant(policy, CHECKED_DOCUMENT, grant);
+	return result.ok ? { ok: true } : {
+		ok: false,
+		reason: result.reason
+	};
+}
 /** The grants of `document` that `policy` drops, in document order; `permdock/catalog` turns them into drift findings. */
 function hostedGrantDrops(policy, document) {
 	return document.grants.flatMap((raw) => {
@@ -312,4 +334,4 @@ function hostedPolicies(source) {
 	});
 }
 //#endregion
-export { mergeHostedGrants as a, memoryPolicySource as i, hostedPolicies as n, parsePolicyDocument as o, isPortableCondition as r, policyDocumentFromClaims as s, hostedGrantDrops as t };
+export { hostedPolicies as a, mergeHostedGrants as c, hostedGrantDrops as i, parsePolicyDocument as l, codeApprovals as n, isPortableCondition as o, declaredGrantee as r, memoryPolicySource as s, checkHostedGrant as t, policyDocumentFromClaims as u };

package/dist/{http-DXJ37RDA.js → http-Ca3Sr5x1.js}

@@ -1,5 +1,5 @@
 import { t as timeoutSignal } from "./timeout-D51niuQP.js";
-import { a as describeError, n as CliError } from "./errors-CWTY6uih.js";
+import { a as describeError, n as CliError } from "./errors-DpP_U6Bf.js";
 import { s as cliVersion } from "./version-CEbQ5UeM.js";
 import "./device-BARQ8eYG.js";
 //#region src/cli/core/http.ts

package/dist/{import-DMmOG27O.js → import-Bz0GefWg.js}

@@ -1,10 +1,10 @@
 import { r as isRecord } from "./compact-CAf557ZB.js";
-import { i as configError, u as usageResult } from "./errors-CWTY6uih.js";
+import { i as configError, u as usageResult } from "./errors-DpP_U6Bf.js";
 import { s as writeFileEnsuringDir } from "./files-D_JIzUrP.js";
-import { r as escapeSqlIdent, s as quoteSqlLiteral } from "./sql-B5T1IL83.js";
-import { C as parseMembershipsFlag, r as HELPERS } from "./shared-CD11nBbC.js";
-import { f as pgConnector } from "./policies-CO1oOymN.js";
-import { t as FIELD_VIEWS } from "./fields-D9tPVUUS.js";
+import { r as escapeSqlIdent, s as quoteSqlLiteral } from "./sql-B96movIM.js";
+import { C as parseMembershipsFlag, r as HELPERS } from "./shared-fMKOv8hP.js";
+import { f as pgConnector } from "./policies-B2lZIurj.js";
+import { t as FIELD_VIEWS } from "./fields-ClcQLrVc.js";
 import { n as emptySchema, r as isSchemaKind, t as emitPermissionsModule } from "./generate-CNU1pIOo.js";
 import { existsSync, readFileSync } from "node:fs";
 import { resolve } from "node:path";

package/dist/{import-CNV7I2Dw.js → import-DB2EG_iy.js}

@@ -1,10 +1,10 @@
 import { r as isRecord } from "./compact-CAf557ZB.js";
 import { t as byCodePoint } from "./compare-pfyVnBjE.js";
 import { i as readJsonFile } from "./files-D_JIzUrP.js";
-import { t as applyFiles } from "./files-C5ZI27eV.js";
-import { n as httpRequest } from "./http-DXJ37RDA.js";
+import { t as applyFiles } from "./files-acUbNwWt.js";
+import { n as httpRequest } from "./http-Ca3Sr5x1.js";
 import { i as schemaExpression, t as emitPermissionsModule } from "./generate-CNU1pIOo.js";
-import { t as validateOpenapi } from "./schema-yLuBWWsh.js";
+import { t as validateOpenapi } from "./schema-gIcCx7zM.js";
 import { existsSync, readFileSync } from "node:fs";
 import { resolve } from "node:path";
 //#region ../../node_modules/.pnpm/yaml@2.9.1/node_modules/yaml/browser/dist/nodes/identity.js

package/dist/{index-CxGUswIC.d.ts → index-BE8y3moU.d.ts}

@@ -1,8 +1,8 @@
-import { Nn as Decision, Rt as Instant, T as Policy, Yn as AuthorizationDetail, et as MembershipSource, fn as Approver, ir as Subject, it as RelationSource, nr as Membership, ut as TokenSigner } from "./policy-types-DzwivBgR.js";
-import { E as PermissionTree, V as AppData, w as Permission } from "./vocabulary-D6lPdb4Z.js";
-import { r as PermDock } from "./permdock-D7eeLJER.js";
-import { a as ApprovalDelegationSource, c as ApprovalListQuery, g as ApprovalVerdict, i as ApprovalDelegation, l as ApprovalPage, m as ApprovalStore, o as ApprovalInspectResult, r as ApprovalCancelMeta, s as ApprovalListFilter, u as ApprovalRequest } from "./types-CCpc2Dcv.js";
-import { a as AccessReviewItemQuery, c as AccessReviewStore, i as AccessReviewItemPage, n as AccessReviewDecision, r as AccessReviewItem, t as AccessReview } from "./types-_sHy8BQf.js";
+import { $n as AuthorizationDetail, Ln as Decision, Rt as Instant, T as Policy, et as MembershipSource, gn as Approver, it as RelationSource, lr as Subject, or as Membership, ut as TokenSigner } from "./policy-types-B-F-qAZk.js";
+import { O as AppData, f as PermissionTree, u as Permission } from "./permission-types-DhNEmoRG.js";
+import { a as PermDock } from "./permdock-Dco6dyCK.js";
+import { a as ApprovalDelegationSource, c as ApprovalListQuery, g as ApprovalVerdict, i as ApprovalDelegation, l as ApprovalPage, m as ApprovalStore, o as ApprovalInspectResult, r as ApprovalCancelMeta, s as ApprovalListFilter, u as ApprovalRequest } from "./types-DC44-hqb.js";
+import { a as AccessReviewItemQuery, c as AccessReviewStore, i as AccessReviewItemPage, n as AccessReviewDecision, r as AccessReviewItem, t as AccessReview } from "./types-CfiKC5aN.js";
 import { t as JsonSchemaNode } from "./json-schema-CN_iLFH2.js";
 //#region src/approvals/access-reviews/handler.d.ts
 type AccessReviewsHandlerOptions = {
@@ -135,6 +135,22 @@ type MatchDelegationOptions = {
 declare function matchDelegation(request: ApprovalRequest, delegate: Subject, options: MatchDelegationOptions): Promise<ApprovalDelegationMatch | undefined>;
 //#endregion
 //#region src/approvals/idempotency.d.ts
+/** The approve or reject call a key was first used for. */
+type IdempotentCall = {
+  readonly action: "approve" | "reject";
+  /** The approval id in the path. */
+  readonly id: string;
+  /** The request body text as read; `""` without a body. */
+  readonly body: string;
+};
+/** One `Idempotency-Key` entry as `approvalsHandler` stores it. */
+type IdempotencyRecord = {
+  /** The store key: the approver's principal id and the field value, joined by a newline. */
+  readonly key: string;
+  readonly response: IdempotentResponse;
+  /** Epoch milliseconds. */
+  readonly expiresAt: number;
+};
 /** A response the approvals handler replays for a repeated `Idempotency-Key`. */
 type IdempotentResponse = {
   /** Which request produced it: a reused key with another fingerprint is refused with `422`. */
@@ -156,6 +172,22 @@ type IdempotencyStore = {
   /** `expiresAt` is epoch milliseconds; the store may drop the entry after it. */
   set(key: string, response: IdempotentResponse, expiresAt: number): void | Promise<void>;
 };
+/** The `IdempotencyStore` key for one approver's `Idempotency-Key`: keys never cross approvers. */
+declare function idempotencyRecordKey(principalId: string, key: string): string;
+/**
+ * The record `approvalsHandler` stores after `call` answered `response`:
+ * the status, headers and body text, the call's fingerprint, and an expiry
+ * 24 hours after `now` (epoch milliseconds, default the clock).
+ */
+declare function idempotencyRecord(input: {
+  readonly principalId: string;
+  readonly key: string;
+  readonly call: IdempotentCall;
+  readonly response: Response;
+  readonly now?: number;
+}): Promise<IdempotencyRecord>;
+/** Whether a stored response came from the same call: a reused key with another call is refused with `422`. */
+declare function matchesIdempotencyRecord(response: IdempotentResponse, call: IdempotentCall): boolean;
 /** An in-process `IdempotencyStore`, for one instance and for tests. */
 declare function memoryIdempotencyStore(): IdempotencyStore;
 //#endregion
@@ -193,8 +225,6 @@ type ApprovalsHandlerOptions = {
    */
   readonly idempotency?: IdempotencyStore;
 };
-/** An approval as the approvals API shows it: never the resume `token`. */
-type ApprovalView = Omit<ApprovalRequest, "token">;
 declare function approvalsHandler(store: ApprovalStore, options: ApprovalsHandlerOptions): (request: Request) => Promise<Response>;
 //#endregion
 //#region src/approvals/parse-request.d.ts
@@ -256,6 +286,18 @@ type SignApprovalOptions = {
  */
 declare function signApproval(request: ApprovalRequest, signer: TokenSigner | undefined, options?: SignApprovalOptions): Promise<string | undefined>;
 //#endregion
+//#region src/approvals/entity-tag.d.ts
+/** An approval as the approvals API shows it: never the resume `token`. */
+type ApprovalView = Omit<ApprovalRequest, "token">;
+/** The request without its resume `token`; every other field stays. */
+declare function approvalView(request: ApprovalRequest): ApprovalView;
+/**
+ * A strong RFC 9110 entity tag: the quoted `sha-256:` digest of
+ * `approvalView(request)` as RFC 8785 JSON. A field outside
+ * `ApprovalRequest` changes the tag, so hash the stored request as is.
+ */
+declare function approvalEntityTag(request: ApprovalRequest): string;
+//#endregion
 //#region src/approvals/relations.d.ts
 type ApproverRelationsOptions = {
   /** The object graph relation approvers are read from; without it they match nobody. */
@@ -428,4 +470,4 @@ declare function memoryApprovalStore(options?: {
   readonly now?: () => Instant;
 }): MemoryApprovalStore;
 //#endregion
-export { AccessReviewVerdict as $, APPROVAL_REQUEST_SCHEMA as A, matchDelegation as B, ApproverRelationsOptions as C, SignApprovalOptions as D, ApprovalSignatureEntry as E, IdempotencyStore as F, pageAccessReviewItems as G, parseApprovalDelegation as H, IdempotentResponse as I, StartAccessReviewInput as J, AccessReviewHolder as K, memoryIdempotencyStore as L, ApprovalView as M, ApprovalsHandlerOptions as N, approvalSignatureClaims as O, approvalsHandler as P, isAccessReviewError as Q, ApprovalDelegationMatch as R, vouchApproval as S, ApprovalSignatureClaims as T, MemoryAccessReviewStore as U, memoryApprovalDelegationSource as V, memoryAccessReviewStore as W, AccessReviewError as X, startAccessReview as Y, AccessReviewErrorCode as Z, resolveApproval as _, approverPermissions as a, storedApprovalToken as b, decodeApprovalCursor as c, pageApprovals as d, accessReviewerEligible as et, cancelApprovals as f, requestApproval as g, readApprovalHeader as h, memoryApprovalStore as i, parseApprovalRequest as j, signApproval as k, encodeApprovalCursor as l, inspectApproval as m, applyApprovalVerdict as n, AccessReviewsHandlerOptions as nt, ApprovalCursorPosition as o, consumeApproval as p, AccessReviewOptions as q, assertApprover as r, accessReviewsHandler as rt, approvalPageSize as s, MemoryApprovalStore as t, decideAccessReviewItem as tt, listAllApprovals as u, resumeDecision as v, approverRelations as w, summarizeSubject as x, resumeFromHeader as y, MatchDelegationOptions as z };
+export { AccessReviewHolder as $, SignApprovalOptions as A, IdempotentResponse as B, ApproverRelationsOptions as C, approvalView as D, approvalEntityTag as E, ApprovalsHandlerOptions as F, ApprovalDelegationMatch as G, idempotencyRecordKey as H, approvalsHandler as I, memoryApprovalDelegationSource as J, MatchDelegationOptions as K, IdempotencyRecord as L, signApproval as M, APPROVAL_REQUEST_SCHEMA as N, ApprovalSignatureClaims as O, parseApprovalRequest as P, pageAccessReviewItems as Q, IdempotencyStore as R, vouchApproval as S, ApprovalView as T, matchesIdempotencyRecord as U, idempotencyRecord as V, memoryIdempotencyStore as W, MemoryAccessReviewStore as X, parseApprovalDelegation as Y, memoryAccessReviewStore as Z, resolveApproval as _, approverPermissions as a, isAccessReviewError as at, storedApprovalToken as b, decodeApprovalCursor as c, decideAccessReviewItem as ct, pageApprovals as d, AccessReviewOptions as et, cancelApprovals as f, requestApproval as g, readApprovalHeader as h, memoryApprovalStore as i, AccessReviewErrorCode as it, approvalSignatureClaims as j, ApprovalSignatureEntry as k, encodeApprovalCursor as l, AccessReviewsHandlerOptions as lt, inspectApproval as m, applyApprovalVerdict as n, startAccessReview as nt, ApprovalCursorPosition as o, AccessReviewVerdict as ot, consumeApproval as p, matchDelegation as q, assertApprover as r, AccessReviewError as rt, approvalPageSize as s, accessReviewerEligible as st, MemoryApprovalStore as t, StartAccessReviewInput as tt, listAllApprovals as u, accessReviewsHandler as ut, resumeDecision as v, approverRelations as w, summarizeSubject as x, resumeFromHeader as y, IdempotentCall as z };