permdock 0.13.0 → 0.15.0

package/dist/mcp/index.js

@@ -12,7 +12,7 @@ import { l as problemResponse, o as methodNotAllowed, r as bearerChallenge, u as
 import { t as clientNameOf } from "../clients-DYr3U86j.js";
 import { r as mapClaimsToSubject } from "../map-claims-C-nv08_n.js";
 import { r as instanceOptions } from "../build-instance-BWXqwQYU.js";
-import { i as refusalText, n as createAgentKernel } from "../kernel-qv4cr9w8.js";
+import { i as refusalText, n as createAgentKernel } from "../kernel-BD8QuMnv.js";
 import { t as boundedMap } from "../lru-8q4WZjBV.js";
 import { t as delegationFrom } from "../delegation-input-FTxMK3ji.js";
 import { n as deniedToolRefusal, r as toolErrorResult, t as approvalToolRefusal } from "../tool-refusal-Qpjs_W6M.js";
@@ -211,6 +211,27 @@ function stepUpRefusal(stepUpAt, decision, permission, data, context, capabiliti
 	});
 }
 //#endregion
+//#region src/mcp/report.ts
+/**
+* Sends `error` to the `onError` sink. The check still refuses; a sink that
+* throws is ignored (invariant 1).
+*/
+function report(sink, error, context) {
+	if (sink === void 0) return;
+	try {
+		sink(error, context);
+	} catch {}
+}
+/** The call's tenant for an error report; `null` when it has none or throws. */
+async function reportedTenant(tenant, authInfo) {
+	if (typeof tenant !== "function") return tenant ?? null;
+	try {
+		return await tenant(authInfo ?? {}) ?? null;
+	} catch {
+		return null;
+	}
+}
+//#endregion
 //#region src/mcp/call-check.ts
 function reachOf(policy, permission, declared) {
 	return declared === void 0 ? {
@@ -252,10 +273,11 @@ function credentialRefusal(checks, permission, reach, authInfo) {
 * The completion re-check of a long-running tool: the call must still be
 * allowed, or approved with the same token.
 */
-async function recheck(checks, binding, args, call, permission, approved, tool) {
+async function recheck(checks, binding, args, call, permission, approved, tool, onError) {
 	const rechecked = await checks.kernel.check(binding, args, call, compact({
 		simulate: true,
-		tool
+		tool,
+		onError
 	}));
 	if (!rechecked.ok) return {
 		ok: false,
@@ -271,7 +293,32 @@ async function recheck(checks, binding, args, call, permission, approved, tool)
 		} : plainRefusal(permission, `Denied: ${permission.key} was revoked before the call completed.`, {})
 	};
 }
-async function decideCall(checks, permission, reach, args, load, context, handlerContext, capabilities, completion, tool) {
+/**
+* Sends the errors a check collected to the `onError` sink, after the check, so
+* the tenant resolves only when there is something to report.
+*/
+async function flush(checks, authInfo, errors, permission, name) {
+	if (errors.length === 0 || checks.onError === void 0) return;
+	const tenant = await reportedTenant(checks.options.tenant, authInfo);
+	for (const error of errors) report(checks.onError, error, {
+		permission,
+		name,
+		tenant
+	});
+}
+async function decideCall(checks, permission, reach, args, load, context, handlerContext, capabilities, completion, tool, name = tool ?? permission.key) {
+	const authInfo = context.http?.authInfo;
+	const errors = [];
+	const onError = (error) => {
+		errors.push(error);
+	};
+	try {
+		return await decided(checks, permission, reach, args, load, context, handlerContext, capabilities, completion, tool, onError);
+	} finally {
+		await flush(checks, authInfo, errors, permission.key, name);
+	}
+}
+async function decided(checks, permission, reach, args, load, context, handlerContext, capabilities, completion, tool, onError) {
 	const authInfo = context.http?.authInfo;
 	const refused = credentialRefusal(checks, permission, reach, authInfo);
 	if (refused !== void 0) return {
@@ -283,10 +330,11 @@ async function decideCall(checks, permission, reach, args, load, context, handle
 		data: load === void 0 ? void 0 : () => load()
 	});
 	const call = compact({ authInfo });
-	if (completion !== void 0) return recheck(checks, binding, args, call, permission, completion.approved, tool);
+	if (completion !== void 0) return recheck(checks, binding, args, call, permission, completion.approved, tool, onError);
 	const checked = await checks.kernel.check(binding, args, call, compact({
 		resumeToken: approvalTokenOf(context),
-		tool
+		tool,
+		onError
 	}));
 	if (!checked.ok) return {
 		ok: false,
@@ -316,7 +364,8 @@ async function decideCall(checks, permission, reach, args, load, context, handle
 					inputRequired: await approvalInput(checks.options, decision, handlerContext, context, capabilities)
 				})
 			};
-		} catch {
+		} catch (error) {
+			onError(error);
 			return {
 				ok: false,
 				refusal: failedRefusal(permission, "failed")
@@ -326,8 +375,8 @@ async function decideCall(checks, permission, reach, args, load, context, handle
 	}
 }
 /** `decideCall` with the refusal text replaced by `deniedText`'s. */
-async function checkCall(checks, permission, reach, args, load, context, handlerContext, capabilities, completion, tool) {
-	const checked = await decideCall(checks, permission, reach, args, load, context, handlerContext, capabilities, completion, tool);
+async function checkCall(checks, permission, reach, args, load, context, handlerContext, capabilities, completion, tool, name = tool ?? permission.key) {
+	const checked = await decideCall(checks, permission, reach, args, load, context, handlerContext, capabilities, completion, tool, name);
 	const { deniedText } = checks.options;
 	if (checked.ok || deniedText === void 0) return checked;
 	const { refusal } = checked;
@@ -366,7 +415,15 @@ async function visible(checks, context, permissionOf, keys, declaredOf = () => v
 	let permdock;
 	try {
 		permdock = await checks.kernel.instance(compact({ authInfo }));
-	} catch {
+	} catch (error) {
+		if (checks.onError !== void 0) {
+			const tenant = await reportedTenant(checks.options.tenant, authInfo);
+			for (const entry of guarded) report(checks.onError, error, {
+				permission: entry.permission.key,
+				name: entry.key,
+				tenant
+			});
+		}
 		return shown;
 	}
 	for (const entry of guarded) if ((!tools || actorMayCallTool(permdock.subject.actor, entry.key)) && permdock.mayUse(entry.permission)) shown.add(entry.key);
@@ -381,12 +438,13 @@ function guard(checks, permission, load, handler, dataArgs, onRefusal, extra = {
 		const loader = load === void 0 ? void 0 : () => load(...args);
 		const reach = extra.reach ?? reachOf(checks.policy, permission, void 0);
 		const tool = extra.tool?.();
-		const checked = await checkCall(checks, permission, reach, args, loader, context, raw, extra.capabilities, void 0, tool);
+		const name = extra.name?.() ?? tool ?? permission.key;
+		const checked = await checkCall(checks, permission, reach, args, loader, context, raw, extra.capabilities, void 0, tool, name);
 		let result;
 		if (checked.ok) {
 			result = await handler(...params);
 			if (extra.longRunning === true) {
-				const again = await checkCall(checks, permission, reach, args, loader, context, raw, extra.capabilities, { approved: checked.approved }, tool);
+				const again = await checkCall(checks, permission, reach, args, loader, context, raw, extra.capabilities, { approved: checked.approved }, tool, name);
 				if (!again.ok) result = onRefusal(again.refusal);
 			}
 		} else result = onRefusal(checked.refusal);
@@ -496,7 +554,8 @@ function protectServer(checks, server, enforcement) {
 		longRunning,
 		capabilities,
 		reach,
-		tool
+		tool,
+		name: tool
 	});
 	const originalTool = server.registerTool.bind(server);
 	const toolPermissionOf = (name, config) => {
@@ -555,7 +614,10 @@ function protectServer(checks, server, enforcement) {
 		const permission = requirePermission("prompt", name, config);
 		const { permission: _permission, data, scopeChallenge, ...passthrough } = config;
 		const load = data;
-		const wrap = (callback) => guard(checks, permission, load, callback, (params) => params.length >= 2 ? [params[0]] : [void 0], throwRefusal, { capabilities });
+		const wrap = (callback) => guard(checks, permission, load, callback, (params) => params.length >= 2 ? [params[0]] : [void 0], throwRefusal, {
+			capabilities,
+			name: () => name
+		});
 		const registered = originalPrompt(name, {
 			...passthrough,
 			scopeChallenge: challengeFor(scopeChallenge, scopesReaching(checks.policy, permission), challengeScope(checks.policy, permission))
@@ -578,7 +640,10 @@ function protectServer(checks, server, enforcement) {
 		const wrap = (callback) => (...params) => {
 			const permission = permissionNow();
 			if (permission === void 0) return Promise.reject(/* @__PURE__ */ new Error(`Denied: resource ${name} is linked to no guarded tool.`));
-			return guard(checks, permission, load, callback, (args) => args.slice(0, -1), throwRefusal, { capabilities })(...params);
+			return guard(checks, permission, load, callback, (args) => args.slice(0, -1), throwRefusal, {
+				capabilities,
+				name: () => name
+			})(...params);
 		};
 		const registered = originalResource(name, uriOrTemplate, {
 			...passthrough,
@@ -680,7 +745,13 @@ function createPermDock(policy, given) {
 			...instanceOptions(options)
 		}))
 	};
-	return { protectServer: ((server, enforcement) => protectServer(checks, server, enforcement)) };
+	return { protectServer: ((server, enforcement, onError) => {
+		const sink = typeof enforcement === "function" ? enforcement : onError;
+		return protectServer(sink === void 0 ? checks : {
+			...checks,
+			onError: sink
+		}, server, typeof enforcement === "function" ? void 0 : enforcement);
+	}) };
 }
 //#endregion
 //#region src/mcp/resource-guard.ts

package/dist/next/plugin.js

@@ -1,5 +1,5 @@
 import { a as describeError } from "../errors-Vpu6rKHl.js";
-import { n as createCollectScheduler, r as report, t as collectOnce } from "../watch-Bpci3hBY.js";
+import { n as createCollectScheduler, r as report, t as collectOnce } from "../watch-DAkjm75Y.js";
 //#region src/cli/plugin.ts
 const PHASE_BUILD = "phase-production-build";
 const PHASE_DEV = "phase-development-server";

package/dist/openai/index.js

@@ -1,7 +1,7 @@
 import { t as compact } from "../compact-CAf557ZB.js";
 import { l as withApp } from "../permdock-BvjivVb9.js";
-import { t as approvalTokenOf } from "../kernel-qv4cr9w8.js";
-import { t as agentRuntime } from "../create-6EwRQlig.js";
+import { t as approvalTokenOf } from "../kernel-BD8QuMnv.js";
+import { t as agentRuntime } from "../create-Coq5fIrq.js";
 //#region src/openai/create.ts
 function appContext(runContext) {
 	const context = runContext?.context;

package/dist/{openapi-D8JQtO8k.js → openapi-CleDZYVf.js}

@@ -7,7 +7,7 @@ import { a as loadModule, n as asPolicy, s as pickNamed, t as asPermissionTree }
 import { t as shortDiff } from "./text-diff-BtfSmdUo.js";
 import { c as openapiVersion, o as createPermDock } from "./openapi-BOsx0xn9.js";
 import { i as fileDrift } from "./output-files-BIQ_9pIs.js";
-import { n as validateOverlay, t as validateOpenapi } from "./schema-CeQZY6bO.js";
+import { n as validateOverlay, t as validateOpenapi } from "./schema-BDGEVO4g.js";
 import { existsSync } from "node:fs";
 import { resolve } from "node:path";
 //#region src/cli/openapi/openapi.ts

package/dist/{openapi-BFyBIe9J.js → openapi-eHZ5hwUJ.js}

@@ -80,7 +80,7 @@ const emit = defineLeaf({
 		}
 	},
 	async run(ctx, { flags }) {
-		return (await import("./openapi-D8JQtO8k.js")).runOpenapi({
+		return (await import("./openapi-CleDZYVf.js")).runOpenapi({
 			cwd: ctx.cwd,
 			config: ctx.config,
 			rest: ["emit"],
@@ -122,7 +122,7 @@ const importDocument = defineLeaf({
 	async run(ctx, { flags }) {
 		const doc = given(flags.doc);
 		if (doc === void 0) throw missingInput("openapi import", ["--doc"], "the OpenAPI document to import");
-		return (await import("./import-PP7uH8rC.js")).runOpenapiImport({
+		return (await import("./import-DK_J8tVE.js")).runOpenapiImport({
 			cwd: ctx.cwd,
 			doc,
 			out: fileOut("openapi import", flags.out),

package/dist/{output-DpCUAST3.js → output-BVZpQDad.js}

@@ -1,5 +1,5 @@
 import { s as cliVersion } from "./version-DMQ0dnN5.js";
-import { t as DOCS_BASE } from "./manifest-Cl6yHiVK.js";
+import { t as DOCS_BASE } from "./manifest-CbEyvPN2.js";
 //#region src/cli/core/output.ts
 const CLI_RESULT_SCHEMA = "https://permdock.com/schemas/cli-result-v1.json";
 function envelope(input) {

package/dist/{powersync-Bm3ZjHwD.js → powersync-CFWILHjb.js}

@@ -14,7 +14,7 @@ const generate = defineLeaf({
 	async run(ctx, { flags }) {
 		const out = fileOut("powersync", flags.out);
 		const from = given(flags.policy);
-		const { runPowerSync } = await import("./powersync-CObULVRk.js");
+		const { runPowerSync } = await import("./powersync-CnGzxvEl.js");
 		return runPowerSync({
 			cwd: ctx.cwd,
 			config: ctx.config,
@@ -45,7 +45,7 @@ const verify = defineLeaf({
 		const db = await dbUrl(ctx, flags, { required: true });
 		const fixtures = given(flags.fixtures);
 		const from = given(flags.policy);
-		const { runPowerSync } = await import("./powersync-CObULVRk.js");
+		const { runPowerSync } = await import("./powersync-CnGzxvEl.js");
 		return runPowerSync({
 			cwd: ctx.cwd,
 			config: ctx.config,

package/dist/powersync-CnGzxvEl.js

@@ -0,0 +1 @@
+export { n as runPowerSync } from "./powersync-uqYWxTjq.js";

package/dist/{powersync-BTLk8GSl.js → powersync-uqYWxTjq.js}

@@ -1,4 +1,4 @@
-import { t as compact } from "./compact-CAf557ZB.js";
+import { r as isRecord, t as compact } from "./compact-CAf557ZB.js";
 import { c as isConditionDate, l as isConditionRef, o as hasConditionOp } from "./refs-C8BKxc_e.js";
 import { g as localSnapshotManifest, j as memoryCustomRoleSource } from "./src-C_pi2Rnh.js";
 import { n as findPermission } from "./permission-registry-B8tYxPIt.js";
@@ -10,16 +10,16 @@ import { u as usageResult } from "./errors-Vpu6rKHl.js";
 import { c as requirePolicy } from "./load-DjSU5KXO.js";
 import { s as quoteSqlLiteral, t as SQL_IDENT } from "./sql-0WjxIp9g.js";
 import { a as scopeMembershipTable, i as scopeColumn } from "./compile-EzEMB-7v.js";
-import "./sources-C4vkzZJV.js";
+import { d as keptKeys } from "./sources-C4vkzZJV.js";
 import { t as applyFiles } from "./files-B3AA05f1.js";
 import { i as fileDrift } from "./output-files-BIQ_9pIs.js";
-import { n as fixtureSubject, r as loadFixtures, t as fixtureRow } from "./fixtures-A1_sp_tR.js";
-import { O as quoteIdent, a as customRolesOn, t as CUSTOM_ROLES } from "./shared-DrGLwM3s.js";
-import { r as tableNames } from "./tables-DimBcVWY.js";
+import { n as fixtureSubject, r as loadFixtures, t as fixtureRow } from "./fixtures-Bm4_K1ke.js";
+import { A as quoteQualified, O as quoteIdent, a as customRolesOn, t as CUSTOM_ROLES } from "./shared-DrGLwM3s.js";
+import { n as tableNameOf, r as tableNames } from "./tables-DimBcVWY.js";
 import { d as andConditions, l as collectGrants, o as assignableRoles, p as contextRefs, t as ownershipRules, u as roleNames } from "./ownership-qqBuGJXr.js";
 import { t as membershipSourcesOf } from "./sources-qoIJQrJv.js";
 import { n as pgConnector } from "./pg-DQTqRrou.js";
-import { m as tableFor, t as canFixture } from "./verify-CmTiQ-yM.js";
+import { m as tableFor, t as canFixture } from "./verify-CgIpJRcG.js";
 import { resolve } from "node:path";
 //#region src/cli/powersync/names.ts
 function ident(name) {
@@ -89,7 +89,6 @@ function streamOf(source) {
 	const { stream } = source.sql;
 	if (stream === void 0) return `the ${source.sql.table} membership source has no stream form: build it with tableMembershipSource, junctionMembershipSource or blockMembershipSource`;
 	if (stream.expiresAt !== void 0) return `the ${stream.table} membership source has no stream: it has an expiry`;
-	if (stream.disabledAt !== void 0) return `the ${stream.table} membership source has no stream: it has disabledAt`;
 	return stream;
 }
 function pairOf(through) {
@@ -111,22 +110,32 @@ function anyOf(clauses) {
 }
 /**
 * The user's own rows of the source, of scope `scope` when the source has a
-* scope column.
+* scope column. `keep` drops the suspension filter: the grant keeps a suspended
+* membership.
 */
-function ownRows(stream, dialect, scope) {
+function ownRows(stream, dialect, scope, keep = false) {
 	const table = bare(stream.table, dialect);
 	const scoped = scope !== void 0 && "column" in stream.scope ? [`${dialect.column(table, stream.scope.column)} = ${dialect.literal(scope)}`] : [];
+	const suspended = !keep && stream.disabledAt !== void 0 ? [`${dialect.column(table, stream.disabledAt)} IS NULL`] : [];
 	if (typeof stream.user === "string") return {
 		table,
 		from: fromTable(stream.table, dialect),
-		where: [`${dialect.column(table, stream.user)} = ${dialect.user}`, ...scoped]
+		where: [
+			`${dialect.column(table, stream.user)} = ${dialect.user}`,
+			...scoped,
+			...suspended
+		]
 	};
 	const users = bare(stream.user.through, dialect);
 	const [ref, id] = pairOf(stream.user);
 	return {
 		table,
 		from: `${fromTable(stream.table, dialect)} INNER JOIN ${fromTable(stream.user.through, dialect)} ON ${dialect.column(users, id)} = ${dialect.column(table, ref)}`,
-		where: [`${dialect.column(users, stream.user.column)} = ${dialect.user}`, ...scoped]
+		where: [
+			`${dialect.column(users, stream.user.column)} = ${dialect.user}`,
+			...scoped,
+			...suspended
+		]
 	};
 }
 /**
@@ -170,9 +179,10 @@ function kindFilter(stream, role, table, ctx) {
 * One `IN (SELECT …)` per role source of the stream that can hold one of
 * `roles` in scope `scope`: the row's `left` is an instance the user holds it
 * in. A null role never equals a key, so a row without a role grants nothing.
+* `keep` drops the suspension filter of a membership the grant keeps.
 */
-function sourceIn(stream, scope, left, roles, ctx) {
-	const own = ownRows(stream, ctx.dialect, scope);
+function sourceIn(stream, scope, left, roles, ctx, keep = false) {
+	const own = ownRows(stream, ctx.dialect, scope, keep);
 	const select = (join, filters) => `${left} IN (SELECT ${ctx.dialect.column(own.table, stream.id)} FROM ${own.from}${join} WHERE ${[...own.where, ...filters].join(" AND ")})`;
 	const out = [];
 	for (const role of roles) {
@@ -193,9 +203,9 @@ function sourceIn(stream, scope, left, roles, ctx) {
 * The roles tables the source joins through, each with the query of the rows
 * the user's own rows reference.
 */
-function roleTableRows(stream, dialect) {
+function roleTableRows(stream, dialect, keep = false) {
 	if (isFixed(stream.roles)) return [];
-	const own = ownRows(stream, dialect);
+	const own = ownRows(stream, dialect, void 0, keep);
 	return roleSources(stream.roles).flatMap((source) => {
 		if (typeof source === "string" || "map" in source) return [];
 		const keys = bare(source.through, dialect);
@@ -341,7 +351,7 @@ function customRoleIn(ctx, root, left, key, level) {
 			continue;
 		}
 		if (isFixed(stream.roles)) continue;
-		const own = ownRows(stream, dialect, root);
+		const own = ownRows(stream, dialect, root, keptKeys(rls?.suspension?.memberships).includes(key));
 		const id = dialect.column(own.table, stream.id);
 		for (const role of roleSources(stream.roles)) {
 			const keyed = roleKeyOf(role, own.table, dialect);
@@ -518,7 +528,7 @@ const COMPARE = {
 * A row condition as alternatives of ANDed clauses over `table`. `undefined`
 * when part of it has no Sync Streams form, so the grant syncs nothing.
 */
-function conditionSql(condition, table, ctx) {
+function conditionSql(condition, table, ctx, permission) {
 	const column = (field) => SQL_IDENT.test(field) ? ctx.dialect.column(table, field) : void 0;
 	switch (condition.op) {
 		case "eq":
@@ -551,7 +561,7 @@ function conditionSql(condition, table, ctx) {
 		}
 		case "and":
 		case "or": {
-			const parts = every(condition.conditions.map((child) => conditionSql(child, table, ctx)));
+			const parts = every(condition.conditions.map((child) => conditionSql(child, table, ctx, permission)));
 			if (parts === void 0) return;
 			return condition.op === "and" ? product(parts) : parts.flat();
 		}
@@ -560,9 +570,9 @@ function conditionSql(condition, table, ctx) {
 			const scope = resolveScope(ctx.scopes, condition.scope);
 			const left = column(condition.field);
 			if (scope === void 0 || left === void 0) return;
-			return membershipSql(scope, left, condition.roles, ctx);
+			return membershipSql(scope, left, condition.roles, ctx, permission);
 		}
-		case "sqlFunction": return conditionSql(condition.twin, table, ctx);
+		case "sqlFunction": return conditionSql(condition.twin, table, ctx, permission);
 		case "related": return relatedSql(condition, table, ctx);
 		case "not":
 		case "contains":
@@ -632,7 +642,7 @@ function permittedSql(resource, key, ctx) {
 	}))];
 	const queries = /* @__PURE__ */ new Set();
 	for (const { item, access } of reaches) {
-		const where = typeof access === "string" || item.where === void 0 ? [[]] : conditionSql(item.where, table, ctx);
+		const where = typeof access === "string" || item.where === void 0 ? [[]] : conditionSql(item.where, table, ctx, item.grant.permission.key);
 		if (typeof access === "string" || where === void 0) {
 			ctx.gaps.push(`inherit() of ${key} leaves out ${item.label}: ${typeof access === "string" ? access : "its condition has no Sync Streams form"}`);
 			continue;
@@ -642,11 +652,20 @@ function permittedSql(resource, key, ctx) {
 	return queries.size === 0 && reaches.length > 0 ? void 0 : [...queries];
 }
 /**
+* Whether `permission` keeps a suspended membership: its key is in
+* `rls.suspension.memberships.keep`, so the stream drops the suspension
+* filter.
+*/
+function keepsSuspended(permission, ctx) {
+	return permission !== void 0 && keptKeys(ctx.config.rls?.suspension?.memberships).includes(permission);
+}
+/**
 * One `IN (SELECT …)` per role source of the membership table: the row's `left`
-* is an instance the user holds `roles` in.
+* is an instance the user holds `roles` in. `keep` drops the suspension
+* filter.
 */
-function membershipIn(table, idColumn, left, roles, ctx) {
-	if (table.expiresAt !== void 0 || table.disabledAt !== void 0) return;
+function membershipIn(table, idColumn, left, roles, ctx, keep = false) {
+	if (table.expiresAt !== void 0) return;
 	const name = bare(table.table, ctx.dialect);
 	const sources = Array.isArray(table.role) ? table.role : [table.role];
 	const kinds = [...new Set(roles.flatMap((role) => ctx.kinds[role] ?? []))];
@@ -654,7 +673,11 @@ function membershipIn(table, idColumn, left, roles, ctx) {
 	if (restricted && (table.via === void 0 || roles.length !== 1)) return;
 	const via = table.via;
 	if (restricted && typeof via === "object" && !kinds.includes(via.value)) return [];
-	const filters = [`${ctx.dialect.column(name, table.user)} = ${ctx.dialect.user}`, ...restricted && typeof via === "string" ? [`${ctx.dialect.column(name, via)} IN (${kinds.map((kind) => ctx.dialect.literal(kind)).join(", ")})`] : []];
+	const filters = [
+		`${ctx.dialect.column(name, table.user)} = ${ctx.dialect.user}`,
+		...restricted && typeof via === "string" ? [`${ctx.dialect.column(name, via)} IN (${kinds.map((kind) => ctx.dialect.literal(kind)).join(", ")})`] : [],
+		...!keep && table.disabledAt !== void 0 ? [`${ctx.dialect.column(name, table.disabledAt)} IS NULL`] : []
+	];
 	const list = roles.map((role) => ctx.dialect.literal(role)).join(", ");
 	return sources.map((source) => {
 		if (typeof source === "string") return [`${left} IN (SELECT ${ctx.dialect.column(name, idColumn)} FROM ${fromTable(table.table, ctx.dialect)} WHERE ${[...filters, `${ctx.dialect.column(name, source)} IN (${list})`].join(" AND ")})`];
@@ -673,11 +696,12 @@ function membershipIn(table, idColumn, left, roles, ctx) {
 * The membership filter of scope `scope`: its `rls.memberships` table, else the
 * union of its membership sources.
 */
-function membershipSql(scope, left, roles, ctx) {
+function membershipSql(scope, left, roles, ctx, permission) {
+	const keep = keepsSuspended(permission, ctx);
 	const table = scopeMembershipTable(ctx.config.rls?.memberships, ctx.scopes, scope);
 	if (table !== void 0) {
 		const idColumn = scopeColumn(table, ctx.scopes, scope);
-		return idColumn === void 0 ? void 0 : membershipIn(table, idColumn, left, roles, ctx);
+		return idColumn === void 0 ? void 0 : membershipIn(table, idColumn, left, roles, ctx, keep);
 	}
 	const sources = scopeSourcesOf(ctx.sources, scope);
 	if (sources.length === 0) return;
@@ -687,7 +711,7 @@ function membershipSql(scope, left, roles, ctx) {
 			ctx.gaps.push(stream);
 			return [];
 		}
-		return sourceIn(stream, scope, left, roles, ctx);
+		return sourceIn(stream, scope, left, roles, ctx, keep);
 	});
 }
 /**
@@ -703,14 +727,14 @@ function accessSql(item, table, ctx) {
 			if (access.scope === "global") return `global role ${access.role} is not a row filter`;
 			const field = ctx.policy.scopes.find((scope) => scope.name === access.scope)?.key;
 			if (field === void 0 || !SQL_IDENT.test(field)) return `scope ${access.scope} has no row key`;
-			return membershipSql(access.scope, ctx.dialect.column(table, field), [access.role], ctx) ?? `no rls.memberships table without an expiry or disabledAt and with the kinds of ${access.role}, and no membership source, for scope ${access.scope}`;
+			return membershipSql(access.scope, ctx.dialect.column(table, field), [access.role], ctx, item.grant.permission.key) ?? `no rls.memberships table without an expiry and with the kinds of ${access.role}, and no membership source, for scope ${access.scope}`;
 		}
 		case "resource": {
 			const holder = ctx.config.rls?.memberships?.resource?.[access.resource];
 			const node = ctx.policy.resources.get(item.grant.permission.resource);
 			const field = node?.name === access.resource ? node.id : node?.parent?.resource === access.resource ? node.parent.field : void 0;
 			if (holder === void 0 || field === void 0 || !SQL_IDENT.test(field)) return `no rls.memberships.resource table for ${access.resource} on the row`;
-			return membershipIn(holder, holder.id ?? "id", ctx.dialect.column(table, field), [access.role], ctx) ?? `the ${access.resource} memberships table has an expiry or disabledAt, or lacks via`;
+			return membershipIn(holder, holder.id ?? "id", ctx.dialect.column(table, field), [access.role], ctx, keepsSuspended(item.grant.permission.key, ctx)) ?? `the ${access.resource} memberships table has an expiry, or lacks via`;
 		}
 		case "actor": return "actor grantees are not in the sync token";
 		default: return access;
@@ -740,12 +764,13 @@ function userTenantIds(ctx) {
 	if (tenants !== void 0) {
 		const column = scopeColumn(tenants, ctx.scopes, root);
 		const members = bare(tenants.table, dialect);
-		return column === void 0 ? [] : [`SELECT ${dialect.column(members, column)} FROM ${fromTable(tenants.table, dialect)} WHERE ${dialect.column(members, tenants.user)} = ${dialect.user}`];
+		const active = tenants.disabledAt !== void 0 && keptKeys(ctx.config.rls?.suspension?.memberships).length === 0 ? ` AND ${dialect.column(members, tenants.disabledAt)} IS NULL` : "";
+		return column === void 0 ? [] : [`SELECT ${dialect.column(members, column)} FROM ${fromTable(tenants.table, dialect)} WHERE ${dialect.column(members, tenants.user)} = ${dialect.user}${active}`];
 	}
 	return scopeSourcesOf(ctx.sources, root).flatMap((source) => {
 		const stream = streamOf(source);
 		if (typeof stream === "string") return [];
-		const rows = ownRows(stream, dialect, root);
+		const rows = ownRows(stream, dialect, root, keptKeys(ctx.config.rls?.suspension?.memberships).length > 0);
 		return [`SELECT ${dialect.column(rows.table, stream.id)} FROM ${rows.from} WHERE ${rows.where.join(" AND ")}`];
 	});
 }
@@ -781,9 +806,10 @@ function subjectStreams(ctx) {
 		entry.queries.add(query);
 		tables.set(table, entry);
 	};
-	const own = (table, user, role) => {
+	const own = (table, user, role, disabledAt) => {
 		const name = bare(table, dialect);
-		const mine = `${dialect.column(name, user)} = ${dialect.user}`;
+		const active = disabledAt !== void 0 && keptKeys(rls?.suspension?.memberships).length === 0 ? ` AND ${dialect.column(name, disabledAt)} IS NULL` : "";
+		const mine = `${dialect.column(name, user)} = ${dialect.user}${active}`;
 		add(name, `SELECT * FROM ${fromTable(table, dialect)} WHERE ${mine}`, user);
 		for (const through of roleThroughs(role)) {
 			const keys = bare(through.through, dialect);
@@ -794,15 +820,16 @@ function subjectStreams(ctx) {
 		}
 	};
 	const memberships = rls?.memberships;
-	for (const table of [...Object.values(memberships?.scopes ?? {}), ...Object.values(memberships?.resource ?? {})]) own(table.table, table.user, table.role);
+	for (const table of [...Object.values(memberships?.scopes ?? {}), ...Object.values(memberships?.resource ?? {})]) own(table.table, table.user, table.role, table.disabledAt);
 	for (const stream of unmappedStreams(ctx)) {
-		const rows = ownRows(stream, dialect);
+		const keep = keptKeys(rls?.suspension?.memberships).length > 0;
+		const rows = ownRows(stream, dialect, void 0, keep);
 		add(rows.table, typeof stream.user === "string" ? `SELECT * FROM ${rows.from} WHERE ${rows.where.join(" AND ")}` : `SELECT ${rows.table}.* FROM ${rows.from} WHERE ${rows.where.join(" AND ")}`, typeof stream.user === "string" ? stream.user : void 0);
 		if (typeof stream.user !== "string") {
 			const users = bare(stream.user.through, dialect);
 			add(users, `SELECT * FROM ${fromTable(stream.user.through, dialect)} WHERE ${dialect.column(users, stream.user.column)} = ${dialect.user}`, stream.user.column);
 		}
-		for (const keys of roleTableRows(stream, dialect)) add(keys.table, keys.query);
+		for (const keys of roleTableRows(stream, dialect, keep)) add(keys.table, keys.query);
 	}
 	const schema = rls?.schema ?? "permdock";
 	const database = rls?.authorize === "database";
@@ -931,7 +958,7 @@ function planWith(policy, config, dialect) {
 		const queries = /* @__PURE__ */ new Set();
 		const compile = (label, gap, item, reach) => {
 			const access = unsupported(item) ?? reach();
-			const where = typeof access === "string" || item.where === void 0 ? [[]] : conditionSql(item.where, table, ctx);
+			const where = typeof access === "string" || item.where === void 0 ? [[]] : conditionSql(item.where, table, ctx, item.grant.permission.key);
 			const gaps = [...new Set(ctx.gaps.splice(0))];
 			for (const reason of gaps) warnings.push(`${label} under-syncs: ${reason}`);
 			if (typeof access === "string") warnings.push(`${label} does not sync: ${access}`);
@@ -1007,6 +1034,53 @@ function planWith(policy, config, dialect) {
 	};
 }
 //#endregion
+//#region src/cli/powersync/verify-followed.ts
+/** Check a non-resource row against its own-user rule or readable parents. */
+async function verifyFollowedRow(input) {
+	const { fixture, config, policy, mismatches } = input;
+	const label = `${fixture.table} for ${fixture.subject.id}`;
+	const spec = config.powersync?.tables?.[fixture.table];
+	const stream = input.plan.tables.find((item) => item.table === bare(fixture.table, {
+		...POSTGRES,
+		names: {
+			renamed: input.plan.devices,
+			seen: /* @__PURE__ */ new Set()
+		}
+	}));
+	if (spec === void 0 || stream === void 0 || !isRecord(fixture.row)) {
+		mismatches.push(`${label}: no configured table stream or invalid row`);
+		return;
+	}
+	const row = fixture.row;
+	let granted = spec.user !== void 0 && row[spec.user] === fixture.subject.id;
+	for (const follow of spec.follow ?? []) {
+		if (!Object.entries(follow.match ?? {}).every(([key, value]) => row[key] === value)) continue;
+		const permission = findPermission(policy.permissions, `${follow.resource}.${config.powersync?.action ?? "read"}`);
+		const resource = policy.resources.get(follow.resource);
+		const parentId = row[follow.field];
+		if (permission === void 0 || resource?.id === void 0 || typeof parentId !== "string" && typeof parentId !== "number") continue;
+		const parents = await input.query(`select * from ${quoteQualified(tableNameOf(config.rls?.tables?.[follow.resource], follow.resource))} where ${quoteIdent(resource.id)}::text = $1::text`, [String(parentId)]);
+		for (const parent of parents) {
+			const root = policy.scopes.find((scope) => scope.within === void 0)?.key;
+			const tenant = root !== void 0 && isRecord(parent) ? parent[root] : void 0;
+			const permdock = await getPermDock(policy, fixtureSubject({
+				...fixture.subject,
+				...typeof tenant === "string" ? { tenant } : {}
+			}), { customRoles: memoryCustomRoleSource(input.customRoles) });
+			granted ||= canFixture(permdock, permission, parent);
+		}
+	}
+	if (fixture.expected === "granted" !== granted) mismatches.push(`${label}: expected ${fixture.expected}, but parent access is ${granted ? "granted" : "denied"}`);
+	const holds = await input.synced({
+		...stream,
+		resource: fixture.table,
+		id: "id"
+	}, fixture);
+	if (holds === void 0) mismatches.push(`${label}: fixture row needs id`);
+	else if (holds && !granted) mismatches.push(`${label}: stream ${stream.name} syncs a row the policy denies`);
+	else if (!holds && granted) mismatches.push(`${label}: granted, but stream ${stream.name} does not sync the row`);
+}
+//#endregion
 //#region src/cli/powersync/verify-gaps.ts
 function heldRoles(subject) {
 	return /* @__PURE__ */ new Set([...subject.roles ?? [], ...(subject.memberships ?? []).flatMap((membership) => membership.roles)]);
@@ -1161,6 +1235,19 @@ async function verifyStreams(input) {
 			for (const stream of [...plan.subject, ...plan.tables]) if (stream.user !== void 0 && await leaks(query, stream, stream.user, fixture)) mismatches.push(`stream ${stream.name} syncs another user's ${stream.table} rows to ${fixture.subject.id}`);
 		}
 		for (const fixture of input.fixtures) {
+			if ("table" in fixture) {
+				await verifyFollowedRow({
+					policy: input.policy,
+					config: input.config,
+					customRoles: input.customRoles,
+					plan,
+					fixture,
+					query,
+					mismatches,
+					synced: (stream, row) => synced(query, stream, row)
+				});
+				continue;
+			}
 			const permission = findPermission(input.policy.permissions, fixture.action);
 			const stream = plan.streams.find((item) => permission !== void 0 && item.resource === permission.resource && permission.action === (input.config.powersync?.action ?? "read"));
 			if (permission === void 0 || stream === void 0) continue;
@@ -1241,7 +1328,7 @@ async function runPowerSync(input) {
 	const notes = [...warnings];
 	if (input.db !== void 0) try {
 		const fixturesPath = input.fixtures ?? input.config.rls?.fixtures ?? "rls.fixtures.json";
-		const { fixtures, customRoles } = await loadFixtures(input.cwd, fixturesPath);
+		const { fixtures, customRoles } = await loadFixtures(input.cwd, fixturesPath, true);
 		const database = await verifyStreams({
 			policy,
 			config: input.config,

package/dist/{pull-iVPQZsnI.js → pull-BBmCxnqX.js}

@@ -7,7 +7,7 @@ import { o as formatCatalogJson } from "./catalog-doc-DjMKzJp9.js";
 import { t as catalogPath } from "./catalog-path-CnI0XTFK.js";
 import { n as parseSupabaseManifest } from "./manifest-BXTbHNIV.js";
 import { t as parseCatalog } from "./parse-1_ZheTW5.js";
-import { a as nonEmptyOr } from "./output-DpCUAST3.js";
+import { a as nonEmptyOr } from "./output-BVZpQDad.js";
 import { t as POLICY_NOT_PUBLISHED } from "./problem-types-DSsRfONQ.js";
 import { n as httpRequest, t as authFailure } from "./http-DOL33cO0.js";
 import { l as cloudUrl, n as cliRuntime, o as readAuth } from "./auth--yPyZNgr.js";

package/dist/pull-D6dloyrc.js

@@ -0,0 +1 @@
+export { n as runCloudPull } from "./pull-BBmCxnqX.js";