permdock 0.8.0 → 0.10.0

package/dist/{rls-CNEH2_BG.js → rls-B57mIeVq.js}

@@ -7,26 +7,26 @@ import { t as policyRowConditionKeys } from "./row-conditions-BAGHOmVq.js";
 import { o as sqlFiles } from "./files-BSjrtIHw.js";
 import { c as requirePolicy } from "./load-DjSU5KXO.js";
 import { i as qualifySqlTable, r as escapeSqlIdent } from "./sql-0WjxIp9g.js";
-import "./sources-CMAM-2A3.js";
-import { t as policyFromCatalog } from "./policy-from-catalog-CJgOm6aq.js";
+import "./sources-C4vkzZJV.js";
+import { t as policyFromCatalog } from "./policy-from-catalog-CU3An8uP.js";
 import { t as beforeFirst } from "./text-BMFRfBqc.js";
 import { i as INDEXES_MARKER, n as GRANTS_MARKER, o as SEEDS_MARKER, t as BACKFILL_MARKER } from "./markers-BeHZ4x9Q.js";
-import { a as nonEmptyOr } from "./output-tkju6U7R.js";
+import { a as nonEmptyOr } from "./output-LsbLe41I.js";
 import { i as requirePeer, n as packageManagerOf, t as addLine } from "./peer-Q0fuZ6hx.js";
 import { t as POLICY_NOT_PUBLISHED } from "./problem-types-DSsRfONQ.js";
-import { t as fetchProjectPolicy } from "./pull-CwpGaQSi.js";
+import { t as fetchProjectPolicy } from "./pull-DQCgvJSC.js";
 import { n as MIGRATION_DIRS } from "./constants-DcJABbLW.js";
 import { a as isSeedsDirectory, c as parseSplit, d as seedsMigration, f as writeOutputFiles, l as partPath, n as dataMigrationFile, r as driftOf, u as pgDeltaPath } from "./output-files-BIQ_9pIs.js";
-import { d as schemasRefusal, f as declarativeSql, l as isSupabaseSchemas, o as supabaseHookSql, s as approvalsSql, t as grantsLabel, u as resolveSchemas, v as parseRbacAuthorize, y as rbacScaffold } from "./supabase-hook-B-yXnzUl.js";
-import { A as quoteQualified, D as qualified$1, I as scopeTypeOf, O as quoteIdent$1, _ as subjectClaimJsonSql, c as SESSION_LIVE_HELPER, g as sessionLiveHelperSql, j as quoteTable, k as quoteLiteral, r as HELPERS, t as CUSTOM_ROLES, y as subjectIdSql } from "./shared-Afctg7B0.js";
-import { C as accessSql, G as byKey, T as seedSql, Z as graphHelper, ct as memberIdsHelper, ft as permittedIdsHelper, ht as scopeTable, mt as scopeSources, r as tableNames, s as graphSql, w as helpersSql, x as permittedByPermissionHelper, y as permissionHelpersSql } from "./tables-DeMNEy6V.js";
-import { c as breakGlassKey, i as assignmentSql, l as collectGrants, n as ownershipSql, s as breakGlassHolder } from "./ownership-B4L59T9u.js";
+import { b as rbacScaffold, d as resolveSchemas, f as schemasRefusal, o as supabaseHookSql, p as declarativeSql, s as approvalsSql, t as grantsLabel, u as isSupabaseSchemas, y as parseRbacAuthorize } from "./supabase-hook-BT2P9wah.js";
+import { A as quoteQualified, D as qualified$1, I as scopeTypeOf, O as quoteIdent$1, _ as subjectClaimJsonSql, c as SESSION_LIVE_HELPER, g as sessionLiveHelperSql, j as quoteTable, k as quoteLiteral, r as HELPERS, t as CUSTOM_ROLES, y as subjectIdSql } from "./shared-DrGLwM3s.js";
+import { C as accessSql, G as byKey, T as seedSql, Z as graphHelper, ct as memberIdsHelper, ft as permittedIdsHelper, ht as scopeTable, mt as scopeSources, r as tableNames, s as graphSql, w as helpersSql, x as permittedByPermissionHelper, y as permissionHelpersSql } from "./tables-DimBcVWY.js";
+import { c as breakGlassKey, i as assignmentSql, l as collectGrants, n as ownershipSql, s as breakGlassHolder } from "./ownership-qqBuGJXr.js";
 import { a as splitUndiffed } from "./deciding-columns-NB4wcyBf.js";
 import { t as connectPgPool } from "./pg-DQTqRrou.js";
-import { n as permissionHoldersSql } from "./resolve-names-CF7xXLSG.js";
-import { a as fieldViewsSql, c as ACTOR_MAY_WRITE, f as readOnlyActorKinds, i as fieldViews, l as actorMayWriteSql, n as columnGrantSql, o as rowBranches, p as readOnlyActorPolicies, r as columnRevokeSql, u as assemblePolicies } from "./fields-D0vUI6dq.js";
-import { _ as indexTargets, a as verifyResult, b as readTableIndexFacts, c as callsHelper, g as INDEX_COLUMNS_SQL, h as COLUMNS_SQL, i as verifyIgnores, l as helperCallKeys, m as tableFor, n as runRlsVerify, o as HELPER_TABLES, p as compileGrants, r as rlsFinding, v as indexesSql, y as pruneIndexTargets } from "./verify-DZeqoWu5.js";
-import { a as generateOptions, c as buildContext, i as rowHelpersSql, l as DROPPED_LIST, n as inheritTargets, o as isRefusal, r as levelKeys, s as splitsPart, t as supautilsRejections, u as rebuildPlan } from "./supautils-BU-pAEpf.js";
+import { a as fieldViewsSql, c as ACTOR_MAY_WRITE, f as readOnlyActorKinds, i as fieldViews, l as actorMayWriteSql, n as columnGrantSql, o as rowBranches, p as readOnlyActorPolicies, r as columnRevokeSql, u as assemblePolicies } from "./fields-DI8s3cPl.js";
+import { n as permissionHoldersSql } from "./resolve-names-Y1Cb22cp.js";
+import { _ as indexTargets, a as verifyResult, b as readTableIndexFacts, c as callsHelper, g as INDEX_COLUMNS_SQL, h as COLUMNS_SQL, i as verifyIgnores, l as helperCallKeys, m as tableFor, n as runRlsVerify, o as HELPER_TABLES, p as compileGrants, r as rlsFinding, v as indexesSql, y as pruneIndexTargets } from "./verify-jHrbmn-E.js";
+import { a as buildContext, c as levelKeys, d as rebuildPlan, i as splitsPart, l as rowHelpersSql, n as generateOptions, o as CANDIDATES, r as isRefusal, s as inheritTargets, t as supautilsRejections, u as DROPPED_LIST } from "./supautils-DBKOoyjn.js";
 import { readFileSync } from "node:fs";
 import { basename, delimiter, join } from "node:path";
 import { spawn } from "node:child_process";
@@ -1409,17 +1409,24 @@ function sectionsSql(input, policy, options, built, generated, jsonSchema, warni
 	if (ctx.assignments !== void 0 && (ownership === void 0 || ownership.assigns.length === 0)) warnings.push("rls.assignments needs a role that declares assigns: no assignment trigger is written");
 	let approvals;
 	try {
-		approvals = approvalsSql(ctx, rls?.approvals, jsonSchema ?? false);
+		approvals = approvalsSql(ctx, rls?.approvals, jsonSchema ?? false, readOnlyActorKinds(rls?.readOnlyActors) !== void 0);
 	} catch (cause) {
 		return { refusal: describeError(cause) };
 	}
 	if (typeof rls?.approvals === "object" && rls.approvals.delegations === true && ctx.authorize !== "database") warnings.push("rls.approvals.delegations with --authorize jwt: permdock_is_approver cannot read a delegator's permissions from the caller's token, so in SQL a cover never satisfies a holder() approver; approvalsHandler still does");
 	const graphed = graphSql(ctx, graph, tableNames(rls?.tables));
 	let rowHelpers = "";
-	if (rls?.rowHelpers !== void 0 || inheritTargets(policy).length > 0) try {
-		rowHelpers = rowHelpersSql(ctx, policy, [...options.fieldsMode === void 0 ? compiled.branches : rowBranches(compiled.branches), ...compiled.actionBranches], rls?.rowHelpers ?? [], tableNames(rls?.tables), warnings);
-	} catch (cause) {
-		return { refusal: describeError(cause) };
+	if (rls?.rowHelpers !== void 0 || inheritTargets(policy).length > 0) {
+		const readable = (grants) => [...options.fieldsMode === void 0 ? grants.branches : rowBranches(grants.branches), ...grants.actionBranches];
+		try {
+			const narrowed = compileGrants(policy, {
+				...ctx,
+				candidates: CANDIDATES
+			}, tableNames(rls?.tables), [], input.skipClosures, true);
+			rowHelpers = rowHelpersSql(ctx, policy, readable(compiled), rls?.rowHelpers ?? [], tableNames(rls?.tables), warnings, readable(narrowed));
+		} catch (cause) {
+			return { refusal: describeError(cause) };
+		}
 	}
 	const breakGlass = breakGlassSql(ctx, breakGlassEntries(policy, tableNames(rls?.tables)));
 	return [
@@ -2225,6 +2232,13 @@ const WRITES = [
 	"delete"
 ];
 /**
+* `rls generate` inlines the check in its `<table>_<command>_read_only_actors`
+* policies.
+*/
+function inlinesActorCheck(expression) {
+	return expression.includes("'act'") && expression.includes("'read_only'");
+}
+/**
 * Each table and write command whose permissive policies reach `authenticated`
 * (or `public`) without the read-only actor check: no restrictive policy for
 * the command calls `permdock_actor_may_write()`, and some permissive one does
@@ -2238,7 +2252,7 @@ function unguardedWrites(policies, fn) {
 		const permissive = applying.filter((policy) => policy.restrictive !== true && (policy.roles ?? []).some((role) => role === "authenticated" || role === "public"));
 		if (permissive.length === 0) continue;
 		const calls = (expression) => expression.includes(fn);
-		if (!(applying.some((policy) => policy.restrictive === true && calls(policy.expression)) || permissive.every((policy) => calls(policy.expression)))) out.push(rlsFinding("write-unguarded", table, command, `${table}: ${command} policies for authenticated do not call ${fn}(), so a read-only support or impersonation session can write (rls.readOnlyActors)`));
+		if (!(applying.some((policy) => policy.restrictive === true && (calls(policy.expression) || inlinesActorCheck(policy.expression))) || permissive.every((policy) => calls(policy.expression)))) out.push(rlsFinding("write-unguarded", table, command, `${table}: ${command} policies for authenticated do not call ${fn}(), so a read-only support or impersonation session can write (rls.readOnlyActors)`));
 	}
 	return out;
 }
@@ -2467,7 +2481,7 @@ async function migrate(input) {
 		output: generated.output
 	};
 	await requirePeer(() => import("pgsql-parser"), "pgsql-parser", "permdock rls migrate", input.cwd, PGSQL_PARSER_MAJOR);
-	const { migrateTarget, runRlsMigrate } = await import("./migrate-B7oP_sQU.js");
+	const { migrateTarget, runRlsMigrate } = await import("./migrate-BJHxQqT5.js");
 	return runRlsMigrate({
 		cwd: input.cwd,
 		sql: input.sql,
@@ -2583,7 +2597,7 @@ async function runRls(input) {
 		}
 		case "import": {
 			await requirePeer(() => import("pgsql-parser"), "pgsql-parser", "permdock rls import", input.cwd, PGSQL_PARSER_MAJOR);
-			const { runRlsImport } = await import("./import-CST57XLp.js");
+			const { runRlsImport } = await import("./import-CNBF96hB.js");
 			return runRlsImport({
 				cwd: input.cwd,
 				config: input.config,

package/dist/{rls-Ca8Jz9b5.js → rls-j0YrFPpW.js}

@@ -192,7 +192,7 @@ async function rlsInput(ctx, verb, shape, options) {
 	};
 }
 async function runRls(input) {
-	return (await import("./rls-CNEH2_BG.js")).runRls(input);
+	return (await import("./rls-B57mIeVq.js")).runRls(input);
 }
 const generate = defineLeaf({
 	flags: {

package/dist/{rpc-fNqAIqQk.js → rpc-vHIwyXCp.js}

@@ -1,7 +1,7 @@
 import { t as compact } from "./compact-CAf557ZB.js";
 import { s as requestFromContext } from "./http-DKLXrFGk.js";
 import { n as tenantScope } from "./adapter-context-CIQpQxbE.js";
-import { t as adapterKernel } from "./bind-D_sZSVA3.js";
+import { t as adapterKernel } from "./bind-BNQA9JK9.js";
 import { r as guardIterable } from "./stream-CDvF0sJm.js";
 //#region src/server/rpc.ts
 /** The tRPC and oRPC error code for a Problem Details status. */

package/dist/run-BATawNVH.js

@@ -0,0 +1 @@
+export { t as run } from "./run-CLP_fQUF.js";

package/dist/{run-Bz26OTfO.js → run-CLP_fQUF.js}

@@ -1,13 +1,13 @@
 import { i as dateAt } from "./time-nR1JesoH.js";
 import { a as describeError, l as problemOf, n as CliError, r as cliProblem, s as kindOfCode } from "./errors-Vpu6rKHl.js";
 import { s as cliVersion } from "./version-DMQ0dnN5.js";
-import { a as resolveCwd, i as readConfig } from "./config-BwPBfN0t.js";
+import { a as resolveCwd, i as readConfig } from "./config-BR23fL8m.js";
 import { t as beforeFirst } from "./text-BMFRfBqc.js";
 import { a as suggestion, i as parseLeaf, n as flagSpellings, o as GLOBAL_FLAGS, r as parseFlags } from "./args-0FrVs5EH.js";
 import { r as progressReporter, t as redact } from "./credentials-CdDxp7jN.js";
-import { a as resolve, i as leaves, n as ROOT, r as SECTIONS, t as DOCS_BASE } from "./manifest-Cgiq5oqc.js";
+import { a as resolve, i as leaves, n as ROOT, r as SECTIONS, t as DOCS_BASE } from "./manifest-B4ENCp2I.js";
 import { t as createStyle } from "./style-Ds11Hmk4.js";
-import { i as githubAnnotations, n as envelope, o as sarifLog, t as dataOf } from "./output-tkju6U7R.js";
+import { i as githubAnnotations, n as envelope, o as sarifLog, t as dataOf } from "./output-LsbLe41I.js";
 import { i as renameMessage, r as flagRename, t as COMMAND_MOVES } from "./renames-CGj7YwcQ.js";
 import { stripVTControlCharacters } from "node:util";
 import { existsSync, statSync } from "node:fs";

package/dist/{run-ticket-Dv7aF7Dk.js → run-ticket-DfnZCh-u.js}

@@ -26,7 +26,8 @@ const RUN_TICKET_CLAIMS = Object.freeze([
 	"automation",
 	"tenant",
 	"trigger",
-	"binding"
+	"binding",
+	"resource"
 ]);
 const RUN_KINDS = [
 	"automation",
@@ -97,6 +98,14 @@ function parseAutomation(value) {
 		version: record["version"]
 	};
 }
+function parseResource(value) {
+	const record = ownRecord(value);
+	if (record === void 0 || !isId(record["type"]) || !isId(record["id"])) return;
+	return {
+		type: record["type"],
+		id: record["id"]
+	};
+}
 function parseBinding(value) {
 	const record = ownRecord(value);
 	if (record === void 0) return;
@@ -140,7 +149,8 @@ function parseBody(record) {
 	const automation = optional(record, "automation", parseAutomation);
 	const trigger = optional(record, "trigger", parseTrigger);
 	const binding = optional(record, "binding", parseBinding);
-	if (!act.ok || !details.ok || !automation.ok || !trigger.ok || !binding.ok || scope === void 0 && details.value === void 0 || kind === "automation" !== (automation.value !== void 0)) return;
+	const resource = optional(record, "resource", parseResource);
+	if (!act.ok || !details.ok || !automation.ok || !trigger.ok || !binding.ok || !resource.ok || scope === void 0 && details.value === void 0 || kind === "automation" !== (automation.value !== void 0)) return;
 	return compact({
 		v: 1,
 		sub,
@@ -151,7 +161,8 @@ function parseBody(record) {
 		automation: automation.value,
 		tenant,
 		trigger: trigger.value,
-		binding: binding.value
+		binding: binding.value,
+		resource: resource.value
 	});
 }
 /**
@@ -218,9 +229,10 @@ function signRunTicket(input, signer, options = {}) {
 		automation: input.automation,
 		tenant: input.tenant,
 		trigger: input.trigger,
-		binding: input.binding
+		binding: input.binding,
+		resource: input.resource
 	}));
-	if (body === void 0) invalid("is invalid: check principal, kind, automation, delegation, trigger and binding");
+	if (body === void 0) invalid("is invalid: check principal, kind, automation, delegation, trigger, binding and resource");
 	if (input.id !== void 0 && !isId(input.id)) invalid("id must be a non-empty string");
 	return signer.sign(body, compact({
 		typ: RUN_TICKET_TYP,
@@ -338,7 +350,8 @@ async function subjectFromRunTicket(token, options) {
 		id: ticket.jti,
 		kind: ticket.kind,
 		automation: ticket.automation,
-		binding: ticket.binding
+		binding: ticket.binding,
+		resource: ticket.resource
 	});
 	return Object.freeze(compact({
 		principal: Object.freeze({

package/dist/{run-ticket-DbWI9f99.d.ts → run-ticket-ylovhyFQ.d.ts}

@@ -1,5 +1,5 @@
-import { $n as AuthorizationDetail, Rt as Instant, Zn as Actor, Zt as AuthEvent, dt as TokenVerifier, lr as Subject, lt as TokenFailureCause, rr as Delegation, sr as Principal, ut as TokenSigner } from "./policy-types-CCiDRZBH.js";
-import { _ as PrincipalSource } from "./permdock-B6Sf4T_S.js";
+import { Wt as Instant, ar as AuthorizationDetail, hr as Subject, ht as TokenVerifier, lr as Delegation, mt as TokenSigner, pr as Principal, pt as TokenFailureCause, rn as AuthEvent, rr as Actor } from "./policy-types-DGIO_gxq.js";
+import { _ as PrincipalSource } from "./permdock-CprAPN3w.js";
 //#region src/server/run-ticket.d.ts
 /**
  * What started the run: a saved automation, a background job, or a caller's own
@@ -24,6 +24,14 @@ type RunAutomation = {
   readonly id: string;
   readonly version: number | string;
 };
+/**
+ * The record a run is bound to. `authorization_details` carries the binding as
+ * `identifier`; this claim names it for the adapter and the audit trail.
+ */
+type RunResource = {
+  readonly type: string;
+  readonly id: string;
+};
 /**
  * The v1 claims of a `vnd.permdock.run+jwt`. At least one of `scope` and
  * `authorization_details` is present.
@@ -49,6 +57,7 @@ type RunTicket = {
    */
   readonly trigger?: Readonly<Record<string, unknown>>;
   readonly binding?: RunBinding;
+  readonly resource?: RunResource;
 };
 /**
  * Every v1 claim of a `vnd.permdock.run+jwt`, the set `parseRunTicket` keeps. A
@@ -70,6 +79,11 @@ type RunTicketInput = {
   readonly tenant?: string;
   readonly trigger?: Readonly<Record<string, unknown>>;
   readonly binding?: RunBinding;
+  /**
+   * The record the run is bound to. Narrow `delegation` to it with an
+   * `authorization_details` `identifier`; this claim grants nothing.
+   */
+  readonly resource?: RunResource;
   /** `jti`; a fresh UUID when absent. */
   readonly id?: string;
   /** Lifetime in whole seconds. Exactly one of `expiresIn` and `expiresAt`. */
@@ -113,6 +127,7 @@ type RunContext = {
   readonly kind: RunKind;
   readonly automation?: RunAutomation;
   readonly binding?: RunBinding;
+  readonly resource?: RunResource;
 };
 /** The principal of a run subject, with the verified ticket attached. */
 type RunPrincipal = Principal & {
@@ -141,4 +156,4 @@ declare function signRunTicket(input: RunTicketInput, signer: TokenSigner, optio
  */
 declare function subjectFromRunTicket(token: string | undefined | null, options: RunTicketSubjectOptions): Promise<Subject<RunPrincipal>>;
 //#endregion
-export { RunContext as a, RunTicket as c, RunTicketInput as d, RunTicketOptions as f, subjectFromRunTicket as g, signRunTicket as h, RunBinding as i, RunTicketAutomations as l, parseRunTicket as m, RunActClaim as n, RunKind as o, RunTicketSubjectOptions as p, RunAutomation as r, RunPrincipal as s, RUN_TICKET_CLAIMS as t, RunTicketFailureCause as u };
+export { subjectFromRunTicket as _, RunContext as a, RunResource as c, RunTicketFailureCause as d, RunTicketInput as f, signRunTicket as g, parseRunTicket as h, RunBinding as i, RunTicket as l, RunTicketSubjectOptions as m, RunActClaim as n, RunKind as o, RunTicketOptions as p, RunAutomation as r, RunPrincipal as s, RUN_TICKET_CLAIMS as t, RunTicketAutomations as u };

package/dist/{saas-iWnUdwCt.js → saas-DK4V-3Is.js}

@@ -1,12 +1,12 @@
 import { r as isRecord } from "./compact-CAf557ZB.js";
 import { i as principal } from "./refs-C8BKxc_e.js";
 import { a as deny, n as role, r as allow } from "./role-builder-BK2-T6oD.js";
-import { A as memoryCustomRoleSource, S as memoryLimitStore, b as memoryRelationSource, x as limits } from "./src-DZ0l9UAg.js";
+import { C as memoryLimitStore, S as limits, j as memoryCustomRoleSource, x as memoryRelationSource } from "./src-C_pi2Rnh.js";
 import { h as secondsAt } from "./time-nR1JesoH.js";
 import { l as relation, n as anyone } from "./grantee-Dke-9rd1.js";
 import { r as definePolicy } from "./policy-CLQ8__GF.js";
 import { s as quoteSqlLiteral } from "./sql-0WjxIp9g.js";
-import { a as saasPlans, i as saasPermissions, o as saasRoles } from "./permissions-mDcTWoBs.js";
+import { a as saasPlans, i as saasPermissions, o as saasRoles } from "./permissions-CYcHj_w7.js";
 //#region src/testing/saas/policy.ts
 function isSubject(user) {
 	return user !== null && "context" in user && "principal" in user;

package/dist/{scan-DCj1KQfn.js → scan-B7xrAvRm.js}

@@ -16,7 +16,7 @@ const scan = defineLeaf({
 		}
 	},
 	async run(ctx, { flags }) {
-		const { runAdoptionScan } = await import("./adoption-scan-BLs67P1l.js");
+		const { runAdoptionScan } = await import("./adoption-scan-0oFt2RD5.js");
 		return runAdoptionScan({
 			cwd: ctx.cwd,
 			srcPath: flags.src.length > 0 ? flags.src : ctx.config.collect?.srcPath ?? ["src"],

package/dist/{schema-Dst9I9Gs.js → schema-3PJ8wAeL.js}

@@ -1,7 +1,7 @@
 import { r as isRecord } from "./compact-CAf557ZB.js";
 import { l as packageRoot } from "./version-DMQ0dnN5.js";
 import { t as DRAFT_PINS } from "./pins-nqarl3oE.js";
-import { a as nonEmptyOr } from "./output-tkju6U7R.js";
+import { a as nonEmptyOr } from "./output-LsbLe41I.js";
 import { t as require__2020 } from "./2020-CJbO8Bvz.js";
 import { readFileSync } from "node:fs";
 import { join } from "node:path";

package/dist/scim/index.d.ts

@@ -1,3 +1,3 @@
 import { t as SqlQuery } from "../sql-B80DFdpG.js";
-import { A as ScimFilter, C as DirectoryUser, D as PATCH_SCHEMA, E as LIST_SCHEMA, F as ScimTokenOptions, I as USER_SCHEMA, L as isDirectoryNotFoundError, M as ScimPage, N as ScimPageResult, O as ROLES_EXTENSION, P as ScimPatchOp, R as isDirectoryUniquenessError, S as DirectoryUniquenessError, T as GROUP_SCHEMA, _ as DirectoryChange, a as normalizePatchOps, b as DirectoryNotFoundError, c as filterSupported, d as resourceTypes, f as schemas, g as APP_DATA_EXTENSION, h as sha256Hex, i as directoryMembershipSource, j as ScimHandlerOptions, k as SCIM_CONTENT_TYPE, l as matchFilter, m as authenticateScim, n as postgresDirectoryStore, o as tenantFromPath, p as serviceProviderConfig, r as memoryDirectoryStore, s as scimHandler, t as PostgresDirectoryStoreOptions, u as parseScimFilter, v as DirectoryGroup, w as ERROR_SCHEMA, x as DirectoryStore, y as DirectoryMembershipSourceOptions } from "../index-BT5-1VsX.js";
+import { A as ScimFilter, C as DirectoryUser, D as PATCH_SCHEMA, E as LIST_SCHEMA, F as ScimTokenOptions, I as USER_SCHEMA, L as isDirectoryNotFoundError, M as ScimPage, N as ScimPageResult, O as ROLES_EXTENSION, P as ScimPatchOp, R as isDirectoryUniquenessError, S as DirectoryUniquenessError, T as GROUP_SCHEMA, _ as DirectoryChange, a as normalizePatchOps, b as DirectoryNotFoundError, c as filterSupported, d as resourceTypes, f as schemas, g as APP_DATA_EXTENSION, h as sha256Hex, i as directoryMembershipSource, j as ScimHandlerOptions, k as SCIM_CONTENT_TYPE, l as matchFilter, m as authenticateScim, n as postgresDirectoryStore, o as tenantFromPath, p as serviceProviderConfig, r as memoryDirectoryStore, s as scimHandler, t as PostgresDirectoryStoreOptions, u as parseScimFilter, v as DirectoryGroup, w as ERROR_SCHEMA, x as DirectoryStore, y as DirectoryMembershipSourceOptions } from "../index-Dj2qF9VC.js";
 export { APP_DATA_EXTENSION, type DirectoryChange, type DirectoryGroup, type DirectoryMembershipSourceOptions, DirectoryNotFoundError, type DirectoryStore, DirectoryUniquenessError, type DirectoryUser, ERROR_SCHEMA, GROUP_SCHEMA, LIST_SCHEMA, PATCH_SCHEMA, type PostgresDirectoryStoreOptions, ROLES_EXTENSION, SCIM_CONTENT_TYPE, type ScimFilter, type ScimHandlerOptions, type ScimPage, type ScimPageResult, type ScimPatchOp, type ScimTokenOptions, type SqlQuery, USER_SCHEMA, authenticateScim, directoryMembershipSource, filterSupported, isDirectoryNotFoundError, isDirectoryUniquenessError, matchFilter, memoryDirectoryStore, normalizePatchOps, parseScimFilter, postgresDirectoryStore, resourceTypes, schemas, scimHandler, serviceProviderConfig, sha256Hex, tenantFromPath };

package/dist/server/index.d.ts

@@ -1,13 +1,13 @@
-import { n as PermDockValidationError, t as PROBLEM_BASE } from "../validation-error-YGg2mXyH.js";
-import { i as PermDockRevokedError, n as PermDockApprovalRequiredError, r as PermDockDeniedError, t as ApprovalHint } from "../errors-zi_4T-rx.js";
+import { n as PermDockValidationError, t as PROBLEM_BASE } from "../validation-error-uvp-kyfO.js";
+import { i as PermDockRevokedError, n as PermDockApprovalRequiredError, r as PermDockDeniedError, t as ApprovalHint } from "../errors-BIM4MFsJ.js";
 import { t as RequestContext } from "../request-context-C2_1lchh.js";
 import { i as memoryRevocationFeed, n as RevocationFeed, t as RevocationEvent } from "../revocations-BaUXHM1N.js";
-import { C as TenantScope, D as ConnectionOptions, E as ConnectionData, S as TenantOption, T as Connection, _ as WebBotAuthVerifier, a as OperationScopes, b as invalidSignatureResponse, c as ServerPermDock, d as DiscoverViaSignatureAgentOptions, f as InvalidSignatureError, g as WebBotAuthOptions, h as WebBotAuthKeys, i as OpenApiHooks, l as ServerPermDockOptions, m as WebBotAuthKeyLookup, n as DeniedResponseEvent, o as ProtectOptions, p as WebBotAuthJwk, r as Guard, s as ScopeGuard, t as DeniedResponse, u as SnapshotQuery, v as discoverViaSignatureAgent, w as tenantScope, x as webBotAuthVerifier, y as invalidSignatureProblem } from "../server-types-CIlpSA2G.js";
-import { i as evaluationsHandler } from "../evaluations-z8dQFDaN.js";
-import { C as subjectFromApiKey, E as createPermDock, S as parseFeedKey, T as problemFromError, _ as generateApiKey, a as SupportSessionContext, b as memoryCredentialStore, c as SupportSessionSubjectOptions, d as ApiKeyFailureCause, f as ApiKeyParts, g as apiKeyVerifier, h as StoredCredential, i as wwwAuthenticate, l as signSupportSession, m as MemoryCredentialStore, n as problemResponse, o as SupportSessionFailureCause, p as ApiKeySubjectOptions, r as validationProblem, s as SupportSessionSource, t as problemFromDecision, u as subjectFromSupportSession, v as generateFeedKey, w as ProblemFromErrorOptions, x as parseApiKey, y as hashApiKey } from "../index-B8s204GL.js";
-import { l as ReplayStore } from "../types-DjuMBNF9.js";
-import { a as WebhookInput, c as WebhookMessage, d as WebhookSigningKey, f as WebhookVerifier, h as webhookVerifier, i as WebhookHeaders, l as WebhookSigner, m as webhookSigner, n as WebhookAlgorithm, o as WebhookJwk, p as WebhookVerifierOptions, r as WebhookFailureCause, s as WebhookJwks, t as VerifiedWebhookMessage, u as WebhookSignerOptions } from "../standard-webhooks-C-qX4mJW.js";
-import { t as memoryReplayStore } from "../replay-DNftIb_R.js";
-import { a as snapshotHeaders, i as cacheLifeFor, n as SnapshotHeaders, o as snapshotTag, r as SnapshotHeadersOptions, t as CacheLifeForOptions } from "../snapshot-cache-BAXZ0KOp.js";
-import { a as RunContext, c as RunTicket, d as RunTicketInput, f as RunTicketOptions, g as subjectFromRunTicket, h as signRunTicket, i as RunBinding, l as RunTicketAutomations, m as parseRunTicket, n as RunActClaim, o as RunKind, p as RunTicketSubjectOptions, r as RunAutomation, s as RunPrincipal, t as RUN_TICKET_CLAIMS, u as RunTicketFailureCause } from "../run-ticket-DbWI9f99.js";
-export { type ApiKeyFailureCause, type ApiKeyParts, type ApiKeySubjectOptions, type ApprovalHint, type CacheLifeForOptions, type Connection, type ConnectionData, type ConnectionOptions, type DeniedResponse, type DeniedResponseEvent, type DiscoverViaSignatureAgentOptions, type Guard, InvalidSignatureError, type MemoryCredentialStore, type OpenApiHooks, type OperationScopes, PROBLEM_BASE, PermDockApprovalRequiredError, PermDockDeniedError, PermDockRevokedError, PermDockValidationError, type ProblemFromErrorOptions, type ProtectOptions, RUN_TICKET_CLAIMS, type ReplayStore, type RequestContext, type RevocationEvent, type RevocationFeed, type RunActClaim, type RunAutomation, type RunBinding, type RunContext, type RunKind, type RunPrincipal, type RunTicket, type RunTicketAutomations, type RunTicketFailureCause, type RunTicketInput, type RunTicketOptions, type RunTicketSubjectOptions, type ScopeGuard, type ServerPermDock, type ServerPermDockOptions, type SnapshotHeaders, type SnapshotHeadersOptions, type SnapshotQuery, type StoredCredential, type SupportSessionContext, type SupportSessionFailureCause, type SupportSessionSource, type SupportSessionSubjectOptions, type TenantOption, type TenantScope, type VerifiedWebhookMessage, type WebBotAuthJwk, type WebBotAuthKeyLookup, type WebBotAuthKeys, type WebBotAuthOptions, type WebBotAuthVerifier, type WebhookAlgorithm, type WebhookFailureCause, type WebhookHeaders, type WebhookInput, type WebhookJwk, type WebhookJwks, type WebhookMessage, type WebhookSigner, type WebhookSignerOptions, type WebhookSigningKey, type WebhookVerifier, type WebhookVerifierOptions, apiKeyVerifier, cacheLifeFor, createPermDock, discoverViaSignatureAgent, evaluationsHandler, generateApiKey, generateFeedKey, hashApiKey, invalidSignatureProblem, invalidSignatureResponse, memoryCredentialStore, memoryReplayStore, memoryRevocationFeed, parseApiKey, parseFeedKey, parseRunTicket, problemFromDecision, problemFromError, problemResponse, signRunTicket, signSupportSession, snapshotHeaders, snapshotTag, subjectFromApiKey, subjectFromRunTicket, subjectFromSupportSession, tenantScope, validationProblem, webBotAuthVerifier, webhookSigner, webhookVerifier, wwwAuthenticate };
+import { C as TenantScope, D as ConnectionOptions, E as ConnectionData, S as TenantOption, T as Connection, _ as WebBotAuthVerifier, a as OperationScopes, b as invalidSignatureResponse, c as ServerPermDock, d as DiscoverViaSignatureAgentOptions, f as InvalidSignatureError, g as WebBotAuthOptions, h as WebBotAuthKeys, i as OpenApiHooks, l as ServerPermDockOptions, m as WebBotAuthKeyLookup, n as DeniedResponseEvent, o as ProtectOptions, p as WebBotAuthJwk, r as Guard, s as ScopeGuard, t as DeniedResponse, u as SnapshotQuery, v as discoverViaSignatureAgent, w as tenantScope, x as webBotAuthVerifier, y as invalidSignatureProblem } from "../server-types-CyRN0-Cd.js";
+import { i as evaluationsHandler } from "../evaluations-DOWuBpWv.js";
+import { C as subjectFromApiKey, E as createPermDock, S as parseFeedKey, T as problemFromError, _ as generateApiKey, a as SupportSessionContext, b as memoryCredentialStore, c as SupportSessionSubjectOptions, d as ApiKeyFailureCause, f as ApiKeyParts, g as apiKeyVerifier, h as StoredCredential, i as wwwAuthenticate, l as signSupportSession, m as MemoryCredentialStore, n as problemResponse, o as SupportSessionFailureCause, p as ApiKeySubjectOptions, r as validationProblem, s as SupportSessionSource, t as problemFromDecision, u as subjectFromSupportSession, v as generateFeedKey, w as ProblemFromErrorOptions, x as parseApiKey, y as hashApiKey } from "../index-CV-7DWeD.js";
+import { l as ReplayStore } from "../types-DsHGPtkR.js";
+import { a as WebhookInput, c as WebhookMessage, d as WebhookSigningKey, f as WebhookVerifier, h as webhookVerifier, i as WebhookHeaders, l as WebhookSigner, m as webhookSigner, n as WebhookAlgorithm, o as WebhookJwk, p as WebhookVerifierOptions, r as WebhookFailureCause, s as WebhookJwks, t as VerifiedWebhookMessage, u as WebhookSignerOptions } from "../standard-webhooks-DOYEuOLx.js";
+import { t as memoryReplayStore } from "../replay-Bs9Df2fQ.js";
+import { a as snapshotHeaders, i as cacheLifeFor, n as SnapshotHeaders, o as snapshotTag, r as SnapshotHeadersOptions, t as CacheLifeForOptions } from "../snapshot-cache-BjAWkchD.js";
+import { _ as subjectFromRunTicket, a as RunContext, c as RunResource, d as RunTicketFailureCause, f as RunTicketInput, g as signRunTicket, h as parseRunTicket, i as RunBinding, l as RunTicket, m as RunTicketSubjectOptions, n as RunActClaim, o as RunKind, p as RunTicketOptions, r as RunAutomation, s as RunPrincipal, t as RUN_TICKET_CLAIMS, u as RunTicketAutomations } from "../run-ticket-ylovhyFQ.js";
+export { type ApiKeyFailureCause, type ApiKeyParts, type ApiKeySubjectOptions, type ApprovalHint, type CacheLifeForOptions, type Connection, type ConnectionData, type ConnectionOptions, type DeniedResponse, type DeniedResponseEvent, type DiscoverViaSignatureAgentOptions, type Guard, InvalidSignatureError, type MemoryCredentialStore, type OpenApiHooks, type OperationScopes, PROBLEM_BASE, PermDockApprovalRequiredError, PermDockDeniedError, PermDockRevokedError, PermDockValidationError, type ProblemFromErrorOptions, type ProtectOptions, RUN_TICKET_CLAIMS, type ReplayStore, type RequestContext, type RevocationEvent, type RevocationFeed, type RunActClaim, type RunAutomation, type RunBinding, type RunContext, type RunKind, type RunPrincipal, type RunResource, type RunTicket, type RunTicketAutomations, type RunTicketFailureCause, type RunTicketInput, type RunTicketOptions, type RunTicketSubjectOptions, type ScopeGuard, type ServerPermDock, type ServerPermDockOptions, type SnapshotHeaders, type SnapshotHeadersOptions, type SnapshotQuery, type StoredCredential, type SupportSessionContext, type SupportSessionFailureCause, type SupportSessionSource, type SupportSessionSubjectOptions, type TenantOption, type TenantScope, type VerifiedWebhookMessage, type WebBotAuthJwk, type WebBotAuthKeyLookup, type WebBotAuthKeys, type WebBotAuthOptions, type WebBotAuthVerifier, type WebhookAlgorithm, type WebhookFailureCause, type WebhookHeaders, type WebhookInput, type WebhookJwk, type WebhookJwks, type WebhookMessage, type WebhookSigner, type WebhookSignerOptions, type WebhookSigningKey, type WebhookVerifier, type WebhookVerifierOptions, apiKeyVerifier, cacheLifeFor, createPermDock, discoverViaSignatureAgent, evaluationsHandler, generateApiKey, generateFeedKey, hashApiKey, invalidSignatureProblem, invalidSignatureResponse, memoryCredentialStore, memoryReplayStore, memoryRevocationFeed, parseApiKey, parseFeedKey, parseRunTicket, problemFromDecision, problemFromError, problemResponse, signRunTicket, signSupportSession, snapshotHeaders, snapshotTag, subjectFromApiKey, subjectFromRunTicket, subjectFromSupportSession, tenantScope, validationProblem, webBotAuthVerifier, webhookSigner, webhookVerifier, wwwAuthenticate };

package/dist/server/index.js

@@ -6,9 +6,9 @@ import { t as memoryReplayStore } from "../replay-BU09ad4L.js";
 import { n as snapshotHeaders, r as snapshotTag, t as cacheLifeFor } from "../snapshot-cache-Bx_4xC_6.js";
 import { d as invalidSignatureProblem, f as invalidSignatureResponse, l as InvalidSignatureError, o as evaluationsHandler, p as webBotAuthVerifier, u as discoverViaSignatureAgent } from "../evaluations-IBceAeKT.js";
 import { n as tenantScope } from "../adapter-context-CIQpQxbE.js";
-import { t as createPermDock } from "../create-_noSrY1T.js";
+import { t as createPermDock } from "../create-BLPKnJKa.js";
 import { a as generateFeedKey, c as parseApiKey, i as generateApiKey, l as parseFeedKey, n as subjectFromSupportSession, o as hashApiKey, r as apiKeyVerifier, s as memoryCredentialStore, t as signSupportSession, u as subjectFromApiKey } from "../server-3cVlTLde.js";
-import { i as subjectFromRunTicket, n as parseRunTicket, r as signRunTicket, t as RUN_TICKET_CLAIMS } from "../run-ticket-Dv7aF7Dk.js";
+import { i as subjectFromRunTicket, n as parseRunTicket, r as signRunTicket, t as RUN_TICKET_CLAIMS } from "../run-ticket-DfnZCh-u.js";
 import { t as problemFromError } from "../map-error-pasIGqMT.js";
 import { n as webhookVerifier, t as webhookSigner } from "../standard-webhooks-D67a3nzk.js";
 export { InvalidSignatureError, PROBLEM_BASE, PermDockApprovalRequiredError, PermDockDeniedError, PermDockRevokedError, PermDockValidationError, RUN_TICKET_CLAIMS, apiKeyVerifier, cacheLifeFor, createPermDock, discoverViaSignatureAgent, evaluationsHandler, generateApiKey, generateFeedKey, hashApiKey, invalidSignatureProblem, invalidSignatureResponse, memoryCredentialStore, memoryReplayStore, memoryRevocationFeed, parseApiKey, parseFeedKey, parseRunTicket, problemFromDecision, problemFromError, problemResponse, signRunTicket, signSupportSession, snapshotHeaders, snapshotTag, subjectFromApiKey, subjectFromRunTicket, subjectFromSupportSession, tenantScope, validationProblem, webBotAuthVerifier, webhookSigner, webhookVerifier, wwwAuthenticate };

package/dist/{server-types-CIlpSA2G.d.ts → server-types-CyRN0-Cd.d.ts}

@@ -1,14 +1,14 @@
-import { Gt as Snapshot, Ln as Decision, Rt as Instant, Zn as Actor, ar as JsonWebKeyLike, j as PolicyVocabulary, lr as Subject } from "./policy-types-CCiDRZBH.js";
+import { Un as Decision, Wt as Instant, X as Intent, Zt as Snapshot, dr as JsonWebKeyLike, hr as Subject, j as PolicyVocabulary, rr as Actor } from "./policy-types-DGIO_gxq.js";
 import { u as Permission } from "./permission-types-CAY-GU7e.js";
-import { a as PermDock, u as SnapshotOptions } from "./permdock-B6Sf4T_S.js";
-import { m as ApprovalStore } from "./types-B_tiYvk8.js";
-import { a as ProblemDetails, t as ApprovalHint } from "./errors-zi_4T-rx.js";
-import { t as InstanceOptions } from "./instance-options-B0KXqTrJ.js";
+import { a as PermDock, u as SnapshotOptions } from "./permdock-CprAPN3w.js";
+import { m as ApprovalStore } from "./types-DLvhVm1r.js";
+import { a as ProblemDetails, t as ApprovalHint } from "./errors-BIM4MFsJ.js";
+import { t as InstanceOptions } from "./instance-options-CoHn-0e8.js";
 import { t as RequestContext } from "./request-context-C2_1lchh.js";
-import { n as PermDockWrap } from "./wrap-DlJE3gS_.js";
+import { n as PermDockWrap } from "./wrap-DxXB54Wu.js";
 import { n as RevocationFeed } from "./revocations-BaUXHM1N.js";
-import { r as PdpFactory } from "./types-B4uqKDnp.js";
-import { i as evaluationsHandler } from "./evaluations-z8dQFDaN.js";
+import { r as PdpFactory } from "./types-DlelvQk4.js";
+import { i as evaluationsHandler } from "./evaluations-DOWuBpWv.js";
 //#region src/server/connection.d.ts
 type ConnectionData<T> = T | (() => T | null | undefined | Promise<T | null | undefined>);
 type ConnectionOptions<T = unknown> = {
@@ -151,6 +151,13 @@ type ServerPermDockOptions<TUser = unknown> = InstanceOptions & {
    * cover derived instances.
    */
   readonly wrap?: PermDockWrap;
+  /**
+   * `'read'` lets `claimsFirst(…, { versions })` judge the token from the
+   * shared version cache. Defaults to `'read'` for `GET`, `HEAD` and `OPTIONS`
+   * and `'write'` for every other method. `undefined` keeps the default; a
+   * throw or any other value is `'write'`.
+   */
+  readonly intent?: (request: Request) => Intent | undefined;
   /**
    * The `adapter` label on decision events, revocations and approvals. Defaults
    * to `server`.

package/dist/{shared-Afctg7B0.js → shared-DrGLwM3s.js}

@@ -4,7 +4,7 @@ import { t as byCodePoint } from "./compare-DTfyUunF.js";
 import { i as configError } from "./errors-Vpu6rKHl.js";
 import { a as quoteQualifiedTable, c as quoteSqlTable, o as quoteSqlIdent, s as quoteSqlLiteral, t as SQL_IDENT } from "./sql-0WjxIp9g.js";
 import { t as byScope } from "./compile-EzEMB-7v.js";
-import "./sources-CMAM-2A3.js";
+import "./sources-C4vkzZJV.js";
 //#region src/cli/sql/columns.ts
 /**
 * The Postgres type a JSON Schema property compares as; `undefined` for text or

package/dist/{sink-Dvi7YZG_.d.ts → sink-B5zoUW_O.d.ts}

@@ -1,7 +1,7 @@
-import { $t as CredentialEvent, Ct as Credential, Qt as AutomationEvent, Xt as AccessEvent, gt as SupportSession, on as MembershipEvent, q as DecisionSink, sn as SinkEvent, ut as TokenSigner } from "./policy-types-CCiDRZBH.js";
+import { J as DecisionSink, St as SupportSession, an as CredentialEvent, fn as MembershipEvent, in as AutomationEvent, kt as Credential, mt as TokenSigner, nn as AccessEvent, pn as SinkEvent } from "./policy-types-DGIO_gxq.js";
 import { M as AppData } from "./permission-types-CAY-GU7e.js";
 import { u as OperationRisk } from "./operations-Ci_rT6Uo.js";
-import { t as Automation } from "./automation-DqEoWHBc.js";
+import { t as Automation } from "./automation-C6Jg75xq.js";
 //#region src/core/sink.d.ts
 /**
  * The closed list of CloudEvents `type` values, `com.permdock.<family>` or

package/dist/{skills-OuoMR49L.js → skills-BUI8DMqy.js}

@@ -1,7 +1,7 @@
 import { t as defineLeaf } from "./command-L8EstFNm.js";
 import { t as checkFlag } from "./flags-DXjoTVbS.js";
 import { r as pick, t as CANCELLED } from "./prompt-BYc6drYW.js";
-import { n as detectedAgents, r as runSkills, t as SKILL_AGENTS } from "./skills-Bjj7BNEQ.js";
+import { n as detectedAgents, r as runSkills, t as SKILL_AGENTS } from "./skills-iwbRxavw.js";
 //#region src/cli/commands/skills.ts
 const forFlag = { for: {
 	type: "string",

package/dist/{skills-Bjj7BNEQ.js → skills-iwbRxavw.js}

@@ -2,7 +2,7 @@ import { t as byCodePoint } from "./compare-DTfyUunF.js";
 import { i as readJsonFile } from "./files-BSjrtIHw.js";
 import { l as packageRoot } from "./version-DMQ0dnN5.js";
 import { t as didYouMean } from "./args-0FrVs5EH.js";
-import { a as nonEmptyOr } from "./output-tkju6U7R.js";
+import { a as nonEmptyOr } from "./output-LsbLe41I.js";
 import { cpSync, existsSync, lstatSync, mkdirSync, readFileSync, readdirSync, readlinkSync, realpathSync, writeFileSync } from "node:fs";
 import { basename, dirname, join, relative, resolve } from "node:path";
 import { pathToFileURL } from "node:url";

package/dist/{snapshot-cache-BAXZ0KOp.d.ts → snapshot-cache-BjAWkchD.d.ts}

@@ -1,4 +1,4 @@
-import { Gt as Snapshot, Rt as Instant } from "./policy-types-CCiDRZBH.js";
+import { Wt as Instant, Zt as Snapshot } from "./policy-types-DGIO_gxq.js";
 //#region src/core/snapshot-cache.d.ts
 type CacheLifeForOptions = {
   /**

package/dist/solid/index.d.ts

@@ -1,13 +1,13 @@
-import { Gt as Snapshot, In as ApprovalRequiredDecision, Ln as Decision, Un as GrantedDecision, dt as TokenVerifier, j as PolicyVocabulary, or as Membership } from "../policy-types-CCiDRZBH.js";
+import { Hn as ApprovalRequiredDecision, Un as Decision, Yn as GrantedDecision, Zt as Snapshot, fr as Membership, ht as TokenVerifier, j as PolicyVocabulary } from "../policy-types-DGIO_gxq.js";
 import { u as Permission } from "../permission-types-CAY-GU7e.js";
 import { r as Role } from "../vocabulary-DEJ5j4mR.js";
-import { d as UncheckedData, s as RowData } from "../permdock-B6Sf4T_S.js";
-import { c as requiredPlans } from "../errors-zi_4T-rx.js";
-import { i as describe, r as DescribeOptions, t as DecisionDescription } from "../describe-ByS9LgHK.js";
+import { d as UncheckedData, s as RowData } from "../permdock-CprAPN3w.js";
+import { c as requiredPlans } from "../errors-BIM4MFsJ.js";
+import { i as describe, r as DescribeOptions, t as DecisionDescription } from "../describe-BbFPBSms.js";
 import { t as PermissionBoundaryState } from "../boundary-C9ck-3uK.js";
-import { n as ProtectedAction, t as ActionResult } from "../action-result-CL-QCITA.js";
+import { n as ProtectedAction, t as ActionResult } from "../action-result-BcudBQOF.js";
 import { t as approvalHeaders } from "../headers-B9jQxjtW.js";
-import { a as FilterResult, b as eventSourceRefresh, c as PermissionSet, d as ProtectedActionView, f as ProviderOptionsBase, h as TenantView, i as ClientStatus, l as PermissionState, m as SubjectView, n as ApprovalState, o as GateMode, p as RolesOptions, r as ClientPermDock, s as GateView, t as ApprovalHandle, v as EventSourceRefreshOptions, y as RefreshTrigger } from "../types-B_d_g7T3.js";
+import { a as FilterResult, b as eventSourceRefresh, c as PermissionSet, d as ProtectedActionView, f as ProviderOptionsBase, h as TenantView, i as ClientStatus, l as PermissionState, m as SubjectView, n as ApprovalState, o as GateMode, p as RolesOptions, r as ClientPermDock, s as GateView, t as ApprovalHandle, v as EventSourceRefreshOptions, y as RefreshTrigger } from "../types-tQB2CEnY.js";
 import { Accessor, Accessor as Accessor$1, JSX } from "solid-js";
 //#region src/solid/types.d.ts
 /** Structural `JSX.Element`: text, a DOM node or a list of children. */

package/dist/solid-start/index.d.ts

@@ -1,9 +1,9 @@
-import { Gt as Snapshot, T as Policy, j as PolicyVocabulary, sr as Principal } from "../policy-types-CCiDRZBH.js";
+import { T as Policy, Zt as Snapshot, j as PolicyVocabulary, pr as Principal } from "../policy-types-DGIO_gxq.js";
 import { u as Permission } from "../permission-types-CAY-GU7e.js";
 import { a as OperationInput, t as Operation } from "../operations-Ci_rT6Uo.js";
-import { a as PermDock } from "../permdock-B6Sf4T_S.js";
-import { D as ConnectionOptions, T as Connection, f as InvalidSignatureError, i as OpenApiHooks, o as ProtectOptions, u as SnapshotQuery, v as discoverViaSignatureAgent, x as webBotAuthVerifier } from "../server-types-CIlpSA2G.js";
-import { a as ProtectTarget, n as FetchAdapterOptions, t as ContextReader } from "../fetch-adapter-C1DCvpqV.js";
+import { a as PermDock } from "../permdock-CprAPN3w.js";
+import { D as ConnectionOptions, T as Connection, f as InvalidSignatureError, i as OpenApiHooks, o as ProtectOptions, u as SnapshotQuery, v as discoverViaSignatureAgent, x as webBotAuthVerifier } from "../server-types-CyRN0-Cd.js";
+import { a as ProtectTarget, n as FetchAdapterOptions, t as ContextReader } from "../fetch-adapter-BIbBAtPZ.js";
 import { APIEvent, FetchEvent } from "@solidjs/start/server";
 //#region src/solid-start/create.d.ts
 /** The h3 event under every SolidStart request; `subject` and `scope` read it. */

package/dist/solid-start/index.js

@@ -1,6 +1,6 @@
 import { l as InvalidSignatureError, p as webBotAuthVerifier, u as discoverViaSignatureAgent } from "../evaluations-IBceAeKT.js";
-import { i as decorate } from "../bind-D_sZSVA3.js";
-import { n as guardedRoute, t as fetchAdapter } from "../fetch-adapter-JL43jD3E.js";
+import { i as decorate } from "../bind-BNQA9JK9.js";
+import { n as guardedRoute, t as fetchAdapter } from "../fetch-adapter-dPTgJVHd.js";
 //#region src/solid-start/create.ts
 /**
 * `event.locals`. Its type, `App.RequestEventLocals`, is declared by

package/dist/{sources-CMAM-2A3.js → sources-C4vkzZJV.js}

@@ -228,7 +228,7 @@ function singleRole(role, table, alias, options) {
 	}
 	const pairs = Object.entries(role.on);
 	const [pair] = pairs;
-	if (pair === void 0 || pairs.length !== 1) throw new TypeError(`${prefix}: ${options.label}.on must map exactly one column of ${table} to ${role.through}, for example ${options.example ?? "{ role_id: 'id' }"}`);
+	if (pair === void 0 || pairs.length !== 1 && options.composite !== true) throw new TypeError(options.composite === true ? `${prefix}: ${options.label}.on must map at least one column of ${table} to ${role.through}, for example ${options.example ?? "{ role_id: 'id' }"}` : `${prefix}: ${options.label}.on must map exactly one column of ${table} to ${role.through}, for example ${options.example ?? "{ role_id: 'id' }"}`);
 	const [ref, id] = pair;
 	const schema = table.includes(".") ? table.split(".")[0] ?? "public" : "public";
 	const through = role.through.includes(".") ? role.through : `${schema}.${role.through}`;
@@ -238,18 +238,20 @@ function singleRole(role, table, alias, options) {
 		table: through,
 		id,
 		key: role.column,
-		ref
+		ref,
+		match: pairs
 	};
+	const on = pairs.map(([from, to]) => `${keys}.${q(to)} = ${alias}.${q(from)}`).join(" and ");
 	const plain = `${keys}.${q(role.column)}::text`;
 	const guard = options.guard;
 	const key = guard !== void 0 && qualifySqlTable(guard.table) === through ? `case when ${keys}.${q(guard.tenant)} is not null${guard.skip === void 0 ? "" : ` and not coalesce(${keys}.${q(guard.skip)}, false)`} and ${plain} = any(${sqlTextArray(guard.declared)}) then null else ${plain} end` : plain;
 	return {
 		column: ref,
 		sql: key,
-		join: `${options.indent === void 0 ? " " : `\n${options.indent}`}join ${target} ${keys} on ${keys}.${q(id)} = ${alias}.${q(ref)}`,
-		lookup: `(select ${key} from ${target} ${keys} where ${keys}.${q(id)} = ${alias}.${q(ref)})`,
+		join: `${options.indent === void 0 ? " " : `\n${options.indent}`}join ${target} ${keys} on ${on}`,
+		lookup: `(select ${key} from ${target} ${keys} where ${on})`,
 		through: keyed,
-		columns: [ref],
+		columns: pairs.map(([from]) => from),
 		throughs: [keyed],
 		lateral: false,
 		nullable: false
@@ -264,12 +266,14 @@ function sourceManifest(column, through, map) {
 		column,
 		map
 	};
-	return through === void 0 ? { column } : {
+	if (through === void 0) return { column };
+	return {
 		column,
 		through: {
 			table: through.table,
 			id: through.id,
-			column: through.key
+			column: through.key,
+			...through.match.length > 1 ? { on: Object.fromEntries(through.match) } : {}
 		}
 	};
 }
@@ -300,6 +304,7 @@ function memberRole(role, table, label, guard) {
 	return roleColumn(role, qualifySqlTable(table), "m", {
 		label,
 		indent: "",
+		composite: true,
 		...guard === void 0 ? {} : { guard }
 	});
 }