permdock 0.8.0 → 0.10.0

package/dist/{diff-CN8IYhC_.js → diff-BwR1JdP2.js}

@@ -21,7 +21,7 @@ const diff = defineLeaf({
 		}
 	},
 	async run(ctx, { flags, args }) {
-		return (await import("./diff-iZWV65nC.js")).runDiff({
+		return (await import("./diff-CQegtBAo.js")).runDiff({
 			cwd: ctx.cwd,
 			config: ctx.config,
 			sources: [args["before"], args["after"]].filter((value) => value !== void 0),

package/dist/{diff-iZWV65nC.js → diff-CQegtBAo.js}

@@ -1,8 +1,8 @@
-import { A as memoryCustomRoleSource } from "./src-DZ0l9UAg.js";
+import { j as memoryCustomRoleSource } from "./src-C_pi2Rnh.js";
 import { n as findPermission } from "./permission-registry-B8tYxPIt.js";
 import { g as secondsOf } from "./time-nR1JesoH.js";
 import { t as canonicalJson } from "./canonical-json-DwilZ1iB.js";
-import { t as getPermDock } from "./permdock-L-_I_3zP.js";
+import { t as getPermDock } from "./permdock-BvjivVb9.js";
 import { i as configError, u as usageResult } from "./errors-Vpu6rKHl.js";
 import { t as buildCatalog } from "./catalog-doc-DjMKzJp9.js";
 import { a as loadModule, n as asPolicy, s as pickNamed } from "./load-DjSU5KXO.js";

package/dist/{doctor-D3wo-yuz.js → doctor-B9FY9H0F.js}

@@ -10,7 +10,7 @@ const doctor = defineLeaf({
 			description: "Check codes or groups to run",
 			valueHint: "code",
 			async complete() {
-				const { DOCTOR_CHECKS } = await import("./doctor-CHD1M9R5.js");
+				const { DOCTOR_CHECKS } = await import("./doctor-DfTnMaUt.js");
 				return [.../* @__PURE__ */ new Set([...DOCTOR_CHECKS.map(({ code }) => code), ...DOCTOR_CHECKS.flatMap(({ groups }) => groups)])];
 			}
 		},
@@ -27,7 +27,7 @@ const doctor = defineLeaf({
 			if (answer === void 0) return CANCELLED;
 			fix = answer;
 		}
-		return (await import("./doctor-CHD1M9R5.js")).runDoctor({
+		return (await import("./doctor-DfTnMaUt.js")).runDoctor({
 			cwd: ctx.cwd,
 			config: ctx.config,
 			only: flags.only,

package/dist/{doctor-CHD1M9R5.js → doctor-DfTnMaUt.js}

@@ -1,11 +1,12 @@
+import { r as isRecord } from "./compact-CAf557ZB.js";
 import { o as hasConditionOp } from "./refs-C8BKxc_e.js";
 import { c as listPermissions, h as formerKeys } from "./permission-registry-B8tYxPIt.js";
 import { u as isPrincipalRelation } from "./resource-relations-8-pCScBO.js";
 import { t as canonicalJson } from "./canonical-json-DwilZ1iB.js";
-import { f as scopeList, o as normalizeMemberships, s as resolveScope } from "./scopes-0Up_UA2t.js";
+import { f as scopeList, l as rootScope, o as normalizeMemberships, s as resolveScope } from "./scopes-0Up_UA2t.js";
 import { o as flattenGrantee } from "./grantee-Dke-9rd1.js";
 import { u as separationConflicts } from "./policy-CLQ8__GF.js";
-import { T as validateCustomRole } from "./evaluate-Dd8Ta0Ie.js";
+import { T as validateCustomRole } from "./evaluate-BAmf_AQd.js";
 import { s as parseCredential } from "./credential-CyyyvCsL.js";
 import { a as describeError } from "./errors-Vpu6rKHl.js";
 import { t as policyRowConditionKeys } from "./row-conditions-BAGHOmVq.js";
@@ -14,34 +15,36 @@ import { i as DOCTOR_REPORT_SCHEMA } from "./version-DMQ0dnN5.js";
 import { c as jsonSchemaOf, i as catalogOAuthScopes } from "./catalog-doc-DjMKzJp9.js";
 import { a as loadModule, i as loadConfiguredPolicy, n as asPolicy, s as pickNamed } from "./load-DjSU5KXO.js";
 import { t as catalogPath } from "./catalog-path-CnI0XTFK.js";
-import { r as runCollect } from "./collect-B7ZFAJU3.js";
+import { r as runCollect } from "./collect-WCl8cJQV.js";
 import { i as qualifySqlTable, s as quoteSqlLiteral } from "./sql-0WjxIp9g.js";
 import { a as scopeMembershipTable } from "./compile-EzEMB-7v.js";
 import { n as supabaseTenantClaim } from "./budget-BELja5A9.js";
-import { d as keptKeys, r as PERMDOCK_SCHEMA } from "./sources-CMAM-2A3.js";
+import { d as keptKeys, r as PERMDOCK_SCHEMA } from "./sources-C4vkzZJV.js";
 import { t as parseCatalog } from "./parse-1_ZheTW5.js";
+import { n as activeTenantMismatch } from "./active-tenant-DVee32-T.js";
 import "./markers-BeHZ4x9Q.js";
 import { t as didYouMean } from "./args-0FrVs5EH.js";
-import { t as DOCS_BASE } from "./manifest-Cgiq5oqc.js";
+import { t as DOCS_BASE } from "./manifest-B4ENCp2I.js";
 import { t as createStyle } from "./style-Ds11Hmk4.js";
-import { a as nonEmptyOr, r as findingOf } from "./output-tkju6U7R.js";
-import { i as runSkillsInstall } from "./skills-Bjj7BNEQ.js";
+import { a as nonEmptyOr, r as findingOf } from "./output-LsbLe41I.js";
+import { i as runSkillsInstall } from "./skills-iwbRxavw.js";
 import { n as MIGRATION_DIRS, t as DEFAULT_SENSITIVE_ACTIONS } from "./constants-DcJABbLW.js";
 import { l as partPath } from "./output-files-BIQ_9pIs.js";
-import { _ as supabaseConfig, a as supabaseHookManifest, c as pd039, g as readSupabaseConfig, h as pd074, m as pd045, n as hookOut, p as attrsPlan, u as resolveSchemas } from "./supabase-hook-B-yXnzUl.js";
-import { G as byKey, Q as graphSqlName, n as tableNameOf, o as graphPlan, r as tableNames } from "./tables-DeMNEy6V.js";
-import { a as guardedTables, p as contextRefs, r as unsatisfiedKinds, t as ownershipRules } from "./ownership-B4L59T9u.js";
+import { _ as readSupabaseConfig, a as supabaseHookManifest, c as activeSource, d as resolveSchemas, g as pd074, h as pd045, l as pd039, m as attrsPlan, n as hookOut, v as supabaseConfig } from "./supabase-hook-BT2P9wah.js";
+import { G as byKey, Q as graphSqlName, n as tableNameOf, o as graphPlan, r as tableNames } from "./tables-DimBcVWY.js";
+import { a as guardedTables, p as contextRefs, r as unsatisfiedKinds, t as ownershipRules } from "./ownership-qqBuGJXr.js";
 import { t as membershipSourcesOf } from "./sources-qoIJQrJv.js";
 import { i as group, n as membershipColumns, o as sqlStatements, r as tableKey } from "./deciding-columns-NB4wcyBf.js";
-import { t as resolveNames } from "./resolve-names-CF7xXLSG.js";
-import { t as FIELD_VIEWS } from "./fields-D0vUI6dq.js";
-import { a as pd010, c as pd014, d as pd038, f as pd041, i as pd008, l as pd015, n as pd001, o as pd011, p as pd057, r as pd007, s as pd013, t as runUsage, u as pd036 } from "./usage-CxEzS4ey.js";
-import { d as rowConditionMessage, f as commandFor, m as tableFor, p as compileGrants, s as ROW_CONDITION_FIX, u as helperTablePolicies } from "./verify-DZeqoWu5.js";
-import { a as streamOf, i as scopeSourcesOf, r as staleFiles, t as powersyncFiles } from "./powersync-DHNQX06W.js";
-import { a as generateOptions, c as buildContext, n as inheritTargets, o as isRefusal, t as supautilsRejections } from "./supautils-BU-pAEpf.js";
+import { t as FIELD_VIEWS } from "./fields-DI8s3cPl.js";
+import { t as resolveNames } from "./resolve-names-Y1Cb22cp.js";
+import { a as pd010, c as pd014, d as pd038, f as pd041, i as pd008, l as pd015, n as pd001, o as pd011, p as pd057, r as pd007, s as pd013, t as runUsage, u as pd036 } from "./usage-t_nXnwCW.js";
+import { d as rowConditionMessage, f as commandFor, m as tableFor, p as compileGrants, s as ROW_CONDITION_FIX, u as helperTablePolicies } from "./verify-jHrbmn-E.js";
+import { a as streamOf, i as scopeSourcesOf, r as staleFiles, t as powersyncFiles } from "./powersync-DUT-UKgw.js";
+import { a as buildContext, n as generateOptions, r as isRefusal, s as inheritTargets, t as supautilsRejections } from "./supautils-DBKOoyjn.js";
 import { n as legacyHelperNames, r as retirePlan, t as legacyHelperCalls } from "./retire-B2xffQgY.js";
 import { existsSync, readFileSync, readdirSync, statSync } from "node:fs";
 import { basename, dirname, join, resolve } from "node:path";
+import { pathToFileURL } from "node:url";
 import { createRequire } from "node:module";
 //#region src/cli/shared/doctor-files.ts
 const nodeFiles = Object.freeze({
@@ -212,6 +215,120 @@ async function pd064(input) {
 	}));
 }
 //#endregion
+//#region src/cli/doctor/better-supabase.ts
+const CONFIG_FILES = [
+	"better-supabase.config.ts",
+	"better-supabase.config.mts",
+	"better-supabase.config.js",
+	"better-supabase.config.mjs"
+];
+/** The default export of the project's `better-supabase.config.*`, if it loads. */
+async function betterSupabaseConfig(input) {
+	const files = filesOf(input);
+	const path = CONFIG_FILES.map((name) => resolve(input.cwd, name)).find((file) => files.exists(file));
+	if (path === void 0) return;
+	try {
+		const loaded = (await loadModule(path))["default"];
+		return isRecord(loaded) ? loaded : void 0;
+	} catch {
+		return;
+	}
+}
+function activeTenantOf(config) {
+	const blocks = config["blocks"];
+	const permissions = isRecord(blocks) ? blocks["permissions"] : void 0;
+	const value = isRecord(permissions) ? permissions["activeTenant"] : void 0;
+	if (value === "claim" || value === "resolver") return value;
+	if (isRecord(value) && typeof value["profileColumn"] === "string") {
+		const key = value["key"];
+		return {
+			profileColumn: value["profileColumn"],
+			...typeof key === "string" ? { key } : {}
+		};
+	}
+}
+/**
+* PermDock's token hook reads the active tenant from another place than
+* better-supabase's `blocks.permissions.activeTenant` writes it, so
+* `switch_organization` never changes the tenant claim.
+*/
+async function pd078(input) {
+	const hook = input.config.supabase?.hook;
+	if (hook === void 0) return [];
+	const config = await betterSupabaseConfig(input);
+	const activeTenant = config === void 0 ? void 0 : activeTenantOf(config);
+	if (activeTenant === void 0) return [];
+	const policy = await policyOf(input);
+	const root = policy === void 0 ? void 0 : rootScope(scopeList(policy.scopes));
+	let from;
+	try {
+		from = activeSource(hook.activeFrom, root ?? "tenant");
+	} catch {
+		return [];
+	}
+	const mismatch = activeTenantMismatch(from, input.config.rls?.tenantClaim ?? "tenant_id", activeTenant);
+	return mismatch === void 0 ? [] : [{
+		code: "PD078",
+		severity: "warning",
+		message: mismatch,
+		fix: "set supabase.hook.activeFrom, then run permdock supabase hook generate"
+	}];
+}
+function isBlockPermissionKey(value) {
+	return isRecord(value) && typeof value["module"] === "string" && typeof value["action"] === "string" && typeof value["key"] === "string";
+}
+/**
+* Every permission key the configured blocks check, from the project's own
+* `better-supabase/sql`; `undefined` when it does not resolve or refuses the
+* config.
+*/
+async function blockPermissionKeys(cwd, blocks) {
+	try {
+		const file = createRequire(resolve(cwd, "package.json")).resolve("better-supabase/sql");
+		const list = (await import(pathToFileURL(file).href))["modulePermissionKeys"];
+		if (!isKeyLister(list)) return;
+		const keys = list(blocks, Object.keys(blocks));
+		return Array.isArray(keys) ? keys.filter(isBlockPermissionKey) : void 0;
+	} catch {
+		return;
+	}
+}
+function isKeyLister(value) {
+	return typeof value === "function";
+}
+/**
+* A permission key a configured better-supabase block checks that the catalog
+* does not list: no role holds it, so the block's SQL checks deny it.
+*/
+async function pd079(input) {
+	const blocks = (await betterSupabaseConfig(input))?.["blocks"];
+	if (!isRecord(blocks)) return [];
+	const files = filesOf(input);
+	const path = catalogPath(input.config, input.cwd);
+	if (!files.exists(path)) return [];
+	let declared;
+	try {
+		declared = new Set(parseCatalog(files.read(path)).permissions.map(({ key }) => key));
+	} catch {
+		return [];
+	}
+	const keys = await blockPermissionKeys(input.cwd, blocks);
+	if (keys === void 0) return [];
+	const missing = /* @__PURE__ */ new Map();
+	for (const entry of keys) if (!declared.has(entry.key)) {
+		const uses = missing.get(entry.key) ?? [];
+		uses.push(`blocks.${entry.module}.permissions.${entry.action}`);
+		missing.set(entry.key, uses);
+	}
+	const catalog = rel(input.cwd, path);
+	return [...missing].map(([key, uses]) => ({
+		code: "PD079",
+		severity: "warning",
+		message: `${key} (${[...new Set(uses)].join(", ")}) is not in ${catalog}, so no role holds it and better-supabase's SQL check denies it`,
+		fix: `declare ${key} in the policy and run permdock collect, or map the block action to a key the catalog lists`
+	}));
+}
+//#endregion
 //#region src/cli/doctor/catalog.ts
 /**
 * A policy that declares `oauthScopes` against a catalog on disk without them,
@@ -2250,6 +2367,17 @@ const DOCTOR_CHECKS = [
 		when: (config) => config.policy !== void 0,
 		run: pd070
 	},
+	{
+		code: "PD078",
+		groups: ["supabase", "better-supabase"],
+		when: (config) => config.supabase?.hook !== void 0,
+		run: pd078
+	},
+	{
+		code: "PD079",
+		groups: ["catalog", "better-supabase"],
+		run: pd079
+	},
 	{
 		code: "PD005",
 		groups: ["skills"],

package/dist/drizzle/index.d.ts

@@ -1,7 +1,7 @@
-import { Rt as Instant, lr as Subject, mr as Condition } from "../policy-types-CCiDRZBH.js";
-import { f as WhereResult } from "../permdock-B6Sf4T_S.js";
+import { Wt as Instant, br as Condition, hr as Subject } from "../policy-types-DGIO_gxq.js";
+import { f as WhereResult } from "../permdock-CprAPN3w.js";
 import { r as RelationsMapping } from "../graph-sql-BwFC4Qjs.js";
-import { s as MembershipsMapping } from "../compile-BFzysW3o.js";
+import { s as MembershipsMapping } from "../compile-BEklRUYo.js";
 import { n as RowCheck, t as WithSubjectOptions } from "../subject-settings-vNW8qmUH.js";
 import { SQL, Table } from "drizzle-orm";
 //#region src/drizzle/types.d.ts

package/dist/elysia/index.d.ts

@@ -1,9 +1,9 @@
-import { T as Policy, j as PolicyVocabulary, sr as Principal } from "../policy-types-CCiDRZBH.js";
+import { T as Policy, j as PolicyVocabulary, pr as Principal } from "../policy-types-DGIO_gxq.js";
 import { u as Permission } from "../permission-types-CAY-GU7e.js";
-import { a as PermDock } from "../permdock-B6Sf4T_S.js";
+import { a as PermDock } from "../permdock-CprAPN3w.js";
 import { n as RevocationFeed } from "../revocations-BaUXHM1N.js";
-import { D as ConnectionOptions, T as Connection, f as InvalidSignatureError, i as OpenApiHooks, o as ProtectOptions, v as discoverViaSignatureAgent, x as webBotAuthVerifier } from "../server-types-CIlpSA2G.js";
-import { t as ServerAdapterOptions } from "../bind-Cp2hBHzP.js";
+import { D as ConnectionOptions, T as Connection, f as InvalidSignatureError, i as OpenApiHooks, o as ProtectOptions, v as discoverViaSignatureAgent, x as webBotAuthVerifier } from "../server-types-CyRN0-Cd.js";
+import { t as ServerAdapterOptions } from "../bind-YYjvfpB9.js";
 import { Elysia } from "elysia";
 //#region src/elysia/create.d.ts
 type ElysiaRequestContext = {

package/dist/elysia/index.js

@@ -1,7 +1,7 @@
 import { a as parsedBody, r as hasCredentials } from "../http-DKLXrFGk.js";
 import { l as InvalidSignatureError, p as webBotAuthVerifier, u as discoverViaSignatureAgent } from "../evaluations-IBceAeKT.js";
 import { t as problemFromError } from "../map-error-pasIGqMT.js";
-import { a as socketConnection, i as decorate, r as bindKernel } from "../bind-D_sZSVA3.js";
+import { a as socketConnection, i as decorate, r as bindKernel } from "../bind-BNQA9JK9.js";
 import { a as onRevoked, n as closeReason, t as POLICY_VIOLATION } from "../stream-CDvF0sJm.js";
 import { Elysia } from "elysia";
 //#region src/elysia/create.ts

package/dist/{errors-zi_4T-rx.d.ts → errors-BIM4MFsJ.d.ts}

@@ -1,4 +1,4 @@
-import { Ln as Decision, ln as WireDenial, lr as Subject } from "./policy-types-CCiDRZBH.js";
+import { Un as Decision, hn as WireDenial, hr as Subject } from "./policy-types-DGIO_gxq.js";
 import { StandardSchemaV1 } from "@standard-schema/spec";
 //#region src/core/problem-details.d.ts
 type Disclosure = "hide" | "reveal";

package/dist/{evaluate-Dd8Ta0Ie.js → evaluate-BAmf_AQd.js}

@@ -1174,11 +1174,14 @@ function roleSourceFor(option, subject, auth) {
 		return;
 	}
 }
-function customRolesFor(source, tenants, auth, globalHeld, heldIn) {
+function customRolesFor(source, tenants, auth, globalHeld, heldIn, memo) {
 	if (source === void 0) return [];
 	const loaded = [];
 	for (const tenant of tenants) try {
-		loaded.push(source.rolesFor(tenant, { held: heldIn(tenant) }));
+		loaded.push(source.rolesFor(tenant, compact({
+			held: heldIn(tenant),
+			memo
+		})));
 	} catch {
 		auth.push({
 			reason: "source-threw",
@@ -1202,12 +1205,18 @@ function customRolesFor(source, tenants, auth, globalHeld, heldIn) {
 	};
 	if (globalHeld !== void 0 && source.globalRoles !== void 0) {
 		const read = source.globalRoles.bind(source);
-		once(() => read({ held: globalHeld }), onlyGlobal);
+		once(() => read(compact({
+			held: globalHeld,
+			memo
+		})), onlyGlobal);
 	}
 	if (tenants.length > 0 && source.sharedRoles !== void 0) {
 		const read = source.sharedRoles.bind(source);
 		const held = [...new Set(tenants.flatMap((tenant) => heldIn(tenant)))];
-		once(() => read({ held }), onlyShared);
+		once(() => read(compact({
+			held,
+			memo
+		})), onlyShared);
 	}
 	if (loaded.some((item) => isThenable(item))) return Promise.all(loaded.map((item) => Promise.resolve(item).catch(() => {
 		auth.push({

package/dist/{evaluations-z8dQFDaN.d.ts → evaluations-DOWuBpWv.d.ts}

@@ -1,6 +1,6 @@
-import { T as Policy } from "./policy-types-CCiDRZBH.js";
-import { a as PermDock } from "./permdock-B6Sf4T_S.js";
-import { m as ApprovalStore } from "./types-B_tiYvk8.js";
+import { T as Policy } from "./policy-types-DGIO_gxq.js";
+import { a as PermDock } from "./permdock-CprAPN3w.js";
+import { m as ApprovalStore } from "./types-DLvhVm1r.js";
 //#region src/server/evaluations.d.ts
 /** AuthZEN 1.0 section 7.1.2.1 `options.evaluations_semantic` values. */
 declare const EVALUATIONS_SEMANTICS: readonly ["execute_all", "deny_on_first_deny", "permit_on_first_permit"];

package/dist/eve/index.d.ts

@@ -1,8 +1,8 @@
-import { T as Policy, j as PolicyVocabulary, sr as Principal } from "../policy-types-CCiDRZBH.js";
+import { T as Policy, j as PolicyVocabulary, pr as Principal } from "../policy-types-DGIO_gxq.js";
 import { u as Permission } from "../permission-types-CAY-GU7e.js";
-import { a as PermDock } from "../permdock-B6Sf4T_S.js";
-import { u as ApprovalRequest } from "../types-B_tiYvk8.js";
-import { o as AgentAdapterOptions, t as AgentPermDock } from "../create-BSNrVuxh.js";
+import { a as PermDock } from "../permdock-CprAPN3w.js";
+import { u as ApprovalRequest } from "../types-DLvhVm1r.js";
+import { o as AgentAdapterOptions, t as AgentPermDock } from "../create-BPUopdfL.js";
 //#region src/eve/create.d.ts
 /** Structural `SessionAuthContext` from `eve`. */
 type EvePrincipal = {

package/dist/eve/index.js

@@ -1,8 +1,8 @@
 import { t as compact } from "../compact-CAf557ZB.js";
-import { l as withApp } from "../permdock-L-_I_3zP.js";
+import { l as withApp } from "../permdock-BvjivVb9.js";
 import { c as isApprovalError } from "../types-CcUXciSj.js";
 import { o as resolveApproval } from "../helpers-DJicaG6f.js";
-import { t as agentRuntime } from "../create-Cq4Uox0f.js";
+import { t as agentRuntime } from "../create-6EwRQlig.js";
 import { t as boundedMap } from "../lru-8q4WZjBV.js";
 //#region src/eve/create.ts
 const TOKENS_PER_PROCESS = 1e3;

package/dist/express/index.d.ts

@@ -1,8 +1,8 @@
-import { T as Policy, j as PolicyVocabulary, sr as Principal } from "../policy-types-CCiDRZBH.js";
+import { T as Policy, j as PolicyVocabulary, pr as Principal } from "../policy-types-DGIO_gxq.js";
 import { u as Permission } from "../permission-types-CAY-GU7e.js";
-import { a as PermDock } from "../permdock-B6Sf4T_S.js";
-import { f as InvalidSignatureError, i as OpenApiHooks, o as ProtectOptions, v as discoverViaSignatureAgent, x as webBotAuthVerifier } from "../server-types-CIlpSA2G.js";
-import { t as ServerAdapterOptions } from "../bind-Cp2hBHzP.js";
+import { a as PermDock } from "../permdock-CprAPN3w.js";
+import { f as InvalidSignatureError, i as OpenApiHooks, o as ProtectOptions, v as discoverViaSignatureAgent, x as webBotAuthVerifier } from "../server-types-CyRN0-Cd.js";
+import { t as ServerAdapterOptions } from "../bind-YYjvfpB9.js";
 import { i as toRequest, r as sendResponse } from "../http-B_LphE5Y.js";
 import { ErrorRequestHandler, Request, RequestHandler, Response, Router } from "express";
 //#region src/express/create.d.ts

package/dist/express/index.js

@@ -1,7 +1,7 @@
 import { r as hasCredentials } from "../http-DKLXrFGk.js";
 import { l as InvalidSignatureError, p as webBotAuthVerifier, u as discoverViaSignatureAgent } from "../evaluations-IBceAeKT.js";
 import { t as problemFromError } from "../map-error-pasIGqMT.js";
-import { i as decorate, r as bindKernel } from "../bind-D_sZSVA3.js";
+import { i as decorate, r as bindKernel } from "../bind-BNQA9JK9.js";
 import { n as sendResponse, r as toRequest } from "../http-DH94eh6f.js";
 import express from "express";
 //#region src/express/create.ts

package/dist/fastify/index.d.ts

@@ -1,8 +1,8 @@
-import { T as Policy, j as PolicyVocabulary, sr as Principal } from "../policy-types-CCiDRZBH.js";
+import { T as Policy, j as PolicyVocabulary, pr as Principal } from "../policy-types-DGIO_gxq.js";
 import { u as Permission } from "../permission-types-CAY-GU7e.js";
-import { a as PermDock } from "../permdock-B6Sf4T_S.js";
-import { f as InvalidSignatureError, i as OpenApiHooks, o as ProtectOptions, v as discoverViaSignatureAgent, x as webBotAuthVerifier } from "../server-types-CIlpSA2G.js";
-import { t as ServerAdapterOptions } from "../bind-Cp2hBHzP.js";
+import { a as PermDock } from "../permdock-CprAPN3w.js";
+import { f as InvalidSignatureError, i as OpenApiHooks, o as ProtectOptions, v as discoverViaSignatureAgent, x as webBotAuthVerifier } from "../server-types-CyRN0-Cd.js";
+import { t as ServerAdapterOptions } from "../bind-YYjvfpB9.js";
 import { FastifyPluginAsync, FastifyReply, FastifyRequest, FastifySchema, FastifyTypeProvider, FastifyTypeProviderDefault, RawRequestDefaultExpression, RawServerDefault, RouteGenericInterface } from "fastify";
 //#region src/server/http.d.ts
 /** A Fastify-style reply: `code`, `header` and `send`. */

package/dist/fastify/index.js

@@ -1,7 +1,7 @@
 import { c as writeReply, i as headersFrom, n as firstHeader, r as hasCredentials, t as fetchRequest } from "../http-DKLXrFGk.js";
 import { l as InvalidSignatureError, p as webBotAuthVerifier, u as discoverViaSignatureAgent } from "../evaluations-IBceAeKT.js";
 import { t as problemFromError } from "../map-error-pasIGqMT.js";
-import { i as decorate, r as bindKernel } from "../bind-D_sZSVA3.js";
+import { i as decorate, r as bindKernel } from "../bind-BNQA9JK9.js";
 //#region src/fastify/http.ts
 function toRequest(request) {
 	const host = firstHeader(request.headers.host) ?? "localhost";

package/dist/{fetch-adapter-C1DCvpqV.d.ts → fetch-adapter-BIbBAtPZ.d.ts}

@@ -1,8 +1,8 @@
 import { u as Permission } from "./permission-types-CAY-GU7e.js";
 import { a as OperationInput, t as Operation } from "./operations-Ci_rT6Uo.js";
 import { n as RevocationFeed } from "./revocations-BaUXHM1N.js";
-import { o as ProtectOptions } from "./server-types-CIlpSA2G.js";
-import { t as ServerAdapterOptions } from "./bind-Cp2hBHzP.js";
+import { o as ProtectOptions } from "./server-types-CyRN0-Cd.js";
+import { t as ServerAdapterOptions } from "./bind-YYjvfpB9.js";
 //#region src/server/fetch-adapter.d.ts
 /**
  * What `protect` checks: a permission, an operation from `defineOperations`, or

package/dist/{fetch-adapter-JL43jD3E.js → fetch-adapter-dPTgJVHd.js}

@@ -3,7 +3,7 @@ import { o as isPermission } from "./permission-registry-B8tYxPIt.js";
 import { r as hasCredentials } from "./http-DKLXrFGk.js";
 import { o as methodNotAllowed } from "./problem-BVLHFK33.js";
 import { t as problemFromError } from "./map-error-pasIGqMT.js";
-import { i as decorate, r as bindKernel } from "./bind-D_sZSVA3.js";
+import { i as decorate, r as bindKernel } from "./bind-BNQA9JK9.js";
 //#region src/server/fetch-adapter.ts
 /**
 * `protect(target, data, options)(handler)` for a framework whose routes are

package/dist/{fields-D0vUI6dq.js → fields-DI8s3cPl.js}

@@ -1,7 +1,7 @@
 import { a as sole } from "./compact-CAf557ZB.js";
 import { i as configError } from "./errors-Vpu6rKHl.js";
 import { c as jsonSchemaOf } from "./catalog-doc-DjMKzJp9.js";
-import { A as quoteQualified, D as qualified, E as helperSchema, O as quoteIdent, _ as subjectClaimJsonSql, k as quoteLiteral, s as signedIn } from "./shared-Afctg7B0.js";
+import { A as quoteQualified, D as qualified, E as helperSchema, O as quoteIdent, _ as subjectClaimJsonSql, k as quoteLiteral, s as signedIn } from "./shared-DrGLwM3s.js";
 //#region src/cli/sql/clauses.ts
 /**
 * True when `sql` is one parenthesised expression, so AND / OR need not wrap it

package/dist/{gen-DWCYcMQM.js → gen-DuAhghDw.js}

@@ -7,10 +7,10 @@ import { t as byCodePoint } from "./compare-DTfyUunF.js";
 import { i as configError, n as CliError } from "./errors-Vpu6rKHl.js";
 import { c as jsonSchemaOf } from "./catalog-doc-DjMKzJp9.js";
 import { c as requirePolicy } from "./load-DjSU5KXO.js";
-import { t as loadConfiguredOperations } from "./catalog-operations-Dadrl7Z-.js";
+import { t as loadConfiguredOperations } from "./catalog-operations-DeHTrJSV.js";
 import { n as fileSummary, r as planFiles } from "./files-B3AA05f1.js";
 import { f as writeOutputFiles, r as driftOf } from "./output-files-BIQ_9pIs.js";
-import { t as resolveNames } from "./resolve-names-CF7xXLSG.js";
+import { t as resolveNames } from "./resolve-names-Y1Cb22cp.js";
 import { i as schemaExpression } from "./generate-CezbCaTI.js";
 import { existsSync, readFileSync } from "node:fs";
 import { dirname, extname, relative, resolve } from "node:path";

package/dist/{gen-B5kvbAoZ.js → gen-DwgCSC6V.js}

@@ -41,7 +41,7 @@ const gen = defineLeaf({
 		const out = given(flags.out);
 		const outDir = given(flags["out-dir"]);
 		const from = given(flags.policy);
-		const { runGen } = await import("./gen-DWCYcMQM.js");
+		const { runGen } = await import("./gen-DuAhghDw.js");
 		return runGen({
 			cwd: ctx.cwd,
 			config: ctx.config,

package/dist/h3/index.d.ts

@@ -1,7 +1,7 @@
-import { Gt as Snapshot, T as Policy, j as PolicyVocabulary, sr as Principal } from "../policy-types-CCiDRZBH.js";
-import { a as PermDock } from "../permdock-B6Sf4T_S.js";
-import { D as ConnectionOptions, T as Connection, f as InvalidSignatureError, i as OpenApiHooks, u as SnapshotQuery, v as discoverViaSignatureAgent, x as webBotAuthVerifier } from "../server-types-CIlpSA2G.js";
-import { a as ProtectTarget, n as FetchAdapterOptions, r as FetchProtect, t as ContextReader } from "../fetch-adapter-C1DCvpqV.js";
+import { T as Policy, Zt as Snapshot, j as PolicyVocabulary, pr as Principal } from "../policy-types-DGIO_gxq.js";
+import { a as PermDock } from "../permdock-CprAPN3w.js";
+import { D as ConnectionOptions, T as Connection, f as InvalidSignatureError, i as OpenApiHooks, u as SnapshotQuery, v as discoverViaSignatureAgent, x as webBotAuthVerifier } from "../server-types-CyRN0-Cd.js";
+import { a as ProtectTarget, n as FetchAdapterOptions, r as FetchProtect, t as ContextReader } from "../fetch-adapter-BIbBAtPZ.js";
 import { EventHandler, H3Event, H3EventContext, Middleware } from "h3";
 //#region src/h3/create.d.ts
 type H3PermDockOptions<TUser = unknown> = FetchAdapterOptions<H3Event, TUser>;

package/dist/h3/index.js

@@ -1,6 +1,6 @@
 import { l as InvalidSignatureError, p as webBotAuthVerifier, u as discoverViaSignatureAgent } from "../evaluations-IBceAeKT.js";
-import { i as decorate } from "../bind-D_sZSVA3.js";
-import { t as fetchAdapter } from "../fetch-adapter-JL43jD3E.js";
+import { i as decorate } from "../bind-BNQA9JK9.js";
+import { t as fetchAdapter } from "../fetch-adapter-dPTgJVHd.js";
 //#region src/h3/create.ts
 function createPermDock(policy, options) {
 	const adapter = fetchAdapter(policy, options, "h3", (event) => event.req);

package/dist/hono/index.d.ts

@@ -1,9 +1,9 @@
-import { T as Policy, j as PolicyVocabulary, sr as Principal } from "../policy-types-CCiDRZBH.js";
+import { T as Policy, j as PolicyVocabulary, pr as Principal } from "../policy-types-DGIO_gxq.js";
 import { u as Permission } from "../permission-types-CAY-GU7e.js";
-import { a as PermDock } from "../permdock-B6Sf4T_S.js";
+import { a as PermDock } from "../permdock-CprAPN3w.js";
 import { n as RevocationFeed } from "../revocations-BaUXHM1N.js";
-import { D as ConnectionOptions, T as Connection, f as InvalidSignatureError, i as OpenApiHooks, o as ProtectOptions, v as discoverViaSignatureAgent, x as webBotAuthVerifier } from "../server-types-CIlpSA2G.js";
-import { t as ServerAdapterOptions } from "../bind-Cp2hBHzP.js";
+import { D as ConnectionOptions, T as Connection, f as InvalidSignatureError, i as OpenApiHooks, o as ProtectOptions, v as discoverViaSignatureAgent, x as webBotAuthVerifier } from "../server-types-CyRN0-Cd.js";
+import { t as ServerAdapterOptions } from "../bind-YYjvfpB9.js";
 import { Context, Hono, MiddlewareHandler } from "hono";
 import { SSEMessage, SSEStreamingApi } from "hono/streaming";
 import { WSEvents } from "hono/ws";

package/dist/hono/index.js

@@ -2,7 +2,7 @@ import { t as compact } from "../compact-CAf557ZB.js";
 import { r as PermDockRevokedError } from "../errors-B6R_lg2a.js";
 import { l as InvalidSignatureError, p as webBotAuthVerifier, u as discoverViaSignatureAgent } from "../evaluations-IBceAeKT.js";
 import { t as problemFromError } from "../map-error-pasIGqMT.js";
-import { r as bindKernel } from "../bind-D_sZSVA3.js";
+import { r as bindKernel } from "../bind-BNQA9JK9.js";
 import { a as onRevoked, n as closeReason, r as guardIterable, t as POLICY_VIOLATION } from "../stream-CDvF0sJm.js";
 import { Hono } from "hono";
 //#region src/hono/create.ts

package/dist/{hosted-Cmtxogd0.d.ts → hosted-DVxlLZMe.d.ts}

@@ -1,4 +1,4 @@
-import { T as Policy, a as ApprovalRequirement, mr as Condition, wn as Grantee } from "./policy-types-CCiDRZBH.js";
+import { An as Grantee, T as Policy, a as ApprovalRequirement, br as Condition } from "./policy-types-DGIO_gxq.js";
 //#region src/core/hosted.d.ts
 /**
  * One grant authored in PermDock Cloud; its grantee is a declared role, plan or

package/dist/{import-CST57XLp.js → import-CNBF96hB.js}

@@ -2,9 +2,9 @@ import { r as isRecord } from "./compact-CAf557ZB.js";
 import { i as configError, u as usageResult } from "./errors-Vpu6rKHl.js";
 import { s as writeFileEnsuringDir } from "./files-BSjrtIHw.js";
 import { r as escapeSqlIdent, s as quoteSqlLiteral } from "./sql-0WjxIp9g.js";
-import { C as parseMembershipsFlag, r as HELPERS } from "./shared-Afctg7B0.js";
+import { C as parseMembershipsFlag, r as HELPERS } from "./shared-DrGLwM3s.js";
 import { n as pgConnector } from "./pg-DQTqRrou.js";
-import { t as FIELD_VIEWS } from "./fields-D0vUI6dq.js";
+import { t as FIELD_VIEWS } from "./fields-DI8s3cPl.js";
 import { n as emptySchema, r as isSchemaKind, t as emitPermissionsModule } from "./generate-CezbCaTI.js";
 import { existsSync, readFileSync } from "node:fs";
 import { resolve } from "node:path";

package/dist/{import-_YqhhwvX.js → import-Iuk9mx8A.js}

@@ -4,7 +4,7 @@ import { i as readJsonFile } from "./files-BSjrtIHw.js";
 import { t as applyFiles } from "./files-B3AA05f1.js";
 import { n as httpRequest } from "./http-DOL33cO0.js";
 import { i as schemaExpression, t as emitPermissionsModule } from "./generate-CezbCaTI.js";
-import { t as validateOpenapi } from "./schema-Dst9I9Gs.js";
+import { t as validateOpenapi } from "./schema-3PJ8wAeL.js";
 import { existsSync, readFileSync } from "node:fs";
 import { resolve } from "node:path";
 //#region ../../node_modules/.pnpm/yaml@2.9.1/node_modules/yaml/browser/dist/nodes/identity.js

package/dist/{index-BhxEUY9J.d.ts → index-BinlXeU-.d.ts}

@@ -1,5 +1,5 @@
-import { T as Policy, sr as Principal, ut as TokenSigner } from "./policy-types-CCiDRZBH.js";
-import { E as SsfPermDockOptions, O as SsfStreamConfiguration, T as SsfPermDock, _ as SetSubject, c as PushSetOptions, d as SetDelivery, g as SetQueue, h as SetPollHandlerOptions, k as SsfStreamStatus, m as SetEvent, p as SetError, t as CaepCommon, v as SignSetOptions } from "./types-DjuMBNF9.js";
+import { T as Policy, mt as TokenSigner, pr as Principal } from "./policy-types-DGIO_gxq.js";
+import { E as SsfPermDockOptions, O as SsfStreamConfiguration, T as SsfPermDock, _ as SetSubject, c as PushSetOptions, d as SetDelivery, g as SetQueue, h as SetPollHandlerOptions, k as SsfStreamStatus, m as SetEvent, p as SetError, t as CaepCommon, v as SignSetOptions } from "./types-DsHGPtkR.js";
 //#region src/ssf/create.d.ts
 declare function createPermDock<TUser, TPrincipal extends Principal = Principal>(policy: Policy<TUser, TPrincipal>, options: SsfPermDockOptions): SsfPermDock;
 //#endregion

package/dist/{index-B8s204GL.d.ts → index-CV-7DWeD.d.ts}

@@ -1,8 +1,8 @@
-import { Ct as Credential, Ln as Decision, St as ApiKeyPrincipal, T as Policy, Tt as CredentialKind, U as CredentialVerifier, Zt as AuthEvent, at as SettingsSource, dt as TokenVerifier, gt as SupportSession, j as PolicyVocabulary, lr as Subject, lt as TokenFailureCause, q as DecisionSink, sr as Principal, ut as TokenSigner } from "./policy-types-CCiDRZBH.js";
+import { J as DecisionSink, Ot as ApiKeyPrincipal, St as SupportSession, T as Policy, U as CredentialVerifier, Un as Decision, hr as Subject, ht as TokenVerifier, j as PolicyVocabulary, jt as CredentialKind, kt as Credential, mt as TokenSigner, pr as Principal, pt as TokenFailureCause, rn as AuthEvent, st as SettingsSource } from "./policy-types-DGIO_gxq.js";
 import { f as PermissionTree, u as Permission } from "./permission-types-CAY-GU7e.js";
-import { _ as PrincipalSource } from "./permdock-B6Sf4T_S.js";
-import { a as ProblemDetails, s as Disclosure, t as ApprovalHint } from "./errors-zi_4T-rx.js";
-import { c as ServerPermDock, l as ServerPermDockOptions } from "./server-types-CIlpSA2G.js";
+import { _ as PrincipalSource } from "./permdock-CprAPN3w.js";
+import { a as ProblemDetails, s as Disclosure, t as ApprovalHint } from "./errors-BIM4MFsJ.js";
+import { c as ServerPermDock, l as ServerPermDockOptions } from "./server-types-CyRN0-Cd.js";
 //#region src/server/create.d.ts
 /**
  * The Fetch factory behind every HTTP adapter. The subject and actor are