permdock 0.6.0 → 0.8.0

package/dist/{rls-BAqP4q66.js → rls-Ca8Jz9b5.js}

@@ -1,13 +1,16 @@
-import { c as missingInput } from "./errors-CWTY6uih.js";
+import { c as missingInput } from "./errors-Vpu6rKHl.js";
 import { t as defineLeaf } from "./command-L8EstFNm.js";
-import { c as given, d as policyFlag, f as validatorFlag, i as dryRunFlag, l as outFlag, n as dbUrl, o as fileOut, r as dbUrlFlags, t as checkFlag } from "./flags-C3DktBDY.js";
+import { c as given, d as policyFlag, f as validatorFlag, i as dryRunFlag, l as outFlag, n as dbUrl, o as fileOut, r as dbUrlFlags, t as checkFlag } from "./flags-DXjoTVbS.js";
 //#region src/cli/commands/rls.ts
 const membershipsFlag = { memberships: {
 	type: "string",
 	description: "Membership table as <table>:tenant,user,role",
 	valueHint: "table"
 } };
-/** The flags that shape the generated SQL; verify --introspect and migrate take them too. */
+/**
+* The flags that shape the generated SQL; verify --introspect and migrate take
+* them too.
+*/
 const shapeFlags = {
 	target: {
 		type: "enum",
@@ -86,7 +89,7 @@ const shapeFlags = {
 	},
 	fields: {
 		type: "enum",
-		options: ["views"],
+		options: ["views", "mask"],
 		description: "Field security"
 	},
 	"revoke-columns": {
@@ -141,7 +144,10 @@ const SHAPE_DEFAULTS = {
 	schemas: void 0,
 	"db-url-stdin": false
 };
-/** Every RlsRunInput field at its "not given" value, with the shape flags applied. */
+/**
+* Every RlsRunInput field at its "not given" value, with the shape flags
+* applied.
+*/
 async function rlsInput(ctx, verb, shape, options) {
 	return {
 		cwd: ctx.cwd,
@@ -186,7 +192,7 @@ async function rlsInput(ctx, verb, shape, options) {
 	};
 }
 async function runRls(input) {
-	return (await import("./rls-DTvYd-lI.js")).runRls(input);
+	return (await import("./rls-CNEH2_BG.js")).runRls(input);
 }
 const generate = defineLeaf({
 	flags: {
@@ -209,7 +215,8 @@ const generate = defineLeaf({
 			valueHint: "parts",
 			list: true,
 			async complete() {
-				return (await import("./output-files-B3IZJksC.js")).SPLIT_PARTS;
+				const { SPLIT_PARTS } = await import("./output-files-BHOIlrfD.js");
+				return SPLIT_PARTS;
 			}
 		},
 		"grants-out": {
@@ -222,6 +229,10 @@ const generate = defineLeaf({
 			description: "File for the role_permissions seeds",
 			valueHint: "file"
 		},
+		"no-seeds": {
+			type: "boolean",
+			description: "Do not write the seeds part: the project seeds role_permissions itself"
+		},
 		"backfill-out": {
 			type: "string",
 			description: "File for the rls.customRoles.from copy",
@@ -239,6 +250,7 @@ const generate = defineLeaf({
 			split: given(flags.split),
 			grantsOut: given(flags["grants-out"]),
 			seedsOut: given(flags["seeds-out"]),
+			...flags["no-seeds"] ? { noSeeds: true } : {},
 			...backfillOut === void 0 ? {} : { backfillOut }
 		});
 	}
@@ -278,7 +290,12 @@ const verify = defineLeaf({
 		kind: {
 			type: "enum",
 			options: ["node", "pgtap"],
-			description: "Run the fixtures in Node or emit a pgTAP file"
+			description: "Run the fixtures in Node or write a pgTAP file"
+		},
+		out: {
+			type: "string",
+			description: "With --kind pgtap, the file to write (default supabase/tests/permdock_rls.test.sql)",
+			valueHint: "file"
 		},
 		tree: {
 			type: "boolean",
@@ -291,19 +308,33 @@ const verify = defineLeaf({
 		advisors: {
 			type: "boolean",
 			description: "Run the Supabase security advisors"
+		},
+		ignore: {
+			type: "string",
+			repeatable: true,
+			description: "Accept the finding with this id for one run; rls.verify.ignore is the committed baseline",
+			valueHint: "id"
 		}
 	},
 	async run(ctx, { flags }) {
 		return runRls({
 			...await rlsInput(ctx, "verify", flags, { dbRequired: flags.introspect || flags.tree }),
+			out: fileOut("rls verify", flags.out),
 			fixtures: given(flags.fixtures),
 			format: flags.kind,
 			tree: flags.tree,
 			introspect: flags.introspect,
-			advisors: flags.advisors
+			advisors: flags.advisors,
+			ignore: flags.ignore
 		});
 	}
 });
+const explain = defineLeaf({
+	flags: { ...shapeFlags },
+	async run(ctx, { flags }) {
+		return runRls(await rlsInput(ctx, "explain", flags));
+	}
+});
 const migrate = defineLeaf({
 	flags: {
 		...shapeFlags,
@@ -333,4 +364,4 @@ const migrate = defineLeaf({
 	}
 });
 //#endregion
-export { generate, importPolicies, migrate, verify };
+export { explain, generate, importPolicies, migrate, verify };

package/dist/{role-builder-uWQZ4v84.js → role-builder-BK2-T6oD.js}

@@ -1,14 +1,14 @@
 import { a as sole, n as isReadonlyArray, t as compact } from "./compact-CAf557ZB.js";
-import { n as freezeDeep } from "./freeze-CrU8nQeX.js";
-import { i as ownKeys, n as isForbiddenKey, t as assertSafeKey } from "./paths-DXSHAMIa.js";
-import { c as isConditionRef, l as isSqlFunctionField, n as isSubjectRef, o as isCondition, s as isConditionDate } from "./refs-K6eWUJ0H.js";
-import { c as isUserApprover, i as flattenApprovers, l as user, o as isAnyOfInput, r as approverLeaves, s as isPermissionApprover } from "./approvers-CqPOLD-o.js";
-import { c as listPermissions, o as isPermission } from "./permission-registry-Br4jSNVi.js";
-import { n as assertMetaValue, r as parseAppData, t as assertAppData } from "./app-data-MuyzVqX8.js";
-import { d as isSelfParented } from "./resource-relations-D_jw0BFx.js";
-import { a as durationOf, r as assertDuration } from "./time-DkWjdL98.js";
-import { a as authenticated, d as roleScopeOf, g as isRole, o as flattenGrantee, r as asGrantee, u as roleNameOf } from "./grantee-hxrUsbpM.js";
-import { c as sanitizeFields, n as normalizeValidity } from "./validity-CZ7-y0Cj.js";
+import { n as freezeDeep } from "./freeze-jjan0lCv.js";
+import { i as ownKeys, n as isForbiddenKey, t as assertSafeKey } from "./paths-CUvURzHp.js";
+import { c as isConditionDate, l as isConditionRef, r as isSubjectRef, s as isCondition, u as isSqlFunctionField } from "./refs-C8BKxc_e.js";
+import { c as isUserApprover, i as flattenApprovers, l as user, o as isAnyOfInput, r as approverLeaves, s as isPermissionApprover } from "./approvers-B4r0N_Uz.js";
+import { c as listPermissions, o as isPermission } from "./permission-registry-B8tYxPIt.js";
+import { n as assertMetaValue, r as parseAppData, t as assertAppData } from "./app-data-UNNm07jV.js";
+import { d as isSelfParented } from "./resource-relations-8-pCScBO.js";
+import { a as durationOf, r as assertDuration } from "./time-nR1JesoH.js";
+import { a as authenticated, d as roleScopeOf, g as isRole, o as flattenGrantee, r as asGrantee, u as roleNameOf } from "./grantee-Dke-9rd1.js";
+import { c as sanitizeFields, n as normalizeValidity } from "./validity-Buc7w8E9.js";
 //#region src/conditions/opaque.ts
 function opaque(input) {
 	return freezeDeep({
@@ -152,7 +152,10 @@ function normalizeSqlFunction(input) {
 		twin
 	});
 }
-/** `{ session: … }` under `subject`; any other value is a comparison on a `subject` field. */
+/**
+* `{ session: … }` under `subject`; any other value is a comparison on a
+* `subject` field.
+*/
 function isSubjectCondition(value) {
 	return value !== null && typeof value === "object" && !Array.isArray(value) && Object.hasOwn(value, "session");
 }
@@ -213,7 +216,10 @@ function normalizeWhere(input) {
 }
 //#endregion
 //#region src/core/approval-normalize.ts
-/** Every approver a requirement names: `by`, each stage and its escalation, and `escalation.to`, inside `anyOf` groups too. */
+/**
+* Every approver a requirement names: `by`, each stage and its escalation, and
+* `escalation.to`, inside `anyOf` groups too.
+*/
 function approversOf(requirement) {
 	return [
 		...approverLeaves(requirement.by),
@@ -330,9 +336,9 @@ function assertApprovalVersions(grants, resources) {
 	}
 }
 /**
-* A relation approver is checked by id, from the requested row: the
-* relation lives on the permission's own resource (optionally up its parent
-* chain), or at the end of a list of links from it.
+* A relation approver is checked by id, from the requested row: the relation
+* lives on the permission's own resource (optionally up its parent chain), or
+* at the end of a list of links from it.
 */
 function assertApprovalRelations(grants, resources) {
 	for (const grant of grants) {
@@ -347,7 +353,10 @@ function assertApprovalRelations(grants, resources) {
 		}
 	}
 }
-/** The resource a relation approver's `through` reaches from `start`, or `undefined`. */
+/**
+* The resource a relation approver's `through` reaches from `start`, or
+* `undefined`.
+*/
 function approverRelationResource(start, through, resources) {
 	if (through === void 0) return start;
 	if (through === "parent") return isSelfParented(resources.get(start)) ? start : void 0;
@@ -368,7 +377,10 @@ function assertLimit(limit, permissionKey) {
 	if (limit.mode !== void 0 && limit.mode !== "hard" && limit.mode !== "soft") throw new Error(`PermDock: limit mode on '${permissionKey}' must be 'hard' or 'soft'`);
 	if (limit.alertAt !== void 0 && (typeof limit.alertAt !== "number" || !(limit.alertAt > 0 && limit.alertAt <= 1))) throw new Error(`PermDock: limit alertAt on '${permissionKey}' must be a fraction above 0 and at most 1`);
 }
-/** The declared fields of a validated `limit`, so extra keys never reach the grant. */
+/**
+* The declared fields of a validated `limit`, so extra keys never reach the
+* grant.
+*/
 function normalizeLimit(limit) {
 	if (limit === void 0) return;
 	return {
@@ -436,7 +448,10 @@ function makeGrant(permission, effect, condition) {
 		requires
 	});
 }
-/** Checks a grant's `meta`: plain JSON, string `description`, `x` through the schema when given. */
+/**
+* Checks a grant's `meta`: plain JSON, string `description`, `x` through the
+* schema when given.
+*/
 function grantMeta(meta, key, schema) {
 	if (meta === void 0) return;
 	assertAppData(meta, `meta of a grant on ${key}`);
@@ -478,7 +493,10 @@ function appObligations(input, key, effect) {
 	}
 	return out.length === 0 ? void 0 : freezeDeep(out);
 }
-/** Re-checks every grant's `meta.x` with the policy's grant schema, keeping the schema output. */
+/**
+* Re-checks every grant's `meta.x` with the policy's grant schema, keeping the
+* schema output.
+*/
 function withGrantSchema(grant, schema) {
 	const meta = grant.meta;
 	if (schema === void 0 || meta?.x === void 0) return grant;
@@ -602,7 +620,10 @@ function holderCount(roleName, option, value) {
 	if (typeof value !== "number" || !Number.isInteger(value) || value < 0) throw new Error(`PermDock: role '${roleName}' ${option} must be a whole number of holders`);
 	return value;
 }
-/** Ownership rules count holders per scope instance, so they need a named-scope role. */
+/**
+* Ownership rules count holders per scope instance, so they need a named-scope
+* role.
+*/
 function roleRules(roleName, scope, options) {
 	const min = holderCount(roleName, "min", options?.min);
 	const max = holderCount(roleName, "max", options?.max);

package/dist/rolldown-runtime-C3I60J0A.js

@@ -0,0 +1,4 @@
+//#region \0rolldown/runtime.js
+var __commonJSMin = (cb, mod) => () => (mod || (cb((mod = { exports: {} }).exports, mod, mod.exports), cb = null), mod.exports);
+//#endregion
+export { __commonJSMin as t };

package/dist/{row-conditions-h2HythXQ.js → row-conditions-BAGHOmVq.js}

@@ -9,9 +9,10 @@ const ROW_GRANTEES = /* @__PURE__ */ new Set([
 /**
 * Whether a grant depends on more than the role and the scope: a row or body
 * condition, a closure, a field list, a purpose, a break-glass override, a
-* validity window, a `requires`, or a relation, plan, actor or assurance grantee. The SQL helpers
-* (`permdock_has`, `permitted_<scope>_ids`) check only role and scope, so a
-* policy that calls them for such a permission would widen access.
+* validity window, a `requires`, or a relation, plan, actor or assurance
+* grantee. The SQL helpers (`permdock_has`, `permitted_<scope>_ids`) check only
+* role and scope, so a policy that calls them for such a permission would widen
+* access.
 */
 function grantHasRowConditions(grant) {
 	const grantees = Array.isArray(grant.to) ? grant.to : [grant.to];

package/dist/{rpc-VSl5ylaQ.js → rpc-fNqAIqQk.js}

@@ -1,8 +1,8 @@
 import { t as compact } from "./compact-CAf557ZB.js";
-import { s as requestFromContext } from "./http-BBoKefeS.js";
-import { n as tenantScope } from "./adapter-context-CRhqyzCk.js";
-import { t as adapterKernel } from "./bind-CAvgUuKs.js";
-import { r as guardIterable } from "./stream-CvdUS9V1.js";
+import { s as requestFromContext } from "./http-DKLXrFGk.js";
+import { n as tenantScope } from "./adapter-context-CIQpQxbE.js";
+import { t as adapterKernel } from "./bind-D_sZSVA3.js";
+import { r as guardIterable } from "./stream-CDvF0sJm.js";
 //#region src/server/rpc.ts
 /** The tRPC and oRPC error code for a Problem Details status. */
 function rpcCode(status) {
@@ -83,7 +83,10 @@ function bindRpcKernel(policy, options, adapter, contextOf, path) {
 		guard
 	};
 }
-/** Wraps a streamed result so revocation ends it and items the subscriber cannot read drop. */
+/**
+* Wraps a streamed result so revocation ends it and items the subscriber cannot
+* read drop.
+*/
 async function guardStream(source, open, permission, data, protectOptions, guard) {
 	const conn = await open(permission === null ? {} : compact({
 		permission,

package/dist/{run-CUKuz0A8.js → run-Bz26OTfO.js}

@@ -1,13 +1,13 @@
-import { i as dateAt } from "./time-DkWjdL98.js";
-import { a as describeError, l as problemOf, n as CliError, r as cliProblem, s as kindOfCode } from "./errors-CWTY6uih.js";
-import { s as cliVersion } from "./version-CEbQ5UeM.js";
-import { a as resolveCwd, i as readConfig } from "./config-bs_kZeYq.js";
+import { i as dateAt } from "./time-nR1JesoH.js";
+import { a as describeError, l as problemOf, n as CliError, r as cliProblem, s as kindOfCode } from "./errors-Vpu6rKHl.js";
+import { s as cliVersion } from "./version-DMQ0dnN5.js";
+import { a as resolveCwd, i as readConfig } from "./config-BwPBfN0t.js";
 import { t as beforeFirst } from "./text-BMFRfBqc.js";
-import { a as suggestion, i as parseLeaf, n as flagSpellings, o as GLOBAL_FLAGS, r as parseFlags } from "./args-IIolxxKA.js";
-import { r as progressReporter, t as redact } from "./credentials-DPyHmYz5.js";
-import { a as resolve, i as leaves, n as ROOT, r as SECTIONS, t as DOCS_BASE } from "./manifest-dvL2XEe1.js";
-import { t as createStyle } from "./style-Uao76wO7.js";
-import { a as sarifLog, i as githubAnnotations, n as envelope, t as dataOf } from "./output-1im__-08.js";
+import { a as suggestion, i as parseLeaf, n as flagSpellings, o as GLOBAL_FLAGS, r as parseFlags } from "./args-0FrVs5EH.js";
+import { r as progressReporter, t as redact } from "./credentials-CdDxp7jN.js";
+import { a as resolve, i as leaves, n as ROOT, r as SECTIONS, t as DOCS_BASE } from "./manifest-Cgiq5oqc.js";
+import { t as createStyle } from "./style-Ds11Hmk4.js";
+import { i as githubAnnotations, n as envelope, o as sarifLog, t as dataOf } from "./output-tkju6U7R.js";
 import { i as renameMessage, r as flagRename, t as COMMAND_MOVES } from "./renames-CGj7YwcQ.js";
 import { stripVTControlCharacters } from "node:util";
 import { existsSync, statSync } from "node:fs";
@@ -19,8 +19,8 @@ function set(env, name) {
 }
 /**
 * The AI agent running the CLI, from the variables `@vercel/detect-agent`
-* reads, in its order. `CURSOR_TRACE_ID` is also set in Cursor's own
-* terminal, so it counts only when stdout is not a TTY.
+* reads, in its order. `CURSOR_TRACE_ID` is also set in Cursor's own terminal,
+* so it counts only when stdout is not a TTY.
 */
 function detectAgent(env, probe) {
 	const named = env["AI_AGENT"]?.trim();
@@ -94,8 +94,8 @@ function modeOf(value, source) {
 	return mode;
 }
 /**
-* `--agent`, then `PERMDOCK_AGENT`, then detection. An unknown value is a
-* usage error, so a typo never leaves an agent with prompts it cannot answer.
+* `--agent`, then `PERMDOCK_AGENT`, then detection. An unknown value is a usage
+* error, so a typo never leaves an agent with prompts it cannot answer.
 */
 function agentMode(flag, env, probe) {
 	const mode = flag === void 0 ? modeOf(env["PERMDOCK_AGENT"], "PERMDOCK_AGENT") ?? "auto" : modeOf(flag, "--agent") ?? "auto";
@@ -110,8 +110,8 @@ function agentMode(flag, env, probe) {
 //#region src/cli/core/consent.ts
 /**
 * The reasons a run needs consent: it edits files the project owns, it
-* publishes to the Cloud, or `--force` overwrites files PermDock did not
-* write. A `--dry-run` or `--check` run writes nothing and needs none.
+* publishes to the Cloud, or `--force` overwrites files PermDock did not write.
+* A `--dry-run` or `--check` run writes nothing and needs none.
 */
 function consentReasons(effects, flags) {
 	if (flags["dry-run"] === true || flags["check"] === true) return [];
@@ -126,8 +126,8 @@ function quote(token) {
 	return /^[\w@%+=:,./-]+$/u.test(token) ? token : `'${token.replaceAll("'", String.raw`'\''`)}'`;
 }
 /**
-* The argv as a command line to run again, `--confirm` dropped. Secrets
-* only arrive through `--*-stdin` flags, so the line holds none.
+* The argv as a command line to run again, `--confirm` dropped. Secrets only
+* arrive through `--*-stdin` flags, so the line holds none.
 */
 function replayArgv(argv) {
 	const out = [];
@@ -143,8 +143,8 @@ function replayArgv(argv) {
 }
 /**
 * A short token bound to what the person agrees to, the directory and the
-* command line. Hex, because a base64url token may start with `-` and parse
-* as a flag. 16 characters, as better-supabase's.
+* command line. Hex, because a base64url token may start with `-` and parse as
+* a flag. 16 characters, as better-supabase's.
 */
 function consentToken(reasons, argv, cwd) {
 	return createHash("sha256").update(JSON.stringify([
@@ -304,7 +304,10 @@ function document(commands) {
 		commands
 	};
 }
-/** `<command> --help --json`: the `cli-commands-v1` document with that command only. */
+/**
+* `<command> --help --json`: the `cli-commands-v1` document with that command
+* only.
+*/
 function leafDocument(path, entry, leaf) {
 	return document([leafJson(path, entry, leaf)]);
 }
@@ -402,8 +405,8 @@ function lined(text) {
 	return text === "" || text.endsWith("\n") ? text : `${text}\n`;
 }
 /**
-* The step that answers an `input_required` error without its own `next`:
-* the same command line with each missing flag or positional filled by a
+* The step that answers an `input_required` error without its own `next`: the
+* same command line with each missing flag or positional filled by a
 * placeholder the caller replaces.
 */
 function missingInputNext(argv, error) {
@@ -675,7 +678,7 @@ async function run(argv, options) {
 		if (result.streamed === true) return done(result.code);
 		if (format === "github" || format === "sarif") {
 			const findings = result.findings ?? [];
-			writeOut(format === "github" ? githubAnnotations(findings) || "" : sarifLog(name, findings));
+			writeOut(format === "github" ? githubAnnotations(findings) : sarifLog(name, findings));
 			return done(result.code);
 		}
 		if (json) {

package/dist/run-D-JE8QWb.js

@@ -0,0 +1 @@
+export { t as run } from "./run-Bz26OTfO.js";

package/dist/{run-ticket-DocwaTKn.d.ts → run-ticket-DbWI9f99.d.ts}

@@ -1,7 +1,10 @@
-import { $n as Delegation, Rt as Instant, Yn as AuthorizationDetail, ar as Subject, dt as TokenVerifier, lt as TokenFailureCause, qn as Actor, qt as AuthEvent, rr as Principal, ut as TokenSigner } from "./policy-types-n0uRTsW8.js";
-import { p as PrincipalSource } from "./permdock-SV8ZINYT.js";
+import { $n as AuthorizationDetail, Rt as Instant, Zn as Actor, Zt as AuthEvent, dt as TokenVerifier, lr as Subject, lt as TokenFailureCause, rr as Delegation, sr as Principal, ut as TokenSigner } from "./policy-types-CCiDRZBH.js";
+import { _ as PrincipalSource } from "./permdock-B6Sf4T_S.js";
 //#region src/server/run-ticket.d.ts
-/** What started the run: a saved automation, a background job, or a caller's own request. */
+/**
+ * What started the run: a saved automation, a background job, or a caller's own
+ * request.
+ */
 type RunKind = "automation" | "job" | "caller";
 /** RFC 8693 `act`: the party running the work, with the chain of earlier actors. */
 type RunActClaim = {
@@ -9,7 +12,10 @@ type RunActClaim = {
   readonly kind?: string;
   readonly act?: RunActClaim;
 };
-/** The connector and tools a run may reach; carried for the adapter, never a grant. */
+/**
+ * The connector and tools a run may reach; carried for the adapter, never a
+ * grant.
+ */
 type RunBinding = {
   readonly connector?: string;
   readonly tools?: readonly string[];
@@ -18,7 +24,10 @@ type RunAutomation = {
   readonly id: string;
   readonly version: number | string;
 };
-/** The v1 claims of a `vnd.permdock.run+jwt`. At least one of `scope` and `authorization_details` is present. */
+/**
+ * The v1 claims of a `vnd.permdock.run+jwt`. At least one of `scope` and
+ * `authorization_details` is present.
+ */
 type RunTicket = {
   readonly v: 1;
   readonly iss: string;
@@ -34,17 +43,28 @@ type RunTicket = {
   /** Present exactly when `kind` is `automation`. */
   readonly automation?: RunAutomation;
   readonly tenant?: string;
-  /** The event that started the run, as JSON. Evaluation never reads it as a grant. */
+  /**
+   * The event that started the run, as JSON. Evaluation never reads it as a
+   * grant.
+   */
   readonly trigger?: Readonly<Record<string, unknown>>;
   readonly binding?: RunBinding;
 };
+/**
+ * Every v1 claim of a `vnd.permdock.run+jwt`, the set `parseRunTicket` keeps. A
+ * signing service passes only these to its signer.
+ */
+declare const RUN_TICKET_CLAIMS: readonly (keyof RunTicket)[];
 type RunTicketInput = {
   /** The principal the run acts for (`sub`). */
   readonly principal: string;
   readonly kind: RunKind;
   /** Becomes `act`; a nested `act` on the actor is kept as the chain. */
   readonly actor?: Actor;
-  /** The run's ceiling. Required: a ticket never carries the principal's full authority. */
+  /**
+   * The run's ceiling. Required: a ticket never carries the principal's full
+   * authority.
+   */
   readonly delegation: Delegation;
   readonly automation?: RunAutomation;
   readonly tenant?: string;
@@ -62,9 +82,9 @@ type RunTicketOptions = {
 };
 /** The live record of an automation, read on every use of its ticket. */
 type RunTicketAutomations = {
-  automation(id: string, options: {
+  automation: (id: string, options: {
     readonly tenant?: string;
-  }): {
+  }) => {
     readonly id: string;
     readonly version: number | string;
     readonly revoked?: boolean;
@@ -99,9 +119,9 @@ type RunPrincipal = Principal & {
   readonly runTicket: RunTicket;
 };
 /**
- * Validates untrusted run-ticket claims and returns a frozen copy with only
- * the v1 fields, or `undefined`. Unknown claims are dropped; a wrong type in
- * a known claim, a missing delegation, or an `automation` that does not match
+ * Validates untrusted run-ticket claims and returns a frozen copy with only the
+ * v1 fields, or `undefined`. Unknown claims are dropped; a wrong type in a
+ * known claim, a missing delegation, or an `automation` that does not match
  * `kind` rejects the whole ticket.
  */
 declare function parseRunTicket(claims: unknown): RunTicket | undefined;
@@ -121,4 +141,4 @@ declare function signRunTicket(input: RunTicketInput, signer: TokenSigner, optio
  */
 declare function subjectFromRunTicket(token: string | undefined | null, options: RunTicketSubjectOptions): Promise<Subject<RunPrincipal>>;
 //#endregion
-export { RunKind as a, RunTicketAutomations as c, RunTicketOptions as d, RunTicketSubjectOptions as f, subjectFromRunTicket as h, RunContext as i, RunTicketFailureCause as l, signRunTicket as m, RunAutomation as n, RunPrincipal as o, parseRunTicket as p, RunBinding as r, RunTicket as s, RunActClaim as t, RunTicketInput as u };
+export { RunContext as a, RunTicket as c, RunTicketInput as d, RunTicketOptions as f, subjectFromRunTicket as g, signRunTicket as h, RunBinding as i, RunTicketAutomations as l, parseRunTicket as m, RunActClaim as n, RunKind as o, RunTicketSubjectOptions as p, RunAutomation as r, RunPrincipal as s, RUN_TICKET_CLAIMS as t, RunTicketFailureCause as u };

package/dist/{run-ticket-sxFI6LAk.js → run-ticket-Dv7aF7Dk.js}

@@ -1,12 +1,33 @@
 import { t as compact } from "./compact-CAf557ZB.js";
-import { n as freezeDeep } from "./freeze-CrU8nQeX.js";
-import { a as ownRecord, n as isForbiddenKey } from "./paths-DXSHAMIa.js";
-import { a as isId } from "./expiry-D4_YKRKD.js";
-import { o as epochSeconds, p as nowSeconds } from "./time-DkWjdL98.js";
+import { n as freezeDeep } from "./freeze-jjan0lCv.js";
+import { a as ownRecord, n as isForbiddenKey } from "./paths-CUvURzHp.js";
+import { a as isId } from "./expiry-6XByK0dm.js";
+import { o as epochSeconds, p as nowSeconds } from "./time-nR1JesoH.js";
 import { n as toWireDelegation, t as fromWireDelegation } from "./wire-delegation-Cv3W2eaM.js";
 import { t as anonymousSubject } from "./subject-BGoM5o8B.js";
 //#region src/server/run-ticket.ts
 const RUN_TICKET_TYP = "vnd.permdock.run+jwt";
+/**
+* Every v1 claim of a `vnd.permdock.run+jwt`, the set `parseRunTicket` keeps. A
+* signing service passes only these to its signer.
+*/
+const RUN_TICKET_CLAIMS = Object.freeze([
+	"v",
+	"iss",
+	"sub",
+	"aud",
+	"jti",
+	"iat",
+	"exp",
+	"kind",
+	"act",
+	"scope",
+	"authorization_details",
+	"automation",
+	"tenant",
+	"trigger",
+	"binding"
+]);
 const RUN_KINDS = [
 	"automation",
 	"job",
@@ -134,9 +155,9 @@ function parseBody(record) {
 	});
 }
 /**
-* Validates untrusted run-ticket claims and returns a frozen copy with only
-* the v1 fields, or `undefined`. Unknown claims are dropped; a wrong type in
-* a known claim, a missing delegation, or an `automation` that does not match
+* Validates untrusted run-ticket claims and returns a frozen copy with only the
+* v1 fields, or `undefined`. Unknown claims are dropped; a wrong type in a
+* known claim, a missing delegation, or an `automation` that does not match
 * `kind` rejects the whole ticket.
 */
 function parseRunTicket(claims) {
@@ -334,4 +355,4 @@ async function subjectFromRunTicket(token, options) {
 	}));
 }
 //#endregion
-export { signRunTicket as n, subjectFromRunTicket as r, parseRunTicket as t };
+export { subjectFromRunTicket as i, parseRunTicket as n, signRunTicket as r, RUN_TICKET_CLAIMS as t };

package/dist/{runtime-D3VTAiCA.js → runtime-BGnrOkVH.js}

@@ -1,6 +1,9 @@
-import { l as scopedTenant, s as protectedView } from "./views-DTIIO-oQ.js";
+import { l as scopedTenant, s as protectedView } from "./views-CD8wuL4Z.js";
 //#region src/svelte/protected.ts
-/** The instance for `tenant`, built once per store change rather than once per check. */
+/**
+* The instance for `tenant`, built once per store change rather than once per
+* check.
+*/
 function scopedFor(store, tenant, _generation) {
 	return scopedTenant(store.get(), tenant);
 }