permdock 0.14.0 → 0.16.0

package/dist/mcp/index.d.ts

@@ -112,15 +112,24 @@ type McpProcedureEnforcement = {
   readonly permissionFor: (name: string) => Permission | undefined;
   readonly oauthScopesFor?: (name: string) => readonly string[] | undefined;
 };
+/** What an `onError` sink receives next to the thrown error. */
+type McpErrorContext = {
+  /** The key of the permission being checked. */
+  readonly permission: string | null;
+  /** The tool, resource or prompt name. */
+  readonly name: string;
+  /**
+   * The tenant the `tenant` option resolves for the call, or `null` when it
+   * resolves none or throws.
+   */
+  readonly tenant: string | null;
+};
 /**
  * Receives an error a check threw: a loader, `decide`, an approval input or a
  * subject a list cannot build. The call still refuses; a sink that throws is
- * ignored.
+ * ignored. A `BetterSupabaseOnError` from `permdock/better-supabase` fits.
  */
-type McpOnError = (error: unknown, context: {
-  readonly permission: string | null;
-  readonly name: string;
-}) => void;
+type McpOnError = (error: unknown, context: McpErrorContext) => void;
 type McpPermDockOptions<TUser = unknown> = InstanceOptions & {
   /**
    * Receives the verified auth info, or `{}` on a transport without one
@@ -299,4 +308,4 @@ type McpSubjectOptions = Pick<JwtSubjectOptions, "claims" | "groupRoles" | "sche
  */
 export declare function subjectFromMcp(authInfo: McpAuthInfo | undefined, options?: McpSubjectOptions): Subject<McpPrincipal>;
 //#endregion
-export type { DeniedText, DeniedTextEvent, GuardedMcpServer, McpAuthInfo, McpOnError, McpPermDock, McpPermDockOptions, McpPrincipal, McpProcedureEnforcement, McpProcedureToolConfig, McpPromptConfig, McpResourceConfig, McpResourceGuardOptions, McpResourceGuardResult, McpSubjectOptions, McpToolConfig, McpUiResourceConfig, ProcedureMcpServer, ProtectedResourceMetadataOptions };
+export type { DeniedText, DeniedTextEvent, GuardedMcpServer, McpAuthInfo, McpErrorContext, McpOnError, McpPermDock, McpPermDockOptions, McpPrincipal, McpProcedureEnforcement, McpProcedureToolConfig, McpPromptConfig, McpResourceConfig, McpResourceGuardOptions, McpResourceGuardResult, McpSubjectOptions, McpToolConfig, McpUiResourceConfig, ProcedureMcpServer, ProtectedResourceMetadataOptions };

package/dist/mcp/index.js

@@ -222,6 +222,15 @@ function report(sink, error, context) {
 		sink(error, context);
 	} catch {}
 }
+/** The call's tenant for an error report; `null` when it has none or throws. */
+async function reportedTenant(tenant, authInfo) {
+	if (typeof tenant !== "function") return tenant ?? null;
+	try {
+		return await tenant(authInfo ?? {}) ?? null;
+	} catch {
+		return null;
+	}
+}
 //#endregion
 //#region src/mcp/call-check.ts
 function reachOf(policy, permission, declared) {
@@ -264,16 +273,11 @@ function credentialRefusal(checks, permission, reach, authInfo) {
 * The completion re-check of a long-running tool: the call must still be
 * allowed, or approved with the same token.
 */
-async function recheck(checks, binding, args, call, permission, approved, tool, name) {
+async function recheck(checks, binding, args, call, permission, approved, tool, onError) {
 	const rechecked = await checks.kernel.check(binding, args, call, compact({
 		simulate: true,
 		tool,
-		onError: (error) => {
-			report(checks.onError, error, {
-				permission: permission.key,
-				name
-			});
-		}
+		onError
 	}));
 	if (!rechecked.ok) return {
 		ok: false,
@@ -289,14 +293,33 @@ async function recheck(checks, binding, args, call, permission, approved, tool,
 		} : plainRefusal(permission, `Denied: ${permission.key} was revoked before the call completed.`, {})
 	};
 }
+/**
+* Sends the errors a check collected to the `onError` sink, after the check, so
+* the tenant resolves only when there is something to report.
+*/
+async function flush(checks, authInfo, errors, permission, name) {
+	if (errors.length === 0 || checks.onError === void 0) return;
+	const tenant = await reportedTenant(checks.options.tenant, authInfo);
+	for (const error of errors) report(checks.onError, error, {
+		permission,
+		name,
+		tenant
+	});
+}
 async function decideCall(checks, permission, reach, args, load, context, handlerContext, capabilities, completion, tool, name = tool ?? permission.key) {
 	const authInfo = context.http?.authInfo;
+	const errors = [];
 	const onError = (error) => {
-		report(checks.onError, error, {
-			permission: permission.key,
-			name
-		});
+		errors.push(error);
 	};
+	try {
+		return await decided(checks, permission, reach, args, load, context, handlerContext, capabilities, completion, tool, onError);
+	} finally {
+		await flush(checks, authInfo, errors, permission.key, name);
+	}
+}
+async function decided(checks, permission, reach, args, load, context, handlerContext, capabilities, completion, tool, onError) {
+	const authInfo = context.http?.authInfo;
 	const refused = credentialRefusal(checks, permission, reach, authInfo);
 	if (refused !== void 0) return {
 		ok: false,
@@ -307,7 +330,7 @@ async function decideCall(checks, permission, reach, args, load, context, handle
 		data: load === void 0 ? void 0 : () => load()
 	});
 	const call = compact({ authInfo });
-	if (completion !== void 0) return recheck(checks, binding, args, call, permission, completion.approved, tool, name);
+	if (completion !== void 0) return recheck(checks, binding, args, call, permission, completion.approved, tool, onError);
 	const checked = await checks.kernel.check(binding, args, call, compact({
 		resumeToken: approvalTokenOf(context),
 		tool,
@@ -393,10 +416,14 @@ async function visible(checks, context, permissionOf, keys, declaredOf = () => v
 	try {
 		permdock = await checks.kernel.instance(compact({ authInfo }));
 	} catch (error) {
-		for (const entry of guarded) report(checks.onError, error, {
-			permission: entry.permission.key,
-			name: entry.key
-		});
+		if (checks.onError !== void 0) {
+			const tenant = await reportedTenant(checks.options.tenant, authInfo);
+			for (const entry of guarded) report(checks.onError, error, {
+				permission: entry.permission.key,
+				name: entry.key,
+				tenant
+			});
+		}
 		return shown;
 	}
 	for (const entry of guarded) if ((!tools || actorMayCallTool(permdock.subject.actor, entry.key)) && permdock.mayUse(entry.permission)) shown.add(entry.key);

package/dist/next/plugin.js

@@ -1,5 +1,5 @@
 import { a as describeError } from "../errors-Vpu6rKHl.js";
-import { n as createCollectScheduler, r as report, t as collectOnce } from "../watch-CTfSlIGD.js";
+import { n as createCollectScheduler, r as report, t as collectOnce } from "../watch-DAkjm75Y.js";
 //#region src/cli/plugin.ts
 const PHASE_BUILD = "phase-production-build";
 const PHASE_DEV = "phase-development-server";

package/dist/{openapi-CT55v3WD.js → openapi-BwWkHxvW.js}

@@ -80,7 +80,7 @@ const emit = defineLeaf({
 		}
 	},
 	async run(ctx, { flags }) {
-		return (await import("./openapi-DDENzRbG.js")).runOpenapi({
+		return (await import("./openapi-DSzQN7Zu.js")).runOpenapi({
 			cwd: ctx.cwd,
 			config: ctx.config,
 			rest: ["emit"],
@@ -122,7 +122,7 @@ const importDocument = defineLeaf({
 	async run(ctx, { flags }) {
 		const doc = given(flags.doc);
 		if (doc === void 0) throw missingInput("openapi import", ["--doc"], "the OpenAPI document to import");
-		return (await import("./import-efm6qPgx.js")).runOpenapiImport({
+		return (await import("./import-Dfe2unKO.js")).runOpenapiImport({
 			cwd: ctx.cwd,
 			doc,
 			out: fileOut("openapi import", flags.out),

package/dist/{openapi-DDENzRbG.js → openapi-DSzQN7Zu.js}

@@ -7,7 +7,7 @@ import { a as loadModule, n as asPolicy, s as pickNamed, t as asPermissionTree }
 import { t as shortDiff } from "./text-diff-BtfSmdUo.js";
 import { c as openapiVersion, o as createPermDock } from "./openapi-BOsx0xn9.js";
 import { i as fileDrift } from "./output-files-BIQ_9pIs.js";
-import { n as validateOverlay, t as validateOpenapi } from "./schema-CnrIP94n.js";
+import { n as validateOverlay, t as validateOpenapi } from "./schema-DvXvxPhQ.js";
 import { existsSync } from "node:fs";
 import { resolve } from "node:path";
 //#region src/cli/openapi/openapi.ts

package/dist/{output-3iB3_Hfg.js → output-DlICTjBh.js}

@@ -1,5 +1,5 @@
 import { s as cliVersion } from "./version-DMQ0dnN5.js";
-import { t as DOCS_BASE } from "./manifest-BWIR_EEB.js";
+import { t as DOCS_BASE } from "./manifest-Cft51TLK.js";
 //#region src/cli/core/output.ts
 const CLI_RESULT_SCHEMA = "https://permdock.com/schemas/cli-result-v1.json";
 function envelope(input) {

package/dist/powersync-0QVP_DuR.js

@@ -0,0 +1 @@
+export { n as runPowerSync } from "./powersync-CBhTBhG2.js";

package/dist/{powersync-DVbskWD9.js → powersync-CBhTBhG2.js}

@@ -19,7 +19,7 @@ import { n as tableNameOf, r as tableNames } from "./tables-DimBcVWY.js";
 import { d as andConditions, l as collectGrants, o as assignableRoles, p as contextRefs, t as ownershipRules, u as roleNames } from "./ownership-qqBuGJXr.js";
 import { t as membershipSourcesOf } from "./sources-qoIJQrJv.js";
 import { n as pgConnector } from "./pg-DQTqRrou.js";
-import { m as tableFor, t as canFixture } from "./verify-CHQgLrtS.js";
+import { m as tableFor, t as canFixture } from "./verify-DfT0QYNh.js";
 import { resolve } from "node:path";
 //#region src/cli/powersync/names.ts
 function ident(name) {

package/dist/{powersync-COjQTHRD.js → powersync-DAfo0EL5.js}

@@ -14,7 +14,7 @@ const generate = defineLeaf({
 	async run(ctx, { flags }) {
 		const out = fileOut("powersync", flags.out);
 		const from = given(flags.policy);
-		const { runPowerSync } = await import("./powersync-k8lUeC37.js");
+		const { runPowerSync } = await import("./powersync-0QVP_DuR.js");
 		return runPowerSync({
 			cwd: ctx.cwd,
 			config: ctx.config,
@@ -45,7 +45,7 @@ const verify = defineLeaf({
 		const db = await dbUrl(ctx, flags, { required: true });
 		const fixtures = given(flags.fixtures);
 		const from = given(flags.policy);
-		const { runPowerSync } = await import("./powersync-k8lUeC37.js");
+		const { runPowerSync } = await import("./powersync-0QVP_DuR.js");
 		return runPowerSync({
 			cwd: ctx.cwd,
 			config: ctx.config,

package/dist/pull-CCAChKuy.js

@@ -0,0 +1 @@
+export { n as runCloudPull } from "./pull-CQCGy1gv.js";

package/dist/{pull-Er4aBHlL.js → pull-CQCGy1gv.js}

@@ -7,7 +7,7 @@ import { o as formatCatalogJson } from "./catalog-doc-DjMKzJp9.js";
 import { t as catalogPath } from "./catalog-path-CnI0XTFK.js";
 import { n as parseSupabaseManifest } from "./manifest-BXTbHNIV.js";
 import { t as parseCatalog } from "./parse-1_ZheTW5.js";
-import { a as nonEmptyOr } from "./output-3iB3_Hfg.js";
+import { a as nonEmptyOr } from "./output-DlICTjBh.js";
 import { t as POLICY_NOT_PUBLISHED } from "./problem-types-DSsRfONQ.js";
 import { n as httpRequest, t as authFailure } from "./http-DOL33cO0.js";
 import { l as cloudUrl, n as cliRuntime, o as readAuth } from "./auth--yPyZNgr.js";

package/dist/react-native/index.d.ts

@@ -124,6 +124,19 @@ type PowerSyncSourceOptions<Q extends string> = {
  * as an argument; `permdock/react-native` never imports `@powersync/*`.
  */
 export declare function powerSyncSource<Q extends string>(db: PowerSyncWatchable, options: PowerSyncSourceOptions<Q>): SnapshotSource;
+/** `powerSyncSource` over one database, memoised per manifest and options. */
+type PowerSyncSourceCache = {
+  readonly source: <Q extends string>(options: PowerSyncSourceOptions<Q>) => SnapshotSource;
+};
+/**
+ * A cache of `powerSyncSource` sources over `db`. `source` answers the same
+ * source for the same `manifest` object and, with `user`, the same `user`,
+ * `tenant` and `attributes` content, or, with `queries`, the same `queries` and
+ * `read` objects. A render that rebuilds its options then keeps the source, so
+ * `PermDockProvider` neither resubscribes nor rereads. Entries live as long as
+ * their manifest; create one cache per database, outside render.
+ */
+export declare function powerSyncSourceCache(db: PowerSyncWatchable): PowerSyncSourceCache;
 //#endregion
 //#region src/react-native/provider.d.ts
 export declare function PermDockProvider(props: ReactNativePermDockProviderProps): ReactElement;
@@ -209,4 +222,4 @@ type NativeStoreOptions = Omit<ReactNativePermDockProviderProps, "children" | "h
 export declare function connectSource(store: ClientStore, source: SnapshotSource, subscribeForeground?: SubscribeForeground): () => void;
 export declare function nativeStore(options: NativeStoreOptions): ClientStore;
 //#endregion
-export { type ActionResult, type AppStateModule, type ApprovalHandle, type ApprovalState, type ClientPermDock, type ClientStatus, type EventSourceRefreshOptions, type FilterResult, type GateMode, type GateView, type LocalMembershipRows, type LocalRowColumn, type LocalRowValue, type LocalSnapshotData, type LocalSnapshotManifest, type LocalSnapshotOptions, type LocalSnapshotRows, type MmkvInstance, type NativeRevalidate, type NetInfoModule, type PermDockDefaults, type PermissionSet, type PermissionState, type PowerSyncQuery, type PowerSyncSourceOptions, type PowerSyncWatchable, Protected, type ProtectedAction, type ProtectedActionHandle, type ProtectedActionView, type ProtectedProps, type ReactNativePermDockProviderProps, type RefreshTrigger, type RolesOptions, type SecureStoreModule, type SnapshotSource, type SnapshotStorage, type SubjectView, type SubscribeForeground, type SubscribeOnline, type TenantView, approvalHeaders, describe, eventSourceRefresh, parseLocalSnapshotManifest, requiredPlans, useApproval, useAssignablePermissions, useAssignableRoles, useDescribe, useFilter, useGate, useMemberships, usePermDock, usePermission, usePermissions, useProtectedAction, useRoles, useSubject, useTenant };
+export { type ActionResult, type AppStateModule, type ApprovalHandle, type ApprovalState, type ClientPermDock, type ClientStatus, type EventSourceRefreshOptions, type FilterResult, type GateMode, type GateView, type LocalMembershipRows, type LocalRowColumn, type LocalRowValue, type LocalSnapshotData, type LocalSnapshotManifest, type LocalSnapshotOptions, type LocalSnapshotRows, type MmkvInstance, type NativeRevalidate, type NetInfoModule, type PermDockDefaults, type PermissionSet, type PermissionState, type PowerSyncQuery, type PowerSyncSourceCache, type PowerSyncSourceOptions, type PowerSyncWatchable, Protected, type ProtectedAction, type ProtectedActionHandle, type ProtectedActionView, type ProtectedProps, type ReactNativePermDockProviderProps, type RefreshTrigger, type RolesOptions, type SecureStoreModule, type SnapshotSource, type SnapshotStorage, type SubjectView, type SubscribeForeground, type SubscribeOnline, type TenantView, approvalHeaders, describe, eventSourceRefresh, parseLocalSnapshotManifest, requiredPlans, useApproval, useAssignablePermissions, useAssignableRoles, useDescribe, useFilter, useGate, useMemberships, usePermDock, usePermission, usePermissions, useProtectedAction, useRoles, useSubject, useTenant };

package/dist/react-native/index.js

@@ -603,6 +603,51 @@ function powerSyncSource(db, options) {
 		}
 	};
 }
+/**
+* A cache of `powerSyncSource` sources over `db`. `source` answers the same
+* source for the same `manifest` object and, with `user`, the same `user`,
+* `tenant` and `attributes` content, or, with `queries`, the same `queries` and
+* `read` objects. A render that rebuilds its options then keeps the source, so
+* `PermDockProvider` neither resubscribes nor rereads. Entries live as long as
+* their manifest; create one cache per database, outside render.
+*/
+function powerSyncSourceCache(db) {
+	const byManifest = /* @__PURE__ */ new WeakMap();
+	return Object.freeze({ source: (options) => {
+		let entries = byManifest.get(options.manifest);
+		if (entries === void 0) {
+			entries = {
+				rows: /* @__PURE__ */ new Map(),
+				custom: /* @__PURE__ */ new WeakMap()
+			};
+			byManifest.set(options.manifest, entries);
+		}
+		if ("user" in options) {
+			const key = JSON.stringify([
+				options.user,
+				options.tenant ?? null,
+				options.attributes ?? null
+			]);
+			let source = entries.rows.get(key);
+			if (source === void 0) {
+				source = powerSyncSource(db, options);
+				entries.rows.set(key, source);
+			}
+			return source;
+		}
+		let byRead = entries.custom.get(options.queries);
+		if (byRead === void 0) {
+			byRead = /* @__PURE__ */ new WeakMap();
+			entries.custom.set(options.queries, byRead);
+		}
+		let source = byRead.get(options.read);
+		if (source === void 0) {
+			source = powerSyncSource(db, options);
+			byRead.set(options.read, source);
+		}
+		return source;
+	} });
+}
 //#endregion
 //#region src/react-native/storage.ts
 const SNAPSHOT_KEY = "permdock.snapshot";
@@ -1081,4 +1126,4 @@ function netInfoOnline(netInfo) {
 	});
 }
 //#endregion
-export { PermDockProvider, Protected, appStateForeground, approvalHeaders, buildLocalSnapshot, connectSource, describe, eventSourceRefresh, localSnapshot, memorySnapshotStorage, mmkvStorage, nativeStore, netInfoOnline, parseLocalSnapshotManifest, powerSyncSource, requiredPlans, secureStoreStorage, useApproval, useAssignablePermissions, useAssignableRoles, useDescribe, useFilter, useGate, useMemberships, usePermDock, usePermission, usePermissionGuard, usePermissions, useProtectedAction, useRoles, useSnapshotReady, useSubject, useTenant };
+export { PermDockProvider, Protected, appStateForeground, approvalHeaders, buildLocalSnapshot, connectSource, describe, eventSourceRefresh, localSnapshot, memorySnapshotStorage, mmkvStorage, nativeStore, netInfoOnline, parseLocalSnapshotManifest, powerSyncSource, powerSyncSourceCache, requiredPlans, secureStoreStorage, useApproval, useAssignablePermissions, useAssignableRoles, useDescribe, useFilter, useGate, useMemberships, usePermDock, usePermission, usePermissionGuard, usePermissions, useProtectedAction, useRoles, useSnapshotReady, useSubject, useTenant };

package/dist/{rls-DjjOHlKE.js → rls-C5ZGzR_B.js}

@@ -192,7 +192,7 @@ async function rlsInput(ctx, verb, shape, options) {
 	};
 }
 async function runRls(input) {
-	return (await import("./rls-DY3Fc18U.js")).runRls(input);
+	return (await import("./rls-tHu7N_Pe.js")).runRls(input);
 }
 const generate = defineLeaf({
 	flags: {

package/dist/{rls-DY3Fc18U.js → rls-tHu7N_Pe.js}

@@ -11,10 +11,10 @@ import "./sources-C4vkzZJV.js";
 import { t as policyFromCatalog } from "./policy-from-catalog-CU3An8uP.js";
 import { t as beforeFirst } from "./text-BMFRfBqc.js";
 import { i as INDEXES_MARKER, n as GRANTS_MARKER, o as SEEDS_MARKER, t as BACKFILL_MARKER } from "./markers-BeHZ4x9Q.js";
-import { a as nonEmptyOr } from "./output-3iB3_Hfg.js";
+import { a as nonEmptyOr } from "./output-DlICTjBh.js";
 import { i as requirePeer, n as packageManagerOf, t as addLine } from "./peer-Q0fuZ6hx.js";
 import { t as POLICY_NOT_PUBLISHED } from "./problem-types-DSsRfONQ.js";
-import { t as fetchProjectPolicy } from "./pull-Er4aBHlL.js";
+import { t as fetchProjectPolicy } from "./pull-CQCGy1gv.js";
 import { n as MIGRATION_DIRS } from "./constants-DcJABbLW.js";
 import { a as isSeedsDirectory, c as parseSplit, d as seedsMigration, f as writeOutputFiles, l as partPath, n as dataMigrationFile, r as driftOf, u as pgDeltaPath } from "./output-files-BIQ_9pIs.js";
 import { b as rbacScaffold, d as resolveSchemas, f as schemasRefusal, o as supabaseHookSql, p as declarativeSql, s as approvalsSql, t as grantsLabel, u as isSupabaseSchemas, y as parseRbacAuthorize } from "./supabase-hook-HPgwYb9V.js";
@@ -25,8 +25,8 @@ import { a as splitUndiffed } from "./deciding-columns-NB4wcyBf.js";
 import { t as connectPgPool } from "./pg-DQTqRrou.js";
 import { a as fieldViewsSql, c as ACTOR_MAY_WRITE, f as readOnlyActorKinds, i as fieldViews, l as actorMayWriteSql, n as columnGrantSql, o as rowBranches, p as readOnlyActorPolicies, r as columnRevokeSql, u as assemblePolicies } from "./fields-DI8s3cPl.js";
 import { n as permissionHoldersSql } from "./resolve-names-Y1Cb22cp.js";
-import { _ as indexTargets, a as verifyResult, b as readTableIndexFacts, c as callsHelper, g as INDEX_COLUMNS_SQL, h as COLUMNS_SQL, i as verifyIgnores, l as helperCallKeys, m as tableFor, n as runRlsVerify, o as HELPER_TABLES, p as compileGrants, r as rlsFinding, v as indexesSql, y as pruneIndexTargets } from "./verify-CHQgLrtS.js";
-import { a as buildContext, c as levelKeys, d as rebuildPlan, i as splitsPart, l as rowHelpersSql, n as generateOptions, o as CANDIDATES, r as isRefusal, s as inheritTargets, t as supautilsRejections, u as DROPPED_LIST } from "./supautils-DZ95xxW-.js";
+import { _ as indexTargets, a as verifyResult, b as readTableIndexFacts, c as callsHelper, g as INDEX_COLUMNS_SQL, h as COLUMNS_SQL, i as verifyIgnores, l as helperCallKeys, m as tableFor, n as runRlsVerify, o as HELPER_TABLES, p as compileGrants, r as rlsFinding, v as indexesSql, y as pruneIndexTargets } from "./verify-DfT0QYNh.js";
+import { a as buildContext, c as levelKeys, d as rebuildPlan, i as splitsPart, l as rowHelpersSql, n as generateOptions, o as CANDIDATES, r as isRefusal, s as inheritTargets, t as supautilsRejections, u as DROPPED_LIST } from "./supautils-SwE642N1.js";
 import { readFileSync } from "node:fs";
 import { basename, delimiter, join } from "node:path";
 import { spawn } from "node:child_process";

package/dist/run-C5P3x1EI.js

@@ -0,0 +1 @@
+export { t as run } from "./run-DUq1xU4K.js";

package/dist/{run-BlxXmaDS.js → run-DUq1xU4K.js}

@@ -1,13 +1,13 @@
 import { i as dateAt } from "./time-nR1JesoH.js";
 import { a as describeError, l as problemOf, n as CliError, r as cliProblem, s as kindOfCode } from "./errors-Vpu6rKHl.js";
 import { s as cliVersion } from "./version-DMQ0dnN5.js";
-import { a as resolveCwd, i as readConfig } from "./config-ZZdtyQZy.js";
+import { a as resolveCwd, i as readConfig } from "./config-CcLlvEYW.js";
 import { t as beforeFirst } from "./text-BMFRfBqc.js";
 import { a as suggestion, i as parseLeaf, n as flagSpellings, o as GLOBAL_FLAGS, r as parseFlags } from "./args-0FrVs5EH.js";
 import { r as progressReporter, t as redact } from "./credentials-CdDxp7jN.js";
-import { a as resolve, i as leaves, n as ROOT, r as SECTIONS, t as DOCS_BASE } from "./manifest-BWIR_EEB.js";
+import { a as resolve, i as leaves, n as ROOT, r as SECTIONS, t as DOCS_BASE } from "./manifest-Cft51TLK.js";
 import { t as createStyle } from "./style-Ds11Hmk4.js";
-import { i as githubAnnotations, n as envelope, o as sarifLog, t as dataOf } from "./output-3iB3_Hfg.js";
+import { i as githubAnnotations, n as envelope, o as sarifLog, t as dataOf } from "./output-DlICTjBh.js";
 import { i as renameMessage, r as flagRename, t as COMMAND_MOVES } from "./renames-CGj7YwcQ.js";
 import { stripVTControlCharacters } from "node:util";
 import { existsSync, statSync } from "node:fs";

package/dist/{scan-CR_xm71k.js → scan-C3HRH9Fs.js}

@@ -16,7 +16,7 @@ const scan = defineLeaf({
 		}
 	},
 	async run(ctx, { flags }) {
-		const { runAdoptionScan } = await import("./adoption-scan-BGtwGfoH.js");
+		const { runAdoptionScan } = await import("./adoption-scan-C2BCiUEG.js");
 		return runAdoptionScan({
 			cwd: ctx.cwd,
 			srcPath: flags.src.length > 0 ? flags.src : ctx.config.collect?.srcPath ?? ["src"],

package/dist/{schema-CnrIP94n.js → schema-DvXvxPhQ.js}

@@ -1,7 +1,7 @@
 import { r as isRecord } from "./compact-CAf557ZB.js";
 import { l as packageRoot } from "./version-DMQ0dnN5.js";
 import { t as DRAFT_PINS } from "./pins-nqarl3oE.js";
-import { a as nonEmptyOr } from "./output-3iB3_Hfg.js";
+import { a as nonEmptyOr } from "./output-DlICTjBh.js";
 import { t as require__2020 } from "./2020-CJbO8Bvz.js";
 import { readFileSync } from "node:fs";
 import { join } from "node:path";

package/dist/{skills-uzsVqEi9.js → skills-B2qTbaQa.js}

@@ -1,7 +1,7 @@
 import { t as defineLeaf } from "./command-L8EstFNm.js";
 import { t as checkFlag } from "./flags-DXjoTVbS.js";
 import { r as pick, t as CANCELLED } from "./prompt-BYc6drYW.js";
-import { n as detectedAgents, r as runSkills, t as SKILL_AGENTS } from "./skills-CY-MY_Oj.js";
+import { n as detectedAgents, r as runSkills, t as SKILL_AGENTS } from "./skills-Celu2W6v.js";
 //#region src/cli/commands/skills.ts
 const forFlag = { for: {
 	type: "string",

package/dist/{skills-CY-MY_Oj.js → skills-Celu2W6v.js}

@@ -2,7 +2,7 @@ import { t as byCodePoint } from "./compare-DTfyUunF.js";
 import { i as readJsonFile } from "./files-BSjrtIHw.js";
 import { l as packageRoot } from "./version-DMQ0dnN5.js";
 import { t as didYouMean } from "./args-0FrVs5EH.js";
-import { a as nonEmptyOr } from "./output-3iB3_Hfg.js";
+import { a as nonEmptyOr } from "./output-DlICTjBh.js";
 import { cpSync, existsSync, lstatSync, mkdirSync, readFileSync, readdirSync, readlinkSync, realpathSync, writeFileSync } from "node:fs";
 import { basename, dirname, join, relative, resolve } from "node:path";
 import { pathToFileURL } from "node:url";

package/dist/{supautils-DZ95xxW-.js → supautils-SwE642N1.js}

@@ -16,7 +16,7 @@ import { t as membershipSourcesOf } from "./sources-qoIJQrJv.js";
 import { i as group, o as sqlStatements } from "./deciding-columns-NB4wcyBf.js";
 import { d as orSql, h as branchClauses } from "./fields-DI8s3cPl.js";
 import { t as resolveNames } from "./resolve-names-Y1Cb22cp.js";
-import { m as tableFor } from "./verify-CHQgLrtS.js";
+import { m as tableFor } from "./verify-DfT0QYNh.js";
 //#region src/cli/rls/custom-role-rebuild.ts
 const PREFIX = "PermDock CLI";
 /** A column of the roles-table row `r`. */
@@ -199,8 +199,8 @@ const DROPPED_LIST = `(select string_agg(g.role || ': ' || g.items, '; ' order b
 * shared role holds is skipped with a warning (`name-taken`). Before-row
 * triggers hold a signed-in caller at trigger depth 1 to the checks of
 * `permdock_replace_custom_role_grants`: `permdock_custom_role_guard` on each
-* role the row names, then `permdock_custom_role_beyond` on the entry it adds;
-* a refusal aborts the write.
+* role the row names, the entry it adds against the ceiling, then
+* `permdock_custom_role_beyond` on that entry; a refusal aborts the write.
 */
 function customRoleSyncSql(ctx, from, migrate) {
 	const plan = rebuildPlan(ctx, from, migrate);
@@ -305,6 +305,17 @@ begin
     end if;
     v_dropped := '{}'::text[];
 ${plan.collectNew[name]}
+    if cardinality(v_dropped) > 0 then
+      raise exception using
+        errcode = '22023',
+        message = 'permdock: ' || v_dropped[1],
+        hint = case
+          when v_dropped[1] like '%outside the ceiling of %' then 'outside-ceiling'
+          when v_dropped[1] like '%, level % is not declared' then 'unknown-level'
+          when v_dropped[1] like '%, not a declared role' then 'unknown-role'
+          else 'unknown-permission'
+        end;
+    end if;
     select string_agg(b, ', ' order by b) into v_beyond
     from ${beyond}(v.tenant_id, v.scope, v.scope_id, v_allow, v_deny, v_include) b;
     if v_beyond is not null then
@@ -389,10 +400,11 @@ function permissionCase(key, branches) {
 	const granted = `coalesce((${allow}), false)`;
 	return `    when ${quoteLiteral(key)} then ${deny === void 0 ? granted : `${granted} and (${deny}) is not true`}`;
 }
-function forUserSql(ctx, fn, helper) {
+function forUserSql(ctx, fn, helper, ids) {
 	const user = ctx.dialect === "supabase" ? "uuid" : "text";
-	const signature = `${user}, text, jsonb`;
-	const head = `create or replace function ${fn}(p_user ${user}, p_permission text, p_claims jsonb default '{}')
+	const signature = `${user}, text, ${ids ? "text[], " : ""}jsonb`;
+	const call = `${helper}(p_permission${ids ? ", p_ids" : ""})`;
+	const head = `create or replace function ${fn}(p_user ${user}, p_permission text, ${ids ? "p_ids text[], " : ""}p_claims jsonb default '{}')
 returns setof text
 language plpgsql
 volatile
@@ -409,7 +421,7 @@ begin
     (coalesce(p_claims, '{}'::jsonb) || pg_catalog.jsonb_build_object('sub', p_user::text, 'role', 'authenticated'))::text,
     true
   );
-  return query select r.id from ${helper}(p_permission) r(id);
+  return query select r.id from ${call} r(id);
   perform pg_catalog.set_config('request.jwt.claims', coalesce(v_claims, ''), true);
 end
 $$;
@@ -429,7 +441,7 @@ begin
     v_saved := v_saved || pg_catalog.jsonb_build_object(v_key, coalesce(pg_catalog.current_setting(${quoteLiteral(`${prefix}.`)} || v_key, true), ''));
     perform pg_catalog.set_config(${quoteLiteral(`${prefix}.`)} || v_key, v_value, true);
   end loop;
-  return query select r.id from ${helper}(p_permission) r(id);
+  return query select r.id from ${call} r(id);
   for v_key, v_value in select s.key, s.value from pg_catalog.jsonb_each_text(v_saved) s loop
     perform pg_catalog.set_config(${quoteLiteral(`${prefix}.`)} || v_key, v_value, true);
   end loop;
@@ -540,7 +552,8 @@ ${rowSql(ctx, name, table, near)}`;
 	if (ctx.dialect === "neon") return rows;
 	return `${rows}
 -- the same rows for a user the caller names, with claims it supplies; no client role may execute it
-${forUserSql(ctx, qualified(ctx, `${name}_for`), fn)}`;
+${forUserSql(ctx, qualified(ctx, `${name}_for`), fn, false)}
+${forUserSql(ctx, qualified(ctx, `${name}_for`), fn, true)}`;
 }
 /**
 * `permitted_<resource>_rows(p_permission)` for each resource `select` names

package/dist/unplugin/index.js

@@ -1,4 +1,4 @@
-import { n as createCollectScheduler, r as report } from "../watch-CTfSlIGD.js";
+import { n as createCollectScheduler, r as report } from "../watch-DAkjm75Y.js";
 import { r as peerHint } from "../peer-Q0fuZ6hx.js";
 import { createRequire } from "node:module";
 //#region src/unplugin/index.ts

package/dist/{usage-WYRc7Kqg.js → usage-CPXeuAdT.js}

@@ -6,8 +6,8 @@ import { c as jsonSchemaOf } from "./catalog-doc-DjMKzJp9.js";
 import { a as loadModule, n as asPolicy, s as pickNamed } from "./load-DjSU5KXO.js";
 import { r as runCollect } from "./collect-WCl8cJQV.js";
 import { t as beforeFirst } from "./text-BMFRfBqc.js";
-import { t as DOCS_BASE } from "./manifest-BWIR_EEB.js";
-import { r as findingOf } from "./output-3iB3_Hfg.js";
+import { t as DOCS_BASE } from "./manifest-Cft51TLK.js";
+import { r as findingOf } from "./output-DlICTjBh.js";
 import { existsSync, readFileSync, realpathSync } from "node:fs";
 import { dirname, resolve } from "node:path";
 import { fileURLToPath, pathToFileURL } from "node:url";

package/dist/{usage-Dm2hn0pS.js → usage-CfZCQd0F.js}

@@ -16,7 +16,7 @@ const usage = defineLeaf({
 		}
 	},
 	async run(ctx, { flags }) {
-		return (await import("./usage-CH7oISI6.js")).runUsage({
+		return (await import("./usage-DmmO_xjJ.js")).runUsage({
 			cwd: ctx.cwd,
 			config: ctx.config,
 			ignore: flags.ignore,

package/dist/usage-DmmO_xjJ.js

@@ -0,0 +1 @@
+export { t as runUsage } from "./usage-CPXeuAdT.js";

package/dist/{verify-CHQgLrtS.js → verify-DfT0QYNh.js}

@@ -22,7 +22,7 @@ import { i as qualifySqlTable, n as defaultSqlCommand, t as SQL_IDENT } from "./
 import { a as scopeMembershipTable, i as scopeColumn } from "./compile-EzEMB-7v.js";
 import "./sources-C4vkzZJV.js";
 import { t as beforeFirst } from "./text-BMFRfBqc.js";
-import { t as DOCS_BASE } from "./manifest-BWIR_EEB.js";
+import { t as DOCS_BASE } from "./manifest-Cft51TLK.js";
 import { n as fixtureSubject, r as loadFixtures, t as fixtureRow } from "./fixtures-Bm4_K1ke.js";
 import { A as quoteQualified, N as arrayColumnsOf, O as quoteIdent, P as columnTypesOf, _ as subjectClaimJsonSql, a as customRolesOn, j as quoteTable, k as quoteLiteral, r as HELPERS, v as subjectClaimSql } from "./shared-DrGLwM3s.js";
 import { C as accessSql, D as tokenScopeAllowsCall, S as requiresSql, ht as scopeTable, k as capabilityAccessSql, n as tableNameOf, o as graphPlan, q as apiKeyAllowsCall, r as tableNames } from "./tables-DimBcVWY.js";

package/dist/watch-CuPz0D2M.js

@@ -0,0 +1 @@
+export { i as watchCollect } from "./watch-DAkjm75Y.js";

package/dist/{watch-CTfSlIGD.js → watch-DAkjm75Y.js}

@@ -2,7 +2,7 @@ import { i as dateAt } from "./time-nR1JesoH.js";
 import { a as describeError } from "./errors-Vpu6rKHl.js";
 import { t as defaultSrcPath } from "./files-BSjrtIHw.js";
 import { r as runCollect } from "./collect-WCl8cJQV.js";
-import { n as isConfigFile, r as loadConfig } from "./config-ZZdtyQZy.js";
+import { n as isConfigFile, r as loadConfig } from "./config-CcLlvEYW.js";
 import { watch } from "node:fs";
 import { basename, dirname, relative, resolve, sep } from "node:path";
 //#region src/cli/watch.ts

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "permdock",
-  "version": "0.14.0",
+  "version": "0.16.0",
   "description": "Typed permissions for TypeScript apps, APIs, databases, and AI agents, with the permdock CLI and test runners.",
   "keywords": [
     "ai-agents",

package/skills/permdock-data/references/queries-and-rls.md

@@ -36,7 +36,7 @@ pnpm exec permdock rls verify --introspect
 ```
 
 - List the scope instances a permission reaches in process with `permdock.permittedIds(permission, scope, { within })`, never a loop of `can` over memberships with a made-up row.
-- Generated policies call `permdock_has('<key>')` and one `permitted_<scope>_ids('<key>')` per declared scope, which Postgres runs once per statement. Hand-written policies that only need membership (an organization switcher) call `member_<scope>_ids()` instead of inventing a permission key. A policy that passes a user id, such as better-supabase's team sharing, calls `member_team_ids_of(<user>)` on Supabase: it answers only when the id is the caller's. Trusted SQL that acts for a stored user (a job, a trigger, a deferred approval) calls `permdock_has_for(p_user, '<key>')` and `permitted_<scope>_ids_for(p_user, '<key>')` in `database` mode, or the generated `permitted_<resource>_rows_for`, never a hand-written function that rewrites `request.jwt.claims`. With `rls.rowHelpers`, a hand-written policy or function that needs the rows a permission reaches through the graph calls `permitted_<resource>_rows('<permission key>')` instead of restating closure walks, link hops and `includes`. A table's own `select` or `insert` policy calls the row-valued `permitted_<resource>_row(<table>, '<permission key>')` instead, so `insert ... returning` sees the new row. A function that checks a known set of rows (one tenant's, a page, a batch) calls `permitted_<resource>_rows('<permission key>', <text[] of ids>)`, which reads only those ids, instead of the one-argument form, which reads the whole table, or a `permitted_<resource>_row` call per row. Hand-written policies and functions that apply no row condition call `permitted_<scope>_ids_by_permission('<permission key>')` or `permdock_has_permission('<permission key>')` instead of spelling a positional `#n` grant key. A screen or RPC that checks many permissions on one organization calls `permitted_<scope>_permission_keys(<id>)` once (or `(<id>, array['<key>', ...])` for a few keys) instead of one helper call per key. A role editor or admin screen lists a role's keys with `permdock_role_permissions(p_role, p_scope, p_tenant, p_scope_id)` (declared roles, and custom roles of the caller's tenant in `database` mode) and the catalog with `permdock_permission_keys()` (`permdock_permission_keys('<scope>')` for the keys a role on that scope can hold), instead of joining `role_permissions` and the custom-role tables by hand; server code reads any tenant's roles with `permdock_trusted_role_permissions`, granted through `rls.trustedReaders`. Set `--tenant-type` (or `rls.scopeTypes`, keyed by scope name or `tenant` and `team`) to the scope columns' types.
+- Generated policies call `permdock_has('<key>')` and one `permitted_<scope>_ids('<key>')` per declared scope, which Postgres runs once per statement. Hand-written policies that only need membership (an organization switcher) call `member_<scope>_ids()` instead of inventing a permission key. A policy that passes a user id, such as better-supabase's team sharing, calls `member_team_ids_of(<user>)` on Supabase: it answers only when the id is the caller's. Trusted SQL that acts for a stored user (a job, a trigger, a deferred approval) calls `permdock_has_for(p_user, '<key>')` and `permitted_<scope>_ids_for(p_user, '<key>')` in `database` mode, or the generated `permitted_<resource>_rows_for` (`permitted_<resource>_rows_for(p_user, '<key>', <text[] of ids>)` for a known set of rows, such as a share link checked against its creator's access), never a hand-written function that rewrites `request.jwt.claims`. With `rls.rowHelpers`, a hand-written policy or function that needs the rows a permission reaches through the graph calls `permitted_<resource>_rows('<permission key>')` instead of restating closure walks, link hops and `includes`. A table's own `select` or `insert` policy calls the row-valued `permitted_<resource>_row(<table>, '<permission key>')` instead, so `insert ... returning` sees the new row. A function that checks a known set of rows (one tenant's, a page, a batch) calls `permitted_<resource>_rows('<permission key>', <text[] of ids>)`, which reads only those ids, instead of the one-argument form, which reads the whole table, or a `permitted_<resource>_row` call per row. Hand-written policies and functions that apply no row condition call `permitted_<scope>_ids_by_permission('<permission key>')` or `permdock_has_permission('<permission key>')` instead of spelling a positional `#n` grant key. A screen or RPC that checks many permissions on one organization calls `permitted_<scope>_permission_keys(<id>)` once (or `(<id>, array['<key>', ...])` for a few keys) instead of one helper call per key. A role editor or admin screen lists a role's keys with `permdock_role_permissions(p_role, p_scope, p_tenant, p_scope_id)` (declared roles, and custom roles of the caller's tenant in `database` mode) and the catalog with `permdock_permission_keys()` (`permdock_permission_keys('<scope>')` for the keys a role on that scope can hold), instead of joining `role_permissions` and the custom-role tables by hand; server code reads any tenant's roles with `permdock_trusted_role_permissions`, granted through `rls.trustedReaders`. Set `--tenant-type` (or `rls.scopeTypes`, keyed by scope name or `tenant` and `team`) to the scope columns' types.
 - `--authorize database` (default) reads the membership tables per statement; map each under `rls.memberships.scopes.<scope>` with `columns` for its id and its ancestors', and `via` so roles with `for` apply: a column name, or `{ value: 'staff' }` when every row has that kind (never add a generated column for it). `--authorize jwt` reads token claims and stays stale until the token refreshes; keep the token lifetime at 3600 seconds or less (PD019).
 - When the role column holds values that are not role keys, give the membership source `role: { column, map: { value: 'role' } }`; a value mapped to `null` grants nothing. `permdock rls explain` prints the tables, membership sources, custom roles table and triggers a generate run binds to, without writing a file. `rls.seeds: 'function'` writes the `role_permissions` rows as `<schema>.seed()` instead of inserts; run `select <schema>.seed();` after each deploy, and PD054 checks the function body.
 - `rls verify --introspect` checks each `security definer` helper by its full signature, so every overload is checked on its own. A helper finding id names the signature (`helper-definer:permdock.permdock_has(text):helper`); write `rls.verify.ignore` entries with it.

package/dist/powersync-k8lUeC37.js

@@ -1 +0,0 @@
-export { n as runPowerSync } from "./powersync-DVbskWD9.js";

package/dist/pull-BY1METGf.js

@@ -1 +0,0 @@
-export { n as runCloudPull } from "./pull-Er4aBHlL.js";

package/dist/run-DGSLvGty.js

@@ -1 +0,0 @@
-export { t as run } from "./run-BlxXmaDS.js";

package/dist/usage-CH7oISI6.js

@@ -1 +0,0 @@
-export { t as runUsage } from "./usage-WYRc7Kqg.js";

package/dist/watch-C44FtM79.js

@@ -1 +0,0 @@
-export { i as watchCollect } from "./watch-CTfSlIGD.js";