permdock 0.6.0 → 0.7.0

package/dist/{support-session-C6xJQYut.js → support-session-Cna49-3f.js}

@@ -3,9 +3,9 @@ import { n as freezeDeep } from "./freeze-CrU8nQeX.js";
 import { a as ownRecord } from "./paths-DXSHAMIa.js";
 import { a as isId, r as idList } from "./expiry-D4_YKRKD.js";
 import { n as internalsOf } from "./internals-Dk8A8fX3.js";
-import { c as listPermissions, m as annotationsFor, n as findPermission } from "./permission-registry-Br4jSNVi.js";
+import { c as listPermissions, m as annotationsFor, n as findPermission } from "./permission-registry-DpPtSKNZ.js";
 import { g as secondsOf, l as isRfc3339, m as rfc3339, p as nowSeconds } from "./time-DkWjdL98.js";
-import { t as canonicalJson } from "./canonical-json-BC8_nMTw.js";
+import { t as canonicalJson } from "./canonical-json-DwilZ1iB.js";
 import { r as sha256Digest } from "./sha256-D9ihqmvd.js";
 //#region src/core/support-session.ts
 const DEFAULT_TTL = 3600;

package/dist/svelte/index.d.ts

@@ -1,10 +1,10 @@
-import { n as requiredPlans } from "../problem-details-B45V5d2b.js";
-import { i as describe } from "../describe-B5qgDvEW.js";
+import { n as requiredPlans } from "../problem-details-Tcfmj3bV.js";
+import { i as describe } from "../describe-O0SwYIK8.js";
 import { t as PermissionBoundaryState } from "../boundary-BmHxVH1J.js";
 import { t as approvalHeaders } from "../headers-CIbDTUTK.js";
-import { a as FilterResult, c as PermissionSet, d as RolesOptions, f as SubjectView, i as ClientStatus, l as PermissionState, n as ApprovalState, p as TenantView, r as ClientPermDock, t as ApprovalHandle } from "../types-B3_ooZgZ.js";
-import { n as SveltePermDockOptions, o as PermissionBoundaryProps, r as ProtectedProps, t as PermDockDefaults } from "../types-CVZSNocA.js";
-import { a as getDescribe, c as permission, d as setPermDock, f as subject, i as filtered, l as permissions, n as assignable, o as getPermDock, p as tenant, r as assignablePermissions, s as memberships, t as approval, u as roles } from "../stores-BUGNbJTt.js";
+import { a as FilterResult, c as PermissionSet, d as RolesOptions, f as SubjectView, i as ClientStatus, l as PermissionState, n as ApprovalState, p as TenantView, r as ClientPermDock, t as ApprovalHandle } from "../types-CKV71kKh.js";
+import { n as SveltePermDockOptions, o as PermissionBoundaryProps, r as ProtectedProps, t as PermDockDefaults } from "../types-DXmwu78Z.js";
+import { a as getDescribe, c as permission, d as setPermDock, f as subject, i as filtered, l as permissions, n as assignable, o as getPermDock, p as tenant, r as assignablePermissions, s as memberships, t as approval, u as roles } from "../stores-BAZwSYZA.js";
 import { Component } from "svelte";
 //#region src/svelte/index.d.ts
 export declare const Protected: Component<ProtectedProps>;

package/dist/svelte/index.js

@@ -1,11 +1,11 @@
 import { r as requiredPlans } from "../problem-details-cn5X30gZ.js";
-import { t as describe } from "../describe-BybMRY7A.js";
+import { t as describe } from "../describe-DZlnEtLy.js";
 import { n as boundaryFallback, t as boundaryDigest } from "../boundary-BM8a_P6E.js";
 import { t as approvalHeaders } from "../headers-BIjfMaoC.js";
-import { u as slotContent } from "../views-DTIIO-oQ.js";
-import { n as getUi, t as getStore } from "../context-B_u3_bDJ.js";
-import { n as viewFor, t as scopedFor } from "../runtime-D3VTAiCA.js";
-import { a as getDescribe, c as permission, d as setPermDock, f as subject, i as filtered, l as permissions, n as assignable, o as getPermDock, p as tenant, r as assignablePermissions, s as memberships, t as approval, u as roles } from "../stores-CGhM8BN_.js";
+import { u as slotContent } from "../views-BB8E9dTP.js";
+import { n as getUi, t as getStore } from "../context--uM9V3Ui.js";
+import { n as viewFor, t as scopedFor } from "../runtime-Vif3_-zf.js";
+import { a as getDescribe, c as permission, d as setPermDock, f as subject, i as filtered, l as permissions, n as assignable, o as getPermDock, p as tenant, r as assignablePermissions, s as memberships, t as approval, u as roles } from "../stores-BqEuHC05.js";
 import "svelte/internal/disclose-version";
 import * as $ from "svelte/internal/client";
 import { onDestroy } from "svelte";

package/dist/svelte/runtime.d.ts

@@ -1,7 +1,7 @@
-import { n as DescribeMessages } from "../describe-B5qgDvEW.js";
+import { n as DescribeMessages } from "../describe-O0SwYIK8.js";
 import { n as boundaryDigest, r as boundaryFallback, t as PermissionBoundaryState } from "../boundary-BmHxVH1J.js";
-import { m as ClientStore } from "../types-B3_ooZgZ.js";
-import { a as viewFor, i as scopedFor, o as PermissionBoundaryProps, r as ProtectedProps, s as slotContent, t as PermDockDefaults } from "../types-CVZSNocA.js";
+import { m as ClientStore } from "../types-CKV71kKh.js";
+import { a as viewFor, i as scopedFor, o as PermissionBoundaryProps, r as ProtectedProps, s as slotContent, t as PermDockDefaults } from "../types-DXmwu78Z.js";
 //#region src/svelte/context.d.ts
 /** The provider's `defaults` and `messages`. */
 type PermDockUi = {

package/dist/svelte/runtime.js

@@ -1,5 +1,5 @@
 import { n as boundaryFallback, t as boundaryDigest } from "../boundary-BM8a_P6E.js";
-import { u as slotContent } from "../views-DTIIO-oQ.js";
-import { n as getUi, t as getStore } from "../context-B_u3_bDJ.js";
-import { n as viewFor, t as scopedFor } from "../runtime-D3VTAiCA.js";
+import { u as slotContent } from "../views-BB8E9dTP.js";
+import { n as getUi, t as getStore } from "../context--uM9V3Ui.js";
+import { n as viewFor, t as scopedFor } from "../runtime-Vif3_-zf.js";
 export { boundaryDigest, boundaryFallback, getStore, getUi, scopedFor, slotContent, viewFor };

package/dist/svelte/source.d.ts

@@ -1,10 +1,10 @@
-import { n as requiredPlans } from "../problem-details-B45V5d2b.js";
-import { i as describe } from "../describe-B5qgDvEW.js";
+import { n as requiredPlans } from "../problem-details-Tcfmj3bV.js";
+import { i as describe } from "../describe-O0SwYIK8.js";
 import { t as PermissionBoundaryState } from "../boundary-BmHxVH1J.js";
 import { t as approvalHeaders } from "../headers-CIbDTUTK.js";
-import { a as FilterResult, c as PermissionSet, d as RolesOptions, f as SubjectView, i as ClientStatus, l as PermissionState, n as ApprovalState, p as TenantView, r as ClientPermDock, t as ApprovalHandle } from "../types-B3_ooZgZ.js";
-import { n as SveltePermDockOptions, o as PermissionBoundaryProps, r as ProtectedProps, t as PermDockDefaults } from "../types-CVZSNocA.js";
-import { a as getDescribe, c as permission, d as setPermDock, f as subject, i as filtered, l as permissions, n as assignable, o as getPermDock, p as tenant, r as assignablePermissions, s as memberships, t as approval, u as roles } from "../stores-BUGNbJTt.js";
+import { a as FilterResult, c as PermissionSet, d as RolesOptions, f as SubjectView, i as ClientStatus, l as PermissionState, n as ApprovalState, p as TenantView, r as ClientPermDock, t as ApprovalHandle } from "../types-CKV71kKh.js";
+import { n as SveltePermDockOptions, o as PermissionBoundaryProps, r as ProtectedProps, t as PermDockDefaults } from "../types-DXmwu78Z.js";
+import { a as getDescribe, c as permission, d as setPermDock, f as subject, i as filtered, l as permissions, n as assignable, o as getPermDock, p as tenant, r as assignablePermissions, s as memberships, t as approval, u as roles } from "../stores-BAZwSYZA.js";
 import { Component } from "svelte";
 //#region src/svelte/source.d.ts
 export declare const Protected: Component<ProtectedProps>;

package/dist/svelte/source.js

@@ -1,7 +1,7 @@
 import { r as requiredPlans } from "../problem-details-cn5X30gZ.js";
-import { t as describe } from "../describe-BybMRY7A.js";
+import { t as describe } from "../describe-DZlnEtLy.js";
 import { t as approvalHeaders } from "../headers-BIjfMaoC.js";
-import { a as getDescribe, c as permission, d as setPermDock, f as subject, i as filtered, l as permissions, n as assignable, o as getPermDock, p as tenant, r as assignablePermissions, s as memberships, t as approval, u as roles } from "../stores-CGhM8BN_.js";
+import { a as getDescribe, c as permission, d as setPermDock, f as subject, i as filtered, l as permissions, n as assignable, o as getPermDock, p as tenant, r as assignablePermissions, s as memberships, t as approval, u as roles } from "../stores-BqEuHC05.js";
 import PermissionBoundaryComponent from "./PermissionBoundary.svelte";
 import ProtectedComponent from "./Protected.svelte";
 //#region src/svelte/source.ts

package/dist/sveltekit/index.d.ts

@@ -1,9 +1,9 @@
-import { T as Policy, Vt as Snapshot, j as PolicyVocabulary, rr as Principal } from "../policy-types-n0uRTsW8.js";
-import { w as Permission } from "../vocabulary-CN8H_9UF.js";
-import { a as OperationInput, t as Operation } from "../operations-X0VM7F3m.js";
-import { r as PermDock } from "../permdock-SV8ZINYT.js";
-import { D as ConnectionOptions, T as Connection, f as InvalidSignatureError, i as OpenApiHooks, o as ProtectOptions, u as SnapshotQuery, v as discoverViaSignatureAgent, x as webBotAuthVerifier } from "../server-types-CKQiCnON.js";
-import { a as ProtectTarget, i as PermDockHandlers, n as FetchAdapterOptions, t as ContextReader } from "../fetch-adapter-Dw0MTS3D.js";
+import { Gt as Snapshot, T as Policy, j as PolicyVocabulary, sr as Principal } from "../policy-types-B-F-qAZk.js";
+import { u as Permission } from "../permission-types-DhNEmoRG.js";
+import { a as OperationInput, t as Operation } from "../operations-BNLes61x.js";
+import { a as PermDock } from "../permdock-Dco6dyCK.js";
+import { D as ConnectionOptions, T as Connection, f as InvalidSignatureError, i as OpenApiHooks, o as ProtectOptions, u as SnapshotQuery, v as discoverViaSignatureAgent, x as webBotAuthVerifier } from "../server-types-C4gZUEZy.js";
+import { a as ProtectTarget, i as PermDockHandlers, n as FetchAdapterOptions, t as ContextReader } from "../fetch-adapter-CuhyYwC1.js";
 import { RequestEvent } from "@sveltejs/kit";
 //#region src/sveltekit/create.d.ts
 /**

package/dist/sveltekit/index.js

@@ -1,5 +1,5 @@
-import { d as discoverViaSignatureAgent, m as webBotAuthVerifier, u as InvalidSignatureError } from "../evaluations-beAooV0n.js";
-import { n as guardedRoute, r as instanceRoute, t as fetchAdapter } from "../fetch-adapter-DD_gfmrC.js";
+import { l as InvalidSignatureError, p as webBotAuthVerifier, u as discoverViaSignatureAgent } from "../evaluations-DReoiVBw.js";
+import { n as guardedRoute, r as instanceRoute, t as fetchAdapter } from "../fetch-adapter-De-u6vhJ.js";
 //#region src/sveltekit/create.ts
 const route = {
 	context: (event) => event,

package/dist/tanstack-start/index.d.ts

@@ -1,9 +1,9 @@
-import { T as Policy, Vt as Snapshot, j as PolicyVocabulary, rr as Principal } from "../policy-types-n0uRTsW8.js";
-import { w as Permission } from "../vocabulary-CN8H_9UF.js";
-import { a as OperationInput, t as Operation } from "../operations-X0VM7F3m.js";
-import { r as PermDock } from "../permdock-SV8ZINYT.js";
-import { D as ConnectionOptions, T as Connection, f as InvalidSignatureError, i as OpenApiHooks, o as ProtectOptions, u as SnapshotQuery, v as discoverViaSignatureAgent, x as webBotAuthVerifier } from "../server-types-CKQiCnON.js";
-import { a as ProtectTarget, n as FetchAdapterOptions, t as ContextReader } from "../fetch-adapter-Dw0MTS3D.js";
+import { Gt as Snapshot, T as Policy, j as PolicyVocabulary, sr as Principal } from "../policy-types-B-F-qAZk.js";
+import { u as Permission } from "../permission-types-DhNEmoRG.js";
+import { a as OperationInput, t as Operation } from "../operations-BNLes61x.js";
+import { a as PermDock } from "../permdock-Dco6dyCK.js";
+import { D as ConnectionOptions, T as Connection, f as InvalidSignatureError, i as OpenApiHooks, o as ProtectOptions, u as SnapshotQuery, v as discoverViaSignatureAgent, x as webBotAuthVerifier } from "../server-types-C4gZUEZy.js";
+import { a as ProtectTarget, n as FetchAdapterOptions, t as ContextReader } from "../fetch-adapter-CuhyYwC1.js";
 import { RequestMiddleware, RequestMiddlewareAfterServer, createMiddleware } from "@tanstack/react-start";
 //#region src/tanstack-start/create.d.ts
 type TanStackStartPermDockOptions<TUser = unknown> = FetchAdapterOptions<Request, TUser>;

package/dist/tanstack-start/index.js

@@ -1,5 +1,5 @@
-import { d as discoverViaSignatureAgent, m as webBotAuthVerifier, u as InvalidSignatureError } from "../evaluations-beAooV0n.js";
-import { t as fetchAdapter } from "../fetch-adapter-DD_gfmrC.js";
+import { l as InvalidSignatureError, p as webBotAuthVerifier, u as discoverViaSignatureAgent } from "../evaluations-DReoiVBw.js";
+import { t as fetchAdapter } from "../fetch-adapter-De-u6vhJ.js";
 import { createMiddleware } from "@tanstack/react-start";
 //#region src/tanstack-start/create.ts
 function createPermDock(policy, options) {

package/dist/{tenancy-DN2QAx9z.js → tenancy-CmeBQ6Nv.js}

@@ -1,7 +1,7 @@
 import { o as sameId, t as expiredAt } from "./expiry-D4_YKRKD.js";
 import { l as isFieldRelation } from "./resource-relations-D_jw0BFx.js";
 import { o as epochSeconds } from "./time-DkWjdL98.js";
-import { c as rootScope, l as scopeChain, m as tenantOf, o as resolveScope, r as findScope, t as activeFor, u as scopeIdOf } from "./scopes-CUPSjo9q.js";
+import { d as scopeIdOf, h as tenantOf, l as rootScope, r as findScope, s as resolveScope, t as activeFor, u as scopeChain } from "./scopes-BHsc-wp-.js";
 //#region src/core/tenancy.ts
 function nowSeconds(now) {
 	return now ?? epochSeconds();
@@ -81,7 +81,7 @@ function rowInScope(membership, scopes, row, partitioned, fieldOf) {
 	const root = rootScope(scopes);
 	const chain = scopeChain(scopes, membership.scope).toReversed();
 	for (const name of chain) {
-		const key = fieldOf?.(name) ?? findScope(scopes, name)?.key;
+		const key = fieldOf(name);
 		if (key === void 0) continue;
 		const value = Object.hasOwn(row, key) ? row[key] : void 0;
 		if ((value !== void 0 || partitioned(name, key)) && !sameId(value, scopeIdOf(membership, name))) return {
@@ -116,6 +116,7 @@ function matchScopedMembership(subject, scope, roleName, row, scopes, resource,
 	let sawExpired = false;
 	let sawWrongScope = false;
 	let sawTenantMismatch = false;
+	let sawNoTenant = false;
 	let sawGraph;
 	for (const membership of memberships) {
 		if (!rolesOf(membership).includes(roleName)) continue;
@@ -124,7 +125,11 @@ function matchScopedMembership(subject, scope, roleName, row, scopes, resource,
 			continue;
 		}
 		if (typeof scope === "string") {
-			if (findScope(scopes, scope) === void 0 || membership.scope !== scope || !inTeam(membership, scopes, team) || !activeFor(membership, scopes, principal.tenant)) continue;
+			if (findScope(scopes, scope) === void 0 || membership.scope !== scope || !inTeam(membership, scopes, team)) continue;
+			if (!activeFor(membership, scopes, principal.tenant)) {
+				sawNoTenant ||= principal.tenant === void 0 && principal.unheldTenant === void 0;
+				continue;
+			}
 			if (instance && !nestedAppliesWithoutRow(membership, scopes, row, team)) {
 				sawWrongScope = true;
 				continue;
@@ -165,6 +170,10 @@ function matchScopedMembership(subject, scope, roleName, row, scopes, resource,
 		ok: false,
 		reason: "tenant-mismatch"
 	};
+	if (sawNoTenant && !sawWrongScope) return {
+		ok: false,
+		reason: "no-tenant"
+	};
 	if (sawExpired && !sawWrongScope) return {
 		ok: false,
 		reason: "expired-membership"

package/dist/terminal/index.d.ts

@@ -1,9 +1,9 @@
-import { Nn as Decision, Rt as Instant, T as Policy, ar as Subject, j as PolicyVocabulary, rr as Principal } from "../policy-types-n0uRTsW8.js";
-import { w as Permission } from "../vocabulary-CN8H_9UF.js";
-import { r as PermDock } from "../permdock-SV8ZINYT.js";
-import { m as ApprovalStore } from "../types-BdtSDbBO.js";
-import { a as ProblemDetails, t as ApprovalHint } from "../errors-DH5QEGXh.js";
-import { t as InstanceOptions } from "../instance-options-BsVpyGIk.js";
+import { Ln as Decision, Rt as Instant, T as Policy, j as PolicyVocabulary, lr as Subject, sr as Principal } from "../policy-types-B-F-qAZk.js";
+import { u as Permission } from "../permission-types-DhNEmoRG.js";
+import { a as PermDock } from "../permdock-Dco6dyCK.js";
+import { m as ApprovalStore } from "../types-DC44-hqb.js";
+import { a as ProblemDetails, t as ApprovalHint } from "../errors-B_Qg9D3e.js";
+import { t as InstanceOptions } from "../instance-options-CU0YQCLH.js";
 //#region src/terminal/types.d.ts
 type TokenSourceName = "device" | "keychain" | "env" | "ci-oidc";
 type TokenSource = TokenSourceName | {

package/dist/terminal/index.js

@@ -2,12 +2,12 @@ import { t as compact } from "../compact-CAf557ZB.js";
 import { a as deniedMessage, i as approvalMessage, n as PermDockDeniedError, t as PermDockApprovalRequiredError } from "../errors-BKy0EfhN.js";
 import { h as secondsAt } from "../time-DkWjdL98.js";
 import { n as resourceRef } from "../resource-ref-CaS9yVPi.js";
-import { c as withApp } from "../permdock-BrAscV28.js";
+import { l as withApp } from "../permdock-BfWEeMqk.js";
 import { r as isSubject } from "../subject-BGoM5o8B.js";
 import { n as readBodyText } from "../body-text-QcXok_SI.js";
-import { l as storedApprovalToken, s as resumeDecision } from "../helpers-CBYVMjwh.js";
+import { l as storedApprovalToken, s as resumeDecision } from "../helpers-DY3vXuGs.js";
 import { t as timeoutSignal } from "../timeout-D51niuQP.js";
-import { n as resolveOrNull, t as buildInstance } from "../build-instance-Bu_eDqYw.js";
+import { n as resolveOrNull, t as buildInstance } from "../build-instance-DxE7czo9.js";
 import { a as refreshCredential, o as revokeCredential, s as runDeviceFlow, t as TERMINAL_TIMEOUT_MS } from "../device-BARQ8eYG.js";
 import { i as writeCredentials, n as deleteCredentials, r as readCredentials } from "../storage-C2bWdvJH.js";
 import { createInterface } from "node:readline";

package/dist/testing/core.d.ts

@@ -0,0 +1,2 @@
+import { S as policyMatrix, _ as DescribePolicyConfig, a as OrmParityScenario, b as PolicyMatrixCell, c as RlsFieldsOutcome, d as RlsParityOptions, f as RlsParityReport, g as testRlsParity, h as RlsQueryResult, i as OrmParityRunInput, l as RlsParityCase, m as RlsQueryFn, n as OrmParityOptions, o as testOrmParity, p as RlsParitySubject, r as OrmParityReport, s as RlsDbOutcome, t as OrmParityCase, u as RlsParityFixture, v as MatrixCell, x as PolicyMatrixReport, y as MatrixOutcome } from "../core-CQkE8Esr.js";
+export { type DescribePolicyConfig, type MatrixCell, type MatrixOutcome, type OrmParityCase, type OrmParityOptions, type OrmParityReport, type OrmParityRunInput, type OrmParityScenario, type PolicyMatrixCell, type PolicyMatrixReport, type RlsDbOutcome, type RlsFieldsOutcome, type RlsParityCase, type RlsParityFixture, type RlsParityOptions, type RlsParityReport, type RlsParitySubject, type RlsQueryFn, type RlsQueryResult, policyMatrix, testOrmParity, testRlsParity };

package/dist/testing/core.js

@@ -0,0 +1 @@
+export { r as policyMatrix, t as testOrmParity, n as testRlsParity } from "../core-B5-w6Kw9.js";

package/dist/testing/fixtures/index.d.ts

@@ -0,0 +1,12 @@
+import { a as CatalogDocument } from "../../types-BXMYB7BY.js";
+import { i as SupabaseManifest } from "../../manifest-BVhExYhw.js";
+//#region src/testing/fixtures/index.d.ts
+/**
+ * The `permissions.catalog.json` of `apps/examples/next-better-supabase`, a
+ * `catalog-v1` document with resources, permissions, scopes, roles, grants
+ * and delegations, for testing a catalog consumer such as a Cloud.
+ */
+export declare const betterSupabaseCatalog: CatalogDocument;
+/** The `permdock.manifest.json` of the same app, a `supabase-manifest-v1` document. */
+export declare const betterSupabaseManifest: SupabaseManifest;
+//#endregion