permdock 0.15.0 → 0.17.0

package/dist/{who-can-BoDJm0Nc.js → who-can-BY5d3HPw.js}

@@ -5,12 +5,12 @@ import { n as internalsOf } from "./internals-B3IgHrvo.js";
 import { a as getResource } from "./permission-registry-B8tYxPIt.js";
 import { a as expandRelation, c as isEdgeRelation, l as isFieldRelation, u as isPrincipalRelation } from "./resource-relations-8-pCScBO.js";
 import { s as instantAt } from "./time-nR1JesoH.js";
-import { f as scopeList, l as rootScope, o as normalizeMemberships, s as resolveScope } from "./scopes-0Up_UA2t.js";
+import { c as rootScope, d as scopeList, o as normalizeMemberships, s as resolveScope } from "./scopes-BSdYaGHs.js";
 import { o as flattenGrantee } from "./grantee-Dke-9rd1.js";
 import { t as byCodePoint } from "./compare-DTfyUunF.js";
-import { r as relationCondition } from "./grantee-conditions-BrYPe-w0.js";
-import { c as nowSeconds, p as scopeField } from "./tenancy-5d1zVBvK.js";
-import { D as emptyListeners, t as evaluate } from "./evaluate-BAmf_AQd.js";
+import { r as relationCondition } from "./grantee-conditions-DX4K_gGI.js";
+import { c as nowSeconds, p as scopeField } from "./tenancy-DvOHHk3-.js";
+import { D as emptyListeners, t as evaluate } from "./evaluate-CsjXeLRo.js";
 import { n as relationId, t as pendingRelations } from "./relations-BxvRvDHK.js";
 import { t as relationWalk } from "./relation-walk-DK_gkgL7.js";
 //#region src/core/who-can.ts

package/dist/workflow/index.d.ts

@@ -1,5 +1,5 @@
-import { a as AutomationSource, i as AutomationRequest, l as memoryAutomationSource, n as AutomationDecision, r as AutomationMode, s as MemoryAutomationSource, t as Automation, u as parseAutomation } from "../automation-C6Jg75xq.js";
-import { i as pollingApprovalWaiter, n as ApprovalWaiter, r as PollingApprovalWaiterOptions, t as ApprovalWaitOptions } from "../waiter-CqUKX6CY.js";
-import { a as WorkflowPermDockOptions, i as WorkflowPermDock, n as AwaitApprovalOptions, o as createPermDock, r as StartAutomationResult, t as AutomationOptions } from "../create-CDd9c22W.js";
+import { a as AutomationSource, i as AutomationRequest, l as memoryAutomationSource, n as AutomationDecision, r as AutomationMode, s as MemoryAutomationSource, t as Automation, u as parseAutomation } from "../automation-DCWuVKtd.js";
+import { i as pollingApprovalWaiter, n as ApprovalWaiter, r as PollingApprovalWaiterOptions, t as ApprovalWaitOptions } from "../waiter-C2cXXLFZ.js";
+import { a as WorkflowPermDockOptions, i as WorkflowPermDock, n as AwaitApprovalOptions, o as createPermDock, r as StartAutomationResult, t as AutomationOptions } from "../create-DrHUmKvG.js";
 import "../index-CaxrMD1A.js";
 export { type ApprovalWaitOptions, type ApprovalWaiter, type Automation, type AutomationDecision, type AutomationMode, type AutomationOptions, type AutomationRequest, type AutomationSource, type AwaitApprovalOptions, type MemoryAutomationSource, type PollingApprovalWaiterOptions, type StartAutomationResult, type WorkflowPermDock, type WorkflowPermDockOptions, createPermDock, memoryAutomationSource, parseAutomation, pollingApprovalWaiter };

package/dist/workflow/index.js

@@ -4,10 +4,10 @@ import { a as isId } from "../expiry-6XByK0dm.js";
 import { n as findPermission } from "../permission-registry-B8tYxPIt.js";
 import { n as isThenable } from "../thenable-BNSM1U2R.js";
 import { n as memoryAutomationSource, r as parseAutomation } from "../automation-x3KEUusw.js";
-import { l as withApp, t as getPermDock } from "../permdock-BvjivVb9.js";
+import { l as withApp, t as getPermDock } from "../permdock-DdzMv5-F.js";
 import { o as automationEvent } from "../sink-D9_vh372.js";
-import { a as requestApproval, s as resumeDecision } from "../helpers-DJicaG6f.js";
-import { i as subjectFromRunTicket, r as signRunTicket } from "../run-ticket-DfnZCh-u.js";
+import { a as requestApproval, s as resumeDecision } from "../helpers-DNnZffrI.js";
+import { i as subjectFromRunTicket, r as signRunTicket } from "../run-ticket-CjvXr6wj.js";
 import { t as pollingApprovalWaiter } from "../waiter-aBLM63_f.js";
 //#region src/workflow/create.ts
 function writeQuietly(sink, event) {
@@ -83,7 +83,8 @@ function createPermDock(policy, given) {
 				kind: "service",
 				tenant: current.tenant,
 				memberships: [{
-					tenant: current.tenant,
+					scope: "tenant",
+					id: current.tenant,
 					roles: current.roles ?? []
 				}]
 			});

package/dist/workflow-sdk/index.d.ts

@@ -1,8 +1,8 @@
-import { Un as Decision } from "../policy-types-DGIO_gxq.js";
+import { qn as Decision } from "../policy-types-IRJVABmm.js";
 import { u as Permission } from "../permission-types-CAY-GU7e.js";
-import { a as PermDock } from "../permdock-CprAPN3w.js";
-import { n as ApprovalWaiter } from "../waiter-CqUKX6CY.js";
-import { i as WorkflowPermDock, r as StartAutomationResult, t as AutomationOptions } from "../create-CDd9c22W.js";
+import { a as PermDock } from "../permdock-DUWZEOLR.js";
+import { n as ApprovalWaiter } from "../waiter-C2cXXLFZ.js";
+import { i as WorkflowPermDock, r as StartAutomationResult, t as AutomationOptions } from "../create-DrHUmKvG.js";
 //#region src/workflow-sdk/index.d.ts
 /**
  * The part of a Workflow SDK `Hook` the waiter reads: awaiting it suspends the

package/dist/{wrap-B2wziJI_.js → wrap-C5PWzgkq.js}

@@ -1,5 +1,5 @@
 import { n as internalsOf, t as attachInternals } from "./internals-B3IgHrvo.js";
-import { i as decideAllWith, n as canAllWith } from "./checks-CGkP3Z7A.js";
+import { i as decideAllWith, n as canAllWith } from "./checks-fyDOhcz0.js";
 //#region src/core/wrap.ts
 /**
 * A frozen copy of `permdock` with the members `overrides` returns replaced.

package/dist/{wrap-DxXB54Wu.d.ts → wrap-DpZAbxuD.d.ts}

@@ -1,5 +1,5 @@
-import { j as PolicyVocabulary } from "./policy-types-DGIO_gxq.js";
-import { a as PermDock } from "./permdock-CprAPN3w.js";
+import { M as PolicyVocabulary } from "./policy-types-IRJVABmm.js";
+import { a as PermDock } from "./permdock-DUWZEOLR.js";
 //#region src/core/wrap.d.ts
 /** A wrapper an adapter applies to each instance it builds, as `withOtel` does. */
 type PermDockWrap = <V extends PolicyVocabulary>(permdock: PermDock<V>) => PermDock<V>;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "permdock",
-  "version": "0.15.0",
+  "version": "0.17.0",
   "description": "Typed permissions for TypeScript apps, APIs, databases, and AI agents, with the permdock CLI and test runners.",
   "keywords": [
     "ai-agents",
@@ -243,6 +243,10 @@
       "types": "./dist/supabase/middleware.d.ts",
       "default": "./dist/supabase/middleware.js"
     },
+    "./supabase/client": {
+      "types": "./dist/supabase/client.d.ts",
+      "default": "./dist/supabase/client.js"
+    },
     "./ssf": {
       "types": "./dist/ssf/index.d.ts",
       "default": "./dist/ssf/index.js"
@@ -333,7 +337,6 @@
     "@orpc/contract": "2.0.0-beta.44",
     "@orpc/openapi": "2.0.0-beta.44",
     "@orpc/server": "2.0.0-beta.44",
-    "@permdock/ox-config": "0.0.0",
     "@permdock/typescript-config": "0.0.0",
     "@solidjs/start": "2.0.6",
     "@supabase/middleware": "1.0.0",
@@ -353,8 +356,8 @@
     "ajv": "8.20.0",
     "astro": "7.4.0",
     "babel-plugin-react-compiler": "1.0.0",
-    "better-supabase": "0.29.0",
-    "better-supabase-floor": "npm:better-supabase@0.29.0",
+    "better-supabase": "0.39.0",
+    "better-supabase-floor": "npm:better-supabase@0.39.0",
     "chat": "4.42.0",
     "diff": "9.0.0",
     "drizzle-orm": "1.0.0-rc.5-5935859",
@@ -411,7 +414,7 @@
     "@trpc/server": ">=11",
     "ai": ">=5",
     "astro": ">=5",
-    "better-supabase": ">=0.29.0",
+    "better-supabase": ">=0.39.0",
     "chat": ">=4",
     "drizzle-orm": ">=0.40 || >=1.0.0-rc.0",
     "elysia": ">=1",

package/schemas/approval-request-v1.json

@@ -102,6 +102,11 @@
     "consumedAt": {
       "$ref": "#/$defs/instant"
     },
+    "fingerprint": {
+      "type": "string",
+      "pattern": "^[0-9a-f]{64}$",
+      "description": "The approvalFingerprint the request was opened under; a resume under another one is refused."
+    },
     "x": {
       "type": "object",
       "description": "The application's own data, set when the request opens: plain JSON, never read by a decision."

package/schemas/catalog-v1.json

@@ -294,9 +294,19 @@
                   "type": "object",
                   "properties": {
                     "by": {},
-                    "mode": {
+                    "combine": {
                       "enum": ["any", "all", "sequential"]
                     },
+                    "mode": {
+                      "description": "confirm or authorize; a catalog written before 0.17 holds any, all or sequential here, read as combine.",
+                      "enum": [
+                        "confirm",
+                        "authorize",
+                        "any",
+                        "all",
+                        "sequential"
+                      ]
+                    },
                     "stages": {
                       "type": "array",
                       "items": {
@@ -312,6 +322,7 @@
                       }
                     },
                     "distinct": {
+                      "description": "Written before 0.17; false reads as mode: confirm.",
                       "type": "boolean"
                     },
                     "staleOn": {
@@ -425,9 +436,13 @@
                 "type": "object",
                 "properties": {
                   "by": {},
-                  "mode": {
+                  "combine": {
                     "enum": ["any", "all", "sequential"]
                   },
+                  "mode": {
+                    "description": "confirm or authorize; a catalog written before 0.17 holds any, all or sequential here, read as combine.",
+                    "enum": ["confirm", "authorize", "any", "all", "sequential"]
+                  },
                   "stages": {
                     "type": "array",
                     "items": {
@@ -443,6 +458,7 @@
                     }
                   },
                   "distinct": {
+                    "description": "Written before 0.17; false reads as mode: confirm.",
                     "type": "boolean"
                   },
                   "staleOn": {

package/schemas/cli-result-v1.json

@@ -64,8 +64,6 @@
             "unknown_command",
             "unknown_flag",
             "invalid_value",
-            "command_moved",
-            "flag_renamed",
             "missing_value",
             "config_not_found",
             "config_invalid",

package/schemas/snapshot-v1.json

@@ -9,6 +9,15 @@
     "v": { "const": 1 },
     "issuedAt": { "$ref": "#/$defs/instant" },
     "expiresAt": { "$ref": "#/$defs/instant" },
+    "authzVersion": {
+      "type": "integer",
+      "minimum": 0,
+      "description": "The token's authz_ver the snapshot was built from."
+    },
+    "sessionId": {
+      "type": "string",
+      "description": "The Auth session_id the snapshot was built for."
+    },
     "subject": {
       "type": "object",
       "required": ["principal", "context"],

package/skills/permdock-approvals/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: permdock-approvals
-description: Requires human approval on PermDock grants, notifies approvers and resumes the approved call. Use when adding approval to a destructive or money-moving action (delete, publish, pay, refund, transfer), choosing approvers with approval by, user(), relation(), distinct, quorum, ttl, escalation or staleOn, ordering approvers with mode and stages, covering an approver with an ApprovalDelegation, loading approval rules as data with an ApprovalPolicySource, separating preparer and approver with exclusiveWith, labelling operations with risk and effects meta, mounting approvalsHandler with an ApprovalStore, sending approval emails (approvalEmail) or chat cards (approvalCard, approvalActions) from approvalPrompt, parking a background run on an ApprovalWaiter (pollingApprovalWaiter, workflowSdkWaiter), resuming with the PermDock-Approval header, mapping approval-required to an agent runtime, MCP elicitation or AG-UI interrupt, or fixing doctor PD017, PD018 or PD024.
+description: Requires human approval on PermDock grants, notifies approvers and resumes the approved call. Use when adding approval to a destructive or money-moving action (delete, publish, pay, refund, transfer), choosing approvers with approval by, user(), relation(), manager(), mode confirm or authorize, quorum, ttl, escalation, staleOn or approvalFingerprint, ordering approvers with combine and stages, covering an approver with an ApprovalDelegation, loading approval rules as data with an ApprovalPolicySource, separating preparer and approver with exclusiveWith, labelling operations with risk and effects meta, mounting approvalsHandler with an ApprovalStore, sending approval emails (approvalEmail) or chat cards (approvalCard, approvalActions) from approvalPrompt, parking a background run on an ApprovalWaiter (pollingApprovalWaiter, workflowSdkWaiter), resuming with the PermDock-Approval header, mapping approval-required to an agent runtime, MCP elicitation or AG-UI interrupt, or fixing doctor PD017, PD018 or PD024.
 license: MIT
 metadata:
   author: ScaleDockHQ
@@ -25,12 +25,12 @@ metadata:
 
 ## Invariants
 
-1. The requester never approves by default. The actor is always refused. The principal is refused unless the grant sets `distinct: false`, and `requireDistinctApprover` on the handler refuses it even then. A delegate is held to the same rule, and so is the delegator. One hop, and `until` is required.
+1. The requester never approves by default. The actor is always refused. The principal is refused unless the grant sets `mode: "confirm"`, and `requireDistinctApprover` on the handler refuses it even then. A delegate is held to the same rule, and so is the delegator. One hop, and `until` is required.
 2. The approver comes from authentication on the approval surface, never from the request body, a tool argument or a link.
 3. One approval resumes one call. The token binds permission, resource, subject and actor, the resume re-runs `decide`, and `consume` spends the approval once.
 4. `can` returns `false` for `approval-required`. Only `decide`, `assert` and the adapters see the third outcome.
 5. Quorum, ttl and escalation live on the grant, not in the store. A grant's `ttl` can shorten the store's window, never extend it.
-6. A `relation()` approver is matched only through facts the approvals handler reads from the app's `RelationSource` at verdict time, never from a request body.
+6. A `relation()` or `manager()` approver is matched only through facts the approvals handler reads from the app's `RelationSource` at verdict time, never from a request body.
 7. Approval rules kept as data only add stages. A source that fails to load denies every call an allow would grant.
 8. A link never approves. An email or chat prompt carries the request id, never the token, and links to the app's approval page where the approver signs in. Chat buttons carry the request id and are applied as the platform-verified clicking user.
 9. A wake carries no verdict. `waiter.wake(token)` only ends a wait; the run decides again through `resumeApproval`, which reads the store.
@@ -51,9 +51,9 @@ metadata:
    });
    ```
 
-   For sign-off in order, use `mode: 'sequential'` with `stages: [{ by, quorum? }]` (or `mode: 'all'` for any order); one person signs one stage. `user('u_cfo')` names one person, and `relation(permissions.expense, 'manager')` names whoever holds the relation on the row.
-   Add `distinct: false` only where the user confirms their own agent's call and no money, deletion or access change sits behind it.
-   ✓ `permdock doctor` reports no PD017 (sensitive verb without approval), and every PD024 (`distinct: false`) is deliberate.
+   For sign-off in order, use `combine: 'sequential'` with `stages: [{ by, quorum? }]` (or `combine: 'all'` for any order); one person signs one stage. `user('u_cfo')` names one person, and `relation(permissions.expense, 'manager')` names whoever holds the relation on the row.
+   Add `mode: "confirm"` only where the user confirms their own agent's call and no money, deletion or access change sits behind it.
+   ✓ `permdock doctor` reports no PD017 (sensitive verb without approval), and every PD024 (`mode: "confirm"`) is deliberate.
 
 2. **Bind content when it matters.** Declare `version: 'updatedAt'` (or a revision counter) on the `resource()` and add `staleOn: 'resource-change'` to the approval, so a changed row resumes as `stale-approval` and asks again.
    ✓ `definePolicy` accepts the grant (it throws when the resource has no `version` or the action is a collection action).
@@ -77,12 +77,12 @@ metadata:
 ## Verify before done
 
 - [ ] Every destructive or money-moving action an agent or a user can trigger has `approval`, or a `deny` on the same leaf.
-- [ ] Each `distinct: false` (PD024) is a deliberate self-confirmation with nothing irreversible behind it.
+- [ ] Each `mode: "confirm"` (PD024) is a deliberate self-confirmation with nothing irreversible behind it.
 - [ ] Roles that must not be held together set `exclusiveWith`, and PD018 is clean.
 - [ ] The store survives the deployment: no `memoryApprovalStore` on serverless or across replicas.
 - [ ] No resume token is read from model output or tool arguments, and each resume re-runs `decide`.
 - [ ] A custom `ApprovalStore` passes `testApprovalStore` from `permdock/testing`.
-- [ ] Grants with `relation()` approvers have a handler with `relations`, and nothing fills `verdict.relations` from client input.
+- [ ] Grants with `relation()` or `manager()` approvers have a handler with `relations`, and nothing fills `verdict.relations` from client input.
 - [ ] No email, chat message or URL carries the approval token or an approve link; `approvalUrl` is https and opens a page behind sign-in.
 - [ ] Approval recipients are decided by `deliver` from server-loaded principals, never from the request body, and the requester is not among them.
 - [ ] Chat approve and reject clicks go through `approvalActions` (or `resolveAction`), never a handler that trusts the button value alone.

package/skills/permdock-approvals/references/stores-and-resume.md

@@ -15,7 +15,7 @@ export const { protect } = createPermDock(policy, { subject, store });
 // Routes for approvers: GET /pending, GET /mine, GET /:id, GET /:id/signature, POST /:id/approve, POST /:id/reject
 const handler = approvalsHandler(store, {
   subject: (request) => approverFromSession(request), // the approver, from real authentication
-  requireDistinctApprover: false, // true refuses the principal even where a grant sets distinct: false
+  requireDistinctApprover: false, // true refuses the principal even where a grant sets mode: "confirm"
   relations, // RelationSource: needed when a grant uses relation() approvers
   permissions, // the permission tree, for relation approvers reached through links
 });
@@ -73,7 +73,7 @@ A gate in your own code resumes the same way with `resumeDecision` from `permdoc
 
 Over HTTP, the client retries the same request with the `PermDock-Approval: <token>` header. In React, `approvalHeaders(token)` builds that header and `useApproval(decision)` requests and polls an approval from the UI.
 
-A bad resume is denied with detail `approval-not-found`, `approval-pending`, `approval-rejected`, `approval-expired`, `approval-consumed` or `approval-mismatch`; a changed row is `stale-approval`. `approvalsHandler` answers `403` for an ineligible approver (`approver-not-eligible`, the actor, or the principal without `distinct: false`) and `409` for a repeated one (`approver-repeated`).
+A bad resume is denied with detail `approval-not-found`, `approval-pending`, `approval-rejected`, `approval-expired`, `approval-consumed` or `approval-mismatch`; a changed row is `stale-approval`. `approvalsHandler` answers `403` for an ineligible approver (`approver-not-eligible`, the actor, or the principal without `mode: "confirm"`) and `409` for a repeated one (`approver-repeated`).
 
 ## Delegation
 
@@ -106,4 +106,8 @@ Send the prompt with `approvalPrompt` and `permdock/delivery`: `approvalEmail` f
 
 ## Approvers
 
-`by` takes roles, `user(id)`, `relation()`, `holder(permission)` and `anyOf(...)`. A list is all-of; use `anyOf(user(id), holder(permissions.x.approve))` for "this person or anyone who holds the permission". `holder()` needs `approvalsHandler(store, { permdockFor: (approver, request) => createPermDock(policy, approver, { customRoles }) })`, so custom roles count. Stages may carry their own `escalation`.
+`by` takes roles, `user(id)`, `relation()`, `manager({ levels? })` (whoever holds `manager` on the requester's `user` record, up to `levels` steps), `holder(permission)` and `anyOf(...)`. A list is all-of; use `anyOf(user(id), holder(permissions.x.approve))` for "this person or anyone who holds the permission". `holder()` needs `approvalsHandler(store, { permdockFor: (approver, request) => createPermDock(policy, approver, { customRoles }) })`, so custom roles count. Stages may carry their own `escalation`.
+
+## Operation fingerprints
+
+Bind an approval to the exact operation with `fingerprint`: `permdock.decide(permission, row, { fingerprint: approvalFingerprint({ id, amount, to }) })`. The token and the stored request carry it, and a resume or `consumeApproval(store, token, at, { fingerprint })` under another one fails with `approval-fingerprint-mismatch`. `approvalFingerprint` returns the same hex string as better-supabase's, synchronously.

package/skills/permdock-audit/SKILL.md

@@ -44,7 +44,7 @@ Read the app's `permissions.ts`, `policy.ts`, factory file and every adapter gua
    ✓ Every policy and custom store has its runner, or a finding.
 6. **ASI02 and ASI03.** Map the inventory onto [OWASP Agentic](https://permdock.com/docs/security/owasp-agentic); for the threat list itself, defer to the `owasp-agentic` spec skill (`npx skills add ScaleDockHQ/scaledock-skills --skill owasp-agentic`).
    - **ASI02** (tool misuse): unmapped tools, a collection permission on a row handler, a destructive tool without `approval`, capability lists that include denied tools.
-   - **ASI03** (identity and privilege abuse): a model-supplied subject or actor, an actor used as approver, `distinct: false` on a sensitive action, a resume token not bound to permission, resource, subject and actor, API keys stored in plain text or created outside `decideCredential`, keys without expiry (PD029), and a `memberships` source applied to service-key subjects.
+   - **ASI03** (identity and privilege abuse): a model-supplied subject or actor, an actor used as approver, `mode: "confirm"` on a sensitive action, a resume token not bound to permission, resource, subject and actor, API keys stored in plain text or created outside `decideCredential`, keys without expiry (PD029), and a `memberships` source applied to service-key subjects.
      ✓ Each agent adapter in the app has an ASI02 line and an ASI03 line.
 7. **Pull request review**, when the scope is one PR. Review only what the diff changes:
    - Run `permdock collect --check` and `permdock usage --json` on both sides and compare. New leaves with no grant, grants for leaves nobody checks, and new `undeclared` or `outsideInclude` findings are comments.

package/skills/permdock-data/references/queries-and-rls.md

@@ -36,7 +36,7 @@ pnpm exec permdock rls verify --introspect
 ```
 
 - List the scope instances a permission reaches in process with `permdock.permittedIds(permission, scope, { within })`, never a loop of `can` over memberships with a made-up row.
-- Generated policies call `permdock_has('<key>')` and one `permitted_<scope>_ids('<key>')` per declared scope, which Postgres runs once per statement. Hand-written policies that only need membership (an organization switcher) call `member_<scope>_ids()` instead of inventing a permission key. A policy that passes a user id, such as better-supabase's team sharing, calls `member_team_ids_of(<user>)` on Supabase: it answers only when the id is the caller's. Trusted SQL that acts for a stored user (a job, a trigger, a deferred approval) calls `permdock_has_for(p_user, '<key>')` and `permitted_<scope>_ids_for(p_user, '<key>')` in `database` mode, or the generated `permitted_<resource>_rows_for`, never a hand-written function that rewrites `request.jwt.claims`. With `rls.rowHelpers`, a hand-written policy or function that needs the rows a permission reaches through the graph calls `permitted_<resource>_rows('<permission key>')` instead of restating closure walks, link hops and `includes`. A table's own `select` or `insert` policy calls the row-valued `permitted_<resource>_row(<table>, '<permission key>')` instead, so `insert ... returning` sees the new row. A function that checks a known set of rows (one tenant's, a page, a batch) calls `permitted_<resource>_rows('<permission key>', <text[] of ids>)`, which reads only those ids, instead of the one-argument form, which reads the whole table, or a `permitted_<resource>_row` call per row. Hand-written policies and functions that apply no row condition call `permitted_<scope>_ids_by_permission('<permission key>')` or `permdock_has_permission('<permission key>')` instead of spelling a positional `#n` grant key. A screen or RPC that checks many permissions on one organization calls `permitted_<scope>_permission_keys(<id>)` once (or `(<id>, array['<key>', ...])` for a few keys) instead of one helper call per key. A role editor or admin screen lists a role's keys with `permdock_role_permissions(p_role, p_scope, p_tenant, p_scope_id)` (declared roles, and custom roles of the caller's tenant in `database` mode) and the catalog with `permdock_permission_keys()` (`permdock_permission_keys('<scope>')` for the keys a role on that scope can hold), instead of joining `role_permissions` and the custom-role tables by hand; server code reads any tenant's roles with `permdock_trusted_role_permissions`, granted through `rls.trustedReaders`. Set `--tenant-type` (or `rls.scopeTypes`, keyed by scope name or `tenant` and `team`) to the scope columns' types.
+- Generated policies call `permdock_has('<key>')` and one `permitted_<scope>_ids('<key>')` per declared scope, which Postgres runs once per statement. Hand-written policies that only need membership (an organization switcher) call `member_<scope>_ids()` instead of inventing a permission key. A policy that passes a user id, such as better-supabase's team sharing, calls `member_team_ids_of(<user>)` on Supabase: it answers only when the id is the caller's. Trusted SQL that acts for a stored user (a job, a trigger, a deferred approval) calls `permdock_has_for(p_user, '<key>')` and `permitted_<scope>_ids_for(p_user, '<key>')` in `database` mode, or the generated `permitted_<resource>_rows_for` (`permitted_<resource>_rows_for(p_user, '<key>', <text[] of ids>)` for a known set of rows, such as a share link checked against its creator's access), never a hand-written function that rewrites `request.jwt.claims`. With `rls.rowHelpers`, a hand-written policy or function that needs the rows a permission reaches through the graph calls `permitted_<resource>_rows('<permission key>')` instead of restating closure walks, link hops and `includes`. A table's own `select` or `insert` policy calls the row-valued `permitted_<resource>_row(<table>, '<permission key>')` instead, so `insert ... returning` sees the new row. A function that checks a known set of rows (one tenant's, a page, a batch) calls `permitted_<resource>_rows('<permission key>', <text[] of ids>)`, which reads only those ids, instead of the one-argument form, which reads the whole table, or a `permitted_<resource>_row` call per row. Hand-written policies and functions that apply no row condition call `permitted_<scope>_ids_by_permission('<permission key>')` or `permdock_has_permission('<permission key>')` instead of spelling a positional `#n` grant key. A screen or RPC that checks many permissions on one organization calls `permitted_<scope>_permission_keys(<id>)` once (or `(<id>, array['<key>', ...])` for a few keys) instead of one helper call per key. A role editor or admin screen lists a role's keys with `permdock_role_permissions(p_role, p_scope, p_tenant, p_scope_id)` (declared roles, and custom roles of the caller's tenant in `database` mode) and the catalog with `permdock_permission_keys()` (`permdock_permission_keys('<scope>')` for the keys a role on that scope can hold), instead of joining `role_permissions` and the custom-role tables by hand; server code reads any tenant's roles with `permdock_trusted_role_permissions`, granted through `rls.trustedReaders`. Set `--tenant-type` (or `rls.scopeTypes`, keyed by scope name or `tenant` and `team`) to the scope columns' types.
 - `--authorize database` (default) reads the membership tables per statement; map each under `rls.memberships.scopes.<scope>` with `columns` for its id and its ancestors', and `via` so roles with `for` apply: a column name, or `{ value: 'staff' }` when every row has that kind (never add a generated column for it). `--authorize jwt` reads token claims and stays stale until the token refreshes; keep the token lifetime at 3600 seconds or less (PD019).
 - When the role column holds values that are not role keys, give the membership source `role: { column, map: { value: 'role' } }`; a value mapped to `null` grants nothing. `permdock rls explain` prints the tables, membership sources, custom roles table and triggers a generate run binds to, without writing a file. `rls.seeds: 'function'` writes the `role_permissions` rows as `<schema>.seed()` instead of inserts; run `select <schema>.seed();` after each deploy, and PD054 checks the function body.
 - `rls verify --introspect` checks each `security definer` helper by its full signature, so every overload is checked on its own. A helper finding id names the signature (`helper-definer:permdock.permdock_has(text):helper`); write `rls.verify.ignore` entries with it.

package/dist/action-result-BcudBQOF.d.ts

@@ -1,19 +0,0 @@
-import { a as ProblemDetails } from "./errors-BIM4MFsJ.js";
-//#region src/core/action-result.d.ts
-/** What a `protectAction` action resolves to; both members cross to the client. */
-type ActionResult<T> = {
-  readonly ok: true;
-  readonly value: T;
-} | {
-  readonly ok: false;
-  readonly problem: ProblemDetails;
-};
-/**
- * The server action: `approval` is the token of a granted approval request,
- * which resumes an `approval-required` decision.
- */
-type ProtectedAction<T> = (input: unknown, options?: {
-  readonly approval?: string;
-}) => Promise<ActionResult<T>>;
-//#endregion
-export { ProtectedAction as n, ActionResult as t };

package/dist/catalog-D3oS2GH3.js

@@ -1 +0,0 @@
-export { t as catalogFile, n as runCatalog } from "./catalog-CGlSwU6j.js";

package/dist/collect-D-eroIfV.js

@@ -1 +0,0 @@
-export { r as runCollect } from "./collect-WCl8cJQV.js";

package/dist/load-Dm0pSYH3.js

@@ -1 +0,0 @@
-export { a as loadModule, s as pickNamed } from "./load-DjSU5KXO.js";

package/dist/output-files-BHOIlrfD.js

@@ -1 +0,0 @@
-export { t as SPLIT_PARTS } from "./output-files-BIQ_9pIs.js";

package/dist/powersync-CnGzxvEl.js

@@ -1 +0,0 @@
-export { n as runPowerSync } from "./powersync-uqYWxTjq.js";

package/dist/pull-D6dloyrc.js

@@ -1 +0,0 @@
-export { n as runCloudPull } from "./pull-BBmCxnqX.js";

package/dist/renames-CGj7YwcQ.js

@@ -1,175 +0,0 @@
-//#region src/cli/core/renames.ts
-const DB_COMMANDS = [
-	"rls generate",
-	"rls import",
-	"rls verify",
-	"supabase hook generate",
-	"powersync verify"
-];
-const FLAG_RENAMES = [
-	{
-		commands: DB_COMMANDS,
-		from: "--db",
-		to: "--db-url-stdin",
-		hint: "--db-url-stdin or DATABASE_URL"
-	},
-	{
-		commands: DB_COMMANDS,
-		from: "--db-url",
-		to: "--db-url-stdin",
-		hint: "--db-url-stdin or DATABASE_URL"
-	},
-	{
-		commands: ["rls generate"],
-		from: "--force",
-		to: "--force-rls"
-	},
-	{
-		commands: ["rls verify"],
-		from: "--format",
-		to: "--kind"
-	},
-	{
-		commands: ["rls verify"],
-		from: "--emit",
-		to: "--kind"
-	},
-	{
-		commands: ["catalog"],
-		from: "--format",
-		to: "--kind",
-		values: {
-			json: "catalog",
-			schema: "json-schema",
-			markdown: "markdown"
-		}
-	},
-	{
-		commands: ["openapi emit"],
-		from: "--format",
-		to: "--kind"
-	},
-	{
-		commands: [
-			"rls generate",
-			"rls verify",
-			"rls migrate",
-			"powersync generate",
-			"powersync verify",
-			"openapi emit"
-		],
-		from: "--from",
-		to: "--policy"
-	},
-	{
-		commands: ["catalog", "arazzo check"],
-		from: "--from",
-		to: "--permissions"
-	},
-	{
-		commands: ["rls import", "openapi import"],
-		from: "--schema",
-		to: "--validator"
-	},
-	{
-		commands: [
-			"usage",
-			"config",
-			"doctor"
-		],
-		from: "--strict",
-		to: "--fail-on",
-		hint: "--fail-on warning",
-		rewrite: "--fail-on warning"
-	},
-	{
-		commands: ["login"],
-		from: "--write",
-		to: "--scope",
-		hint: "--scope catalog:write",
-		rewrite: "--scope catalog:write"
-	},
-	{
-		commands: ["skills install", "skills update"],
-		from: "--agent",
-		to: "--for"
-	},
-	{
-		commands: ["skills install", "skills update"],
-		from: "--client",
-		to: "--for"
-	},
-	{
-		commands: ["init"],
-		from: "--agent",
-		to: "--integration"
-	},
-	{
-		commands: ["init"],
-		from: "--ui",
-		to: "--integration"
-	},
-	{
-		commands: ["init"],
-		from: "--src",
-		to: "--out-dir"
-	},
-	{
-		commands: [
-			"rls generate",
-			"rls verify",
-			"rls migrate"
-		],
-		from: "--rbac-scaffold",
-		to: "--rbac",
-		hint: "--rbac supabase",
-		rewrite: "--rbac supabase"
-	},
-	{
-		commands: ["rls migrate"],
-		from: "--write",
-		hint: "rls migrate writes by default; --dry-run prints the plan without writing",
-		rewrite: ""
-	},
-	{
-		commands: ["cloud push"],
-		from: "--environment",
-		to: "--project",
-		hint: "--project <id>: a project id is its environment"
-	},
-	{
-		commands: ["scan"],
-		from: "--legacy",
-		hint: "permdock scan lists the checks written without PermDock; drop --legacy",
-		rewrite: ""
-	}
-];
-const COMMAND_MOVES = [
-	{
-		from: "openapi",
-		to: "openapi emit"
-	},
-	{
-		from: "skills",
-		to: "skills install"
-	},
-	{
-		from: "arazzo",
-		to: "arazzo check"
-	}
-];
-const DEFAULT_CHANGES = [{
-	command: "rls migrate",
-	unless: ["--write", "--retire-out"],
-	add: "--dry-run"
-}];
-/** The rename that matches `flag` (as typed, before any `=`) on `command`. */
-function flagRename(command, flag) {
-	return FLAG_RENAMES.find((rename) => rename.from === flag && rename.commands.includes(command));
-}
-function renameMessage(command, rename) {
-	const replacement = rename.hint ?? rename.to;
-	return replacement === void 0 ? `${command}: ${rename.from} was removed in 0.5.0.` : rename.to === void 0 ? `${command}: ${rename.from} was removed in 0.5.0: ${replacement}.` : `${command}: ${rename.from} is ${replacement} since 0.5.0.`;
-}
-//#endregion
-export { renameMessage as i, DEFAULT_CHANGES as n, flagRename as r, COMMAND_MOVES as t };

package/dist/run-DlQYPtPv.js

@@ -1 +0,0 @@
-export { t as run } from "./run-D5WIJfs7.js";

package/dist/supabase-hook-qsewAVZY.js

@@ -1 +0,0 @@
-export { i as runSupabase } from "./supabase-hook-HPgwYb9V.js";

package/dist/usage-D3KJyaNS.js

@@ -1 +0,0 @@
-export { t as runUsage } from "./usage-e6M1Mls1.js";

package/dist/watch-CuPz0D2M.js

@@ -1 +0,0 @@
-export { i as watchCollect } from "./watch-DAkjm75Y.js";