permdock 0.7.0 → 0.8.0

package/dist/{preset-CHTbd-DQ.js → preset-BjLzeFpp.js}

@@ -178,9 +178,9 @@ const FRAMEWORKS = [
 	}
 ];
 /**
-* Agent runtimes and UI recipes. The preset code keeps one bitset per
-* `kind`, each in this list's order, so a new entry goes after the last
-* one of its kind.
+* Agent runtimes and UI recipes. The preset code keeps one bitset per `kind`,
+* each in this list's order, so a new entry goes after the last one of its
+* kind.
 */
 const INTEGRATIONS = [
 	{
@@ -250,10 +250,9 @@ function requiredBy(choices, picked) {
 	return choices.filter((choice) => picked.includes(choice.id)).flatMap((choice) => choice.requires ?? []);
 }
 /**
-* The preset `input` describes, with every feature its archetype,
-* integrations and other features require turned on, and lists in
-* catalogue order. Features are only ever added, so resolving twice is a
-* no-op.
+* The preset `input` describes, with every feature its archetype, integrations
+* and other features require turned on, and lists in catalogue order. Features
+* are only ever added, so resolving twice is a no-op.
 */
 function resolvePreset(input) {
 	const integrations = INTEGRATIONS.map((item) => item.id).filter((id) => (input.integrations ?? PRESET_DEFAULTS.integrations).includes(id));
@@ -282,12 +281,12 @@ function resolvePreset(input) {
 //#endregion
 //#region src/preset/codec.ts
 /**
-* Preset codes: `p1` followed by base64url bytes. Version 1 packs, in
-* order, one byte each for the archetype, auth, backend and framework
-* index, then a bitset per multi-select list (features, agent
-* integrations, UI integrations, services), each as many bytes as the list
-* needs. A list only grows at the end, so a code keeps its meaning as the
-* catalogue grows; a new layout gets a new version prefix.
+* Preset codes: `p1` followed by base64url bytes. Version 1 packs, in order,
+* one byte each for the archetype, auth, backend and framework index, then a
+* bitset per multi-select list (features, agent integrations, UI integrations,
+* services), each as many bytes as the list needs. A list only grows at the
+* end, so a code keeps its meaning as the catalogue grows; a new layout gets a
+* new version prefix.
 */
 const VERSION = "p1";
 const AGENT_INTEGRATIONS = INTEGRATIONS.filter((item) => item.kind === "agent");
@@ -349,8 +348,8 @@ function encodePreset(preset) {
 	]);
 }
 /**
-* The preset a code stands for, resolved, or `undefined` for a code that
-* is not a version this package reads or does not decode.
+* The preset a code stands for, resolved, or `undefined` for a code that is not
+* a version this package reads or does not decode.
 */
 function decodePreset(code) {
 	if (!code.startsWith(VERSION)) return;
@@ -384,7 +383,10 @@ function decodePreset(code) {
 }
 //#endregion
 //#region src/preset/flags.ts
-/** One `permdock init` flag per preset key, with the catalogue it takes values from. */
+/**
+* One `permdock init` flag per preset key, with the catalogue it takes values
+* from.
+*/
 const PRESET_FLAGS = {
 	archetype: {
 		flag: "archetype",
@@ -423,9 +425,9 @@ const PRESET_FLAGS = {
 	}
 };
 /**
-* The `permdock init` flags that select `preset`, leaving out defaults and
-* the features its archetype and integrations already turn on, so
-* `permdock init <flags>` resolves to the same preset.
+* The `permdock init` flags that select `preset`, leaving out defaults and the
+* features its archetype and integrations already turn on, so `permdock init
+* <flags>` resolves to the same preset.
 */
 function presetFlags(preset) {
 	const implied = resolvePreset({
@@ -867,9 +869,9 @@ function quote(value) {
 	return JSON.stringify(value);
 }
 /**
-* An environment read in the generated code. Built from parts so this
-* runtime chunk carries no `process.` token, which the WinterTC check reads
-* as a Node global; the generated file has it whole.
+* An environment read in the generated code. Built from parts so this runtime
+* chunk carries no `process.` token, which the WinterTC check reads as a Node
+* global; the generated file has it whole.
 */
 function env(name) {
 	return ["process", `env[${quote(name)}]`].join(".");
@@ -1224,7 +1226,10 @@ function backendFiles(ctx) {
 		default: return ctx.preset.backend;
 	}
 }
-/** What `permdock.ts` adds for the backend: imports, statements before `defineApp`, and its options. */
+/**
+* What `permdock.ts` adds for the backend: imports, statements before
+* `defineApp`, and its options.
+*/
 function backendApp(ctx) {
 	if (ctx.preset.backend !== "supabase") return {
 		imports: [],
@@ -1286,7 +1291,10 @@ ${entries.join("\n")}
 });
 `;
 }
-/** What a role's grant becomes under the preset's features; the matrix and the code read the same answer. */
+/**
+* What a role's grant becomes under the preset's features; the matrix and the
+* code read the same answer.
+*/
 function grantShape(preset, role, grant) {
 	const has = (feature) => preset.features.includes(feature);
 	const resource = DOMAINS[preset.archetype].resources.find((item) => item.name === grant.resource);
@@ -1607,8 +1615,21 @@ export function decideReadKey(permdock: PermDock, id: string) {
 }
 function rlsOption(ctx) {
 	if (!ctx.has("rls")) return null;
-	const table = `{\n      table: "org_members",\n      tenant: "org_id",\n      user: "user_id",\n      role: "role",\n    }`;
-	return ctx.preset.backend === "supabase" ? `supabaseRls({${ctx.has("tenancy") ? `\n    memberships: ${table},\n  ` : ""}})` : `{\n    dialect: "guc",${ctx.has("tenancy") ? `\n    memberships: { tenant: ${table} },` : ""}\n  }`;
+	return ctx.preset.backend === "supabase" ? `supabaseRls({${ctx.has("tenancy") ? `\n    memberships: {
+      table: "org_members",
+      tenant: "org_id",
+      user: "user_id",
+      role: "role",
+    },\n  ` : ""}})` : `{\n    dialect: "guc",${ctx.has("tenancy") ? `\n    memberships: {
+      scopes: {
+        tenant: {
+          table: "org_members",
+          columns: { tenant: "org_id" },
+          user: "user_id",
+          role: "role",
+        },
+      },
+    },` : ""}\n  }`;
 }
 function configFile(ctx) {
 	const rls = rlsOption(ctx);
@@ -1626,7 +1647,10 @@ ${options.join("\n")}
 });
 `);
 }
-/** The `@permdock` registry recipes for the preset's UI; native has the gate and the upgrade prompt. */
+/**
+* The `@permdock` registry recipes for the preset's UI; native has the gate and
+* the upgrade prompt.
+*/
 function recipesFor(ctx) {
 	const web = ["gated-button"];
 	if (ctx.has("approvals")) web.push("approval-request-dialog");
@@ -1675,9 +1699,9 @@ function docsFor(ctx) {
 	return [...new Set(docs)];
 }
 /**
-* The files, dependencies and recipes for `preset`. Pure: no file system
-* and no network, so the same function runs in the CLI, in a registry route
-* and in the browser preview on /create.
+* The files, dependencies and recipes for `preset`. Pure: no file system and no
+* network, so the same function runs in the CLI, in a registry route and in the
+* browser preview on /create.
 */
 function generatePreset(preset, options = {}) {
 	const ctx = {
@@ -1713,8 +1737,8 @@ const NONE = {
 	limit: false
 };
 /**
-* Who may do what under `preset`, from the same model the generated policy
-* is written from, for a page that shows the policy without running it.
+* Who may do what under `preset`, from the same model the generated policy is
+* written from, for a page that shows the policy without running it.
 */
 function presetMatrix(preset) {
 	const domain = DOMAINS[preset.archetype];

package/dist/{principal-source-pHneukrx.js → principal-source-C6N60GtM.js}

@@ -1,13 +1,13 @@
-import { t as freezeCopy } from "./freeze-CrU8nQeX.js";
-import { a as ownRecord } from "./paths-DXSHAMIa.js";
+import { t as freezeCopy } from "./freeze-jjan0lCv.js";
+import { a as ownRecord } from "./paths-CUvURzHp.js";
 //#region src/core/principal-source.ts
 function nonEmpty(value) {
 	return typeof value === "string" && value.trim() !== "";
 }
 /**
 * A `PrincipalIdentity` in the form sources compare: an email trimmed and
-* lower-cased with no provider or workspace, a chat identity with a
-* provider. Anything else, inherited fields included, is `undefined`.
+* lower-cased with no provider or workspace, a chat identity with a provider.
+* Anything else, inherited fields included, is `undefined`.
 */
 function normalizeIdentity(value) {
 	const record = ownRecord(value);
@@ -55,9 +55,9 @@ async function loadPrincipal(source, id, tenant) {
 	}
 }
 /**
-* `source.principalByIdentity(identity)` over the normalised identity,
-* failing closed: no source or method, an invalid identity, `null`, a throw
-* or a rejection is `null`.
+* `source.principalByIdentity(identity)` over the normalised identity, failing
+* closed: no source or method, an invalid identity, `null`, a throw or a
+* rejection is `null`.
 */
 async function loadPrincipalByIdentity(source, identity) {
 	const normalized = normalizeIdentity(identity);
@@ -69,9 +69,9 @@ async function loadPrincipalByIdentity(source, identity) {
 	}
 }
 /**
-* In-process principals for tests and single-replica apps. `identities`
-* links an email or chat identity to a principal id; each answer is a fresh
-* frozen copy. `tenant` is not a filter, as for a database source.
+* In-process principals for tests and single-replica apps. `identities` links
+* an email or chat identity to a principal id; each answer is a fresh frozen
+* copy. `tenant` is not a filter, as for a database source.
 */
 function memoryPrincipalSource(input) {
 	const byId = /* @__PURE__ */ new Map();

package/dist/prisma/index.d.ts

@@ -1,14 +1,20 @@
-import { Rt as Instant, lr as Subject, mr as Condition } from "../policy-types-B-F-qAZk.js";
-import { u as WhereResult } from "../permdock-Dco6dyCK.js";
-import { r as RelationsMapping } from "../graph-sql-B-dsAT6j.js";
-import { n as WithSubjectOptions, t as RowCheck } from "../row-check-Dt35czLy.js";
+import { Rt as Instant, lr as Subject, mr as Condition } from "../policy-types-CCiDRZBH.js";
+import { f as WhereResult } from "../permdock-B6Sf4T_S.js";
+import { r as RelationsMapping } from "../graph-sql-BwFC4Qjs.js";
+import { n as RowCheck, t as WithSubjectOptions } from "../subject-settings-vNW8qmUH.js";
 //#region src/prisma/model-fields.d.ts
-/** A model's non-nullable scalar fields and its scalar list fields, by Prisma field name. */
+/**
+ * A model's non-nullable scalar fields and its scalar list fields, by Prisma
+ * field name.
+ */
 type PrismaModelFields = {
   readonly required: readonly string[];
   readonly lists: readonly string[];
 };
-/** The `datamodel` of Prisma's DMMF (`getDMMF`, or a generator's `options.dmmf.datamodel`). */
+/**
+ * The `datamodel` of Prisma's DMMF (`getDMMF`, or a generator's
+ * `options.dmmf.datamodel`).
+ */
 type PrismaDatamodel = {
   readonly models: readonly {
     readonly name: string;
@@ -21,8 +27,9 @@ type PrismaDatamodel = {
   }[];
 };
 /**
- * Reads a model's required and list fields from `schema.prisma` text or a DMMF datamodel, for
- * the `model` option of `toWhere` and `toPredicate`. Relation fields are skipped.
+ * Reads a model's required and list fields from `schema.prisma` text or a DMMF
+ * datamodel, for the `model` option of `toWhere` and `toPredicate`. Relation
+ * fields are skipped.
  */
 export declare function prismaModelFields(datamodel: string | PrismaDatamodel, model: string): PrismaModelFields;
 //#endregion
@@ -30,11 +37,17 @@ export declare function prismaModelFields(datamodel: string | PrismaDatamodel, m
 type PrismaWhereOptions = {
   readonly fields?: Readonly<Record<string, string>>;
   readonly subject?: Subject;
-  /** The clock membership expiry is read at; a `Temporal.Instant` fits. Defaults to the current time. */
+  /**
+   * The clock membership expiry is read at; a `Temporal.Instant` fits. Defaults
+   * to the current time.
+   */
   readonly now?: Instant;
   readonly listFields?: readonly string[];
   readonly requiredFields?: readonly string[];
-  /** Required and list fields read from the schema by `prismaModelFields`; adds to `requiredFields` and `listFields`. */
+  /**
+   * Required and list fields read from the schema by `prismaModelFields`; adds
+   * to `requiredFields` and `listFields`.
+   */
   readonly model?: PrismaModelFields;
 };
 export declare function toWhere<T extends Record<string, unknown> = Record<string, unknown>>(input: Condition | WhereResult, options?: PrismaWhereOptions): T;
@@ -48,43 +61,45 @@ export declare function permdockExtension(): {
   };
 };
 type PrismaTransactionClient = {
-  $executeRawUnsafe(query: string, ...values: unknown[]): Promise<number>;
+  $executeRawUnsafe: (query: string, ...values: unknown[]) => Promise<number>;
 };
 type PrismaLike<Tx> = {
-  $transaction<T>(fn: (tx: Tx) => Promise<T>): Promise<T>;
+  $transaction: <T>(fn: (tx: Tx) => Promise<T>) => Promise<T>;
 };
 /**
- * Runs `fn` in an interactive transaction whose role and claims are `permdock.subject`'s, so
- * the generated RLS policies decide for the same subject as the in-process checks.
+ * Runs `fn` in an interactive transaction whose role and claims are
+ * `permdock.subject`'s, so the generated RLS policies decide for the same
+ * subject as the in-process checks.
  */
 export declare function withSubject<Tx extends PrismaTransactionClient, T>(prisma: PrismaLike<Tx>, permdock: {
   readonly subject: Subject;
 }, fn: (tx: Tx) => Promise<T>, options?: WithSubjectOptions): Promise<T>;
 type PrismaDelegate = {
-  findFirst(args: {
+  findFirst: (args: {
     readonly where: Record<string, unknown>;
-  }): Promise<unknown>;
+  }) => Promise<unknown>;
 };
 /**
- * Checks one row by its unique key, for `findUnique`, `update` and `delete`, which take no
- * filter: `{ found: false }` when `unique` matches nothing, otherwise whether the permission
- * filter keeps the row. One query when granted, two otherwise.
+ * Checks one row by its unique key, for `findUnique`, `update` and `delete`,
+ * which take no filter: `{ found: false }` when `unique` matches nothing,
+ * otherwise whether the permission filter keeps the row. One query when
+ * granted, two otherwise.
  */
 export declare function checkRow(delegate: PrismaDelegate, input: Condition | WhereResult, unique: Record<string, unknown>, options?: PrismaWhereOptions): Promise<RowCheck>;
 //#endregion
 //#region src/prisma/predicate.d.ts
 /** A Prisma 8 ORM field proxy: `u.email` inside `.where((u) => ...)`. */
 type PrismaFieldProxy = {
-  eq(value: unknown): unknown;
-  neq(value: unknown): unknown;
-  gt(value: unknown): unknown;
-  gte(value: unknown): unknown;
-  lt(value: unknown): unknown;
-  lte(value: unknown): unknown;
-  like(pattern: string): unknown;
-  in(values: readonly unknown[]): unknown;
-  isNull(): unknown;
-  isNotNull(): unknown;
+  eq: (value: unknown) => unknown;
+  neq: (value: unknown) => unknown;
+  gt: (value: unknown) => unknown;
+  gte: (value: unknown) => unknown;
+  lt: (value: unknown) => unknown;
+  lte: (value: unknown) => unknown;
+  like: (pattern: string) => unknown;
+  in: (values: readonly unknown[]) => unknown;
+  isNull: () => unknown;
+  isNotNull: () => unknown;
 };
 /** `import { and, or, not } from '@prisma/orm-postgres/orm-client'`. */
 type PrismaCombinators = {
@@ -95,12 +110,21 @@ type PrismaCombinators = {
 type PrismaPredicateOptions = {
   readonly fields?: Readonly<Record<string, string>>;
   readonly subject?: Subject;
-  /** The clock membership expiry is read at; a `Temporal.Instant` fits. Defaults to the current time. */
+  /**
+   * The clock membership expiry is read at; a `Temporal.Instant` fits. Defaults
+   * to the current time.
+   */
   readonly now?: Instant;
-  /** Required and list fields from `prismaModelFields`; `contains` on a list field is refused. */
+  /**
+   * Required and list fields from `prismaModelFields`; `contains` on a list
+   * field is refused.
+   */
   readonly model?: PrismaModelFields;
   readonly listFields?: readonly string[];
-  /** A non-null column (the primary key) that spells constant true and false. Default `id`. */
+  /**
+   * A non-null column (the primary key) that spells constant true and false.
+   * Default `id`.
+   */
   readonly key?: string;
   /** Loaded from `@prisma/orm-postgres/orm-client` by default. */
   readonly combinators?: PrismaCombinators;
@@ -108,16 +132,17 @@ type PrismaPredicateOptions = {
 type Model = Readonly<Record<string, PrismaFieldProxy>>;
 /**
  * Compiles a condition into a Prisma 8 ORM predicate: pass the result to
- * `db.orm.<ns>.<Model>.where(...)`. No grant compiles to a predicate that matches no row.
+ * `db.orm.<ns>.<Model>.where(...)`. No grant compiles to a predicate that
+ * matches no row.
  */
 export declare function toPredicate<M = Model>(input: Condition | WhereResult, options?: PrismaPredicateOptions): (model: M) => unknown;
 //#endregion
 //#region src/conditions/resolve-related.d.ts
 type ResolveRelatedOptions = {
   /**
-   * Runs one Postgres query with `$1`-style placeholders and returns its
-   * rows; each row's `id` is an id the filtered field may hold. With Prisma:
-   * `({ sql, values }) => prisma.$queryRawUnsafe(sql, ...values)`.
+   * Runs one Postgres query with `$1`-style placeholders and returns its rows;
+   * each row's `id` is an id the filtered field may hold. With Prisma: `({ sql,
+   * values }) => prisma.$queryRawUnsafe(sql, ...values)`.
    */
   readonly run: (query: {
     readonly sql: string;
@@ -125,14 +150,17 @@ type ResolveRelatedOptions = {
   }) => Promise<readonly Readonly<Record<string, unknown>>[]>;
   /** Where the relation graph lives. */
   readonly relations?: RelationsMapping;
-  /** Turns an id (always text) into the field's type, e.g. `Number` for an integer key. */
+  /**
+   * Turns an id (always text) into the field's type, e.g. `Number` for an
+   * integer key.
+   */
   readonly parse?: (id: string, field: string) => unknown;
 };
 /**
- * `where` with every `related` node replaced by the ids it reaches, read in
- * one query per node, so an ORM without raw subqueries (Prisma) filters the
- * graph with a plain `in`. The ids are read now: run the filtered query right
- * after, in the same transaction when the graph may change in between.
+ * `where` with every `related` node replaced by the ids it reaches, read in one
+ * query per node, so an ORM without raw subqueries (Prisma) filters the graph
+ * with a plain `in`. The ids are read now: run the filtered query right after,
+ * in the same transaction when the graph may change in between.
  */
 export declare function resolveRelated(where: WhereResult, options: ResolveRelatedOptions): Promise<WhereResult>;
 //#endregion

package/dist/prisma/index.js

@@ -1,9 +1,9 @@
 import { t as compact } from "../compact-CAf557ZB.js";
-import { n as freezeDeep } from "../freeze-CrU8nQeX.js";
-import { t as assertSafeKey } from "../paths-DXSHAMIa.js";
-import { n as PermDockValidationError } from "../validation-error-ZfUHbKvf.js";
-import { a as relatedRowGuard, l as renderGraphSql, n as escapeLike, s as relatedTargetsSql, t as compileWhere, u as restrictedRowsSql } from "../compile-BAEO5bOk.js";
-import { n as statementText, o as rowCheckOf, r as subjectStatements, s as loadPeer } from "../subject-settings-CkEwrw3W.js";
+import { n as freezeDeep } from "../freeze-jjan0lCv.js";
+import { t as assertSafeKey } from "../paths-CUvURzHp.js";
+import { n as PermDockValidationError } from "../validation-error-CYg2kJEw.js";
+import { c as relatedTargetsSql, d as restrictedRowsSql, n as compileWhere, o as relatedRowGuard, r as escapeLike, u as renderGraphSql } from "../compile-EzEMB-7v.js";
+import { n as statementText, o as rowCheckOf, r as subjectStatements, s as loadPeer } from "../subject-settings-8sH5HlII.js";
 //#region src/prisma/to-where.ts
 function fieldTests(options) {
 	const mapped = (field) => fieldName(field, options.fields);
@@ -139,8 +139,9 @@ function permdockExtension() {
 	};
 }
 /**
-* Runs `fn` in an interactive transaction whose role and claims are `permdock.subject`'s, so
-* the generated RLS policies decide for the same subject as the in-process checks.
+* Runs `fn` in an interactive transaction whose role and claims are
+* `permdock.subject`'s, so the generated RLS policies decide for the same
+* subject as the in-process checks.
 */
 function withSubject(prisma, permdock, fn, options = {}) {
 	const statements = subjectStatements(permdock, options);
@@ -150,9 +151,10 @@ function withSubject(prisma, permdock, fn, options = {}) {
 	});
 }
 /**
-* Checks one row by its unique key, for `findUnique`, `update` and `delete`, which take no
-* filter: `{ found: false }` when `unique` matches nothing, otherwise whether the permission
-* filter keeps the row. One query when granted, two otherwise.
+* Checks one row by its unique key, for `findUnique`, `update` and `delete`,
+* which take no filter: `{ found: false }` when `unique` matches nothing,
+* otherwise whether the permission filter keeps the row. One query when
+* granted, two otherwise.
 */
 async function checkRow(delegate, input, unique, options = {}) {
 	const filter = toWhere(input, options);
@@ -233,7 +235,8 @@ function render(node, model, options, ops) {
 }
 /**
 * Compiles a condition into a Prisma 8 ORM predicate: pass the result to
-* `db.orm.<ns>.<Model>.where(...)`. No grant compiles to a predicate that matches no row.
+* `db.orm.<ns>.<Model>.where(...)`. No grant compiles to a predicate that
+* matches no row.
 */
 function toPredicate(input, options = {}) {
 	const compiled = compileWhere(input, compact({
@@ -292,8 +295,9 @@ function fromDatamodel(datamodel, model) {
 	};
 }
 /**
-* Reads a model's required and list fields from `schema.prisma` text or a DMMF datamodel, for
-* the `model` option of `toWhere` and `toPredicate`. Relation fields are skipped.
+* Reads a model's required and list fields from `schema.prisma` text or a DMMF
+* datamodel, for the `model` option of `toWhere` and `toPredicate`. Relation
+* fields are skipped.
 */
 function prismaModelFields(datamodel, model) {
 	assertSafeKey(model, "Prisma model");
@@ -334,10 +338,10 @@ function refused(detail) {
 	});
 }
 /**
-* `where` with every `related` node replaced by the ids it reaches, read in
-* one query per node, so an ORM without raw subqueries (Prisma) filters the
-* graph with a plain `in`. The ids are read now: run the filtered query right
-* after, in the same transaction when the graph may change in between.
+* `where` with every `related` node replaced by the ids it reaches, read in one
+* query per node, so an ORM without raw subqueries (Prisma) filters the graph
+* with a plain `in`. The ids are read now: run the filtered query right after,
+* in the same transaction when the graph may change in between.
 */
 async function resolveRelated(where, options) {
 	const resources = where.resources;

package/dist/{problem-CTviyH5L.js → problem-BVLHFK33.js}

@@ -1,9 +1,9 @@
 import { t as compact } from "./compact-CAf557ZB.js";
-import { n as freezeDeep } from "./freeze-CrU8nQeX.js";
-import { n as PermDockValidationError } from "./validation-error-ZfUHbKvf.js";
-import { a as problemType, i as stepUpOf, n as problemDetails, o as statusProblem, t as notFoundDetails } from "./problem-details-cn5X30gZ.js";
-import { a as deniedMessage, i as approvalMessage } from "./errors-BKy0EfhN.js";
-import { a as durationOf, g as secondsOf, p as nowSeconds } from "./time-DkWjdL98.js";
+import { n as freezeDeep } from "./freeze-jjan0lCv.js";
+import { n as PermDockValidationError } from "./validation-error-CYg2kJEw.js";
+import { a as problemType, i as stepUpOf, n as problemDetails, o as statusProblem, t as notFoundDetails } from "./problem-details-CLDgX1KV.js";
+import { a as deniedMessage, i as approvalMessage } from "./errors-B6R_lg2a.js";
+import { a as durationOf, g as secondsOf, p as nowSeconds } from "./time-nR1JesoH.js";
 //#region src/server/problem.ts
 function quoted(value) {
 	return `"${value.replaceAll(/["\\]/gu, "")}"`;
@@ -31,7 +31,10 @@ function protectedResourceMetadataUrl(resource) {
 	const path = resource.pathname === "/" ? "" : resource.pathname;
 	return `${resource.origin}/.well-known/oauth-protected-resource${path}`;
 }
-/** The `error_description` of every `invalid_token` challenge (RFC 6750 section 3.1). */
+/**
+* The `error_description` of every `invalid_token` challenge (RFC 6750 section
+* 3.1).
+*/
 const INVALID_TOKEN = "The access token is invalid";
 function wwwAuthenticate(decision, permission, credentials = true) {
 	return challengeFor(decision, permission?.scope, credentials);
@@ -111,9 +114,9 @@ function rateLimitHeaders(decision, now) {
 	};
 }
 /**
-* The response for a decision's Problem Details: `WWW-Authenticate` for a
-* `401` or a missing delegation, and the rate-limit fields for a `429`. A
-* hidden row's `404` carries neither, so it reads like a missing one.
+* The response for a decision's Problem Details: `WWW-Authenticate` for a `401`
+* or a missing delegation, and the rate-limit fields for a `429`. A hidden
+* row's `404` carries neither, so it reads like a missing one.
 */
 function decisionResponse(details, decision, options = {}) {
 	const headers = new Headers({
@@ -127,13 +130,15 @@ function decisionResponse(details, decision, options = {}) {
 		headers
 	});
 }
-function problemFromDecision(decision, permission, subject, options = {}) {
-	if (decision.outcome === "granted") return new Response(null, { status: 204 });
-	const validation = decision.outcome === "denied" ? decision.denials[0]?.detail : void 0;
-	if (options.disclosure !== "hide" && validation instanceof PermDockValidationError) return problemResponse(validation.toProblemDetails(), options.scope === void 0 ? permission : {
-		...permission,
-		scope: options.scope
-	}, decision);
+function validationOf(decision, disclosure) {
+	const detail = decision.outcome === "denied" ? decision.denials[0]?.detail : void 0;
+	return disclosure !== "hide" && detail instanceof PermDockValidationError ? detail : void 0;
+}
+/** The Problem Details body `problemFromDecision` answers with. */
+function decisionProblem(decision, permission, subject, options = {}) {
+	return validationOf(decision, options.disclosure)?.toProblemDetails() ?? refusalDetails(decision, permission, subject, options);
+}
+function refusalDetails(decision, permission, subject, options) {
 	const details = problemDetails(compact({
 		decision,
 		detail: decision.outcome === "approval-required" ? approvalMessage(permission.key, decision.reason, decision.token) : deniedMessage(permission.key, subject?.principal?.id, decision.denials, decision.alternatives.map((leaf) => leaf.key), subject !== void 0),
@@ -147,10 +152,19 @@ function problemFromDecision(decision, permission, subject, options = {}) {
 		at: options.approval.at,
 		hint: options.approval.hint
 	});
-	return decisionResponse(approval === void 0 ? details : {
+	return approval === void 0 ? details : {
 		...details,
 		approval
-	}, decision, compact({
+	};
+}
+function problemFromDecision(decision, permission, subject, options = {}) {
+	if (decision.outcome === "granted") return new Response(null, { status: 204 });
+	const validation = validationOf(decision, options.disclosure);
+	if (validation !== void 0) return problemResponse(validation.toProblemDetails(), options.scope === void 0 ? permission : {
+		...permission,
+		scope: options.scope
+	}, decision);
+	return decisionResponse(refusalDetails(decision, permission, subject, options), decision, compact({
 		scope: options.scope ?? permission.scope,
 		credentials: options.credentials
 	}));
@@ -167,16 +181,22 @@ const ANONYMOUS = freezeDeep({
 	}],
 	alternatives: []
 });
-/** The `401` for a request with no subject, with the RFC 6750 challenge its credentials call for. */
+/**
+* The `401` for a request with no subject, with the RFC 6750 challenge its
+* credentials call for.
+*/
 function unauthenticatedProblem(credentials) {
 	return decisionResponse(problemDetails({
 		decision: ANONYMOUS,
 		detail: "anonymous"
 	}), ANONYMOUS, { credentials });
 }
-/** RFC 9110 section 15.5.6: a `405` lists the methods the resource supports in `Allow`. */
+/**
+* RFC 9110 section 15.5.6: a `405` lists the methods the resource supports in
+* `Allow`.
+*/
 function methodNotAllowed(allow) {
 	return problemResponse(statusProblem(405, `use ${allow}`), void 0, void 0, { Allow: allow });
 }
 //#endregion
-export { methodNotAllowed as a, problemResponse as c, validationProblem as d, wwwAuthenticate as f, decisionResponse as i, protectedResourceMetadataUrl as l, batchTooLarge as n, notFoundProblem as o, bearerChallenge as r, problemFromDecision as s, ANONYMOUS as t, unauthenticatedProblem as u };
+export { decisionResponse as a, problemFromDecision as c, unauthenticatedProblem as d, validationProblem as f, decisionProblem as i, problemResponse as l, batchTooLarge as n, methodNotAllowed as o, wwwAuthenticate as p, bearerChallenge as r, notFoundProblem as s, ANONYMOUS as t, protectedResourceMetadataUrl as u };

package/dist/{problem-details-cn5X30gZ.js → problem-details-CLDgX1KV.js}

@@ -1,5 +1,5 @@
 import { t as compact } from "./compact-CAf557ZB.js";
-import { t as PROBLEM_BASE } from "./validation-error-ZfUHbKvf.js";
+import { t as PROBLEM_BASE } from "./validation-error-CYg2kJEw.js";
 import { t as wireDenials } from "./wire-denial-C7PaVYEM.js";
 //#region src/core/problem-types.ts
 /** The `type` URI of a PermDock problem type. */
@@ -38,7 +38,10 @@ function statusProblem(status, detail, extra = {}) {
 }
 //#endregion
 //#region src/core/problem-details.ts
-/** Reasons that only arise once a matching grant was found, so they reveal nothing hidden. */
+/**
+* Reasons that only arise once a matching grant was found, so they reveal
+* nothing hidden.
+*/
 const HOLDS_GRANT = /* @__PURE__ */ new Set([
 	"insufficient-user-authentication",
 	"limit",
@@ -48,14 +51,20 @@ function granteesOf(to) {
 	if (to === void 0) return [];
 	return Array.isArray(to) ? to : [to];
 }
-/** The plans a `not-entitled` denial asks for; empty unless every denial is `not-entitled`. */
+/**
+* The plans a `not-entitled` denial asks for; empty unless every denial is
+* `not-entitled`.
+*/
 function requiredPlans(decision) {
 	if (decision.outcome !== "denied" || decision.denials.length === 0 || decision.denials.some((denial) => denial.reason !== "not-entitled")) return [];
 	const plans = /* @__PURE__ */ new Set();
 	for (const denial of decision.denials) for (const item of granteesOf(denial.to)) if (item.kind === "plan") plans.add(item.plan);
 	return [...plans];
 }
-/** The `acr` values and the tightest `maxAge` the failing assurance grants ask for. */
+/**
+* The `acr` values and the tightest `maxAge` the failing assurance grants ask
+* for.
+*/
 function stepUpOf(decision) {
 	if (decision.outcome !== "denied") return {};
 	const acr = /* @__PURE__ */ new Set();

package/dist/{problem-types-CJ2325SZ.js → problem-types-DSsRfONQ.js}

@@ -1,5 +1,8 @@
 //#region src/cli/cloud/problem-types.ts
-/** The Problem `type` of `GET /v1/projects/{id}/policy` before the first `cloud push`. */
+/**
+* The Problem `type` of `GET /v1/projects/{id}/policy` before the first `cloud
+* push`.
+*/
 const POLICY_NOT_PUBLISHED = "https://permdock.com/problems/policy-not-published";
 //#endregion
 export { POLICY_NOT_PUBLISHED as t };