permdock 0.8.0 → 0.9.0

package/dist/collect-D-eroIfV.js

@@ -0,0 +1 @@
+export { r as runCollect } from "./collect-WCl8cJQV.js";

package/dist/{collect-B7ZFAJU3.js → collect-WCl8cJQV.js}

@@ -2,7 +2,7 @@ import { a as describeError } from "./errors-Vpu6rKHl.js";
 import { a as rel, r as listSourceFiles, s as writeFileEnsuringDir, t as defaultSrcPath } from "./files-BSjrtIHw.js";
 import { n as catalogForCompare, o as formatCatalogJson, r as catalogForDrift, t as buildCatalog } from "./catalog-doc-DjMKzJp9.js";
 import { a as loadModule, i as loadConfiguredPolicy, r as leavesOf, s as pickNamed, t as asPermissionTree } from "./load-DjSU5KXO.js";
-import { t as loadConfiguredOperations } from "./catalog-operations-Dadrl7Z-.js";
+import { t as loadConfiguredOperations } from "./catalog-operations-DeHTrJSV.js";
 import { t as catalogPath } from "./catalog-path-CnI0XTFK.js";
 import { t as shortDiff } from "./text-diff-BtfSmdUo.js";
 import { existsSync, readFileSync } from "node:fs";

package/dist/compile/index.d.ts

@@ -1,3 +1,3 @@
 import { n as GraphSqlPart, r as RelationsMapping, t as GraphSql } from "../graph-sql-BwFC4Qjs.js";
-import { a as CompiledWhere, c as compileWhere, i as CompiledSql, l as escapeLike, n as CompiledCompare, o as MembershipTable, r as CompiledExists, s as MembershipsMapping, t as CompileWhereOptions } from "../compile-BFzysW3o.js";
+import { a as CompiledWhere, c as compileWhere, i as CompiledSql, l as escapeLike, n as CompiledCompare, o as MembershipTable, r as CompiledExists, s as MembershipsMapping, t as CompileWhereOptions } from "../compile-BEklRUYo.js";
 export { type CompileWhereOptions, type CompiledCompare, type CompiledExists, type CompiledSql, type CompiledWhere, type GraphSql, type GraphSqlPart, type MembershipTable, type MembershipsMapping, type RelationsMapping, compileWhere, escapeLike };

package/dist/{compile-BFzysW3o.d.ts → compile-BEklRUYo.d.ts}

@@ -1,6 +1,6 @@
-import { Rt as Instant, fn as Scope, lr as Subject, mr as Condition } from "./policy-types-CCiDRZBH.js";
+import { Wt as Instant, br as Condition, hr as Subject, vn as Scope } from "./policy-types-DGIO_gxq.js";
 import { b as ResourceNode } from "./permission-types-CAY-GU7e.js";
-import { f as WhereResult } from "./permdock-B6Sf4T_S.js";
+import { f as WhereResult } from "./permdock-CprAPN3w.js";
 import { r as RelationsMapping, t as GraphSql } from "./graph-sql-BwFC4Qjs.js";
 //#region src/conditions/compile.d.ts
 type MembershipTable = {

package/dist/{completion-saoYiRFO.js → completion-_bc0OUQ-.js}

@@ -1,6 +1,6 @@
 import { n as CliError } from "./errors-Vpu6rKHl.js";
 import { a as suggestion, o as GLOBAL_FLAGS } from "./args-0FrVs5EH.js";
-import { a as resolve } from "./manifest-Cgiq5oqc.js";
+import { a as resolve } from "./manifest-B2QPh19C.js";
 import { t as defineLeaf } from "./command-L8EstFNm.js";
 //#region src/cli/core/completion.ts
 const SHELLS = [

package/dist/{config-DBeXXmBF.js → config-D5XrLWpk.js}

@@ -10,7 +10,7 @@ const config = defineLeaf({
 		...failOnFlag
 	},
 	async run(ctx, { flags }) {
-		const { runConfig } = await import("./config-report-BipSWA6V.js");
+		const { runConfig } = await import("./config-report-BmWIskD7.js");
 		return runConfig({
 			cwd: ctx.cwd,
 			config: ctx.config,

package/dist/{config-report-BipSWA6V.js → config-report-BmWIskD7.js}

@@ -1,9 +1,9 @@
 import { a as rel, t as defaultSrcPath } from "./files-BSjrtIHw.js";
 import { r as CONFIG_REPORT_SCHEMA } from "./version-DMQ0dnN5.js";
 import { t as catalogPath } from "./catalog-path-CnI0XTFK.js";
-import { n as guessPermissions, t as barrelFile } from "./collect-B7ZFAJU3.js";
+import { n as guessPermissions, t as barrelFile } from "./collect-WCl8cJQV.js";
 import "./sources-CMAM-2A3.js";
-import { t as DOCS_BASE } from "./manifest-Cgiq5oqc.js";
+import { t as DOCS_BASE } from "./manifest-B2QPh19C.js";
 import { n as MIGRATION_DIRS, t as DEFAULT_SENSITIVE_ACTIONS } from "./constants-DcJABbLW.js";
 //#region src/cli/config-report.ts
 function configReport(input) {

package/dist/convex/index.d.ts

@@ -1,8 +1,8 @@
-import { T as Policy, j as PolicyVocabulary, sr as Principal } from "../policy-types-CCiDRZBH.js";
+import { T as Policy, j as PolicyVocabulary, pr as Principal } from "../policy-types-DGIO_gxq.js";
 import { u as Permission } from "../permission-types-CAY-GU7e.js";
-import { a as PermDock } from "../permdock-B6Sf4T_S.js";
-import { a as ProblemDetails, r as PermDockDeniedError } from "../errors-zi_4T-rx.js";
-import { t as InstanceOptions } from "../instance-options-B0KXqTrJ.js";
+import { a as PermDock } from "../permdock-CprAPN3w.js";
+import { a as ProblemDetails, r as PermDockDeniedError } from "../errors-BIM4MFsJ.js";
+import { t as InstanceOptions } from "../instance-options-CoHn-0e8.js";
 //#region src/convex/types.d.ts
 type ConvexContextLike = {
   readonly auth?: {

package/dist/convex/index.js

@@ -1,8 +1,8 @@
 import { t as compact } from "../compact-CAf557ZB.js";
 import { n as PermDockValidationError } from "../validation-error-CYg2kJEw.js";
 import { n as PermDockDeniedError, t as PermDockApprovalRequiredError } from "../errors-B6R_lg2a.js";
-import { l as withApp } from "../permdock-L-_I_3zP.js";
-import { n as resolveOrNull, t as buildInstance } from "../build-instance-CNWaYJyr.js";
+import { l as withApp } from "../permdock-BvjivVb9.js";
+import { n as resolveOrNull, t as buildInstance } from "../build-instance-BWXqwQYU.js";
 import { n as tenantScope, t as actorFrom } from "../adapter-context-CIQpQxbE.js";
 //#region src/convex/create.ts
 /**

package/dist/{core-hWIARPDz.d.ts → core-CFepFiDP.d.ts}

@@ -1,6 +1,6 @@
-import { Ln as Decision, T as Policy, or as Membership, tr as CustomRole } from "./policy-types-CCiDRZBH.js";
+import { T as Policy, Un as Decision, fr as Membership, sr as CustomRole } from "./policy-types-DGIO_gxq.js";
 import { u as Permission } from "./permission-types-CAY-GU7e.js";
-import { f as WhereResult, o as PermDockOptions } from "./permdock-B6Sf4T_S.js";
+import { f as WhereResult, o as PermDockOptions } from "./permdock-CprAPN3w.js";
 //#region src/testing/policy-matrix.d.ts
 type MatrixOutcome = "granted" | "denied" | "approval-required";
 type MatrixCell = MatrixOutcome | {

package/dist/{core-H-mbhpZc.js → core-DzVINFbU.js}

@@ -1,10 +1,10 @@
-import { A as memoryCustomRoleSource } from "./src-DZ0l9UAg.js";
+import { j as memoryCustomRoleSource } from "./src-C_pi2Rnh.js";
 import { c as listPermissions } from "./permission-registry-B8tYxPIt.js";
 import { f as scopeList } from "./scopes-0Up_UA2t.js";
-import { y as membershipsClaim } from "./evaluate-Dd8Ta0Ie.js";
+import { y as membershipsClaim } from "./evaluate-BAmf_AQd.js";
 import { n as parseSnapshot } from "./snapshot-CXlzi69u.js";
 import { n as fromSnapshot } from "./from-snapshot-DCakWRsr.js";
-import { t as getPermDock } from "./permdock-L-_I_3zP.js";
+import { t as getPermDock } from "./permdock-BvjivVb9.js";
 import { c as quoteSqlTable, n as defaultSqlCommand, o as quoteSqlIdent, t as SQL_IDENT } from "./sql-0WjxIp9g.js";
 import "./budget-BELja5A9.js";
 //#region src/testing/policy-matrix.ts

package/dist/{create-Cq4Uox0f.js → create-6EwRQlig.js}

@@ -1,10 +1,10 @@
 import { t as compact } from "./compact-CAf557ZB.js";
 import { n as freezeDeep } from "./freeze-jjan0lCv.js";
 import { o as deniedFor } from "./where-scope-DlCdCM_8.js";
-import { l as withApp } from "./permdock-L-_I_3zP.js";
+import { l as withApp } from "./permdock-BvjivVb9.js";
 import { t as composeWraps } from "./wrap-B2wziJI_.js";
-import { r as instanceOptions } from "./build-instance-CNWaYJyr.js";
-import { n as createAgentKernel } from "./kernel-C-fYydV2.js";
+import { r as instanceOptions } from "./build-instance-BWXqwQYU.js";
+import { n as createAgentKernel } from "./kernel-qv4cr9w8.js";
 //#region src/agent/create.ts
 function modelRow(modelId) {
 	return { id: modelId };

package/dist/{create-_noSrY1T.js → create-BLPKnJKa.js}

@@ -3,13 +3,13 @@ import { n as freezeDeep } from "./freeze-jjan0lCv.js";
 import { n as problemDetails } from "./problem-details-CLDgX1KV.js";
 import { c as listPermissions } from "./permission-registry-B8tYxPIt.js";
 import { n as resourceRef } from "./resource-ref-CaS9yVPi.js";
-import { i as challengeScope, l as withApp } from "./permdock-L-_I_3zP.js";
+import { i as challengeScope, l as withApp } from "./permdock-BvjivVb9.js";
 import { r as hasCredentials } from "./http-DKLXrFGk.js";
 import { a as decisionResponse, c as problemFromDecision, d as unauthenticatedProblem, s as notFoundProblem, t as ANONYMOUS } from "./problem-BVLHFK33.js";
-import { n as resolveOrNull } from "./build-instance-CNWaYJyr.js";
+import { n as resolveOrNull } from "./build-instance-BWXqwQYU.js";
 import { _ as LOAD_FAILED, l as InvalidSignatureError, n as applyApprovalResume, o as evaluationsHandler } from "./evaluations-IBceAeKT.js";
 import { n as tenantScope, t as actorFrom } from "./adapter-context-CIQpQxbE.js";
-import { n as requestContext, t as buildReportingInstance } from "./request-context-C25ilqiJ.js";
+import { n as requestContext, t as buildReportingInstance } from "./request-context-Duzdf0cd.js";
 //#region src/server/kernel-problems.ts
 const NOT_DELEGATED = freezeDeep({
 	outcome: "denied",
@@ -170,6 +170,11 @@ async function resolveActor(request, options) {
 	return (options.webBotAuth === void 0 ? void 0 : await options.webBotAuth.verify(request)) ?? actorFrom(options.actor, request);
 }
 const NO_TENANT = "\0";
+const READ_METHODS = /* @__PURE__ */ new Set([
+	"GET",
+	"HEAD",
+	"OPTIONS"
+]);
 /**
 * The Fetch factory behind every HTTP adapter. The subject and actor are
 * resolved once per `Request`; one instance is cached per `(Request, tenant)`,
@@ -200,7 +205,17 @@ function createPermDock(policy, given) {
 		return resolved;
 	};
 	const reporters = /* @__PURE__ */ new WeakMap();
-	const instanceFor = async ({ user, actor, context, errors }, tenant) => {
+	const intentOf = (request) => {
+		let chosen;
+		try {
+			chosen = options.intent?.(request);
+		} catch {
+			return "write";
+		}
+		if (chosen === void 0) return READ_METHODS.has(request.method) ? "read" : "write";
+		return chosen === "read" ? "read" : "write";
+	};
+	const instanceFor = async ({ user, actor, context, errors }, tenant, intent) => {
 		const built = await buildReportingInstance({
 			policy,
 			user,
@@ -208,7 +223,8 @@ function createPermDock(policy, given) {
 			scope: {
 				tenant,
 				actor,
-				context
+				context,
+				intent
 			},
 			errors,
 			wrap: (created) => options.wrap === void 0 ? created : options.wrap(created)
@@ -231,7 +247,7 @@ function createPermDock(policy, given) {
 		const key = tenant ?? NO_TENANT;
 		const hit = byTenant.get(key);
 		if (hit !== void 0) return hit;
-		const built = (async () => instanceFor(await resolveSubject(request), tenant))();
+		const built = (async () => instanceFor(await resolveSubject(request), tenant, intentOf(request)))();
 		byTenant.set(key, built);
 		return built;
 	};
@@ -239,7 +255,7 @@ function createPermDock(policy, given) {
 		const { tenant } = scope ?? await tenantScope(options.tenant, request);
 		return (await import("./connection-B72dg5Q2.js")).openConnection({
 			open: async () => (await build(request, { tenant })).permdock,
-			rebuild: async () => (await instanceFor(await freshSubject(request), tenant)).permdock,
+			rebuild: async () => (await instanceFor(await freshSubject(request), tenant, "write")).permdock,
 			tenant,
 			...options.revocations === void 0 ? {} : { feed: options.revocations },
 			adapter,

package/dist/{create-BSNrVuxh.d.ts → create-BPUopdfL.d.ts}

@@ -1,13 +1,13 @@
-import { Ln as Decision, T as Policy, j as PolicyVocabulary, lr as Subject, rr as Delegation, sr as Principal } from "./policy-types-CCiDRZBH.js";
+import { T as Policy, Un as Decision, hr as Subject, j as PolicyVocabulary, lr as Delegation, pr as Principal } from "./policy-types-DGIO_gxq.js";
 import { u as Permission } from "./permission-types-CAY-GU7e.js";
 import { t as Operation } from "./operations-Ci_rT6Uo.js";
-import { a as PermDock } from "./permdock-B6Sf4T_S.js";
-import { m as ApprovalStore } from "./types-B_tiYvk8.js";
-import { t as InstanceOptions } from "./instance-options-B0KXqTrJ.js";
+import { a as PermDock } from "./permdock-CprAPN3w.js";
+import { m as ApprovalStore } from "./types-DLvhVm1r.js";
+import { t as InstanceOptions } from "./instance-options-CoHn-0e8.js";
 import { t as RequestContext } from "./request-context-C2_1lchh.js";
-import { n as PermDockWrap } from "./wrap-DlJE3gS_.js";
-import { o as OtelWrap } from "./types-DHKPcqzr.js";
-import { t as DeniedText } from "./denied-text-CHNlVInN.js";
+import { n as PermDockWrap } from "./wrap-DxXB54Wu.js";
+import { o as OtelWrap } from "./types-B6ExllNo.js";
+import { t as DeniedText } from "./denied-text-DHldhVUv.js";
 //#region src/agent/step-up.d.ts
 /**
  * What the user can do to lift a denial: authenticate again with the `acr` and

package/dist/{create-CM1FciYG.d.ts → create-BamXmeob.d.ts}

@@ -1,10 +1,10 @@
-import { Ln as Decision, Rn as Denial, Rt as Instant, T as Policy, Zt as AuthEvent, dt as TokenVerifier, j as PolicyVocabulary, sr as Principal, ut as TokenSigner } from "./policy-types-CCiDRZBH.js";
+import { T as Policy, Un as Decision, Wn as Denial, Wt as Instant, ht as TokenVerifier, j as PolicyVocabulary, mt as TokenSigner, pr as Principal, rn as AuthEvent } from "./policy-types-DGIO_gxq.js";
 import { u as Permission } from "./permission-types-CAY-GU7e.js";
-import { _ as PrincipalSource, a as PermDock, n as DecideOptions, o as PermDockOptions } from "./permdock-B6Sf4T_S.js";
-import { m as ApprovalStore } from "./types-B_tiYvk8.js";
-import { a as AutomationSource } from "./automation-DqEoWHBc.js";
-import { n as ApprovalWaiter } from "./waiter-Bu9zAlE0.js";
-import { i as RunBinding, r as RunAutomation } from "./run-ticket-DbWI9f99.js";
+import { _ as PrincipalSource, a as PermDock, n as DecideOptions, o as PermDockOptions } from "./permdock-CprAPN3w.js";
+import { m as ApprovalStore } from "./types-DLvhVm1r.js";
+import { a as AutomationSource } from "./automation-C6Jg75xq.js";
+import { n as ApprovalWaiter } from "./waiter-CqUKX6CY.js";
+import { i as RunBinding, r as RunAutomation } from "./run-ticket-B2o2Kxz8.js";
 //#region src/workflow/create.d.ts
 type WorkflowPermDockOptions = PermDockOptions & {
   /** Signs the run tickets `start` mints. */

package/dist/{create-BVq1lNQE.d.ts → create-DBvUsgzK.d.ts}

@@ -1,9 +1,9 @@
-import { In as ApprovalRequiredDecision, T as Policy, Un as GrantedDecision, Vn as DeniedDecision, j as PolicyVocabulary, lr as Subject, sr as Principal } from "./policy-types-CCiDRZBH.js";
+import { Hn as ApprovalRequiredDecision, T as Policy, Yn as GrantedDecision, hr as Subject, j as PolicyVocabulary, pr as Principal, qn as DeniedDecision } from "./policy-types-DGIO_gxq.js";
 import { t as Operation } from "./operations-Ci_rT6Uo.js";
-import { _ as PrincipalSource, a as PermDock, o as PermDockOptions } from "./permdock-B6Sf4T_S.js";
-import { m as ApprovalStore, p as ApprovalStatus } from "./types-B_tiYvk8.js";
+import { _ as PrincipalSource, a as PermDock, o as PermDockOptions } from "./permdock-CprAPN3w.js";
+import { m as ApprovalStore, p as ApprovalStatus } from "./types-DLvhVm1r.js";
 import { n as ApprovalErrorCode } from "./errors-CHwoRRpB.js";
-import { t as ApprovalPrompt } from "./approval-prompt-PYagyQUj.js";
+import { t as ApprovalPrompt } from "./approval-prompt-3BqWczTt.js";
 //#region src/chat/subject.d.ts
 /**
  * The platform user behind a chat message or action. Fill it only from an event

package/dist/delivery/index.d.ts

@@ -1,5 +1,5 @@
-import { an as EmailCategory, rn as DeliveryFailureCause, tn as DeliveryChannel } from "../policy-types-CCiDRZBH.js";
-import { i as approvalUrlFor, n as ApprovalUrl, r as approvalPrompt, t as ApprovalPrompt } from "../approval-prompt-PYagyQUj.js";
-import { _ as TransportOptions, a as DeliveryReport, c as DeliveryTransport, d as EmailTransport, f as EmailUnsubscribe, g as TransportMessages, h as TransportItem, i as DeliveryMessages, l as DeliveryTransports, m as Recipient, n as ChatTransport, o as DeliveryResult, p as OutgoingEmail, r as DeliverOptions, s as DeliveryTarget, t as ChatMessage, u as EmailMessage, v as WebhookMessage, y as WebhookTransport } from "../types-yUuPR5Hy.js";
-import { C as audience, S as SubscriberEvent, _ as ParseConnectorResult, a as DeliveryPermDock, b as Audience, c as MemoryDelivery, d as memoryDeliveryTransport, f as CONNECTOR_SCHEMA, g as ConnectorKind, h as ConnectorIssue, i as isDeliveryTarget, l as MemoryDeliveryTransport, m as Connector, n as webhookTransport, o as DeliveryPermDockOptions, p as CONNECTOR_KINDS, r as isAddrSpec, s as createPermDock, t as WebhookTransportOptions, u as MemoryDeliveryTransportOptions, v as SiemDestination, w as subscribersFor, x as AudienceOptions, y as parseConnector } from "../index-Bv5iXPqU.js";
+import { dn as EmailCategory, ln as DeliveryFailureCause, sn as DeliveryChannel } from "../policy-types-DGIO_gxq.js";
+import { i as approvalUrlFor, n as ApprovalUrl, r as approvalPrompt, t as ApprovalPrompt } from "../approval-prompt-3BqWczTt.js";
+import { _ as TransportOptions, a as DeliveryReport, c as DeliveryTransport, d as EmailTransport, f as EmailUnsubscribe, g as TransportMessages, h as TransportItem, i as DeliveryMessages, l as DeliveryTransports, m as Recipient, n as ChatTransport, o as DeliveryResult, p as OutgoingEmail, r as DeliverOptions, s as DeliveryTarget, t as ChatMessage, u as EmailMessage, v as WebhookMessage, y as WebhookTransport } from "../types-CN0LsqbK.js";
+import { C as audience, S as SubscriberEvent, _ as ParseConnectorResult, a as DeliveryPermDock, b as Audience, c as MemoryDelivery, d as memoryDeliveryTransport, f as CONNECTOR_SCHEMA, g as ConnectorKind, h as ConnectorIssue, i as isDeliveryTarget, l as MemoryDeliveryTransport, m as Connector, n as webhookTransport, o as DeliveryPermDockOptions, p as CONNECTOR_KINDS, r as isAddrSpec, s as createPermDock, t as WebhookTransportOptions, u as MemoryDeliveryTransportOptions, v as SiemDestination, w as subscribersFor, x as AudienceOptions, y as parseConnector } from "../index-ymept53A.js";
 export { type ApprovalPrompt, type ApprovalUrl, type Audience, type AudienceOptions, CONNECTOR_KINDS, CONNECTOR_SCHEMA, type ChatMessage, type ChatTransport, type Connector, type ConnectorIssue, type ConnectorKind, type DeliverOptions, type DeliveryChannel, type DeliveryFailureCause, type DeliveryMessages, type DeliveryPermDock, type DeliveryPermDockOptions, type DeliveryReport, type DeliveryResult, type DeliveryTarget, type DeliveryTransport, type DeliveryTransports, type EmailCategory, type EmailMessage, type EmailTransport, type EmailUnsubscribe, type MemoryDelivery, type MemoryDeliveryTransport, type MemoryDeliveryTransportOptions, type OutgoingEmail, type ParseConnectorResult, type Recipient, type SiemDestination, type SubscriberEvent, type TransportItem, type TransportMessages, type TransportOptions, type WebhookMessage, type WebhookTransport, type WebhookTransportOptions, approvalPrompt, approvalUrlFor, audience, createPermDock, isAddrSpec, isDeliveryTarget, memoryDeliveryTransport, parseConnector, subscribersFor, webhookTransport };

package/dist/delivery/index.js

@@ -1,5 +1,5 @@
 import { n as approvalUrlFor, t as approvalPrompt } from "../approval-prompt-B8hQY69x.js";
-import { n as subscribersFor, t as audience } from "../audience-BAkBDMqn.js";
+import { n as subscribersFor, t as audience } from "../audience-DTjR8xet.js";
 import { t as CONNECTOR_SCHEMA } from "../connector-schema-CYLQNMYq.js";
 import { a as parseConnector, i as CONNECTOR_KINDS, n as createPermDock, r as memoryDeliveryTransport, t as webhookTransport } from "../delivery-BupfvJIV.js";
 import { i as isDeliveryTarget, n as isAddrSpec } from "../target-qdEAnnhU.js";

package/dist/{denied-text-CHNlVInN.d.ts → denied-text-DHldhVUv.d.ts}

@@ -1,4 +1,4 @@
-import { Ln as Decision } from "./policy-types-CCiDRZBH.js";
+import { Un as Decision } from "./policy-types-DGIO_gxq.js";
 import { u as Permission } from "./permission-types-CAY-GU7e.js";
 //#region src/agent/denied-text.d.ts
 /**

package/dist/{describe-ByS9LgHK.d.ts → describe-BbFPBSms.d.ts}

@@ -1,4 +1,4 @@
-import { Bn as DenialReason, Ln as Decision, Vn as DeniedDecision } from "./policy-types-CCiDRZBH.js";
+import { Kn as DenialReason, Un as Decision, qn as DeniedDecision } from "./policy-types-DGIO_gxq.js";
 import { u as Permission } from "./permission-types-CAY-GU7e.js";
 //#region src/core/describe.d.ts
 type DecisionDescription = {

package/dist/{diff-CN8IYhC_.js → diff-BwR1JdP2.js}

@@ -21,7 +21,7 @@ const diff = defineLeaf({
 		}
 	},
 	async run(ctx, { flags, args }) {
-		return (await import("./diff-iZWV65nC.js")).runDiff({
+		return (await import("./diff-CQegtBAo.js")).runDiff({
 			cwd: ctx.cwd,
 			config: ctx.config,
 			sources: [args["before"], args["after"]].filter((value) => value !== void 0),

package/dist/{diff-iZWV65nC.js → diff-CQegtBAo.js}

@@ -1,8 +1,8 @@
-import { A as memoryCustomRoleSource } from "./src-DZ0l9UAg.js";
+import { j as memoryCustomRoleSource } from "./src-C_pi2Rnh.js";
 import { n as findPermission } from "./permission-registry-B8tYxPIt.js";
 import { g as secondsOf } from "./time-nR1JesoH.js";
 import { t as canonicalJson } from "./canonical-json-DwilZ1iB.js";
-import { t as getPermDock } from "./permdock-L-_I_3zP.js";
+import { t as getPermDock } from "./permdock-BvjivVb9.js";
 import { i as configError, u as usageResult } from "./errors-Vpu6rKHl.js";
 import { t as buildCatalog } from "./catalog-doc-DjMKzJp9.js";
 import { a as loadModule, n as asPolicy, s as pickNamed } from "./load-DjSU5KXO.js";

package/dist/{doctor-CHD1M9R5.js → doctor-ClRVAtXQ.js}

@@ -5,7 +5,7 @@ import { t as canonicalJson } from "./canonical-json-DwilZ1iB.js";
 import { f as scopeList, o as normalizeMemberships, s as resolveScope } from "./scopes-0Up_UA2t.js";
 import { o as flattenGrantee } from "./grantee-Dke-9rd1.js";
 import { u as separationConflicts } from "./policy-CLQ8__GF.js";
-import { T as validateCustomRole } from "./evaluate-Dd8Ta0Ie.js";
+import { T as validateCustomRole } from "./evaluate-BAmf_AQd.js";
 import { s as parseCredential } from "./credential-CyyyvCsL.js";
 import { a as describeError } from "./errors-Vpu6rKHl.js";
 import { t as policyRowConditionKeys } from "./row-conditions-BAGHOmVq.js";
@@ -14,7 +14,7 @@ import { i as DOCTOR_REPORT_SCHEMA } from "./version-DMQ0dnN5.js";
 import { c as jsonSchemaOf, i as catalogOAuthScopes } from "./catalog-doc-DjMKzJp9.js";
 import { a as loadModule, i as loadConfiguredPolicy, n as asPolicy, s as pickNamed } from "./load-DjSU5KXO.js";
 import { t as catalogPath } from "./catalog-path-CnI0XTFK.js";
-import { r as runCollect } from "./collect-B7ZFAJU3.js";
+import { r as runCollect } from "./collect-WCl8cJQV.js";
 import { i as qualifySqlTable, s as quoteSqlLiteral } from "./sql-0WjxIp9g.js";
 import { a as scopeMembershipTable } from "./compile-EzEMB-7v.js";
 import { n as supabaseTenantClaim } from "./budget-BELja5A9.js";
@@ -22,23 +22,23 @@ import { d as keptKeys, r as PERMDOCK_SCHEMA } from "./sources-CMAM-2A3.js";
 import { t as parseCatalog } from "./parse-1_ZheTW5.js";
 import "./markers-BeHZ4x9Q.js";
 import { t as didYouMean } from "./args-0FrVs5EH.js";
-import { t as DOCS_BASE } from "./manifest-Cgiq5oqc.js";
+import { t as DOCS_BASE } from "./manifest-B2QPh19C.js";
 import { t as createStyle } from "./style-Ds11Hmk4.js";
-import { a as nonEmptyOr, r as findingOf } from "./output-tkju6U7R.js";
-import { i as runSkillsInstall } from "./skills-Bjj7BNEQ.js";
+import { a as nonEmptyOr, r as findingOf } from "./output-DV5dwOTs.js";
+import { i as runSkillsInstall } from "./skills-CQQcuGBi.js";
 import { n as MIGRATION_DIRS, t as DEFAULT_SENSITIVE_ACTIONS } from "./constants-DcJABbLW.js";
 import { l as partPath } from "./output-files-BIQ_9pIs.js";
-import { _ as supabaseConfig, a as supabaseHookManifest, c as pd039, g as readSupabaseConfig, h as pd074, m as pd045, n as hookOut, p as attrsPlan, u as resolveSchemas } from "./supabase-hook-B-yXnzUl.js";
-import { G as byKey, Q as graphSqlName, n as tableNameOf, o as graphPlan, r as tableNames } from "./tables-DeMNEy6V.js";
-import { a as guardedTables, p as contextRefs, r as unsatisfiedKinds, t as ownershipRules } from "./ownership-B4L59T9u.js";
+import { _ as supabaseConfig, a as supabaseHookManifest, c as pd039, g as readSupabaseConfig, h as pd074, m as pd045, n as hookOut, p as attrsPlan, u as resolveSchemas } from "./supabase-hook-CrgU06WH.js";
+import { G as byKey, Q as graphSqlName, n as tableNameOf, o as graphPlan, r as tableNames } from "./tables-BqrxBCir.js";
+import { a as guardedTables, p as contextRefs, r as unsatisfiedKinds, t as ownershipRules } from "./ownership-DA5YdYTm.js";
 import { t as membershipSourcesOf } from "./sources-qoIJQrJv.js";
 import { i as group, n as membershipColumns, o as sqlStatements, r as tableKey } from "./deciding-columns-NB4wcyBf.js";
-import { t as resolveNames } from "./resolve-names-CF7xXLSG.js";
+import { t as resolveNames } from "./resolve-names-ConCSj1y.js";
 import { t as FIELD_VIEWS } from "./fields-D0vUI6dq.js";
-import { a as pd010, c as pd014, d as pd038, f as pd041, i as pd008, l as pd015, n as pd001, o as pd011, p as pd057, r as pd007, s as pd013, t as runUsage, u as pd036 } from "./usage-CxEzS4ey.js";
-import { d as rowConditionMessage, f as commandFor, m as tableFor, p as compileGrants, s as ROW_CONDITION_FIX, u as helperTablePolicies } from "./verify-DZeqoWu5.js";
-import { a as streamOf, i as scopeSourcesOf, r as staleFiles, t as powersyncFiles } from "./powersync-DHNQX06W.js";
-import { a as generateOptions, c as buildContext, n as inheritTargets, o as isRefusal, t as supautilsRejections } from "./supautils-BU-pAEpf.js";
+import { a as pd010, c as pd014, d as pd038, f as pd041, i as pd008, l as pd015, n as pd001, o as pd011, p as pd057, r as pd007, s as pd013, t as runUsage, u as pd036 } from "./usage-B9EtHWLa.js";
+import { d as rowConditionMessage, f as commandFor, m as tableFor, p as compileGrants, s as ROW_CONDITION_FIX, u as helperTablePolicies } from "./verify-DlUcTDBz.js";
+import { a as streamOf, i as scopeSourcesOf, r as staleFiles, t as powersyncFiles } from "./powersync-CJrT1DSc.js";
+import { a as buildContext, n as generateOptions, r as isRefusal, s as inheritTargets, t as supautilsRejections } from "./supautils-ByezN3b8.js";
 import { n as legacyHelperNames, r as retirePlan, t as legacyHelperCalls } from "./retire-B2xffQgY.js";
 import { existsSync, readFileSync, readdirSync, statSync } from "node:fs";
 import { basename, dirname, join, resolve } from "node:path";

package/dist/{doctor-D3wo-yuz.js → doctor-LPMYjSqO.js}

@@ -10,7 +10,7 @@ const doctor = defineLeaf({
 			description: "Check codes or groups to run",
 			valueHint: "code",
 			async complete() {
-				const { DOCTOR_CHECKS } = await import("./doctor-CHD1M9R5.js");
+				const { DOCTOR_CHECKS } = await import("./doctor-ClRVAtXQ.js");
 				return [.../* @__PURE__ */ new Set([...DOCTOR_CHECKS.map(({ code }) => code), ...DOCTOR_CHECKS.flatMap(({ groups }) => groups)])];
 			}
 		},
@@ -27,7 +27,7 @@ const doctor = defineLeaf({
 			if (answer === void 0) return CANCELLED;
 			fix = answer;
 		}
-		return (await import("./doctor-CHD1M9R5.js")).runDoctor({
+		return (await import("./doctor-ClRVAtXQ.js")).runDoctor({
 			cwd: ctx.cwd,
 			config: ctx.config,
 			only: flags.only,

package/dist/drizzle/index.d.ts

@@ -1,7 +1,7 @@
-import { Rt as Instant, lr as Subject, mr as Condition } from "../policy-types-CCiDRZBH.js";
-import { f as WhereResult } from "../permdock-B6Sf4T_S.js";
+import { Wt as Instant, br as Condition, hr as Subject } from "../policy-types-DGIO_gxq.js";
+import { f as WhereResult } from "../permdock-CprAPN3w.js";
 import { r as RelationsMapping } from "../graph-sql-BwFC4Qjs.js";
-import { s as MembershipsMapping } from "../compile-BFzysW3o.js";
+import { s as MembershipsMapping } from "../compile-BEklRUYo.js";
 import { n as RowCheck, t as WithSubjectOptions } from "../subject-settings-vNW8qmUH.js";
 import { SQL, Table } from "drizzle-orm";
 //#region src/drizzle/types.d.ts

package/dist/elysia/index.d.ts

@@ -1,9 +1,9 @@
-import { T as Policy, j as PolicyVocabulary, sr as Principal } from "../policy-types-CCiDRZBH.js";
+import { T as Policy, j as PolicyVocabulary, pr as Principal } from "../policy-types-DGIO_gxq.js";
 import { u as Permission } from "../permission-types-CAY-GU7e.js";
-import { a as PermDock } from "../permdock-B6Sf4T_S.js";
+import { a as PermDock } from "../permdock-CprAPN3w.js";
 import { n as RevocationFeed } from "../revocations-BaUXHM1N.js";
-import { D as ConnectionOptions, T as Connection, f as InvalidSignatureError, i as OpenApiHooks, o as ProtectOptions, v as discoverViaSignatureAgent, x as webBotAuthVerifier } from "../server-types-CIlpSA2G.js";
-import { t as ServerAdapterOptions } from "../bind-Cp2hBHzP.js";
+import { D as ConnectionOptions, T as Connection, f as InvalidSignatureError, i as OpenApiHooks, o as ProtectOptions, v as discoverViaSignatureAgent, x as webBotAuthVerifier } from "../server-types-CyRN0-Cd.js";
+import { t as ServerAdapterOptions } from "../bind-YYjvfpB9.js";
 import { Elysia } from "elysia";
 //#region src/elysia/create.d.ts
 type ElysiaRequestContext = {

package/dist/elysia/index.js

@@ -1,7 +1,7 @@
 import { a as parsedBody, r as hasCredentials } from "../http-DKLXrFGk.js";
 import { l as InvalidSignatureError, p as webBotAuthVerifier, u as discoverViaSignatureAgent } from "../evaluations-IBceAeKT.js";
 import { t as problemFromError } from "../map-error-pasIGqMT.js";
-import { a as socketConnection, i as decorate, r as bindKernel } from "../bind-D_sZSVA3.js";
+import { a as socketConnection, i as decorate, r as bindKernel } from "../bind-BNQA9JK9.js";
 import { a as onRevoked, n as closeReason, t as POLICY_VIOLATION } from "../stream-CDvF0sJm.js";
 import { Elysia } from "elysia";
 //#region src/elysia/create.ts

package/dist/{errors-zi_4T-rx.d.ts → errors-BIM4MFsJ.d.ts}

@@ -1,4 +1,4 @@
-import { Ln as Decision, ln as WireDenial, lr as Subject } from "./policy-types-CCiDRZBH.js";
+import { Un as Decision, hn as WireDenial, hr as Subject } from "./policy-types-DGIO_gxq.js";
 import { StandardSchemaV1 } from "@standard-schema/spec";
 //#region src/core/problem-details.d.ts
 type Disclosure = "hide" | "reveal";

package/dist/{evaluate-Dd8Ta0Ie.js → evaluate-BAmf_AQd.js}

@@ -1174,11 +1174,14 @@ function roleSourceFor(option, subject, auth) {
 		return;
 	}
 }
-function customRolesFor(source, tenants, auth, globalHeld, heldIn) {
+function customRolesFor(source, tenants, auth, globalHeld, heldIn, memo) {
 	if (source === void 0) return [];
 	const loaded = [];
 	for (const tenant of tenants) try {
-		loaded.push(source.rolesFor(tenant, { held: heldIn(tenant) }));
+		loaded.push(source.rolesFor(tenant, compact({
+			held: heldIn(tenant),
+			memo
+		})));
 	} catch {
 		auth.push({
 			reason: "source-threw",
@@ -1202,12 +1205,18 @@ function customRolesFor(source, tenants, auth, globalHeld, heldIn) {
 	};
 	if (globalHeld !== void 0 && source.globalRoles !== void 0) {
 		const read = source.globalRoles.bind(source);
-		once(() => read({ held: globalHeld }), onlyGlobal);
+		once(() => read(compact({
+			held: globalHeld,
+			memo
+		})), onlyGlobal);
 	}
 	if (tenants.length > 0 && source.sharedRoles !== void 0) {
 		const read = source.sharedRoles.bind(source);
 		const held = [...new Set(tenants.flatMap((tenant) => heldIn(tenant)))];
-		once(() => read({ held }), onlyShared);
+		once(() => read(compact({
+			held,
+			memo
+		})), onlyShared);
 	}
 	if (loaded.some((item) => isThenable(item))) return Promise.all(loaded.map((item) => Promise.resolve(item).catch(() => {
 		auth.push({

package/dist/{evaluations-z8dQFDaN.d.ts → evaluations-DOWuBpWv.d.ts}

@@ -1,6 +1,6 @@
-import { T as Policy } from "./policy-types-CCiDRZBH.js";
-import { a as PermDock } from "./permdock-B6Sf4T_S.js";
-import { m as ApprovalStore } from "./types-B_tiYvk8.js";
+import { T as Policy } from "./policy-types-DGIO_gxq.js";
+import { a as PermDock } from "./permdock-CprAPN3w.js";
+import { m as ApprovalStore } from "./types-DLvhVm1r.js";
 //#region src/server/evaluations.d.ts
 /** AuthZEN 1.0 section 7.1.2.1 `options.evaluations_semantic` values. */
 declare const EVALUATIONS_SEMANTICS: readonly ["execute_all", "deny_on_first_deny", "permit_on_first_permit"];

package/dist/eve/index.d.ts

@@ -1,8 +1,8 @@
-import { T as Policy, j as PolicyVocabulary, sr as Principal } from "../policy-types-CCiDRZBH.js";
+import { T as Policy, j as PolicyVocabulary, pr as Principal } from "../policy-types-DGIO_gxq.js";
 import { u as Permission } from "../permission-types-CAY-GU7e.js";
-import { a as PermDock } from "../permdock-B6Sf4T_S.js";
-import { u as ApprovalRequest } from "../types-B_tiYvk8.js";
-import { o as AgentAdapterOptions, t as AgentPermDock } from "../create-BSNrVuxh.js";
+import { a as PermDock } from "../permdock-CprAPN3w.js";
+import { u as ApprovalRequest } from "../types-DLvhVm1r.js";
+import { o as AgentAdapterOptions, t as AgentPermDock } from "../create-BPUopdfL.js";
 //#region src/eve/create.d.ts
 /** Structural `SessionAuthContext` from `eve`. */
 type EvePrincipal = {

package/dist/eve/index.js

@@ -1,8 +1,8 @@
 import { t as compact } from "../compact-CAf557ZB.js";
-import { l as withApp } from "../permdock-L-_I_3zP.js";
+import { l as withApp } from "../permdock-BvjivVb9.js";
 import { c as isApprovalError } from "../types-CcUXciSj.js";
 import { o as resolveApproval } from "../helpers-DJicaG6f.js";
-import { t as agentRuntime } from "../create-Cq4Uox0f.js";
+import { t as agentRuntime } from "../create-6EwRQlig.js";
 import { t as boundedMap } from "../lru-8q4WZjBV.js";
 //#region src/eve/create.ts
 const TOKENS_PER_PROCESS = 1e3;

package/dist/express/index.d.ts

@@ -1,8 +1,8 @@
-import { T as Policy, j as PolicyVocabulary, sr as Principal } from "../policy-types-CCiDRZBH.js";
+import { T as Policy, j as PolicyVocabulary, pr as Principal } from "../policy-types-DGIO_gxq.js";
 import { u as Permission } from "../permission-types-CAY-GU7e.js";
-import { a as PermDock } from "../permdock-B6Sf4T_S.js";
-import { f as InvalidSignatureError, i as OpenApiHooks, o as ProtectOptions, v as discoverViaSignatureAgent, x as webBotAuthVerifier } from "../server-types-CIlpSA2G.js";
-import { t as ServerAdapterOptions } from "../bind-Cp2hBHzP.js";
+import { a as PermDock } from "../permdock-CprAPN3w.js";
+import { f as InvalidSignatureError, i as OpenApiHooks, o as ProtectOptions, v as discoverViaSignatureAgent, x as webBotAuthVerifier } from "../server-types-CyRN0-Cd.js";
+import { t as ServerAdapterOptions } from "../bind-YYjvfpB9.js";
 import { i as toRequest, r as sendResponse } from "../http-B_LphE5Y.js";
 import { ErrorRequestHandler, Request, RequestHandler, Response, Router } from "express";
 //#region src/express/create.d.ts

package/dist/express/index.js

@@ -1,7 +1,7 @@
 import { r as hasCredentials } from "../http-DKLXrFGk.js";
 import { l as InvalidSignatureError, p as webBotAuthVerifier, u as discoverViaSignatureAgent } from "../evaluations-IBceAeKT.js";
 import { t as problemFromError } from "../map-error-pasIGqMT.js";
-import { i as decorate, r as bindKernel } from "../bind-D_sZSVA3.js";
+import { i as decorate, r as bindKernel } from "../bind-BNQA9JK9.js";
 import { n as sendResponse, r as toRequest } from "../http-DH94eh6f.js";
 import express from "express";
 //#region src/express/create.ts

package/dist/fastify/index.d.ts

@@ -1,8 +1,8 @@
-import { T as Policy, j as PolicyVocabulary, sr as Principal } from "../policy-types-CCiDRZBH.js";
+import { T as Policy, j as PolicyVocabulary, pr as Principal } from "../policy-types-DGIO_gxq.js";
 import { u as Permission } from "../permission-types-CAY-GU7e.js";
-import { a as PermDock } from "../permdock-B6Sf4T_S.js";
-import { f as InvalidSignatureError, i as OpenApiHooks, o as ProtectOptions, v as discoverViaSignatureAgent, x as webBotAuthVerifier } from "../server-types-CIlpSA2G.js";
-import { t as ServerAdapterOptions } from "../bind-Cp2hBHzP.js";
+import { a as PermDock } from "../permdock-CprAPN3w.js";
+import { f as InvalidSignatureError, i as OpenApiHooks, o as ProtectOptions, v as discoverViaSignatureAgent, x as webBotAuthVerifier } from "../server-types-CyRN0-Cd.js";
+import { t as ServerAdapterOptions } from "../bind-YYjvfpB9.js";
 import { FastifyPluginAsync, FastifyReply, FastifyRequest, FastifySchema, FastifyTypeProvider, FastifyTypeProviderDefault, RawRequestDefaultExpression, RawServerDefault, RouteGenericInterface } from "fastify";
 //#region src/server/http.d.ts
 /** A Fastify-style reply: `code`, `header` and `send`. */

package/dist/fastify/index.js

@@ -1,7 +1,7 @@
 import { c as writeReply, i as headersFrom, n as firstHeader, r as hasCredentials, t as fetchRequest } from "../http-DKLXrFGk.js";
 import { l as InvalidSignatureError, p as webBotAuthVerifier, u as discoverViaSignatureAgent } from "../evaluations-IBceAeKT.js";
 import { t as problemFromError } from "../map-error-pasIGqMT.js";
-import { i as decorate, r as bindKernel } from "../bind-D_sZSVA3.js";
+import { i as decorate, r as bindKernel } from "../bind-BNQA9JK9.js";
 //#region src/fastify/http.ts
 function toRequest(request) {
 	const host = firstHeader(request.headers.host) ?? "localhost";

package/dist/{fetch-adapter-C1DCvpqV.d.ts → fetch-adapter-BIbBAtPZ.d.ts}

@@ -1,8 +1,8 @@
 import { u as Permission } from "./permission-types-CAY-GU7e.js";
 import { a as OperationInput, t as Operation } from "./operations-Ci_rT6Uo.js";
 import { n as RevocationFeed } from "./revocations-BaUXHM1N.js";
-import { o as ProtectOptions } from "./server-types-CIlpSA2G.js";
-import { t as ServerAdapterOptions } from "./bind-Cp2hBHzP.js";
+import { o as ProtectOptions } from "./server-types-CyRN0-Cd.js";
+import { t as ServerAdapterOptions } from "./bind-YYjvfpB9.js";
 //#region src/server/fetch-adapter.d.ts
 /**
  * What `protect` checks: a permission, an operation from `defineOperations`, or

package/dist/{fetch-adapter-JL43jD3E.js → fetch-adapter-dPTgJVHd.js}

@@ -3,7 +3,7 @@ import { o as isPermission } from "./permission-registry-B8tYxPIt.js";
 import { r as hasCredentials } from "./http-DKLXrFGk.js";
 import { o as methodNotAllowed } from "./problem-BVLHFK33.js";
 import { t as problemFromError } from "./map-error-pasIGqMT.js";
-import { i as decorate, r as bindKernel } from "./bind-D_sZSVA3.js";
+import { i as decorate, r as bindKernel } from "./bind-BNQA9JK9.js";
 //#region src/server/fetch-adapter.ts
 /**
 * `protect(target, data, options)(handler)` for a framework whose routes are