permdock 0.11.0 → 0.14.0

package/dist/{rls-CtRaRrn3.js → rls-DY3Fc18U.js}

@@ -11,13 +11,13 @@ import "./sources-C4vkzZJV.js";
 import { t as policyFromCatalog } from "./policy-from-catalog-CU3An8uP.js";
 import { t as beforeFirst } from "./text-BMFRfBqc.js";
 import { i as INDEXES_MARKER, n as GRANTS_MARKER, o as SEEDS_MARKER, t as BACKFILL_MARKER } from "./markers-BeHZ4x9Q.js";
-import { a as nonEmptyOr } from "./output-CtyBwTNB.js";
+import { a as nonEmptyOr } from "./output-3iB3_Hfg.js";
 import { i as requirePeer, n as packageManagerOf, t as addLine } from "./peer-Q0fuZ6hx.js";
 import { t as POLICY_NOT_PUBLISHED } from "./problem-types-DSsRfONQ.js";
-import { t as fetchProjectPolicy } from "./pull-CAeaAioC.js";
+import { t as fetchProjectPolicy } from "./pull-Er4aBHlL.js";
 import { n as MIGRATION_DIRS } from "./constants-DcJABbLW.js";
 import { a as isSeedsDirectory, c as parseSplit, d as seedsMigration, f as writeOutputFiles, l as partPath, n as dataMigrationFile, r as driftOf, u as pgDeltaPath } from "./output-files-BIQ_9pIs.js";
-import { b as rbacScaffold, d as resolveSchemas, f as schemasRefusal, o as supabaseHookSql, p as declarativeSql, s as approvalsSql, t as grantsLabel, u as isSupabaseSchemas, y as parseRbacAuthorize } from "./supabase-hook-CyuD9Wau.js";
+import { b as rbacScaffold, d as resolveSchemas, f as schemasRefusal, o as supabaseHookSql, p as declarativeSql, s as approvalsSql, t as grantsLabel, u as isSupabaseSchemas, y as parseRbacAuthorize } from "./supabase-hook-HPgwYb9V.js";
 import { A as quoteQualified, D as qualified$1, I as scopeTypeOf, O as quoteIdent$1, _ as subjectClaimJsonSql, c as SESSION_LIVE_HELPER, g as sessionLiveHelperSql, j as quoteTable, k as quoteLiteral, r as HELPERS, t as CUSTOM_ROLES, y as subjectIdSql } from "./shared-DrGLwM3s.js";
 import { C as accessSql, G as byKey, T as seedSql, Z as graphHelper, ct as memberIdsHelper, ft as permittedIdsHelper, ht as scopeTable, mt as scopeSources, r as tableNames, s as graphSql, w as helpersSql, x as permittedByPermissionHelper, y as permissionHelpersSql } from "./tables-DimBcVWY.js";
 import { c as breakGlassKey, i as assignmentSql, l as collectGrants, n as ownershipSql, s as breakGlassHolder } from "./ownership-qqBuGJXr.js";
@@ -25,8 +25,8 @@ import { a as splitUndiffed } from "./deciding-columns-NB4wcyBf.js";
 import { t as connectPgPool } from "./pg-DQTqRrou.js";
 import { a as fieldViewsSql, c as ACTOR_MAY_WRITE, f as readOnlyActorKinds, i as fieldViews, l as actorMayWriteSql, n as columnGrantSql, o as rowBranches, p as readOnlyActorPolicies, r as columnRevokeSql, u as assemblePolicies } from "./fields-DI8s3cPl.js";
 import { n as permissionHoldersSql } from "./resolve-names-Y1Cb22cp.js";
-import { _ as indexTargets, a as verifyResult, b as readTableIndexFacts, c as callsHelper, g as INDEX_COLUMNS_SQL, h as COLUMNS_SQL, i as verifyIgnores, l as helperCallKeys, m as tableFor, n as runRlsVerify, o as HELPER_TABLES, p as compileGrants, r as rlsFinding, v as indexesSql, y as pruneIndexTargets } from "./verify-6EauWrkP.js";
-import { a as buildContext, c as levelKeys, d as rebuildPlan, i as splitsPart, l as rowHelpersSql, n as generateOptions, o as CANDIDATES, r as isRefusal, s as inheritTargets, t as supautilsRejections, u as DROPPED_LIST } from "./supautils-C-_jqylY.js";
+import { _ as indexTargets, a as verifyResult, b as readTableIndexFacts, c as callsHelper, g as INDEX_COLUMNS_SQL, h as COLUMNS_SQL, i as verifyIgnores, l as helperCallKeys, m as tableFor, n as runRlsVerify, o as HELPER_TABLES, p as compileGrants, r as rlsFinding, v as indexesSql, y as pruneIndexTargets } from "./verify-CHQgLrtS.js";
+import { a as buildContext, c as levelKeys, d as rebuildPlan, i as splitsPart, l as rowHelpersSql, n as generateOptions, o as CANDIDATES, r as isRefusal, s as inheritTargets, t as supautilsRejections, u as DROPPED_LIST } from "./supautils-DZ95xxW-.js";
 import { readFileSync } from "node:fs";
 import { basename, delimiter, join } from "node:path";
 import { spawn } from "node:child_process";
@@ -1027,11 +1027,13 @@ function realtimeStoragePolicies(ctx, facts, config, warnings = []) {
 }
 //#endregion
 //#region src/cli/rls/generate-policies.ts
+const ACTOR_GUARDS_HEADER = "-- rls.readOnlyActors with --helpers-only: restrictive policies on the write commands, which narrow the hand-written policies and grant nothing. A table that does not exist yet is skipped.";
 const SERVICE_TABLES_HEADER = "-- Supabase Realtime and Storage: rls.realtime and rls.storage. RLS on both tables is Supabase's.";
 /**
-* A `realtime.messages` or `storage.objects` policy that applies only where the
-* table exists. The Realtime and Storage services create those tables, so a
-* local stack with the service off, and pg-delta's shadow database, have none.
+* A policy that applies only where its table exists. The Realtime and Storage
+* services create `realtime.messages` and `storage.objects`, so a local stack
+* with the service off, and pg-delta's shadow database, have none; under
+* `--helpers-only` the app's own migrations create its tables.
 */
 function guardedPolicySql(item) {
 	const body = policySql(item).trimEnd().split("\n").map((line) => `    ${line}`).join("\n");
@@ -1053,6 +1055,18 @@ function withHelperTables(sql, helperTables) {
 	const tables = `${helperTables.trimEnd()}\n`;
 	return sql.trim() === "" ? tables : `${sql.trimEnd()}\n\n${tables}`;
 }
+/**
+* The read-only actor policies `--helpers-only` writes: those on a table
+* `rls.tables` names. A resource it does not name has no known table, so its
+* write commands get a warning instead.
+*/
+function helpersOnlyActorGuards(guards, tables, actorMayWrite, warnings) {
+	const named = new Set(Object.values(tableNames(tables) ?? {}).map((table) => qualifySqlTable(table)));
+	const kept = guards.filter((guard) => named.has(qualifySqlTable(guard.table)));
+	const unmapped = [...new Set(guards.filter((guard) => !named.has(qualifySqlTable(guard.table))).map((guard) => qualifySqlTable(guard.table)))].toSorted();
+	if (unmapped.length > 0) warnings.push(`rls.readOnlyActors with --helpers-only writes read-only actor policies only on tables rls.tables names; for ${unmapped.join(", ")}, name the table in rls.tables, or add \`and (select ${actorMayWrite}())\` to each hand-written insert, update and delete policy`);
+	return kept;
+}
 function databaseModeWarnings(policy, { ctx }, warnings) {
 	if (ctx.authorize !== "database") return;
 	for (const { name } of ctx.scopes) if (policy.grants.some((grant) => grant.scope === name) && scopeTable(ctx, name) === void 0 && scopeSources(ctx, name).length === 0) warnings.push(`${name}-scoped grants read the ${name} memberships table in database mode: set rls.memberships.scopes.${name}, rls.membershipSources or supabase.hook.memberships (or --memberships for the first scope), otherwise they deny`);
@@ -1077,12 +1091,12 @@ function generatePolicies(input, policy, options, built, warnings) {
 	const force = input.force === true || rls?.force === true;
 	if (force && views.some((view) => view.companion !== void 0)) warnings.push("--force with --revoke-columns: each <table>_visible_fields companion reads as its owner, so its owner needs BYPASSRLS or the restricted columns read as null");
 	const policyName = input.policyName ?? rls?.policyName;
-	const assembled = helpersOnly ? [] : assemblePolicies(fieldsMode === void 0 ? compiled.branches : rowBranches(compiled.branches), {
+	const assembled = assemblePolicies(fieldsMode === void 0 ? compiled.branches : rowBranches(compiled.branches), {
 		perRole: input.policyPerRole === true || rls?.policyPerRole === true,
 		...policyName === void 0 ? {} : { name: policyName }
 	});
 	const actorKinds = readOnlyActorKinds(rls?.readOnlyActors);
-	if (actorKinds !== void 0 && helpersOnly) warnings.push(`rls.readOnlyActors with --helpers-only writes no policies: add \`and (select ${qualified$1(ctx, ACTOR_MAY_WRITE)}())\` to each hand-written insert, update and delete policy, or a restrictive policy that calls it`);
+	const actorGuards = actorKinds === void 0 || !helpersOnly ? [] : helpersOnlyActorGuards(readOnlyActorPolicies(assembled, subjectClaimJsonSql(ctx, "act"), actorKinds), rls?.tables, qualified$1(ctx, ACTOR_MAY_WRITE), warnings);
 	const withActors = (items) => actorKinds === void 0 ? items : [...items, ...readOnlyActorPolicies(items, subjectClaimJsonSql(ctx, "act"), actorKinds)];
 	let tablePolicies;
 	try {
@@ -1104,7 +1118,8 @@ function generatePolicies(input, policy, options, built, warnings) {
 		helpersOnly,
 		force,
 		views,
-		policies: withActors(assembled)
+		policies: helpersOnly ? [] : withActors(assembled),
+		...actorGuards.length === 0 ? {} : { actorGuards: [ACTOR_GUARDS_HEADER, ...actorGuards.map(guardedPolicySql)].join("\n") }
 	};
 	if (servicePolicies.length === 0) return generated;
 	return {
@@ -1543,7 +1558,7 @@ function tableColumns(rowColumns, tables, helpersOnly, warnings) {
 function emitTarget(input, built, generated, preamble) {
 	const rls = input.config.rls;
 	const { ctx } = built;
-	const { policies, force, views, helperTables } = generated;
+	const { policies, force, views, helperTables, actorGuards } = generated;
 	const outRel = input.out ?? rls?.out ?? defaultOut(input.target);
 	const migration = input.target === "sql" ? "" : dialectRoles(migrationSql(policies, withHelperTables(preamble, helperTables), force, views), ctx.dialect);
 	const migrationRel = migration === "" ? void 0 : migrationOut(outRel);
@@ -1551,7 +1566,7 @@ function emitTarget(input, built, generated, preamble) {
 	let text;
 	switch (input.target) {
 		case "sql":
-			text = dialectRoles(withHelperTables(emitSql(policies, preamble, force, views), helperTables), ctx.dialect);
+			text = dialectRoles(withHelperTables(withHelperTables(emitSql(policies, preamble, force, views), helperTables), actorGuards), ctx.dialect);
 			break;
 		case "drizzle":
 			text = emitDrizzle(policies, compact({
@@ -1594,7 +1609,7 @@ function generateSql(input, policy, options, built, warnings) {
 	const { preamble, audit } = assembled;
 	if (generated.force) forceWarnings(built, warnings);
 	const emitted = emitTarget(input, built, generated, preamble);
-	const { policies, force, views, helperTables, guardedTables, helpersOnly } = generated;
+	const { policies, force, views, helperTables, guardedTables, helpersOnly, actorGuards } = generated;
 	const seedsSplit = splitsPart(input.split, "seeds");
 	return {
 		...generated,
@@ -1605,7 +1620,7 @@ function generateSql(input, policy, options, built, warnings) {
 			policies: dialectRoles(withHelperTables(emitSql(policies, "", force, views), helperTables), ctx.dialect),
 			declarativePolicies: dialectRoles(emitSql(policies, "", force, views), ctx.dialect),
 			...guardedTables === void 0 ? {} : { servicePolicies: dialectRoles(guardedTables, ctx.dialect) },
-			helpers: dialectRoles(emitSql([], preamble, false, helpersOnly ? views : []), ctx.dialect),
+			helpers: dialectRoles(withHelperTables(emitSql([], preamble, false, helpersOnly ? views : []), actorGuards), ctx.dialect),
 			seeds: `${SEEDS_MARKER} schema=${built.schema}\n${seedsBody(ctx, built.schema, generated.compiled.rolePermissions)}\n${seedsSplit ? audit : ""}`,
 			indexes: `${INDEXES_MARKER}\n${indexesSql(indexes)}\n`
 		})

package/dist/{rls-BYHN5bcJ.js → rls-DjjOHlKE.js}

@@ -192,7 +192,7 @@ async function rlsInput(ctx, verb, shape, options) {
 	};
 }
 async function runRls(input) {
-	return (await import("./rls-CtRaRrn3.js")).runRls(input);
+	return (await import("./rls-DY3Fc18U.js")).runRls(input);
 }
 const generate = defineLeaf({
 	flags: {

package/dist/{run-B5nyNKe8.js → run-BlxXmaDS.js}

@@ -1,13 +1,13 @@
 import { i as dateAt } from "./time-nR1JesoH.js";
 import { a as describeError, l as problemOf, n as CliError, r as cliProblem, s as kindOfCode } from "./errors-Vpu6rKHl.js";
 import { s as cliVersion } from "./version-DMQ0dnN5.js";
-import { a as resolveCwd, i as readConfig } from "./config-BR23fL8m.js";
+import { a as resolveCwd, i as readConfig } from "./config-ZZdtyQZy.js";
 import { t as beforeFirst } from "./text-BMFRfBqc.js";
 import { a as suggestion, i as parseLeaf, n as flagSpellings, o as GLOBAL_FLAGS, r as parseFlags } from "./args-0FrVs5EH.js";
 import { r as progressReporter, t as redact } from "./credentials-CdDxp7jN.js";
-import { a as resolve, i as leaves, n as ROOT, r as SECTIONS, t as DOCS_BASE } from "./manifest-Cav1rjNQ.js";
+import { a as resolve, i as leaves, n as ROOT, r as SECTIONS, t as DOCS_BASE } from "./manifest-BWIR_EEB.js";
 import { t as createStyle } from "./style-Ds11Hmk4.js";
-import { i as githubAnnotations, n as envelope, o as sarifLog, t as dataOf } from "./output-CtyBwTNB.js";
+import { i as githubAnnotations, n as envelope, o as sarifLog, t as dataOf } from "./output-3iB3_Hfg.js";
 import { i as renameMessage, r as flagRename, t as COMMAND_MOVES } from "./renames-CGj7YwcQ.js";
 import { stripVTControlCharacters } from "node:util";
 import { existsSync, statSync } from "node:fs";

package/dist/run-DGSLvGty.js

@@ -0,0 +1 @@
+export { t as run } from "./run-BlxXmaDS.js";

package/dist/{scan-CvFWW_fU.js → scan-CR_xm71k.js}

@@ -16,7 +16,7 @@ const scan = defineLeaf({
 		}
 	},
 	async run(ctx, { flags }) {
-		const { runAdoptionScan } = await import("./adoption-scan-DKCOsfcF.js");
+		const { runAdoptionScan } = await import("./adoption-scan-BGtwGfoH.js");
 		return runAdoptionScan({
 			cwd: ctx.cwd,
 			srcPath: flags.src.length > 0 ? flags.src : ctx.config.collect?.srcPath ?? ["src"],

package/dist/{schema-CQzIJdEd.js → schema-CnrIP94n.js}

@@ -1,7 +1,7 @@
 import { r as isRecord } from "./compact-CAf557ZB.js";
 import { l as packageRoot } from "./version-DMQ0dnN5.js";
 import { t as DRAFT_PINS } from "./pins-nqarl3oE.js";
-import { a as nonEmptyOr } from "./output-CtyBwTNB.js";
+import { a as nonEmptyOr } from "./output-3iB3_Hfg.js";
 import { t as require__2020 } from "./2020-CJbO8Bvz.js";
 import { readFileSync } from "node:fs";
 import { join } from "node:path";

package/dist/{skills-Bar7ZqwM.js → skills-CY-MY_Oj.js}

@@ -2,7 +2,7 @@ import { t as byCodePoint } from "./compare-DTfyUunF.js";
 import { i as readJsonFile } from "./files-BSjrtIHw.js";
 import { l as packageRoot } from "./version-DMQ0dnN5.js";
 import { t as didYouMean } from "./args-0FrVs5EH.js";
-import { a as nonEmptyOr } from "./output-CtyBwTNB.js";
+import { a as nonEmptyOr } from "./output-3iB3_Hfg.js";
 import { cpSync, existsSync, lstatSync, mkdirSync, readFileSync, readdirSync, readlinkSync, realpathSync, writeFileSync } from "node:fs";
 import { basename, dirname, join, relative, resolve } from "node:path";
 import { pathToFileURL } from "node:url";

package/dist/{skills-BZc81VLt.js → skills-uzsVqEi9.js}

@@ -1,7 +1,7 @@
 import { t as defineLeaf } from "./command-L8EstFNm.js";
 import { t as checkFlag } from "./flags-DXjoTVbS.js";
 import { r as pick, t as CANCELLED } from "./prompt-BYc6drYW.js";
-import { n as detectedAgents, r as runSkills, t as SKILL_AGENTS } from "./skills-Bar7ZqwM.js";
+import { n as detectedAgents, r as runSkills, t as SKILL_AGENTS } from "./skills-CY-MY_Oj.js";
 //#region src/cli/commands/skills.ts
 const forFlag = { for: {
 	type: "string",

package/dist/supabase/index.js

@@ -1,5 +1,5 @@
-import { a as supabaseClaims, i as supabaseApprovalStore, n as supabaseRls, o as exchangeCapability, r as tableApprovalDelegationSource, t as authorizeSql } from "../supabase-CC6rIri4.js";
 import { n as supabaseTenantClaim, t as supabaseMembershipsBudget } from "../budget-BELja5A9.js";
+import { a as supabaseClaims, i as supabaseApprovalStore, n as supabaseRls, o as exchangeCapability, r as tableApprovalDelegationSource, t as authorizeSql } from "../supabase-CDHMsDD0.js";
 import { c as tableMembershipSource, i as authzVersion, o as junctionMembershipSource, s as supabasePostgresQuery, t as AUTHZ_VERSION_TABLE } from "../sources-C4vkzZJV.js";
 import { a as delegationOf, c as subjectFromSupabaseSession, i as actorOf, n as postgrestSources, r as readSubjectRecord, s as subjectFromSupabase } from "../postgrest-DAxFltvO.js";
 import { n as parseSupabaseManifest, t as hasTokenHook } from "../manifest-BXTbHNIV.js";

package/dist/{supabase-CBEK6KEo.js → supabase-DYWnT800.js}

@@ -47,7 +47,7 @@ const hookGenerate = defineLeaf({
 		const budget = given(flags.budget);
 		const schema = given(flags.schema);
 		const grantsOut = given(flags["grants-out"]);
-		const { runSupabase } = await import("./supabase-hook-CWvEpdCh.js");
+		const { runSupabase } = await import("./supabase-hook-qsewAVZY.js");
 		return runSupabase({
 			cwd: ctx.cwd,
 			config: ctx.config,
@@ -76,7 +76,7 @@ const inspect = defineLeaf({
 	},
 	async run(ctx, { flags }) {
 		const out = flags.out === "" ? true : flags.out === "-" ? void 0 : flags.out;
-		const { runSupabase } = await import("./supabase-hook-CWvEpdCh.js");
+		const { runSupabase } = await import("./supabase-hook-qsewAVZY.js");
 		return runSupabase({
 			cwd: ctx.cwd,
 			config: ctx.config,

package/dist/{supabase-hook-CyuD9Wau.js → supabase-hook-HPgwYb9V.js}

@@ -6,10 +6,10 @@ import { a as describeError, i as configError } from "./errors-Vpu6rKHl.js";
 import { i as readJsonFile, o as sqlFiles, s as writeFileEnsuringDir } from "./files-BSjrtIHw.js";
 import { a as SUPABASE_MANIFEST_SCHEMA } from "./version-DMQ0dnN5.js";
 import { c as requirePolicy } from "./load-DjSU5KXO.js";
+import "./budget-BELja5A9.js";
 import { i as qualifySqlTable } from "./sql-0WjxIp9g.js";
 import { i as scopeColumn } from "./compile-EzEMB-7v.js";
-import { t as authorizeSql } from "./supabase-CC6rIri4.js";
-import "./budget-BELja5A9.js";
+import { t as authorizeSql } from "./supabase-CDHMsDD0.js";
 import { a as hookApiNames, d as keptKeys, t as AUTHZ_VERSION_TABLE, u as roleManifest } from "./sources-C4vkzZJV.js";
 import { o as readMemberships } from "./postgrest-DAxFltvO.js";
 import { t as beforeFirst } from "./text-BMFRfBqc.js";

package/dist/supabase-hook-qsewAVZY.js

@@ -0,0 +1 @@
+export { i as runSupabase } from "./supabase-hook-HPgwYb9V.js";

package/dist/{supautils-C-_jqylY.js → supautils-DZ95xxW-.js}

@@ -3,12 +3,12 @@ import { f as scopeList, s as resolveScope } from "./scopes-0Up_UA2t.js";
 import { o as flattenGrantee } from "./grantee-Dke-9rd1.js";
 import { l as policyLevels } from "./policy-CLQ8__GF.js";
 import { a as describeError, i as configError } from "./errors-Vpu6rKHl.js";
-import { d as sqlTextArray, i as qualifySqlTable } from "./sql-0WjxIp9g.js";
 import "./budget-BELja5A9.js";
+import { d as sqlTextArray, i as qualifySqlTable } from "./sql-0WjxIp9g.js";
 import { l as roleColumn } from "./sources-C4vkzZJV.js";
 import { t as beforeFirst } from "./text-BMFRfBqc.js";
 import { c as parseSplit } from "./output-files-BIQ_9pIs.js";
-import { x as resolveAuthorize } from "./supabase-hook-CyuD9Wau.js";
+import { x as resolveAuthorize } from "./supabase-hook-HPgwYb9V.js";
 import { A as quoteQualified, C as parseMembershipsFlag, D as qualified, F as firstScopeType, O as quoteIdent, R as tenantTypeOf, a as customRolesOn, j as quoteTable, k as quoteLiteral, s as signedIn, t as CUSTOM_ROLES } from "./shared-DrGLwM3s.js";
 import { G as byKey, H as rolesTableScope, O as tokenScopesPlan, Q as graphSqlName, V as raiseSql, W as byCodeUnit, Y as apiKeysPlan, a as closureDepths, bt as checkSuspension, i as tablelessResources, o as graphPlan, r as tableNames, t as resolveVias, z as currentKeyExpr } from "./tables-DimBcVWY.js";
 import { o as assignableRoles, r as unsatisfiedKinds, t as ownershipRules, u as roleNames } from "./ownership-qqBuGJXr.js";
@@ -16,7 +16,7 @@ import { t as membershipSourcesOf } from "./sources-qoIJQrJv.js";
 import { i as group, o as sqlStatements } from "./deciding-columns-NB4wcyBf.js";
 import { d as orSql, h as branchClauses } from "./fields-DI8s3cPl.js";
 import { t as resolveNames } from "./resolve-names-Y1Cb22cp.js";
-import { m as tableFor } from "./verify-6EauWrkP.js";
+import { m as tableFor } from "./verify-CHQgLrtS.js";
 //#region src/cli/rls/custom-role-rebuild.ts
 const PREFIX = "PermDock CLI";
 /** A column of the roles-table row `r`. */

package/dist/testing/core.js

@@ -1 +1 @@
-export { r as policyMatrix, t as testOrmParity, n as testRlsParity } from "../core-DzVINFbU.js";
+export { r as policyMatrix, t as testOrmParity, n as testRlsParity } from "../core-lxoANyai.js";

package/dist/testing/fixtures/index.js

@@ -512,7 +512,7 @@ var better_supabase_manifest_default = {
 		"schema": "permdock",
 		"function": "custom_access_token_hook",
 		"out": "supabase/schemas/permdock/functions/custom_access_token_hook.sql",
-		"activeFrom": { "appMetadata": "active_organization" },
+		"activeFrom": { "appMetadata": "tenant_id" },
 		"schemas": "pg-delta"
 	},
 	helpers: {

package/dist/testing/index.js

@@ -27,16 +27,16 @@ import { c as problemFromDecision } from "../problem-BVLHFK33.js";
 import { o as resolveApproval } from "../helpers-DJicaG6f.js";
 import { t as APPROVAL_REQUEST_SCHEMA } from "../request-schema-DhX7UbfQ.js";
 import { t as catalogSchema } from "../schema-BOJjqlWL.js";
+import { t as supabaseMembershipsBudget } from "../budget-BELja5A9.js";
 import { c as parseApiKey } from "../server-3cVlTLde.js";
 import { n as discoverAuthorizationServer } from "../device-BwbJNmb2.js";
 import { t as CONNECTOR_SCHEMA } from "../connector-schema-CYLQNMYq.js";
 import { l as sha256Hex, n as scimHandler, t as directoryMembershipSource } from "../scim-jJBJ7g1Z.js";
 import { c as quoteSqlTable, o as quoteSqlIdent } from "../sql-0WjxIp9g.js";
 import { i as cloudEndpoints, n as cloud, s as approverHeaders, t as bearerChallenge } from "../challenge-DImNcR7B.js";
-import { t as supabaseMembershipsBudget } from "../budget-BELja5A9.js";
 import { t as supabaseManifestSchema } from "../manifest-schema-DQkBK2Mr.js";
 import { t as PUSHED_POLICY_SCHEMA } from "../pushed-policy-CDuOL2de.js";
-import { i as policyMatrixLayout, n as testRlsParity, r as policyMatrix, t as testOrmParity } from "../core-DzVINFbU.js";
+import { i as policyMatrixLayout, n as testRlsParity, r as policyMatrix, t as testOrmParity } from "../core-lxoANyai.js";
 import { i as saasPermissions } from "../permissions-CYcHj_w7.js";
 import { C as saasOrg, E as saasSeed, S as saasMemberships, a as saasProject, g as verifySaasSession, h as signSaasToken, k as saasPolicy, t as saasDoc, w as saasPrincipal, x as saasCustomRoles } from "../saas-DK4V-3Is.js";
 import { t as POLICY_NOT_PUBLISHED } from "../problem-types-DSsRfONQ.js";

package/dist/unplugin/index.js

@@ -1,4 +1,4 @@
-import { n as createCollectScheduler, r as report } from "../watch-Bpci3hBY.js";
+import { n as createCollectScheduler, r as report } from "../watch-CTfSlIGD.js";
 import { r as peerHint } from "../peer-Q0fuZ6hx.js";
 import { createRequire } from "node:module";
 //#region src/unplugin/index.ts

package/dist/usage-CH7oISI6.js

@@ -0,0 +1 @@
+export { t as runUsage } from "./usage-WYRc7Kqg.js";

package/dist/{usage-heV5KOiU.js → usage-Dm2hn0pS.js}

@@ -16,7 +16,7 @@ const usage = defineLeaf({
 		}
 	},
 	async run(ctx, { flags }) {
-		return (await import("./usage-CNca1i1W.js")).runUsage({
+		return (await import("./usage-CH7oISI6.js")).runUsage({
 			cwd: ctx.cwd,
 			config: ctx.config,
 			ignore: flags.ignore,

package/dist/{usage-Y6xZUfE-.js → usage-WYRc7Kqg.js}

@@ -6,8 +6,8 @@ import { c as jsonSchemaOf } from "./catalog-doc-DjMKzJp9.js";
 import { a as loadModule, n as asPolicy, s as pickNamed } from "./load-DjSU5KXO.js";
 import { r as runCollect } from "./collect-WCl8cJQV.js";
 import { t as beforeFirst } from "./text-BMFRfBqc.js";
-import { t as DOCS_BASE } from "./manifest-Cav1rjNQ.js";
-import { r as findingOf } from "./output-CtyBwTNB.js";
+import { t as DOCS_BASE } from "./manifest-BWIR_EEB.js";
+import { r as findingOf } from "./output-3iB3_Hfg.js";
 import { existsSync, readFileSync, realpathSync } from "node:fs";
 import { dirname, resolve } from "node:path";
 import { fileURLToPath, pathToFileURL } from "node:url";

package/dist/{verify-6EauWrkP.js → verify-CHQgLrtS.js}

@@ -17,13 +17,13 @@ import { t as policyRowConditionKeys } from "./row-conditions-BAGHOmVq.js";
 import { s as writeFileEnsuringDir } from "./files-BSjrtIHw.js";
 import { c as jsonSchemaOf } from "./catalog-doc-DjMKzJp9.js";
 import { o as loadPolicyAt } from "./load-DjSU5KXO.js";
+import "./budget-BELja5A9.js";
 import { i as qualifySqlTable, n as defaultSqlCommand, t as SQL_IDENT } from "./sql-0WjxIp9g.js";
 import { a as scopeMembershipTable, i as scopeColumn } from "./compile-EzEMB-7v.js";
-import "./budget-BELja5A9.js";
 import "./sources-C4vkzZJV.js";
 import { t as beforeFirst } from "./text-BMFRfBqc.js";
-import { t as DOCS_BASE } from "./manifest-Cav1rjNQ.js";
-import { n as fixtureSubject, r as loadFixtures, t as fixtureRow } from "./fixtures-A1_sp_tR.js";
+import { t as DOCS_BASE } from "./manifest-BWIR_EEB.js";
+import { n as fixtureSubject, r as loadFixtures, t as fixtureRow } from "./fixtures-Bm4_K1ke.js";
 import { A as quoteQualified, N as arrayColumnsOf, O as quoteIdent, P as columnTypesOf, _ as subjectClaimJsonSql, a as customRolesOn, j as quoteTable, k as quoteLiteral, r as HELPERS, v as subjectClaimSql } from "./shared-DrGLwM3s.js";
 import { C as accessSql, D as tokenScopeAllowsCall, S as requiresSql, ht as scopeTable, k as capabilityAccessSql, n as tableNameOf, o as graphPlan, q as apiKeyAllowsCall, r as tableNames } from "./tables-DimBcVWY.js";
 import { c as breakGlassKey, f as compileConditionSql, l as collectGrants, m as sqlFunctionNames, p as contextRefs, s as breakGlassHolder } from "./ownership-qqBuGJXr.js";

package/dist/watch-C44FtM79.js

@@ -0,0 +1 @@
+export { i as watchCollect } from "./watch-CTfSlIGD.js";

package/dist/{watch-Bpci3hBY.js → watch-CTfSlIGD.js}

@@ -2,7 +2,7 @@ import { i as dateAt } from "./time-nR1JesoH.js";
 import { a as describeError } from "./errors-Vpu6rKHl.js";
 import { t as defaultSrcPath } from "./files-BSjrtIHw.js";
 import { r as runCollect } from "./collect-WCl8cJQV.js";
-import { n as isConfigFile, r as loadConfig } from "./config-BR23fL8m.js";
+import { n as isConfigFile, r as loadConfig } from "./config-ZZdtyQZy.js";
 import { watch } from "node:fs";
 import { basename, dirname, relative, resolve, sep } from "node:path";
 //#region src/cli/watch.ts

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "permdock",
-  "version": "0.11.0",
+  "version": "0.14.0",
   "description": "Typed permissions for TypeScript apps, APIs, databases, and AI agents, with the permdock CLI and test runners.",
   "keywords": [
     "ai-agents",
@@ -320,7 +320,7 @@
     "oxc-parser": "0.154.0"
   },
   "devDependencies": {
-    "@anthropic-ai/claude-agent-sdk": "0.3.301",
+    "@anthropic-ai/claude-agent-sdk": "0.3.303",
     "@arethetypeswrong/cli": "0.18.5",
     "@babel/core": "8.0.7",
     "@clack/prompts": "1.8.1",
@@ -330,9 +330,9 @@
     "@nestjs/core": "12.1.3",
     "@nestjs/platform-express": "12.1.3",
     "@openai/agents": "0.20.0",
-    "@orpc/contract": "2.0.0-beta.42",
-    "@orpc/openapi": "2.0.0-beta.42",
-    "@orpc/server": "2.0.0-beta.42",
+    "@orpc/contract": "2.0.0-beta.44",
+    "@orpc/openapi": "2.0.0-beta.44",
+    "@orpc/server": "2.0.0-beta.44",
     "@permdock/ox-config": "0.0.0",
     "@permdock/typescript-config": "0.0.0",
     "@solidjs/start": "2.0.6",
@@ -340,35 +340,35 @@
     "@supabase/supabase-js": "2.118.0",
     "@sveltejs/kit": "3.1.0",
     "@sveltejs/vite-plugin-svelte": "7.3.1",
-    "@tanstack/react-start": "1.169.2",
+    "@tanstack/react-start": "1.169.3",
     "@trpc/server": "11.19.0",
     "@types/express": "5.0.6",
-    "@types/node": "24.19.2",
+    "@types/node": "26.6.5",
     "@types/pg": "8.23.1",
     "@types/react": "19.3.0",
     "@types/react-dom": "19.3.0",
     "@vercel/detect-agent": "1.2.5",
     "@vitest/coverage-v8": "5.0.5",
-    "ai": "7.0.141",
+    "ai": "7.0.143",
     "ajv": "8.20.0",
     "astro": "7.4.0",
     "babel-plugin-react-compiler": "1.0.0",
-    "better-supabase": "0.18.0",
-    "better-supabase-floor": "npm:better-supabase@0.13.0",
+    "better-supabase": "0.29.0",
+    "better-supabase-floor": "npm:better-supabase@0.29.0",
     "chat": "4.42.0",
     "diff": "9.0.0",
     "drizzle-orm": "1.0.0-rc.5-5935859",
     "elysia": "1.4.30",
-    "eve": "0.79.2",
+    "eve": "0.80.1",
     "express": "5.3.0",
     "fastest-levenshtein": "1.0.16",
     "fastify": "5.12.7",
-    "h3": "2.0.2",
+    "h3": "2.0.5",
     "happy-dom": "21.0.4",
     "hono": "4.13.13",
     "jose": "6.2.12",
-    "kysely": "0.29.6",
-    "next": "16.4.1",
+    "kysely": "0.29.7",
+    "next": "16.4.2",
     "oxlint": "1.89.0",
     "oxlint-tsgolint": "7.0.2004",
     "package-manager-detector": "1.9.0",
@@ -378,7 +378,7 @@
     "react": "19.3.1",
     "react-dom": "19.3.1",
     "reflect-metadata": "0.2.2",
-    "resend": "6.33.0",
+    "resend": "6.34.1",
     "rxjs": "7.8.2",
     "smol-toml": "1.9.1",
     "solid-js": "1.9.17",
@@ -411,7 +411,7 @@
     "@trpc/server": ">=11",
     "ai": ">=5",
     "astro": ">=5",
-    "better-supabase": ">=0.13.0",
+    "better-supabase": ">=0.29.0",
     "chat": ">=4",
     "drizzle-orm": ">=0.40 || >=1.0.0-rc.0",
     "elysia": ">=1",

package/skills/permdock-credentials/references/tokens-keys-links.md

@@ -125,7 +125,7 @@ const subject = await subjectFromCapability(token, {
 - The result is a `kind: 'link'` principal with one `{ on, roles, via: 'link' }` membership. It never holds a scope or global role.
 - `linkPolicy` returns the tenant's `LinkPolicy` (`maxLifetime`, `redeemers`, `once`). Passing the same policy to `signCapability` refuses to mint a link the resolver would refuse.
 - Never an unguessable id without expiry, and never a security-definer RPC that reads the guest page's rows.
-- The one exception is resolving a stored link. When links live in better-supabase's share-links block, its `resolve_share_link` is `security definer` and reads only the link table. `subjectFromShareLink(token, { shareLinks, links, ttl })` from `permdock/better-supabase` turns the row into the same link subject. The page's rows are then read through `exchangeCapability` and RLS, as for a signed link. `links` maps each subject type (`subject.type` from better-supabase 0.14, `subjectType` before it) to a resource and maps the row's role to PermDock roles. An unmapped type or role, and a revoked or expired row, are anonymous. A link pinned to a version is refused, because a capability reads the current rows; read it through better-supabase's `versions.getShared(token)`. See [row-backed links](https://permdock.com/docs/concepts/capabilities#row-backed-links).
+- The one exception is resolving a stored link. When links live in better-supabase's share-links block, its `resolve_share_link` is `security definer` and reads only the link table. `subjectFromShareLink(token, { shareLinks, links, ttl })` from `permdock/better-supabase` turns the row into the same link subject. The page's rows are then read through `exchangeCapability` and RLS, as for a signed link. `links` maps each subject type (the row's `subject.type`) to a resource and maps the row's role to PermDock roles. An unmapped type or role, and a revoked or expired row, are anonymous. A link pinned to a version is refused, because a capability reads the current rows; read it through better-supabase's `versions.getShared(token)`. See [row-backed links](https://permdock.com/docs/concepts/capabilities#row-backed-links).
 
 With Supabase, let RLS serve the link through an exchange, never the link token itself:
 

package/skills/permdock-wire/references/adapters.md

@@ -501,7 +501,7 @@ const subject = subjectFromSupabase(claims, {
 
 Write the claims with `permdock supabase hook generate`; `permdock supabase inspect --out` writes the manifest (helper names, tenant claim, budget, claims written) that `authorizationProvider` from `permdock/better-supabase` turns into better-supabase's `authorization` config. No `@supabase/supabase-js` peer. Pair with `permdock rls generate`, or keep SQL as authority and run `permdock rls verify --db-url-stdin` against `sqlFunction` twins ([database-first](https://permdock.com/docs/adapters/rls)); the generic RLS workflow is in the `permdock-data` skill.
 
-With better-supabase, set `auth.authorization: authorizationProvider({ manifest, catalog })` in `better-supabase.config.ts` (top-level `authorization` before 0.15) (with `rls.customRoles` its `canAssign` and `canAssignFor` call `permdock_can_assign_any` and its `_for` form, so custom roles are assignable through better-supabase; regenerate the manifest after turning custom roles on), pass `authorizer({ policy })` to the server (`createNext`, `createHono`, `createMcp`) so every `permission` a resource, action, route guard or tool declares is decided by PermDock from the verified claims (`operations` maps tables for `permissions: true`; a missing or anonymous claim denies), build bucket and topic `access` policies with `bucketPolicy` and `topicPolicy`, and map its session with `subjectFromBetterSupabase(session)` (all from `permdock/better-supabase`): the active tenant's `features` become `principal.plans`. Pass `plans: { keys }` when better-supabase's `entitlements.claim.keys` shortens feature keys, and `apiKeys: { permissions, manifest }` so an `apiKey` session maps to the key's credential subject instead of the anonymous one. For `createMcp` tools, put the permission in `meta` and spread `toolPolicy({ permdock })` into the options: tools without one are hidden and refused, and approval-required calls are refused because `createMcp` collects no approvals. Wrap a `CredentialProvider` with `credentialGuard(provider, { permdock, use, revoke? })` so PermDock decides each token use. `authorizationProvider({ ..., approver })` lets holders of that permission approve AI tool calls, never their own. `approvers: { 'ai-tool': holder(p), 'support-session': ..., 'invoice.send': ... }` fills `isApprover` through `permdock_is_approver` (needs `rls.approvals`); only `user()`, `holder()` and `anyOf()` approvers, and a kind it does not name has no approver. `accessReviewApplier({ client, reviews, policy, demoteTo?, email?, permdockFor? })` applies a review's revoked items: `update_member_role` to the `demoteTo` role when that role lacks the permission, else `remove_member`, plus `revoke_invitation` for the member's matching invitations, then `markApplied`; pass the reviewer's client so the blocks' own checks run. better-supabase's `createAgentRuntime({ toolApproval })` takes `toolApproval` from `permdock/ai-sdk` as it is. Validate its claims with `betterSupabase.claims(supabaseClaims().extend(appSchema))` (`supabaseClaims` from `permdock/supabase`, any Standard Schema as `appSchema`) instead of a hand-written copy of the claim shape. A `supabase.hook.claims` function that needs the user's organizations calls `<schema>.member_organization_ids_for(user_id)` (generated by `rls generate`, executable by `supabase_auth_admin` only) instead of querying the membership tables itself. With a scope named `team` or `teams`, `authorizationProvider` fills better-supabase's `teamIdsOf` with `<schema>.member_team_ids_of(user)`, which answers only for the caller, so with `blocks.permissions.model: 'provider'` (`blocks.access` before 0.15) better-supabase's `team_ids_of()` and team-sharing policies read PermDock's memberships. A token Supabase's OAuth server issued to a third-party app (`client_id`) becomes an `oauth-client` actor limited to its `scope`; `deny(permission, { to: actor('oauth-client') })` keeps such apps out, in the app and, through `rls generate`, in Postgres. A better-supabase support session (`act.kind: 'support'`) is actor kind `support` with `sessionId` and `readOnly`, and `actingAs` (`act.kind: 'impersonation'`) is kind `impersonation`; neither has a delegation, so they reach nothing until a policy delegation names `actor('support')` or `actor('impersonation')`, and `readOnly: true` (also when `read_only` is absent) narrows that to read-only permissions. Generated RLS reads memberships, not `act`, so a support token sent to the Data API writes as the user: add a restrictive `for update` (and `insert` / `delete`) policy per writable table that requires `act ->> 'read_only' = 'false'` when `act` is a support or session level ([support access](https://permdock.com/docs/guides/support-access)). With `rls.anonymousSignIns: 'deny'`, pass `anonymousSignIns: 'deny'` to the subject mapper too (doctor PD057). Check a deployed database against the generated policies with `permdock rls verify --introspect`.
+With better-supabase, set `auth.authorization: authorizationProvider({ manifest, catalog })` in `better-supabase.config.ts` (with `rls.customRoles` its `canAssign` and `canAssignFor` call `permdock_can_assign_any` and its `_for` form, so custom roles are assignable through better-supabase; regenerate the manifest after turning custom roles on), pass `authorizer({ policy })` to the server (`createNext`, `createHono`, `createMcp`) so every `permission` a resource, action, route guard or tool declares is decided by PermDock from the verified claims (`operations` maps tables for `permissions: true`; a missing or anonymous claim denies), build bucket and topic `access` policies with `bucketPolicy` and `topicPolicy`, and map its session with `subjectFromBetterSupabase(session)` (all from `permdock/better-supabase`): the active tenant's `features` become `principal.plans`. Pass `plans: { keys }` when better-supabase's `entitlements.claim.keys` shortens feature keys, and `apiKeys: { permissions, manifest }` so an `apiKey` session maps to the key's credential subject instead of the anonymous one. For `createMcp` tools, put the permission in `meta` and spread `toolPolicy({ permdock })` into the options: tools without one are hidden and refused, and approval-required calls are refused because `createMcp` collects no approvals. Wrap a `CredentialProvider` with `credentialGuard(provider, { permdock, use, revoke? })` so PermDock decides each token use. `authorizationProvider({ ..., approver })` lets holders of that permission approve AI tool calls, never their own. `approvers: { 'ai-tool': holder(p), 'support-session': ..., 'invoice.send': ... }` fills `isApprover` through `permdock_is_approver` (needs `rls.approvals`); only `user()`, `holder()` and `anyOf()` approvers, and a kind it does not name has no approver. `accessReviewApplier({ client, reviews, policy, demoteTo?, email?, permdockFor? })` applies a review's revoked items: `update_member_role` to the `demoteTo` role when that role lacks the permission, else `remove_member`, plus `revoke_invitation` for the member's matching invitations, then `markApplied`; pass the reviewer's client so the blocks' own checks run. better-supabase's `createAgentRuntime({ toolApproval })` takes `toolApproval` from `permdock/ai-sdk` as it is. Validate its claims with `betterSupabase.claims(supabaseClaims().extend(appSchema))` (`supabaseClaims` from `permdock/supabase`, any Standard Schema as `appSchema`) instead of a hand-written copy of the claim shape. A `supabase.hook.claims` function that needs the user's organizations calls `<schema>.member_organization_ids_for(user_id)` (generated by `rls generate`, executable by `supabase_auth_admin` only) instead of querying the membership tables itself. With a scope named `team` or `teams`, `authorizationProvider` fills better-supabase's `teamIdsOf` with `<schema>.member_team_ids_of(user)`, which answers only for the caller, so with `blocks.permissions.model: 'provider'` better-supabase's `team_ids_of()` and team-sharing policies read PermDock's memberships. A token Supabase's OAuth server issued to a third-party app (`client_id`) becomes an `oauth-client` actor limited to its `scope`; `deny(permission, { to: actor('oauth-client') })` keeps such apps out, in the app and, through `rls generate`, in Postgres. A better-supabase support session (`act.kind: 'support'`) is actor kind `support` with `sessionId` and `readOnly`, and `actingAs` (`act.kind: 'impersonation'`) is kind `impersonation`; neither has a delegation, so they reach nothing until a policy delegation names `actor('support')` or `actor('impersonation')`, and `readOnly: true` (also when `read_only` is absent) narrows that to read-only permissions. Generated RLS reads memberships, not `act`, so a support token sent to the Data API writes as the user: add a restrictive `for update` (and `insert` / `delete`) policy per writable table that requires `act ->> 'read_only' = 'false'` when `act` is a support or session level ([support access](https://permdock.com/docs/guides/support-access)). With `rls.anonymousSignIns: 'deny'`, pass `anonymousSignIns: 'deny'` to the subject mapper too (doctor PD057). Check a deployed database against the generated policies with `permdock rls verify --introspect`.
 
 The other better-supabase slots, all from `permdock/better-supabase` ([better-supabase](https://permdock.com/docs/adapters/better-supabase)): `hookCan(permdock)` and `handlerCan({ getPermDock })` are the `can` options of `authorizeHook` and `protectWebHandler` in `better-supabase/workflow-sdk`; they decide with no row unless the `data` option loads one (`hookCan(permdock, { data: (tenant, key) => row })`, `handlerCan(source, { data: (request, key) => row })`), so without it a permission with a row condition denies, and `handlerCan` answers `undefined` (401) without a signed-in principal. `supportPolicy({ policy, options?, writable?, approval?, approved? })` is the `authorize` option of `supportSessions`; it decides each start with `decideSupportSession` as the admin, and an `approval-required` start passes only once `approved(input, pending)` returns `{ approvedBy }` for an approver other than the admin. `subscriberPolicy({ policy, principals, events, row?, sender? })` filters outbox, webhook or realtime subscribers to those who may read the event (exact type, then the longest `prefix.*`, then `*`; a type with no entry reaches no one). `principalSource({ claims, identities? })` is a `PrincipalSource` over the claims better-supabase mints, for `decideFor`, `subscribersFor` and delivery; only links the app created through a signed-in flow or a verified address go in `identities`. `authorizationHooks({ policy, claims, service?, principals?, events?, approvers?, support?, tickets? })` is the `authorization` option of `createServer`: it answers automation publish and run-as, delegated OAuth scopes, `approverOf`, identities, delivery audiences, support sessions and run tickets from the claims better-supabase mints now, never from the request.
 

package/dist/powersync-6vgKevSi.js

@@ -1 +0,0 @@
-export { n as runPowerSync } from "./powersync-CD8-Ypao.js";

package/dist/pull-DfJALUbS.js

@@ -1 +0,0 @@
-export { n as runCloudPull } from "./pull-CAeaAioC.js";

package/dist/run-0vOholnN.js

@@ -1 +0,0 @@
-export { t as run } from "./run-B5nyNKe8.js";

package/dist/supabase-hook-CWvEpdCh.js

@@ -1 +0,0 @@
-export { i as runSupabase } from "./supabase-hook-CyuD9Wau.js";

package/dist/usage-CNca1i1W.js

@@ -1 +0,0 @@
-export { t as runUsage } from "./usage-Y6xZUfE-.js";

package/dist/watch-COuvly20.js

@@ -1 +0,0 @@
-export { i as watchCollect } from "./watch-Bpci3hBY.js";

package/dist/{core-DzVINFbU.js → core-lxoANyai.js}

@@ -5,8 +5,8 @@ import { y as membershipsClaim } from "./evaluate-BAmf_AQd.js";
 import { n as parseSnapshot } from "./snapshot-CXlzi69u.js";
 import { n as fromSnapshot } from "./from-snapshot-DCakWRsr.js";
 import { t as getPermDock } from "./permdock-BvjivVb9.js";
-import { c as quoteSqlTable, n as defaultSqlCommand, o as quoteSqlIdent, t as SQL_IDENT } from "./sql-0WjxIp9g.js";
 import "./budget-BELja5A9.js";
+import { c as quoteSqlTable, n as defaultSqlCommand, o as quoteSqlIdent, t as SQL_IDENT } from "./sql-0WjxIp9g.js";
 //#region src/testing/policy-matrix.ts
 function isOutcomeCell(value) {
 	return value === "granted" || value === "denied" || value === "approval-required" || value !== null && typeof value === "object" && ("denials" in value || "outcome" in value || "alternatives" in value || "obligations" in value || "deniedBy" in value);

package/dist/{supabase-CC6rIri4.js → supabase-CDHMsDD0.js}

@@ -5,8 +5,8 @@ import { s as ApprovalError } from "./types-CcUXciSj.js";
 import { c as decodeApprovalCursor, l as encodeApprovalCursor, s as approvalPageSize, t as applyApprovalVerdict } from "./store-RNFvaJJv.js";
 import { a as parseCapability } from "./capability-BqX94r07.js";
 import { t as loadJose } from "./load-jose-DZ4dnjri.js";
-import { a as quoteQualifiedTable, c as quoteSqlTable, d as sqlTextArray, i as qualifySqlTable, o as quoteSqlIdent, s as quoteSqlLiteral } from "./sql-0WjxIp9g.js";
 import "./budget-BELja5A9.js";
+import { a as quoteQualifiedTable, c as quoteSqlTable, d as sqlTextArray, i as qualifySqlTable, o as quoteSqlIdent, s as quoteSqlLiteral } from "./sql-0WjxIp9g.js";
 import { d as keptKeys, l as roleColumn } from "./sources-C4vkzZJV.js";
 import { t as callRpc } from "./postgrest-DAxFltvO.js";
 //#region src/supabase/capability.ts