permdock 0.8.0 → 0.9.0

package/dist/{rls-CNEH2_BG.js → rls-Cx0dtsB7.js}

@@ -8,25 +8,25 @@ import { o as sqlFiles } from "./files-BSjrtIHw.js";
 import { c as requirePolicy } from "./load-DjSU5KXO.js";
 import { i as qualifySqlTable, r as escapeSqlIdent } from "./sql-0WjxIp9g.js";
 import "./sources-CMAM-2A3.js";
-import { t as policyFromCatalog } from "./policy-from-catalog-CJgOm6aq.js";
+import { t as policyFromCatalog } from "./policy-from-catalog-CU3An8uP.js";
 import { t as beforeFirst } from "./text-BMFRfBqc.js";
 import { i as INDEXES_MARKER, n as GRANTS_MARKER, o as SEEDS_MARKER, t as BACKFILL_MARKER } from "./markers-BeHZ4x9Q.js";
-import { a as nonEmptyOr } from "./output-tkju6U7R.js";
+import { a as nonEmptyOr } from "./output-DV5dwOTs.js";
 import { i as requirePeer, n as packageManagerOf, t as addLine } from "./peer-Q0fuZ6hx.js";
 import { t as POLICY_NOT_PUBLISHED } from "./problem-types-DSsRfONQ.js";
-import { t as fetchProjectPolicy } from "./pull-CwpGaQSi.js";
+import { t as fetchProjectPolicy } from "./pull-2nJr0qg_.js";
 import { n as MIGRATION_DIRS } from "./constants-DcJABbLW.js";
 import { a as isSeedsDirectory, c as parseSplit, d as seedsMigration, f as writeOutputFiles, l as partPath, n as dataMigrationFile, r as driftOf, u as pgDeltaPath } from "./output-files-BIQ_9pIs.js";
-import { d as schemasRefusal, f as declarativeSql, l as isSupabaseSchemas, o as supabaseHookSql, s as approvalsSql, t as grantsLabel, u as resolveSchemas, v as parseRbacAuthorize, y as rbacScaffold } from "./supabase-hook-B-yXnzUl.js";
+import { d as schemasRefusal, f as declarativeSql, l as isSupabaseSchemas, o as supabaseHookSql, s as approvalsSql, t as grantsLabel, u as resolveSchemas, v as parseRbacAuthorize, y as rbacScaffold } from "./supabase-hook-CrgU06WH.js";
 import { A as quoteQualified, D as qualified$1, I as scopeTypeOf, O as quoteIdent$1, _ as subjectClaimJsonSql, c as SESSION_LIVE_HELPER, g as sessionLiveHelperSql, j as quoteTable, k as quoteLiteral, r as HELPERS, t as CUSTOM_ROLES, y as subjectIdSql } from "./shared-Afctg7B0.js";
-import { C as accessSql, G as byKey, T as seedSql, Z as graphHelper, ct as memberIdsHelper, ft as permittedIdsHelper, ht as scopeTable, mt as scopeSources, r as tableNames, s as graphSql, w as helpersSql, x as permittedByPermissionHelper, y as permissionHelpersSql } from "./tables-DeMNEy6V.js";
-import { c as breakGlassKey, i as assignmentSql, l as collectGrants, n as ownershipSql, s as breakGlassHolder } from "./ownership-B4L59T9u.js";
+import { C as accessSql, G as byKey, T as seedSql, Z as graphHelper, ct as memberIdsHelper, ft as permittedIdsHelper, ht as scopeTable, mt as scopeSources, r as tableNames, s as graphSql, w as helpersSql, x as permittedByPermissionHelper, y as permissionHelpersSql } from "./tables-BqrxBCir.js";
+import { c as breakGlassKey, i as assignmentSql, l as collectGrants, n as ownershipSql, s as breakGlassHolder } from "./ownership-DA5YdYTm.js";
 import { a as splitUndiffed } from "./deciding-columns-NB4wcyBf.js";
 import { t as connectPgPool } from "./pg-DQTqRrou.js";
-import { n as permissionHoldersSql } from "./resolve-names-CF7xXLSG.js";
+import { n as permissionHoldersSql } from "./resolve-names-ConCSj1y.js";
 import { a as fieldViewsSql, c as ACTOR_MAY_WRITE, f as readOnlyActorKinds, i as fieldViews, l as actorMayWriteSql, n as columnGrantSql, o as rowBranches, p as readOnlyActorPolicies, r as columnRevokeSql, u as assemblePolicies } from "./fields-D0vUI6dq.js";
-import { _ as indexTargets, a as verifyResult, b as readTableIndexFacts, c as callsHelper, g as INDEX_COLUMNS_SQL, h as COLUMNS_SQL, i as verifyIgnores, l as helperCallKeys, m as tableFor, n as runRlsVerify, o as HELPER_TABLES, p as compileGrants, r as rlsFinding, v as indexesSql, y as pruneIndexTargets } from "./verify-DZeqoWu5.js";
-import { a as generateOptions, c as buildContext, i as rowHelpersSql, l as DROPPED_LIST, n as inheritTargets, o as isRefusal, r as levelKeys, s as splitsPart, t as supautilsRejections, u as rebuildPlan } from "./supautils-BU-pAEpf.js";
+import { _ as indexTargets, a as verifyResult, b as readTableIndexFacts, c as callsHelper, g as INDEX_COLUMNS_SQL, h as COLUMNS_SQL, i as verifyIgnores, l as helperCallKeys, m as tableFor, n as runRlsVerify, o as HELPER_TABLES, p as compileGrants, r as rlsFinding, v as indexesSql, y as pruneIndexTargets } from "./verify-DlUcTDBz.js";
+import { a as buildContext, c as levelKeys, d as rebuildPlan, i as splitsPart, l as rowHelpersSql, n as generateOptions, o as CANDIDATES, r as isRefusal, s as inheritTargets, t as supautilsRejections, u as DROPPED_LIST } from "./supautils-ByezN3b8.js";
 import { readFileSync } from "node:fs";
 import { basename, delimiter, join } from "node:path";
 import { spawn } from "node:child_process";
@@ -1416,10 +1416,17 @@ function sectionsSql(input, policy, options, built, generated, jsonSchema, warni
 	if (typeof rls?.approvals === "object" && rls.approvals.delegations === true && ctx.authorize !== "database") warnings.push("rls.approvals.delegations with --authorize jwt: permdock_is_approver cannot read a delegator's permissions from the caller's token, so in SQL a cover never satisfies a holder() approver; approvalsHandler still does");
 	const graphed = graphSql(ctx, graph, tableNames(rls?.tables));
 	let rowHelpers = "";
-	if (rls?.rowHelpers !== void 0 || inheritTargets(policy).length > 0) try {
-		rowHelpers = rowHelpersSql(ctx, policy, [...options.fieldsMode === void 0 ? compiled.branches : rowBranches(compiled.branches), ...compiled.actionBranches], rls?.rowHelpers ?? [], tableNames(rls?.tables), warnings);
-	} catch (cause) {
-		return { refusal: describeError(cause) };
+	if (rls?.rowHelpers !== void 0 || inheritTargets(policy).length > 0) {
+		const readable = (grants) => [...options.fieldsMode === void 0 ? grants.branches : rowBranches(grants.branches), ...grants.actionBranches];
+		try {
+			const narrowed = compileGrants(policy, {
+				...ctx,
+				candidates: CANDIDATES
+			}, tableNames(rls?.tables), [], input.skipClosures, true);
+			rowHelpers = rowHelpersSql(ctx, policy, readable(compiled), rls?.rowHelpers ?? [], tableNames(rls?.tables), warnings, readable(narrowed));
+		} catch (cause) {
+			return { refusal: describeError(cause) };
+		}
 	}
 	const breakGlass = breakGlassSql(ctx, breakGlassEntries(policy, tableNames(rls?.tables)));
 	return [

package/dist/{rpc-fNqAIqQk.js → rpc-vHIwyXCp.js}

@@ -1,7 +1,7 @@
 import { t as compact } from "./compact-CAf557ZB.js";
 import { s as requestFromContext } from "./http-DKLXrFGk.js";
 import { n as tenantScope } from "./adapter-context-CIQpQxbE.js";
-import { t as adapterKernel } from "./bind-D_sZSVA3.js";
+import { t as adapterKernel } from "./bind-BNQA9JK9.js";
 import { r as guardIterable } from "./stream-CDvF0sJm.js";
 //#region src/server/rpc.ts
 /** The tRPC and oRPC error code for a Problem Details status. */

package/dist/run-Ck22anC2.js

@@ -0,0 +1 @@
+export { t as run } from "./run-PbRlXTfh.js";

package/dist/{run-Bz26OTfO.js → run-PbRlXTfh.js}

@@ -5,9 +5,9 @@ import { a as resolveCwd, i as readConfig } from "./config-BwPBfN0t.js";
 import { t as beforeFirst } from "./text-BMFRfBqc.js";
 import { a as suggestion, i as parseLeaf, n as flagSpellings, o as GLOBAL_FLAGS, r as parseFlags } from "./args-0FrVs5EH.js";
 import { r as progressReporter, t as redact } from "./credentials-CdDxp7jN.js";
-import { a as resolve, i as leaves, n as ROOT, r as SECTIONS, t as DOCS_BASE } from "./manifest-Cgiq5oqc.js";
+import { a as resolve, i as leaves, n as ROOT, r as SECTIONS, t as DOCS_BASE } from "./manifest-B2QPh19C.js";
 import { t as createStyle } from "./style-Ds11Hmk4.js";
-import { i as githubAnnotations, n as envelope, o as sarifLog, t as dataOf } from "./output-tkju6U7R.js";
+import { i as githubAnnotations, n as envelope, o as sarifLog, t as dataOf } from "./output-DV5dwOTs.js";
 import { i as renameMessage, r as flagRename, t as COMMAND_MOVES } from "./renames-CGj7YwcQ.js";
 import { stripVTControlCharacters } from "node:util";
 import { existsSync, statSync } from "node:fs";

package/dist/{run-ticket-DbWI9f99.d.ts → run-ticket-B2o2Kxz8.d.ts}

@@ -1,5 +1,5 @@
-import { $n as AuthorizationDetail, Rt as Instant, Zn as Actor, Zt as AuthEvent, dt as TokenVerifier, lr as Subject, lt as TokenFailureCause, rr as Delegation, sr as Principal, ut as TokenSigner } from "./policy-types-CCiDRZBH.js";
-import { _ as PrincipalSource } from "./permdock-B6Sf4T_S.js";
+import { Wt as Instant, ar as AuthorizationDetail, hr as Subject, ht as TokenVerifier, lr as Delegation, mt as TokenSigner, pr as Principal, pt as TokenFailureCause, rn as AuthEvent, rr as Actor } from "./policy-types-DGIO_gxq.js";
+import { _ as PrincipalSource } from "./permdock-CprAPN3w.js";
 //#region src/server/run-ticket.d.ts
 /**
  * What started the run: a saved automation, a background job, or a caller's own

package/dist/{saas-iWnUdwCt.js → saas-DK4V-3Is.js}

@@ -1,12 +1,12 @@
 import { r as isRecord } from "./compact-CAf557ZB.js";
 import { i as principal } from "./refs-C8BKxc_e.js";
 import { a as deny, n as role, r as allow } from "./role-builder-BK2-T6oD.js";
-import { A as memoryCustomRoleSource, S as memoryLimitStore, b as memoryRelationSource, x as limits } from "./src-DZ0l9UAg.js";
+import { C as memoryLimitStore, S as limits, j as memoryCustomRoleSource, x as memoryRelationSource } from "./src-C_pi2Rnh.js";
 import { h as secondsAt } from "./time-nR1JesoH.js";
 import { l as relation, n as anyone } from "./grantee-Dke-9rd1.js";
 import { r as definePolicy } from "./policy-CLQ8__GF.js";
 import { s as quoteSqlLiteral } from "./sql-0WjxIp9g.js";
-import { a as saasPlans, i as saasPermissions, o as saasRoles } from "./permissions-mDcTWoBs.js";
+import { a as saasPlans, i as saasPermissions, o as saasRoles } from "./permissions-CYcHj_w7.js";
 //#region src/testing/saas/policy.ts
 function isSubject(user) {
 	return user !== null && "context" in user && "principal" in user;

package/dist/{scan-DCj1KQfn.js → scan-CRTj6fke.js}

@@ -16,7 +16,7 @@ const scan = defineLeaf({
 		}
 	},
 	async run(ctx, { flags }) {
-		const { runAdoptionScan } = await import("./adoption-scan-BLs67P1l.js");
+		const { runAdoptionScan } = await import("./adoption-scan-Ch07MdxN.js");
 		return runAdoptionScan({
 			cwd: ctx.cwd,
 			srcPath: flags.src.length > 0 ? flags.src : ctx.config.collect?.srcPath ?? ["src"],

package/dist/{schema-Dst9I9Gs.js → schema-BTsE1WRT.js}

@@ -1,7 +1,7 @@
 import { r as isRecord } from "./compact-CAf557ZB.js";
 import { l as packageRoot } from "./version-DMQ0dnN5.js";
 import { t as DRAFT_PINS } from "./pins-nqarl3oE.js";
-import { a as nonEmptyOr } from "./output-tkju6U7R.js";
+import { a as nonEmptyOr } from "./output-DV5dwOTs.js";
 import { t as require__2020 } from "./2020-CJbO8Bvz.js";
 import { readFileSync } from "node:fs";
 import { join } from "node:path";

package/dist/scim/index.d.ts

@@ -1,3 +1,3 @@
 import { t as SqlQuery } from "../sql-B80DFdpG.js";
-import { A as ScimFilter, C as DirectoryUser, D as PATCH_SCHEMA, E as LIST_SCHEMA, F as ScimTokenOptions, I as USER_SCHEMA, L as isDirectoryNotFoundError, M as ScimPage, N as ScimPageResult, O as ROLES_EXTENSION, P as ScimPatchOp, R as isDirectoryUniquenessError, S as DirectoryUniquenessError, T as GROUP_SCHEMA, _ as DirectoryChange, a as normalizePatchOps, b as DirectoryNotFoundError, c as filterSupported, d as resourceTypes, f as schemas, g as APP_DATA_EXTENSION, h as sha256Hex, i as directoryMembershipSource, j as ScimHandlerOptions, k as SCIM_CONTENT_TYPE, l as matchFilter, m as authenticateScim, n as postgresDirectoryStore, o as tenantFromPath, p as serviceProviderConfig, r as memoryDirectoryStore, s as scimHandler, t as PostgresDirectoryStoreOptions, u as parseScimFilter, v as DirectoryGroup, w as ERROR_SCHEMA, x as DirectoryStore, y as DirectoryMembershipSourceOptions } from "../index-BT5-1VsX.js";
+import { A as ScimFilter, C as DirectoryUser, D as PATCH_SCHEMA, E as LIST_SCHEMA, F as ScimTokenOptions, I as USER_SCHEMA, L as isDirectoryNotFoundError, M as ScimPage, N as ScimPageResult, O as ROLES_EXTENSION, P as ScimPatchOp, R as isDirectoryUniquenessError, S as DirectoryUniquenessError, T as GROUP_SCHEMA, _ as DirectoryChange, a as normalizePatchOps, b as DirectoryNotFoundError, c as filterSupported, d as resourceTypes, f as schemas, g as APP_DATA_EXTENSION, h as sha256Hex, i as directoryMembershipSource, j as ScimHandlerOptions, k as SCIM_CONTENT_TYPE, l as matchFilter, m as authenticateScim, n as postgresDirectoryStore, o as tenantFromPath, p as serviceProviderConfig, r as memoryDirectoryStore, s as scimHandler, t as PostgresDirectoryStoreOptions, u as parseScimFilter, v as DirectoryGroup, w as ERROR_SCHEMA, x as DirectoryStore, y as DirectoryMembershipSourceOptions } from "../index-Dj2qF9VC.js";
 export { APP_DATA_EXTENSION, type DirectoryChange, type DirectoryGroup, type DirectoryMembershipSourceOptions, DirectoryNotFoundError, type DirectoryStore, DirectoryUniquenessError, type DirectoryUser, ERROR_SCHEMA, GROUP_SCHEMA, LIST_SCHEMA, PATCH_SCHEMA, type PostgresDirectoryStoreOptions, ROLES_EXTENSION, SCIM_CONTENT_TYPE, type ScimFilter, type ScimHandlerOptions, type ScimPage, type ScimPageResult, type ScimPatchOp, type ScimTokenOptions, type SqlQuery, USER_SCHEMA, authenticateScim, directoryMembershipSource, filterSupported, isDirectoryNotFoundError, isDirectoryUniquenessError, matchFilter, memoryDirectoryStore, normalizePatchOps, parseScimFilter, postgresDirectoryStore, resourceTypes, schemas, scimHandler, serviceProviderConfig, sha256Hex, tenantFromPath };

package/dist/server/index.d.ts

@@ -1,13 +1,13 @@
-import { n as PermDockValidationError, t as PROBLEM_BASE } from "../validation-error-YGg2mXyH.js";
-import { i as PermDockRevokedError, n as PermDockApprovalRequiredError, r as PermDockDeniedError, t as ApprovalHint } from "../errors-zi_4T-rx.js";
+import { n as PermDockValidationError, t as PROBLEM_BASE } from "../validation-error-uvp-kyfO.js";
+import { i as PermDockRevokedError, n as PermDockApprovalRequiredError, r as PermDockDeniedError, t as ApprovalHint } from "../errors-BIM4MFsJ.js";
 import { t as RequestContext } from "../request-context-C2_1lchh.js";
 import { i as memoryRevocationFeed, n as RevocationFeed, t as RevocationEvent } from "../revocations-BaUXHM1N.js";
-import { C as TenantScope, D as ConnectionOptions, E as ConnectionData, S as TenantOption, T as Connection, _ as WebBotAuthVerifier, a as OperationScopes, b as invalidSignatureResponse, c as ServerPermDock, d as DiscoverViaSignatureAgentOptions, f as InvalidSignatureError, g as WebBotAuthOptions, h as WebBotAuthKeys, i as OpenApiHooks, l as ServerPermDockOptions, m as WebBotAuthKeyLookup, n as DeniedResponseEvent, o as ProtectOptions, p as WebBotAuthJwk, r as Guard, s as ScopeGuard, t as DeniedResponse, u as SnapshotQuery, v as discoverViaSignatureAgent, w as tenantScope, x as webBotAuthVerifier, y as invalidSignatureProblem } from "../server-types-CIlpSA2G.js";
-import { i as evaluationsHandler } from "../evaluations-z8dQFDaN.js";
-import { C as subjectFromApiKey, E as createPermDock, S as parseFeedKey, T as problemFromError, _ as generateApiKey, a as SupportSessionContext, b as memoryCredentialStore, c as SupportSessionSubjectOptions, d as ApiKeyFailureCause, f as ApiKeyParts, g as apiKeyVerifier, h as StoredCredential, i as wwwAuthenticate, l as signSupportSession, m as MemoryCredentialStore, n as problemResponse, o as SupportSessionFailureCause, p as ApiKeySubjectOptions, r as validationProblem, s as SupportSessionSource, t as problemFromDecision, u as subjectFromSupportSession, v as generateFeedKey, w as ProblemFromErrorOptions, x as parseApiKey, y as hashApiKey } from "../index-B8s204GL.js";
-import { l as ReplayStore } from "../types-DjuMBNF9.js";
-import { a as WebhookInput, c as WebhookMessage, d as WebhookSigningKey, f as WebhookVerifier, h as webhookVerifier, i as WebhookHeaders, l as WebhookSigner, m as webhookSigner, n as WebhookAlgorithm, o as WebhookJwk, p as WebhookVerifierOptions, r as WebhookFailureCause, s as WebhookJwks, t as VerifiedWebhookMessage, u as WebhookSignerOptions } from "../standard-webhooks-C-qX4mJW.js";
-import { t as memoryReplayStore } from "../replay-DNftIb_R.js";
-import { a as snapshotHeaders, i as cacheLifeFor, n as SnapshotHeaders, o as snapshotTag, r as SnapshotHeadersOptions, t as CacheLifeForOptions } from "../snapshot-cache-BAXZ0KOp.js";
-import { a as RunContext, c as RunTicket, d as RunTicketInput, f as RunTicketOptions, g as subjectFromRunTicket, h as signRunTicket, i as RunBinding, l as RunTicketAutomations, m as parseRunTicket, n as RunActClaim, o as RunKind, p as RunTicketSubjectOptions, r as RunAutomation, s as RunPrincipal, t as RUN_TICKET_CLAIMS, u as RunTicketFailureCause } from "../run-ticket-DbWI9f99.js";
+import { C as TenantScope, D as ConnectionOptions, E as ConnectionData, S as TenantOption, T as Connection, _ as WebBotAuthVerifier, a as OperationScopes, b as invalidSignatureResponse, c as ServerPermDock, d as DiscoverViaSignatureAgentOptions, f as InvalidSignatureError, g as WebBotAuthOptions, h as WebBotAuthKeys, i as OpenApiHooks, l as ServerPermDockOptions, m as WebBotAuthKeyLookup, n as DeniedResponseEvent, o as ProtectOptions, p as WebBotAuthJwk, r as Guard, s as ScopeGuard, t as DeniedResponse, u as SnapshotQuery, v as discoverViaSignatureAgent, w as tenantScope, x as webBotAuthVerifier, y as invalidSignatureProblem } from "../server-types-CyRN0-Cd.js";
+import { i as evaluationsHandler } from "../evaluations-DOWuBpWv.js";
+import { C as subjectFromApiKey, E as createPermDock, S as parseFeedKey, T as problemFromError, _ as generateApiKey, a as SupportSessionContext, b as memoryCredentialStore, c as SupportSessionSubjectOptions, d as ApiKeyFailureCause, f as ApiKeyParts, g as apiKeyVerifier, h as StoredCredential, i as wwwAuthenticate, l as signSupportSession, m as MemoryCredentialStore, n as problemResponse, o as SupportSessionFailureCause, p as ApiKeySubjectOptions, r as validationProblem, s as SupportSessionSource, t as problemFromDecision, u as subjectFromSupportSession, v as generateFeedKey, w as ProblemFromErrorOptions, x as parseApiKey, y as hashApiKey } from "../index-CV-7DWeD.js";
+import { l as ReplayStore } from "../types-DsHGPtkR.js";
+import { a as WebhookInput, c as WebhookMessage, d as WebhookSigningKey, f as WebhookVerifier, h as webhookVerifier, i as WebhookHeaders, l as WebhookSigner, m as webhookSigner, n as WebhookAlgorithm, o as WebhookJwk, p as WebhookVerifierOptions, r as WebhookFailureCause, s as WebhookJwks, t as VerifiedWebhookMessage, u as WebhookSignerOptions } from "../standard-webhooks-DOYEuOLx.js";
+import { t as memoryReplayStore } from "../replay-Bs9Df2fQ.js";
+import { a as snapshotHeaders, i as cacheLifeFor, n as SnapshotHeaders, o as snapshotTag, r as SnapshotHeadersOptions, t as CacheLifeForOptions } from "../snapshot-cache-BjAWkchD.js";
+import { a as RunContext, c as RunTicket, d as RunTicketInput, f as RunTicketOptions, g as subjectFromRunTicket, h as signRunTicket, i as RunBinding, l as RunTicketAutomations, m as parseRunTicket, n as RunActClaim, o as RunKind, p as RunTicketSubjectOptions, r as RunAutomation, s as RunPrincipal, t as RUN_TICKET_CLAIMS, u as RunTicketFailureCause } from "../run-ticket-B2o2Kxz8.js";
 export { type ApiKeyFailureCause, type ApiKeyParts, type ApiKeySubjectOptions, type ApprovalHint, type CacheLifeForOptions, type Connection, type ConnectionData, type ConnectionOptions, type DeniedResponse, type DeniedResponseEvent, type DiscoverViaSignatureAgentOptions, type Guard, InvalidSignatureError, type MemoryCredentialStore, type OpenApiHooks, type OperationScopes, PROBLEM_BASE, PermDockApprovalRequiredError, PermDockDeniedError, PermDockRevokedError, PermDockValidationError, type ProblemFromErrorOptions, type ProtectOptions, RUN_TICKET_CLAIMS, type ReplayStore, type RequestContext, type RevocationEvent, type RevocationFeed, type RunActClaim, type RunAutomation, type RunBinding, type RunContext, type RunKind, type RunPrincipal, type RunTicket, type RunTicketAutomations, type RunTicketFailureCause, type RunTicketInput, type RunTicketOptions, type RunTicketSubjectOptions, type ScopeGuard, type ServerPermDock, type ServerPermDockOptions, type SnapshotHeaders, type SnapshotHeadersOptions, type SnapshotQuery, type StoredCredential, type SupportSessionContext, type SupportSessionFailureCause, type SupportSessionSource, type SupportSessionSubjectOptions, type TenantOption, type TenantScope, type VerifiedWebhookMessage, type WebBotAuthJwk, type WebBotAuthKeyLookup, type WebBotAuthKeys, type WebBotAuthOptions, type WebBotAuthVerifier, type WebhookAlgorithm, type WebhookFailureCause, type WebhookHeaders, type WebhookInput, type WebhookJwk, type WebhookJwks, type WebhookMessage, type WebhookSigner, type WebhookSignerOptions, type WebhookSigningKey, type WebhookVerifier, type WebhookVerifierOptions, apiKeyVerifier, cacheLifeFor, createPermDock, discoverViaSignatureAgent, evaluationsHandler, generateApiKey, generateFeedKey, hashApiKey, invalidSignatureProblem, invalidSignatureResponse, memoryCredentialStore, memoryReplayStore, memoryRevocationFeed, parseApiKey, parseFeedKey, parseRunTicket, problemFromDecision, problemFromError, problemResponse, signRunTicket, signSupportSession, snapshotHeaders, snapshotTag, subjectFromApiKey, subjectFromRunTicket, subjectFromSupportSession, tenantScope, validationProblem, webBotAuthVerifier, webhookSigner, webhookVerifier, wwwAuthenticate };

package/dist/server/index.js

@@ -6,7 +6,7 @@ import { t as memoryReplayStore } from "../replay-BU09ad4L.js";
 import { n as snapshotHeaders, r as snapshotTag, t as cacheLifeFor } from "../snapshot-cache-Bx_4xC_6.js";
 import { d as invalidSignatureProblem, f as invalidSignatureResponse, l as InvalidSignatureError, o as evaluationsHandler, p as webBotAuthVerifier, u as discoverViaSignatureAgent } from "../evaluations-IBceAeKT.js";
 import { n as tenantScope } from "../adapter-context-CIQpQxbE.js";
-import { t as createPermDock } from "../create-_noSrY1T.js";
+import { t as createPermDock } from "../create-BLPKnJKa.js";
 import { a as generateFeedKey, c as parseApiKey, i as generateApiKey, l as parseFeedKey, n as subjectFromSupportSession, o as hashApiKey, r as apiKeyVerifier, s as memoryCredentialStore, t as signSupportSession, u as subjectFromApiKey } from "../server-3cVlTLde.js";
 import { i as subjectFromRunTicket, n as parseRunTicket, r as signRunTicket, t as RUN_TICKET_CLAIMS } from "../run-ticket-Dv7aF7Dk.js";
 import { t as problemFromError } from "../map-error-pasIGqMT.js";

package/dist/{server-types-CIlpSA2G.d.ts → server-types-CyRN0-Cd.d.ts}

@@ -1,14 +1,14 @@
-import { Gt as Snapshot, Ln as Decision, Rt as Instant, Zn as Actor, ar as JsonWebKeyLike, j as PolicyVocabulary, lr as Subject } from "./policy-types-CCiDRZBH.js";
+import { Un as Decision, Wt as Instant, X as Intent, Zt as Snapshot, dr as JsonWebKeyLike, hr as Subject, j as PolicyVocabulary, rr as Actor } from "./policy-types-DGIO_gxq.js";
 import { u as Permission } from "./permission-types-CAY-GU7e.js";
-import { a as PermDock, u as SnapshotOptions } from "./permdock-B6Sf4T_S.js";
-import { m as ApprovalStore } from "./types-B_tiYvk8.js";
-import { a as ProblemDetails, t as ApprovalHint } from "./errors-zi_4T-rx.js";
-import { t as InstanceOptions } from "./instance-options-B0KXqTrJ.js";
+import { a as PermDock, u as SnapshotOptions } from "./permdock-CprAPN3w.js";
+import { m as ApprovalStore } from "./types-DLvhVm1r.js";
+import { a as ProblemDetails, t as ApprovalHint } from "./errors-BIM4MFsJ.js";
+import { t as InstanceOptions } from "./instance-options-CoHn-0e8.js";
 import { t as RequestContext } from "./request-context-C2_1lchh.js";
-import { n as PermDockWrap } from "./wrap-DlJE3gS_.js";
+import { n as PermDockWrap } from "./wrap-DxXB54Wu.js";
 import { n as RevocationFeed } from "./revocations-BaUXHM1N.js";
-import { r as PdpFactory } from "./types-B4uqKDnp.js";
-import { i as evaluationsHandler } from "./evaluations-z8dQFDaN.js";
+import { r as PdpFactory } from "./types-DlelvQk4.js";
+import { i as evaluationsHandler } from "./evaluations-DOWuBpWv.js";
 //#region src/server/connection.d.ts
 type ConnectionData<T> = T | (() => T | null | undefined | Promise<T | null | undefined>);
 type ConnectionOptions<T = unknown> = {
@@ -151,6 +151,13 @@ type ServerPermDockOptions<TUser = unknown> = InstanceOptions & {
    * cover derived instances.
    */
   readonly wrap?: PermDockWrap;
+  /**
+   * `'read'` lets `claimsFirst(…, { versions })` judge the token from the
+   * shared version cache. Defaults to `'read'` for `GET`, `HEAD` and `OPTIONS`
+   * and `'write'` for every other method. `undefined` keeps the default; a
+   * throw or any other value is `'write'`.
+   */
+  readonly intent?: (request: Request) => Intent | undefined;
   /**
    * The `adapter` label on decision events, revocations and approvals. Defaults
    * to `server`.

package/dist/{sink-Dvi7YZG_.d.ts → sink-B5zoUW_O.d.ts}

@@ -1,7 +1,7 @@
-import { $t as CredentialEvent, Ct as Credential, Qt as AutomationEvent, Xt as AccessEvent, gt as SupportSession, on as MembershipEvent, q as DecisionSink, sn as SinkEvent, ut as TokenSigner } from "./policy-types-CCiDRZBH.js";
+import { J as DecisionSink, St as SupportSession, an as CredentialEvent, fn as MembershipEvent, in as AutomationEvent, kt as Credential, mt as TokenSigner, nn as AccessEvent, pn as SinkEvent } from "./policy-types-DGIO_gxq.js";
 import { M as AppData } from "./permission-types-CAY-GU7e.js";
 import { u as OperationRisk } from "./operations-Ci_rT6Uo.js";
-import { t as Automation } from "./automation-DqEoWHBc.js";
+import { t as Automation } from "./automation-C6Jg75xq.js";
 //#region src/core/sink.d.ts
 /**
  * The closed list of CloudEvents `type` values, `com.permdock.<family>` or

package/dist/{skills-OuoMR49L.js → skills-C9uKfSF5.js}

@@ -1,7 +1,7 @@
 import { t as defineLeaf } from "./command-L8EstFNm.js";
 import { t as checkFlag } from "./flags-DXjoTVbS.js";
 import { r as pick, t as CANCELLED } from "./prompt-BYc6drYW.js";
-import { n as detectedAgents, r as runSkills, t as SKILL_AGENTS } from "./skills-Bjj7BNEQ.js";
+import { n as detectedAgents, r as runSkills, t as SKILL_AGENTS } from "./skills-CQQcuGBi.js";
 //#region src/cli/commands/skills.ts
 const forFlag = { for: {
 	type: "string",

package/dist/{skills-Bjj7BNEQ.js → skills-CQQcuGBi.js}

@@ -2,7 +2,7 @@ import { t as byCodePoint } from "./compare-DTfyUunF.js";
 import { i as readJsonFile } from "./files-BSjrtIHw.js";
 import { l as packageRoot } from "./version-DMQ0dnN5.js";
 import { t as didYouMean } from "./args-0FrVs5EH.js";
-import { a as nonEmptyOr } from "./output-tkju6U7R.js";
+import { a as nonEmptyOr } from "./output-DV5dwOTs.js";
 import { cpSync, existsSync, lstatSync, mkdirSync, readFileSync, readdirSync, readlinkSync, realpathSync, writeFileSync } from "node:fs";
 import { basename, dirname, join, relative, resolve } from "node:path";
 import { pathToFileURL } from "node:url";

package/dist/{snapshot-cache-BAXZ0KOp.d.ts → snapshot-cache-BjAWkchD.d.ts}

@@ -1,4 +1,4 @@
-import { Gt as Snapshot, Rt as Instant } from "./policy-types-CCiDRZBH.js";
+import { Wt as Instant, Zt as Snapshot } from "./policy-types-DGIO_gxq.js";
 //#region src/core/snapshot-cache.d.ts
 type CacheLifeForOptions = {
   /**

package/dist/solid/index.d.ts

@@ -1,13 +1,13 @@
-import { Gt as Snapshot, In as ApprovalRequiredDecision, Ln as Decision, Un as GrantedDecision, dt as TokenVerifier, j as PolicyVocabulary, or as Membership } from "../policy-types-CCiDRZBH.js";
+import { Hn as ApprovalRequiredDecision, Un as Decision, Yn as GrantedDecision, Zt as Snapshot, fr as Membership, ht as TokenVerifier, j as PolicyVocabulary } from "../policy-types-DGIO_gxq.js";
 import { u as Permission } from "../permission-types-CAY-GU7e.js";
 import { r as Role } from "../vocabulary-DEJ5j4mR.js";
-import { d as UncheckedData, s as RowData } from "../permdock-B6Sf4T_S.js";
-import { c as requiredPlans } from "../errors-zi_4T-rx.js";
-import { i as describe, r as DescribeOptions, t as DecisionDescription } from "../describe-ByS9LgHK.js";
+import { d as UncheckedData, s as RowData } from "../permdock-CprAPN3w.js";
+import { c as requiredPlans } from "../errors-BIM4MFsJ.js";
+import { i as describe, r as DescribeOptions, t as DecisionDescription } from "../describe-BbFPBSms.js";
 import { t as PermissionBoundaryState } from "../boundary-C9ck-3uK.js";
-import { n as ProtectedAction, t as ActionResult } from "../action-result-CL-QCITA.js";
+import { n as ProtectedAction, t as ActionResult } from "../action-result-BcudBQOF.js";
 import { t as approvalHeaders } from "../headers-B9jQxjtW.js";
-import { a as FilterResult, b as eventSourceRefresh, c as PermissionSet, d as ProtectedActionView, f as ProviderOptionsBase, h as TenantView, i as ClientStatus, l as PermissionState, m as SubjectView, n as ApprovalState, o as GateMode, p as RolesOptions, r as ClientPermDock, s as GateView, t as ApprovalHandle, v as EventSourceRefreshOptions, y as RefreshTrigger } from "../types-B_d_g7T3.js";
+import { a as FilterResult, b as eventSourceRefresh, c as PermissionSet, d as ProtectedActionView, f as ProviderOptionsBase, h as TenantView, i as ClientStatus, l as PermissionState, m as SubjectView, n as ApprovalState, o as GateMode, p as RolesOptions, r as ClientPermDock, s as GateView, t as ApprovalHandle, v as EventSourceRefreshOptions, y as RefreshTrigger } from "../types-tQB2CEnY.js";
 import { Accessor, Accessor as Accessor$1, JSX } from "solid-js";
 //#region src/solid/types.d.ts
 /** Structural `JSX.Element`: text, a DOM node or a list of children. */

package/dist/solid-start/index.d.ts

@@ -1,9 +1,9 @@
-import { Gt as Snapshot, T as Policy, j as PolicyVocabulary, sr as Principal } from "../policy-types-CCiDRZBH.js";
+import { T as Policy, Zt as Snapshot, j as PolicyVocabulary, pr as Principal } from "../policy-types-DGIO_gxq.js";
 import { u as Permission } from "../permission-types-CAY-GU7e.js";
 import { a as OperationInput, t as Operation } from "../operations-Ci_rT6Uo.js";
-import { a as PermDock } from "../permdock-B6Sf4T_S.js";
-import { D as ConnectionOptions, T as Connection, f as InvalidSignatureError, i as OpenApiHooks, o as ProtectOptions, u as SnapshotQuery, v as discoverViaSignatureAgent, x as webBotAuthVerifier } from "../server-types-CIlpSA2G.js";
-import { a as ProtectTarget, n as FetchAdapterOptions, t as ContextReader } from "../fetch-adapter-C1DCvpqV.js";
+import { a as PermDock } from "../permdock-CprAPN3w.js";
+import { D as ConnectionOptions, T as Connection, f as InvalidSignatureError, i as OpenApiHooks, o as ProtectOptions, u as SnapshotQuery, v as discoverViaSignatureAgent, x as webBotAuthVerifier } from "../server-types-CyRN0-Cd.js";
+import { a as ProtectTarget, n as FetchAdapterOptions, t as ContextReader } from "../fetch-adapter-BIbBAtPZ.js";
 import { APIEvent, FetchEvent } from "@solidjs/start/server";
 //#region src/solid-start/create.d.ts
 /** The h3 event under every SolidStart request; `subject` and `scope` read it. */

package/dist/solid-start/index.js

@@ -1,6 +1,6 @@
 import { l as InvalidSignatureError, p as webBotAuthVerifier, u as discoverViaSignatureAgent } from "../evaluations-IBceAeKT.js";
-import { i as decorate } from "../bind-D_sZSVA3.js";
-import { n as guardedRoute, t as fetchAdapter } from "../fetch-adapter-JL43jD3E.js";
+import { i as decorate } from "../bind-BNQA9JK9.js";
+import { n as guardedRoute, t as fetchAdapter } from "../fetch-adapter-dPTgJVHd.js";
 //#region src/solid-start/create.ts
 /**
 * `event.locals`. Its type, `App.RequestEventLocals`, is declared by

package/dist/{sources-B1Os_YUu.d.ts → sources-CWG32C0G.d.ts}

@@ -1,5 +1,5 @@
-import { et as MembershipSource } from "./policy-types-CCiDRZBH.js";
-import { n as RoleMap, r as RoleThrough, x as SupabaseSuspension } from "./types-ah9NlU6j.js";
+import { nt as MembershipSource } from "./policy-types-DGIO_gxq.js";
+import { n as RoleMap, r as RoleThrough, x as SupabaseSuspension } from "./types-BMVDHvI0.js";
 import { t as SqlQuery } from "./sql-B80DFdpG.js";
 import { c as SupabaseManifestMembership } from "./manifest-CzzWtnAb.js";
 //#region src/supabase/roles.d.ts

package/dist/{src-DZ0l9UAg.js → src-C_pi2Rnh.js}

@@ -8,7 +8,7 @@ import { n as internalsOf } from "./internals-B3IgHrvo.js";
 import { c as listPermissions, i as getRegistry, n as findPermission, o as isPermission } from "./permission-registry-B8tYxPIt.js";
 import { n as isThenable$1 } from "./thenable-BNSM1U2R.js";
 import { c as isEdgeRelation, m as restrictedStops, o as groupEntries, s as isComputedRelation, u as isPrincipalRelation } from "./resource-relations-8-pCScBO.js";
-import { a as durationOf, g as secondsOf, m as rfc3339, p as nowSeconds } from "./time-nR1JesoH.js";
+import { a as durationOf, f as nowMillis, g as secondsOf, m as rfc3339, p as nowSeconds } from "./time-nR1JesoH.js";
 import { a as normalizeMembership$1, d as scopeIdOf, f as scopeList, h as tenantOf, l as rootScope, o as normalizeMemberships$1, s as resolveScope$1, u as scopeChain } from "./scopes-0Up_UA2t.js";
 import { u as evaluateCondition } from "./delegation-CDB6_keF.js";
 import { _ as listPlans, a as authenticated, m as findRole, o as flattenGrantee } from "./grantee-Dke-9rd1.js";
@@ -16,12 +16,12 @@ import { m as tenantsOf, r as isMembershipExpired } from "./tenancy-5d1zVBvK.js"
 import { c as levelNames, i as grantList, n as declaredRoleNames } from "./policy-CLQ8__GF.js";
 import { o as isPortableCondition } from "./hosted-D0IzESu_.js";
 import { n as OPERATION_RISKS, r as isOperationRisk } from "./permissions-CVXmRILq.js";
-import { C as tenantCustomRoles, S as roleAllowKeys, f as customRoleId, l as ceilingGrants, m as customRoleScope, p as customRoleOf, x as resolveCustomRole } from "./evaluate-Dd8Ta0Ie.js";
-import { a as heldLevels, f as bindingOf, h as usesAssigns, m as roleMeta, n as snapshotScopes, o as collectSnapshotGrants, p as rankRoles, r as assignableCandidates, t as snapshotOf } from "./instance-snapshot--JWiTrvO.js";
+import { C as tenantCustomRoles, S as roleAllowKeys, f as customRoleId, l as ceilingGrants, m as customRoleScope, p as customRoleOf, x as resolveCustomRole } from "./evaluate-BAmf_AQd.js";
+import { a as heldLevels, f as bindingOf, h as usesAssigns, m as roleMeta, n as snapshotScopes, o as collectSnapshotGrants, p as rankRoles, r as assignableCandidates, t as snapshotOf } from "./instance-snapshot-DuWf1cT3.js";
 import { n as relationId } from "./relations-BxvRvDHK.js";
 import { i as snapshotGrant, r as plainPermission, t as buildSnapshot } from "./snapshot-CXlzi69u.js";
 import { n as LOCAL_CUSTOM_ROLE } from "./parse-local-manifest-DEiCF4ah.js";
-import { c as APP, r as resolveSubject } from "./permdock-L-_I_3zP.js";
+import { c as APP, r as resolveSubject } from "./permdock-BvjivVb9.js";
 import { i as memoryApprovalStore } from "./store-RNFvaJJv.js";
 import { n as wrapPermDock } from "./wrap-B2wziJI_.js";
 //#region src/conditions/sql-function.ts
@@ -819,6 +819,107 @@ function signPolicyDocument(document, signer, options) {
 	});
 }
 //#endregion
+//#region src/core/version-cache.ts
+const MAX_STALE_CEILING_MS = 6e4;
+const DEFAULT_MAX_ENTRIES = 1e4;
+/**
+* An in-process `VersionCache`: a bounded LRU keyed by principal id that keeps
+* resolved versions and shares reads in flight. Create it once at module
+* scope.
+*/
+function memoryVersionCache(options) {
+	const maxStaleMs = Math.min(Math.max(Math.floor(options.maxStaleMs), 0), MAX_STALE_CEILING_MS);
+	const maxEntries = Math.max(Math.floor(options.maxEntries ?? DEFAULT_MAX_ENTRIES), 1);
+	const entries = /* @__PURE__ */ new Map();
+	const inFlight = /* @__PURE__ */ new Map();
+	const counts = {
+		reads: 0,
+		shared: 0,
+		hits: 0,
+		evictions: 0
+	};
+	const now = () => nowMillis(options.now?.());
+	const store = (id, entry) => {
+		entries.delete(id);
+		entries.set(id, entry);
+		if (entries.size > maxEntries) {
+			const oldest = entries.keys().next();
+			if (oldest.done !== true) entries.delete(oldest.value);
+		}
+	};
+	const observe = (principal, at) => {
+		const claimed = principal.authzVersion;
+		if (typeof claimed !== "number") return;
+		const issued = typeof principal.issuedAt === "number" ? principal.issuedAt * 1e3 : void 0;
+		const entry = entries.get(principal.id);
+		if (entry === void 0) {
+			if (issued !== void 0 && issued <= at && at - issued <= maxStaleMs) store(principal.id, {
+				version: claimed,
+				at: issued
+			});
+			return;
+		}
+		if (claimed > entry.version) store(principal.id, {
+			version: claimed,
+			at: issued === void 0 ? entry.at : Math.max(entry.at, issued)
+		});
+	};
+	const start = (id, read, at) => {
+		counts.reads += 1;
+		const keep = (version) => {
+			if (typeof version === "number" && Number.isFinite(version)) {
+				const entry = entries.get(id);
+				store(id, {
+					version: Math.max(version, entry?.version ?? version),
+					at
+				});
+			}
+			return version;
+		};
+		const answer = read();
+		if (!isThenable$1(answer)) return keep(answer);
+		const pending = Promise.resolve(answer).then((version) => inFlight.get(id) === pending ? keep(version) : version);
+		inFlight.set(id, pending);
+		const settle = () => {
+			if (inFlight.get(id) === pending) inFlight.delete(id);
+		};
+		pending.then(settle, settle);
+		return pending;
+	};
+	return Object.freeze({
+		name: "memory",
+		maxStaleMs,
+		current(principal, read, { live }) {
+			const at = now();
+			if (live) return start(principal.id, read, at);
+			observe(principal, at);
+			const entry = entries.get(principal.id);
+			if (entry !== void 0 && at - entry.at <= maxStaleMs) {
+				counts.hits += 1;
+				store(principal.id, entry);
+				return entry.version;
+			}
+			const pending = inFlight.get(principal.id);
+			if (pending !== void 0) {
+				counts.shared += 1;
+				return pending;
+			}
+			return start(principal.id, read, at);
+		},
+		evict(principal) {
+			counts.evictions += 1;
+			entries.delete(principal);
+			inFlight.delete(principal);
+		},
+		stats() {
+			return {
+				...counts,
+				size: entries.size
+			};
+		}
+	});
+}
+//#endregion
 //#region src/core/arazzo.ts
 const VERSION = /^1\.[01]\.\d+(?:-.+)?$/u;
 const STEP_TARGETS = [
@@ -2039,4 +2140,4 @@ function toCsvRow(event) {
 	].map(field).join(",");
 }
 //#endregion
-export { memoryCustomRoleSource as A, stripeEntitlementSource as C, validateApprovalPolicy as D, memoryApprovalPolicySource as E, sqlFunction as F, memoryMembershipSource as M, memorySettingsSource as N, defineOperations as O, memorySnapshotSource as P, memoryLimitStore as S, approvalPoliciesFor as T, arazzoFindings as _, normalizeMembership as a, memoryRelationSource as b, crud as c, snapshotFor as d, customRoleSource as f, localSnapshotManifest as g, defineApp as h, decideRoleChange as i, memoryEntitlementSource as j, isOperationEffect as k, readable as l, shadowMode as m, toCsvRow as n, normalizeMemberships as o, mayAccess as p, checkRoleChange as r, resolveScope as s, CSV_COLUMNS as t, writable as u, simulateArazzo as v, approvalPolicies as w, limits as x, signPolicyDocument as y };
+export { isOperationEffect as A, memoryLimitStore as C, memoryApprovalPolicySource as D, approvalPoliciesFor as E, memorySnapshotSource as F, sqlFunction as I, memoryEntitlementSource as M, memoryMembershipSource as N, validateApprovalPolicy as O, memorySettingsSource as P, limits as S, approvalPolicies as T, arazzoFindings as _, normalizeMembership as a, signPolicyDocument as b, crud as c, snapshotFor as d, customRoleSource as f, localSnapshotManifest as g, defineApp as h, decideRoleChange as i, memoryCustomRoleSource as j, defineOperations as k, readable as l, shadowMode as m, toCsvRow as n, normalizeMemberships as o, mayAccess as p, checkRoleChange as r, resolveScope as s, CSV_COLUMNS as t, writable as u, simulateArazzo as v, stripeEntitlementSource as w, memoryRelationSource as x, memoryVersionCache as y };

package/dist/ssf/index.d.ts

@@ -1,4 +1,4 @@
-import { A as SsfSubject, C as SsfEventName, D as SsfReceiver, E as SsfPermDockOptions, M as SsfTransmitterConfiguration, N as SsfVerification, O as SsfStreamConfiguration, S as SsfEventListener, T as SsfPermDock, _ as SetSubject, a as PollHandle, b as SsfEventHandler, c as PushSetOptions, d as SetDelivery, f as SetDeliveryFailureCause, g as SetQueue, h as SetPollHandlerOptions, i as CaepReason, j as SsfSubjectResolver, k as SsfStreamStatus, l as ReplayStore, m as SetEvent, n as CaepEventName, o as PollOptions, p as SetError, r as CaepInitiatingEntity, s as PollResult, t as CaepCommon, u as RiscEventName, v as SignSetOptions, w as SsfOnEvent, x as SsfEventInput, y as SsfAuditEvent } from "../types-DjuMBNF9.js";
-import { t as memoryReplayStore } from "../replay-DNftIb_R.js";
-import { A as createPermDock, C as memorySsfStreamStore, D as PollSetsResult, E as PollSetsOptions, O as PolledSet, S as SsfStreamStore, T as setPollHandler, _ as SsfFanOut, a as CaepTokenClaimsChange, b as ssfTransmitter, c as RiscEvents, d as caepEvents, f as pushSet, g as FanOutSetOptions, h as streamVerificationEvent, i as CaepEvents, k as pollSets, l as SSF_POLL_DELIVERY, m as signSet, n as CaepCredentialChange, o as RiscAccountDisabled, p as riscEvents, r as CaepDeviceComplianceChange, s as RiscCredentialCompromise, t as CaepAssuranceLevelChange, u as SSF_PUSH_DELIVERY, v as SsfTransmitterOptions, w as memorySetQueue, x as SsfStream, y as fanOutSet } from "../index-BhxEUY9J.js";
+import { A as SsfSubject, C as SsfEventName, D as SsfReceiver, E as SsfPermDockOptions, M as SsfTransmitterConfiguration, N as SsfVerification, O as SsfStreamConfiguration, S as SsfEventListener, T as SsfPermDock, _ as SetSubject, a as PollHandle, b as SsfEventHandler, c as PushSetOptions, d as SetDelivery, f as SetDeliveryFailureCause, g as SetQueue, h as SetPollHandlerOptions, i as CaepReason, j as SsfSubjectResolver, k as SsfStreamStatus, l as ReplayStore, m as SetEvent, n as CaepEventName, o as PollOptions, p as SetError, r as CaepInitiatingEntity, s as PollResult, t as CaepCommon, u as RiscEventName, v as SignSetOptions, w as SsfOnEvent, x as SsfEventInput, y as SsfAuditEvent } from "../types-DsHGPtkR.js";
+import { t as memoryReplayStore } from "../replay-Bs9Df2fQ.js";
+import { A as createPermDock, C as memorySsfStreamStore, D as PollSetsResult, E as PollSetsOptions, O as PolledSet, S as SsfStreamStore, T as setPollHandler, _ as SsfFanOut, a as CaepTokenClaimsChange, b as ssfTransmitter, c as RiscEvents, d as caepEvents, f as pushSet, g as FanOutSetOptions, h as streamVerificationEvent, i as CaepEvents, k as pollSets, l as SSF_POLL_DELIVERY, m as signSet, n as CaepCredentialChange, o as RiscAccountDisabled, p as riscEvents, r as CaepDeviceComplianceChange, s as RiscCredentialCompromise, t as CaepAssuranceLevelChange, u as SSF_PUSH_DELIVERY, v as SsfTransmitterOptions, w as memorySetQueue, x as SsfStream, y as fanOutSet } from "../index-BinlXeU-.js";
 export { type CaepAssuranceLevelChange, type CaepCommon, type CaepCredentialChange, type CaepDeviceComplianceChange, type CaepEventName, type CaepEvents, type CaepInitiatingEntity, type CaepReason, type CaepTokenClaimsChange, type FanOutSetOptions, type PollHandle, type PollOptions, type PollResult, type PollSetsOptions, type PollSetsResult, type PolledSet, type PushSetOptions, type ReplayStore, type RiscAccountDisabled, type RiscCredentialCompromise, type RiscEventName, type RiscEvents, SSF_POLL_DELIVERY, SSF_PUSH_DELIVERY, type SetDelivery, type SetDeliveryFailureCause, type SetError, type SetEvent, type SetPollHandlerOptions, type SetQueue, type SetSubject, type SignSetOptions, type SsfAuditEvent, type SsfEventHandler, type SsfEventInput, type SsfEventListener, type SsfEventName, type SsfFanOut, type SsfOnEvent, type SsfPermDock, type SsfPermDockOptions, type SsfReceiver, type SsfStream, type SsfStreamConfiguration, type SsfStreamStatus, type SsfStreamStore, type SsfSubject, type SsfSubjectResolver, type SsfTransmitterConfiguration, type SsfTransmitterOptions, type SsfVerification, caepEvents, createPermDock, fanOutSet, memoryReplayStore, memorySetQueue, memorySsfStreamStore, pollSets, pushSet, riscEvents, setPollHandler, signSet, ssfTransmitter, streamVerificationEvent };

package/dist/{standard-webhooks-C-qX4mJW.d.ts → standard-webhooks-DOYEuOLx.d.ts}

@@ -1,5 +1,5 @@
-import { Rt as Instant, ar as JsonWebKeyLike } from "./policy-types-CCiDRZBH.js";
-import { l as ReplayStore } from "./types-DjuMBNF9.js";
+import { Wt as Instant, dr as JsonWebKeyLike } from "./policy-types-DGIO_gxq.js";
+import { l as ReplayStore } from "./types-DsHGPtkR.js";
 //#region src/server/standard-webhooks.d.ts
 /** The three Standard Webhooks headers a delivery carries. */
 type WebhookHeaders = {

package/dist/{stores-C0Kta5Ft.d.ts → stores-DZJvxFIZ.d.ts}

@@ -1,11 +1,11 @@
-import { Ln as Decision, j as PolicyVocabulary, or as Membership } from "./policy-types-CCiDRZBH.js";
+import { Un as Decision, fr as Membership, j as PolicyVocabulary } from "./policy-types-DGIO_gxq.js";
 import { u as Permission } from "./permission-types-CAY-GU7e.js";
 import { r as Role } from "./vocabulary-DEJ5j4mR.js";
-import { d as UncheckedData, s as RowData } from "./permdock-B6Sf4T_S.js";
-import { r as DescribeOptions, t as DecisionDescription } from "./describe-ByS9LgHK.js";
-import { n as ProtectedAction } from "./action-result-CL-QCITA.js";
-import { a as FilterResult, c as PermissionSet, h as TenantView, l as PermissionState, m as SubjectView, o as GateMode, p as RolesOptions, r as ClientPermDock, s as GateView, t as ApprovalHandle } from "./types-B_d_g7T3.js";
-import { n as ProtectedActionReadable, r as SveltePermDockOptions } from "./types-djVzLlIV.js";
+import { d as UncheckedData, s as RowData } from "./permdock-CprAPN3w.js";
+import { r as DescribeOptions, t as DecisionDescription } from "./describe-BbFPBSms.js";
+import { n as ProtectedAction } from "./action-result-BcudBQOF.js";
+import { a as FilterResult, c as PermissionSet, h as TenantView, l as PermissionState, m as SubjectView, o as GateMode, p as RolesOptions, r as ClientPermDock, s as GateView, t as ApprovalHandle } from "./types-tQB2CEnY.js";
+import { n as ProtectedActionReadable, r as SveltePermDockOptions } from "./types-CEinc15V.js";
 import { Readable } from "svelte/store";
 //#region src/svelte/stores.d.ts
 declare function setPermDock(options: SveltePermDockOptions): ClientPermDock;

package/dist/{stream-ltuLdtTG.d.ts → stream-9y9qw51m.d.ts}

@@ -1,5 +1,5 @@
 import { u as Permission } from "./permission-types-CAY-GU7e.js";
-import { o as ProtectOptions } from "./server-types-CIlpSA2G.js";
+import { o as ProtectOptions } from "./server-types-CyRN0-Cd.js";
 //#region src/server/stream.d.ts
 type StreamProtectOptions = ProtectOptions & {
   /**

package/dist/supabase/index.d.ts

@@ -1,10 +1,10 @@
-import { Rt as Instant, lr as Subject } from "../policy-types-CCiDRZBH.js";
-import { a as ApprovalDelegationSource, m as ApprovalStore, u as ApprovalRequest } from "../types-B_tiYvk8.js";
-import { a as SupabaseRpcClient, c as readSubjectRecord, i as SupabaseRpcCaller, n as PostgrestSourcesOptions, o as SupabaseRpcResult, r as SubjectRecord, s as postgrestSources, t as PostgrestSources } from "../postgrest-DicQyqm-.js";
-import { C as SupabaseClaims, D as SupabasePermDockClaims, E as SupabaseMembershipClaim, O as supabaseClaims, S as SupabaseActClaim, T as SupabaseClaimsSchema, _ as SupabaseStorage, a as SupabaseActor, b as SupabaseSuspendedScope, c as SupabaseInclude, d as SupabasePrincipal, f as SupabaseRealtime, g as SupabaseSessionLike, h as SupabaseRlsOptions, i as SupabaseActiveRow, l as SupabaseMembershipTable, m as SupabaseRlsMembershipTable, o as SupabaseActorResult, p as SupabaseRlsConfig, r as RoleThrough, s as SupabaseDelegation, t as AuthorizeSqlOptions, u as SupabasePermissionRef, v as SupabaseSubjectOptions, w as SupabaseClaimsOptions, x as SupabaseSuspension, y as SupabaseSuspendedMembership } from "../types-ah9NlU6j.js";
+import { Wt as Instant, hr as Subject } from "../policy-types-DGIO_gxq.js";
+import { a as ApprovalDelegationSource, m as ApprovalStore, u as ApprovalRequest } from "../types-DLvhVm1r.js";
+import { a as SupabaseRpcClient, c as readSubjectRecord, i as SupabaseRpcCaller, n as PostgrestSourcesOptions, o as SupabaseRpcResult, r as SubjectRecord, s as postgrestSources, t as PostgrestSources } from "../postgrest-D5nUGm-c.js";
+import { C as SupabaseClaims, D as SupabasePermDockClaims, E as SupabaseMembershipClaim, O as supabaseClaims, S as SupabaseActClaim, T as SupabaseClaimsSchema, _ as SupabaseStorage, a as SupabaseActor, b as SupabaseSuspendedScope, c as SupabaseInclude, d as SupabasePrincipal, f as SupabaseRealtime, g as SupabaseSessionLike, h as SupabaseRlsOptions, i as SupabaseActiveRow, l as SupabaseMembershipTable, m as SupabaseRlsMembershipTable, o as SupabaseActorResult, p as SupabaseRlsConfig, r as RoleThrough, s as SupabaseDelegation, t as AuthorizeSqlOptions, u as SupabasePermissionRef, v as SupabaseSubjectOptions, w as SupabaseClaimsOptions, x as SupabaseSuspension, y as SupabaseSuspendedMembership } from "../types-BMVDHvI0.js";
 import { t as SqlQuery } from "../sql-B80DFdpG.js";
 import { _ as hasTokenHook, a as SupabaseManifestActiveRow, c as SupabaseManifestMembership, d as SupabaseManifestResourceNames, f as SupabaseManifestRls, g as SupabaseManifestValue, h as SupabaseManifestThrough, i as SupabaseManifest, l as SupabaseManifestNames, m as SupabaseManifestScopeNames, n as SupabaseHookClaim, o as SupabaseManifestColumn, p as SupabaseManifestRole, r as SupabaseHookManifest, s as SupabaseManifestHelper, t as SupabaseDatabaseManifest, u as SupabaseManifestRequires, v as parseSupabaseManifest } from "../manifest-CzzWtnAb.js";
-import { a as MembershipStream, c as SupabasePostgres, d as supabasePostgresQuery, f as tableMembershipSource, i as MembershipSql, l as authzVersion, n as MembershipHolders, o as MembershipTableOptions, r as MembershipJunctionOptions, s as SqlMembershipSource, t as AUTHZ_VERSION_TABLE, u as junctionMembershipSource } from "../sources-B1Os_YUu.js";
+import { a as MembershipStream, c as SupabasePostgres, d as supabasePostgresQuery, f as tableMembershipSource, i as MembershipSql, l as authzVersion, n as MembershipHolders, o as MembershipTableOptions, r as MembershipJunctionOptions, s as SqlMembershipSource, t as AUTHZ_VERSION_TABLE, u as junctionMembershipSource } from "../sources-CWG32C0G.js";
 import { n as supabaseTenantClaim, t as supabaseMembershipsBudget } from "../budget-hYsPz_yE.js";
 //#region src/supabase/capability.d.ts
 type ExchangeCapabilityOptions = {

package/dist/supabase/index.js

@@ -1,6 +1,6 @@
-import { a as supabaseClaims, i as supabaseApprovalStore, n as supabaseRls, o as exchangeCapability, r as tableApprovalDelegationSource, t as authorizeSql } from "../supabase-BL1qJzzY.js";
+import { a as supabaseClaims, i as supabaseApprovalStore, n as supabaseRls, o as exchangeCapability, r as tableApprovalDelegationSource, t as authorizeSql } from "../supabase-DnMMg5Fn.js";
 import { n as supabaseTenantClaim, t as supabaseMembershipsBudget } from "../budget-BELja5A9.js";
 import { c as tableMembershipSource, i as authzVersion, o as junctionMembershipSource, s as supabasePostgresQuery, t as AUTHZ_VERSION_TABLE } from "../sources-CMAM-2A3.js";
-import { a as delegationOf, c as subjectFromSupabaseSession, i as actorOf, n as postgrestSources, r as readSubjectRecord, s as subjectFromSupabase } from "../postgrest-D4nuPXIQ.js";
+import { a as delegationOf, c as subjectFromSupabaseSession, i as actorOf, n as postgrestSources, r as readSubjectRecord, s as subjectFromSupabase } from "../postgrest-5Dr3W64L.js";
 import { n as parseSupabaseManifest, t as hasTokenHook } from "../manifest-wg8WkkpD.js";
 export { AUTHZ_VERSION_TABLE, actorOf, authorizeSql, authzVersion, delegationOf, exchangeCapability, hasTokenHook, junctionMembershipSource, parseSupabaseManifest, postgrestSources, readSubjectRecord, subjectFromSupabase, subjectFromSupabaseSession, supabaseApprovalStore, supabaseClaims, supabaseMembershipsBudget, supabasePostgresQuery, supabaseRls, supabaseTenantClaim, tableApprovalDelegationSource, tableMembershipSource };

package/dist/supabase/middleware.d.ts

@@ -1,10 +1,10 @@
-import { T as Policy, j as PolicyVocabulary, lr as Subject, sr as Principal } from "../policy-types-CCiDRZBH.js";
+import { T as Policy, hr as Subject, j as PolicyVocabulary, pr as Principal } from "../policy-types-DGIO_gxq.js";
 import { u as Permission } from "../permission-types-CAY-GU7e.js";
-import { a as PermDock } from "../permdock-B6Sf4T_S.js";
-import { t as InstanceOptions } from "../instance-options-B0KXqTrJ.js";
+import { a as PermDock } from "../permdock-CprAPN3w.js";
+import { t as InstanceOptions } from "../instance-options-CoHn-0e8.js";
 import { t as RequestContext } from "../request-context-C2_1lchh.js";
-import { i as OpenApiHooks } from "../server-types-CIlpSA2G.js";
-import { n as ServerAdapterServices } from "../bind-Cp2hBHzP.js";
+import { i as OpenApiHooks } from "../server-types-CyRN0-Cd.js";
+import { n as ServerAdapterServices } from "../bind-YYjvfpB9.js";
 import { Middleware } from "@supabase/middleware";
 //#region src/supabase/middleware.d.ts
 /**

package/dist/supabase/middleware.js

@@ -1,11 +1,11 @@
 import { t as compact } from "../compact-CAf557ZB.js";
-import { l as withApp } from "../permdock-L-_I_3zP.js";
+import { l as withApp } from "../permdock-BvjivVb9.js";
 import { t as composeWraps } from "../wrap-B2wziJI_.js";
 import { r as credentialSubject } from "../credential-CyyyvCsL.js";
 import { o as methodNotAllowed } from "../problem-BVLHFK33.js";
-import { r as instanceOptions } from "../build-instance-CNWaYJyr.js";
-import { t as createPermDock$1 } from "../create-_noSrY1T.js";
-import { n as attached } from "../bind-D_sZSVA3.js";
+import { r as instanceOptions } from "../build-instance-BWXqwQYU.js";
+import { t as createPermDock$1 } from "../create-BLPKnJKa.js";
+import { n as attached } from "../bind-BNQA9JK9.js";
 import { defineMiddleware } from "@supabase/middleware";
 //#region src/supabase/middleware.ts
 const SECRET_KEY_NAME = /^[A-Za-z0-9_-]+$/u;