permdock 0.7.0 → 0.9.0

package/dist/{server-types-C4gZUEZy.d.ts → server-types-CyRN0-Cd.d.ts}

@@ -1,18 +1,21 @@
-import { Gt as Snapshot, Ln as Decision, Rt as Instant, Zn as Actor, ar as JsonWebKeyLike, j as PolicyVocabulary, lr as Subject } from "./policy-types-B-F-qAZk.js";
-import { u as Permission } from "./permission-types-DhNEmoRG.js";
-import { a as PermDock, l as SnapshotOptions } from "./permdock-Dco6dyCK.js";
-import { m as ApprovalStore } from "./types-DC44-hqb.js";
-import { a as ProblemDetails, t as ApprovalHint } from "./errors-B_Qg9D3e.js";
-import { t as InstanceOptions } from "./instance-options-CU0YQCLH.js";
+import { Un as Decision, Wt as Instant, X as Intent, Zt as Snapshot, dr as JsonWebKeyLike, hr as Subject, j as PolicyVocabulary, rr as Actor } from "./policy-types-DGIO_gxq.js";
+import { u as Permission } from "./permission-types-CAY-GU7e.js";
+import { a as PermDock, u as SnapshotOptions } from "./permdock-CprAPN3w.js";
+import { m as ApprovalStore } from "./types-DLvhVm1r.js";
+import { a as ProblemDetails, t as ApprovalHint } from "./errors-BIM4MFsJ.js";
+import { t as InstanceOptions } from "./instance-options-CoHn-0e8.js";
 import { t as RequestContext } from "./request-context-C2_1lchh.js";
-import { n as PermDockWrap } from "./wrap-B6R0cMRL.js";
-import { n as RevocationFeed } from "./revocations-R07lFBnX.js";
-import { r as PdpFactory } from "./types-D3A19w4A.js";
-import { i as evaluationsHandler } from "./evaluations-BCddEOfO.js";
+import { n as PermDockWrap } from "./wrap-DxXB54Wu.js";
+import { n as RevocationFeed } from "./revocations-BaUXHM1N.js";
+import { r as PdpFactory } from "./types-DlelvQk4.js";
+import { i as evaluationsHandler } from "./evaluations-DOWuBpWv.js";
 //#region src/server/connection.d.ts
 type ConnectionData<T> = T | (() => T | null | undefined | Promise<T | null | undefined>);
 type ConnectionOptions<T = unknown> = {
-  /** The permission the stream or socket is opened for; re-checked after every revalidation. */
+  /**
+   * The permission the stream or socket is opened for; re-checked after every
+   * revalidation.
+   */
   readonly permission?: Permission;
   /** The row for `permission`, or a loader re-run on every revalidation. */
   readonly data?: ConnectionData<T>;
@@ -25,13 +28,13 @@ type Connection = {
   /** Aborts with a `PermDockRevokedError` when the connection must end. */
   readonly signal: AbortSignal;
   /**
-   * Per-message decision. Data is validated against the resource schema
-   * first unless `{ trusted: true }` marks it as a row the server loaded.
+   * Per-message decision. Data is validated against the resource schema first
+   * unless `{ trusted: true }` marks it as a row the server loaded.
    */
   readonly check: (permission: Permission, data?: unknown, options?: {
     readonly trusted?: boolean;
   }) => Decision;
-  readonly filter: <T>(permission: Permission<string, T, "instance">, items: readonly T[]) => T[];
+  readonly filter: <T>(permission: Permission<string, NoInfer<T>, "instance">, items: readonly T[]) => T[];
   /**
    * Resolves once every revalidation queued so far has finished, so a message
    * checked after a revocation event is checked against the rebuilt instance.
@@ -43,14 +46,17 @@ type Connection = {
 //#endregion
 //#region src/core/adapter-context.d.ts
 /**
- * The active tenant an adapter resolved from its own framework context.
- * Present means "use this tenant", even when `tenant` is `undefined`.
+ * The active tenant an adapter resolved from its own framework context. Present
+ * means "use this tenant", even when `tenant` is `undefined`.
  */
 type TenantScope = {
   readonly tenant: string | undefined;
 };
 type TenantOption<TContext> = string | ((context: TContext) => string | undefined | Promise<string | undefined>);
-/** Resolves an adapter `tenant` option against its framework context; a throw is no tenant. */
+/**
+ * Resolves an adapter `tenant` option against its framework context; a throw is
+ * no tenant.
+ */
 declare function tenantScope<TContext>(option: TenantOption<TContext> | undefined, context: TContext): Promise<TenantScope>;
 //#endregion
 //#region src/server/web-bot-auth.d.ts
@@ -75,13 +81,16 @@ type WebBotAuthOptions = {
   readonly now?: () => Instant;
 };
 /**
- * An adapter's `webBotAuth` option: `webBotAuthVerifier(options)`,
- * so an app without it does not bundle RFC 9421 verification.
+ * An adapter's `webBotAuth` option: `webBotAuthVerifier(options)`, so an app
+ * without it does not bundle RFC 9421 verification.
  */
 type WebBotAuthVerifier = {
   readonly name?: string;
-  /** The verified signer as an actor, `undefined` for an unsigned request; throws `InvalidSignatureError` for a bad signature. */
-  verify(request: Request): Promise<Actor | undefined>;
+  /**
+   * The verified signer as an actor, `undefined` for an unsigned request;
+   * throws `InvalidSignatureError` for a bad signature.
+   */
+  verify: (request: Request) => Promise<Actor | undefined>;
 };
 type DiscoverViaSignatureAgentOptions = {
   readonly allow: readonly string[];
@@ -104,7 +113,10 @@ declare function webBotAuthVerifier(options?: WebBotAuthOptions): WebBotAuthVeri
 //#endregion
 //#region src/server/server-types.d.ts
 type ServerPermDockOptions<TUser = unknown> = InstanceOptions & {
-  /** The user, or a full `Subject` (core then skips `policy.subject`); `null` is anonymous. */
+  /**
+   * The user, or a full `Subject` (core then skips `policy.subject`); `null` is
+   * anonymous.
+   */
   readonly subject: (request: Request) => TUser | Subject | null | Promise<TUser | Subject | null>;
   readonly actor?: (request: Request) => unknown;
   /** `webBotAuthVerifier(options)`; a verified bot becomes the actor. */
@@ -123,23 +135,39 @@ type ServerPermDockOptions<TUser = unknown> = InstanceOptions & {
   readonly approval?: ApprovalHint;
   readonly operations?: OperationScopes;
   /**
-   * Replaces the response of a refused guard. A status below 300, or a
-   * throw, keeps the default response and reports through `on('error')`.
+   * Replaces the response of a refused guard. A status below 300, or a throw,
+   * keeps the default response and reports through `on('error')`.
    */
   readonly deniedResponse?: DeniedResponse;
   /**
-   * Request values merged into `subject.context`, under `policy.context`.
-   * Only values the server derived belong here, never client input. A throw
-   * or a value that is not a JSON object adds nothing and reports through
+   * Request values merged into `subject.context`, under `policy.context`. Only
+   * values the server derived belong here, never client input. A throw or a
+   * value that is not a JSON object adds nothing and reports through
    * `on('error')`.
    */
   readonly context?: (request: Request) => RequestContext | undefined | Promise<RequestContext | undefined>;
-  /** Wraps each instance the factory builds; build it with `wrapPermDock` to cover derived instances. */
+  /**
+   * Wraps each instance the factory builds; build it with `wrapPermDock` to
+   * cover derived instances.
+   */
   readonly wrap?: PermDockWrap;
-  /** The `adapter` label on decision events, revocations and approvals. Defaults to `server`. */
+  /**
+   * `'read'` lets `claimsFirst(…, { versions })` judge the token from the
+   * shared version cache. Defaults to `'read'` for `GET`, `HEAD` and `OPTIONS`
+   * and `'write'` for every other method. `undefined` keeps the default; a
+   * throw or any other value is `'write'`.
+   */
+  readonly intent?: (request: Request) => Intent | undefined;
+  /**
+   * The `adapter` label on decision events, revocations and approvals. Defaults
+   * to `server`.
+   */
   readonly adapter?: string;
 };
-/** What `deniedResponse` receives: the refusal and the default Problem Details for it. */
+/**
+ * What `deniedResponse` receives: the refusal and the default Problem Details
+ * for it.
+ */
 type DeniedResponseEvent = {
   readonly decision: Exclude<Decision, {
     readonly outcome: "granted";
@@ -147,10 +175,13 @@ type DeniedResponseEvent = {
   readonly problem: ProblemDetails;
   readonly request: Request | undefined;
 };
-/** Returns Problem Details with extra members, a `Response`, or nothing for the default. */
+/**
+ * Returns Problem Details with extra members, a `Response`, or nothing for the
+ * default.
+ */
 type DeniedResponse = (event: DeniedResponseEvent) => ProblemDetails | Response | undefined | Promise<ProblemDetails | Response | undefined>;
 type OperationScopes = {
-  oauthScopesForRequest(method: string, path: string): readonly string[] | undefined;
+  oauthScopesForRequest: (method: string, path: string) => readonly string[] | undefined;
 };
 type Guard<T = unknown, V extends PolicyVocabulary = PolicyVocabulary> = {
   readonly ok: true;
@@ -162,7 +193,10 @@ type Guard<T = unknown, V extends PolicyVocabulary = PolicyVocabulary> = {
 } | {
   readonly ok: false;
   readonly response: Response;
-  /** The refusal behind `response`; absent for a missing row or a bad signature. */
+  /**
+   * The refusal behind `response`; absent for a missing row or a bad
+   * signature.
+   */
   readonly decision?: Exclude<Decision, {
     readonly outcome: "granted";
   }>;
@@ -179,15 +213,18 @@ type ScopeGuard<T = unknown, V extends PolicyVocabulary = PolicyVocabulary> = {
 } | {
   readonly ok: false;
   readonly response: Response;
-  /** The refusal behind `response`; absent for a missing row or a bad signature. */
+  /**
+   * The refusal behind `response`; absent for a missing row or a bad
+   * signature.
+   */
   readonly decision?: Exclude<Decision, {
     readonly outcome: "granted";
   }>;
 };
 type Loader<T> = (request: Request) => T | null | undefined | Promise<T | null | undefined>;
 /**
- * `protect(permission, data?, options?)`, or `protect(null, data?,
- * { oauthScopes })` for a route that needs a signed-in principal and, from a
+ * `protect(permission, data?, options?)`, or `protect(null, data?, {
+ * oauthScopes })` for a route that needs a signed-in principal and, from a
  * delegated token, one of the OAuth scopes it declares, but no permission.
  */
 type Protect<V extends PolicyVocabulary = PolicyVocabulary, TArgs extends unknown[] = []> = {
@@ -204,9 +241,9 @@ type OpenApiHooks = {
 };
 type ProtectOptions = {
   /**
-   * `true` when `data` returns a row the server loaded itself, to skip
-   * schema validation. Anything else is validated against the resource
-   * schema before the check.
+   * `true` when `data` returns a row the server loaded itself, to skip schema
+   * validation. Anything else is validated against the resource schema before
+   * the check.
    */
   readonly trusted?: boolean;
   /**
@@ -221,7 +258,10 @@ type ProtectOptions = {
   readonly explain?: boolean;
 };
 type SnapshotQuery = {
-  /** The active tenant; defaults to the `tenant` option resolved from the request. */
+  /**
+   * The active tenant; defaults to the `tenant` option resolved from the
+   * request.
+   */
   readonly tenant?: string;
   readonly include?: SnapshotOptions["include"];
   readonly tenants?: "all";
@@ -234,23 +274,25 @@ type SnapshotQuery = {
 type ServerPermDock<V extends PolicyVocabulary = PolicyVocabulary> = {
   readonly getPermDock: (request: Request, scope?: TenantScope) => Promise<PermDock<V>>;
   /**
-   * The JSON snapshot for a loader (React Router, TanStack Start, SvelteKit, Nuxt), built from the
-   * request's cached subject. Send it with `snapshotHeaders(snapshot)`.
+   * The JSON snapshot for a loader (React Router, TanStack Start, SvelteKit,
+   * Nuxt), built from the request's cached subject. Send it with
+   * `snapshotHeaders(snapshot)`.
    */
   readonly getSnapshot: (request: Request, query?: SnapshotQuery) => Promise<Snapshot>;
   readonly protect: Protect<V, [scope?: TenantScope]>;
   /**
    * `protect` against an instance the adapter already holds, such as a gateway
-   * connection's: the same OAuth scope check, loader, decision and approval resume.
-   * A method, so a `ServerPermDock<V>` stays assignable to `ServerPermDock`.
+   * connection's: the same OAuth scope check, loader, decision and approval
+   * resume. A method, so a `ServerPermDock<V>` stays assignable to
+   * `ServerPermDock`.
    */
   protectOn<T = unknown>(instance: PermDock<V>, permission: Permission | null, data?: () => T | null | undefined | Promise<T | null | undefined>, protectOptions?: ProtectOptions, request?: Request): Promise<Guard<T, V> | ScopeGuard<T, V>>;
   /** A long-lived connection for a stream or socket opened by `request`. */
   readonly connection: <T = unknown>(request: Request, options?: ConnectionOptions<T>, scope?: TenantScope) => Promise<Connection>;
   /**
    * Lets `to`, a second `Request` an adapter built for the same incoming
-   * request (to re-read a body a parser consumed), reuse the subject and
-   * actor already resolved for `from`.
+   * request (to re-read a body a parser consumed), reuse the subject and actor
+   * already resolved for `from`.
    */
   readonly shareSubject: (from: Request, to: Request) => void;
   readonly problem: (decision: Decision, init?: {

package/dist/{sha256-D9ihqmvd.js → sha256-C-4WXKIu.js}

@@ -69,7 +69,8 @@ function rotr(value, bits) {
 	return value >>> bits | value << 32 - bits;
 }
 /**
-* SHA-256 of UTF-8 text. Pure JS so `decide` stays synchronous and WinterTC-safe.
+* SHA-256 of UTF-8 text. Pure JS so `decide` stays synchronous and
+* WinterTC-safe.
 */
 function sha256(message) {
 	const bytes = new TextEncoder().encode(message);
@@ -142,8 +143,8 @@ function sha256(message) {
 	return out;
 }
 /**
-* The one digest notation: `sha-256:` plus the unpadded base64url SHA-256
-* of `text`. An RFC 9651 sf-token, so it fits a structured header as is.
+* The one digest notation: `sha-256:` plus the unpadded base64url SHA-256 of
+* `text`. An RFC 9651 sf-token, so it fits a structured header as is.
 */
 function sha256Digest(text) {
 	return `sha-256:${bytesToBase64Url(sha256(text))}`;

package/dist/{shared-fMKOv8hP.js → shared-Afctg7B0.js}

@@ -1,11 +1,15 @@
 import { r as isRecord } from "./compact-CAf557ZB.js";
-import { n as isForbiddenKey } from "./paths-DXSHAMIa.js";
-import { t as byCodePoint } from "./compare-pfyVnBjE.js";
-import { i as configError } from "./errors-DpP_U6Bf.js";
-import { a as quoteQualifiedTable, c as quoteSqlTable, o as quoteSqlIdent, s as quoteSqlLiteral, t as SQL_IDENT } from "./sql-B96movIM.js";
-import "./sources-B-zYB4GS.js";
+import { n as isForbiddenKey } from "./paths-CUvURzHp.js";
+import { t as byCodePoint } from "./compare-DTfyUunF.js";
+import { i as configError } from "./errors-Vpu6rKHl.js";
+import { a as quoteQualifiedTable, c as quoteSqlTable, o as quoteSqlIdent, s as quoteSqlLiteral, t as SQL_IDENT } from "./sql-0WjxIp9g.js";
+import { t as byScope } from "./compile-EzEMB-7v.js";
+import "./sources-CMAM-2A3.js";
 //#region src/cli/sql/columns.ts
-/** The Postgres type a JSON Schema property compares as; `undefined` for text or an unknown shape. */
+/**
+* The Postgres type a JSON Schema property compares as; `undefined` for text or
+* an unknown shape.
+*/
 function columnTypeOf(property) {
 	if (!isRecord(property)) return;
 	const variants = [property["anyOf"], property["oneOf"]].find(Array.isArray);
@@ -67,14 +71,21 @@ function sqlType(name) {
 function tenantTypeOf(ctx) {
 	return sqlType(ctx.tenantType ?? "uuid");
 }
-function teamTypeOf(ctx) {
-	return sqlType(ctx.teamType ?? ctx.tenantType ?? "uuid");
-}
-/** Postgres type of scope `name`'s id: `scopeTypes`, then the tenant / team type by position. */
+/**
+* Postgres type of scope `name`'s id: `scopeTypes` by name or by its `tenant` /
+* `team` alias, then the tenant type.
+*/
 function scopeTypeOf(ctx, name) {
-	const declared = ctx.scopeTypes?.[name];
-	if (declared !== void 0) return sqlType(declared);
-	return name === ctx.scopes[1]?.name ? teamTypeOf(ctx) : tenantTypeOf(ctx);
+	const declared = byScope(ctx.scopeTypes, ctx.scopes, name);
+	return declared === void 0 ? tenantTypeOf(ctx) : sqlType(declared);
+}
+/**
+* The tenant type `rls.scopeTypes` gives the first scope, else `uuid`: the type
+* the tenant claim and the custom-role tenant arguments are cast to.
+*/
+function firstScopeType(scopeTypes, scopes) {
+	const first = scopes[0]?.name;
+	return (first === void 0 ? void 0 : byScope(scopeTypes, scopes, first)) ?? scopeTypes?.["tenant"] ?? "uuid";
 }
 //#endregion
 //#region src/cli/sql/quote.ts
@@ -102,10 +113,10 @@ function declaredArray(values) {
 	return values.length === 0 ? `'{}'::text[]` : `array[${values.map(quoteLiteral).join(", ")}]::text[]`;
 }
 /**
-* A text array as a Postgres literal (`'{admin,owner}'`). An element that
-* holds a delimiter, a brace, a quote, a backslash, whitespace, or that
-* reads as `NULL`, is double-quoted and escaped, so one element can never
-* split into several.
+* A text array as a Postgres literal (`'{admin,owner}'`). An element that holds
+* a delimiter, a brace, a quote, a backslash, whitespace, or that reads as
+* `NULL`, is double-quoted and escaped, so one element can never split into
+* several.
 */
 function textArrayLiteral(values) {
 	return quoteLiteral(`{${values.map((value) => value === "" || /[\s,{}"\\]/u.test(value) || /^null$/iu.test(value) ? `"${value.replaceAll("\\", "\\\\").replaceAll("\"", "\\\"")}"` : value).join(",")}}`);
@@ -118,21 +129,21 @@ function parseMembershipsFlag(raw) {
 	const colon = raw.indexOf(":");
 	const table = colon === -1 ? raw : raw.slice(0, colon);
 	const cols = (colon === -1 ? "" : raw.slice(colon + 1)).split(",").map((item) => item.trim()).filter((item) => item !== "");
-	return { tenant: {
+	return { scopes: { tenant: {
 		table,
-		tenant: cols[0] ?? "tenant_id",
+		columns: { tenant: cols[0] ?? "tenant_id" },
 		user: cols[1] ?? "user_id",
 		role: cols[2] ?? "role",
 		...cols[3] === void 0 ? {} : { expiresAt: cols[3] }
-	} };
+	} } };
 }
 //#endregion
 //#region src/cli/sql/subject.ts
 /**
-* A role with `for` counts only on a membership of one of those kinds:
-* `case role when 'admin' then via = any(...) ... else true end`. A missing
-* kind (`viaExpr` null) holds none of them. A constant kind folds into the
-* roles it excludes, or no filter. `undefined` when nothing is filtered.
+* A role with `for` counts only on a membership of one of those kinds: `case
+* role when 'admin' then via = any(...) ... else true end`. A missing kind
+* (`viaExpr` null) holds none of them. A constant kind folds into the roles it
+* excludes, or no filter. `undefined` when nothing is filtered.
 */
 function kindFilterSql(ctx, roleExpr, viaExpr) {
 	const kinds = Object.entries(ctx.ownership?.kinds ?? {}).toSorted(([a], [b]) => byCodePoint(a, b));
@@ -143,7 +154,10 @@ function kindFilterSql(ctx, roleExpr, viaExpr) {
 	}
 	return `case ${roleExpr} ${kinds.map(([role, allowed]) => `when ${quoteLiteral(role)} then coalesce(${viaExpr}, '') = any(array[${allowed.map(quoteLiteral).join(", ")}]::text[])`).join(" ")} else true end`;
 }
-/** The kind check for one known role; `undefined` when it has no `for` or a constant kind it allows. */
+/**
+* The kind check for one known role; `undefined` when it has no `for` or a
+* constant kind it allows.
+*/
 function roleKindSql(ctx, role, viaExpr) {
 	const allowed = ctx.ownership?.kinds[role];
 	if (allowed === void 0) return;
@@ -161,7 +175,10 @@ function keyTenantSql(ctx, tenant) {
 	const named = `nullif(${subjectClaimJsonSql(ctx, keys.claim)} ->> ${quoteLiteral(keys.tenant)}, '')`;
 	return tenant === void 0 ? `${named} is null` : `(${named} is null or (${tenant})::text = ${named})`;
 }
-/** The active-tenant claim cast to the tenant column's type, so the comparison uses the column's index. */
+/**
+* The active-tenant claim cast to the tenant column's type, so the comparison
+* uses the column's index.
+*/
 function tenantClaimSql(ctx) {
 	return `${subjectClaimSql(ctx, ctx.tenantClaim)}::${tenantTypeOf(ctx)}`;
 }
@@ -170,7 +187,10 @@ function userIdHelperSql(ctx) {
 	return qualified(ctx, USER_ID_HELPER);
 }
 const SESSION_LIVE_HELPER = "permdock_session_live";
-/** `{ subject: { session: { live: true } } }` in a policy; only Supabase has `auth.sessions`. */
+/**
+* `{ subject: { session: { live: true } } }` in a policy; only Supabase has
+* `auth.sessions`.
+*/
 function liveSessionSql(ctx) {
 	if (ctx.dialect !== "supabase") throw configError(`PermDock CLI: { subject: { session: { live: true } } } reads auth.sessions, which only the supabase dialect has (got ${ctx.dialect})`);
 	return `(select ${qualified(ctx, SESSION_LIVE_HELPER)}())`;
@@ -245,7 +265,10 @@ function subjectClaimJsonSql(ctx, claim) {
 function viaAllowed(value, allowed) {
 	return allowed.includes(value ?? "");
 }
-/** The membership kind of a row `m` of `table`: its column as text, or its constant (`null` without one). */
+/**
+* The membership kind of a row `m` of `table`: its column as text, or its
+* constant (`null` without one).
+*/
 function memberVia(table) {
 	const via = table.via;
 	if (via === void 0) return { value: null };
@@ -267,7 +290,10 @@ const HELPERS = {
 	has: "permdock_has",
 	hasFor: "permdock_has_for"
 };
-/** Objects `--custom-roles` adds next to the helpers. Names are part of the SQL contract. */
+/**
+* Objects `--custom-roles` adds next to the helpers. Names are part of the SQL
+* contract.
+*/
 const CUSTOM_ROLES = {
 	permissions: "custom_role_permissions",
 	includes: "custom_role_includes",
@@ -275,6 +301,7 @@ const CUSTOM_ROLES = {
 	keys: "permdock_custom_keys",
 	beyond: "permdock_custom_role_beyond",
 	guard: "permdock_custom_role_guard",
+	syncGuard: "permdock_sync_custom_role_guard",
 	beyondFor: "permdock_custom_role_beyond_for",
 	guardFor: "permdock_custom_role_guard_for",
 	shape: "permdock_custom_role_shape",
@@ -296,16 +323,22 @@ const CUSTOM_ROLES = {
 };
 /** The function `rls.roles` adds. The name is part of the SQL contract. */
 const GLOBAL_ROLES = { replace: "permdock_replace_global_roles" };
-/** `user` is the SQL for the user id: the dialect's (the default) or the `p_user` parameter of a `_for` helper. */
+/**
+* `user` is the SQL for the user id: the dialect's (the default) or the
+* `p_user` parameter of a `_for` helper.
+*/
 function signedIn(ctx, user = subjectIdSql(ctx)) {
 	return `coalesce(${user}::text, '') <> ''`;
 }
 function rootName(ctx) {
 	return ctx.scopes[0]?.name ?? "tenant";
 }
-/** The stored allow as `permissions` hands it to `permdock_custom_keys`: `key`, or `key@level` with levels. */
+/**
+* The stored allow as `permissions` hands it to `permdock_custom_keys`: `key`,
+* or `key@level` with levels.
+*/
 function allowEntry(ctx) {
 	return ctx.customRoles?.levels === true ? "permission || coalesce('@' || c.level, '')" : "permission";
 }
 //#endregion
-export { quoteQualified as A, parseMembershipsFlag as C, qualified as D, helperSchema as E, scopeTypeOf as F, sqlType as I, tenantTypeOf as L, textArrayLiteral as M, arrayColumnsOf as N, quoteIdent as O, columnTypesOf as P, CLAIM as S, declaredArray as T, subjectClaimJsonSql as _, customRolesOn as a, tenantClaimSql as b, SESSION_LIVE_HELPER as c, keyTenantSql as d, kindFilterSql as f, sessionLiveHelperSql as g, roleKindSql as h, allowEntry as i, quoteTable as j, quoteLiteral as k, USER_ID_HELPER as l, memberVia as m, GLOBAL_ROLES as n, rootName as o, liveSessionSql as p, HELPERS as r, signedIn as s, CUSTOM_ROLES as t, globalKindFilterSql as u, subjectClaimSql as v, CLI as w, userIdHelperSql as x, subjectIdSql as y };
+export { quoteQualified as A, parseMembershipsFlag as C, qualified as D, helperSchema as E, firstScopeType as F, scopeTypeOf as I, sqlType as L, textArrayLiteral as M, arrayColumnsOf as N, quoteIdent as O, columnTypesOf as P, tenantTypeOf as R, CLAIM as S, declaredArray as T, subjectClaimJsonSql as _, customRolesOn as a, tenantClaimSql as b, SESSION_LIVE_HELPER as c, keyTenantSql as d, kindFilterSql as f, sessionLiveHelperSql as g, roleKindSql as h, allowEntry as i, quoteTable as j, quoteLiteral as k, USER_ID_HELPER as l, memberVia as m, GLOBAL_ROLES as n, rootName as o, liveSessionSql as p, HELPERS as r, signedIn as s, CUSTOM_ROLES as t, globalKindFilterSql as u, subjectClaimSql as v, CLI as w, userIdHelperSql as x, subjectIdSql as y };

package/dist/{shared-C8LjUdVU.js → shared-l0oGGetg.js}

@@ -1,9 +1,12 @@
-import { a as durationOf, f as nowMillis } from "./time-DkWjdL98.js";
-import { t as decisionToken } from "./token-2qYDvXz2.js";
+import { a as durationOf, f as nowMillis } from "./time-nR1JesoH.js";
+import { t as decisionToken } from "./token-DC9EQiet.js";
 //#region src/pdp/shared.ts
 const MAX_CACHE_TTL = 30;
 const CACHE_MAX = 1e3;
-/** Milliseconds from `ttl` seconds, clamped to 30 s; a `ttl` that is not a whole number of seconds above 0 disables the cache. */
+/**
+* Milliseconds from `ttl` seconds, clamped to 30 s; a `ttl` that is not a whole
+* number of seconds above 0 disables the cache.
+*/
 function ttlMs(cache) {
 	const ttl = durationOf(cache?.ttl);
 	return ttl === void 0 ? 0 : Math.min(ttl, MAX_CACHE_TTL) * 1e3;
@@ -48,9 +51,9 @@ function granted(provider, permission, subject, data) {
 	};
 }
 /**
-* The request that would be sent, plus what a custom mapping may drop
-* (issuer, tenant, actor): a tenant switch or a changed row never reuses a
-* cached answer.
+* The request that would be sent, plus what a custom mapping may drop (issuer,
+* tenant, actor): a tenant switch or a changed row never reuses a cached
+* answer.
 */
 function cacheKey(subject, permission, body) {
 	return JSON.stringify([

package/dist/{signals-D3NcTKUS.js → signals-B1vHR3fN.js}

@@ -6,8 +6,8 @@ const EXIT_CODES = {
 /** How long a signalled run may take to clean up before the process exits. */
 const GRACE_MS = 2e3;
 /**
-* Turns SIGINT and SIGTERM into an aborted signal and the 128 + n exit code.
-* A second signal, or a run still busy after the grace period, exits at once.
+* Turns SIGINT and SIGTERM into an aborted signal and the 128 + n exit code. A
+* second signal, or a run still busy after the grace period, exits at once.
 */
 function trapSignals() {
 	const controller = new AbortController();

package/dist/{sink-Cp_Eot9W.d.ts → sink-B5zoUW_O.d.ts}

@@ -1,7 +1,7 @@
-import { $t as CredentialEvent, Ct as Credential, Qt as AutomationEvent, Xt as AccessEvent, gt as SupportSession, on as MembershipEvent, q as DecisionSink, sn as SinkEvent, ut as TokenSigner } from "./policy-types-B-F-qAZk.js";
-import { O as AppData } from "./permission-types-DhNEmoRG.js";
-import { u as OperationRisk } from "./operations-BNLes61x.js";
-import { t as Automation } from "./automation-DOtAFWdy.js";
+import { J as DecisionSink, St as SupportSession, an as CredentialEvent, fn as MembershipEvent, in as AutomationEvent, kt as Credential, mt as TokenSigner, nn as AccessEvent, pn as SinkEvent } from "./policy-types-DGIO_gxq.js";
+import { M as AppData } from "./permission-types-CAY-GU7e.js";
+import { u as OperationRisk } from "./operations-Ci_rT6Uo.js";
+import { t as Automation } from "./automation-C6Jg75xq.js";
 //#region src/core/sink.d.ts
 /**
  * The closed list of CloudEvents `type` values, `com.permdock.<family>` or
@@ -40,7 +40,10 @@ declare const CLOUD_EVENT_TYPES: {
   readonly deliveryFailed: "com.permdock.delivery.failed";
 };
 type CloudEventType = (typeof CLOUD_EVENT_TYPES)[keyof typeof CLOUD_EVENT_TYPES];
-/** Types named for a later release; a receiver refuses them until then. None are reserved now. */
+/**
+ * Types named for a later release; a receiver refuses them until then. None are
+ * reserved now.
+ */
 declare const RESERVED_CLOUD_EVENT_TYPES: readonly CloudEventType[];
 /** The CloudEvents JSON format media type for one event (structured mode). */
 declare const CLOUDEVENTS_CONTENT_TYPE = "application/cloudevents+json";
@@ -51,27 +54,42 @@ declare const CLOUDEVENTS_BATCH_CONTENT_TYPE = "application/cloudevents-batch+js
  * which the Cloud then suspends; the `operation-*` codes only report.
  */
 type CatalogFindingCode = "permission-removed" | "not-hostable" | "grantee-removed" | "approval-tightened" | "operation-risk-raised" | "operation-approval-removed";
-/** One drift finding: the permission key and, when one broke, the hosted grant id. */
+/**
+ * One drift finding: the permission key and, when one broke, the hosted grant
+ * id.
+ */
 type CatalogFinding = {
   readonly code: CatalogFindingCode;
   readonly permission: string;
   readonly grant?: string;
   /** The operation name, on the `operation-*` codes. */
   readonly operation?: string;
-  /** `meta.risk` before the publish, on `operation-risk-raised`; an unset risk is `low`. */
+  /**
+   * `meta.risk` before the publish, on `operation-risk-raised`; an unset risk
+   * is `low`.
+   */
   readonly previous?: OperationRisk;
   /** `meta.risk` after the publish, on `operation-risk-raised`. */
   readonly risk?: OperationRisk;
 };
-/** `data` of a `com.permdock.catalog.*` event: a `permdock cloud push` or a drift against live hosted grants. */
+/**
+ * `data` of a `com.permdock.catalog.*` event: a `permdock cloud push` or a
+ * drift against live hosted grants.
+ */
 type CatalogEventData = {
   readonly kind: "publish" | "drift";
-  /** The catalog fingerprint after the publish, or the one drift was measured against. */
+  /**
+   * The catalog fingerprint after the publish, or the one drift was measured
+   * against.
+   */
   readonly fingerprint: string;
   readonly previous?: string;
   readonly findings?: readonly CatalogFinding[];
 };
-/** A CloudEvents 1.0 event in the JSON format, with the distributed-tracing extension. */
+/**
+ * A CloudEvents 1.0 event in the JSON format, with the distributed-tracing
+ * extension.
+ */
 type CloudEvent = {
   readonly specversion: "1.0";
   readonly type: CloudEventType;
@@ -82,9 +100,15 @@ type CloudEvent = {
   /** An RFC 3339 instant: the sink event's `at`. */
   readonly time: string;
   readonly datacontenttype: "application/json";
-  /** The published JSON Schema of `data`, `https://permdock.com/schemas/<family>-event-v1.json`. */
+  /**
+   * The published JSON Schema of `data`,
+   * `https://permdock.com/schemas/<family>-event-v1.json`.
+   */
   readonly dataschema: string;
-  /** W3C Trace Context `traceparent`, the CloudEvents distributed-tracing extension. */
+  /**
+   * W3C Trace Context `traceparent`, the CloudEvents distributed-tracing
+   * extension.
+   */
   readonly traceparent?: string;
   readonly tracestate?: string;
   readonly data: SinkEvent | CatalogEventData;
@@ -141,9 +165,9 @@ declare function automationEvent(input: {
   readonly x?: AppData;
 }): AutomationEvent;
 /**
- * The `access` event of a `SupportSession`: `started` when it begins,
- * `ended` when it lapses, `revoked` when it is ended early. `principal` is
- * the staff member, as for a support membership.
+ * The `access` event of a `SupportSession`: `started` when it begins, `ended`
+ * when it lapses, `revoked` when it is ended early. `principal` is the staff
+ * member, as for a support membership.
  */
 declare function supportSessionEvent(input: {
   readonly operation: AccessEvent["operation"];
@@ -155,8 +179,8 @@ declare function supportSessionEvent(input: {
   readonly x?: AppData;
 }): AccessEvent;
 /**
- * A `credential` sink event for `credential`. `sample` belongs on `used`
- * events only and must be in `(0, 1]`.
+ * A `credential` sink event for `credential`. `sample` belongs on `used` events
+ * only and must be in `(0, 1]`.
  */
 declare function credentialEvent(input: {
   readonly operation: CredentialEvent["operation"];
@@ -215,9 +239,9 @@ declare function accessEvent(input: {
  */
 declare function toCloudEvent(event: SinkEvent, options: CloudEventOptions): CloudEvent;
 /**
- * Signs sink events as an offline evidence export: a compact JWS with
- * `typ: vnd.permdock.evidence+jwt` whose `events` claim holds CloudEvents.
- * Live deliveries use Standard Webhooks instead.
+ * Signs sink events as an offline evidence export: a compact JWS with `typ:
+ * vnd.permdock.evidence+jwt` whose `events` claim holds CloudEvents. Live
+ * deliveries use Standard Webhooks instead.
  */
 declare function signDecisionBatch(events: readonly SinkEvent[], signer: TokenSigner, options: SignDecisionBatchOptions): Promise<string>;
 declare function memoryDecisionSink(options?: MemoryDecisionSinkOptions): MemoryDecisionSink;