permdock 0.14.0 → 0.15.0

package/dist/mcp/index.d.ts

@@ -112,15 +112,24 @@ type McpProcedureEnforcement = {
   readonly permissionFor: (name: string) => Permission | undefined;
   readonly oauthScopesFor?: (name: string) => readonly string[] | undefined;
 };
+/** What an `onError` sink receives next to the thrown error. */
+type McpErrorContext = {
+  /** The key of the permission being checked. */
+  readonly permission: string | null;
+  /** The tool, resource or prompt name. */
+  readonly name: string;
+  /**
+   * The tenant the `tenant` option resolves for the call, or `null` when it
+   * resolves none or throws.
+   */
+  readonly tenant: string | null;
+};
 /**
  * Receives an error a check threw: a loader, `decide`, an approval input or a
  * subject a list cannot build. The call still refuses; a sink that throws is
- * ignored.
+ * ignored. A `BetterSupabaseOnError` from `permdock/better-supabase` fits.
  */
-type McpOnError = (error: unknown, context: {
-  readonly permission: string | null;
-  readonly name: string;
-}) => void;
+type McpOnError = (error: unknown, context: McpErrorContext) => void;
 type McpPermDockOptions<TUser = unknown> = InstanceOptions & {
   /**
    * Receives the verified auth info, or `{}` on a transport without one
@@ -299,4 +308,4 @@ type McpSubjectOptions = Pick<JwtSubjectOptions, "claims" | "groupRoles" | "sche
  */
 export declare function subjectFromMcp(authInfo: McpAuthInfo | undefined, options?: McpSubjectOptions): Subject<McpPrincipal>;
 //#endregion
-export type { DeniedText, DeniedTextEvent, GuardedMcpServer, McpAuthInfo, McpOnError, McpPermDock, McpPermDockOptions, McpPrincipal, McpProcedureEnforcement, McpProcedureToolConfig, McpPromptConfig, McpResourceConfig, McpResourceGuardOptions, McpResourceGuardResult, McpSubjectOptions, McpToolConfig, McpUiResourceConfig, ProcedureMcpServer, ProtectedResourceMetadataOptions };
+export type { DeniedText, DeniedTextEvent, GuardedMcpServer, McpAuthInfo, McpErrorContext, McpOnError, McpPermDock, McpPermDockOptions, McpPrincipal, McpProcedureEnforcement, McpProcedureToolConfig, McpPromptConfig, McpResourceConfig, McpResourceGuardOptions, McpResourceGuardResult, McpSubjectOptions, McpToolConfig, McpUiResourceConfig, ProcedureMcpServer, ProtectedResourceMetadataOptions };

package/dist/mcp/index.js

@@ -222,6 +222,15 @@ function report(sink, error, context) {
 		sink(error, context);
 	} catch {}
 }
+/** The call's tenant for an error report; `null` when it has none or throws. */
+async function reportedTenant(tenant, authInfo) {
+	if (typeof tenant !== "function") return tenant ?? null;
+	try {
+		return await tenant(authInfo ?? {}) ?? null;
+	} catch {
+		return null;
+	}
+}
 //#endregion
 //#region src/mcp/call-check.ts
 function reachOf(policy, permission, declared) {
@@ -264,16 +273,11 @@ function credentialRefusal(checks, permission, reach, authInfo) {
 * The completion re-check of a long-running tool: the call must still be
 * allowed, or approved with the same token.
 */
-async function recheck(checks, binding, args, call, permission, approved, tool, name) {
+async function recheck(checks, binding, args, call, permission, approved, tool, onError) {
 	const rechecked = await checks.kernel.check(binding, args, call, compact({
 		simulate: true,
 		tool,
-		onError: (error) => {
-			report(checks.onError, error, {
-				permission: permission.key,
-				name
-			});
-		}
+		onError
 	}));
 	if (!rechecked.ok) return {
 		ok: false,
@@ -289,14 +293,33 @@ async function recheck(checks, binding, args, call, permission, approved, tool,
 		} : plainRefusal(permission, `Denied: ${permission.key} was revoked before the call completed.`, {})
 	};
 }
+/**
+* Sends the errors a check collected to the `onError` sink, after the check, so
+* the tenant resolves only when there is something to report.
+*/
+async function flush(checks, authInfo, errors, permission, name) {
+	if (errors.length === 0 || checks.onError === void 0) return;
+	const tenant = await reportedTenant(checks.options.tenant, authInfo);
+	for (const error of errors) report(checks.onError, error, {
+		permission,
+		name,
+		tenant
+	});
+}
 async function decideCall(checks, permission, reach, args, load, context, handlerContext, capabilities, completion, tool, name = tool ?? permission.key) {
 	const authInfo = context.http?.authInfo;
+	const errors = [];
 	const onError = (error) => {
-		report(checks.onError, error, {
-			permission: permission.key,
-			name
-		});
+		errors.push(error);
 	};
+	try {
+		return await decided(checks, permission, reach, args, load, context, handlerContext, capabilities, completion, tool, onError);
+	} finally {
+		await flush(checks, authInfo, errors, permission.key, name);
+	}
+}
+async function decided(checks, permission, reach, args, load, context, handlerContext, capabilities, completion, tool, onError) {
+	const authInfo = context.http?.authInfo;
 	const refused = credentialRefusal(checks, permission, reach, authInfo);
 	if (refused !== void 0) return {
 		ok: false,
@@ -307,7 +330,7 @@ async function decideCall(checks, permission, reach, args, load, context, handle
 		data: load === void 0 ? void 0 : () => load()
 	});
 	const call = compact({ authInfo });
-	if (completion !== void 0) return recheck(checks, binding, args, call, permission, completion.approved, tool, name);
+	if (completion !== void 0) return recheck(checks, binding, args, call, permission, completion.approved, tool, onError);
 	const checked = await checks.kernel.check(binding, args, call, compact({
 		resumeToken: approvalTokenOf(context),
 		tool,
@@ -393,10 +416,14 @@ async function visible(checks, context, permissionOf, keys, declaredOf = () => v
 	try {
 		permdock = await checks.kernel.instance(compact({ authInfo }));
 	} catch (error) {
-		for (const entry of guarded) report(checks.onError, error, {
-			permission: entry.permission.key,
-			name: entry.key
-		});
+		if (checks.onError !== void 0) {
+			const tenant = await reportedTenant(checks.options.tenant, authInfo);
+			for (const entry of guarded) report(checks.onError, error, {
+				permission: entry.permission.key,
+				name: entry.key,
+				tenant
+			});
+		}
 		return shown;
 	}
 	for (const entry of guarded) if ((!tools || actorMayCallTool(permdock.subject.actor, entry.key)) && permdock.mayUse(entry.permission)) shown.add(entry.key);

package/dist/next/plugin.js

@@ -1,5 +1,5 @@
 import { a as describeError } from "../errors-Vpu6rKHl.js";
-import { n as createCollectScheduler, r as report, t as collectOnce } from "../watch-CTfSlIGD.js";
+import { n as createCollectScheduler, r as report, t as collectOnce } from "../watch-DAkjm75Y.js";
 //#region src/cli/plugin.ts
 const PHASE_BUILD = "phase-production-build";
 const PHASE_DEV = "phase-development-server";

package/dist/{openapi-DDENzRbG.js → openapi-CleDZYVf.js}

@@ -7,7 +7,7 @@ import { a as loadModule, n as asPolicy, s as pickNamed, t as asPermissionTree }
 import { t as shortDiff } from "./text-diff-BtfSmdUo.js";
 import { c as openapiVersion, o as createPermDock } from "./openapi-BOsx0xn9.js";
 import { i as fileDrift } from "./output-files-BIQ_9pIs.js";
-import { n as validateOverlay, t as validateOpenapi } from "./schema-CnrIP94n.js";
+import { n as validateOverlay, t as validateOpenapi } from "./schema-BDGEVO4g.js";
 import { existsSync } from "node:fs";
 import { resolve } from "node:path";
 //#region src/cli/openapi/openapi.ts

package/dist/{openapi-CT55v3WD.js → openapi-eHZ5hwUJ.js}

@@ -80,7 +80,7 @@ const emit = defineLeaf({
 		}
 	},
 	async run(ctx, { flags }) {
-		return (await import("./openapi-DDENzRbG.js")).runOpenapi({
+		return (await import("./openapi-CleDZYVf.js")).runOpenapi({
 			cwd: ctx.cwd,
 			config: ctx.config,
 			rest: ["emit"],
@@ -122,7 +122,7 @@ const importDocument = defineLeaf({
 	async run(ctx, { flags }) {
 		const doc = given(flags.doc);
 		if (doc === void 0) throw missingInput("openapi import", ["--doc"], "the OpenAPI document to import");
-		return (await import("./import-efm6qPgx.js")).runOpenapiImport({
+		return (await import("./import-DK_J8tVE.js")).runOpenapiImport({
 			cwd: ctx.cwd,
 			doc,
 			out: fileOut("openapi import", flags.out),

package/dist/{output-3iB3_Hfg.js → output-BVZpQDad.js}

@@ -1,5 +1,5 @@
 import { s as cliVersion } from "./version-DMQ0dnN5.js";
-import { t as DOCS_BASE } from "./manifest-BWIR_EEB.js";
+import { t as DOCS_BASE } from "./manifest-CbEyvPN2.js";
 //#region src/cli/core/output.ts
 const CLI_RESULT_SCHEMA = "https://permdock.com/schemas/cli-result-v1.json";
 function envelope(input) {

package/dist/{powersync-COjQTHRD.js → powersync-CFWILHjb.js}

@@ -14,7 +14,7 @@ const generate = defineLeaf({
 	async run(ctx, { flags }) {
 		const out = fileOut("powersync", flags.out);
 		const from = given(flags.policy);
-		const { runPowerSync } = await import("./powersync-k8lUeC37.js");
+		const { runPowerSync } = await import("./powersync-CnGzxvEl.js");
 		return runPowerSync({
 			cwd: ctx.cwd,
 			config: ctx.config,
@@ -45,7 +45,7 @@ const verify = defineLeaf({
 		const db = await dbUrl(ctx, flags, { required: true });
 		const fixtures = given(flags.fixtures);
 		const from = given(flags.policy);
-		const { runPowerSync } = await import("./powersync-k8lUeC37.js");
+		const { runPowerSync } = await import("./powersync-CnGzxvEl.js");
 		return runPowerSync({
 			cwd: ctx.cwd,
 			config: ctx.config,

package/dist/powersync-CnGzxvEl.js

@@ -0,0 +1 @@
+export { n as runPowerSync } from "./powersync-uqYWxTjq.js";

package/dist/{powersync-DVbskWD9.js → powersync-uqYWxTjq.js}

@@ -19,7 +19,7 @@ import { n as tableNameOf, r as tableNames } from "./tables-DimBcVWY.js";
 import { d as andConditions, l as collectGrants, o as assignableRoles, p as contextRefs, t as ownershipRules, u as roleNames } from "./ownership-qqBuGJXr.js";
 import { t as membershipSourcesOf } from "./sources-qoIJQrJv.js";
 import { n as pgConnector } from "./pg-DQTqRrou.js";
-import { m as tableFor, t as canFixture } from "./verify-CHQgLrtS.js";
+import { m as tableFor, t as canFixture } from "./verify-CgIpJRcG.js";
 import { resolve } from "node:path";
 //#region src/cli/powersync/names.ts
 function ident(name) {

package/dist/{pull-Er4aBHlL.js → pull-BBmCxnqX.js}

@@ -7,7 +7,7 @@ import { o as formatCatalogJson } from "./catalog-doc-DjMKzJp9.js";
 import { t as catalogPath } from "./catalog-path-CnI0XTFK.js";
 import { n as parseSupabaseManifest } from "./manifest-BXTbHNIV.js";
 import { t as parseCatalog } from "./parse-1_ZheTW5.js";
-import { a as nonEmptyOr } from "./output-3iB3_Hfg.js";
+import { a as nonEmptyOr } from "./output-BVZpQDad.js";
 import { t as POLICY_NOT_PUBLISHED } from "./problem-types-DSsRfONQ.js";
 import { n as httpRequest, t as authFailure } from "./http-DOL33cO0.js";
 import { l as cloudUrl, n as cliRuntime, o as readAuth } from "./auth--yPyZNgr.js";

package/dist/pull-D6dloyrc.js

@@ -0,0 +1 @@
+export { n as runCloudPull } from "./pull-BBmCxnqX.js";

package/dist/react-native/index.d.ts

@@ -124,6 +124,19 @@ type PowerSyncSourceOptions<Q extends string> = {
  * as an argument; `permdock/react-native` never imports `@powersync/*`.
  */
 export declare function powerSyncSource<Q extends string>(db: PowerSyncWatchable, options: PowerSyncSourceOptions<Q>): SnapshotSource;
+/** `powerSyncSource` over one database, memoised per manifest and options. */
+type PowerSyncSourceCache = {
+  readonly source: <Q extends string>(options: PowerSyncSourceOptions<Q>) => SnapshotSource;
+};
+/**
+ * A cache of `powerSyncSource` sources over `db`. `source` answers the same
+ * source for the same `manifest` object and, with `user`, the same `user`,
+ * `tenant` and `attributes` content, or, with `queries`, the same `queries` and
+ * `read` objects. A render that rebuilds its options then keeps the source, so
+ * `PermDockProvider` neither resubscribes nor rereads. Entries live as long as
+ * their manifest; create one cache per database, outside render.
+ */
+export declare function powerSyncSourceCache(db: PowerSyncWatchable): PowerSyncSourceCache;
 //#endregion
 //#region src/react-native/provider.d.ts
 export declare function PermDockProvider(props: ReactNativePermDockProviderProps): ReactElement;
@@ -209,4 +222,4 @@ type NativeStoreOptions = Omit<ReactNativePermDockProviderProps, "children" | "h
 export declare function connectSource(store: ClientStore, source: SnapshotSource, subscribeForeground?: SubscribeForeground): () => void;
 export declare function nativeStore(options: NativeStoreOptions): ClientStore;
 //#endregion
-export { type ActionResult, type AppStateModule, type ApprovalHandle, type ApprovalState, type ClientPermDock, type ClientStatus, type EventSourceRefreshOptions, type FilterResult, type GateMode, type GateView, type LocalMembershipRows, type LocalRowColumn, type LocalRowValue, type LocalSnapshotData, type LocalSnapshotManifest, type LocalSnapshotOptions, type LocalSnapshotRows, type MmkvInstance, type NativeRevalidate, type NetInfoModule, type PermDockDefaults, type PermissionSet, type PermissionState, type PowerSyncQuery, type PowerSyncSourceOptions, type PowerSyncWatchable, Protected, type ProtectedAction, type ProtectedActionHandle, type ProtectedActionView, type ProtectedProps, type ReactNativePermDockProviderProps, type RefreshTrigger, type RolesOptions, type SecureStoreModule, type SnapshotSource, type SnapshotStorage, type SubjectView, type SubscribeForeground, type SubscribeOnline, type TenantView, approvalHeaders, describe, eventSourceRefresh, parseLocalSnapshotManifest, requiredPlans, useApproval, useAssignablePermissions, useAssignableRoles, useDescribe, useFilter, useGate, useMemberships, usePermDock, usePermission, usePermissions, useProtectedAction, useRoles, useSubject, useTenant };
+export { type ActionResult, type AppStateModule, type ApprovalHandle, type ApprovalState, type ClientPermDock, type ClientStatus, type EventSourceRefreshOptions, type FilterResult, type GateMode, type GateView, type LocalMembershipRows, type LocalRowColumn, type LocalRowValue, type LocalSnapshotData, type LocalSnapshotManifest, type LocalSnapshotOptions, type LocalSnapshotRows, type MmkvInstance, type NativeRevalidate, type NetInfoModule, type PermDockDefaults, type PermissionSet, type PermissionState, type PowerSyncQuery, type PowerSyncSourceCache, type PowerSyncSourceOptions, type PowerSyncWatchable, Protected, type ProtectedAction, type ProtectedActionHandle, type ProtectedActionView, type ProtectedProps, type ReactNativePermDockProviderProps, type RefreshTrigger, type RolesOptions, type SecureStoreModule, type SnapshotSource, type SnapshotStorage, type SubjectView, type SubscribeForeground, type SubscribeOnline, type TenantView, approvalHeaders, describe, eventSourceRefresh, parseLocalSnapshotManifest, requiredPlans, useApproval, useAssignablePermissions, useAssignableRoles, useDescribe, useFilter, useGate, useMemberships, usePermDock, usePermission, usePermissions, useProtectedAction, useRoles, useSubject, useTenant };

package/dist/react-native/index.js

@@ -603,6 +603,51 @@ function powerSyncSource(db, options) {
 		}
 	};
 }
+/**
+* A cache of `powerSyncSource` sources over `db`. `source` answers the same
+* source for the same `manifest` object and, with `user`, the same `user`,
+* `tenant` and `attributes` content, or, with `queries`, the same `queries` and
+* `read` objects. A render that rebuilds its options then keeps the source, so
+* `PermDockProvider` neither resubscribes nor rereads. Entries live as long as
+* their manifest; create one cache per database, outside render.
+*/
+function powerSyncSourceCache(db) {
+	const byManifest = /* @__PURE__ */ new WeakMap();
+	return Object.freeze({ source: (options) => {
+		let entries = byManifest.get(options.manifest);
+		if (entries === void 0) {
+			entries = {
+				rows: /* @__PURE__ */ new Map(),
+				custom: /* @__PURE__ */ new WeakMap()
+			};
+			byManifest.set(options.manifest, entries);
+		}
+		if ("user" in options) {
+			const key = JSON.stringify([
+				options.user,
+				options.tenant ?? null,
+				options.attributes ?? null
+			]);
+			let source = entries.rows.get(key);
+			if (source === void 0) {
+				source = powerSyncSource(db, options);
+				entries.rows.set(key, source);
+			}
+			return source;
+		}
+		let byRead = entries.custom.get(options.queries);
+		if (byRead === void 0) {
+			byRead = /* @__PURE__ */ new WeakMap();
+			entries.custom.set(options.queries, byRead);
+		}
+		let source = byRead.get(options.read);
+		if (source === void 0) {
+			source = powerSyncSource(db, options);
+			byRead.set(options.read, source);
+		}
+		return source;
+	} });
+}
 //#endregion
 //#region src/react-native/storage.ts
 const SNAPSHOT_KEY = "permdock.snapshot";
@@ -1081,4 +1126,4 @@ function netInfoOnline(netInfo) {
 	});
 }
 //#endregion
-export { PermDockProvider, Protected, appStateForeground, approvalHeaders, buildLocalSnapshot, connectSource, describe, eventSourceRefresh, localSnapshot, memorySnapshotStorage, mmkvStorage, nativeStore, netInfoOnline, parseLocalSnapshotManifest, powerSyncSource, requiredPlans, secureStoreStorage, useApproval, useAssignablePermissions, useAssignableRoles, useDescribe, useFilter, useGate, useMemberships, usePermDock, usePermission, usePermissionGuard, usePermissions, useProtectedAction, useRoles, useSnapshotReady, useSubject, useTenant };
+export { PermDockProvider, Protected, appStateForeground, approvalHeaders, buildLocalSnapshot, connectSource, describe, eventSourceRefresh, localSnapshot, memorySnapshotStorage, mmkvStorage, nativeStore, netInfoOnline, parseLocalSnapshotManifest, powerSyncSource, powerSyncSourceCache, requiredPlans, secureStoreStorage, useApproval, useAssignablePermissions, useAssignableRoles, useDescribe, useFilter, useGate, useMemberships, usePermDock, usePermission, usePermissionGuard, usePermissions, useProtectedAction, useRoles, useSnapshotReady, useSubject, useTenant };

package/dist/{rls-DY3Fc18U.js → rls-BwKXdVEW.js}

@@ -11,10 +11,10 @@ import "./sources-C4vkzZJV.js";
 import { t as policyFromCatalog } from "./policy-from-catalog-CU3An8uP.js";
 import { t as beforeFirst } from "./text-BMFRfBqc.js";
 import { i as INDEXES_MARKER, n as GRANTS_MARKER, o as SEEDS_MARKER, t as BACKFILL_MARKER } from "./markers-BeHZ4x9Q.js";
-import { a as nonEmptyOr } from "./output-3iB3_Hfg.js";
+import { a as nonEmptyOr } from "./output-BVZpQDad.js";
 import { i as requirePeer, n as packageManagerOf, t as addLine } from "./peer-Q0fuZ6hx.js";
 import { t as POLICY_NOT_PUBLISHED } from "./problem-types-DSsRfONQ.js";
-import { t as fetchProjectPolicy } from "./pull-Er4aBHlL.js";
+import { t as fetchProjectPolicy } from "./pull-BBmCxnqX.js";
 import { n as MIGRATION_DIRS } from "./constants-DcJABbLW.js";
 import { a as isSeedsDirectory, c as parseSplit, d as seedsMigration, f as writeOutputFiles, l as partPath, n as dataMigrationFile, r as driftOf, u as pgDeltaPath } from "./output-files-BIQ_9pIs.js";
 import { b as rbacScaffold, d as resolveSchemas, f as schemasRefusal, o as supabaseHookSql, p as declarativeSql, s as approvalsSql, t as grantsLabel, u as isSupabaseSchemas, y as parseRbacAuthorize } from "./supabase-hook-HPgwYb9V.js";
@@ -25,8 +25,8 @@ import { a as splitUndiffed } from "./deciding-columns-NB4wcyBf.js";
 import { t as connectPgPool } from "./pg-DQTqRrou.js";
 import { a as fieldViewsSql, c as ACTOR_MAY_WRITE, f as readOnlyActorKinds, i as fieldViews, l as actorMayWriteSql, n as columnGrantSql, o as rowBranches, p as readOnlyActorPolicies, r as columnRevokeSql, u as assemblePolicies } from "./fields-DI8s3cPl.js";
 import { n as permissionHoldersSql } from "./resolve-names-Y1Cb22cp.js";
-import { _ as indexTargets, a as verifyResult, b as readTableIndexFacts, c as callsHelper, g as INDEX_COLUMNS_SQL, h as COLUMNS_SQL, i as verifyIgnores, l as helperCallKeys, m as tableFor, n as runRlsVerify, o as HELPER_TABLES, p as compileGrants, r as rlsFinding, v as indexesSql, y as pruneIndexTargets } from "./verify-CHQgLrtS.js";
-import { a as buildContext, c as levelKeys, d as rebuildPlan, i as splitsPart, l as rowHelpersSql, n as generateOptions, o as CANDIDATES, r as isRefusal, s as inheritTargets, t as supautilsRejections, u as DROPPED_LIST } from "./supautils-DZ95xxW-.js";
+import { _ as indexTargets, a as verifyResult, b as readTableIndexFacts, c as callsHelper, g as INDEX_COLUMNS_SQL, h as COLUMNS_SQL, i as verifyIgnores, l as helperCallKeys, m as tableFor, n as runRlsVerify, o as HELPER_TABLES, p as compileGrants, r as rlsFinding, v as indexesSql, y as pruneIndexTargets } from "./verify-CgIpJRcG.js";
+import { a as buildContext, c as levelKeys, d as rebuildPlan, i as splitsPart, l as rowHelpersSql, n as generateOptions, o as CANDIDATES, r as isRefusal, s as inheritTargets, t as supautilsRejections, u as DROPPED_LIST } from "./supautils-CGk4YpvC.js";
 import { readFileSync } from "node:fs";
 import { basename, delimiter, join } from "node:path";
 import { spawn } from "node:child_process";

package/dist/{rls-DjjOHlKE.js → rls-yK2nZUcm.js}

@@ -192,7 +192,7 @@ async function rlsInput(ctx, verb, shape, options) {
 	};
 }
 async function runRls(input) {
-	return (await import("./rls-DY3Fc18U.js")).runRls(input);
+	return (await import("./rls-BwKXdVEW.js")).runRls(input);
 }
 const generate = defineLeaf({
 	flags: {

package/dist/{run-BlxXmaDS.js → run-D5WIJfs7.js}

@@ -1,13 +1,13 @@
 import { i as dateAt } from "./time-nR1JesoH.js";
 import { a as describeError, l as problemOf, n as CliError, r as cliProblem, s as kindOfCode } from "./errors-Vpu6rKHl.js";
 import { s as cliVersion } from "./version-DMQ0dnN5.js";
-import { a as resolveCwd, i as readConfig } from "./config-ZZdtyQZy.js";
+import { a as resolveCwd, i as readConfig } from "./config-CcLlvEYW.js";
 import { t as beforeFirst } from "./text-BMFRfBqc.js";
 import { a as suggestion, i as parseLeaf, n as flagSpellings, o as GLOBAL_FLAGS, r as parseFlags } from "./args-0FrVs5EH.js";
 import { r as progressReporter, t as redact } from "./credentials-CdDxp7jN.js";
-import { a as resolve, i as leaves, n as ROOT, r as SECTIONS, t as DOCS_BASE } from "./manifest-BWIR_EEB.js";
+import { a as resolve, i as leaves, n as ROOT, r as SECTIONS, t as DOCS_BASE } from "./manifest-CbEyvPN2.js";
 import { t as createStyle } from "./style-Ds11Hmk4.js";
-import { i as githubAnnotations, n as envelope, o as sarifLog, t as dataOf } from "./output-3iB3_Hfg.js";
+import { i as githubAnnotations, n as envelope, o as sarifLog, t as dataOf } from "./output-BVZpQDad.js";
 import { i as renameMessage, r as flagRename, t as COMMAND_MOVES } from "./renames-CGj7YwcQ.js";
 import { stripVTControlCharacters } from "node:util";
 import { existsSync, statSync } from "node:fs";

package/dist/run-DlQYPtPv.js

@@ -0,0 +1 @@
+export { t as run } from "./run-D5WIJfs7.js";

package/dist/{scan-CR_xm71k.js → scan-CzdMtHnq.js}

@@ -16,7 +16,7 @@ const scan = defineLeaf({
 		}
 	},
 	async run(ctx, { flags }) {
-		const { runAdoptionScan } = await import("./adoption-scan-BGtwGfoH.js");
+		const { runAdoptionScan } = await import("./adoption-scan-DLel53Oa.js");
 		return runAdoptionScan({
 			cwd: ctx.cwd,
 			srcPath: flags.src.length > 0 ? flags.src : ctx.config.collect?.srcPath ?? ["src"],

package/dist/{schema-CnrIP94n.js → schema-BDGEVO4g.js}

@@ -1,7 +1,7 @@
 import { r as isRecord } from "./compact-CAf557ZB.js";
 import { l as packageRoot } from "./version-DMQ0dnN5.js";
 import { t as DRAFT_PINS } from "./pins-nqarl3oE.js";
-import { a as nonEmptyOr } from "./output-3iB3_Hfg.js";
+import { a as nonEmptyOr } from "./output-BVZpQDad.js";
 import { t as require__2020 } from "./2020-CJbO8Bvz.js";
 import { readFileSync } from "node:fs";
 import { join } from "node:path";

package/dist/{skills-uzsVqEi9.js → skills-BIsm1n26.js}

@@ -1,7 +1,7 @@
 import { t as defineLeaf } from "./command-L8EstFNm.js";
 import { t as checkFlag } from "./flags-DXjoTVbS.js";
 import { r as pick, t as CANCELLED } from "./prompt-BYc6drYW.js";
-import { n as detectedAgents, r as runSkills, t as SKILL_AGENTS } from "./skills-CY-MY_Oj.js";
+import { n as detectedAgents, r as runSkills, t as SKILL_AGENTS } from "./skills-BZxPQ_09.js";
 //#region src/cli/commands/skills.ts
 const forFlag = { for: {
 	type: "string",

package/dist/{skills-CY-MY_Oj.js → skills-BZxPQ_09.js}

@@ -2,7 +2,7 @@ import { t as byCodePoint } from "./compare-DTfyUunF.js";
 import { i as readJsonFile } from "./files-BSjrtIHw.js";
 import { l as packageRoot } from "./version-DMQ0dnN5.js";
 import { t as didYouMean } from "./args-0FrVs5EH.js";
-import { a as nonEmptyOr } from "./output-3iB3_Hfg.js";
+import { a as nonEmptyOr } from "./output-BVZpQDad.js";
 import { cpSync, existsSync, lstatSync, mkdirSync, readFileSync, readdirSync, readlinkSync, realpathSync, writeFileSync } from "node:fs";
 import { basename, dirname, join, relative, resolve } from "node:path";
 import { pathToFileURL } from "node:url";

package/dist/{supautils-DZ95xxW-.js → supautils-CGk4YpvC.js}

@@ -16,7 +16,7 @@ import { t as membershipSourcesOf } from "./sources-qoIJQrJv.js";
 import { i as group, o as sqlStatements } from "./deciding-columns-NB4wcyBf.js";
 import { d as orSql, h as branchClauses } from "./fields-DI8s3cPl.js";
 import { t as resolveNames } from "./resolve-names-Y1Cb22cp.js";
-import { m as tableFor } from "./verify-CHQgLrtS.js";
+import { m as tableFor } from "./verify-CgIpJRcG.js";
 //#region src/cli/rls/custom-role-rebuild.ts
 const PREFIX = "PermDock CLI";
 /** A column of the roles-table row `r`. */
@@ -199,8 +199,8 @@ const DROPPED_LIST = `(select string_agg(g.role || ': ' || g.items, '; ' order b
 * shared role holds is skipped with a warning (`name-taken`). Before-row
 * triggers hold a signed-in caller at trigger depth 1 to the checks of
 * `permdock_replace_custom_role_grants`: `permdock_custom_role_guard` on each
-* role the row names, then `permdock_custom_role_beyond` on the entry it adds;
-* a refusal aborts the write.
+* role the row names, the entry it adds against the ceiling, then
+* `permdock_custom_role_beyond` on that entry; a refusal aborts the write.
 */
 function customRoleSyncSql(ctx, from, migrate) {
 	const plan = rebuildPlan(ctx, from, migrate);
@@ -305,6 +305,17 @@ begin
     end if;
     v_dropped := '{}'::text[];
 ${plan.collectNew[name]}
+    if cardinality(v_dropped) > 0 then
+      raise exception using
+        errcode = '22023',
+        message = 'permdock: ' || v_dropped[1],
+        hint = case
+          when v_dropped[1] like '%outside the ceiling of %' then 'outside-ceiling'
+          when v_dropped[1] like '%, level % is not declared' then 'unknown-level'
+          when v_dropped[1] like '%, not a declared role' then 'unknown-role'
+          else 'unknown-permission'
+        end;
+    end if;
     select string_agg(b, ', ' order by b) into v_beyond
     from ${beyond}(v.tenant_id, v.scope, v.scope_id, v_allow, v_deny, v_include) b;
     if v_beyond is not null then

package/dist/unplugin/index.js

@@ -1,4 +1,4 @@
-import { n as createCollectScheduler, r as report } from "../watch-CTfSlIGD.js";
+import { n as createCollectScheduler, r as report } from "../watch-DAkjm75Y.js";
 import { r as peerHint } from "../peer-Q0fuZ6hx.js";
 import { createRequire } from "node:module";
 //#region src/unplugin/index.ts

package/dist/usage-D3KJyaNS.js

@@ -0,0 +1 @@
+export { t as runUsage } from "./usage-e6M1Mls1.js";

package/dist/{usage-Dm2hn0pS.js → usage-DBNrpwoT.js}

@@ -16,7 +16,7 @@ const usage = defineLeaf({
 		}
 	},
 	async run(ctx, { flags }) {
-		return (await import("./usage-CH7oISI6.js")).runUsage({
+		return (await import("./usage-D3KJyaNS.js")).runUsage({
 			cwd: ctx.cwd,
 			config: ctx.config,
 			ignore: flags.ignore,

package/dist/{usage-WYRc7Kqg.js → usage-e6M1Mls1.js}

@@ -6,8 +6,8 @@ import { c as jsonSchemaOf } from "./catalog-doc-DjMKzJp9.js";
 import { a as loadModule, n as asPolicy, s as pickNamed } from "./load-DjSU5KXO.js";
 import { r as runCollect } from "./collect-WCl8cJQV.js";
 import { t as beforeFirst } from "./text-BMFRfBqc.js";
-import { t as DOCS_BASE } from "./manifest-BWIR_EEB.js";
-import { r as findingOf } from "./output-3iB3_Hfg.js";
+import { t as DOCS_BASE } from "./manifest-CbEyvPN2.js";
+import { r as findingOf } from "./output-BVZpQDad.js";
 import { existsSync, readFileSync, realpathSync } from "node:fs";
 import { dirname, resolve } from "node:path";
 import { fileURLToPath, pathToFileURL } from "node:url";

package/dist/{verify-CHQgLrtS.js → verify-CgIpJRcG.js}

@@ -22,7 +22,7 @@ import { i as qualifySqlTable, n as defaultSqlCommand, t as SQL_IDENT } from "./
 import { a as scopeMembershipTable, i as scopeColumn } from "./compile-EzEMB-7v.js";
 import "./sources-C4vkzZJV.js";
 import { t as beforeFirst } from "./text-BMFRfBqc.js";
-import { t as DOCS_BASE } from "./manifest-BWIR_EEB.js";
+import { t as DOCS_BASE } from "./manifest-CbEyvPN2.js";
 import { n as fixtureSubject, r as loadFixtures, t as fixtureRow } from "./fixtures-Bm4_K1ke.js";
 import { A as quoteQualified, N as arrayColumnsOf, O as quoteIdent, P as columnTypesOf, _ as subjectClaimJsonSql, a as customRolesOn, j as quoteTable, k as quoteLiteral, r as HELPERS, v as subjectClaimSql } from "./shared-DrGLwM3s.js";
 import { C as accessSql, D as tokenScopeAllowsCall, S as requiresSql, ht as scopeTable, k as capabilityAccessSql, n as tableNameOf, o as graphPlan, q as apiKeyAllowsCall, r as tableNames } from "./tables-DimBcVWY.js";

package/dist/watch-CuPz0D2M.js

@@ -0,0 +1 @@
+export { i as watchCollect } from "./watch-DAkjm75Y.js";

package/dist/{watch-CTfSlIGD.js → watch-DAkjm75Y.js}

@@ -2,7 +2,7 @@ import { i as dateAt } from "./time-nR1JesoH.js";
 import { a as describeError } from "./errors-Vpu6rKHl.js";
 import { t as defaultSrcPath } from "./files-BSjrtIHw.js";
 import { r as runCollect } from "./collect-WCl8cJQV.js";
-import { n as isConfigFile, r as loadConfig } from "./config-ZZdtyQZy.js";
+import { n as isConfigFile, r as loadConfig } from "./config-CcLlvEYW.js";
 import { watch } from "node:fs";
 import { basename, dirname, relative, resolve, sep } from "node:path";
 //#region src/cli/watch.ts

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "permdock",
-  "version": "0.14.0",
+  "version": "0.15.0",
   "description": "Typed permissions for TypeScript apps, APIs, databases, and AI agents, with the permdock CLI and test runners.",
   "keywords": [
     "ai-agents",

package/dist/powersync-k8lUeC37.js

@@ -1 +0,0 @@
-export { n as runPowerSync } from "./powersync-DVbskWD9.js";

package/dist/pull-BY1METGf.js

@@ -1 +0,0 @@
-export { n as runCloudPull } from "./pull-Er4aBHlL.js";

package/dist/run-DGSLvGty.js

@@ -1 +0,0 @@
-export { t as run } from "./run-BlxXmaDS.js";

package/dist/usage-CH7oISI6.js

@@ -1 +0,0 @@
-export { t as runUsage } from "./usage-WYRc7Kqg.js";

package/dist/watch-C44FtM79.js

@@ -1 +0,0 @@
-export { i as watchCollect } from "./watch-CTfSlIGD.js";