permdock 0.6.0 → 0.7.0

package/dist/{evaluations-C_1vdSZc.d.ts → evaluations-BCddEOfO.d.ts}

@@ -1,6 +1,6 @@
-import { T as Policy } from "./policy-types-n0uRTsW8.js";
-import { r as PermDock } from "./permdock-SV8ZINYT.js";
-import { m as ApprovalStore } from "./types-BdtSDbBO.js";
+import { T as Policy } from "./policy-types-B-F-qAZk.js";
+import { a as PermDock } from "./permdock-Dco6dyCK.js";
+import { m as ApprovalStore } from "./types-DC44-hqb.js";
 //#region src/server/evaluations.d.ts
 /** AuthZEN 1.0 section 7.1.2.1 `options.evaluations_semantic` values. */
 declare const EVALUATIONS_SEMANTICS: readonly ["execute_all", "deny_on_first_deny", "permit_on_first_permit"];
@@ -13,7 +13,7 @@ declare function evaluationsSemantic(body: Readonly<Record<string, unknown>>): E
  */
 declare function evaluateBatch<T extends {
   readonly decision: boolean;
-}>(items: readonly unknown[], semantic: EvaluationsSemantic, rowOf: (item: unknown) => Promise<T>): Promise<T[]>;
+}, I = unknown>(items: readonly I[], semantic: EvaluationsSemantic, rowOf: (item: I) => Promise<T>): Promise<T[]>;
 declare function evaluationsHandler(options: {
   readonly policy: Policy;
   readonly resolve?: (request: Request) => Promise<PermDock>;

package/dist/{evaluations-beAooV0n.js → evaluations-DReoiVBw.js}

@@ -1,12 +1,12 @@
 import { r as isRecord, t as compact } from "./compact-CAf557ZB.js";
 import { t as PROBLEM_BASE } from "./validation-error-ZfUHbKvf.js";
 import { t as wireDenials } from "./wire-denial-C7PaVYEM.js";
-import { c as listPermissions, g as formerScopes, h as formerKeys } from "./permission-registry-Br4jSNVi.js";
+import { c as listPermissions, g as formerScopes, h as formerKeys } from "./permission-registry-DpPtSKNZ.js";
 import { h as secondsAt } from "./time-DkWjdL98.js";
 import { n as resourceRef } from "./resource-ref-CaS9yVPi.js";
 import { n as readBodyText } from "./body-text-QcXok_SI.js";
 import { c as problemResponse, d as validationProblem, n as batchTooLarge } from "./problem-CTviyH5L.js";
-import { i as readApprovalHeader, s as resumeDecision } from "./helpers-CBYVMjwh.js";
+import { i as readApprovalHeader, s as resumeDecision } from "./helpers-DY3vXuGs.js";
 import { t as bodyTooLarge } from "./body-CH5of8Ne.js";
 import { t as timeoutSignal } from "./timeout-D51niuQP.js";
 //#region src/core/decision.ts
@@ -420,7 +420,7 @@ function unknownSemanticProblem() {
 * order, stopping after the first deny or permit.
 */
 async function evaluateBatch(items, semantic, rowOf) {
-	if (semantic === "execute_all") return Promise.all(items.map(rowOf));
+	if (semantic === "execute_all") return Promise.all(items.map((item) => rowOf(item)));
 	const stopOn = semantic === "permit_on_first_permit";
 	const rows = [];
 	for (const item of items) {
@@ -607,4 +607,4 @@ function evaluationsHandler(options) {
 	};
 }
 //#endregion
-export { wireResourceId as _, evaluationReasons as a, unknownSemanticProblem as c, discoverViaSignatureAgent as d, invalidSignatureProblem as f, permissionLookup as g, itemResourceData as h, evaluateBatch as i, withRequestId as l, webBotAuthVerifier as m, applyApprovalResume as n, evaluationsHandler as o, invalidSignatureResponse as p, authzenMetadata as r, evaluationsSemantic as s, EVALUATIONS_SEMANTICS as t, InvalidSignatureError as u, NO_GRANT as v };
+export { NO_GRANT as _, evaluationReasons as a, withRequestId as c, invalidSignatureProblem as d, invalidSignatureResponse as f, wireResourceId as g, permissionLookup as h, evaluateBatch as i, InvalidSignatureError as l, itemResourceData as m, applyApprovalResume as n, evaluationsHandler as o, webBotAuthVerifier as p, authzenMetadata as r, evaluationsSemantic as s, EVALUATIONS_SEMANTICS as t, discoverViaSignatureAgent as u };

package/dist/eve/index.d.ts

@@ -1,8 +1,8 @@
-import { T as Policy, j as PolicyVocabulary, rr as Principal } from "../policy-types-n0uRTsW8.js";
-import { w as Permission } from "../vocabulary-CN8H_9UF.js";
-import { r as PermDock } from "../permdock-SV8ZINYT.js";
-import { u as ApprovalRequest } from "../types-BdtSDbBO.js";
-import { o as AgentAdapterOptions, t as AgentPermDock } from "../create-CBMmFie-.js";
+import { T as Policy, j as PolicyVocabulary, sr as Principal } from "../policy-types-B-F-qAZk.js";
+import { u as Permission } from "../permission-types-DhNEmoRG.js";
+import { a as PermDock } from "../permdock-Dco6dyCK.js";
+import { u as ApprovalRequest } from "../types-DC44-hqb.js";
+import { o as AgentAdapterOptions, t as AgentPermDock } from "../create-UTnUVETj.js";
 //#region src/eve/create.d.ts
 /** Structural `SessionAuthContext` from `eve`. */
 type EvePrincipal = {

package/dist/eve/index.js

@@ -1,8 +1,8 @@
 import { t as compact } from "../compact-CAf557ZB.js";
-import { c as withApp } from "../permdock-BrAscV28.js";
+import { l as withApp } from "../permdock-BfWEeMqk.js";
 import { c as isApprovalError } from "../types-DqzsnlSA.js";
-import { o as resolveApproval } from "../helpers-CBYVMjwh.js";
-import { t as agentRuntime } from "../create-CGm28gyI.js";
+import { o as resolveApproval } from "../helpers-DY3vXuGs.js";
+import { t as agentRuntime } from "../create-Cb86Z8Im.js";
 import { t as boundedMap } from "../lru-8q4WZjBV.js";
 //#region src/eve/create.ts
 const TOKENS_PER_PROCESS = 1e3;

package/dist/express/index.d.ts

@@ -1,8 +1,8 @@
-import { T as Policy, j as PolicyVocabulary, rr as Principal } from "../policy-types-n0uRTsW8.js";
-import { w as Permission } from "../vocabulary-CN8H_9UF.js";
-import { r as PermDock } from "../permdock-SV8ZINYT.js";
-import { f as InvalidSignatureError, i as OpenApiHooks, o as ProtectOptions, v as discoverViaSignatureAgent, x as webBotAuthVerifier } from "../server-types-CKQiCnON.js";
-import { t as ServerAdapterOptions } from "../bind-DOyrv6zi.js";
+import { T as Policy, j as PolicyVocabulary, sr as Principal } from "../policy-types-B-F-qAZk.js";
+import { u as Permission } from "../permission-types-DhNEmoRG.js";
+import { a as PermDock } from "../permdock-Dco6dyCK.js";
+import { f as InvalidSignatureError, i as OpenApiHooks, o as ProtectOptions, v as discoverViaSignatureAgent, x as webBotAuthVerifier } from "../server-types-C4gZUEZy.js";
+import { t as ServerAdapterOptions } from "../bind-JDuvxjuW.js";
 import { i as toRequest, r as sendResponse } from "../http-B_LphE5Y.js";
 import { ErrorRequestHandler, Request, RequestHandler, Response, Router } from "express";
 //#region src/express/create.d.ts

package/dist/express/index.js

@@ -1,7 +1,7 @@
 import { r as hasCredentials } from "../http-BBoKefeS.js";
-import { d as discoverViaSignatureAgent, m as webBotAuthVerifier, u as InvalidSignatureError } from "../evaluations-beAooV0n.js";
-import { t as problemFromError } from "../map-error-Dr70oA_3.js";
-import { i as decorate, r as bindKernel } from "../bind-CAvgUuKs.js";
+import { l as InvalidSignatureError, p as webBotAuthVerifier, u as discoverViaSignatureAgent } from "../evaluations-DReoiVBw.js";
+import { t as problemFromError } from "../map-error-BQGyDm_M.js";
+import { i as decorate, r as bindKernel } from "../bind-D1nO6fiC.js";
 import { n as sendResponse, r as toRequest } from "../http-ujKm0JXE.js";
 import express from "express";
 //#region src/express/create.ts

package/dist/fastify/index.d.ts

@@ -1,8 +1,8 @@
-import { T as Policy, j as PolicyVocabulary, rr as Principal } from "../policy-types-n0uRTsW8.js";
-import { w as Permission } from "../vocabulary-CN8H_9UF.js";
-import { r as PermDock } from "../permdock-SV8ZINYT.js";
-import { f as InvalidSignatureError, i as OpenApiHooks, o as ProtectOptions, v as discoverViaSignatureAgent, x as webBotAuthVerifier } from "../server-types-CKQiCnON.js";
-import { t as ServerAdapterOptions } from "../bind-DOyrv6zi.js";
+import { T as Policy, j as PolicyVocabulary, sr as Principal } from "../policy-types-B-F-qAZk.js";
+import { u as Permission } from "../permission-types-DhNEmoRG.js";
+import { a as PermDock } from "../permdock-Dco6dyCK.js";
+import { f as InvalidSignatureError, i as OpenApiHooks, o as ProtectOptions, v as discoverViaSignatureAgent, x as webBotAuthVerifier } from "../server-types-C4gZUEZy.js";
+import { t as ServerAdapterOptions } from "../bind-JDuvxjuW.js";
 import { FastifyPluginAsync, FastifyReply, FastifyRequest, FastifySchema, FastifyTypeProvider, FastifyTypeProviderDefault, RawRequestDefaultExpression, RawServerDefault, RouteGenericInterface } from "fastify";
 //#region src/server/http.d.ts
 /** A Fastify-style reply: `code`, `header` and `send`. */

package/dist/fastify/index.js

@@ -1,7 +1,7 @@
 import { c as writeReply, i as headersFrom, n as firstHeader, r as hasCredentials, t as fetchRequest } from "../http-BBoKefeS.js";
-import { d as discoverViaSignatureAgent, m as webBotAuthVerifier, u as InvalidSignatureError } from "../evaluations-beAooV0n.js";
-import { t as problemFromError } from "../map-error-Dr70oA_3.js";
-import { i as decorate, r as bindKernel } from "../bind-CAvgUuKs.js";
+import { l as InvalidSignatureError, p as webBotAuthVerifier, u as discoverViaSignatureAgent } from "../evaluations-DReoiVBw.js";
+import { t as problemFromError } from "../map-error-BQGyDm_M.js";
+import { i as decorate, r as bindKernel } from "../bind-D1nO6fiC.js";
 //#region src/fastify/http.ts
 function toRequest(request) {
 	const host = firstHeader(request.headers.host) ?? "localhost";

package/dist/{fetch-adapter-Dw0MTS3D.d.ts → fetch-adapter-CuhyYwC1.d.ts}

@@ -1,8 +1,8 @@
-import { w as Permission } from "./vocabulary-CN8H_9UF.js";
-import { a as OperationInput, t as Operation } from "./operations-X0VM7F3m.js";
+import { u as Permission } from "./permission-types-DhNEmoRG.js";
+import { a as OperationInput, t as Operation } from "./operations-BNLes61x.js";
 import { n as RevocationFeed } from "./revocations-R07lFBnX.js";
-import { o as ProtectOptions } from "./server-types-CKQiCnON.js";
-import { t as ServerAdapterOptions } from "./bind-DOyrv6zi.js";
+import { o as ProtectOptions } from "./server-types-C4gZUEZy.js";
+import { t as ServerAdapterOptions } from "./bind-JDuvxjuW.js";
 //#region src/server/fetch-adapter.d.ts
 /** What `protect` checks: a permission, an operation from `defineOperations`, or `null` for a route that needs only OAuth scopes. */
 type ProtectTarget = Permission | Operation | null;

package/dist/{fetch-adapter-DD_gfmrC.js → fetch-adapter-De-u6vhJ.js}

@@ -1,9 +1,9 @@
 import { t as compact } from "./compact-CAf557ZB.js";
-import { o as isPermission } from "./permission-registry-Br4jSNVi.js";
+import { o as isPermission } from "./permission-registry-DpPtSKNZ.js";
 import { r as hasCredentials } from "./http-BBoKefeS.js";
 import { a as methodNotAllowed } from "./problem-CTviyH5L.js";
-import { t as problemFromError } from "./map-error-Dr70oA_3.js";
-import { i as decorate, r as bindKernel } from "./bind-CAvgUuKs.js";
+import { t as problemFromError } from "./map-error-BQGyDm_M.js";
+import { i as decorate, r as bindKernel } from "./bind-D1nO6fiC.js";
 //#region src/server/fetch-adapter.ts
 /**
 * `protect(target, data, options)(handler)` for a framework whose routes are

package/dist/{fields-OYG_JR78.js → fields-ClcQLrVc.js}

@@ -1,7 +1,7 @@
-import { i as configError } from "./errors-CWTY6uih.js";
-import { s as jsonSchemaOf } from "./catalog-doc-Cdn7-0pQ.js";
-import { F as quoteQualified, N as quoteIdent, P as quoteLiteral, j as helperSchema, s as signedIn } from "./shared-BAK8t4Uo.js";
-import { c as branchClauses, i as orSql, s as andSql, u as wrapSql } from "./policies-DP2nqRoF.js";
+import { i as configError } from "./errors-DpP_U6Bf.js";
+import { c as jsonSchemaOf } from "./catalog-doc-CV9s6B1S.js";
+import { A as quoteQualified, E as helperSchema, O as quoteIdent, k as quoteLiteral, s as signedIn } from "./shared-fMKOv8hP.js";
+import { c as branchClauses, i as orSql, s as andSql, u as wrapSql } from "./policies-B2lZIurj.js";
 //#region src/cli/rls/fields.ts
 /** Names of the field-view objects. Part of the SQL contract. */
 const FIELD_VIEWS = {
@@ -12,7 +12,9 @@ const FIELD_VIEWS = {
 	/** The companion's row-key column, joined to the base table's key. */
 	key: "permdock_key",
 	/** Marks the companion so doctor PD022 knows it reads as its owner on purpose. */
-	comment: "permdock:field-companion"
+	comment: "permdock:field-companion",
+	/** `<table>_mask(p_row)`: the row-masking function `fields: 'mask'` adds. */
+	mask: "_mask"
 };
 function covers(branch, column) {
 	return branch.fields === void 0 || branch.fields.includes(column);
@@ -67,12 +69,13 @@ function viewName(table, suffix) {
 	return `${table}${suffix}`;
 }
 /**
-* `<helper schema>.<table>_visible_fields`: outside the Data API's schemas,
-* so its owner rights reach clients only through the `_visible` join.
+* `<helper schema>.<table><suffix>`: outside the Data API's schemas, so the
+* companion's owner rights reach clients only through the `_visible` join and
+* the mask function is neither an RPC nor a computed field.
 */
-function companionName(ctx, table) {
+function helperObjectName(ctx, table, suffix) {
 	const base = table.startsWith("public.") ? table.slice(7) : table.replaceAll(".", "_");
-	return `${helperSchema(ctx)}.${viewName(base, FIELD_VIEWS.companion)}`;
+	return `${helperSchema(ctx)}.${viewName(base, suffix)}`;
 }
 /**
 * One view per table whose read grants limit fields. A column is restricted
@@ -93,7 +96,7 @@ function fieldViews(policy, ctx, branches, options, warnings) {
 		const resource = reads.find((branch) => branch.resource !== void 0)?.resource;
 		if (!limited || allows.length === 0 || resource === void 0) continue;
 		const names = schemaColumns(policy, resource);
-		if (names === void 0) throw configError(`PermDock CLI: --fields views needs the ${resource} schema's JSON Schema (Standard JSON Schema) to list the columns of ${table}`);
+		if (names === void 0) throw configError(`PermDock CLI: --fields ${options.mask === true ? "mask" : "views"} needs the ${resource} schema's JSON Schema (Standard JSON Schema) to list the columns of ${table}`);
 		const key = policy.resources.get(resource)?.id ?? "id";
 		const restricted = (column) => column !== key && (allows.some((branch) => branch.fields !== void 0 && !branch.fields.includes(column)) || denies.some((branch) => branch.fields?.includes(column) === true));
 		const columns = names.map((name) => {
@@ -116,7 +119,8 @@ function fieldViews(policy, ctx, branches, options, warnings) {
 			key,
 			columns,
 			roles: reads.some((branch) => branch.roles.includes("anon")) ? ["anon", "authenticated"] : ["authenticated"],
-			...options.revokeColumns ? { companion: companionName(ctx, table) } : {}
+			...options.revokeColumns ? { companion: helperObjectName(ctx, table, FIELD_VIEWS.companion) } : {},
+			...options.mask === true ? { maskFunction: helperObjectName(ctx, table, FIELD_VIEWS.mask) } : {}
 		});
 	}
 	return views;
@@ -176,6 +180,34 @@ function columnRevokeSql(view) {
 	return `revoke select (${columnList(restrictedColumns(view))}) on table ${quoteQualified(view.table)} from anon, authenticated;`;
 }
 /**
+* `<table>_mask(p_row)`: the row with each restricted column the caller may
+* not read set to null, by the same masks as the view. It reads only the row
+* it is given, so its caller decides which rows; `security invoker`, because
+* it needs nothing beyond the helpers the masks call. The body names the
+* parameter `$1`, since a column called `p_row` would shadow the name.
+*/
+function maskFunctionSql(view, fn) {
+	const table = quoteQualified(view.table);
+	const name = quoteQualified(fn);
+	const nulls = view.columns.flatMap((column) => column.mask === void 0 ? [] : [`case when ${column.mask} then '{}'::jsonb else pg_catalog.jsonb_build_object(${quoteLiteral(column.name)}, null) end`]);
+	return `-- ${fn}: a row of ${view.table} with ${restrictedColumns(view).join(", ")} null unless a read grant covers the column for the row, for SQL that reads ${view.table} without ${view.view}
+create or replace function ${name}(p_row ${table})
+returns ${table}
+language sql
+stable
+security invoker
+set search_path = ''
+as $$
+  select pg_catalog.jsonb_populate_record(
+    $1,
+    ${nulls.join("\n    || ")}
+  )
+  from (select ($1).*) r
+$$;
+revoke all on function ${name}(${table}) from public, anon, authenticated;
+grant execute on function ${name}(${table}) to ${view.roles.join(", ")};`;
+}
+/**
 * The view SQL: the `security_invoker` view, and with `--revoke-columns` the
 * owner-rights companion it joins for the restricted columns. The companion
 * masks every column with the full field decision and keeps only rows where
@@ -184,10 +216,12 @@ function columnRevokeSql(view) {
 function fieldViewsSql(views) {
 	return views.map((view) => {
 		const head = `-- field view over ${view.table}: ${restrictedColumns(view).join(", ")} read as null unless a read grant covers the column for the row`;
+		const mask = view.maskFunction === void 0 ? [] : [maskFunctionSql(view, view.maskFunction)];
 		if (view.companion === void 0) return [
 			head,
 			inlineViewSql(view),
-			grantView(view.view, view.roles)
+			grantView(view.view, view.roles),
+			...mask
 		].join("\n");
 		return [
 			head,
@@ -195,7 +229,8 @@ function fieldViewsSql(views) {
 			companionSql(view, view.companion),
 			grantView(view.companion, view.roles),
 			joinedViewSql(view, view.companion),
-			grantView(view.view, view.roles)
+			grantView(view.view, view.roles),
+			...mask
 		].join("\n");
 	}).join("\n\n");
 }

package/dist/{files-C5ZI27eV.js → files-acUbNwWt.js}

@@ -1,10 +1,19 @@
-import { n as CliError } from "./errors-CWTY6uih.js";
-import { existsSync, mkdirSync, readFileSync, realpathSync, renameSync, rmSync, writeFileSync } from "node:fs";
+import { n as CliError } from "./errors-DpP_U6Bf.js";
+import { existsSync, mkdirSync, readFileSync, realpathSync, renameSync, rmSync, statSync, writeFileSync } from "node:fs";
 import { dirname, relative, resolve } from "node:path";
 import { execFileSync } from "node:child_process";
 //#region src/cli/core/files.ts
+/** `/dev/null` and its kin: a rename over a device is refused, so it is written in place. */
+function isCharacterDevice(abs) {
+	try {
+		return statSync(abs).isCharacterDevice();
+	} catch {
+		return false;
+	}
+}
 function outcomeOf(abs, text) {
 	if (!existsSync(abs)) return "created";
+	if (isCharacterDevice(abs)) return "updated";
 	return readFileSync(abs, "utf8") === text ? "unchanged" : "updated";
 }
 /** What writing `files` would do, without writing. */
@@ -27,6 +36,10 @@ function applyFiles(cwd, files, options = {}) {
 		for (const [index, file] of files.entries()) {
 			if (planned[index]?.outcome === "unchanged") continue;
 			const target = resolve(cwd, file.path);
+			if (isCharacterDevice(target)) {
+				writeFileSync(target, file.text);
+				continue;
+			}
 			const temp = `${target}.permdock-${String(process.pid)}.tmp`;
 			mkdirSync(dirname(target), { recursive: true });
 			writeFileSync(temp, file.text);

package/dist/{fixtures-B7XrLeY7.js → fixtures-BTMW6zgU.js}

@@ -1,7 +1,7 @@
 import { r as isRecord } from "./compact-CAf557ZB.js";
-import { i as configError } from "./errors-CWTY6uih.js";
+import { i as configError } from "./errors-DpP_U6Bf.js";
 import { i as readJsonFile } from "./files-D_JIzUrP.js";
-import { a as loadModule, s as pickNamed } from "./load-DFS_ry0W.js";
+import { a as loadModule, s as pickNamed } from "./load-DxroEzH1.js";
 import { existsSync } from "node:fs";
 import { resolve } from "node:path";
 //#region src/cli/fixtures.ts

package/dist/{flags-C3DktBDY.js → flags-aaeRAdiD.js}

@@ -1,5 +1,5 @@
-import { n as CliError } from "./errors-CWTY6uih.js";
-import { n as secretInput } from "./credentials-DPyHmYz5.js";
+import { n as CliError } from "./errors-DpP_U6Bf.js";
+import { n as secretInput } from "./credentials-BpuTwd7a.js";
 //#region src/cli/core/flags.ts
 /** The flag vocabulary shared with better-supabase: one spelling per meaning. */
 const dbUrlFlags = { "db-url-stdin": {

package/dist/{from-snapshot-CTCMsFZk.js → from-snapshot-Bz469dIh.js}

@@ -2,19 +2,20 @@ import { t as compact } from "./compact-CAf557ZB.js";
 import { n as freezeDeep } from "./freeze-CrU8nQeX.js";
 import { a as deniedMessage, i as approvalMessage, n as PermDockDeniedError, t as PermDockApprovalRequiredError } from "./errors-BKy0EfhN.js";
 import { o as sameId } from "./expiry-D4_YKRKD.js";
-import { c as listPermissions } from "./permission-registry-Br4jSNVi.js";
+import { c as listPermissions } from "./permission-registry-DpPtSKNZ.js";
 import { g as secondsOf, o as epochSeconds, t as INVALID_NOW } from "./time-DkWjdL98.js";
-import { a as normalizeMemberships, d as scopeList, m as tenantOf, o as resolveScope, t as activeFor } from "./scopes-CUPSjo9q.js";
-import { a as readOnlyActorRefuses, c as rowIdOf, l as rowValues, n as coveredByDelegation, u as evaluateCondition } from "./delegation-j6-rc37o.js";
-import { b as synthesiseRole, m as findRole, v as listRoles } from "./grantee-hxrUsbpM.js";
+import { f as scopeList, h as tenantOf, o as normalizeMemberships, s as resolveScope, t as activeFor } from "./scopes-BHsc-wp-.js";
+import { a as readOnlyActorRefuses, c as rowIdOf, l as rowValues, n as coveredByDelegation, u as evaluateCondition } from "./delegation-C5rOdTp5.js";
+import { b as synthesiseRole, m as findRole, v as listRoles } from "./grantee-BrRANrpT.js";
 import { a as grantCoversField, o as pickVisible, r as readWireValidity, t as isActive } from "./validity-CZ7-y0Cj.js";
-import { c as nowSeconds, d as resolveActiveTenant, f as rowInScope, n as inTeam, r as isMembershipExpired, s as nestedAppliesWithoutRow } from "./tenancy-DN2QAx9z.js";
+import { c as nowSeconds, d as resolveActiveTenant, f as rowInScope, n as inTeam, r as isMembershipExpired, s as nestedAppliesWithoutRow } from "./tenancy-CmeBQ6Nv.js";
 import { t as requiresApproval } from "./approval-required-TzNB9oQA.js";
-import { r as tokenPayload, t as decisionToken } from "./token-BLZcjQgt.js";
+import { r as tokenPayload, t as decisionToken } from "./token-2qYDvXz2.js";
 import { t as fromWireDelegation } from "./wire-delegation-Cv3W2eaM.js";
-import { n as matchGrantee } from "./grantee-match-DbENBHLB.js";
+import { n as matchGrantee } from "./grantee-match-0RtHWQDx.js";
 import { t as resourceIdOf } from "./resource-ref-CaS9yVPi.js";
-import { a as deniedFor, n as mayUse, o as signSnapshot, r as permittedIds, t as whereFromGrants } from "./where-scope-C9vfEphl.js";
+import { i as permittedIds, o as deniedFor, r as mayUse, s as signSnapshot, t as whereFromGrants } from "./where-scope-wq2coopv.js";
+import { i as decideAllWith, n as canAllWith } from "./checks-BC_0mPIq.js";
 //#region src/core/snapshot-evaluate.ts
 function coveredByInclude(snapshot, permission) {
 	const include = snapshot.include;
@@ -51,7 +52,7 @@ function scopeOk(snapshot, grant, permission, subject, data, team, now, only) {
 		};
 		if (!activeFor(membership, scopes, principal.tenant)) return {
 			ok: false,
-			reason: principal.tenant === void 0 ? "no-membership" : "tenant-mismatch"
+			reason: principal.tenant === void 0 && principal.unheldTenant === void 0 ? "no-tenant" : principal.tenant === void 0 ? "no-membership" : "tenant-mismatch"
 		};
 		if (!inTeam(membership, scopes, team)) return {
 			ok: false,
@@ -361,7 +362,8 @@ function subjectFromSnapshot(snapshot, tenant) {
 	return freezeDeep(compact({
 		principal: principal === null ? null : compact({
 			...principal,
-			tenant: nextTenant
+			tenant: nextTenant,
+			unheldTenant: nextTenant === void 0 ? tenant : void 0
 		}),
 		delegation: fromWireDelegation(snapshot.subject.delegation),
 		context: snapshot.subject.context,
@@ -440,9 +442,14 @@ function fromSnapshot(snapshot, options = {}) {
 	const instance = {
 		can,
 		decide,
+		canAll: (checks, decideOptions) => canAllWith(can, checks, decideOptions),
+		decideAll: (checks, decideOptions) => decideAllWith(decide, checks, decideOptions),
 		decideEach(permission, rows, decideOptions) {
 			return Object.freeze(rows.map((row) => run(permission, row, decideOptions)));
 		},
+		decideIds(permission, ids) {
+			return Promise.resolve(Object.freeze(ids.map(() => deniedFor(permission, "unsupported"))));
+		},
 		decideFor(_principalId, permission) {
 			return Promise.resolve(deniedFor(permission, "unsupported"));
 		},

package/dist/generate-3FNO5P5Q.js

@@ -0,0 +1,159 @@
+import { n as SCIM_TABLES, r as SCIM_UNIQUE } from "./postgres-store-BL9M_CA1.js";
+import { o as quoteSqlIdent } from "./sql-B96movIM.js";
+import { n as fileSummary, t as applyFiles } from "./files-acUbNwWt.js";
+import { r as driftOf } from "./output-files-CCMdcFWb.js";
+//#region src/cli/scim/generate.ts
+const SCIM_MARKER = "-- generated by permdock scim generate";
+/** The client roles each dialect's data API connects as; none may reach the directory. */
+function clientRoles(dialect) {
+	switch (dialect) {
+		case "supabase": return [
+			"public",
+			"anon",
+			"authenticated"
+		];
+		case "neon": return [
+			"public",
+			"anonymous",
+			"authenticated"
+		];
+		case "guc": return ["public"];
+		default: return dialect;
+	}
+}
+/**
+* The directory `postgresDirectoryStore` reads and writes: users, groups and
+* group members keyed on `(tenant, id)`, with `userName` and `externalId`
+* unique per tenant. Member values are SCIM `value`s, not a foreign key to
+* users, because a member may be a nested group. No client role may read
+* or write the tables.
+*/
+function scimSchemaSql(input) {
+	const schema = quoteSqlIdent(input.schema);
+	const table = (name) => `${schema}.${quoteSqlIdent(name)}`;
+	const users = table(SCIM_TABLES.users);
+	const groups = table(SCIM_TABLES.groups);
+	const members = table(SCIM_TABLES.members);
+	const all = [
+		users,
+		groups,
+		members
+	].join(", ");
+	return `${SCIM_MARKER} (--dialect ${input.dialect})
+-- the SCIM directory postgresDirectoryStore reads and writes for scimHandler; every row belongs to one tenant
+create schema if not exists ${schema};
+
+create table if not exists ${users} (
+  seq bigint generated always as identity unique,
+  tenant text not null check (tenant <> ''),
+  id text not null check (id <> ''),
+  user_name text not null,
+  external_id text,
+  active boolean not null default true,
+  emails jsonb,
+  x jsonb,
+  created_at timestamptz not null default now(),
+  updated_at timestamptz not null default now(),
+  revision bigint not null default 1,
+  primary key (tenant, id),
+  constraint ${quoteSqlIdent(SCIM_UNIQUE.userName)} unique (tenant, user_name),
+  constraint ${quoteSqlIdent(SCIM_UNIQUE.userExternalId)} unique (tenant, external_id)
+);
+
+create table if not exists ${groups} (
+  seq bigint generated always as identity unique,
+  tenant text not null check (tenant <> ''),
+  id text not null check (id <> ''),
+  display_name text not null,
+  external_id text,
+  roles text[],
+  x jsonb,
+  created_at timestamptz not null default now(),
+  updated_at timestamptz not null default now(),
+  revision bigint not null default 1,
+  primary key (tenant, id),
+  constraint ${quoteSqlIdent(SCIM_UNIQUE.groupExternalId)} unique (tenant, external_id)
+);
+
+create table if not exists ${members} (
+  tenant text not null,
+  group_id text not null,
+  user_id text not null,
+  position integer not null default 0,
+  primary key (tenant, group_id, user_id),
+  foreign key (tenant, group_id) references ${groups} (tenant, id) on delete cascade
+);
+create index if not exists ${quoteSqlIdent(`${SCIM_TABLES.members}_user_idx`)} on ${members} (tenant, user_id);
+
+-- server only: grant select, insert, update and delete on these tables to the role postgresDirectoryStore
+-- connects as when it does not own them
+alter table ${users} enable row level security;
+alter table ${groups} enable row level security;
+alter table ${members} enable row level security;
+revoke all on table ${all} from ${clientRoles(input.dialect).join(", ")};
+`;
+}
+/** `supabase/schemas/<schema>/scim.sql` for Supabase, the pg-delta per-schema layout; `permdock_scim.sql` otherwise. */
+function scimOut(dialect, schema) {
+	return dialect === "supabase" ? `supabase/schemas/${schema}/scim.sql` : "permdock_scim.sql";
+}
+function runScimGenerate(input) {
+	const dialect = input.dialect ?? input.config.rls?.dialect ?? "supabase";
+	const schema = input.schema ?? input.config.rls?.schema ?? "permdock";
+	const sql = scimSchemaSql({
+		schema,
+		dialect
+	});
+	const out = input.out ?? scimOut(dialect, schema);
+	const data = {
+		out,
+		dialect,
+		schema,
+		tables: Object.values(SCIM_TABLES).map((name) => `${schema}.${name}`)
+	};
+	if (out === "-") return {
+		code: 0,
+		output: sql.trimEnd(),
+		data: {
+			...data,
+			sql
+		}
+	};
+	if (input.check) {
+		const drift = driftOf(input.cwd, [{
+			part: "scim",
+			rel: out,
+			text: sql
+		}]);
+		return drift.length === 0 ? {
+			code: 0,
+			output: `${out} is current`,
+			data
+		} : {
+			code: 1,
+			output: `${drift.join("\n")}\nrun permdock scim generate`,
+			data: {
+				...data,
+				drift
+			}
+		};
+	}
+	const applied = applyFiles(input.cwd, [{
+		path: out,
+		text: sql
+	}], { dryRun: input.dryRun });
+	return {
+		code: 0,
+		output: fileSummary(applied, input.dryRun),
+		data: {
+			...data,
+			files: applied
+		},
+		next: [{
+			when: "in CI, to fail when the file is stale",
+			command: "permdock scim generate --check"
+		}]
+	};
+}
+//#endregion
+export { runScimGenerate };

package/dist/{grantee-hxrUsbpM.js → grantee-BrRANrpT.js}

@@ -1,7 +1,7 @@
 import { t as compact } from "./compact-CAf557ZB.js";
 import { n as freezeDeep, t as freezeCopy } from "./freeze-CrU8nQeX.js";
 import { i as ownKeys, n as isForbiddenKey, t as assertSafeKey } from "./paths-DXSHAMIa.js";
-import { c as listPermissions, o as isPermission } from "./permission-registry-Br4jSNVi.js";
+import { c as listPermissions, o as isPermission } from "./permission-registry-DpPtSKNZ.js";
 import { i as readAppData, r as parseAppData, t as assertAppData } from "./app-data-MuyzVqX8.js";
 //#region src/core/vocabulary.ts
 const ROLE_KIND = "role";

package/dist/{grantee-conditions-CcXf8hMM.js → grantee-conditions-C6P1Tvol.js}

@@ -1,7 +1,7 @@
 import { a as sole, t as compact } from "./compact-CAf557ZB.js";
 import { a as expandRelation, c as isEdgeRelation, d as isSelfParented, l as isFieldRelation, m as restrictedStops, p as restrictedFor, s as isComputedRelation, u as isPrincipalRelation } from "./resource-relations-D_jw0BFx.js";
 import { d as isoNow } from "./time-DkWjdL98.js";
-import { c as rootScope, d as scopeList, o as resolveScope } from "./scopes-CUPSjo9q.js";
+import { f as scopeList, l as rootScope, s as resolveScope } from "./scopes-BHsc-wp-.js";
 //#region src/core/grantee-conditions.ts
 /**
 * Where a graph relation starts on the row: its own id when the relation is

package/dist/{grantee-match-DbENBHLB.js → grantee-match-0RtHWQDx.js}

@@ -1,8 +1,8 @@
 import { t as compact } from "./compact-CAf557ZB.js";
 import { u as isoAt } from "./time-DkWjdL98.js";
-import { d as scopeList, t as activeFor } from "./scopes-CUPSjo9q.js";
-import { o as flattenGrantee } from "./grantee-hxrUsbpM.js";
-import { r as relationCondition, t as inheritCondition } from "./grantee-conditions-CcXf8hMM.js";
+import { f as scopeList, t as activeFor } from "./scopes-BHsc-wp-.js";
+import { o as flattenGrantee } from "./grantee-BrRANrpT.js";
+import { r as relationCondition, t as inheritCondition } from "./grantee-conditions-C6P1Tvol.js";
 //#region src/core/grantee-match.ts
 function combineWhere(left, right) {
 	if (left === void 0) return right;

package/dist/h3/index.d.ts

@@ -1,7 +1,7 @@
-import { T as Policy, Vt as Snapshot, j as PolicyVocabulary, rr as Principal } from "../policy-types-n0uRTsW8.js";
-import { r as PermDock } from "../permdock-SV8ZINYT.js";
-import { D as ConnectionOptions, T as Connection, f as InvalidSignatureError, i as OpenApiHooks, u as SnapshotQuery, v as discoverViaSignatureAgent, x as webBotAuthVerifier } from "../server-types-CKQiCnON.js";
-import { a as ProtectTarget, n as FetchAdapterOptions, r as FetchProtect, t as ContextReader } from "../fetch-adapter-Dw0MTS3D.js";
+import { Gt as Snapshot, T as Policy, j as PolicyVocabulary, sr as Principal } from "../policy-types-B-F-qAZk.js";
+import { a as PermDock } from "../permdock-Dco6dyCK.js";
+import { D as ConnectionOptions, T as Connection, f as InvalidSignatureError, i as OpenApiHooks, u as SnapshotQuery, v as discoverViaSignatureAgent, x as webBotAuthVerifier } from "../server-types-C4gZUEZy.js";
+import { a as ProtectTarget, n as FetchAdapterOptions, r as FetchProtect, t as ContextReader } from "../fetch-adapter-CuhyYwC1.js";
 import { EventHandler, H3Event, H3EventContext, Middleware } from "h3";
 //#region src/h3/create.d.ts
 type H3PermDockOptions<TUser = unknown> = FetchAdapterOptions<H3Event, TUser>;

package/dist/h3/index.js

@@ -1,6 +1,6 @@
-import { d as discoverViaSignatureAgent, m as webBotAuthVerifier, u as InvalidSignatureError } from "../evaluations-beAooV0n.js";
-import { i as decorate } from "../bind-CAvgUuKs.js";
-import { t as fetchAdapter } from "../fetch-adapter-DD_gfmrC.js";
+import { l as InvalidSignatureError, p as webBotAuthVerifier, u as discoverViaSignatureAgent } from "../evaluations-DReoiVBw.js";
+import { i as decorate } from "../bind-D1nO6fiC.js";
+import { t as fetchAdapter } from "../fetch-adapter-De-u6vhJ.js";
 //#region src/h3/create.ts
 function createPermDock(policy, options) {
 	const adapter = fetchAdapter(policy, options, "h3", (event) => event.req);