permdock 0.13.0 → 0.14.0

package/dist/a2a/index.js

@@ -8,7 +8,7 @@ import { n as resourceRef } from "../resource-ref-CaS9yVPi.js";
 import { i as challengeScope, l as withApp, o as hasScope, s as scopesReaching } from "../permdock-BvjivVb9.js";
 import { p as wwwAuthenticate, r as bearerChallenge } from "../problem-BVLHFK33.js";
 import { r as instanceOptions } from "../build-instance-BWXqwQYU.js";
-import { n as createAgentKernel } from "../kernel-qv4cr9w8.js";
+import { n as createAgentKernel } from "../kernel-BD8QuMnv.js";
 import { t as delegationFrom } from "../delegation-input-FTxMK3ji.js";
 //#region src/a2a/create.ts
 function firstScheme(options) {

package/dist/{adoption-scan-oks22j9J.js → adoption-scan-BGtwGfoH.js}

@@ -1,5 +1,5 @@
 import { r as listSourceFiles } from "./files-BSjrtIHw.js";
-import { t as DOCS_BASE } from "./manifest-Cl6yHiVK.js";
+import { t as DOCS_BASE } from "./manifest-BWIR_EEB.js";
 import { readFileSync } from "node:fs";
 import { relative } from "node:path";
 //#region src/cli/adoption-scan.ts

package/dist/agent/index.js

@@ -1 +1 @@
-export { n as createPermDock } from "../create-6EwRQlig.js";
+export { n as createPermDock } from "../create-Coq5fIrq.js";

package/dist/ai-sdk/index.js

@@ -1,8 +1,8 @@
 import { t as compact } from "../compact-CAf557ZB.js";
 import { n as PermDockDeniedError, t as PermDockApprovalRequiredError } from "../errors-B6R_lg2a.js";
 import { l as withApp } from "../permdock-BvjivVb9.js";
-import { r as stepUpText, t as approvalTokenOf } from "../kernel-qv4cr9w8.js";
-import { t as agentRuntime } from "../create-6EwRQlig.js";
+import { r as stepUpText, t as approvalTokenOf } from "../kernel-BD8QuMnv.js";
+import { t as agentRuntime } from "../create-Coq5fIrq.js";
 //#region src/ai-sdk/create.ts
 const APPROVAL_STATUSES = /* @__PURE__ */ new Set([
 	"approved",

package/dist/{arazzo-BzVfXbhf.js → arazzo-9uhbmKf5.js}

@@ -3,7 +3,7 @@ import { c as missingInput } from "./errors-Vpu6rKHl.js";
 import { i as readJsonFile } from "./files-BSjrtIHw.js";
 import { t as ARAZZO_REPORT_SCHEMA } from "./version-DMQ0dnN5.js";
 import { a as loadModule, s as pickNamed, t as asPermissionTree } from "./load-DjSU5KXO.js";
-import { t as DOCS_BASE } from "./manifest-Cl6yHiVK.js";
+import { t as DOCS_BASE } from "./manifest-BWIR_EEB.js";
 import { existsSync } from "node:fs";
 import { resolve } from "node:path";
 //#region src/cli/arazzo.ts

package/dist/{arazzo-CBBIhC40.js → arazzo-Bol9OgF-.js}

@@ -21,7 +21,7 @@ const check = defineLeaf({
 		...permissionsFlag
 	},
 	async run(ctx, { flags }) {
-		return (await import("./arazzo-BzVfXbhf.js")).runArazzo({
+		return (await import("./arazzo-9uhbmKf5.js")).runArazzo({
 			cwd: ctx.cwd,
 			config: ctx.config,
 			doc: given(flags.doc),

package/dist/better-supabase/index.d.ts

@@ -162,9 +162,10 @@ type ApiKeySessionOptions = {
   readonly serviceRoles?: ServiceRoles<ApiKeySession>;
 };
 /**
- * better-supabase's `SessionSnapshot` (0.15 and later): one verified token,
- * from `bsb.getRequestSession()`, that `'use cache: private'` scopes share. Its
- * `issuedAt` and `authzVersion` come from the `iat` and `authz_ver` claims.
+ * The fields of better-supabase's `SessionSnapshot` a subject reads: one
+ * verified token, from `bsb.getRequestSession()`, that `'use cache: private'`
+ * scopes share. Its `issuedAt` and `authzVersion` come from the `iat` and
+ * `authz_ver` claims.
  */
 type SessionSnapshotLike = {
   readonly accessToken: string;
@@ -417,9 +418,8 @@ type AuthorizationProviderOptions = {
   /**
    * Fill better-supabase's `rowsWith` (and `rowsWithFor` when the `_for`
    * helpers exist) from the `rls.rowHelpers` helpers the manifest names, so a
-   * `config.records.<type>.permissions.<action>` entry with `rows` checks the
-   * rows the caller holds a permission on. Needs better-supabase 0.22 or later,
-   * whose config takes those templates.
+   * `config.subjects.<type>.permissions.<action>` entry with `rows` checks the
+   * rows the caller holds a permission on.
    */
   readonly rowHelpers?: boolean;
 };
@@ -485,8 +485,8 @@ type AuthorizerOptions = {
    */
   readonly version?: MembershipSource["version"];
   /**
-   * The version cache for `memberships` when better-supabase passes none (0.13
-   * and 0.14, or a server created without `versions`).
+   * The version cache for `memberships` when better-supabase passes none (a
+   * server created without `versions`).
    */
   readonly versions?: VersionCache;
   /**
@@ -510,7 +510,7 @@ type AuthorizerOptions = {
  * subject is mapped from the verified claims with `subjectFromBetterSupabase`;
  * the request's `context.tenant` selects the active tenant only among the
  * memberships the claims hold. A caller without claims is anonymous, and a
- * throw denies. With better-supabase 0.15's runtime `memo`, the checks of one
+ * throw denies. With better-supabase's runtime `memo`, the checks of one
  * request scope share an instance per claims, tenant and intent.
  */
 export declare function authorizer(options: AuthorizerOptions): Authorizer<Permission>;
@@ -801,20 +801,14 @@ export declare function roleOrderFromCatalog(catalog: CatalogDocument, options?:
 //#region src/better-supabase/share-links.d.ts
 /**
  * The fields of better-supabase's `ResolvedShareLink` a link subject is built
- * from: `subject` from better-supabase 0.14, `subjectType` and `subjectId`
- * before it.
+ * from.
  */
-type ShareLinkRow = ShareLinkRowFields & ({
+type ShareLinkRow = {
+  readonly id: string;
   readonly subject: {
     readonly type: string;
     readonly id: string;
   };
-} | {
-  readonly subjectType: string;
-  readonly subjectId: string;
-});
-type ShareLinkRowFields = {
-  readonly id: string;
   readonly organizationId: string;
   readonly role: string;
   /** Set on a link pinned to one version, which `subjectFromShareLink` refuses. */
@@ -846,8 +840,8 @@ type ShareLinkTarget = {
 type ShareLinkSubjectOptions = {
   readonly shareLinks: ShareLinkResolver;
   /**
-   * One entry per subject type a guest page serves, keyed by better-supabase's
-   * `subjectType`.
+   * One entry per subject type a guest page serves, keyed by the row's
+   * `subject.type`.
    */
   readonly links: Readonly<Record<string, ShareLinkTarget>>;
   /**

package/dist/better-supabase/index.js

@@ -457,12 +457,8 @@ function supportPolicy(options) {
 }
 //#endregion
 //#region src/better-supabase/hooks.ts
-/**
-* better-supabase's claim that caps a context to the permission keys it lists:
-* `bs_permission_cap` before 0.15, `bsb_permission_cap` from 0.15. A run sets
-* both, so the cap holds on every version in the peer range.
-*/
-const PERMISSION_CAP_CLAIMS = ["bs_permission_cap", "bsb_permission_cap"];
+/** better-supabase's claim that caps a context to the permission keys it lists. */
+const PERMISSION_CAP_CLAIM = "bsb_permission_cap";
 /**
 * Whether `permdock` is granted `key` with no row; an unknown key and
 * `approval-required` are `false`.
@@ -541,7 +537,7 @@ function authorizationHooks(options) {
 				if (!isRecord(claims) || !await holdsAll(claims, ref)) return null;
 				return Object.freeze({
 					...claims,
-					...Object.fromEntries(PERMISSION_CAP_CLAIMS.map((claim) => [claim, [...ref.permissions]]))
+					[PERMISSION_CAP_CLAIM]: [...ref.permissions]
 				});
 			} catch {
 				return null;
@@ -1241,7 +1237,7 @@ const keyOf = (request) => isPermission(request.action) ? request.action.key : n
 * subject is mapped from the verified claims with `subjectFromBetterSupabase`;
 * the request's `context.tenant` selects the active tenant only among the
 * memberships the claims hold. A caller without claims is anonymous, and a
-* throw denies. With better-supabase 0.15's runtime `memo`, the checks of one
+* throw denies. With better-supabase's runtime `memo`, the checks of one
 * request scope share an instance per claims, tenant and intent.
 */
 function authorizer(options) {
@@ -1674,14 +1670,6 @@ function ownEntry(record, key) {
 	return Object.hasOwn(record, key) ? record[key] : void 0;
 }
 function rowSubject(row) {
-	if (!Object.hasOwn(row, "subject")) {
-		const type = row["subjectType"];
-		const id = row["subjectId"];
-		return isId(type) && isId(id) ? {
-			type,
-			id
-		} : void 0;
-	}
 	const subject = row["subject"];
 	if (typeof subject !== "object" || subject === null) return void 0;
 	const ref = Object.fromEntries(Object.entries(subject));

package/dist/better-supabase-83Gsetrv.js

@@ -0,0 +1,56 @@
+import { r as isRecord } from "./compact-CAf557ZB.js";
+import "./budget-BELja5A9.js";
+import { existsSync, readFileSync, readdirSync, statSync } from "node:fs";
+import { resolve } from "node:path";
+//#region src/cli/shared/doctor-files.ts
+const nodeFiles = Object.freeze({
+	exists: (path) => existsSync(path),
+	read: (path) => readFileSync(path, "utf8"),
+	list: (path) => readdirSync(path),
+	isDirectory: (path) => statSync(path, { throwIfNoEntry: false })?.isDirectory() === true
+});
+function filesOf(input) {
+	return input.files ?? nodeFiles;
+}
+/** Parses the JSON file at `path`; throws when it is missing or invalid. */
+function readJson(files, path) {
+	return JSON.parse(files.read(path));
+}
+//#endregion
+//#region src/cli/project/better-supabase.ts
+const CONFIG_FILES = [
+	"better-supabase.config.ts",
+	"better-supabase.config.mts",
+	"better-supabase.config.js",
+	"better-supabase.config.mjs"
+];
+/** The default export of the project's `better-supabase.config.*`, if it loads. */
+async function betterSupabaseConfig(input) {
+	const files = filesOf(input);
+	const path = CONFIG_FILES.map((name) => resolve(input.cwd, name)).find((file) => files.exists(file));
+	if (path === void 0) return;
+	try {
+		const { loadModule } = await import("./load-Dm0pSYH3.js");
+		const loaded = (await loadModule(path))["default"];
+		return isRecord(loaded) ? loaded : void 0;
+	} catch {
+		return;
+	}
+}
+/** Resolve the hook default once for generation, inspection and doctor. */
+function betterSupabaseDefaults(config, detected) {
+	const hook = config.supabase?.hook;
+	if (!detected || hook === void 0 || hook.activeFrom !== void 0) return config;
+	return {
+		...config,
+		supabase: {
+			...config.supabase,
+			hook: {
+				...hook,
+				activeFrom: `app_metadata.${config.rls?.tenantClaim ?? "tenant_id"}`
+			}
+		}
+	};
+}
+//#endregion
+export { readJson as a, nodeFiles as i, betterSupabaseDefaults as n, filesOf as r, betterSupabaseConfig as t };

package/dist/{casbin-C8r5trwy.js → casbin-1PVgMHOR.js}

@@ -16,7 +16,7 @@ const casbinImport = defineLeaf({
 		...outFlag
 	},
 	async run(ctx, { flags }) {
-		const { runCasbinImport } = await import("./casbin-BunKq48W.js");
+		const { runCasbinImport } = await import("./casbin-CBXD5rFx.js");
 		return runCasbinImport({
 			cwd: ctx.cwd,
 			model: given(flags.model),

package/dist/{casbin-BunKq48W.js → casbin-CBXD5rFx.js}

@@ -1,4 +1,4 @@
-import { a as nonEmptyOr } from "./output-DpCUAST3.js";
+import { a as nonEmptyOr } from "./output-3iB3_Hfg.js";
 import { t as applyFiles } from "./files-B3AA05f1.js";
 import { n as isIdentifier, t as emitPolicyModule } from "./policy-module-xym9fnSq.js";
 import { existsSync, readFileSync } from "node:fs";

package/dist/claude-agent/index.js

@@ -1,6 +1,6 @@
 import { r as isRecord, t as compact } from "../compact-CAf557ZB.js";
 import { l as withApp } from "../permdock-BvjivVb9.js";
-import { t as agentRuntime } from "../create-6EwRQlig.js";
+import { t as agentRuntime } from "../create-Coq5fIrq.js";
 //#region src/claude-agent/create.ts
 const MCP_PREFIX = "mcp__";
 function asInput(input) {

package/dist/cli/bin.js

@@ -11,7 +11,7 @@ if (argv.length === 1 && (argv[0] === "--version" || argv[0] === "-v")) {
 	const [{ isCi }, { trapSignals }, { run }, { streamHasColors }] = await Promise.all([
 		import("../env-DJZrPjRi.js"),
 		import("../signals-B1vHR3fN.js"),
-		import("../run-BqW8S5TM.js"),
+		import("../run-DGSLvGty.js"),
 		import("../style-DblOtSga.js")
 	]);
 	const signals = trapSignals();

package/dist/cli/index.js

@@ -1,8 +1,8 @@
 import { t as catalogPath } from "../catalog-path-CnI0XTFK.js";
-import { t as defineConfig } from "../config-BR23fL8m.js";
+import { t as defineConfig } from "../config-ZZdtyQZy.js";
 import { n as parsePushedPolicy, r as pushedPolicy, t as PUSHED_POLICY_SCHEMA } from "../pushed-policy-CDuOL2de.js";
 import { c as parseGrantsMarker, l as parseHookMarker } from "../markers-BeHZ4x9Q.js";
-import { t as run } from "../run-CjFdAzqE.js";
+import { t as run } from "../run-BlxXmaDS.js";
 //#region src/cli/token-schemas.ts
 const ID = {
 	type: "string",

package/dist/{cloud-C_Mau1q2.js → cloud-BfJVKpcN.js}

@@ -70,7 +70,7 @@ const pull = defineLeaf({
 	},
 	async run(ctx, { flags }) {
 		const env = await withStdinSecret(ctx, "token", flags["token-stdin"], "PERMDOCK_CLOUD_TOKEN");
-		return (await import("./pull-3OQCgxUf.js")).runCloudPull({
+		return (await import("./pull-BY1METGf.js")).runCloudPull({
 			cwd: ctx.cwd,
 			config: ctx.config,
 			url: given(flags.url),

package/dist/{codemod-CpMCbp0G.js → codemod-BXLd4K3j.js}

@@ -1,7 +1,7 @@
 import { n as CliError } from "./errors-Vpu6rKHl.js";
 import { a as rel } from "./files-BSjrtIHw.js";
 import { t as beforeFirst } from "./text-BMFRfBqc.js";
-import { n as ROOT } from "./manifest-Cl6yHiVK.js";
+import { n as ROOT } from "./manifest-BWIR_EEB.js";
 import { i as renameMessage, n as DEFAULT_CHANGES, r as flagRename, t as COMMAND_MOVES } from "./renames-CGj7YwcQ.js";
 import { i as refuseDirty, t as applyFiles } from "./files-B3AA05f1.js";
 import { readFileSync, readdirSync, statSync } from "node:fs";

package/dist/{codemod-BqYPToUJ.js → codemod-DWfH-KHk.js}

@@ -7,7 +7,7 @@ const codemod = defineLeaf({
 		description: "The release to migrate to (0.5)",
 		required: true,
 		async complete() {
-			return (await import("./codemod-CpMCbp0G.js")).codemodVersions();
+			return (await import("./codemod-BXLd4K3j.js")).codemodVersions();
 		}
 	}, {
 		name: "paths",
@@ -22,7 +22,7 @@ const codemod = defineLeaf({
 		}
 	},
 	async run(ctx, { flags, args, rest }) {
-		return (await import("./codemod-CpMCbp0G.js")).runCodemod({
+		return (await import("./codemod-BXLd4K3j.js")).runCodemod({
 			cwd: ctx.cwd,
 			version: args["version"],
 			paths: rest,

package/dist/{collect-D9Tt0Bcx.js → collect-lZgCKMe_.js}

@@ -29,7 +29,7 @@ const collect = defineLeaf({
 		};
 		if (flags.watch) {
 			if (flags.check) throw new CliError("usage", "collect: --watch writes the catalog; drop --check", { code: "invalid_value" });
-			return (await import("./watch-COuvly20.js")).watchCollect(ctx, overrides);
+			return (await import("./watch-C44FtM79.js")).watchCollect(ctx, overrides);
 		}
 		const result = await (await import("./collect-D-eroIfV.js")).runCollect({
 			cwd: ctx.cwd,

package/dist/{completion-Cq4fbT2S.js → completion-fJ19i8Jk.js}

@@ -1,6 +1,6 @@
 import { n as CliError } from "./errors-Vpu6rKHl.js";
 import { a as suggestion, o as GLOBAL_FLAGS } from "./args-0FrVs5EH.js";
-import { a as resolve } from "./manifest-Cl6yHiVK.js";
+import { a as resolve } from "./manifest-BWIR_EEB.js";
 import { t as defineLeaf } from "./command-L8EstFNm.js";
 //#region src/cli/core/completion.ts
 const SHELLS = [

package/dist/{config-0xxCmoD8.js → config-BYSk3iKV.js}

@@ -10,7 +10,7 @@ const config = defineLeaf({
 		...failOnFlag
 	},
 	async run(ctx, { flags }) {
-		const { runConfig } = await import("./config-report-C1-r59VY.js");
+		const { runConfig } = await import("./config-report-BpztJ3HP.js");
 		return runConfig({
 			cwd: ctx.cwd,
 			config: ctx.config,

package/dist/{config-BR23fL8m.js → config-ZZdtyQZy.js}

@@ -1,5 +1,6 @@
 import { r as isRecord } from "./compact-CAf557ZB.js";
 import { i as configError, n as CliError } from "./errors-Vpu6rKHl.js";
+import { n as betterSupabaseDefaults, t as betterSupabaseConfig } from "./better-supabase-83Gsetrv.js";
 import { a as isSection, i as isModuleKey, n as MODULE_KEYS, o as kindOf, r as describeKinds, t as CONFIG_SHAPE } from "./config-shape-tsxHx71E.js";
 import { existsSync } from "node:fs";
 import { relative, resolve } from "node:path";
@@ -80,8 +81,10 @@ async function readConfig(cwd, fromFlag, options) {
 	const mod = await loadModule(path, options);
 	const display = relative(cwd, path).replaceAll("\\", "/");
 	const raw = pickNamed(mod, ["default"]);
+	const parsed = parseConfig(hasModuleValue(raw) ? await traceValues(cwd, path, display, raw, options) : raw, display);
 	return {
-		...parseConfig(hasModuleValue(raw) ? await traceValues(cwd, path, display, raw, options) : raw, display),
+		...parsed,
+		config: betterSupabaseDefaults(parsed.config, await betterSupabaseConfig({ cwd }) !== void 0),
 		file: path
 	};
 }

package/dist/{config-report-C1-r59VY.js → config-report-BpztJ3HP.js}

@@ -3,7 +3,7 @@ import { r as CONFIG_REPORT_SCHEMA } from "./version-DMQ0dnN5.js";
 import { t as catalogPath } from "./catalog-path-CnI0XTFK.js";
 import { n as guessPermissions, t as barrelFile } from "./collect-WCl8cJQV.js";
 import "./sources-C4vkzZJV.js";
-import { t as DOCS_BASE } from "./manifest-Cl6yHiVK.js";
+import { t as DOCS_BASE } from "./manifest-BWIR_EEB.js";
 import { n as MIGRATION_DIRS, t as DEFAULT_SENSITIVE_ACTIONS } from "./constants-DcJABbLW.js";
 //#region src/cli/config-report.ts
 function configReport(input) {

package/dist/{create-6EwRQlig.js → create-Coq5fIrq.js}

@@ -4,7 +4,7 @@ import { o as deniedFor } from "./where-scope-DlCdCM_8.js";
 import { l as withApp } from "./permdock-BvjivVb9.js";
 import { t as composeWraps } from "./wrap-B2wziJI_.js";
 import { r as instanceOptions } from "./build-instance-BWXqwQYU.js";
-import { n as createAgentKernel } from "./kernel-qv4cr9w8.js";
+import { n as createAgentKernel } from "./kernel-BD8QuMnv.js";
 //#region src/agent/create.ts
 function modelRow(modelId) {
 	return { id: modelId };

package/dist/{diff-BwR1JdP2.js → diff-CxtbOi2l.js}

@@ -21,7 +21,7 @@ const diff = defineLeaf({
 		}
 	},
 	async run(ctx, { flags, args }) {
-		return (await import("./diff-CQegtBAo.js")).runDiff({
+		return (await import("./diff-DfmYaIhB.js")).runDiff({
 			cwd: ctx.cwd,
 			config: ctx.config,
 			sources: [args["before"], args["after"]].filter((value) => value !== void 0),

package/dist/{diff-CQegtBAo.js → diff-DfmYaIhB.js}

@@ -8,7 +8,7 @@ import { t as buildCatalog } from "./catalog-doc-DjMKzJp9.js";
 import { a as loadModule, n as asPolicy, s as pickNamed } from "./load-DjSU5KXO.js";
 import { t as parseCatalog } from "./parse-1_ZheTW5.js";
 import { t as operationFindings } from "./operation-findings-CXtFzlKJ.js";
-import { n as fixtureSubject, r as loadFixtures, t as fixtureRow } from "./fixtures-A1_sp_tR.js";
+import { n as fixtureSubject, r as loadFixtures, t as fixtureRow } from "./fixtures-Bm4_K1ke.js";
 import { existsSync, readFileSync } from "node:fs";
 import { resolve } from "node:path";
 //#region src/cli/diff/format.ts

package/dist/{doctor-Dea6IqRw.js → doctor-NxCr_hba.js}

@@ -10,7 +10,7 @@ const doctor = defineLeaf({
 			description: "Check codes or groups to run",
 			valueHint: "code",
 			async complete() {
-				const { DOCTOR_CHECKS } = await import("./doctor-CDfzrMQB.js");
+				const { DOCTOR_CHECKS } = await import("./doctor-eNc7A_7I.js");
 				return [.../* @__PURE__ */ new Set([...DOCTOR_CHECKS.map(({ code }) => code), ...DOCTOR_CHECKS.flatMap(({ groups }) => groups)])];
 			}
 		},
@@ -27,7 +27,7 @@ const doctor = defineLeaf({
 			if (answer === void 0) return CANCELLED;
 			fix = answer;
 		}
-		return (await import("./doctor-CDfzrMQB.js")).runDoctor({
+		return (await import("./doctor-eNc7A_7I.js")).runDoctor({
 			cwd: ctx.cwd,
 			config: ctx.config,
 			only: flags.only,

package/dist/{doctor-CDfzrMQB.js → doctor-eNc7A_7I.js}

@@ -16,51 +16,36 @@ import { c as jsonSchemaOf, i as catalogOAuthScopes } from "./catalog-doc-DjMKzJ
 import { a as loadModule, i as loadConfiguredPolicy, n as asPolicy, s as pickNamed } from "./load-DjSU5KXO.js";
 import { t as catalogPath } from "./catalog-path-CnI0XTFK.js";
 import { r as runCollect } from "./collect-WCl8cJQV.js";
+import { n as supabaseTenantClaim } from "./budget-BELja5A9.js";
+import { a as readJson, i as nodeFiles, n as betterSupabaseDefaults, r as filesOf, t as betterSupabaseConfig } from "./better-supabase-83Gsetrv.js";
 import { i as qualifySqlTable, s as quoteSqlLiteral } from "./sql-0WjxIp9g.js";
 import { a as scopeMembershipTable } from "./compile-EzEMB-7v.js";
-import { n as supabaseTenantClaim } from "./budget-BELja5A9.js";
 import { d as keptKeys, r as PERMDOCK_SCHEMA } from "./sources-C4vkzZJV.js";
 import { t as parseCatalog } from "./parse-1_ZheTW5.js";
 import { n as activeTenantMismatch } from "./active-tenant-DVee32-T.js";
 import "./markers-BeHZ4x9Q.js";
 import { t as didYouMean } from "./args-0FrVs5EH.js";
-import { t as DOCS_BASE } from "./manifest-Cl6yHiVK.js";
+import { t as DOCS_BASE } from "./manifest-BWIR_EEB.js";
 import { t as createStyle } from "./style-Ds11Hmk4.js";
-import { a as nonEmptyOr, r as findingOf } from "./output-DpCUAST3.js";
-import { i as runSkillsInstall } from "./skills-5XWpNzCi.js";
+import { a as nonEmptyOr, r as findingOf } from "./output-3iB3_Hfg.js";
+import { i as runSkillsInstall } from "./skills-CY-MY_Oj.js";
 import { n as MIGRATION_DIRS, t as DEFAULT_SENSITIVE_ACTIONS } from "./constants-DcJABbLW.js";
 import { l as partPath } from "./output-files-BIQ_9pIs.js";
-import { _ as readSupabaseConfig, a as supabaseHookManifest, c as activeSource, d as resolveSchemas, g as pd074, h as pd045, l as pd039, m as attrsPlan, n as hookOut, v as supabaseConfig } from "./supabase-hook-CyuD9Wau.js";
+import { _ as readSupabaseConfig, a as supabaseHookManifest, c as activeSource, d as resolveSchemas, g as pd074, h as pd045, l as pd039, m as attrsPlan, n as hookOut, v as supabaseConfig } from "./supabase-hook-HPgwYb9V.js";
 import { G as byKey, Q as graphSqlName, n as tableNameOf, o as graphPlan, r as tableNames } from "./tables-DimBcVWY.js";
 import { a as guardedTables, p as contextRefs, r as unsatisfiedKinds, t as ownershipRules } from "./ownership-qqBuGJXr.js";
 import { t as membershipSourcesOf } from "./sources-qoIJQrJv.js";
 import { i as group, n as membershipColumns, o as sqlStatements, r as tableKey } from "./deciding-columns-NB4wcyBf.js";
 import { t as FIELD_VIEWS } from "./fields-DI8s3cPl.js";
 import { t as resolveNames } from "./resolve-names-Y1Cb22cp.js";
-import { a as pd010, c as pd014, d as pd038, f as pd041, i as pd008, l as pd015, n as pd001, o as pd011, p as pd057, r as pd007, s as pd013, t as runUsage, u as pd036 } from "./usage-hMYVFsN5.js";
-import { d as rowConditionMessage, f as commandFor, m as tableFor, p as compileGrants, s as ROW_CONDITION_FIX, u as helperTablePolicies } from "./verify-CmTiQ-yM.js";
-import { a as streamOf, i as scopeSourcesOf, r as staleFiles, t as powersyncFiles } from "./powersync-BTLk8GSl.js";
-import { a as buildContext, n as generateOptions, r as isRefusal, s as inheritTargets, t as supautilsRejections } from "./supautils-PRhfO-bL.js";
+import { a as pd010, c as pd014, d as pd038, f as pd041, i as pd008, l as pd015, n as pd001, o as pd011, p as pd057, r as pd007, s as pd013, t as runUsage, u as pd036 } from "./usage-WYRc7Kqg.js";
+import { d as rowConditionMessage, f as commandFor, m as tableFor, p as compileGrants, s as ROW_CONDITION_FIX, u as helperTablePolicies } from "./verify-CHQgLrtS.js";
+import { a as streamOf, i as scopeSourcesOf, r as staleFiles, t as powersyncFiles } from "./powersync-DVbskWD9.js";
+import { a as buildContext, n as generateOptions, r as isRefusal, s as inheritTargets, t as supautilsRejections } from "./supautils-DZ95xxW-.js";
 import { n as legacyHelperNames, r as retirePlan, t as legacyHelperCalls } from "./retire-B2xffQgY.js";
-import { existsSync, readFileSync, readdirSync, statSync } from "node:fs";
 import { basename, dirname, join, resolve } from "node:path";
 import { pathToFileURL } from "node:url";
 import { createRequire } from "node:module";
-//#region src/cli/shared/doctor-files.ts
-const nodeFiles = Object.freeze({
-	exists: (path) => existsSync(path),
-	read: (path) => readFileSync(path, "utf8"),
-	list: (path) => readdirSync(path),
-	isDirectory: (path) => statSync(path, { throwIfNoEntry: false })?.isDirectory() === true
-});
-function filesOf(input) {
-	return input.files ?? nodeFiles;
-}
-/** Parses the JSON file at `path`; throws when it is missing or invalid. */
-function readJson(files, path) {
-	return JSON.parse(files.read(path));
-}
-//#endregion
 //#region src/cli/project/project.ts
 function loadProject(input) {
 	const { cwd, config } = input;
@@ -216,24 +201,6 @@ async function pd064(input) {
 }
 //#endregion
 //#region src/cli/doctor/better-supabase.ts
-const CONFIG_FILES = [
-	"better-supabase.config.ts",
-	"better-supabase.config.mts",
-	"better-supabase.config.js",
-	"better-supabase.config.mjs"
-];
-/** The default export of the project's `better-supabase.config.*`, if it loads. */
-async function betterSupabaseConfig(input) {
-	const files = filesOf(input);
-	const path = CONFIG_FILES.map((name) => resolve(input.cwd, name)).find((file) => files.exists(file));
-	if (path === void 0) return;
-	try {
-		const loaded = (await loadModule(path))["default"];
-		return isRecord(loaded) ? loaded : void 0;
-	} catch {
-		return;
-	}
-}
 function activeTenantOf(config) {
 	const blocks = config["blocks"];
 	const permissions = isRecord(blocks) ? blocks["permissions"] : void 0;
@@ -253,8 +220,7 @@ function activeTenantOf(config) {
 * `switch_organization` never changes the tenant claim.
 */
 async function pd078(input) {
-	const hook = input.config.supabase?.hook;
-	if (hook === void 0) return [];
+	if (input.config.supabase?.hook === void 0) return [];
 	const config = await betterSupabaseConfig(input);
 	const activeTenant = config === void 0 ? void 0 : activeTenantOf(config);
 	if (activeTenant === void 0) return [];
@@ -262,7 +228,7 @@ async function pd078(input) {
 	const root = policy === void 0 ? void 0 : rootScope(scopeList(policy.scopes));
 	let from;
 	try {
-		from = activeSource(hook.activeFrom, root ?? "tenant");
+		from = activeSource(betterSupabaseDefaults(input.config, config !== void 0).supabase?.hook?.activeFrom, root ?? "tenant");
 	} catch {
 		return [];
 	}
@@ -1086,7 +1052,7 @@ async function pd058(input) {
 		code: "PD058",
 		severity: "warning",
 		message: gap,
-		fix: "build the source with tableMembershipSource or junctionMembershipSource, without expiresAt or disabledAt, or serve its members from the server"
+		fix: "build the source with tableMembershipSource or junctionMembershipSource, without expiresAt, or serve its members from the server"
 	}));
 	return [...staleFiles(cwd, compiled.files).map((file) => ({
 		code: "PD058",

package/dist/eve/index.js

@@ -2,7 +2,7 @@ import { t as compact } from "../compact-CAf557ZB.js";
 import { l as withApp } from "../permdock-BvjivVb9.js";
 import { c as isApprovalError } from "../types-CcUXciSj.js";
 import { o as resolveApproval } from "../helpers-DJicaG6f.js";
-import { t as agentRuntime } from "../create-6EwRQlig.js";
+import { t as agentRuntime } from "../create-Coq5fIrq.js";
 import { t as boundedMap } from "../lru-8q4WZjBV.js";
 //#region src/eve/create.ts
 const TOKENS_PER_PROCESS = 1e3;

package/dist/{fixtures-A1_sp_tR.js → fixtures-Bm4_K1ke.js}

@@ -5,12 +5,14 @@ import { a as loadModule, s as pickNamed } from "./load-DjSU5KXO.js";
 import { existsSync } from "node:fs";
 import { resolve } from "node:path";
 //#region src/cli/fixtures.ts
-function asFixtures(value) {
+function asFixtures(value, followed = false) {
 	const list = Array.isArray(value) ? value : isRecord(value) && Array.isArray(value["fixtures"]) ? value["fixtures"] : void 0;
 	if (list === void 0) throw configError("PermDock CLI: fixtures must be an array or { fixtures }");
 	return list.map((item, index) => {
 		if (!isRecord(item) || !isRecord(item["subject"]) || item["row"] === void 0) throw configError(`PermDock CLI: fixture ${index} needs subject and row`);
-		if (typeof item["action"] !== "string") throw new TypeError(`PermDock CLI: fixture ${index} needs action`);
+		if (followed && item["table"] !== void 0) {
+			if (typeof item["table"] !== "string" || item["table"].length === 0 || item["action"] !== void 0 || item["expected"] !== "granted" && item["expected"] !== "denied") throw configError(`PermDock CLI: fixture ${index} needs table and expected (granted or denied), without action`);
+		} else if (typeof item["action"] !== "string") throw new TypeError(`PermDock CLI: fixture ${index} needs action`);
 		if (typeof item["subject"]["id"] !== "string") throw new TypeError(`PermDock CLI: fixture ${index} subject needs id`);
 		const memberships = item["subject"]["memberships"];
 		if (memberships !== void 0 && !Array.isArray(memberships)) throw configError(`PermDock CLI: fixture ${index} subject.memberships must be an array`);
@@ -26,23 +28,19 @@ function asCustomRoles(value) {
 	if (!Array.isArray(value["customRoles"])) throw new TypeError("PermDock CLI: fixtures customRoles must be an array");
 	return value["customRoles"];
 }
-/**
-* A `.json` file or a module exporting `fixtures` (or default) and optionally
-* `customRoles`.
-*/
-async function loadFixtures(cwd, path) {
+async function loadFixtures(cwd, path, followed = false) {
 	const abs = resolve(cwd, path);
 	if (!existsSync(abs)) throw configError(`PermDock CLI: fixtures not found: ${path}`);
 	if (abs.endsWith(".json")) {
 		const parsed = readJsonFile(abs);
 		return {
-			fixtures: asFixtures(parsed),
+			fixtures: asFixtures(parsed, followed),
 			customRoles: asCustomRoles(parsed)
 		};
 	}
 	const mod = await loadModule(abs);
 	return {
-		fixtures: asFixtures(pickNamed(mod, ["fixtures", "default"])),
+		fixtures: asFixtures(pickNamed(mod, ["fixtures", "default"]), followed),
 		customRoles: asCustomRoles(mod)
 	};
 }

package/dist/{import-PP7uH8rC.js → import-efm6qPgx.js}

@@ -4,7 +4,7 @@ import { i as readJsonFile } from "./files-BSjrtIHw.js";
 import { t as applyFiles } from "./files-B3AA05f1.js";
 import { n as httpRequest } from "./http-DOL33cO0.js";
 import { i as schemaExpression, t as emitPermissionsModule } from "./generate-CezbCaTI.js";
-import { t as validateOpenapi } from "./schema-CeQZY6bO.js";
+import { t as validateOpenapi } from "./schema-CnrIP94n.js";
 import { existsSync, readFileSync } from "node:fs";
 import { resolve } from "node:path";
 //#region ../../node_modules/.pnpm/yaml@2.9.1/node_modules/yaml/browser/dist/nodes/identity.js