permdock 0.9.0 → 0.11.0

package/dist/{collect-B80GYEot.js → collect-D9Tt0Bcx.js}

@@ -29,7 +29,7 @@ const collect = defineLeaf({
 		};
 		if (flags.watch) {
 			if (flags.check) throw new CliError("usage", "collect: --watch writes the catalog; drop --check", { code: "invalid_value" });
-			return (await import("./watch-ClLuO2TL.js")).watchCollect(ctx, overrides);
+			return (await import("./watch-COuvly20.js")).watchCollect(ctx, overrides);
 		}
 		const result = await (await import("./collect-D-eroIfV.js")).runCollect({
 			cwd: ctx.cwd,

package/dist/{completion-_bc0OUQ-.js → completion-DLTuCf53.js}

@@ -1,6 +1,6 @@
 import { n as CliError } from "./errors-Vpu6rKHl.js";
 import { a as suggestion, o as GLOBAL_FLAGS } from "./args-0FrVs5EH.js";
-import { a as resolve } from "./manifest-B2QPh19C.js";
+import { a as resolve } from "./manifest-Cav1rjNQ.js";
 import { t as defineLeaf } from "./command-L8EstFNm.js";
 //#region src/cli/core/completion.ts
 const SHELLS = [

package/dist/{config-BwPBfN0t.js → config-BR23fL8m.js}

@@ -1,6 +1,6 @@
 import { r as isRecord } from "./compact-CAf557ZB.js";
 import { i as configError, n as CliError } from "./errors-Vpu6rKHl.js";
-import { a as isSection, i as isModuleKey, n as MODULE_KEYS, o as kindOf, r as describeKinds, t as CONFIG_SHAPE } from "./config-shape-ykV0Vm2n.js";
+import { a as isSection, i as isModuleKey, n as MODULE_KEYS, o as kindOf, r as describeKinds, t as CONFIG_SHAPE } from "./config-shape-tsxHx71E.js";
 import { existsSync } from "node:fs";
 import { relative, resolve } from "node:path";
 //#region src/cli/project/config-schema.ts
@@ -89,7 +89,7 @@ function hasModuleValue(raw) {
 	return isRecord(raw) && Object.keys(MODULE_KEYS).some((key) => isRecord(raw[key]));
 }
 async function traceValues(cwd, file, display, config, options) {
-	const { traceModuleValues } = await import("./module-values-BJTBdo6y.js");
+	const { traceModuleValues } = await import("./module-values-B1EVTkHP.js");
 	return traceModuleValues({
 		cwd,
 		file,

package/dist/{config-D5XrLWpk.js → config-CmydKZr2.js}

@@ -10,7 +10,7 @@ const config = defineLeaf({
 		...failOnFlag
 	},
 	async run(ctx, { flags }) {
-		const { runConfig } = await import("./config-report-BmWIskD7.js");
+		const { runConfig } = await import("./config-report-5AwptLr2.js");
 		return runConfig({
 			cwd: ctx.cwd,
 			config: ctx.config,

package/dist/{config-report-BmWIskD7.js → config-report-5AwptLr2.js}

@@ -2,8 +2,8 @@ import { a as rel, t as defaultSrcPath } from "./files-BSjrtIHw.js";
 import { r as CONFIG_REPORT_SCHEMA } from "./version-DMQ0dnN5.js";
 import { t as catalogPath } from "./catalog-path-CnI0XTFK.js";
 import { n as guessPermissions, t as barrelFile } from "./collect-WCl8cJQV.js";
-import "./sources-CMAM-2A3.js";
-import { t as DOCS_BASE } from "./manifest-B2QPh19C.js";
+import "./sources-C4vkzZJV.js";
+import { t as DOCS_BASE } from "./manifest-Cav1rjNQ.js";
 import { n as MIGRATION_DIRS, t as DEFAULT_SENSITIVE_ACTIONS } from "./constants-DcJABbLW.js";
 //#region src/cli/config-report.ts
 function configReport(input) {

package/dist/{config-shape-ykV0Vm2n.js → config-shape-tsxHx71E.js}

@@ -81,7 +81,8 @@ const CONFIG_SHAPE = {
 		out: STRING,
 		resources: ARRAY,
 		action: STRING,
-		manifest: STRING
+		manifest: STRING,
+		tables: OBJECT
 	},
 	doctor: {
 		sensitiveActions: ARRAY,

package/dist/{create-BamXmeob.d.ts → create-CDd9c22W.d.ts}

@@ -4,7 +4,7 @@ import { _ as PrincipalSource, a as PermDock, n as DecideOptions, o as PermDockO
 import { m as ApprovalStore } from "./types-DLvhVm1r.js";
 import { a as AutomationSource } from "./automation-C6Jg75xq.js";
 import { n as ApprovalWaiter } from "./waiter-CqUKX6CY.js";
-import { i as RunBinding, r as RunAutomation } from "./run-ticket-B2o2Kxz8.js";
+import { c as RunResource, i as RunBinding, r as RunAutomation } from "./run-ticket-ylovhyFQ.js";
 //#region src/workflow/create.d.ts
 type WorkflowPermDockOptions = PermDockOptions & {
   /** Signs the run tickets `start` mints. */
@@ -47,6 +47,14 @@ type AutomationOptions = {
   /** The run id (`jti`); a fresh UUID when absent. */
   readonly id?: string;
   readonly binding?: RunBinding;
+  /**
+   * The record the run is bound to. The automation's permissions on
+   * `resource.type` then hold on that id only, through an
+   * `authorization_details` `identifier`; a check on another id, or with no
+   * row, denies. Its other permissions are unchanged. A type none of its
+   * permissions is on denies the start.
+   */
+  readonly resource?: RunResource;
   readonly now?: Instant;
 };
 type StartAutomationResult = {
@@ -55,6 +63,7 @@ type StartAutomationResult = {
   readonly run: {
     readonly id: string;
     readonly automation: RunAutomation;
+    readonly resource?: RunResource;
   };
 } | {
   readonly outcome: "denied";

package/dist/{doctor-LPMYjSqO.js → doctor-DxyVeUEE.js}

@@ -10,7 +10,7 @@ const doctor = defineLeaf({
 			description: "Check codes or groups to run",
 			valueHint: "code",
 			async complete() {
-				const { DOCTOR_CHECKS } = await import("./doctor-ClRVAtXQ.js");
+				const { DOCTOR_CHECKS } = await import("./doctor-ktitU5Dl.js");
 				return [.../* @__PURE__ */ new Set([...DOCTOR_CHECKS.map(({ code }) => code), ...DOCTOR_CHECKS.flatMap(({ groups }) => groups)])];
 			}
 		},
@@ -27,7 +27,7 @@ const doctor = defineLeaf({
 			if (answer === void 0) return CANCELLED;
 			fix = answer;
 		}
-		return (await import("./doctor-ClRVAtXQ.js")).runDoctor({
+		return (await import("./doctor-ktitU5Dl.js")).runDoctor({
 			cwd: ctx.cwd,
 			config: ctx.config,
 			only: flags.only,

package/dist/{doctor-ClRVAtXQ.js → doctor-ktitU5Dl.js}

@@ -1,8 +1,9 @@
+import { r as isRecord } from "./compact-CAf557ZB.js";
 import { o as hasConditionOp } from "./refs-C8BKxc_e.js";
 import { c as listPermissions, h as formerKeys } from "./permission-registry-B8tYxPIt.js";
 import { u as isPrincipalRelation } from "./resource-relations-8-pCScBO.js";
 import { t as canonicalJson } from "./canonical-json-DwilZ1iB.js";
-import { f as scopeList, o as normalizeMemberships, s as resolveScope } from "./scopes-0Up_UA2t.js";
+import { f as scopeList, l as rootScope, o as normalizeMemberships, s as resolveScope } from "./scopes-0Up_UA2t.js";
 import { o as flattenGrantee } from "./grantee-Dke-9rd1.js";
 import { u as separationConflicts } from "./policy-CLQ8__GF.js";
 import { T as validateCustomRole } from "./evaluate-BAmf_AQd.js";
@@ -18,30 +19,32 @@ import { r as runCollect } from "./collect-WCl8cJQV.js";
 import { i as qualifySqlTable, s as quoteSqlLiteral } from "./sql-0WjxIp9g.js";
 import { a as scopeMembershipTable } from "./compile-EzEMB-7v.js";
 import { n as supabaseTenantClaim } from "./budget-BELja5A9.js";
-import { d as keptKeys, r as PERMDOCK_SCHEMA } from "./sources-CMAM-2A3.js";
+import { d as keptKeys, r as PERMDOCK_SCHEMA } from "./sources-C4vkzZJV.js";
 import { t as parseCatalog } from "./parse-1_ZheTW5.js";
+import { n as activeTenantMismatch } from "./active-tenant-DVee32-T.js";
 import "./markers-BeHZ4x9Q.js";
 import { t as didYouMean } from "./args-0FrVs5EH.js";
-import { t as DOCS_BASE } from "./manifest-B2QPh19C.js";
+import { t as DOCS_BASE } from "./manifest-Cav1rjNQ.js";
 import { t as createStyle } from "./style-Ds11Hmk4.js";
-import { a as nonEmptyOr, r as findingOf } from "./output-DV5dwOTs.js";
-import { i as runSkillsInstall } from "./skills-CQQcuGBi.js";
+import { a as nonEmptyOr, r as findingOf } from "./output-CtyBwTNB.js";
+import { i as runSkillsInstall } from "./skills-Bar7ZqwM.js";
 import { n as MIGRATION_DIRS, t as DEFAULT_SENSITIVE_ACTIONS } from "./constants-DcJABbLW.js";
 import { l as partPath } from "./output-files-BIQ_9pIs.js";
-import { _ as supabaseConfig, a as supabaseHookManifest, c as pd039, g as readSupabaseConfig, h as pd074, m as pd045, n as hookOut, p as attrsPlan, u as resolveSchemas } from "./supabase-hook-CrgU06WH.js";
-import { G as byKey, Q as graphSqlName, n as tableNameOf, o as graphPlan, r as tableNames } from "./tables-BqrxBCir.js";
-import { a as guardedTables, p as contextRefs, r as unsatisfiedKinds, t as ownershipRules } from "./ownership-DA5YdYTm.js";
+import { _ as readSupabaseConfig, a as supabaseHookManifest, c as activeSource, d as resolveSchemas, g as pd074, h as pd045, l as pd039, m as attrsPlan, n as hookOut, v as supabaseConfig } from "./supabase-hook-CyuD9Wau.js";
+import { G as byKey, Q as graphSqlName, n as tableNameOf, o as graphPlan, r as tableNames } from "./tables-DimBcVWY.js";
+import { a as guardedTables, p as contextRefs, r as unsatisfiedKinds, t as ownershipRules } from "./ownership-qqBuGJXr.js";
 import { t as membershipSourcesOf } from "./sources-qoIJQrJv.js";
 import { i as group, n as membershipColumns, o as sqlStatements, r as tableKey } from "./deciding-columns-NB4wcyBf.js";
-import { t as resolveNames } from "./resolve-names-ConCSj1y.js";
-import { t as FIELD_VIEWS } from "./fields-D0vUI6dq.js";
-import { a as pd010, c as pd014, d as pd038, f as pd041, i as pd008, l as pd015, n as pd001, o as pd011, p as pd057, r as pd007, s as pd013, t as runUsage, u as pd036 } from "./usage-B9EtHWLa.js";
-import { d as rowConditionMessage, f as commandFor, m as tableFor, p as compileGrants, s as ROW_CONDITION_FIX, u as helperTablePolicies } from "./verify-DlUcTDBz.js";
-import { a as streamOf, i as scopeSourcesOf, r as staleFiles, t as powersyncFiles } from "./powersync-CJrT1DSc.js";
-import { a as buildContext, n as generateOptions, r as isRefusal, s as inheritTargets, t as supautilsRejections } from "./supautils-ByezN3b8.js";
+import { t as FIELD_VIEWS } from "./fields-DI8s3cPl.js";
+import { t as resolveNames } from "./resolve-names-Y1Cb22cp.js";
+import { a as pd010, c as pd014, d as pd038, f as pd041, i as pd008, l as pd015, n as pd001, o as pd011, p as pd057, r as pd007, s as pd013, t as runUsage, u as pd036 } from "./usage-Y6xZUfE-.js";
+import { d as rowConditionMessage, f as commandFor, m as tableFor, p as compileGrants, s as ROW_CONDITION_FIX, u as helperTablePolicies } from "./verify-6EauWrkP.js";
+import { a as streamOf, i as scopeSourcesOf, r as staleFiles, t as powersyncFiles } from "./powersync-CD8-Ypao.js";
+import { a as buildContext, n as generateOptions, r as isRefusal, s as inheritTargets, t as supautilsRejections } from "./supautils-C-_jqylY.js";
 import { n as legacyHelperNames, r as retirePlan, t as legacyHelperCalls } from "./retire-B2xffQgY.js";
 import { existsSync, readFileSync, readdirSync, statSync } from "node:fs";
 import { basename, dirname, join, resolve } from "node:path";
+import { pathToFileURL } from "node:url";
 import { createRequire } from "node:module";
 //#region src/cli/shared/doctor-files.ts
 const nodeFiles = Object.freeze({
@@ -212,6 +215,120 @@ async function pd064(input) {
 	}));
 }
 //#endregion
+//#region src/cli/doctor/better-supabase.ts
+const CONFIG_FILES = [
+	"better-supabase.config.ts",
+	"better-supabase.config.mts",
+	"better-supabase.config.js",
+	"better-supabase.config.mjs"
+];
+/** The default export of the project's `better-supabase.config.*`, if it loads. */
+async function betterSupabaseConfig(input) {
+	const files = filesOf(input);
+	const path = CONFIG_FILES.map((name) => resolve(input.cwd, name)).find((file) => files.exists(file));
+	if (path === void 0) return;
+	try {
+		const loaded = (await loadModule(path))["default"];
+		return isRecord(loaded) ? loaded : void 0;
+	} catch {
+		return;
+	}
+}
+function activeTenantOf(config) {
+	const blocks = config["blocks"];
+	const permissions = isRecord(blocks) ? blocks["permissions"] : void 0;
+	const value = isRecord(permissions) ? permissions["activeTenant"] : void 0;
+	if (value === "claim" || value === "resolver") return value;
+	if (isRecord(value) && typeof value["profileColumn"] === "string") {
+		const key = value["key"];
+		return {
+			profileColumn: value["profileColumn"],
+			...typeof key === "string" ? { key } : {}
+		};
+	}
+}
+/**
+* PermDock's token hook reads the active tenant from another place than
+* better-supabase's `blocks.permissions.activeTenant` writes it, so
+* `switch_organization` never changes the tenant claim.
+*/
+async function pd078(input) {
+	const hook = input.config.supabase?.hook;
+	if (hook === void 0) return [];
+	const config = await betterSupabaseConfig(input);
+	const activeTenant = config === void 0 ? void 0 : activeTenantOf(config);
+	if (activeTenant === void 0) return [];
+	const policy = await policyOf(input);
+	const root = policy === void 0 ? void 0 : rootScope(scopeList(policy.scopes));
+	let from;
+	try {
+		from = activeSource(hook.activeFrom, root ?? "tenant");
+	} catch {
+		return [];
+	}
+	const mismatch = activeTenantMismatch(from, input.config.rls?.tenantClaim ?? "tenant_id", activeTenant);
+	return mismatch === void 0 ? [] : [{
+		code: "PD078",
+		severity: "warning",
+		message: mismatch,
+		fix: "set supabase.hook.activeFrom, then run permdock supabase hook generate"
+	}];
+}
+function isBlockPermissionKey(value) {
+	return isRecord(value) && typeof value["module"] === "string" && typeof value["action"] === "string" && typeof value["key"] === "string";
+}
+/**
+* Every permission key the configured blocks check, from the project's own
+* `better-supabase/sql`; `undefined` when it does not resolve or refuses the
+* config.
+*/
+async function blockPermissionKeys(cwd, blocks) {
+	try {
+		const file = createRequire(resolve(cwd, "package.json")).resolve("better-supabase/sql");
+		const list = (await import(pathToFileURL(file).href))["modulePermissionKeys"];
+		if (!isKeyLister(list)) return;
+		const keys = list(blocks, Object.keys(blocks));
+		return Array.isArray(keys) ? keys.filter(isBlockPermissionKey) : void 0;
+	} catch {
+		return;
+	}
+}
+function isKeyLister(value) {
+	return typeof value === "function";
+}
+/**
+* A permission key a configured better-supabase block checks that the catalog
+* does not list: no role holds it, so the block's SQL checks deny it.
+*/
+async function pd079(input) {
+	const blocks = (await betterSupabaseConfig(input))?.["blocks"];
+	if (!isRecord(blocks)) return [];
+	const files = filesOf(input);
+	const path = catalogPath(input.config, input.cwd);
+	if (!files.exists(path)) return [];
+	let declared;
+	try {
+		declared = new Set(parseCatalog(files.read(path)).permissions.map(({ key }) => key));
+	} catch {
+		return [];
+	}
+	const keys = await blockPermissionKeys(input.cwd, blocks);
+	if (keys === void 0) return [];
+	const missing = /* @__PURE__ */ new Map();
+	for (const entry of keys) if (!declared.has(entry.key)) {
+		const uses = missing.get(entry.key) ?? [];
+		uses.push(`blocks.${entry.module}.permissions.${entry.action}`);
+		missing.set(entry.key, uses);
+	}
+	const catalog = rel(input.cwd, path);
+	return [...missing].map(([key, uses]) => ({
+		code: "PD079",
+		severity: "warning",
+		message: `${key} (${[...new Set(uses)].join(", ")}) is not in ${catalog}, so no role holds it and better-supabase's SQL check denies it`,
+		fix: `declare ${key} in the policy and run permdock collect, or map the block action to a key the catalog lists`
+	}));
+}
+//#endregion
 //#region src/cli/doctor/catalog.ts
 /**
 * A policy that declares `oauthScopes` against a catalog on disk without them,
@@ -2250,6 +2367,17 @@ const DOCTOR_CHECKS = [
 		when: (config) => config.policy !== void 0,
 		run: pd070
 	},
+	{
+		code: "PD078",
+		groups: ["supabase", "better-supabase"],
+		when: (config) => config.supabase?.hook !== void 0,
+		run: pd078
+	},
+	{
+		code: "PD079",
+		groups: ["catalog", "better-supabase"],
+		run: pd079
+	},
 	{
 		code: "PD005",
 		groups: ["skills"],

package/dist/{fields-D0vUI6dq.js → fields-DI8s3cPl.js}

@@ -1,7 +1,7 @@
 import { a as sole } from "./compact-CAf557ZB.js";
 import { i as configError } from "./errors-Vpu6rKHl.js";
 import { c as jsonSchemaOf } from "./catalog-doc-DjMKzJp9.js";
-import { A as quoteQualified, D as qualified, E as helperSchema, O as quoteIdent, _ as subjectClaimJsonSql, k as quoteLiteral, s as signedIn } from "./shared-Afctg7B0.js";
+import { A as quoteQualified, D as qualified, E as helperSchema, O as quoteIdent, _ as subjectClaimJsonSql, k as quoteLiteral, s as signedIn } from "./shared-DrGLwM3s.js";
 //#region src/cli/sql/clauses.ts
 /**
 * True when `sql` is one parenthesised expression, so AND / OR need not wrap it

package/dist/{gen-BtfFWGbz.js → gen-DuAhghDw.js}

@@ -10,7 +10,7 @@ import { c as requirePolicy } from "./load-DjSU5KXO.js";
 import { t as loadConfiguredOperations } from "./catalog-operations-DeHTrJSV.js";
 import { n as fileSummary, r as planFiles } from "./files-B3AA05f1.js";
 import { f as writeOutputFiles, r as driftOf } from "./output-files-BIQ_9pIs.js";
-import { t as resolveNames } from "./resolve-names-ConCSj1y.js";
+import { t as resolveNames } from "./resolve-names-Y1Cb22cp.js";
 import { i as schemaExpression } from "./generate-CezbCaTI.js";
 import { existsSync, readFileSync } from "node:fs";
 import { dirname, extname, relative, resolve } from "node:path";

package/dist/{gen-BFfzZSLH.js → gen-DwgCSC6V.js}

@@ -41,7 +41,7 @@ const gen = defineLeaf({
 		const out = given(flags.out);
 		const outDir = given(flags["out-dir"]);
 		const from = given(flags.policy);
-		const { runGen } = await import("./gen-BtfFWGbz.js");
+		const { runGen } = await import("./gen-DuAhghDw.js");
 		return runGen({
 			cwd: ctx.cwd,
 			config: ctx.config,

package/dist/{import-CST57XLp.js → import-CNBF96hB.js}

@@ -2,9 +2,9 @@ import { r as isRecord } from "./compact-CAf557ZB.js";
 import { i as configError, u as usageResult } from "./errors-Vpu6rKHl.js";
 import { s as writeFileEnsuringDir } from "./files-BSjrtIHw.js";
 import { r as escapeSqlIdent, s as quoteSqlLiteral } from "./sql-0WjxIp9g.js";
-import { C as parseMembershipsFlag, r as HELPERS } from "./shared-Afctg7B0.js";
+import { C as parseMembershipsFlag, r as HELPERS } from "./shared-DrGLwM3s.js";
 import { n as pgConnector } from "./pg-DQTqRrou.js";
-import { t as FIELD_VIEWS } from "./fields-D0vUI6dq.js";
+import { t as FIELD_VIEWS } from "./fields-DI8s3cPl.js";
 import { n as emptySchema, r as isSchemaKind, t as emitPermissionsModule } from "./generate-CezbCaTI.js";
 import { existsSync, readFileSync } from "node:fs";
 import { resolve } from "node:path";

package/dist/{import-ACkOrv6g.js → import-t1yqnCyG.js}

@@ -4,7 +4,7 @@ import { i as readJsonFile } from "./files-BSjrtIHw.js";
 import { t as applyFiles } from "./files-B3AA05f1.js";
 import { n as httpRequest } from "./http-DOL33cO0.js";
 import { i as schemaExpression, t as emitPermissionsModule } from "./generate-CezbCaTI.js";
-import { t as validateOpenapi } from "./schema-BTsE1WRT.js";
+import { t as validateOpenapi } from "./schema-CQzIJdEd.js";
 import { existsSync, readFileSync } from "node:fs";
 import { resolve } from "node:path";
 //#region ../../node_modules/.pnpm/yaml@2.9.1/node_modules/yaml/browser/dist/nodes/identity.js

package/dist/{index-vYjMrXyK.d.ts → index-Cay5-Kvx.d.ts}

@@ -1,4 +1,4 @@
-import { Ar as SqlFunctionCondition, C as MembershipFixture, D as PolicyDelegation, G as CustomRoleSource, I as SeparationConflict, Kn as DenialReason, N as RoleBinding, P as RoleOptions, R as SupportAccessOptions, T as Policy, Tr as OpaqueCondition, Un as Decision, Ut as InstanceHandle, V as VocabularyFromInput, Wn as Denial, Wt as Instant, Y as EntitlementSource, Yt as LocalSnapshotManifest, Z as JwtClaims, Zt as Snapshot, _n as PolicyScopesInput, c as BreakGlassOptions, cn as DeliveryEvent, ct as SnapshotSource, fr as Membership, ft as TenantSettings, g as GrantCondition, h as Grant, hr as Subject, i as ApprovalOption, it as RelationGroup, j as PolicyVocabulary, k as PolicyOptions, kr as SqlFunctionArg, lr as Delegation, mt as TokenSigner, nn as AccessEvent, nt as MembershipSource, on as DecisionEvent, ot as RelationSource, pn as SinkEvent, pr as Principal, s as AssuranceRequirement, sr as CustomRole, st as SettingsSource, vn as Scope, xr as ConditionRef, yt as VersionQuery } from "./policy-types-DGIO_gxq.js";
+import { Ar as SqlFunctionCondition, C as MembershipFixture, D as PolicyDelegation, G as CustomRoleSource, I as SeparationConflict, Kn as DenialReason, N as RoleBinding, P as RoleOptions, R as SupportAccessOptions, T as Policy, Tr as OpaqueCondition, Un as Decision, Ut as InstanceHandle, V as VocabularyFromInput, Wn as Denial, Wt as Instant, Y as EntitlementSource, Yt as LocalSnapshotManifest, Z as JwtClaims, Zt as Snapshot, _n as PolicyScopesInput, c as BreakGlassOptions, cn as DeliveryEvent, ct as SnapshotSource, fr as Membership, ft as TenantSettings, g as GrantCondition, h as Grant, hr as Subject, i as ApprovalOption, it as RelationGroup, j as PolicyVocabulary, k as PolicyOptions, kr as SqlFunctionArg, lr as Delegation, mt as TokenSigner, nn as AccessEvent, nt as MembershipSource, on as DecisionEvent, ot as RelationSource, pn as SinkEvent, pr as Principal, s as AssuranceRequirement, sr as CustomRole, st as SettingsSource, vn as Scope, xr as ConditionRef } from "./policy-types-DGIO_gxq.js";
 import { E as ResourceXTree, S as ResourceParent, T as ResourceRestricted, b as ResourceNode, d as PermissionKind, f as PermissionTree, g as ResourceInit, m as PermissionsOptions, n as ActionMeta, p as PermissionsOf, t as ActionList, u as Permission, w as ResourceRelationInput, x as ResourceOptions, y as ResourceMeta } from "./permission-types-CAY-GU7e.js";
 import { a as RoleTree, r as Role } from "./vocabulary-DEJ5j4mR.js";
 import { a as PermDock, o as PermDockOptions } from "./permdock-CprAPN3w.js";
@@ -7,6 +7,7 @@ import { m as ApprovalStore } from "./types-DLvhVm1r.js";
 import { t as InstanceOptions } from "./instance-options-CoHn-0e8.js";
 import { n as PermDockWrap } from "./wrap-DxXB54Wu.js";
 import { t as JsonSchemaNode } from "./json-schema-BfXgnRNT.js";
+import { n as VersionCache } from "./version-cache-Df11C2Qp.js";
 import { i as CatalogEventData, s as CloudEvent } from "./sink-B5zoUW_O.js";
 import { StandardSchemaV1 } from "@standard-schema/spec";
 //#region src/conditions/refs.d.ts
@@ -191,55 +192,6 @@ declare function memoryCustomRoleSource(customRoles: readonly CustomRole[]): Cus
  */
 declare const APPROVAL_POLICY_UNAVAILABLE = "approval-policy-unavailable";
 //#endregion
-//#region src/core/version-cache.d.ts
-type VersionCacheStats = {
-  /** Version reads the cache started. */
-  readonly reads: number;
-  /** Calls answered by a read already in flight. */
-  readonly shared: number;
-  /** Calls answered from an entry or a token claim, with no read. */
-  readonly hits: number;
-  readonly evictions: number;
-  readonly size: number;
-};
-/**
- * Current authorization versions shared by every instance in a process:
- * `claimsFirst(source, { versions })` reads through it.
- */
-type VersionCache = {
-  readonly name?: string;
-  /** How old an entry may be when an instance with intent `read` uses it. */
-  readonly maxStaleMs: number;
-  /**
-   * The current version of `principal`. With `live: false`, an entry at most
-   * `maxStaleMs` old answers, a read in flight is shared, and a token claim
-   * newer than the entry raises it; with `live: true`, `read` runs.
-   */
-  current: (principal: VersionQuery, read: () => number | undefined | Promise<number | undefined>, options: {
-    readonly live: boolean;
-  }) => number | undefined | Promise<number | undefined>;
-  /** Drops `principal`'s entry, so the next instance reads the version. */
-  evict: (principal: string) => void;
-  stats: () => VersionCacheStats;
-};
-type MemoryVersionCacheOptions = {
-  /**
-   * How stale a read may be, in milliseconds: the entry lifetime and the
-   * longest a removed member keeps read access. Clamped to 0 to 60,000.
-   */
-  readonly maxStaleMs: number;
-  /** Principals kept; the least recently used goes first. Default 10,000. */
-  readonly maxEntries?: number;
-  /** The clock, read only when an instance asks for a version. */
-  readonly now?: () => Instant;
-};
-/**
- * An in-process `VersionCache`: a bounded LRU keyed by principal id that keeps
- * resolved versions and shares reads in flight. Create it once at module
- * scope.
- */
-declare function memoryVersionCache(options: MemoryVersionCacheOptions): VersionCache;
-//#endregion
 //#region src/core/memberships.d.ts
 /**
  * One `MembershipSource` over several: memberships are merged and
@@ -1198,4 +1150,4 @@ declare function coveredByDelegation(permission: DelegatedPermission, delegation
  */
 declare function delegatedPermissions(delegations: readonly PolicyDelegation[] | undefined, subject: Subject, heldRoles: ReadonlySet<string>, now: number): ReadonlySet<string> | undefined;
 //#endregion
-export { resource as $, opaque as $t, RoleChangeCheckInput as A, HoldingVia as At, ActivateInput as B, countHolders as Bt, parseCatalogEventData as C, validateCustomRole as Cn, SnapshotClaims as Ct, parseSinkEvents as D, SignPolicyDocumentOptions as Dt, parseSinkEvent as E, principal as En, snapshotFromClaims as Et, checkRoleChange as F, memoryRelationSource as Ft, allow as G, memoryVersionCache as Gt, breakGlass as H, MemoryVersionCacheOptions as Ht, decideRoleChange as I, StripeEntitlementsClient as It, role as J, memoryEntitlementSource as Jt, deny as K, APPROVAL_POLICY_UNAVAILABLE as Kt, normalizeMembership as L, stripeEntitlementSource as Lt, RoleChangeOptions as M, whoCan as Mt, RoleChangeTarget as N, MemoryEdge as Nt, RoleChange as O, signPolicyDocument as Ot, RoleRules as P, MemoryRelationSourceData as Pt, formerKeys as Q, sqlFunction as Qt, normalizeMemberships as R, claimsFirst as Rt, SINK_EVENT_SCHEMAS as S, resolveCustomRole as Sn, SignSnapshotOptions as St, parseCloudEventBatch as T, context as Tn, snapshotClaims as Tt, supportAccess as U, VersionCache as Ut, activate as V, isExternallyManaged as Vt, normalizeApproval as W, VersionCacheStats as Wt, readable as X, memorySettingsSource as Xt, crud as Y, memoryMembershipSource as Yt, writable as Z, memorySnapshotSource as Zt, DECISION_EVENT_SCHEMA as _, CustomRoleValidation as _n, ArazzoSimulateInput as _t, catalogFingerprint as a, RoleNameOf as an, customRoleSource as at, EVENT_SCHEMA_IDS as b, customRoleClaim as bn, simulateArazzo as bt, OCSF_VERSION as c, separationConflicts as cn, ShadowMismatch as ct, accessToOcsf as d, fromSnapshot as dn, defineApp as dt, findPermission as en, definePermissions as et, toOcsf as f, parseSnapshot as fn, AppOptions as ft, CREDENTIAL_EVENT_SCHEMA as g, CustomRoleRename as gn, ArazzoPlan as gt, CATALOG_EVENT_SCHEMA as h, CustomRoleEntry as hn, ArazzoFinding as ht, canonicalJson as i, mergePermissions as in, CustomRoleSourceOptions as it, RoleChangeDecision as j, WhoCan as jt, RoleChangeCheck as k, Holder as kt, OcsfAuthorizeSession as l, requiresApproval as ln, ShadowOptions as lt, AUTOMATION_EVENT_SCHEMA as m, CustomRoleDropReason as mn, localSnapshotManifest as mt, delegatedPermissions as n, isPermission as nn, snapshotFor as nt, CSV_COLUMNS as o, definePolicy as on, mayAccess as ot, ACCESS_EVENT_SCHEMA as p, CustomRoleDrop as pn, AppProfile as pt, normalizeAssurance as q, memoryCustomRoleSource as qt, sha256Digest as r, listPermissions as rn, CustomRoleReader as rt, toCsvRow as s, isRoleName as sn, LegacyCheck as st, coveredByDelegation as t, getResource as tn, SnapshotForOptions as tt, OcsfUserManagement as u, emptySnapshot as un, shadowMode as ut, DELIVERY_EVENT_SCHEMA as v, ResolvedCustomRole as vn, ArazzoStepResult as vt, parseCloudEvent as w, claim as wn, signSnapshot as wt, MEMBERSHIP_EVENT_SCHEMA as x, parseCustomRoleEntry as xn, deliveryEvent as xt, DIRECTORY_EVENT_SCHEMA as y, ValidateCustomRoleOptions as yn, arazzoFindings as yt, resolveScope as z, composeMemberships as zt };
+export { resource as $, listPermissions as $t, RoleChangeCheckInput as A, HoldingVia as At, ActivateInput as B, countHolders as Bt, parseCatalogEventData as C, SnapshotClaims as Ct, parseSinkEvents as D, SignPolicyDocumentOptions as Dt, parseSinkEvent as E, snapshotFromClaims as Et, checkRoleChange as F, memoryRelationSource as Ft, allow as G, memoryMembershipSource as Gt, breakGlass as H, APPROVAL_POLICY_UNAVAILABLE as Ht, decideRoleChange as I, StripeEntitlementsClient as It, role as J, sqlFunction as Jt, deny as K, memorySettingsSource as Kt, normalizeMembership as L, stripeEntitlementSource as Lt, RoleChangeOptions as M, whoCan as Mt, RoleChangeTarget as N, MemoryEdge as Nt, RoleChange as O, signPolicyDocument as Ot, RoleRules as P, MemoryRelationSourceData as Pt, formerKeys as Q, isPermission as Qt, normalizeMemberships as R, claimsFirst as Rt, SINK_EVENT_SCHEMAS as S, principal as Sn, SignSnapshotOptions as St, parseCloudEventBatch as T, snapshotClaims as Tt, supportAccess as U, memoryCustomRoleSource as Ut, activate as V, isExternallyManaged as Vt, normalizeApproval as W, memoryEntitlementSource as Wt, readable as X, findPermission as Xt, crud as Y, opaque as Yt, writable as Z, getResource as Zt, DECISION_EVENT_SCHEMA as _, parseCustomRoleEntry as _n, ArazzoSimulateInput as _t, catalogFingerprint as a, requiresApproval as an, customRoleSource as at, EVENT_SCHEMA_IDS as b, claim as bn, simulateArazzo as bt, OCSF_VERSION as c, parseSnapshot as cn, ShadowMismatch as ct, accessToOcsf as d, CustomRoleEntry as dn, defineApp as dt, mergePermissions as en, definePermissions as et, toOcsf as f, CustomRoleRename as fn, AppOptions as ft, CREDENTIAL_EVENT_SCHEMA as g, customRoleClaim as gn, ArazzoPlan as gt, CATALOG_EVENT_SCHEMA as h, ValidateCustomRoleOptions as hn, ArazzoFinding as ht, canonicalJson as i, separationConflicts as in, CustomRoleSourceOptions as it, RoleChangeDecision as j, WhoCan as jt, RoleChangeCheck as k, Holder as kt, OcsfAuthorizeSession as l, CustomRoleDrop as ln, ShadowOptions as lt, AUTOMATION_EVENT_SCHEMA as m, ResolvedCustomRole as mn, localSnapshotManifest as mt, delegatedPermissions as n, definePolicy as nn, snapshotFor as nt, CSV_COLUMNS as o, emptySnapshot as on, mayAccess as ot, ACCESS_EVENT_SCHEMA as p, CustomRoleValidation as pn, AppProfile as pt, normalizeAssurance as q, memorySnapshotSource as qt, sha256Digest as r, isRoleName as rn, CustomRoleReader as rt, toCsvRow as s, fromSnapshot as sn, LegacyCheck as st, coveredByDelegation as t, RoleNameOf as tn, SnapshotForOptions as tt, OcsfUserManagement as u, CustomRoleDropReason as un, shadowMode as ut, DELIVERY_EVENT_SCHEMA as v, resolveCustomRole as vn, ArazzoStepResult as vt, parseCloudEvent as w, signSnapshot as wt, MEMBERSHIP_EVENT_SCHEMA as x, context as xn, deliveryEvent as xt, DIRECTORY_EVENT_SCHEMA as y, validateCustomRole as yn, arazzoFindings as yt, resolveScope as z, composeMemberships as zt };

package/dist/index.d.ts

@@ -1,7 +1,7 @@
 import { $ as LimitRemaining, $n as Quota, $t as SnapshotGrant, A as PolicyScopes, An as Grantee, Ar as SqlFunctionCondition, At as CredentialDecision, B as ValidateMode, Bn as relation, Bt as decideCredential, C as MembershipFixture, Cn as ApproverInput, Cr as MemberOfCondition, Ct as SupportSessionDecision, D as PolicyDelegation, Dn as anyOf, Dr as RelatedHop, Dt as parseSupportSession, E as PolicyAppDataSchemas, En as allOf, Er as RelatedCondition, Et as decideSupportSession, F as RoleScope, Fn as anyone, Fr as isSqlFunctionField, Ft as CredentialPolicyViolation, G as CustomRoleSource, Gn as DenialDetails, Gt as LocalCustomRoleTable, H as WireValidity, Hn as ApprovalRequiredDecision, Ht as parseCredential, I as SeparationConflict, In as assurance, It as CredentialRequest, J as DecisionSink, Jn as ExplainedDecision, Jt as LocalRowValue, K as CustomRoleSourceFactory, Kn as DenialReason, Kt as LocalMembershipRows, L as SubjectOf, Ln as authenticated, Lt as DecideCredentialOptions, M as PrincipalOf, Mn as InheritGrantee, Mr as isCondition, Mt as CredentialPermission, N as RoleBinding, Nn as RelationGrantee, Nr as isConditionDate, Nt as CredentialPermissionInput, O as PolicyOAuthScope, On as holder, Or as RestrictedAncestors, Ot as ApiKeyPrincipal, P as RoleOptions, Pn as actor, Pr as isConditionRef, Pt as CredentialPolicy, Q as LimitConsumeInput, Qn as Obligation, Qt as SnapshotAssignable, R as SupportAccessOptions, Rn as inherit, Rt as credentialDelegation, S as HostedGrantRef, Sn as Approver, Sr as ConditionValue, St as SupportSession, T as Policy, Tn as UserApprover, Tt as SupportSessionRequest, U as CredentialVerifier, Un as Decision, Vn as AppObligation, Vt as isFeedId, W as CustomRoleContext, Wn as Denial, X as Intent, Xn as LimitDetail, Xt as LocalSnapshotRows, Y as EntitlementSource, Yn as GrantedDecision, Yt as LocalSnapshotManifest, Zn as MatchedGrant, Zt as Snapshot, _ as GrantLimit, _n as PolicyScopesInput, _r as ActorKind, _t as VerifiedToken, a as ApprovalRequirement, an as CredentialEvent, ar as AuthorizationDetail, at as RelationHolder, b as GrantScope, bn as ScopeNames, br as Condition, bt as WhereCompiler, c as BreakGlassOptions, cn as DeliveryEvent, cr as CustomRoleGrant, ct as SnapshotSource, d as ClosureContext, dn as EmailCategory, dt as SubjectResolver, en as SnapshotNotEntitled, er as Trace, et as LimitStore, f as ClosureGrantFn, fn as MembershipEvent, fr as Membership, ft as TenantSettings, g as GrantCondition, gr as VerifiedClaims, gt as VerificationFailure, h as Grant, hn as WireDenial, hr as Subject, ht as TokenVerifier, i as ApprovalOption, in as AutomationEvent, ir as Assurance, it as RelationGroup, jn as GranteeInput, jr as hasConditionOp, jt as CredentialKind, kn as user, kr as SqlFunctionArg, kt as Credential, l as BreakGlassRequirements, ln as DeliveryFailureCause, lr as Delegation, lt as SourceContext, m as DelegationTarget, mn as WireDecision, mr as SharedCustomRole, mt as TokenSigner, n as ApprovalEscalation, nn as AccessEvent, nr as TraceSkipReason, nt as MembershipSource, o as ApprovalStage, on as DecisionEvent, or as Binding, ot as RelationSource, p as DelegationInput, pn as SinkEvent, pr as Principal, pt as TokenFailureCause, q as DecisionProvider, qn as DeniedDecision, qt as LocalRowColumn, r as ApprovalMode, rn as AuthEvent, rr as Actor, rt as RelationChain, s as AssuranceRequirement, sn as DeliveryChannel, sr as CustomRole, st as SettingsSource, t as ActivationOption, tn as SnapshotScope, tr as TraceSkip, tt as MemberEntry, u as BreakGlassSpec, un as DirectoryEvent, ur as GnapAccess, ut as SourceMemo, v as GrantMeta, vn as Scope, vr as AdapterId, vt as VersionContext, w as ObligationInput, wn as PermissionApprover, wr as MemberOfParent, wt as SupportSessionPolicy, x as GrantValidity, xn as AnyOfApprover, xr as ConditionRef, xt as DecideSupportSessionOptions, y as GrantOptions, yn as ScopeDeclaration, yr as MembershipVia, yt as VersionQuery, z as SupportConsent, zn as plan, zt as credentialPolicyViolation } from "./policy-types-DGIO_gxq.js";
 import { A as RESOURCE_NAME, C as ResourceRelation, D as RowOf, E as ResourceXTree, M as AppData, N as AppDataSchema, O as PERMISSION_ROW, P as MetaValue, S as ResourceParent, T as ResourceRestricted, _ as ResourceLevel, a as EdgeGroups, b as ResourceNode, c as FieldRelation, d as PermissionKind, f as PermissionTree, g as ResourceInit, h as PrincipalRelation, i as EdgeGroup, j as RESOURCE_X, k as POLICY_SCOPES, m as PermissionsOptions, n as ActionMeta, o as EdgeMatch, p as PermissionsOf, r as ComputedRelation, s as EdgeRelation, u as Permission, v as ResourceLink, w as ResourceRelationInput, x as ResourceOptions, y as ResourceMeta } from "./permission-types-CAY-GU7e.js";
 import { a as RoleTree, c as definePlans, d as isPlan, f as isRole, i as RoleMeta, l as defineRoles, m as listRoles, n as PlanTree, o as Vocabulary, p as listPlans, r as Role, s as VocabularyOptions, t as Plan, u as findRole } from "./vocabulary-DEJ5j4mR.js";
-import { $ as resource, $t as opaque, A as RoleChangeCheckInput, At as HoldingVia, B as ActivateInput, Bt as countHolders, C as parseCatalogEventData, Cn as validateCustomRole, Ct as SnapshotClaims, D as parseSinkEvents, Dt as SignPolicyDocumentOptions, E as parseSinkEvent, En as principal, Et as snapshotFromClaims, F as checkRoleChange, Ft as memoryRelationSource, G as allow, Gt as memoryVersionCache, H as breakGlass, Ht as MemoryVersionCacheOptions, I as decideRoleChange, It as StripeEntitlementsClient, J as role, Jt as memoryEntitlementSource, K as deny, Kt as APPROVAL_POLICY_UNAVAILABLE, L as normalizeMembership, Lt as stripeEntitlementSource, M as RoleChangeOptions, Mt as whoCan, N as RoleChangeTarget, Nt as MemoryEdge, O as RoleChange, Ot as signPolicyDocument, P as RoleRules, Pt as MemoryRelationSourceData, Q as formerKeys, Qt as sqlFunction, R as normalizeMemberships, Rt as claimsFirst, S as SINK_EVENT_SCHEMAS, Sn as resolveCustomRole, St as SignSnapshotOptions, T as parseCloudEventBatch, Tn as context, Tt as snapshotClaims, U as supportAccess, Ut as VersionCache, V as activate, Vt as isExternallyManaged, W as normalizeApproval, Wt as VersionCacheStats, X as readable, Xt as memorySettingsSource, Y as crud, Yt as memoryMembershipSource, Z as writable, Zt as memorySnapshotSource, _ as DECISION_EVENT_SCHEMA, _n as CustomRoleValidation, _t as ArazzoSimulateInput, a as catalogFingerprint, an as RoleNameOf, at as customRoleSource, b as EVENT_SCHEMA_IDS, bn as customRoleClaim, bt as simulateArazzo, c as OCSF_VERSION, cn as separationConflicts, ct as ShadowMismatch, d as accessToOcsf, dn as fromSnapshot, dt as defineApp, en as findPermission, et as definePermissions, f as toOcsf, fn as parseSnapshot, ft as AppOptions, g as CREDENTIAL_EVENT_SCHEMA, gn as CustomRoleRename, gt as ArazzoPlan, h as CATALOG_EVENT_SCHEMA, hn as CustomRoleEntry, ht as ArazzoFinding, i as canonicalJson, in as mergePermissions, it as CustomRoleSourceOptions, j as RoleChangeDecision, jt as WhoCan, k as RoleChangeCheck, kt as Holder, l as OcsfAuthorizeSession, ln as requiresApproval, lt as ShadowOptions, m as AUTOMATION_EVENT_SCHEMA, mn as CustomRoleDropReason, mt as localSnapshotManifest, n as delegatedPermissions, nn as isPermission, nt as snapshotFor, o as CSV_COLUMNS, on as definePolicy, ot as mayAccess, p as ACCESS_EVENT_SCHEMA, pn as CustomRoleDrop, pt as AppProfile, q as normalizeAssurance, qt as memoryCustomRoleSource, r as sha256Digest, rn as listPermissions, rt as CustomRoleReader, s as toCsvRow, sn as isRoleName, st as LegacyCheck, t as coveredByDelegation, tn as getResource, tt as SnapshotForOptions, u as OcsfUserManagement, un as emptySnapshot, ut as shadowMode, v as DELIVERY_EVENT_SCHEMA, vn as ResolvedCustomRole, vt as ArazzoStepResult, w as parseCloudEvent, wn as claim, wt as signSnapshot, x as MEMBERSHIP_EVENT_SCHEMA, xn as parseCustomRoleEntry, xt as deliveryEvent, y as DIRECTORY_EVENT_SCHEMA, yn as ValidateCustomRoleOptions, yt as arazzoFindings, z as resolveScope, zt as composeMemberships } from "./index-vYjMrXyK.js";
+import { $ as resource, $t as listPermissions, A as RoleChangeCheckInput, At as HoldingVia, B as ActivateInput, Bt as countHolders, C as parseCatalogEventData, Ct as SnapshotClaims, D as parseSinkEvents, Dt as SignPolicyDocumentOptions, E as parseSinkEvent, Et as snapshotFromClaims, F as checkRoleChange, Ft as memoryRelationSource, G as allow, Gt as memoryMembershipSource, H as breakGlass, Ht as APPROVAL_POLICY_UNAVAILABLE, I as decideRoleChange, It as StripeEntitlementsClient, J as role, Jt as sqlFunction, K as deny, Kt as memorySettingsSource, L as normalizeMembership, Lt as stripeEntitlementSource, M as RoleChangeOptions, Mt as whoCan, N as RoleChangeTarget, Nt as MemoryEdge, O as RoleChange, Ot as signPolicyDocument, P as RoleRules, Pt as MemoryRelationSourceData, Q as formerKeys, Qt as isPermission, R as normalizeMemberships, Rt as claimsFirst, S as SINK_EVENT_SCHEMAS, Sn as principal, St as SignSnapshotOptions, T as parseCloudEventBatch, Tt as snapshotClaims, U as supportAccess, Ut as memoryCustomRoleSource, V as activate, Vt as isExternallyManaged, W as normalizeApproval, Wt as memoryEntitlementSource, X as readable, Xt as findPermission, Y as crud, Yt as opaque, Z as writable, Zt as getResource, _ as DECISION_EVENT_SCHEMA, _n as parseCustomRoleEntry, _t as ArazzoSimulateInput, a as catalogFingerprint, an as requiresApproval, at as customRoleSource, b as EVENT_SCHEMA_IDS, bn as claim, bt as simulateArazzo, c as OCSF_VERSION, cn as parseSnapshot, ct as ShadowMismatch, d as accessToOcsf, dn as CustomRoleEntry, dt as defineApp, en as mergePermissions, et as definePermissions, f as toOcsf, fn as CustomRoleRename, ft as AppOptions, g as CREDENTIAL_EVENT_SCHEMA, gn as customRoleClaim, gt as ArazzoPlan, h as CATALOG_EVENT_SCHEMA, hn as ValidateCustomRoleOptions, ht as ArazzoFinding, i as canonicalJson, in as separationConflicts, it as CustomRoleSourceOptions, j as RoleChangeDecision, jt as WhoCan, k as RoleChangeCheck, kt as Holder, l as OcsfAuthorizeSession, ln as CustomRoleDrop, lt as ShadowOptions, m as AUTOMATION_EVENT_SCHEMA, mn as ResolvedCustomRole, mt as localSnapshotManifest, n as delegatedPermissions, nn as definePolicy, nt as snapshotFor, o as CSV_COLUMNS, on as emptySnapshot, ot as mayAccess, p as ACCESS_EVENT_SCHEMA, pn as CustomRoleValidation, pt as AppProfile, q as normalizeAssurance, qt as memorySnapshotSource, r as sha256Digest, rn as isRoleName, rt as CustomRoleReader, s as toCsvRow, sn as fromSnapshot, st as LegacyCheck, t as coveredByDelegation, tn as RoleNameOf, tt as SnapshotForOptions, u as OcsfUserManagement, un as CustomRoleDropReason, ut as shadowMode, v as DELIVERY_EVENT_SCHEMA, vn as resolveCustomRole, vt as ArazzoStepResult, w as parseCloudEvent, wt as signSnapshot, x as MEMBERSHIP_EVENT_SCHEMA, xn as context, xt as deliveryEvent, y as DIRECTORY_EVENT_SCHEMA, yn as validateCustomRole, yt as arazzoFindings, z as resolveScope, zt as composeMemberships } from "./index-Cay5-Kvx.js";
 import { a as OperationInput, c as defineOperations, d as isOperationRisk, i as OperationEffect, l as OPERATION_RISKS, n as OperationData, o as OperationMap, r as OperationDefinition, s as OperationMeta, t as Operation, u as OperationRisk } from "./operations-Ci_rT6Uo.js";
 import { A as memoryApprovalPolicySource, C as PermissionCheck, D as ApprovalPolicySource, E as ApprovalPolicyProblem, O as ApprovalPolicyValidation, S as memoryLimitStore, T as ApprovalPolicy, _ as PrincipalSource, a as PermDock, b as Limits, c as RowPair, d as UncheckedData, f as WhereResult, g as PrincipalIdentityLink, h as PrincipalIdentity, i as LoadedRows, j as validateApprovalPolicy, k as approvalPolicies, l as SimulateOptions, m as getPermDockSync, n as DecideOptions, o as PermDockOptions, p as getPermDock, r as DeriveOptions, s as RowData, t as DecideIdsOptions, u as SnapshotOptions, v as memoryPrincipalSource, w as ApprovalPolicies, x as limits, y as PermittedIdsOptions } from "./permdock-CprAPN3w.js";
 import { d as memoryPolicySource, f as mergeHostedGrants, i as HostedGrantDropped, l as hostedPolicies, m as policyDocumentFromClaims, o as PolicyDocument, p as parsePolicyDocument, r as HostedGrantDropReason, s as PolicySource, t as HostedGrant, u as isPortableCondition } from "./hosted-DVxlLZMe.js";
@@ -13,6 +13,7 @@ import { n as PermDockWrap, r as wrapPermDock, t as PermDockOverrides } from "./
 import { t as JsonSchemaNode } from "./json-schema-BfXgnRNT.js";
 import { i as memoryRevocationFeed, n as RevocationFeed, r as RevocationListener, t as RevocationEvent } from "./revocations-BaUXHM1N.js";
 import { t as ClientNames } from "./clients-C_NOET3z.js";
+import { i as memoryVersionCache, n as VersionCache, r as VersionCacheStats, t as MemoryVersionCacheOptions } from "./version-cache-Df11C2Qp.js";
 import { a as CapabilityOptions, c as LinkPolicy, d as linkPolicyViolation, f as parseCapability, i as CapabilityInput, l as LinkPolicyViolation, m as signCapability, n as CapabilityClaim, o as CapabilityPrincipal, p as parseCapabilityClaim, r as CapabilityConfirmation, s as CapabilityRedeemer, t as Capability, u as capabilityFromClaims } from "./capability-Di9tiUvi.js";
 import { a as AutomationSource, c as decideAutomation, i as AutomationRequest, l as memoryAutomationSource, n as AutomationDecision, o as DecideAutomationOptions, r as AutomationMode, s as MemoryAutomationSource, t as Automation, u as parseAutomation } from "./automation-C6Jg75xq.js";
 import { S as toCloudEvent, _ as credentialEvent, a as CatalogFinding, b as signDecisionBatch, c as CloudEventOptions, d as MemoryDecisionSinkOptions, f as RESERVED_CLOUD_EVENT_TYPES, g as cloudEventType, h as automationEvent, i as CatalogEventData, l as CloudEventType, m as accessEvent, n as CLOUDEVENTS_CONTENT_TYPE, o as CatalogFindingCode, p as SignDecisionBatchOptions, r as CLOUD_EVENT_TYPES, s as CloudEvent, t as CLOUDEVENTS_BATCH_CONTENT_TYPE, u as MemoryDecisionSink, v as membershipEvent, x as supportSessionEvent, y as memoryDecisionSink } from "./sink-B5zoUW_O.js";

package/dist/{init-txYTuW9u.js → init-CY7THM2v.js}

@@ -48,7 +48,7 @@ const init = defineLeaf({
 		...forceFlag
 	},
 	async run(ctx, { flags }) {
-		const [{ runInit }, { packageManagerOf }] = await Promise.all([import("./init-BjuFDYT1.js"), import("./peer-C9LvBCcb.js")]);
+		const [{ runInit }, { packageManagerOf }] = await Promise.all([import("./init-DFwylmiN.js"), import("./peer-C9LvBCcb.js")]);
 		const agent = await packageManagerOf(ctx.cwd);
 		const selection = {
 			archetype: flags.archetype,
@@ -79,7 +79,7 @@ const presetDecode = defineLeaf({
 	positionals: presetCode,
 	flags: {},
 	async run(_ctx, { args }) {
-		const { runPreset } = await import("./init-BjuFDYT1.js");
+		const { runPreset } = await import("./init-DFwylmiN.js");
 		return runPreset("decode", args["code"] ?? "");
 	}
 });
@@ -87,7 +87,7 @@ const presetUrl = defineLeaf({
 	positionals: presetCode,
 	flags: {},
 	async run(_ctx, { args }) {
-		const { runPreset } = await import("./init-BjuFDYT1.js");
+		const { runPreset } = await import("./init-DFwylmiN.js");
 		return runPreset("url", args["code"] ?? "");
 	}
 });

package/dist/{init-BjuFDYT1.js → init-DFwylmiN.js}

@@ -1,6 +1,6 @@
 import { n as CliError } from "./errors-Vpu6rKHl.js";
 import { a as decodePreset, g as resolvePreset, i as presetFlags, n as generatePreset, o as encodePreset } from "./preset-BjLzeFpp.js";
-import { a as nonEmptyOr } from "./output-DV5dwOTs.js";
+import { a as nonEmptyOr } from "./output-CtyBwTNB.js";
 import { t as addLine } from "./peer-Q0fuZ6hx.js";
 import { t as applyFiles } from "./files-B3AA05f1.js";
 import { existsSync } from "node:fs";

package/dist/{login-CgfCTO3F.js → login-B92-dZMK.js}

@@ -3,7 +3,7 @@ import { n as CliError } from "./errors-Vpu6rKHl.js";
 import { i as postForm, r as parseToken, s as runDeviceFlow } from "./device-BwbJNmb2.js";
 import { i as writeCredentials, n as deleteCredentials, r as readCredentials, t as credentialsPath } from "./storage-C2bWdvJH.js";
 import { n as randomToken, t as pkce } from "./pkce-CnmmYqUZ.js";
-import { a as nonEmptyOr } from "./output-DV5dwOTs.js";
+import { a as nonEmptyOr } from "./output-CtyBwTNB.js";
 import { n as httpRequest } from "./http-DOL33cO0.js";
 import { c as READ_SCOPES, d as issuerMetadata, i as credentialsInsideRepository, l as cloudUrl, n as cliRuntime, r as credentialStorage, s as CLI_CLIENT_ID, t as CREDENTIAL_SERVICE } from "./auth--yPyZNgr.js";
 import { spawn } from "node:child_process";

package/dist/{login-CfImTJGb.js → login-C5XLYZSF.js}

@@ -27,7 +27,7 @@ const login = defineLeaf({
 		}
 	},
 	async run(ctx, { flags }) {
-		const { runLogin } = await import("./login-CgfCTO3F.js");
+		const { runLogin } = await import("./login-B92-dZMK.js");
 		return runLogin({
 			cwd: ctx.cwd,
 			url: given(flags.url),
@@ -43,7 +43,7 @@ const login = defineLeaf({
 const logout = defineLeaf({
 	flags: { ...urlFlag },
 	async run(ctx, { flags }) {
-		const { runLogout } = await import("./login-CgfCTO3F.js");
+		const { runLogout } = await import("./login-B92-dZMK.js");
 		return runLogout({
 			url: given(flags.url),
 			json: ctx.json,
@@ -55,7 +55,7 @@ const logout = defineLeaf({
 const whoami = defineLeaf({
 	flags: { ...urlFlag },
 	async run(ctx, { flags }) {
-		const { runWhoami } = await import("./login-CgfCTO3F.js");
+		const { runWhoami } = await import("./login-B92-dZMK.js");
 		return runWhoami({
 			url: given(flags.url),
 			json: ctx.json,

package/dist/{manifest-CzzWtnAb.d.ts → manifest-B5yF3CIq.d.ts}

@@ -6,6 +6,14 @@
  * is the major of this shape; a field is only ever added within it.
  * `schemas/supabase-manifest-v1.json` is its JSON Schema.
  */
+/** An `app_metadata` key, or a column of a table joined on `id`. */
+type SupabaseManifestActiveFrom = {
+  readonly appMetadata: string;
+} | {
+  readonly table: string;
+  readonly column: string;
+  readonly id: string;
+};
 type SupabaseHookManifest = {
   readonly $schema: "https://permdock.com/schemas/supabase-manifest-v1.json";
   readonly version: 1;
@@ -21,6 +29,12 @@ type SupabaseHookManifest = {
      */
     readonly schemas?: "pg-delta" | "migra" | "migrations";
     readonly before?: readonly string[];
+    /**
+     * Where the hook reads the active first-scope id
+     * (`supabase.hook.activeFrom`). Absent from a manifest written before
+     * 0.10.
+     */
+    readonly activeFrom?: SupabaseManifestActiveFrom;
   };
   readonly helpers: {
     readonly schema: string;
@@ -151,6 +165,11 @@ type SupabaseManifestThrough = {
   readonly table: string;
   readonly id: string;
   readonly column: string;
+  /**
+   * Every referencing column to the column of `table` it matches, when the
+   * reference spans several columns (a role set keyed by scope id and user).
+   */
+  readonly on?: Readonly<Record<string, string>>;
 };
 /**
  * A role column (with `through` when it references a roles table), or the fixed

package/dist/{manifest-wg8WkkpD.js → manifest-BXTbHNIV.js}

@@ -1,7 +1,7 @@
 import { n as freezeDeep } from "./freeze-jjan0lCv.js";
 import { n as PermDockValidationError } from "./validation-error-CYg2kJEw.js";
 import { n as copyJson, t as checkSchema } from "./json-schema-BPGa-RjQ.js";
-import { t as supabaseManifestSchema } from "./manifest-schema-2r37XRhD.js";
+import { t as supabaseManifestSchema } from "./manifest-schema-DQkBK2Mr.js";
 //#region src/supabase/manifest.ts
 /** Whether the manifest describes a token hook. */
 function hasTokenHook(manifest) {