permdock 0.11.0 → 0.14.0

package/dist/openai/index.js

@@ -1,7 +1,7 @@
 import { t as compact } from "../compact-CAf557ZB.js";
 import { l as withApp } from "../permdock-BvjivVb9.js";
-import { t as approvalTokenOf } from "../kernel-qv4cr9w8.js";
-import { t as agentRuntime } from "../create-6EwRQlig.js";
+import { t as approvalTokenOf } from "../kernel-BD8QuMnv.js";
+import { t as agentRuntime } from "../create-Coq5fIrq.js";
 //#region src/openai/create.ts
 function appContext(runContext) {
 	const context = runContext?.context;

package/dist/{openapi-gMQQSzNn.js → openapi-CT55v3WD.js}

@@ -80,7 +80,7 @@ const emit = defineLeaf({
 		}
 	},
 	async run(ctx, { flags }) {
-		return (await import("./openapi-CuePQL4z.js")).runOpenapi({
+		return (await import("./openapi-DDENzRbG.js")).runOpenapi({
 			cwd: ctx.cwd,
 			config: ctx.config,
 			rest: ["emit"],
@@ -122,7 +122,7 @@ const importDocument = defineLeaf({
 	async run(ctx, { flags }) {
 		const doc = given(flags.doc);
 		if (doc === void 0) throw missingInput("openapi import", ["--doc"], "the OpenAPI document to import");
-		return (await import("./import-t1yqnCyG.js")).runOpenapiImport({
+		return (await import("./import-efm6qPgx.js")).runOpenapiImport({
 			cwd: ctx.cwd,
 			doc,
 			out: fileOut("openapi import", flags.out),

package/dist/{openapi-CuePQL4z.js → openapi-DDENzRbG.js}

@@ -7,7 +7,7 @@ import { a as loadModule, n as asPolicy, s as pickNamed, t as asPermissionTree }
 import { t as shortDiff } from "./text-diff-BtfSmdUo.js";
 import { c as openapiVersion, o as createPermDock } from "./openapi-BOsx0xn9.js";
 import { i as fileDrift } from "./output-files-BIQ_9pIs.js";
-import { n as validateOverlay, t as validateOpenapi } from "./schema-CQzIJdEd.js";
+import { n as validateOverlay, t as validateOpenapi } from "./schema-CnrIP94n.js";
 import { existsSync } from "node:fs";
 import { resolve } from "node:path";
 //#region src/cli/openapi/openapi.ts

package/dist/{output-CtyBwTNB.js → output-3iB3_Hfg.js}

@@ -1,5 +1,5 @@
 import { s as cliVersion } from "./version-DMQ0dnN5.js";
-import { t as DOCS_BASE } from "./manifest-Cav1rjNQ.js";
+import { t as DOCS_BASE } from "./manifest-BWIR_EEB.js";
 //#region src/cli/core/output.ts
 const CLI_RESULT_SCHEMA = "https://permdock.com/schemas/cli-result-v1.json";
 function envelope(input) {

package/dist/{powersync-CBcsEvdr.js → powersync-COjQTHRD.js}

@@ -14,7 +14,7 @@ const generate = defineLeaf({
 	async run(ctx, { flags }) {
 		const out = fileOut("powersync", flags.out);
 		const from = given(flags.policy);
-		const { runPowerSync } = await import("./powersync-6vgKevSi.js");
+		const { runPowerSync } = await import("./powersync-k8lUeC37.js");
 		return runPowerSync({
 			cwd: ctx.cwd,
 			config: ctx.config,
@@ -45,7 +45,7 @@ const verify = defineLeaf({
 		const db = await dbUrl(ctx, flags, { required: true });
 		const fixtures = given(flags.fixtures);
 		const from = given(flags.policy);
-		const { runPowerSync } = await import("./powersync-6vgKevSi.js");
+		const { runPowerSync } = await import("./powersync-k8lUeC37.js");
 		return runPowerSync({
 			cwd: ctx.cwd,
 			config: ctx.config,

package/dist/{powersync-CD8-Ypao.js → powersync-DVbskWD9.js}

@@ -1,4 +1,4 @@
-import { t as compact } from "./compact-CAf557ZB.js";
+import { r as isRecord, t as compact } from "./compact-CAf557ZB.js";
 import { c as isConditionDate, l as isConditionRef, o as hasConditionOp } from "./refs-C8BKxc_e.js";
 import { g as localSnapshotManifest, j as memoryCustomRoleSource } from "./src-C_pi2Rnh.js";
 import { n as findPermission } from "./permission-registry-B8tYxPIt.js";
@@ -10,16 +10,16 @@ import { u as usageResult } from "./errors-Vpu6rKHl.js";
 import { c as requirePolicy } from "./load-DjSU5KXO.js";
 import { s as quoteSqlLiteral, t as SQL_IDENT } from "./sql-0WjxIp9g.js";
 import { a as scopeMembershipTable, i as scopeColumn } from "./compile-EzEMB-7v.js";
-import "./sources-C4vkzZJV.js";
+import { d as keptKeys } from "./sources-C4vkzZJV.js";
 import { t as applyFiles } from "./files-B3AA05f1.js";
 import { i as fileDrift } from "./output-files-BIQ_9pIs.js";
-import { n as fixtureSubject, r as loadFixtures, t as fixtureRow } from "./fixtures-A1_sp_tR.js";
-import { O as quoteIdent, a as customRolesOn, t as CUSTOM_ROLES } from "./shared-DrGLwM3s.js";
-import { r as tableNames } from "./tables-DimBcVWY.js";
+import { n as fixtureSubject, r as loadFixtures, t as fixtureRow } from "./fixtures-Bm4_K1ke.js";
+import { A as quoteQualified, O as quoteIdent, a as customRolesOn, t as CUSTOM_ROLES } from "./shared-DrGLwM3s.js";
+import { n as tableNameOf, r as tableNames } from "./tables-DimBcVWY.js";
 import { d as andConditions, l as collectGrants, o as assignableRoles, p as contextRefs, t as ownershipRules, u as roleNames } from "./ownership-qqBuGJXr.js";
 import { t as membershipSourcesOf } from "./sources-qoIJQrJv.js";
 import { n as pgConnector } from "./pg-DQTqRrou.js";
-import { m as tableFor, t as canFixture } from "./verify-6EauWrkP.js";
+import { m as tableFor, t as canFixture } from "./verify-CHQgLrtS.js";
 import { resolve } from "node:path";
 //#region src/cli/powersync/names.ts
 function ident(name) {
@@ -89,7 +89,6 @@ function streamOf(source) {
 	const { stream } = source.sql;
 	if (stream === void 0) return `the ${source.sql.table} membership source has no stream form: build it with tableMembershipSource, junctionMembershipSource or blockMembershipSource`;
 	if (stream.expiresAt !== void 0) return `the ${stream.table} membership source has no stream: it has an expiry`;
-	if (stream.disabledAt !== void 0) return `the ${stream.table} membership source has no stream: it has disabledAt`;
 	return stream;
 }
 function pairOf(through) {
@@ -111,22 +110,32 @@ function anyOf(clauses) {
 }
 /**
 * The user's own rows of the source, of scope `scope` when the source has a
-* scope column.
+* scope column. `keep` drops the suspension filter: the grant keeps a suspended
+* membership.
 */
-function ownRows(stream, dialect, scope) {
+function ownRows(stream, dialect, scope, keep = false) {
 	const table = bare(stream.table, dialect);
 	const scoped = scope !== void 0 && "column" in stream.scope ? [`${dialect.column(table, stream.scope.column)} = ${dialect.literal(scope)}`] : [];
+	const suspended = !keep && stream.disabledAt !== void 0 ? [`${dialect.column(table, stream.disabledAt)} IS NULL`] : [];
 	if (typeof stream.user === "string") return {
 		table,
 		from: fromTable(stream.table, dialect),
-		where: [`${dialect.column(table, stream.user)} = ${dialect.user}`, ...scoped]
+		where: [
+			`${dialect.column(table, stream.user)} = ${dialect.user}`,
+			...scoped,
+			...suspended
+		]
 	};
 	const users = bare(stream.user.through, dialect);
 	const [ref, id] = pairOf(stream.user);
 	return {
 		table,
 		from: `${fromTable(stream.table, dialect)} INNER JOIN ${fromTable(stream.user.through, dialect)} ON ${dialect.column(users, id)} = ${dialect.column(table, ref)}`,
-		where: [`${dialect.column(users, stream.user.column)} = ${dialect.user}`, ...scoped]
+		where: [
+			`${dialect.column(users, stream.user.column)} = ${dialect.user}`,
+			...scoped,
+			...suspended
+		]
 	};
 }
 /**
@@ -170,9 +179,10 @@ function kindFilter(stream, role, table, ctx) {
 * One `IN (SELECT …)` per role source of the stream that can hold one of
 * `roles` in scope `scope`: the row's `left` is an instance the user holds it
 * in. A null role never equals a key, so a row without a role grants nothing.
+* `keep` drops the suspension filter of a membership the grant keeps.
 */
-function sourceIn(stream, scope, left, roles, ctx) {
-	const own = ownRows(stream, ctx.dialect, scope);
+function sourceIn(stream, scope, left, roles, ctx, keep = false) {
+	const own = ownRows(stream, ctx.dialect, scope, keep);
 	const select = (join, filters) => `${left} IN (SELECT ${ctx.dialect.column(own.table, stream.id)} FROM ${own.from}${join} WHERE ${[...own.where, ...filters].join(" AND ")})`;
 	const out = [];
 	for (const role of roles) {
@@ -193,9 +203,9 @@ function sourceIn(stream, scope, left, roles, ctx) {
 * The roles tables the source joins through, each with the query of the rows
 * the user's own rows reference.
 */
-function roleTableRows(stream, dialect) {
+function roleTableRows(stream, dialect, keep = false) {
 	if (isFixed(stream.roles)) return [];
-	const own = ownRows(stream, dialect);
+	const own = ownRows(stream, dialect, void 0, keep);
 	return roleSources(stream.roles).flatMap((source) => {
 		if (typeof source === "string" || "map" in source) return [];
 		const keys = bare(source.through, dialect);
@@ -341,7 +351,7 @@ function customRoleIn(ctx, root, left, key, level) {
 			continue;
 		}
 		if (isFixed(stream.roles)) continue;
-		const own = ownRows(stream, dialect, root);
+		const own = ownRows(stream, dialect, root, keptKeys(rls?.suspension?.memberships).includes(key));
 		const id = dialect.column(own.table, stream.id);
 		for (const role of roleSources(stream.roles)) {
 			const keyed = roleKeyOf(role, own.table, dialect);
@@ -518,7 +528,7 @@ const COMPARE = {
 * A row condition as alternatives of ANDed clauses over `table`. `undefined`
 * when part of it has no Sync Streams form, so the grant syncs nothing.
 */
-function conditionSql(condition, table, ctx) {
+function conditionSql(condition, table, ctx, permission) {
 	const column = (field) => SQL_IDENT.test(field) ? ctx.dialect.column(table, field) : void 0;
 	switch (condition.op) {
 		case "eq":
@@ -551,7 +561,7 @@ function conditionSql(condition, table, ctx) {
 		}
 		case "and":
 		case "or": {
-			const parts = every(condition.conditions.map((child) => conditionSql(child, table, ctx)));
+			const parts = every(condition.conditions.map((child) => conditionSql(child, table, ctx, permission)));
 			if (parts === void 0) return;
 			return condition.op === "and" ? product(parts) : parts.flat();
 		}
@@ -560,9 +570,9 @@ function conditionSql(condition, table, ctx) {
 			const scope = resolveScope(ctx.scopes, condition.scope);
 			const left = column(condition.field);
 			if (scope === void 0 || left === void 0) return;
-			return membershipSql(scope, left, condition.roles, ctx);
+			return membershipSql(scope, left, condition.roles, ctx, permission);
 		}
-		case "sqlFunction": return conditionSql(condition.twin, table, ctx);
+		case "sqlFunction": return conditionSql(condition.twin, table, ctx, permission);
 		case "related": return relatedSql(condition, table, ctx);
 		case "not":
 		case "contains":
@@ -632,7 +642,7 @@ function permittedSql(resource, key, ctx) {
 	}))];
 	const queries = /* @__PURE__ */ new Set();
 	for (const { item, access } of reaches) {
-		const where = typeof access === "string" || item.where === void 0 ? [[]] : conditionSql(item.where, table, ctx);
+		const where = typeof access === "string" || item.where === void 0 ? [[]] : conditionSql(item.where, table, ctx, item.grant.permission.key);
 		if (typeof access === "string" || where === void 0) {
 			ctx.gaps.push(`inherit() of ${key} leaves out ${item.label}: ${typeof access === "string" ? access : "its condition has no Sync Streams form"}`);
 			continue;
@@ -642,11 +652,20 @@ function permittedSql(resource, key, ctx) {
 	return queries.size === 0 && reaches.length > 0 ? void 0 : [...queries];
 }
 /**
+* Whether `permission` keeps a suspended membership: its key is in
+* `rls.suspension.memberships.keep`, so the stream drops the suspension
+* filter.
+*/
+function keepsSuspended(permission, ctx) {
+	return permission !== void 0 && keptKeys(ctx.config.rls?.suspension?.memberships).includes(permission);
+}
+/**
 * One `IN (SELECT …)` per role source of the membership table: the row's `left`
-* is an instance the user holds `roles` in.
+* is an instance the user holds `roles` in. `keep` drops the suspension
+* filter.
 */
-function membershipIn(table, idColumn, left, roles, ctx) {
-	if (table.expiresAt !== void 0 || table.disabledAt !== void 0) return;
+function membershipIn(table, idColumn, left, roles, ctx, keep = false) {
+	if (table.expiresAt !== void 0) return;
 	const name = bare(table.table, ctx.dialect);
 	const sources = Array.isArray(table.role) ? table.role : [table.role];
 	const kinds = [...new Set(roles.flatMap((role) => ctx.kinds[role] ?? []))];
@@ -654,7 +673,11 @@ function membershipIn(table, idColumn, left, roles, ctx) {
 	if (restricted && (table.via === void 0 || roles.length !== 1)) return;
 	const via = table.via;
 	if (restricted && typeof via === "object" && !kinds.includes(via.value)) return [];
-	const filters = [`${ctx.dialect.column(name, table.user)} = ${ctx.dialect.user}`, ...restricted && typeof via === "string" ? [`${ctx.dialect.column(name, via)} IN (${kinds.map((kind) => ctx.dialect.literal(kind)).join(", ")})`] : []];
+	const filters = [
+		`${ctx.dialect.column(name, table.user)} = ${ctx.dialect.user}`,
+		...restricted && typeof via === "string" ? [`${ctx.dialect.column(name, via)} IN (${kinds.map((kind) => ctx.dialect.literal(kind)).join(", ")})`] : [],
+		...!keep && table.disabledAt !== void 0 ? [`${ctx.dialect.column(name, table.disabledAt)} IS NULL`] : []
+	];
 	const list = roles.map((role) => ctx.dialect.literal(role)).join(", ");
 	return sources.map((source) => {
 		if (typeof source === "string") return [`${left} IN (SELECT ${ctx.dialect.column(name, idColumn)} FROM ${fromTable(table.table, ctx.dialect)} WHERE ${[...filters, `${ctx.dialect.column(name, source)} IN (${list})`].join(" AND ")})`];
@@ -673,11 +696,12 @@ function membershipIn(table, idColumn, left, roles, ctx) {
 * The membership filter of scope `scope`: its `rls.memberships` table, else the
 * union of its membership sources.
 */
-function membershipSql(scope, left, roles, ctx) {
+function membershipSql(scope, left, roles, ctx, permission) {
+	const keep = keepsSuspended(permission, ctx);
 	const table = scopeMembershipTable(ctx.config.rls?.memberships, ctx.scopes, scope);
 	if (table !== void 0) {
 		const idColumn = scopeColumn(table, ctx.scopes, scope);
-		return idColumn === void 0 ? void 0 : membershipIn(table, idColumn, left, roles, ctx);
+		return idColumn === void 0 ? void 0 : membershipIn(table, idColumn, left, roles, ctx, keep);
 	}
 	const sources = scopeSourcesOf(ctx.sources, scope);
 	if (sources.length === 0) return;
@@ -687,7 +711,7 @@ function membershipSql(scope, left, roles, ctx) {
 			ctx.gaps.push(stream);
 			return [];
 		}
-		return sourceIn(stream, scope, left, roles, ctx);
+		return sourceIn(stream, scope, left, roles, ctx, keep);
 	});
 }
 /**
@@ -703,14 +727,14 @@ function accessSql(item, table, ctx) {
 			if (access.scope === "global") return `global role ${access.role} is not a row filter`;
 			const field = ctx.policy.scopes.find((scope) => scope.name === access.scope)?.key;
 			if (field === void 0 || !SQL_IDENT.test(field)) return `scope ${access.scope} has no row key`;
-			return membershipSql(access.scope, ctx.dialect.column(table, field), [access.role], ctx) ?? `no rls.memberships table without an expiry or disabledAt and with the kinds of ${access.role}, and no membership source, for scope ${access.scope}`;
+			return membershipSql(access.scope, ctx.dialect.column(table, field), [access.role], ctx, item.grant.permission.key) ?? `no rls.memberships table without an expiry and with the kinds of ${access.role}, and no membership source, for scope ${access.scope}`;
 		}
 		case "resource": {
 			const holder = ctx.config.rls?.memberships?.resource?.[access.resource];
 			const node = ctx.policy.resources.get(item.grant.permission.resource);
 			const field = node?.name === access.resource ? node.id : node?.parent?.resource === access.resource ? node.parent.field : void 0;
 			if (holder === void 0 || field === void 0 || !SQL_IDENT.test(field)) return `no rls.memberships.resource table for ${access.resource} on the row`;
-			return membershipIn(holder, holder.id ?? "id", ctx.dialect.column(table, field), [access.role], ctx) ?? `the ${access.resource} memberships table has an expiry or disabledAt, or lacks via`;
+			return membershipIn(holder, holder.id ?? "id", ctx.dialect.column(table, field), [access.role], ctx, keepsSuspended(item.grant.permission.key, ctx)) ?? `the ${access.resource} memberships table has an expiry, or lacks via`;
 		}
 		case "actor": return "actor grantees are not in the sync token";
 		default: return access;
@@ -740,12 +764,13 @@ function userTenantIds(ctx) {
 	if (tenants !== void 0) {
 		const column = scopeColumn(tenants, ctx.scopes, root);
 		const members = bare(tenants.table, dialect);
-		return column === void 0 ? [] : [`SELECT ${dialect.column(members, column)} FROM ${fromTable(tenants.table, dialect)} WHERE ${dialect.column(members, tenants.user)} = ${dialect.user}`];
+		const active = tenants.disabledAt !== void 0 && keptKeys(ctx.config.rls?.suspension?.memberships).length === 0 ? ` AND ${dialect.column(members, tenants.disabledAt)} IS NULL` : "";
+		return column === void 0 ? [] : [`SELECT ${dialect.column(members, column)} FROM ${fromTable(tenants.table, dialect)} WHERE ${dialect.column(members, tenants.user)} = ${dialect.user}${active}`];
 	}
 	return scopeSourcesOf(ctx.sources, root).flatMap((source) => {
 		const stream = streamOf(source);
 		if (typeof stream === "string") return [];
-		const rows = ownRows(stream, dialect, root);
+		const rows = ownRows(stream, dialect, root, keptKeys(ctx.config.rls?.suspension?.memberships).length > 0);
 		return [`SELECT ${dialect.column(rows.table, stream.id)} FROM ${rows.from} WHERE ${rows.where.join(" AND ")}`];
 	});
 }
@@ -781,9 +806,10 @@ function subjectStreams(ctx) {
 		entry.queries.add(query);
 		tables.set(table, entry);
 	};
-	const own = (table, user, role) => {
+	const own = (table, user, role, disabledAt) => {
 		const name = bare(table, dialect);
-		const mine = `${dialect.column(name, user)} = ${dialect.user}`;
+		const active = disabledAt !== void 0 && keptKeys(rls?.suspension?.memberships).length === 0 ? ` AND ${dialect.column(name, disabledAt)} IS NULL` : "";
+		const mine = `${dialect.column(name, user)} = ${dialect.user}${active}`;
 		add(name, `SELECT * FROM ${fromTable(table, dialect)} WHERE ${mine}`, user);
 		for (const through of roleThroughs(role)) {
 			const keys = bare(through.through, dialect);
@@ -794,15 +820,16 @@ function subjectStreams(ctx) {
 		}
 	};
 	const memberships = rls?.memberships;
-	for (const table of [...Object.values(memberships?.scopes ?? {}), ...Object.values(memberships?.resource ?? {})]) own(table.table, table.user, table.role);
+	for (const table of [...Object.values(memberships?.scopes ?? {}), ...Object.values(memberships?.resource ?? {})]) own(table.table, table.user, table.role, table.disabledAt);
 	for (const stream of unmappedStreams(ctx)) {
-		const rows = ownRows(stream, dialect);
+		const keep = keptKeys(rls?.suspension?.memberships).length > 0;
+		const rows = ownRows(stream, dialect, void 0, keep);
 		add(rows.table, typeof stream.user === "string" ? `SELECT * FROM ${rows.from} WHERE ${rows.where.join(" AND ")}` : `SELECT ${rows.table}.* FROM ${rows.from} WHERE ${rows.where.join(" AND ")}`, typeof stream.user === "string" ? stream.user : void 0);
 		if (typeof stream.user !== "string") {
 			const users = bare(stream.user.through, dialect);
 			add(users, `SELECT * FROM ${fromTable(stream.user.through, dialect)} WHERE ${dialect.column(users, stream.user.column)} = ${dialect.user}`, stream.user.column);
 		}
-		for (const keys of roleTableRows(stream, dialect)) add(keys.table, keys.query);
+		for (const keys of roleTableRows(stream, dialect, keep)) add(keys.table, keys.query);
 	}
 	const schema = rls?.schema ?? "permdock";
 	const database = rls?.authorize === "database";
@@ -931,7 +958,7 @@ function planWith(policy, config, dialect) {
 		const queries = /* @__PURE__ */ new Set();
 		const compile = (label, gap, item, reach) => {
 			const access = unsupported(item) ?? reach();
-			const where = typeof access === "string" || item.where === void 0 ? [[]] : conditionSql(item.where, table, ctx);
+			const where = typeof access === "string" || item.where === void 0 ? [[]] : conditionSql(item.where, table, ctx, item.grant.permission.key);
 			const gaps = [...new Set(ctx.gaps.splice(0))];
 			for (const reason of gaps) warnings.push(`${label} under-syncs: ${reason}`);
 			if (typeof access === "string") warnings.push(`${label} does not sync: ${access}`);
@@ -1007,6 +1034,53 @@ function planWith(policy, config, dialect) {
 	};
 }
 //#endregion
+//#region src/cli/powersync/verify-followed.ts
+/** Check a non-resource row against its own-user rule or readable parents. */
+async function verifyFollowedRow(input) {
+	const { fixture, config, policy, mismatches } = input;
+	const label = `${fixture.table} for ${fixture.subject.id}`;
+	const spec = config.powersync?.tables?.[fixture.table];
+	const stream = input.plan.tables.find((item) => item.table === bare(fixture.table, {
+		...POSTGRES,
+		names: {
+			renamed: input.plan.devices,
+			seen: /* @__PURE__ */ new Set()
+		}
+	}));
+	if (spec === void 0 || stream === void 0 || !isRecord(fixture.row)) {
+		mismatches.push(`${label}: no configured table stream or invalid row`);
+		return;
+	}
+	const row = fixture.row;
+	let granted = spec.user !== void 0 && row[spec.user] === fixture.subject.id;
+	for (const follow of spec.follow ?? []) {
+		if (!Object.entries(follow.match ?? {}).every(([key, value]) => row[key] === value)) continue;
+		const permission = findPermission(policy.permissions, `${follow.resource}.${config.powersync?.action ?? "read"}`);
+		const resource = policy.resources.get(follow.resource);
+		const parentId = row[follow.field];
+		if (permission === void 0 || resource?.id === void 0 || typeof parentId !== "string" && typeof parentId !== "number") continue;
+		const parents = await input.query(`select * from ${quoteQualified(tableNameOf(config.rls?.tables?.[follow.resource], follow.resource))} where ${quoteIdent(resource.id)}::text = $1::text`, [String(parentId)]);
+		for (const parent of parents) {
+			const root = policy.scopes.find((scope) => scope.within === void 0)?.key;
+			const tenant = root !== void 0 && isRecord(parent) ? parent[root] : void 0;
+			const permdock = await getPermDock(policy, fixtureSubject({
+				...fixture.subject,
+				...typeof tenant === "string" ? { tenant } : {}
+			}), { customRoles: memoryCustomRoleSource(input.customRoles) });
+			granted ||= canFixture(permdock, permission, parent);
+		}
+	}
+	if (fixture.expected === "granted" !== granted) mismatches.push(`${label}: expected ${fixture.expected}, but parent access is ${granted ? "granted" : "denied"}`);
+	const holds = await input.synced({
+		...stream,
+		resource: fixture.table,
+		id: "id"
+	}, fixture);
+	if (holds === void 0) mismatches.push(`${label}: fixture row needs id`);
+	else if (holds && !granted) mismatches.push(`${label}: stream ${stream.name} syncs a row the policy denies`);
+	else if (!holds && granted) mismatches.push(`${label}: granted, but stream ${stream.name} does not sync the row`);
+}
+//#endregion
 //#region src/cli/powersync/verify-gaps.ts
 function heldRoles(subject) {
 	return /* @__PURE__ */ new Set([...subject.roles ?? [], ...(subject.memberships ?? []).flatMap((membership) => membership.roles)]);
@@ -1161,6 +1235,19 @@ async function verifyStreams(input) {
 			for (const stream of [...plan.subject, ...plan.tables]) if (stream.user !== void 0 && await leaks(query, stream, stream.user, fixture)) mismatches.push(`stream ${stream.name} syncs another user's ${stream.table} rows to ${fixture.subject.id}`);
 		}
 		for (const fixture of input.fixtures) {
+			if ("table" in fixture) {
+				await verifyFollowedRow({
+					policy: input.policy,
+					config: input.config,
+					customRoles: input.customRoles,
+					plan,
+					fixture,
+					query,
+					mismatches,
+					synced: (stream, row) => synced(query, stream, row)
+				});
+				continue;
+			}
 			const permission = findPermission(input.policy.permissions, fixture.action);
 			const stream = plan.streams.find((item) => permission !== void 0 && item.resource === permission.resource && permission.action === (input.config.powersync?.action ?? "read"));
 			if (permission === void 0 || stream === void 0) continue;
@@ -1241,7 +1328,7 @@ async function runPowerSync(input) {
 	const notes = [...warnings];
 	if (input.db !== void 0) try {
 		const fixturesPath = input.fixtures ?? input.config.rls?.fixtures ?? "rls.fixtures.json";
-		const { fixtures, customRoles } = await loadFixtures(input.cwd, fixturesPath);
+		const { fixtures, customRoles } = await loadFixtures(input.cwd, fixturesPath, true);
 		const database = await verifyStreams({
 			policy,
 			config: input.config,

package/dist/powersync-k8lUeC37.js

@@ -0,0 +1 @@
+export { n as runPowerSync } from "./powersync-DVbskWD9.js";

package/dist/pull-BY1METGf.js

@@ -0,0 +1 @@
+export { n as runCloudPull } from "./pull-Er4aBHlL.js";

package/dist/{pull-CAeaAioC.js → pull-Er4aBHlL.js}

@@ -7,7 +7,7 @@ import { o as formatCatalogJson } from "./catalog-doc-DjMKzJp9.js";
 import { t as catalogPath } from "./catalog-path-CnI0XTFK.js";
 import { n as parseSupabaseManifest } from "./manifest-BXTbHNIV.js";
 import { t as parseCatalog } from "./parse-1_ZheTW5.js";
-import { a as nonEmptyOr } from "./output-CtyBwTNB.js";
+import { a as nonEmptyOr } from "./output-3iB3_Hfg.js";
 import { t as POLICY_NOT_PUBLISHED } from "./problem-types-DSsRfONQ.js";
 import { n as httpRequest, t as authFailure } from "./http-DOL33cO0.js";
 import { l as cloudUrl, n as cliRuntime, o as readAuth } from "./auth--yPyZNgr.js";

package/dist/react-native/index.d.ts

@@ -115,13 +115,13 @@ type PowerSyncSourceOptions<Q extends string> = {
   readonly read?: undefined;
 };
 /**
- * A `localSnapshot` source over a PowerSync database: `get` runs every query
- * with `db.getAll`, and a `db.watch` per query reports changes. Without
- * `queries` and `read`, it reads the tables `manifest.rows` names: the
- * memberships of every source with null roles dropped, the global roles and the
- * custom roles with their levels. A watch result with unchanged content
- * re-renders nothing (`connectSource`). The source takes the database as an
- * argument; `permdock/react-native` never imports `@powersync/*`.
+ * A `localSnapshot` source over a PowerSync database: `get` initially runs
+ * every query with `db.getAll`; watch-triggered reads refresh only fired
+ * queries. Without `queries` and `read`, it reads the tables `manifest.rows`
+ * names: the memberships of every source with null roles dropped, the global
+ * roles and the custom roles with their levels. A watch result with unchanged
+ * content re-renders nothing (`connectSource`). The source takes the database
+ * as an argument; `permdock/react-native` never imports `@powersync/*`.
  */
 export declare function powerSyncSource<Q extends string>(db: PowerSyncWatchable, options: PowerSyncSourceOptions<Q>): SnapshotSource;
 //#endregion

package/dist/react-native/index.js

@@ -535,32 +535,73 @@ function planOf(options) {
 	};
 }
 /**
-* A `localSnapshot` source over a PowerSync database: `get` runs every query
-* with `db.getAll`, and a `db.watch` per query reports changes. Without
-* `queries` and `read`, it reads the tables `manifest.rows` names: the
-* memberships of every source with null roles dropped, the global roles and the
-* custom roles with their levels. A watch result with unchanged content
-* re-renders nothing (`connectSource`). The source takes the database as an
-* argument; `permdock/react-native` never imports `@powersync/*`.
+* A `localSnapshot` source over a PowerSync database: `get` initially runs
+* every query with `db.getAll`; watch-triggered reads refresh only fired
+* queries. Without `queries` and `read`, it reads the tables `manifest.rows`
+* names: the memberships of every source with null roles dropped, the global
+* roles and the custom roles with their levels. A watch result with unchanged
+* content re-renders nothing (`connectSource`). The source takes the database
+* as an argument; `permdock/react-native` never imports `@powersync/*`.
 */
 function powerSyncSource(db, options) {
 	const plan = planOf(options);
-	return localSnapshot({
-		manifest: options.manifest,
-		read: async () => {
-			const results = await Promise.all(Object.entries(plan.queries).map(async ([name, query]) => {
-				return [name, await db.getAll(query.sql, [...query.parameters ?? []])];
-			}));
-			return plan.read(Object.fromEntries(results));
+	const queries = Object.entries(plan.queries);
+	const rows = /* @__PURE__ */ new Map();
+	const dirty = /* @__PURE__ */ new Set();
+	const listeners = /* @__PURE__ */ new Set();
+	let scheduled = false;
+	let pending;
+	let snapshot;
+	let content;
+	const invalidate = (name) => {
+		dirty.add(name);
+		if (scheduled) return;
+		scheduled = true;
+		queueMicrotask(() => {
+			scheduled = false;
+			for (const listener of listeners) listener();
+		});
+	};
+	const read = async () => {
+		if (dirty.size === 0) for (const [name] of queries) dirty.add(name);
+		do {
+			const selected = queries.filter(([name]) => dirty.has(name) || !rows.has(name));
+			for (const [name] of selected) dirty.delete(name);
+			try {
+				const results = await Promise.all(selected.map(async ([name, query]) => [name, await db.getAll(query.sql, [...query.parameters ?? []])]));
+				for (const [name, result] of results) rows.set(name, result);
+			} catch (error) {
+				for (const [name] of selected) dirty.add(name);
+				throw error;
+			}
+		} while (dirty.size > 0);
+		const data = plan.read(Object.fromEntries(rows));
+		const next = JSON.stringify([data, data.principal?.memberships?.map((membership) => isMembershipExpired(membership))]);
+		if (snapshot === void 0 || next !== content) {
+			snapshot = buildLocalSnapshot(options.manifest, data);
+			content = next;
+		}
+		return snapshot;
+	};
+	return {
+		get: () => {
+			pending ??= read().finally(() => {
+				pending = void 0;
+			});
+			return pending;
 		},
 		subscribe: (listener) => {
+			listeners.add(listener);
 			const controller = new AbortController();
-			for (const query of Object.values(plan.queries)) db.watch(query.sql, [...query.parameters ?? []], { onResult: listener }, { signal: controller.signal });
+			for (const [name, query] of queries) db.watch(query.sql, [...query.parameters ?? []], { onResult: () => {
+				invalidate(name);
+			} }, { signal: controller.signal });
 			return () => {
+				listeners.delete(listener);
 				controller.abort();
 			};
 		}
-	});
+	};
 }
 //#endregion
 //#region src/react-native/storage.ts