permdock 0.13.0 → 0.15.0

package/dist/react-native/index.d.ts

@@ -115,15 +115,28 @@ type PowerSyncSourceOptions<Q extends string> = {
   readonly read?: undefined;
 };
 /**
- * A `localSnapshot` source over a PowerSync database: `get` runs every query
- * with `db.getAll`, and a `db.watch` per query reports changes. Without
- * `queries` and `read`, it reads the tables `manifest.rows` names: the
- * memberships of every source with null roles dropped, the global roles and the
- * custom roles with their levels. A watch result with unchanged content
- * re-renders nothing (`connectSource`). The source takes the database as an
- * argument; `permdock/react-native` never imports `@powersync/*`.
+ * A `localSnapshot` source over a PowerSync database: `get` initially runs
+ * every query with `db.getAll`; watch-triggered reads refresh only fired
+ * queries. Without `queries` and `read`, it reads the tables `manifest.rows`
+ * names: the memberships of every source with null roles dropped, the global
+ * roles and the custom roles with their levels. A watch result with unchanged
+ * content re-renders nothing (`connectSource`). The source takes the database
+ * as an argument; `permdock/react-native` never imports `@powersync/*`.
  */
 export declare function powerSyncSource<Q extends string>(db: PowerSyncWatchable, options: PowerSyncSourceOptions<Q>): SnapshotSource;
+/** `powerSyncSource` over one database, memoised per manifest and options. */
+type PowerSyncSourceCache = {
+  readonly source: <Q extends string>(options: PowerSyncSourceOptions<Q>) => SnapshotSource;
+};
+/**
+ * A cache of `powerSyncSource` sources over `db`. `source` answers the same
+ * source for the same `manifest` object and, with `user`, the same `user`,
+ * `tenant` and `attributes` content, or, with `queries`, the same `queries` and
+ * `read` objects. A render that rebuilds its options then keeps the source, so
+ * `PermDockProvider` neither resubscribes nor rereads. Entries live as long as
+ * their manifest; create one cache per database, outside render.
+ */
+export declare function powerSyncSourceCache(db: PowerSyncWatchable): PowerSyncSourceCache;
 //#endregion
 //#region src/react-native/provider.d.ts
 export declare function PermDockProvider(props: ReactNativePermDockProviderProps): ReactElement;
@@ -209,4 +222,4 @@ type NativeStoreOptions = Omit<ReactNativePermDockProviderProps, "children" | "h
 export declare function connectSource(store: ClientStore, source: SnapshotSource, subscribeForeground?: SubscribeForeground): () => void;
 export declare function nativeStore(options: NativeStoreOptions): ClientStore;
 //#endregion
-export { type ActionResult, type AppStateModule, type ApprovalHandle, type ApprovalState, type ClientPermDock, type ClientStatus, type EventSourceRefreshOptions, type FilterResult, type GateMode, type GateView, type LocalMembershipRows, type LocalRowColumn, type LocalRowValue, type LocalSnapshotData, type LocalSnapshotManifest, type LocalSnapshotOptions, type LocalSnapshotRows, type MmkvInstance, type NativeRevalidate, type NetInfoModule, type PermDockDefaults, type PermissionSet, type PermissionState, type PowerSyncQuery, type PowerSyncSourceOptions, type PowerSyncWatchable, Protected, type ProtectedAction, type ProtectedActionHandle, type ProtectedActionView, type ProtectedProps, type ReactNativePermDockProviderProps, type RefreshTrigger, type RolesOptions, type SecureStoreModule, type SnapshotSource, type SnapshotStorage, type SubjectView, type SubscribeForeground, type SubscribeOnline, type TenantView, approvalHeaders, describe, eventSourceRefresh, parseLocalSnapshotManifest, requiredPlans, useApproval, useAssignablePermissions, useAssignableRoles, useDescribe, useFilter, useGate, useMemberships, usePermDock, usePermission, usePermissions, useProtectedAction, useRoles, useSubject, useTenant };
+export { type ActionResult, type AppStateModule, type ApprovalHandle, type ApprovalState, type ClientPermDock, type ClientStatus, type EventSourceRefreshOptions, type FilterResult, type GateMode, type GateView, type LocalMembershipRows, type LocalRowColumn, type LocalRowValue, type LocalSnapshotData, type LocalSnapshotManifest, type LocalSnapshotOptions, type LocalSnapshotRows, type MmkvInstance, type NativeRevalidate, type NetInfoModule, type PermDockDefaults, type PermissionSet, type PermissionState, type PowerSyncQuery, type PowerSyncSourceCache, type PowerSyncSourceOptions, type PowerSyncWatchable, Protected, type ProtectedAction, type ProtectedActionHandle, type ProtectedActionView, type ProtectedProps, type ReactNativePermDockProviderProps, type RefreshTrigger, type RolesOptions, type SecureStoreModule, type SnapshotSource, type SnapshotStorage, type SubjectView, type SubscribeForeground, type SubscribeOnline, type TenantView, approvalHeaders, describe, eventSourceRefresh, parseLocalSnapshotManifest, requiredPlans, useApproval, useAssignablePermissions, useAssignableRoles, useDescribe, useFilter, useGate, useMemberships, usePermDock, usePermission, usePermissions, useProtectedAction, useRoles, useSubject, useTenant };

package/dist/react-native/index.js

@@ -535,32 +535,118 @@ function planOf(options) {
 	};
 }
 /**
-* A `localSnapshot` source over a PowerSync database: `get` runs every query
-* with `db.getAll`, and a `db.watch` per query reports changes. Without
-* `queries` and `read`, it reads the tables `manifest.rows` names: the
-* memberships of every source with null roles dropped, the global roles and the
-* custom roles with their levels. A watch result with unchanged content
-* re-renders nothing (`connectSource`). The source takes the database as an
-* argument; `permdock/react-native` never imports `@powersync/*`.
+* A `localSnapshot` source over a PowerSync database: `get` initially runs
+* every query with `db.getAll`; watch-triggered reads refresh only fired
+* queries. Without `queries` and `read`, it reads the tables `manifest.rows`
+* names: the memberships of every source with null roles dropped, the global
+* roles and the custom roles with their levels. A watch result with unchanged
+* content re-renders nothing (`connectSource`). The source takes the database
+* as an argument; `permdock/react-native` never imports `@powersync/*`.
 */
 function powerSyncSource(db, options) {
 	const plan = planOf(options);
-	return localSnapshot({
-		manifest: options.manifest,
-		read: async () => {
-			const results = await Promise.all(Object.entries(plan.queries).map(async ([name, query]) => {
-				return [name, await db.getAll(query.sql, [...query.parameters ?? []])];
-			}));
-			return plan.read(Object.fromEntries(results));
+	const queries = Object.entries(plan.queries);
+	const rows = /* @__PURE__ */ new Map();
+	const dirty = /* @__PURE__ */ new Set();
+	const listeners = /* @__PURE__ */ new Set();
+	let scheduled = false;
+	let pending;
+	let snapshot;
+	let content;
+	const invalidate = (name) => {
+		dirty.add(name);
+		if (scheduled) return;
+		scheduled = true;
+		queueMicrotask(() => {
+			scheduled = false;
+			for (const listener of listeners) listener();
+		});
+	};
+	const read = async () => {
+		if (dirty.size === 0) for (const [name] of queries) dirty.add(name);
+		do {
+			const selected = queries.filter(([name]) => dirty.has(name) || !rows.has(name));
+			for (const [name] of selected) dirty.delete(name);
+			try {
+				const results = await Promise.all(selected.map(async ([name, query]) => [name, await db.getAll(query.sql, [...query.parameters ?? []])]));
+				for (const [name, result] of results) rows.set(name, result);
+			} catch (error) {
+				for (const [name] of selected) dirty.add(name);
+				throw error;
+			}
+		} while (dirty.size > 0);
+		const data = plan.read(Object.fromEntries(rows));
+		const next = JSON.stringify([data, data.principal?.memberships?.map((membership) => isMembershipExpired(membership))]);
+		if (snapshot === void 0 || next !== content) {
+			snapshot = buildLocalSnapshot(options.manifest, data);
+			content = next;
+		}
+		return snapshot;
+	};
+	return {
+		get: () => {
+			pending ??= read().finally(() => {
+				pending = void 0;
+			});
+			return pending;
 		},
 		subscribe: (listener) => {
+			listeners.add(listener);
 			const controller = new AbortController();
-			for (const query of Object.values(plan.queries)) db.watch(query.sql, [...query.parameters ?? []], { onResult: listener }, { signal: controller.signal });
+			for (const [name, query] of queries) db.watch(query.sql, [...query.parameters ?? []], { onResult: () => {
+				invalidate(name);
+			} }, { signal: controller.signal });
 			return () => {
+				listeners.delete(listener);
 				controller.abort();
 			};
 		}
-	});
+	};
+}
+/**
+* A cache of `powerSyncSource` sources over `db`. `source` answers the same
+* source for the same `manifest` object and, with `user`, the same `user`,
+* `tenant` and `attributes` content, or, with `queries`, the same `queries` and
+* `read` objects. A render that rebuilds its options then keeps the source, so
+* `PermDockProvider` neither resubscribes nor rereads. Entries live as long as
+* their manifest; create one cache per database, outside render.
+*/
+function powerSyncSourceCache(db) {
+	const byManifest = /* @__PURE__ */ new WeakMap();
+	return Object.freeze({ source: (options) => {
+		let entries = byManifest.get(options.manifest);
+		if (entries === void 0) {
+			entries = {
+				rows: /* @__PURE__ */ new Map(),
+				custom: /* @__PURE__ */ new WeakMap()
+			};
+			byManifest.set(options.manifest, entries);
+		}
+		if ("user" in options) {
+			const key = JSON.stringify([
+				options.user,
+				options.tenant ?? null,
+				options.attributes ?? null
+			]);
+			let source = entries.rows.get(key);
+			if (source === void 0) {
+				source = powerSyncSource(db, options);
+				entries.rows.set(key, source);
+			}
+			return source;
+		}
+		let byRead = entries.custom.get(options.queries);
+		if (byRead === void 0) {
+			byRead = /* @__PURE__ */ new WeakMap();
+			entries.custom.set(options.queries, byRead);
+		}
+		let source = byRead.get(options.read);
+		if (source === void 0) {
+			source = powerSyncSource(db, options);
+			byRead.set(options.read, source);
+		}
+		return source;
+	} });
 }
 //#endregion
 //#region src/react-native/storage.ts
@@ -1040,4 +1126,4 @@ function netInfoOnline(netInfo) {
 	});
 }
 //#endregion
-export { PermDockProvider, Protected, appStateForeground, approvalHeaders, buildLocalSnapshot, connectSource, describe, eventSourceRefresh, localSnapshot, memorySnapshotStorage, mmkvStorage, nativeStore, netInfoOnline, parseLocalSnapshotManifest, powerSyncSource, requiredPlans, secureStoreStorage, useApproval, useAssignablePermissions, useAssignableRoles, useDescribe, useFilter, useGate, useMemberships, usePermDock, usePermission, usePermissionGuard, usePermissions, useProtectedAction, useRoles, useSnapshotReady, useSubject, useTenant };
+export { PermDockProvider, Protected, appStateForeground, approvalHeaders, buildLocalSnapshot, connectSource, describe, eventSourceRefresh, localSnapshot, memorySnapshotStorage, mmkvStorage, nativeStore, netInfoOnline, parseLocalSnapshotManifest, powerSyncSource, powerSyncSourceCache, requiredPlans, secureStoreStorage, useApproval, useAssignablePermissions, useAssignableRoles, useDescribe, useFilter, useGate, useMemberships, usePermDock, usePermission, usePermissionGuard, usePermissions, useProtectedAction, useRoles, useSnapshotReady, useSubject, useTenant };

package/dist/{rls-BItB4vkC.js → rls-BwKXdVEW.js}

@@ -11,13 +11,13 @@ import "./sources-C4vkzZJV.js";
 import { t as policyFromCatalog } from "./policy-from-catalog-CU3An8uP.js";
 import { t as beforeFirst } from "./text-BMFRfBqc.js";
 import { i as INDEXES_MARKER, n as GRANTS_MARKER, o as SEEDS_MARKER, t as BACKFILL_MARKER } from "./markers-BeHZ4x9Q.js";
-import { a as nonEmptyOr } from "./output-DpCUAST3.js";
+import { a as nonEmptyOr } from "./output-BVZpQDad.js";
 import { i as requirePeer, n as packageManagerOf, t as addLine } from "./peer-Q0fuZ6hx.js";
 import { t as POLICY_NOT_PUBLISHED } from "./problem-types-DSsRfONQ.js";
-import { t as fetchProjectPolicy } from "./pull-iVPQZsnI.js";
+import { t as fetchProjectPolicy } from "./pull-BBmCxnqX.js";
 import { n as MIGRATION_DIRS } from "./constants-DcJABbLW.js";
 import { a as isSeedsDirectory, c as parseSplit, d as seedsMigration, f as writeOutputFiles, l as partPath, n as dataMigrationFile, r as driftOf, u as pgDeltaPath } from "./output-files-BIQ_9pIs.js";
-import { b as rbacScaffold, d as resolveSchemas, f as schemasRefusal, o as supabaseHookSql, p as declarativeSql, s as approvalsSql, t as grantsLabel, u as isSupabaseSchemas, y as parseRbacAuthorize } from "./supabase-hook-CyuD9Wau.js";
+import { b as rbacScaffold, d as resolveSchemas, f as schemasRefusal, o as supabaseHookSql, p as declarativeSql, s as approvalsSql, t as grantsLabel, u as isSupabaseSchemas, y as parseRbacAuthorize } from "./supabase-hook-HPgwYb9V.js";
 import { A as quoteQualified, D as qualified$1, I as scopeTypeOf, O as quoteIdent$1, _ as subjectClaimJsonSql, c as SESSION_LIVE_HELPER, g as sessionLiveHelperSql, j as quoteTable, k as quoteLiteral, r as HELPERS, t as CUSTOM_ROLES, y as subjectIdSql } from "./shared-DrGLwM3s.js";
 import { C as accessSql, G as byKey, T as seedSql, Z as graphHelper, ct as memberIdsHelper, ft as permittedIdsHelper, ht as scopeTable, mt as scopeSources, r as tableNames, s as graphSql, w as helpersSql, x as permittedByPermissionHelper, y as permissionHelpersSql } from "./tables-DimBcVWY.js";
 import { c as breakGlassKey, i as assignmentSql, l as collectGrants, n as ownershipSql, s as breakGlassHolder } from "./ownership-qqBuGJXr.js";
@@ -25,8 +25,8 @@ import { a as splitUndiffed } from "./deciding-columns-NB4wcyBf.js";
 import { t as connectPgPool } from "./pg-DQTqRrou.js";
 import { a as fieldViewsSql, c as ACTOR_MAY_WRITE, f as readOnlyActorKinds, i as fieldViews, l as actorMayWriteSql, n as columnGrantSql, o as rowBranches, p as readOnlyActorPolicies, r as columnRevokeSql, u as assemblePolicies } from "./fields-DI8s3cPl.js";
 import { n as permissionHoldersSql } from "./resolve-names-Y1Cb22cp.js";
-import { _ as indexTargets, a as verifyResult, b as readTableIndexFacts, c as callsHelper, g as INDEX_COLUMNS_SQL, h as COLUMNS_SQL, i as verifyIgnores, l as helperCallKeys, m as tableFor, n as runRlsVerify, o as HELPER_TABLES, p as compileGrants, r as rlsFinding, v as indexesSql, y as pruneIndexTargets } from "./verify-CmTiQ-yM.js";
-import { a as buildContext, c as levelKeys, d as rebuildPlan, i as splitsPart, l as rowHelpersSql, n as generateOptions, o as CANDIDATES, r as isRefusal, s as inheritTargets, t as supautilsRejections, u as DROPPED_LIST } from "./supautils-PRhfO-bL.js";
+import { _ as indexTargets, a as verifyResult, b as readTableIndexFacts, c as callsHelper, g as INDEX_COLUMNS_SQL, h as COLUMNS_SQL, i as verifyIgnores, l as helperCallKeys, m as tableFor, n as runRlsVerify, o as HELPER_TABLES, p as compileGrants, r as rlsFinding, v as indexesSql, y as pruneIndexTargets } from "./verify-CgIpJRcG.js";
+import { a as buildContext, c as levelKeys, d as rebuildPlan, i as splitsPart, l as rowHelpersSql, n as generateOptions, o as CANDIDATES, r as isRefusal, s as inheritTargets, t as supautilsRejections, u as DROPPED_LIST } from "./supautils-CGk4YpvC.js";
 import { readFileSync } from "node:fs";
 import { basename, delimiter, join } from "node:path";
 import { spawn } from "node:child_process";

package/dist/{rls-C8nxX0RV.js → rls-yK2nZUcm.js}

@@ -192,7 +192,7 @@ async function rlsInput(ctx, verb, shape, options) {
 	};
 }
 async function runRls(input) {
-	return (await import("./rls-BItB4vkC.js")).runRls(input);
+	return (await import("./rls-BwKXdVEW.js")).runRls(input);
 }
 const generate = defineLeaf({
 	flags: {

package/dist/{run-CjFdAzqE.js → run-D5WIJfs7.js}

@@ -1,13 +1,13 @@
 import { i as dateAt } from "./time-nR1JesoH.js";
 import { a as describeError, l as problemOf, n as CliError, r as cliProblem, s as kindOfCode } from "./errors-Vpu6rKHl.js";
 import { s as cliVersion } from "./version-DMQ0dnN5.js";
-import { a as resolveCwd, i as readConfig } from "./config-BR23fL8m.js";
+import { a as resolveCwd, i as readConfig } from "./config-CcLlvEYW.js";
 import { t as beforeFirst } from "./text-BMFRfBqc.js";
 import { a as suggestion, i as parseLeaf, n as flagSpellings, o as GLOBAL_FLAGS, r as parseFlags } from "./args-0FrVs5EH.js";
 import { r as progressReporter, t as redact } from "./credentials-CdDxp7jN.js";
-import { a as resolve, i as leaves, n as ROOT, r as SECTIONS, t as DOCS_BASE } from "./manifest-Cl6yHiVK.js";
+import { a as resolve, i as leaves, n as ROOT, r as SECTIONS, t as DOCS_BASE } from "./manifest-CbEyvPN2.js";
 import { t as createStyle } from "./style-Ds11Hmk4.js";
-import { i as githubAnnotations, n as envelope, o as sarifLog, t as dataOf } from "./output-DpCUAST3.js";
+import { i as githubAnnotations, n as envelope, o as sarifLog, t as dataOf } from "./output-BVZpQDad.js";
 import { i as renameMessage, r as flagRename, t as COMMAND_MOVES } from "./renames-CGj7YwcQ.js";
 import { stripVTControlCharacters } from "node:util";
 import { existsSync, statSync } from "node:fs";

package/dist/run-DlQYPtPv.js

@@ -0,0 +1 @@
+export { t as run } from "./run-D5WIJfs7.js";

package/dist/{scan-COIQvTMg.js → scan-CzdMtHnq.js}

@@ -16,7 +16,7 @@ const scan = defineLeaf({
 		}
 	},
 	async run(ctx, { flags }) {
-		const { runAdoptionScan } = await import("./adoption-scan-oks22j9J.js");
+		const { runAdoptionScan } = await import("./adoption-scan-DLel53Oa.js");
 		return runAdoptionScan({
 			cwd: ctx.cwd,
 			srcPath: flags.src.length > 0 ? flags.src : ctx.config.collect?.srcPath ?? ["src"],

package/dist/{schema-CeQZY6bO.js → schema-BDGEVO4g.js}

@@ -1,7 +1,7 @@
 import { r as isRecord } from "./compact-CAf557ZB.js";
 import { l as packageRoot } from "./version-DMQ0dnN5.js";
 import { t as DRAFT_PINS } from "./pins-nqarl3oE.js";
-import { a as nonEmptyOr } from "./output-DpCUAST3.js";
+import { a as nonEmptyOr } from "./output-BVZpQDad.js";
 import { t as require__2020 } from "./2020-CJbO8Bvz.js";
 import { readFileSync } from "node:fs";
 import { join } from "node:path";

package/dist/{skills-CfkYP7GG.js → skills-BIsm1n26.js}

@@ -1,7 +1,7 @@
 import { t as defineLeaf } from "./command-L8EstFNm.js";
 import { t as checkFlag } from "./flags-DXjoTVbS.js";
 import { r as pick, t as CANCELLED } from "./prompt-BYc6drYW.js";
-import { n as detectedAgents, r as runSkills, t as SKILL_AGENTS } from "./skills-5XWpNzCi.js";
+import { n as detectedAgents, r as runSkills, t as SKILL_AGENTS } from "./skills-BZxPQ_09.js";
 //#region src/cli/commands/skills.ts
 const forFlag = { for: {
 	type: "string",

package/dist/{skills-5XWpNzCi.js → skills-BZxPQ_09.js}

@@ -2,7 +2,7 @@ import { t as byCodePoint } from "./compare-DTfyUunF.js";
 import { i as readJsonFile } from "./files-BSjrtIHw.js";
 import { l as packageRoot } from "./version-DMQ0dnN5.js";
 import { t as didYouMean } from "./args-0FrVs5EH.js";
-import { a as nonEmptyOr } from "./output-DpCUAST3.js";
+import { a as nonEmptyOr } from "./output-BVZpQDad.js";
 import { cpSync, existsSync, lstatSync, mkdirSync, readFileSync, readdirSync, readlinkSync, realpathSync, writeFileSync } from "node:fs";
 import { basename, dirname, join, relative, resolve } from "node:path";
 import { pathToFileURL } from "node:url";

package/dist/supabase/index.js

@@ -1,5 +1,5 @@
-import { a as supabaseClaims, i as supabaseApprovalStore, n as supabaseRls, o as exchangeCapability, r as tableApprovalDelegationSource, t as authorizeSql } from "../supabase-CC6rIri4.js";
 import { n as supabaseTenantClaim, t as supabaseMembershipsBudget } from "../budget-BELja5A9.js";
+import { a as supabaseClaims, i as supabaseApprovalStore, n as supabaseRls, o as exchangeCapability, r as tableApprovalDelegationSource, t as authorizeSql } from "../supabase-CDHMsDD0.js";
 import { c as tableMembershipSource, i as authzVersion, o as junctionMembershipSource, s as supabasePostgresQuery, t as AUTHZ_VERSION_TABLE } from "../sources-C4vkzZJV.js";
 import { a as delegationOf, c as subjectFromSupabaseSession, i as actorOf, n as postgrestSources, r as readSubjectRecord, s as subjectFromSupabase } from "../postgrest-DAxFltvO.js";
 import { n as parseSupabaseManifest, t as hasTokenHook } from "../manifest-BXTbHNIV.js";

package/dist/{supabase-CBEK6KEo.js → supabase-DYWnT800.js}

@@ -47,7 +47,7 @@ const hookGenerate = defineLeaf({
 		const budget = given(flags.budget);
 		const schema = given(flags.schema);
 		const grantsOut = given(flags["grants-out"]);
-		const { runSupabase } = await import("./supabase-hook-CWvEpdCh.js");
+		const { runSupabase } = await import("./supabase-hook-qsewAVZY.js");
 		return runSupabase({
 			cwd: ctx.cwd,
 			config: ctx.config,
@@ -76,7 +76,7 @@ const inspect = defineLeaf({
 	},
 	async run(ctx, { flags }) {
 		const out = flags.out === "" ? true : flags.out === "-" ? void 0 : flags.out;
-		const { runSupabase } = await import("./supabase-hook-CWvEpdCh.js");
+		const { runSupabase } = await import("./supabase-hook-qsewAVZY.js");
 		return runSupabase({
 			cwd: ctx.cwd,
 			config: ctx.config,

package/dist/{supabase-hook-CyuD9Wau.js → supabase-hook-HPgwYb9V.js}

@@ -6,10 +6,10 @@ import { a as describeError, i as configError } from "./errors-Vpu6rKHl.js";
 import { i as readJsonFile, o as sqlFiles, s as writeFileEnsuringDir } from "./files-BSjrtIHw.js";
 import { a as SUPABASE_MANIFEST_SCHEMA } from "./version-DMQ0dnN5.js";
 import { c as requirePolicy } from "./load-DjSU5KXO.js";
+import "./budget-BELja5A9.js";
 import { i as qualifySqlTable } from "./sql-0WjxIp9g.js";
 import { i as scopeColumn } from "./compile-EzEMB-7v.js";
-import { t as authorizeSql } from "./supabase-CC6rIri4.js";
-import "./budget-BELja5A9.js";
+import { t as authorizeSql } from "./supabase-CDHMsDD0.js";
 import { a as hookApiNames, d as keptKeys, t as AUTHZ_VERSION_TABLE, u as roleManifest } from "./sources-C4vkzZJV.js";
 import { o as readMemberships } from "./postgrest-DAxFltvO.js";
 import { t as beforeFirst } from "./text-BMFRfBqc.js";

package/dist/supabase-hook-qsewAVZY.js

@@ -0,0 +1 @@
+export { i as runSupabase } from "./supabase-hook-HPgwYb9V.js";

package/dist/{supautils-PRhfO-bL.js → supautils-CGk4YpvC.js}

@@ -3,12 +3,12 @@ import { f as scopeList, s as resolveScope } from "./scopes-0Up_UA2t.js";
 import { o as flattenGrantee } from "./grantee-Dke-9rd1.js";
 import { l as policyLevels } from "./policy-CLQ8__GF.js";
 import { a as describeError, i as configError } from "./errors-Vpu6rKHl.js";
-import { d as sqlTextArray, i as qualifySqlTable } from "./sql-0WjxIp9g.js";
 import "./budget-BELja5A9.js";
+import { d as sqlTextArray, i as qualifySqlTable } from "./sql-0WjxIp9g.js";
 import { l as roleColumn } from "./sources-C4vkzZJV.js";
 import { t as beforeFirst } from "./text-BMFRfBqc.js";
 import { c as parseSplit } from "./output-files-BIQ_9pIs.js";
-import { x as resolveAuthorize } from "./supabase-hook-CyuD9Wau.js";
+import { x as resolveAuthorize } from "./supabase-hook-HPgwYb9V.js";
 import { A as quoteQualified, C as parseMembershipsFlag, D as qualified, F as firstScopeType, O as quoteIdent, R as tenantTypeOf, a as customRolesOn, j as quoteTable, k as quoteLiteral, s as signedIn, t as CUSTOM_ROLES } from "./shared-DrGLwM3s.js";
 import { G as byKey, H as rolesTableScope, O as tokenScopesPlan, Q as graphSqlName, V as raiseSql, W as byCodeUnit, Y as apiKeysPlan, a as closureDepths, bt as checkSuspension, i as tablelessResources, o as graphPlan, r as tableNames, t as resolveVias, z as currentKeyExpr } from "./tables-DimBcVWY.js";
 import { o as assignableRoles, r as unsatisfiedKinds, t as ownershipRules, u as roleNames } from "./ownership-qqBuGJXr.js";
@@ -16,7 +16,7 @@ import { t as membershipSourcesOf } from "./sources-qoIJQrJv.js";
 import { i as group, o as sqlStatements } from "./deciding-columns-NB4wcyBf.js";
 import { d as orSql, h as branchClauses } from "./fields-DI8s3cPl.js";
 import { t as resolveNames } from "./resolve-names-Y1Cb22cp.js";
-import { m as tableFor } from "./verify-CmTiQ-yM.js";
+import { m as tableFor } from "./verify-CgIpJRcG.js";
 //#region src/cli/rls/custom-role-rebuild.ts
 const PREFIX = "PermDock CLI";
 /** A column of the roles-table row `r`. */
@@ -199,8 +199,8 @@ const DROPPED_LIST = `(select string_agg(g.role || ': ' || g.items, '; ' order b
 * shared role holds is skipped with a warning (`name-taken`). Before-row
 * triggers hold a signed-in caller at trigger depth 1 to the checks of
 * `permdock_replace_custom_role_grants`: `permdock_custom_role_guard` on each
-* role the row names, then `permdock_custom_role_beyond` on the entry it adds;
-* a refusal aborts the write.
+* role the row names, the entry it adds against the ceiling, then
+* `permdock_custom_role_beyond` on that entry; a refusal aborts the write.
 */
 function customRoleSyncSql(ctx, from, migrate) {
 	const plan = rebuildPlan(ctx, from, migrate);
@@ -305,6 +305,17 @@ begin
     end if;
     v_dropped := '{}'::text[];
 ${plan.collectNew[name]}
+    if cardinality(v_dropped) > 0 then
+      raise exception using
+        errcode = '22023',
+        message = 'permdock: ' || v_dropped[1],
+        hint = case
+          when v_dropped[1] like '%outside the ceiling of %' then 'outside-ceiling'
+          when v_dropped[1] like '%, level % is not declared' then 'unknown-level'
+          when v_dropped[1] like '%, not a declared role' then 'unknown-role'
+          else 'unknown-permission'
+        end;
+    end if;
     select string_agg(b, ', ' order by b) into v_beyond
     from ${beyond}(v.tenant_id, v.scope, v.scope_id, v_allow, v_deny, v_include) b;
     if v_beyond is not null then

package/dist/testing/core.js

@@ -1 +1 @@
-export { r as policyMatrix, t as testOrmParity, n as testRlsParity } from "../core-DzVINFbU.js";
+export { r as policyMatrix, t as testOrmParity, n as testRlsParity } from "../core-lxoANyai.js";

package/dist/testing/fixtures/index.js

@@ -512,7 +512,7 @@ var better_supabase_manifest_default = {
 		"schema": "permdock",
 		"function": "custom_access_token_hook",
 		"out": "supabase/schemas/permdock/functions/custom_access_token_hook.sql",
-		"activeFrom": { "appMetadata": "active_organization" },
+		"activeFrom": { "appMetadata": "tenant_id" },
 		"schemas": "pg-delta"
 	},
 	helpers: {

package/dist/testing/index.js

@@ -27,16 +27,16 @@ import { c as problemFromDecision } from "../problem-BVLHFK33.js";
 import { o as resolveApproval } from "../helpers-DJicaG6f.js";
 import { t as APPROVAL_REQUEST_SCHEMA } from "../request-schema-DhX7UbfQ.js";
 import { t as catalogSchema } from "../schema-BOJjqlWL.js";
+import { t as supabaseMembershipsBudget } from "../budget-BELja5A9.js";
 import { c as parseApiKey } from "../server-3cVlTLde.js";
 import { n as discoverAuthorizationServer } from "../device-BwbJNmb2.js";
 import { t as CONNECTOR_SCHEMA } from "../connector-schema-CYLQNMYq.js";
 import { l as sha256Hex, n as scimHandler, t as directoryMembershipSource } from "../scim-jJBJ7g1Z.js";
 import { c as quoteSqlTable, o as quoteSqlIdent } from "../sql-0WjxIp9g.js";
 import { i as cloudEndpoints, n as cloud, s as approverHeaders, t as bearerChallenge } from "../challenge-DImNcR7B.js";
-import { t as supabaseMembershipsBudget } from "../budget-BELja5A9.js";
 import { t as supabaseManifestSchema } from "../manifest-schema-DQkBK2Mr.js";
 import { t as PUSHED_POLICY_SCHEMA } from "../pushed-policy-CDuOL2de.js";
-import { i as policyMatrixLayout, n as testRlsParity, r as policyMatrix, t as testOrmParity } from "../core-DzVINFbU.js";
+import { i as policyMatrixLayout, n as testRlsParity, r as policyMatrix, t as testOrmParity } from "../core-lxoANyai.js";
 import { i as saasPermissions } from "../permissions-CYcHj_w7.js";
 import { C as saasOrg, E as saasSeed, S as saasMemberships, a as saasProject, g as verifySaasSession, h as signSaasToken, k as saasPolicy, t as saasDoc, w as saasPrincipal, x as saasCustomRoles } from "../saas-DK4V-3Is.js";
 import { t as POLICY_NOT_PUBLISHED } from "../problem-types-DSsRfONQ.js";

package/dist/unplugin/index.js

@@ -1,4 +1,4 @@
-import { n as createCollectScheduler, r as report } from "../watch-Bpci3hBY.js";
+import { n as createCollectScheduler, r as report } from "../watch-DAkjm75Y.js";
 import { r as peerHint } from "../peer-Q0fuZ6hx.js";
 import { createRequire } from "node:module";
 //#region src/unplugin/index.ts

package/dist/usage-D3KJyaNS.js

@@ -0,0 +1 @@
+export { t as runUsage } from "./usage-e6M1Mls1.js";

package/dist/{usage-BfzSfOpD.js → usage-DBNrpwoT.js}

@@ -16,7 +16,7 @@ const usage = defineLeaf({
 		}
 	},
 	async run(ctx, { flags }) {
-		return (await import("./usage-BDiTP763.js")).runUsage({
+		return (await import("./usage-D3KJyaNS.js")).runUsage({
 			cwd: ctx.cwd,
 			config: ctx.config,
 			ignore: flags.ignore,

package/dist/{usage-hMYVFsN5.js → usage-e6M1Mls1.js}

@@ -6,8 +6,8 @@ import { c as jsonSchemaOf } from "./catalog-doc-DjMKzJp9.js";
 import { a as loadModule, n as asPolicy, s as pickNamed } from "./load-DjSU5KXO.js";
 import { r as runCollect } from "./collect-WCl8cJQV.js";
 import { t as beforeFirst } from "./text-BMFRfBqc.js";
-import { t as DOCS_BASE } from "./manifest-Cl6yHiVK.js";
-import { r as findingOf } from "./output-DpCUAST3.js";
+import { t as DOCS_BASE } from "./manifest-CbEyvPN2.js";
+import { r as findingOf } from "./output-BVZpQDad.js";
 import { existsSync, readFileSync, realpathSync } from "node:fs";
 import { dirname, resolve } from "node:path";
 import { fileURLToPath, pathToFileURL } from "node:url";

package/dist/{verify-CmTiQ-yM.js → verify-CgIpJRcG.js}

@@ -17,13 +17,13 @@ import { t as policyRowConditionKeys } from "./row-conditions-BAGHOmVq.js";
 import { s as writeFileEnsuringDir } from "./files-BSjrtIHw.js";
 import { c as jsonSchemaOf } from "./catalog-doc-DjMKzJp9.js";
 import { o as loadPolicyAt } from "./load-DjSU5KXO.js";
+import "./budget-BELja5A9.js";
 import { i as qualifySqlTable, n as defaultSqlCommand, t as SQL_IDENT } from "./sql-0WjxIp9g.js";
 import { a as scopeMembershipTable, i as scopeColumn } from "./compile-EzEMB-7v.js";
-import "./budget-BELja5A9.js";
 import "./sources-C4vkzZJV.js";
 import { t as beforeFirst } from "./text-BMFRfBqc.js";
-import { t as DOCS_BASE } from "./manifest-Cl6yHiVK.js";
-import { n as fixtureSubject, r as loadFixtures, t as fixtureRow } from "./fixtures-A1_sp_tR.js";
+import { t as DOCS_BASE } from "./manifest-CbEyvPN2.js";
+import { n as fixtureSubject, r as loadFixtures, t as fixtureRow } from "./fixtures-Bm4_K1ke.js";
 import { A as quoteQualified, N as arrayColumnsOf, O as quoteIdent, P as columnTypesOf, _ as subjectClaimJsonSql, a as customRolesOn, j as quoteTable, k as quoteLiteral, r as HELPERS, v as subjectClaimSql } from "./shared-DrGLwM3s.js";
 import { C as accessSql, D as tokenScopeAllowsCall, S as requiresSql, ht as scopeTable, k as capabilityAccessSql, n as tableNameOf, o as graphPlan, q as apiKeyAllowsCall, r as tableNames } from "./tables-DimBcVWY.js";
 import { c as breakGlassKey, f as compileConditionSql, l as collectGrants, m as sqlFunctionNames, p as contextRefs, s as breakGlassHolder } from "./ownership-qqBuGJXr.js";

package/dist/watch-CuPz0D2M.js

@@ -0,0 +1 @@
+export { i as watchCollect } from "./watch-DAkjm75Y.js";

package/dist/{watch-Bpci3hBY.js → watch-DAkjm75Y.js}

@@ -2,7 +2,7 @@ import { i as dateAt } from "./time-nR1JesoH.js";
 import { a as describeError } from "./errors-Vpu6rKHl.js";
 import { t as defaultSrcPath } from "./files-BSjrtIHw.js";
 import { r as runCollect } from "./collect-WCl8cJQV.js";
-import { n as isConfigFile, r as loadConfig } from "./config-BR23fL8m.js";
+import { n as isConfigFile, r as loadConfig } from "./config-CcLlvEYW.js";
 import { watch } from "node:fs";
 import { basename, dirname, relative, resolve, sep } from "node:path";
 //#region src/cli/watch.ts

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "permdock",
-  "version": "0.13.0",
+  "version": "0.15.0",
   "description": "Typed permissions for TypeScript apps, APIs, databases, and AI agents, with the permdock CLI and test runners.",
   "keywords": [
     "ai-agents",
@@ -320,7 +320,7 @@
     "oxc-parser": "0.154.0"
   },
   "devDependencies": {
-    "@anthropic-ai/claude-agent-sdk": "0.3.301",
+    "@anthropic-ai/claude-agent-sdk": "0.3.303",
     "@arethetypeswrong/cli": "0.18.5",
     "@babel/core": "8.0.7",
     "@clack/prompts": "1.8.1",
@@ -330,9 +330,9 @@
     "@nestjs/core": "12.1.3",
     "@nestjs/platform-express": "12.1.3",
     "@openai/agents": "0.20.0",
-    "@orpc/contract": "2.0.0-beta.42",
-    "@orpc/openapi": "2.0.0-beta.42",
-    "@orpc/server": "2.0.0-beta.42",
+    "@orpc/contract": "2.0.0-beta.44",
+    "@orpc/openapi": "2.0.0-beta.44",
+    "@orpc/server": "2.0.0-beta.44",
     "@permdock/ox-config": "0.0.0",
     "@permdock/typescript-config": "0.0.0",
     "@solidjs/start": "2.0.6",
@@ -340,35 +340,35 @@
     "@supabase/supabase-js": "2.118.0",
     "@sveltejs/kit": "3.1.0",
     "@sveltejs/vite-plugin-svelte": "7.3.1",
-    "@tanstack/react-start": "1.169.2",
+    "@tanstack/react-start": "1.169.3",
     "@trpc/server": "11.19.0",
     "@types/express": "5.0.6",
-    "@types/node": "24.19.2",
+    "@types/node": "26.6.5",
     "@types/pg": "8.23.1",
     "@types/react": "19.3.0",
     "@types/react-dom": "19.3.0",
     "@vercel/detect-agent": "1.2.5",
     "@vitest/coverage-v8": "5.0.5",
-    "ai": "7.0.141",
+    "ai": "7.0.143",
     "ajv": "8.20.0",
     "astro": "7.4.0",
     "babel-plugin-react-compiler": "1.0.0",
-    "better-supabase": "0.18.0",
-    "better-supabase-floor": "npm:better-supabase@0.13.0",
+    "better-supabase": "0.29.0",
+    "better-supabase-floor": "npm:better-supabase@0.29.0",
     "chat": "4.42.0",
     "diff": "9.0.0",
     "drizzle-orm": "1.0.0-rc.5-5935859",
     "elysia": "1.4.30",
-    "eve": "0.79.2",
+    "eve": "0.80.1",
     "express": "5.3.0",
     "fastest-levenshtein": "1.0.16",
     "fastify": "5.12.7",
-    "h3": "2.0.2",
+    "h3": "2.0.5",
     "happy-dom": "21.0.4",
     "hono": "4.13.13",
     "jose": "6.2.12",
-    "kysely": "0.29.6",
-    "next": "16.4.1",
+    "kysely": "0.29.7",
+    "next": "16.4.2",
     "oxlint": "1.89.0",
     "oxlint-tsgolint": "7.0.2004",
     "package-manager-detector": "1.9.0",
@@ -378,7 +378,7 @@
     "react": "19.3.1",
     "react-dom": "19.3.1",
     "reflect-metadata": "0.2.2",
-    "resend": "6.33.0",
+    "resend": "6.34.1",
     "rxjs": "7.8.2",
     "smol-toml": "1.9.1",
     "solid-js": "1.9.17",
@@ -411,7 +411,7 @@
     "@trpc/server": ">=11",
     "ai": ">=5",
     "astro": ">=5",
-    "better-supabase": ">=0.13.0",
+    "better-supabase": ">=0.29.0",
     "chat": ">=4",
     "drizzle-orm": ">=0.40 || >=1.0.0-rc.0",
     "elysia": ">=1",

package/skills/permdock-credentials/references/tokens-keys-links.md

@@ -125,7 +125,7 @@ const subject = await subjectFromCapability(token, {
 - The result is a `kind: 'link'` principal with one `{ on, roles, via: 'link' }` membership. It never holds a scope or global role.
 - `linkPolicy` returns the tenant's `LinkPolicy` (`maxLifetime`, `redeemers`, `once`). Passing the same policy to `signCapability` refuses to mint a link the resolver would refuse.
 - Never an unguessable id without expiry, and never a security-definer RPC that reads the guest page's rows.
-- The one exception is resolving a stored link. When links live in better-supabase's share-links block, its `resolve_share_link` is `security definer` and reads only the link table. `subjectFromShareLink(token, { shareLinks, links, ttl })` from `permdock/better-supabase` turns the row into the same link subject. The page's rows are then read through `exchangeCapability` and RLS, as for a signed link. `links` maps each subject type (`subject.type` from better-supabase 0.14, `subjectType` before it) to a resource and maps the row's role to PermDock roles. An unmapped type or role, and a revoked or expired row, are anonymous. A link pinned to a version is refused, because a capability reads the current rows; read it through better-supabase's `versions.getShared(token)`. See [row-backed links](https://permdock.com/docs/concepts/capabilities#row-backed-links).
+- The one exception is resolving a stored link. When links live in better-supabase's share-links block, its `resolve_share_link` is `security definer` and reads only the link table. `subjectFromShareLink(token, { shareLinks, links, ttl })` from `permdock/better-supabase` turns the row into the same link subject. The page's rows are then read through `exchangeCapability` and RLS, as for a signed link. `links` maps each subject type (the row's `subject.type`) to a resource and maps the row's role to PermDock roles. An unmapped type or role, and a revoked or expired row, are anonymous. A link pinned to a version is refused, because a capability reads the current rows; read it through better-supabase's `versions.getShared(token)`. See [row-backed links](https://permdock.com/docs/concepts/capabilities#row-backed-links).
 
 With Supabase, let RLS serve the link through an exchange, never the link token itself: