permdock 0.13.0 → 0.14.0

package/dist/{supabase-hook-CyuD9Wau.js → supabase-hook-HPgwYb9V.js}

@@ -6,10 +6,10 @@ import { a as describeError, i as configError } from "./errors-Vpu6rKHl.js";
 import { i as readJsonFile, o as sqlFiles, s as writeFileEnsuringDir } from "./files-BSjrtIHw.js";
 import { a as SUPABASE_MANIFEST_SCHEMA } from "./version-DMQ0dnN5.js";
 import { c as requirePolicy } from "./load-DjSU5KXO.js";
+import "./budget-BELja5A9.js";
 import { i as qualifySqlTable } from "./sql-0WjxIp9g.js";
 import { i as scopeColumn } from "./compile-EzEMB-7v.js";
-import { t as authorizeSql } from "./supabase-CC6rIri4.js";
-import "./budget-BELja5A9.js";
+import { t as authorizeSql } from "./supabase-CDHMsDD0.js";
 import { a as hookApiNames, d as keptKeys, t as AUTHZ_VERSION_TABLE, u as roleManifest } from "./sources-C4vkzZJV.js";
 import { o as readMemberships } from "./postgrest-DAxFltvO.js";
 import { t as beforeFirst } from "./text-BMFRfBqc.js";

package/dist/supabase-hook-qsewAVZY.js

@@ -0,0 +1 @@
+export { i as runSupabase } from "./supabase-hook-HPgwYb9V.js";

package/dist/{supautils-PRhfO-bL.js → supautils-DZ95xxW-.js}

@@ -3,12 +3,12 @@ import { f as scopeList, s as resolveScope } from "./scopes-0Up_UA2t.js";
 import { o as flattenGrantee } from "./grantee-Dke-9rd1.js";
 import { l as policyLevels } from "./policy-CLQ8__GF.js";
 import { a as describeError, i as configError } from "./errors-Vpu6rKHl.js";
-import { d as sqlTextArray, i as qualifySqlTable } from "./sql-0WjxIp9g.js";
 import "./budget-BELja5A9.js";
+import { d as sqlTextArray, i as qualifySqlTable } from "./sql-0WjxIp9g.js";
 import { l as roleColumn } from "./sources-C4vkzZJV.js";
 import { t as beforeFirst } from "./text-BMFRfBqc.js";
 import { c as parseSplit } from "./output-files-BIQ_9pIs.js";
-import { x as resolveAuthorize } from "./supabase-hook-CyuD9Wau.js";
+import { x as resolveAuthorize } from "./supabase-hook-HPgwYb9V.js";
 import { A as quoteQualified, C as parseMembershipsFlag, D as qualified, F as firstScopeType, O as quoteIdent, R as tenantTypeOf, a as customRolesOn, j as quoteTable, k as quoteLiteral, s as signedIn, t as CUSTOM_ROLES } from "./shared-DrGLwM3s.js";
 import { G as byKey, H as rolesTableScope, O as tokenScopesPlan, Q as graphSqlName, V as raiseSql, W as byCodeUnit, Y as apiKeysPlan, a as closureDepths, bt as checkSuspension, i as tablelessResources, o as graphPlan, r as tableNames, t as resolveVias, z as currentKeyExpr } from "./tables-DimBcVWY.js";
 import { o as assignableRoles, r as unsatisfiedKinds, t as ownershipRules, u as roleNames } from "./ownership-qqBuGJXr.js";
@@ -16,7 +16,7 @@ import { t as membershipSourcesOf } from "./sources-qoIJQrJv.js";
 import { i as group, o as sqlStatements } from "./deciding-columns-NB4wcyBf.js";
 import { d as orSql, h as branchClauses } from "./fields-DI8s3cPl.js";
 import { t as resolveNames } from "./resolve-names-Y1Cb22cp.js";
-import { m as tableFor } from "./verify-CmTiQ-yM.js";
+import { m as tableFor } from "./verify-CHQgLrtS.js";
 //#region src/cli/rls/custom-role-rebuild.ts
 const PREFIX = "PermDock CLI";
 /** A column of the roles-table row `r`. */

package/dist/testing/core.js

@@ -1 +1 @@
-export { r as policyMatrix, t as testOrmParity, n as testRlsParity } from "../core-DzVINFbU.js";
+export { r as policyMatrix, t as testOrmParity, n as testRlsParity } from "../core-lxoANyai.js";

package/dist/testing/fixtures/index.js

@@ -512,7 +512,7 @@ var better_supabase_manifest_default = {
 		"schema": "permdock",
 		"function": "custom_access_token_hook",
 		"out": "supabase/schemas/permdock/functions/custom_access_token_hook.sql",
-		"activeFrom": { "appMetadata": "active_organization" },
+		"activeFrom": { "appMetadata": "tenant_id" },
 		"schemas": "pg-delta"
 	},
 	helpers: {

package/dist/testing/index.js

@@ -27,16 +27,16 @@ import { c as problemFromDecision } from "../problem-BVLHFK33.js";
 import { o as resolveApproval } from "../helpers-DJicaG6f.js";
 import { t as APPROVAL_REQUEST_SCHEMA } from "../request-schema-DhX7UbfQ.js";
 import { t as catalogSchema } from "../schema-BOJjqlWL.js";
+import { t as supabaseMembershipsBudget } from "../budget-BELja5A9.js";
 import { c as parseApiKey } from "../server-3cVlTLde.js";
 import { n as discoverAuthorizationServer } from "../device-BwbJNmb2.js";
 import { t as CONNECTOR_SCHEMA } from "../connector-schema-CYLQNMYq.js";
 import { l as sha256Hex, n as scimHandler, t as directoryMembershipSource } from "../scim-jJBJ7g1Z.js";
 import { c as quoteSqlTable, o as quoteSqlIdent } from "../sql-0WjxIp9g.js";
 import { i as cloudEndpoints, n as cloud, s as approverHeaders, t as bearerChallenge } from "../challenge-DImNcR7B.js";
-import { t as supabaseMembershipsBudget } from "../budget-BELja5A9.js";
 import { t as supabaseManifestSchema } from "../manifest-schema-DQkBK2Mr.js";
 import { t as PUSHED_POLICY_SCHEMA } from "../pushed-policy-CDuOL2de.js";
-import { i as policyMatrixLayout, n as testRlsParity, r as policyMatrix, t as testOrmParity } from "../core-DzVINFbU.js";
+import { i as policyMatrixLayout, n as testRlsParity, r as policyMatrix, t as testOrmParity } from "../core-lxoANyai.js";
 import { i as saasPermissions } from "../permissions-CYcHj_w7.js";
 import { C as saasOrg, E as saasSeed, S as saasMemberships, a as saasProject, g as verifySaasSession, h as signSaasToken, k as saasPolicy, t as saasDoc, w as saasPrincipal, x as saasCustomRoles } from "../saas-DK4V-3Is.js";
 import { t as POLICY_NOT_PUBLISHED } from "../problem-types-DSsRfONQ.js";

package/dist/unplugin/index.js

@@ -1,4 +1,4 @@
-import { n as createCollectScheduler, r as report } from "../watch-Bpci3hBY.js";
+import { n as createCollectScheduler, r as report } from "../watch-CTfSlIGD.js";
 import { r as peerHint } from "../peer-Q0fuZ6hx.js";
 import { createRequire } from "node:module";
 //#region src/unplugin/index.ts

package/dist/usage-CH7oISI6.js

@@ -0,0 +1 @@
+export { t as runUsage } from "./usage-WYRc7Kqg.js";

package/dist/{usage-BfzSfOpD.js → usage-Dm2hn0pS.js}

@@ -16,7 +16,7 @@ const usage = defineLeaf({
 		}
 	},
 	async run(ctx, { flags }) {
-		return (await import("./usage-BDiTP763.js")).runUsage({
+		return (await import("./usage-CH7oISI6.js")).runUsage({
 			cwd: ctx.cwd,
 			config: ctx.config,
 			ignore: flags.ignore,

package/dist/{usage-hMYVFsN5.js → usage-WYRc7Kqg.js}

@@ -6,8 +6,8 @@ import { c as jsonSchemaOf } from "./catalog-doc-DjMKzJp9.js";
 import { a as loadModule, n as asPolicy, s as pickNamed } from "./load-DjSU5KXO.js";
 import { r as runCollect } from "./collect-WCl8cJQV.js";
 import { t as beforeFirst } from "./text-BMFRfBqc.js";
-import { t as DOCS_BASE } from "./manifest-Cl6yHiVK.js";
-import { r as findingOf } from "./output-DpCUAST3.js";
+import { t as DOCS_BASE } from "./manifest-BWIR_EEB.js";
+import { r as findingOf } from "./output-3iB3_Hfg.js";
 import { existsSync, readFileSync, realpathSync } from "node:fs";
 import { dirname, resolve } from "node:path";
 import { fileURLToPath, pathToFileURL } from "node:url";

package/dist/{verify-CmTiQ-yM.js → verify-CHQgLrtS.js}

@@ -17,13 +17,13 @@ import { t as policyRowConditionKeys } from "./row-conditions-BAGHOmVq.js";
 import { s as writeFileEnsuringDir } from "./files-BSjrtIHw.js";
 import { c as jsonSchemaOf } from "./catalog-doc-DjMKzJp9.js";
 import { o as loadPolicyAt } from "./load-DjSU5KXO.js";
+import "./budget-BELja5A9.js";
 import { i as qualifySqlTable, n as defaultSqlCommand, t as SQL_IDENT } from "./sql-0WjxIp9g.js";
 import { a as scopeMembershipTable, i as scopeColumn } from "./compile-EzEMB-7v.js";
-import "./budget-BELja5A9.js";
 import "./sources-C4vkzZJV.js";
 import { t as beforeFirst } from "./text-BMFRfBqc.js";
-import { t as DOCS_BASE } from "./manifest-Cl6yHiVK.js";
-import { n as fixtureSubject, r as loadFixtures, t as fixtureRow } from "./fixtures-A1_sp_tR.js";
+import { t as DOCS_BASE } from "./manifest-BWIR_EEB.js";
+import { n as fixtureSubject, r as loadFixtures, t as fixtureRow } from "./fixtures-Bm4_K1ke.js";
 import { A as quoteQualified, N as arrayColumnsOf, O as quoteIdent, P as columnTypesOf, _ as subjectClaimJsonSql, a as customRolesOn, j as quoteTable, k as quoteLiteral, r as HELPERS, v as subjectClaimSql } from "./shared-DrGLwM3s.js";
 import { C as accessSql, D as tokenScopeAllowsCall, S as requiresSql, ht as scopeTable, k as capabilityAccessSql, n as tableNameOf, o as graphPlan, q as apiKeyAllowsCall, r as tableNames } from "./tables-DimBcVWY.js";
 import { c as breakGlassKey, f as compileConditionSql, l as collectGrants, m as sqlFunctionNames, p as contextRefs, s as breakGlassHolder } from "./ownership-qqBuGJXr.js";

package/dist/watch-C44FtM79.js

@@ -0,0 +1 @@
+export { i as watchCollect } from "./watch-CTfSlIGD.js";

package/dist/{watch-Bpci3hBY.js → watch-CTfSlIGD.js}

@@ -2,7 +2,7 @@ import { i as dateAt } from "./time-nR1JesoH.js";
 import { a as describeError } from "./errors-Vpu6rKHl.js";
 import { t as defaultSrcPath } from "./files-BSjrtIHw.js";
 import { r as runCollect } from "./collect-WCl8cJQV.js";
-import { n as isConfigFile, r as loadConfig } from "./config-BR23fL8m.js";
+import { n as isConfigFile, r as loadConfig } from "./config-ZZdtyQZy.js";
 import { watch } from "node:fs";
 import { basename, dirname, relative, resolve, sep } from "node:path";
 //#region src/cli/watch.ts

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "permdock",
-  "version": "0.13.0",
+  "version": "0.14.0",
   "description": "Typed permissions for TypeScript apps, APIs, databases, and AI agents, with the permdock CLI and test runners.",
   "keywords": [
     "ai-agents",
@@ -320,7 +320,7 @@
     "oxc-parser": "0.154.0"
   },
   "devDependencies": {
-    "@anthropic-ai/claude-agent-sdk": "0.3.301",
+    "@anthropic-ai/claude-agent-sdk": "0.3.303",
     "@arethetypeswrong/cli": "0.18.5",
     "@babel/core": "8.0.7",
     "@clack/prompts": "1.8.1",
@@ -330,9 +330,9 @@
     "@nestjs/core": "12.1.3",
     "@nestjs/platform-express": "12.1.3",
     "@openai/agents": "0.20.0",
-    "@orpc/contract": "2.0.0-beta.42",
-    "@orpc/openapi": "2.0.0-beta.42",
-    "@orpc/server": "2.0.0-beta.42",
+    "@orpc/contract": "2.0.0-beta.44",
+    "@orpc/openapi": "2.0.0-beta.44",
+    "@orpc/server": "2.0.0-beta.44",
     "@permdock/ox-config": "0.0.0",
     "@permdock/typescript-config": "0.0.0",
     "@solidjs/start": "2.0.6",
@@ -340,35 +340,35 @@
     "@supabase/supabase-js": "2.118.0",
     "@sveltejs/kit": "3.1.0",
     "@sveltejs/vite-plugin-svelte": "7.3.1",
-    "@tanstack/react-start": "1.169.2",
+    "@tanstack/react-start": "1.169.3",
     "@trpc/server": "11.19.0",
     "@types/express": "5.0.6",
-    "@types/node": "24.19.2",
+    "@types/node": "26.6.5",
     "@types/pg": "8.23.1",
     "@types/react": "19.3.0",
     "@types/react-dom": "19.3.0",
     "@vercel/detect-agent": "1.2.5",
     "@vitest/coverage-v8": "5.0.5",
-    "ai": "7.0.141",
+    "ai": "7.0.143",
     "ajv": "8.20.0",
     "astro": "7.4.0",
     "babel-plugin-react-compiler": "1.0.0",
-    "better-supabase": "0.18.0",
-    "better-supabase-floor": "npm:better-supabase@0.13.0",
+    "better-supabase": "0.29.0",
+    "better-supabase-floor": "npm:better-supabase@0.29.0",
     "chat": "4.42.0",
     "diff": "9.0.0",
     "drizzle-orm": "1.0.0-rc.5-5935859",
     "elysia": "1.4.30",
-    "eve": "0.79.2",
+    "eve": "0.80.1",
     "express": "5.3.0",
     "fastest-levenshtein": "1.0.16",
     "fastify": "5.12.7",
-    "h3": "2.0.2",
+    "h3": "2.0.5",
     "happy-dom": "21.0.4",
     "hono": "4.13.13",
     "jose": "6.2.12",
-    "kysely": "0.29.6",
-    "next": "16.4.1",
+    "kysely": "0.29.7",
+    "next": "16.4.2",
     "oxlint": "1.89.0",
     "oxlint-tsgolint": "7.0.2004",
     "package-manager-detector": "1.9.0",
@@ -378,7 +378,7 @@
     "react": "19.3.1",
     "react-dom": "19.3.1",
     "reflect-metadata": "0.2.2",
-    "resend": "6.33.0",
+    "resend": "6.34.1",
     "rxjs": "7.8.2",
     "smol-toml": "1.9.1",
     "solid-js": "1.9.17",
@@ -411,7 +411,7 @@
     "@trpc/server": ">=11",
     "ai": ">=5",
     "astro": ">=5",
-    "better-supabase": ">=0.13.0",
+    "better-supabase": ">=0.29.0",
     "chat": ">=4",
     "drizzle-orm": ">=0.40 || >=1.0.0-rc.0",
     "elysia": ">=1",

package/skills/permdock-credentials/references/tokens-keys-links.md

@@ -125,7 +125,7 @@ const subject = await subjectFromCapability(token, {
 - The result is a `kind: 'link'` principal with one `{ on, roles, via: 'link' }` membership. It never holds a scope or global role.
 - `linkPolicy` returns the tenant's `LinkPolicy` (`maxLifetime`, `redeemers`, `once`). Passing the same policy to `signCapability` refuses to mint a link the resolver would refuse.
 - Never an unguessable id without expiry, and never a security-definer RPC that reads the guest page's rows.
-- The one exception is resolving a stored link. When links live in better-supabase's share-links block, its `resolve_share_link` is `security definer` and reads only the link table. `subjectFromShareLink(token, { shareLinks, links, ttl })` from `permdock/better-supabase` turns the row into the same link subject. The page's rows are then read through `exchangeCapability` and RLS, as for a signed link. `links` maps each subject type (`subject.type` from better-supabase 0.14, `subjectType` before it) to a resource and maps the row's role to PermDock roles. An unmapped type or role, and a revoked or expired row, are anonymous. A link pinned to a version is refused, because a capability reads the current rows; read it through better-supabase's `versions.getShared(token)`. See [row-backed links](https://permdock.com/docs/concepts/capabilities#row-backed-links).
+- The one exception is resolving a stored link. When links live in better-supabase's share-links block, its `resolve_share_link` is `security definer` and reads only the link table. `subjectFromShareLink(token, { shareLinks, links, ttl })` from `permdock/better-supabase` turns the row into the same link subject. The page's rows are then read through `exchangeCapability` and RLS, as for a signed link. `links` maps each subject type (the row's `subject.type`) to a resource and maps the row's role to PermDock roles. An unmapped type or role, and a revoked or expired row, are anonymous. A link pinned to a version is refused, because a capability reads the current rows; read it through better-supabase's `versions.getShared(token)`. See [row-backed links](https://permdock.com/docs/concepts/capabilities#row-backed-links).
 
 With Supabase, let RLS serve the link through an exchange, never the link token itself:
 

package/skills/permdock-wire/references/adapters.md

@@ -501,7 +501,7 @@ const subject = subjectFromSupabase(claims, {
 
 Write the claims with `permdock supabase hook generate`; `permdock supabase inspect --out` writes the manifest (helper names, tenant claim, budget, claims written) that `authorizationProvider` from `permdock/better-supabase` turns into better-supabase's `authorization` config. No `@supabase/supabase-js` peer. Pair with `permdock rls generate`, or keep SQL as authority and run `permdock rls verify --db-url-stdin` against `sqlFunction` twins ([database-first](https://permdock.com/docs/adapters/rls)); the generic RLS workflow is in the `permdock-data` skill.
 
-With better-supabase, set `auth.authorization: authorizationProvider({ manifest, catalog })` in `better-supabase.config.ts` (top-level `authorization` before 0.15) (with `rls.customRoles` its `canAssign` and `canAssignFor` call `permdock_can_assign_any` and its `_for` form, so custom roles are assignable through better-supabase; regenerate the manifest after turning custom roles on), pass `authorizer({ policy })` to the server (`createNext`, `createHono`, `createMcp`) so every `permission` a resource, action, route guard or tool declares is decided by PermDock from the verified claims (`operations` maps tables for `permissions: true`; a missing or anonymous claim denies), build bucket and topic `access` policies with `bucketPolicy` and `topicPolicy`, and map its session with `subjectFromBetterSupabase(session)` (all from `permdock/better-supabase`): the active tenant's `features` become `principal.plans`. Pass `plans: { keys }` when better-supabase's `entitlements.claim.keys` shortens feature keys, and `apiKeys: { permissions, manifest }` so an `apiKey` session maps to the key's credential subject instead of the anonymous one. For `createMcp` tools, put the permission in `meta` and spread `toolPolicy({ permdock })` into the options: tools without one are hidden and refused, and approval-required calls are refused because `createMcp` collects no approvals. Wrap a `CredentialProvider` with `credentialGuard(provider, { permdock, use, revoke? })` so PermDock decides each token use. `authorizationProvider({ ..., approver })` lets holders of that permission approve AI tool calls, never their own. `approvers: { 'ai-tool': holder(p), 'support-session': ..., 'invoice.send': ... }` fills `isApprover` through `permdock_is_approver` (needs `rls.approvals`); only `user()`, `holder()` and `anyOf()` approvers, and a kind it does not name has no approver. `accessReviewApplier({ client, reviews, policy, demoteTo?, email?, permdockFor? })` applies a review's revoked items: `update_member_role` to the `demoteTo` role when that role lacks the permission, else `remove_member`, plus `revoke_invitation` for the member's matching invitations, then `markApplied`; pass the reviewer's client so the blocks' own checks run. better-supabase's `createAgentRuntime({ toolApproval })` takes `toolApproval` from `permdock/ai-sdk` as it is. Validate its claims with `betterSupabase.claims(supabaseClaims().extend(appSchema))` (`supabaseClaims` from `permdock/supabase`, any Standard Schema as `appSchema`) instead of a hand-written copy of the claim shape. A `supabase.hook.claims` function that needs the user's organizations calls `<schema>.member_organization_ids_for(user_id)` (generated by `rls generate`, executable by `supabase_auth_admin` only) instead of querying the membership tables itself. With a scope named `team` or `teams`, `authorizationProvider` fills better-supabase's `teamIdsOf` with `<schema>.member_team_ids_of(user)`, which answers only for the caller, so with `blocks.permissions.model: 'provider'` (`blocks.access` before 0.15) better-supabase's `team_ids_of()` and team-sharing policies read PermDock's memberships. A token Supabase's OAuth server issued to a third-party app (`client_id`) becomes an `oauth-client` actor limited to its `scope`; `deny(permission, { to: actor('oauth-client') })` keeps such apps out, in the app and, through `rls generate`, in Postgres. A better-supabase support session (`act.kind: 'support'`) is actor kind `support` with `sessionId` and `readOnly`, and `actingAs` (`act.kind: 'impersonation'`) is kind `impersonation`; neither has a delegation, so they reach nothing until a policy delegation names `actor('support')` or `actor('impersonation')`, and `readOnly: true` (also when `read_only` is absent) narrows that to read-only permissions. Generated RLS reads memberships, not `act`, so a support token sent to the Data API writes as the user: add a restrictive `for update` (and `insert` / `delete`) policy per writable table that requires `act ->> 'read_only' = 'false'` when `act` is a support or session level ([support access](https://permdock.com/docs/guides/support-access)). With `rls.anonymousSignIns: 'deny'`, pass `anonymousSignIns: 'deny'` to the subject mapper too (doctor PD057). Check a deployed database against the generated policies with `permdock rls verify --introspect`.
+With better-supabase, set `auth.authorization: authorizationProvider({ manifest, catalog })` in `better-supabase.config.ts` (with `rls.customRoles` its `canAssign` and `canAssignFor` call `permdock_can_assign_any` and its `_for` form, so custom roles are assignable through better-supabase; regenerate the manifest after turning custom roles on), pass `authorizer({ policy })` to the server (`createNext`, `createHono`, `createMcp`) so every `permission` a resource, action, route guard or tool declares is decided by PermDock from the verified claims (`operations` maps tables for `permissions: true`; a missing or anonymous claim denies), build bucket and topic `access` policies with `bucketPolicy` and `topicPolicy`, and map its session with `subjectFromBetterSupabase(session)` (all from `permdock/better-supabase`): the active tenant's `features` become `principal.plans`. Pass `plans: { keys }` when better-supabase's `entitlements.claim.keys` shortens feature keys, and `apiKeys: { permissions, manifest }` so an `apiKey` session maps to the key's credential subject instead of the anonymous one. For `createMcp` tools, put the permission in `meta` and spread `toolPolicy({ permdock })` into the options: tools without one are hidden and refused, and approval-required calls are refused because `createMcp` collects no approvals. Wrap a `CredentialProvider` with `credentialGuard(provider, { permdock, use, revoke? })` so PermDock decides each token use. `authorizationProvider({ ..., approver })` lets holders of that permission approve AI tool calls, never their own. `approvers: { 'ai-tool': holder(p), 'support-session': ..., 'invoice.send': ... }` fills `isApprover` through `permdock_is_approver` (needs `rls.approvals`); only `user()`, `holder()` and `anyOf()` approvers, and a kind it does not name has no approver. `accessReviewApplier({ client, reviews, policy, demoteTo?, email?, permdockFor? })` applies a review's revoked items: `update_member_role` to the `demoteTo` role when that role lacks the permission, else `remove_member`, plus `revoke_invitation` for the member's matching invitations, then `markApplied`; pass the reviewer's client so the blocks' own checks run. better-supabase's `createAgentRuntime({ toolApproval })` takes `toolApproval` from `permdock/ai-sdk` as it is. Validate its claims with `betterSupabase.claims(supabaseClaims().extend(appSchema))` (`supabaseClaims` from `permdock/supabase`, any Standard Schema as `appSchema`) instead of a hand-written copy of the claim shape. A `supabase.hook.claims` function that needs the user's organizations calls `<schema>.member_organization_ids_for(user_id)` (generated by `rls generate`, executable by `supabase_auth_admin` only) instead of querying the membership tables itself. With a scope named `team` or `teams`, `authorizationProvider` fills better-supabase's `teamIdsOf` with `<schema>.member_team_ids_of(user)`, which answers only for the caller, so with `blocks.permissions.model: 'provider'` better-supabase's `team_ids_of()` and team-sharing policies read PermDock's memberships. A token Supabase's OAuth server issued to a third-party app (`client_id`) becomes an `oauth-client` actor limited to its `scope`; `deny(permission, { to: actor('oauth-client') })` keeps such apps out, in the app and, through `rls generate`, in Postgres. A better-supabase support session (`act.kind: 'support'`) is actor kind `support` with `sessionId` and `readOnly`, and `actingAs` (`act.kind: 'impersonation'`) is kind `impersonation`; neither has a delegation, so they reach nothing until a policy delegation names `actor('support')` or `actor('impersonation')`, and `readOnly: true` (also when `read_only` is absent) narrows that to read-only permissions. Generated RLS reads memberships, not `act`, so a support token sent to the Data API writes as the user: add a restrictive `for update` (and `insert` / `delete`) policy per writable table that requires `act ->> 'read_only' = 'false'` when `act` is a support or session level ([support access](https://permdock.com/docs/guides/support-access)). With `rls.anonymousSignIns: 'deny'`, pass `anonymousSignIns: 'deny'` to the subject mapper too (doctor PD057). Check a deployed database against the generated policies with `permdock rls verify --introspect`.
 
 The other better-supabase slots, all from `permdock/better-supabase` ([better-supabase](https://permdock.com/docs/adapters/better-supabase)): `hookCan(permdock)` and `handlerCan({ getPermDock })` are the `can` options of `authorizeHook` and `protectWebHandler` in `better-supabase/workflow-sdk`; they decide with no row unless the `data` option loads one (`hookCan(permdock, { data: (tenant, key) => row })`, `handlerCan(source, { data: (request, key) => row })`), so without it a permission with a row condition denies, and `handlerCan` answers `undefined` (401) without a signed-in principal. `supportPolicy({ policy, options?, writable?, approval?, approved? })` is the `authorize` option of `supportSessions`; it decides each start with `decideSupportSession` as the admin, and an `approval-required` start passes only once `approved(input, pending)` returns `{ approvedBy }` for an approver other than the admin. `subscriberPolicy({ policy, principals, events, row?, sender? })` filters outbox, webhook or realtime subscribers to those who may read the event (exact type, then the longest `prefix.*`, then `*`; a type with no entry reaches no one). `principalSource({ claims, identities? })` is a `PrincipalSource` over the claims better-supabase mints, for `decideFor`, `subscribersFor` and delivery; only links the app created through a signed-in flow or a verified address go in `identities`. `authorizationHooks({ policy, claims, service?, principals?, events?, approvers?, support?, tickets? })` is the `authorization` option of `createServer`: it answers automation publish and run-as, delegated OAuth scopes, `approverOf`, identities, delivery audiences, support sessions and run tickets from the claims better-supabase mints now, never from the request.
 

package/dist/powersync-CObULVRk.js

@@ -1 +0,0 @@
-export { n as runPowerSync } from "./powersync-BTLk8GSl.js";

package/dist/pull-3OQCgxUf.js

@@ -1 +0,0 @@
-export { n as runCloudPull } from "./pull-iVPQZsnI.js";

package/dist/run-BqW8S5TM.js

@@ -1 +0,0 @@
-export { t as run } from "./run-CjFdAzqE.js";

package/dist/supabase-hook-CWvEpdCh.js

@@ -1 +0,0 @@
-export { i as runSupabase } from "./supabase-hook-CyuD9Wau.js";

package/dist/usage-BDiTP763.js

@@ -1 +0,0 @@
-export { t as runUsage } from "./usage-hMYVFsN5.js";

package/dist/watch-COuvly20.js

@@ -1 +0,0 @@
-export { i as watchCollect } from "./watch-Bpci3hBY.js";

package/dist/{core-DzVINFbU.js → core-lxoANyai.js}

@@ -5,8 +5,8 @@ import { y as membershipsClaim } from "./evaluate-BAmf_AQd.js";
 import { n as parseSnapshot } from "./snapshot-CXlzi69u.js";
 import { n as fromSnapshot } from "./from-snapshot-DCakWRsr.js";
 import { t as getPermDock } from "./permdock-BvjivVb9.js";
-import { c as quoteSqlTable, n as defaultSqlCommand, o as quoteSqlIdent, t as SQL_IDENT } from "./sql-0WjxIp9g.js";
 import "./budget-BELja5A9.js";
+import { c as quoteSqlTable, n as defaultSqlCommand, o as quoteSqlIdent, t as SQL_IDENT } from "./sql-0WjxIp9g.js";
 //#region src/testing/policy-matrix.ts
 function isOutcomeCell(value) {
 	return value === "granted" || value === "denied" || value === "approval-required" || value !== null && typeof value === "object" && ("denials" in value || "outcome" in value || "alternatives" in value || "obligations" in value || "deniedBy" in value);

package/dist/{supabase-CC6rIri4.js → supabase-CDHMsDD0.js}

@@ -5,8 +5,8 @@ import { s as ApprovalError } from "./types-CcUXciSj.js";
 import { c as decodeApprovalCursor, l as encodeApprovalCursor, s as approvalPageSize, t as applyApprovalVerdict } from "./store-RNFvaJJv.js";
 import { a as parseCapability } from "./capability-BqX94r07.js";
 import { t as loadJose } from "./load-jose-DZ4dnjri.js";
-import { a as quoteQualifiedTable, c as quoteSqlTable, d as sqlTextArray, i as qualifySqlTable, o as quoteSqlIdent, s as quoteSqlLiteral } from "./sql-0WjxIp9g.js";
 import "./budget-BELja5A9.js";
+import { a as quoteQualifiedTable, c as quoteSqlTable, d as sqlTextArray, i as qualifySqlTable, o as quoteSqlIdent, s as quoteSqlLiteral } from "./sql-0WjxIp9g.js";
 import { d as keptKeys, l as roleColumn } from "./sources-C4vkzZJV.js";
 import { t as callRpc } from "./postgrest-DAxFltvO.js";
 //#region src/supabase/capability.ts