permdock 0.16.0 → 0.17.0

package/dist/{policy-from-catalog-CU3An8uP.js → policy-from-catalog-DVa1faOr.js}

@@ -1,17 +1,18 @@
 import { r as isRecord, t as compact } from "./compact-CAf557ZB.js";
 import { n as freezeDeep } from "./freeze-jjan0lCv.js";
-import { p as normalizeWhere } from "./role-builder-BK2-T6oD.js";
+import { l as normalizeWhere } from "./role-builder-BrmOcXch.js";
 import { n as PermDockValidationError } from "./validation-error-CYg2kJEw.js";
 import { i as getRegistry, n as findPermission, v as resource } from "./permission-registry-B8tYxPIt.js";
-import { n as defineScopes } from "./scopes-0Up_UA2t.js";
+import { n as defineScopes } from "./scopes-BSdYaGHs.js";
 import { f as definePlans, p as defineRoles } from "./grantee-Dke-9rd1.js";
+import { o as readWireApproval } from "./approval-normalize-4KxMRdJC.js";
 import { r as readWireValidity } from "./validity-Buc7w8E9.js";
-import { a as indexPolicy, f as normalizeDelegation } from "./policy-CLQ8__GF.js";
-import { o as isPortableCondition } from "./hosted-D0IzESu_.js";
+import { a as indexPolicy, f as normalizeDelegation } from "./policy-DxQyHKPB.js";
+import { o as isPortableCondition } from "./hosted-tPZnyjQS.js";
 import { t as definePermissions } from "./permissions-CVXmRILq.js";
 import { n as copyJson, t as checkSchema } from "./json-schema-BPGa-RjQ.js";
-import { t as parseCatalog } from "./parse-1_ZheTW5.js";
-import { n as parsePushedPolicy } from "./pushed-policy-CDuOL2de.js";
+import { t as parseCatalog } from "./parse-UTC-sDrt.js";
+import { n as parsePushedPolicy } from "./pushed-policy-DMXAOmEW.js";
 //#region src/catalog/json-schema-validator.ts
 const ANNOTATIONS = /* @__PURE__ */ new Set([
 	"$schema",
@@ -292,7 +293,7 @@ function buildGrant(tree, raw) {
 		role: raw.role,
 		where,
 		check: condition(raw.check, `grant '${raw.permission}' check`, raw.portable !== false),
-		approval: raw.approval,
+		approval: readWireApproval(raw.approval),
 		portable: raw.portable !== false,
 		limit: raw.limit,
 		fields: raw.fields,

package/dist/{policy-types-DGIO_gxq.d.ts → policy-types-IRJVABmm.d.ts}

@@ -193,7 +193,7 @@ type ActorKind = OpenUnion<"mcp-client" | "oauth-client" | "support" | "imperson
  * The adapter a decision event names: a PermDock entry, or an integrator's own
  * adapter.
  */
-type AdapterId = OpenUnion<"server" | "next" | "hono" | "express" | "fastify" | "elysia" | "nest" | "node" | "h3" | "sveltekit" | "astro" | "solid-start" | "tanstack-start" | "trpc" | "orpc" | "supabase-middleware" | "convex" | "authzen" | "mcp" | "a2a" | "agent" | "ai-sdk" | "claude-agent" | "openai" | "eve" | "terminal" | "webmcp" | "workflow" | "chat" | "delivery">;
+type AdapterId = OpenUnion<"server" | "next" | "hono" | "express" | "fastify" | "elysia" | "nest" | "node" | "h3" | "sveltekit" | "astro" | "solid-start" | "tanstack-start" | "trpc" | "orpc" | "supabase-middleware" | "better-supabase" | "convex" | "authzen" | "mcp" | "a2a" | "agent" | "ai-sdk" | "claude-agent" | "openai" | "eve" | "terminal" | "webmcp" | "workflow" | "chat" | "delivery">;
 /**
  * How a membership was obtained (`membership.via`); `viaOnly` and support rules
  * match it by equality.
@@ -289,10 +289,6 @@ type Membership = {
    * conditions or RLS, and never written into token claims.
    */
   readonly x?: AppData;
-  /** Input only: an instance of the first scope. */
-  readonly tenant?: string;
-  /** Input only: an instance of the second scope, inside `tenant`. */
-  readonly team?: string;
 };
 /**
  * One permission a custom role adds or removes. It names a declared permission
@@ -595,6 +591,11 @@ type ApprovalRequiredDecision = {
   readonly grant: MatchedGrant;
   readonly reason: "human";
   readonly token: string;
+  /**
+   * The `fingerprint` the call passed, bound into `token`; the request it opens
+   * records it, and a resume under another fingerprint is refused.
+   */
+  readonly fingerprint?: string;
   /** Present only with `explain: true`. */
   readonly trace?: Trace;
 };
@@ -690,6 +691,16 @@ type PermissionApprover = {
   readonly kind: "permission";
   readonly permission: string;
 };
+/**
+ * The requester's manager, or anyone up the chain within `levels` (default 1),
+ * read from the `manager` relation on the requester's `user` record. Checked
+ * only through verdict facts (`ApprovalVerdict.relations`) that the handler
+ * reads from its `RelationSource`.
+ */
+type ManagerApprover = {
+  readonly kind: "manager";
+  readonly levels?: number;
+};
 /**
  * An approver who matches at least one item; an item that is a list matches
  * when every entry does.
@@ -701,11 +712,11 @@ type AnyOfApprover = {
 /**
  * Who may approve: a subject-only grantee, a `relation()` the approver holds on
  * the requested row (checked when the verdict is given), `user(id)`,
- * `holder(permission)`, or `anyOf(...)`. A list (or `allOf(...)`) matches an
- * approver who satisfies every item.
+ * `holder(permission)`, `manager()`, or `anyOf(...)`. A list (or `allOf(...)`)
+ * matches an approver who satisfies every item.
  */
-type Approver = Grantee | UserApprover | PermissionApprover | AnyOfApprover;
-type ApproverInput = GranteeInput | UserApprover | PermissionApprover | {
+type Approver = Grantee | UserApprover | PermissionApprover | ManagerApprover | AnyOfApprover;
+type ApproverInput = GranteeInput | UserApprover | PermissionApprover | ManagerApprover | {
   readonly kind: "any-of";
   readonly of: readonly ApproverInput[];
 } | readonly ApproverInput[];
@@ -723,6 +734,13 @@ declare function anyOf(...items: readonly ApproverInput[]): {
 declare function allOf(...items: readonly ApproverInput[]): readonly ApproverInput[];
 /** A named approver for `approval.by`, matched on the approver's principal id. */
 declare function user(id: string): UserApprover;
+/**
+ * Approves when the approver manages the requester, directly or within `levels`
+ * steps up the chain (1 to `MAX_MANAGER_LEVELS`, default 1).
+ */
+declare function manager(options?: {
+  readonly levels?: number;
+}): ManagerApprover;
 //#endregion
 //#region src/core/scopes.d.ts
 /**
@@ -1183,6 +1201,13 @@ type Snapshot = {
    * still cover.
    */
   readonly delegated?: readonly string[];
+  /**
+   * The token's authorization version (`authz_ver`) the snapshot was built
+   * from. A client compares it with the version in a refresh signal.
+   */
+  readonly authzVersion?: number;
+  /** The Auth session (`session_id`) the snapshot was built for. */
+  readonly sessionId?: string;
 };
 /**
  * A grant the subject would hold on another plan: its permission, role and
@@ -1721,6 +1746,16 @@ type DecisionProvider = {
  * query and no answer outlives the instance.
  */
 type SourceMemo = <T>(key: string, read: () => T) => T;
+/**
+ * One read a source made, for an `onSourceCall` hook: `cached` is `true` when
+ * the instance's `SourceMemo` answered it without a query.
+ */
+type SourceCall = {
+  readonly source: string;
+  readonly method: string;
+  readonly durationMs: number;
+  readonly cached: boolean;
+};
 /** What `getPermDock` passes to every source call besides its query. */
 type SourceContext = {
   /** Absent when the source is called outside `getPermDock`. */
@@ -2089,16 +2124,22 @@ type ApprovalStage = {
  * order. `'sequential'`: stages complete in order; an approver signs only the
  * first incomplete stage. An approver signs once per request.
  */
-type ApprovalMode = "any" | "all" | "sequential";
+type ApprovalCombine = "any" | "all" | "sequential";
+/**
+ * `'authorize'` (the default): someone other than the request's principal
+ * approves. `'confirm'`: the principal may approve their own request. Neither
+ * is met by an approver acting through an agent or a delegated token.
+ */
+type ApprovalMode = "confirm" | "authorize";
 type ApprovalRequirement = {
-  /** Set when `mode` is `'any'` (the default); absent under `stages`. */
+  /** Set when `combine` is `'any'` (the default); absent under `stages`. */
   readonly by?: Approver | readonly Approver[];
   /** Absent means `'any'`. */
-  readonly mode?: ApprovalMode;
-  /** Set when `mode` is `'all'` or `'sequential'`. */
+  readonly combine?: ApprovalCombine;
+  /** Set when `combine` is `'all'` or `'sequential'`. */
   readonly stages?: readonly ApprovalStage[];
-  /** `false` lets the request's principal approve it; absent means `true`. */
-  readonly distinct?: boolean;
+  /** Absent means `'authorize'`. */
+  readonly mode?: ApprovalMode;
   /** `'resource-change'` binds the approval to the row's `version` field. */
   readonly staleOn?: "resource-change";
   /**
@@ -2119,7 +2160,7 @@ type ApprovalOption = "human" | {
    * `'all'` or `'sequential'` with `stages`; absent means `'any'` with
    * `by`.
    */
-  readonly mode?: ApprovalMode;
+  readonly combine?: ApprovalCombine;
   readonly stages?: readonly {
     readonly by: ApproverInput;
     readonly quorum?: number;
@@ -2129,8 +2170,11 @@ type ApprovalOption = "human" | {
       readonly to: ApproverInput;
     };
   }[];
-  /** `false` lets the request's principal approve it; absent means `true`. */
-  readonly distinct?: boolean;
+  /**
+   * `'confirm'` lets the request's principal approve it; absent means
+   * `'authorize'`.
+   */
+  readonly mode?: ApprovalMode;
   /**
    * `'resource-change'`: the approval covers the row as it was when it was
    * requested. The resource must declare `version`; once that field
@@ -2676,4 +2720,4 @@ type SubjectOf<P> = {
   readonly expiresAt?: number;
 };
 //#endregion
-export { LimitRemaining as $, Quota as $n, SnapshotGrant as $t, PolicyScopes as A, Grantee as An, SqlFunctionCondition as Ar, CredentialDecision as At, ValidateMode as B, relation as Bn, decideCredential as Bt, MembershipFixture as C, ApproverInput as Cn, MemberOfCondition as Cr, SupportSessionDecision as Ct, PolicyDelegation as D, anyOf as Dn, RelatedHop as Dr, parseSupportSession as Dt, PolicyAppDataSchemas as E, allOf as En, RelatedCondition as Er, decideSupportSession as Et, RoleScope as F, anyone as Fn, isSqlFunctionField as Fr, CredentialPolicyViolation as Ft, CustomRoleSource as G, DenialDetails as Gn, LocalCustomRoleTable as Gt, WireValidity as H, ApprovalRequiredDecision as Hn, parseCredential as Ht, SeparationConflict as I, assurance as In, CredentialRequest as It, DecisionSink as J, ExplainedDecision as Jn, LocalRowValue as Jt, CustomRoleSourceFactory as K, DenialReason as Kn, LocalMembershipRows as Kt, SubjectOf as L, authenticated as Ln, DecideCredentialOptions as Lt, PrincipalOf as M, InheritGrantee as Mn, isCondition as Mr, CredentialPermission as Mt, RoleBinding as N, RelationGrantee as Nn, isConditionDate as Nr, CredentialPermissionInput as Nt, PolicyOAuthScope as O, holder as On, RestrictedAncestors as Or, ApiKeyPrincipal as Ot, RoleOptions as P, actor as Pn, isConditionRef as Pr, CredentialPolicy as Pt, LimitConsumeInput as Q, Obligation as Qn, SnapshotAssignable as Qt, SupportAccessOptions as R, inherit as Rn, credentialDelegation as Rt, HostedGrantRef as S, Approver as Sn, ConditionValue as Sr, SupportSession as St, Policy as T, UserApprover as Tn, OpaqueCondition as Tr, SupportSessionRequest as Tt, CredentialVerifier as U, Decision as Un, InstanceHandle as Ut, VocabularyFromInput as V, AppObligation as Vn, isFeedId as Vt, CustomRoleContext as W, Denial as Wn, Instant as Wt, Intent as X, LimitDetail as Xn, LocalSnapshotRows as Xt, EntitlementSource as Y, GrantedDecision as Yn, LocalSnapshotManifest as Yt, JwtClaims as Z, MatchedGrant as Zn, Snapshot as Zt, GrantLimit as _, PolicyScopesInput as _n, ActorKind as _r, VerifiedToken as _t, ApprovalRequirement as a, CredentialEvent as an, AuthorizationDetail as ar, RelationHolder as at, GrantScope as b, ScopeNames as bn, Condition as br, WhereCompiler as bt, BreakGlassOptions as c, DeliveryEvent as cn, CustomRoleGrant as cr, SnapshotSource as ct, ClosureContext as d, EmailCategory as dn, JsonWebKeyLike as dr, SubjectResolver as dt, SnapshotNotEntitled as en, Trace as er, LimitStore as et, ClosureGrantFn as f, MembershipEvent as fn, Membership as fr, TenantSettings as ft, GrantCondition as g, WireDelegation as gn, VerifiedClaims as gr, VerificationFailure as gt, Grant as h, WireDenial as hn, Subject as hr, TokenVerifier as ht, ApprovalOption as i, AutomationEvent as in, Assurance as ir, RelationGroup as it, PolicyVocabulary as j, GranteeInput as jn, hasConditionOp as jr, CredentialKind as jt, PolicyOptions as k, user as kn, SqlFunctionArg as kr, Credential as kt, BreakGlassRequirements as l, DeliveryFailureCause as ln, Delegation as lr, SourceContext as lt, DelegationTarget as m, WireDecision as mn, SharedCustomRole as mr, TokenSigner as mt, ApprovalEscalation as n, AccessEvent as nn, TraceSkipReason as nr, MembershipSource as nt, ApprovalStage as o, DecisionEvent as on, Binding as or, RelationSource as ot, DelegationInput as p, SinkEvent as pn, Principal as pr, TokenFailureCause as pt, DecisionProvider as q, DeniedDecision as qn, LocalRowColumn as qt, ApprovalMode as r, AuthEvent as rn, Actor as rr, RelationChain as rt, AssuranceRequirement as s, DeliveryChannel as sn, CustomRole as sr, SettingsSource as st, ActivationOption as t, SnapshotScope as tn, TraceSkip as tr, MemberEntry as tt, BreakGlassSpec as u, DirectoryEvent as un, GnapAccess as ur, SourceMemo as ut, GrantMeta as v, Scope as vn, AdapterId as vr, VersionContext as vt, ObligationInput as w, PermissionApprover as wn, MemberOfParent as wr, SupportSessionPolicy as wt, GrantValidity as x, AnyOfApprover as xn, ConditionRef as xr, DecideSupportSessionOptions as xt, GrantOptions as y, ScopeDeclaration as yn, MembershipVia as yr, VersionQuery as yt, SupportConsent as z, plan as zn, credentialPolicyViolation as zt };
+export { LimitConsumeInput as $, GrantedDecision as $n, Snapshot as $t, PolicyOptions as A, anyOf as An, RelatedCondition as Ar, ApiKeyPrincipal as At, SupportConsent as B, assurance as Bn, credentialDelegation as Bt, HostedGrantRef as C, AnyOfApprover as Cn, MembershipVia as Cr, DecideSupportSessionOptions as Ct, PolicyAppDataSchemas as D, PermissionApprover as Dn, MemberOfCondition as Dr, SupportSessionRequest as Dt, Policy as E, ManagerApprover as En, ConditionValue as Er, SupportSessionPolicy as Et, RoleOptions as F, GranteeInput as Fn, hasConditionOp as Fr, CredentialPermissionInput as Ft, CustomRoleContext as G, AppObligation as Gn, InstanceHandle as Gt, VocabularyFromInput as H, inherit as Hn, decideCredential as Ht, RoleScope as I, InheritGrantee as In, isCondition as Ir, CredentialPolicy as It, DecisionProvider as J, Denial as Jn, LocalMembershipRows as Jt, CustomRoleSource as K, ApprovalRequiredDecision as Kn, Instant as Kt, SeparationConflict as L, RelationGrantee as Ln, isConditionDate as Lr, CredentialPolicyViolation as Lt, PolicyVocabulary as M, manager as Mn, RestrictedAncestors as Mr, CredentialDecision as Mt, PrincipalOf as N, user as Nn, SqlFunctionArg as Nr, CredentialKind as Nt, PolicyDelegation as O, UserApprover as On, MemberOfParent as Or, decideSupportSession as Ot, RoleBinding as P, Grantee as Pn, SqlFunctionCondition as Pr, CredentialPermission as Pt, JwtClaims as Q, ExplainedDecision as Qn, LocalSnapshotRows as Qt, SubjectOf as R, actor as Rn, isConditionRef as Rr, CredentialRequest as Rt, GrantValidity as S, ScopeNames as Sn, AdapterId as Sr, WhereCompiler as St, ObligationInput as T, ApproverInput as Tn, ConditionRef as Tr, SupportSessionDecision as Tt, WireValidity as U, plan as Un, isFeedId as Ut, ValidateMode as V, authenticated as Vn, credentialPolicyViolation as Vt, CredentialVerifier as W, relation as Wn, parseCredential as Wt, EntitlementSource as X, DenialReason as Xn, LocalRowValue as Xt, DecisionSink as Y, DenialDetails as Yn, LocalRowColumn as Yt, Intent as Z, DeniedDecision as Zn, LocalSnapshotManifest as Zt, GrantCondition as _, WireDenial as _n, Principal as _r, TokenVerifier as _t, ApprovalOption as a, AuthEvent as an, TraceSkip as ar, RelationGroup as at, GrantOptions as b, Scope as bn, VerifiedClaims as br, VersionContext as bt, AssuranceRequirement as c, DecisionEvent as cn, Assurance as cr, SettingsSource as ct, BreakGlassSpec as d, DeliveryFailureCause as dn, CustomRole as dr, SourceContext as dt, SnapshotAssignable as en, LimitDetail as er, LimitRemaining as et, ClosureContext as f, DirectoryEvent as fn, CustomRoleGrant as fr, SourceMemo as ft, Grant as g, WireDecision as gn, Membership as gr, TokenSigner as gt, DelegationTarget as h, SinkEvent as hn, JsonWebKeyLike as hr, TokenFailureCause as ht, ApprovalMode as i, AccessEvent as in, Trace as ir, RelationChain as it, PolicyScopes as j, holder as jn, RelatedHop as jr, Credential as jt, PolicyOAuthScope as k, allOf as kn, OpaqueCondition as kr, parseSupportSession as kt, BreakGlassOptions as l, DeliveryChannel as ln, AuthorizationDetail as lr, SnapshotSource as lt, DelegationInput as m, MembershipEvent as mn, GnapAccess as mr, TenantSettings as mt, ApprovalCombine as n, SnapshotNotEntitled as nn, Obligation as nr, MemberEntry as nt, ApprovalRequirement as o, AutomationEvent as on, TraceSkipReason as or, RelationHolder as ot, ClosureGrantFn as p, EmailCategory as pn, Delegation as pr, SubjectResolver as pt, CustomRoleSourceFactory as q, Decision as qn, LocalCustomRoleTable as qt, ApprovalEscalation as r, SnapshotScope as rn, Quota as rr, MembershipSource as rt, ApprovalStage as s, CredentialEvent as sn, Actor as sr, RelationSource as st, ActivationOption as t, SnapshotGrant as tn, MatchedGrant as tr, LimitStore as tt, BreakGlassRequirements as u, DeliveryEvent as un, Binding as ur, SourceCall as ut, GrantLimit as v, WireDelegation as vn, SharedCustomRole as vr, VerificationFailure as vt, MembershipFixture as w, Approver as wn, Condition as wr, SupportSession as wt, GrantScope as x, ScopeDeclaration as xn, ActorKind as xr, VersionQuery as xt, GrantMeta as y, PolicyScopesInput as yn, Subject as yr, VerifiedToken as yt, SupportAccessOptions as z, anyone as zn, isSqlFunctionField as zr, DecideCredentialOptions as zt };

package/dist/{postgrest-D5nUGm-c.d.ts → postgrest-B_cEDd4e.d.ts}

@@ -1,4 +1,4 @@
-import { G as CustomRoleSource, T as Policy, fr as Membership, hr as Subject, nt as MembershipSource, pr as Principal, sr as CustomRole, tt as MemberEntry } from "./policy-types-DGIO_gxq.js";
+import { E as Policy, K as CustomRoleSource, _r as Principal, dr as CustomRole, gr as Membership, nt as MemberEntry, rt as MembershipSource, ut as SourceCall, yr as Subject } from "./policy-types-IRJVABmm.js";
 //#region src/supabase/postgrest.d.ts
 /**
  * What a supabase-js `rpc` call resolves to: `data` or an `error` with a
@@ -57,6 +57,11 @@ type PostgrestSourcesOptions = {
    * token claims a custom role, which the custom roles need anyway.
    */
   readonly policy?: Policy;
+  /**
+   * Called after every function read with its duration and whether the
+   * instance's memo answered it. A hook that throws is ignored.
+   */
+  readonly onSourceCall?: (call: SourceCall) => void;
 };
 /** One user as `subject_for(p_user)` returns it. */
 type SubjectRecord = {
@@ -119,12 +124,12 @@ declare function readSubjectRecord(value: unknown): SubjectRecord | undefined;
  * `permdock supabase hook generate` writes, for a backend that reaches Postgres
  * only through PostgREST. `memberships.version` reads only the version, so
  * `claimsFirst` with `onStale: 'reread'` reads the full subject only for a
- * stale token; when the version function is missing it falls back to
- * `subject_for`. With `policy`, a token that claims a custom role has its
- * subject read in one `subject_for` call instead, and custom roles are read
- * only for a subject that holds one. It keeps no answers: create it once at
- * module scope, and `getPermDock` shares each read within one instance. Pass
- * `claimsFirst(…, { versions })` to share version reads across instances.
+ * stale token; a missing version function throws, and `permdock doctor` PD083
+ * reports it. With `policy`, a token that claims a custom role has its subject
+ * read in one `subject_for` call instead, and custom roles are read only for a
+ * subject that holds one. It keeps no answers: create it once at module scope,
+ * and `getPermDock` shares each read within one instance. Pass `claimsFirst(…,
+ * { versions })` to share version reads across instances.
  */
 declare function postgrestSources(client: SupabaseRpcCaller, options?: PostgrestSourcesOptions): PostgrestSources;
 //#endregion

package/dist/{postgrest-DAxFltvO.js → postgrest-BrjrckDG.js}

@@ -1,10 +1,11 @@
 import { r as isRecord, t as compact } from "./compact-CAf557ZB.js";
 import { n as freezeDeep } from "./freeze-jjan0lCv.js";
 import { r as validateRecord } from "./thenable-BNSM1U2R.js";
-import { t as anonymousSubject } from "./subject-BGoM5o8B.js";
+import { f as nowMillis } from "./time-nR1JesoH.js";
+import { t as anonymousSubject } from "./subject-C7RddW0G.js";
 import { t as readClaim } from "./claims-map-CKkoAAYF.js";
 import { t as clientNameOf } from "./clients-DYr3U86j.js";
-import "./budget-BELja5A9.js";
+import "./budget-BBCPDOGP.js";
 import { a as hookApiNames } from "./sources-C4vkzZJV.js";
 //#region src/supabase/subject.ts
 const REGISTERED = /* @__PURE__ */ new Set([
@@ -79,14 +80,12 @@ function asMembership(item) {
 	const scope = typeof item["scope"] === "string" ? item["scope"] : void 0;
 	const id = typeof item["id"] === "string" ? item["id"] : void 0;
 	const within = isRecord(item["within"]) ? Object.fromEntries(Object.entries(item["within"]).filter((entry) => typeof entry[1] === "string")) : void 0;
-	const tenant = typeof item["tenant"] === "string" ? item["tenant"] : void 0;
-	const team = typeof item["team"] === "string" ? item["team"] : void 0;
 	const onRecord = isRecord(item["on"]) ? item["on"] : void 0;
 	const on = onRecord !== void 0 && typeof onRecord["resource"] === "string" && typeof onRecord["id"] === "string" ? {
 		resource: onRecord["resource"],
 		id: onRecord["id"]
 	} : void 0;
-	if ((scope === void 0 || id === void 0) && tenant === void 0 && team === void 0 && on === void 0) return;
+	if ((scope === void 0 || id === void 0) && on === void 0) return;
 	const keep = item["keep"];
 	if (keep !== void 0 && (!Array.isArray(keep) || !keep.every((key) => typeof key === "string" && key !== ""))) return;
 	return compact({
@@ -94,8 +93,6 @@ function asMembership(item) {
 		scope,
 		id,
 		within,
-		tenant,
-		team,
 		on,
 		via: typeof item["via"] === "string" ? item["via"] : void 0,
 		expiresAt: typeof item["expires_at"] === "number" ? item["expires_at"] : void 0,
@@ -487,8 +484,41 @@ function readSubjectRecord(value) {
 		claims: isRecord(value["claims"]) && Object.keys(value["claims"]).length > 0 ? value["claims"] : void 0
 	});
 }
-function once(memo, key, read) {
-	return memo === void 0 ? read() : memo(key, read);
+/**
+* Uncached version reads of one principal closer together than this count as
+* one request reading the version more than once.
+*/
+const REPEAT_WINDOW_MS = 1e3;
+const REPEAT_TRACKED = 1e3;
+/** Read through `globalThis` so the entry loads on runtimes without `process`. */
+function isDevelopment() {
+	const proc = Reflect.get(globalThis, "process");
+	if (typeof proc !== "object" || proc === null) return false;
+	const env = Reflect.get(proc, "env");
+	return typeof env === "object" && env !== null && Reflect.get(env, "NODE_ENV") === "development";
+}
+/**
+* In development, warns once when one principal's version is read twice within
+* `REPEAT_WINDOW_MS`: a request that builds its instance more than once instead
+* of sharing it through `instanceCache` or `permdockFor`.
+*/
+function repeatedVersionReads() {
+	if (!isDevelopment()) return () => void 0;
+	const last = /* @__PURE__ */ new Map();
+	let warned = false;
+	return (userId) => {
+		if (warned) return;
+		const at = nowMillis();
+		const previous = last.get(userId);
+		if (previous !== void 0 && at - previous < REPEAT_WINDOW_MS) {
+			warned = true;
+			last.clear();
+			console.warn("PermDock: the authorization version of one user was read more than once within a second. Share one instance per request through instanceCache and permdockFor, or pass version: { known }.");
+			return;
+		}
+		if (last.size >= REPEAT_TRACKED) last.clear();
+		last.set(userId, at);
+	};
 }
 /**
 * Membership, custom-role and subject sources over the `subject_for(p_user)`,
@@ -496,12 +526,12 @@ function once(memo, key, read) {
 * `permdock supabase hook generate` writes, for a backend that reaches Postgres
 * only through PostgREST. `memberships.version` reads only the version, so
 * `claimsFirst` with `onStale: 'reread'` reads the full subject only for a
-* stale token; when the version function is missing it falls back to
-* `subject_for`. With `policy`, a token that claims a custom role has its
-* subject read in one `subject_for` call instead, and custom roles are read
-* only for a subject that holds one. It keeps no answers: create it once at
-* module scope, and `getPermDock` shares each read within one instance. Pass
-* `claimsFirst(…, { versions })` to share version reads across instances.
+* stale token; a missing version function throws, and `permdock doctor` PD083
+* reports it. With `policy`, a token that claims a custom role has its subject
+* read in one `subject_for` call instead, and custom roles are read only for a
+* subject that holds one. It keeps no answers: create it once at module scope,
+* and `getPermDock` shares each read within one instance. Pass `claimsFirst(…,
+* { versions })` to share version reads across instances.
 */
 function postgrestSources(client, options = {}) {
 	const api = options.api;
@@ -512,7 +542,29 @@ function postgrestSources(client, options = {}) {
 	const versionFn = options.versionFn ?? names?.authzVersionFor ?? "authz_version_for";
 	const declared = options.policy === void 0 ? void 0 : options.policy.index.declaredRoles;
 	const onlyDeclared = (held) => declared !== void 0 && held?.every((name) => declared.has(name)) === true;
-	const list = async (query) => {
+	const hook = options.onSourceCall;
+	const noteVersionRead = repeatedVersionReads();
+	const once = (memo, method, key, read) => {
+		let ran = false;
+		const started = performance.now();
+		const run = () => {
+			ran = true;
+			return read();
+		};
+		const answer = memo === void 0 ? run() : memo(key, run);
+		if (hook === void 0) return answer;
+		return answer.finally(() => {
+			try {
+				hook({
+					source: "postgrest",
+					method,
+					durationMs: performance.now() - started,
+					cached: !ran
+				});
+			} catch {}
+		});
+	};
+	const members = async (query) => {
 		const result = await callRpc(client, schema, membersFn, {
 			p_scope: query.scope,
 			p_id: query.id
@@ -520,14 +572,17 @@ function postgrestSources(client, options = {}) {
 		if (result.error !== null) throw new Error(`PermDock: ${schema}.${membersFn} failed: ${result.error.message}`);
 		return readMemberEntries(result.data);
 	};
-	const record = (userId, memo) => once(memo, `${schema}.${fn}:${userId}`, async () => {
+	const list = (query) => once(void 0, `${schema}.${membersFn}`, "", () => members(query));
+	const record = (userId, memo) => once(memo, `${schema}.${fn}`, `${schema}.${fn}:${userId}`, async () => {
 		const result = await callRpc(client, schema, fn, { p_user: userId });
 		if (result.error !== null) throw new Error(`PermDock: ${schema}.${fn} failed: ${result.error.message}`);
 		return readSubjectRecord(result.data);
 	});
-	const version = (userId, memo) => once(memo, `${schema}.${versionFn}:${userId}`, async () => {
+	const version = (userId, memo) => once(memo, `${schema}.${versionFn}`, `${schema}.${versionFn}:${userId}`, async () => {
+		noteVersionRead(userId);
 		const result = await callRpc(client, schema, versionFn, { p_user: userId });
-		return result.error === null ? versionOf(result.data) : (await record(userId, memo))?.authzVersion;
+		if (result.error !== null) throw new Error(`PermDock: ${schema}.${versionFn} failed: ${result.error.message}`);
+		return versionOf(result.data);
 	});
 	const live = async (userId, memo) => {
 		const found = await record(userId, memo);

package/dist/{powersync-DAfo0EL5.js → powersync-BZxw_v-A.js}

@@ -1,5 +1,5 @@
 import { t as defineLeaf } from "./command-L8EstFNm.js";
-import { c as given, d as policyFlag, n as dbUrl, o as fileOut, r as dbUrlFlags, t as checkFlag } from "./flags-DXjoTVbS.js";
+import { c as given, d as policyFlag, n as dbUrl, o as fileOut, r as dbUrlFlags, t as checkFlag } from "./flags-BlmpmXoY.js";
 //#region src/cli/commands/powersync.ts
 const generate = defineLeaf({
 	flags: {
@@ -14,7 +14,7 @@ const generate = defineLeaf({
 	async run(ctx, { flags }) {
 		const out = fileOut("powersync", flags.out);
 		const from = given(flags.policy);
-		const { runPowerSync } = await import("./powersync-0QVP_DuR.js");
+		const { runPowerSync } = await import("./powersync-Cqzx25dI.js");
 		return runPowerSync({
 			cwd: ctx.cwd,
 			config: ctx.config,
@@ -45,7 +45,7 @@ const verify = defineLeaf({
 		const db = await dbUrl(ctx, flags, { required: true });
 		const fixtures = given(flags.fixtures);
 		const from = given(flags.policy);
-		const { runPowerSync } = await import("./powersync-0QVP_DuR.js");
+		const { runPowerSync } = await import("./powersync-Cqzx25dI.js");
 		return runPowerSync({
 			cwd: ctx.cwd,
 			config: ctx.config,

package/dist/{powersync-CBhTBhG2.js → powersync-C0nsyULQ.js}

@@ -1,25 +1,25 @@
 import { r as isRecord, t as compact } from "./compact-CAf557ZB.js";
 import { c as isConditionDate, l as isConditionRef, o as hasConditionOp } from "./refs-C8BKxc_e.js";
-import { g as localSnapshotManifest, j as memoryCustomRoleSource } from "./src-C_pi2Rnh.js";
+import { M as memoryCustomRoleSource, g as localSnapshotManifest } from "./src-nYNBfmgq.js";
 import { n as findPermission } from "./permission-registry-B8tYxPIt.js";
-import { f as scopeList, s as resolveScope } from "./scopes-0Up_UA2t.js";
-import { l as policyLevels } from "./policy-CLQ8__GF.js";
+import { d as scopeList, s as resolveScope } from "./scopes-BSdYaGHs.js";
+import { l as policyLevels } from "./policy-DxQyHKPB.js";
 import { t as requiresApproval } from "./approval-required-TzNB9oQA.js";
-import { t as getPermDock } from "./permdock-BvjivVb9.js";
-import { u as usageResult } from "./errors-Vpu6rKHl.js";
-import { c as requirePolicy } from "./load-DjSU5KXO.js";
+import { t as getPermDock } from "./permdock-DdzMv5-F.js";
+import { u as usageResult } from "./errors-BhRkoNS7.js";
+import { c as requirePolicy } from "./load-BaEamml-.js";
 import { s as quoteSqlLiteral, t as SQL_IDENT } from "./sql-0WjxIp9g.js";
-import { a as scopeMembershipTable, i as scopeColumn } from "./compile-EzEMB-7v.js";
+import { a as scopeMembershipTable, i as scopeColumn } from "./compile-B_oJqmIg.js";
 import { d as keptKeys } from "./sources-C4vkzZJV.js";
-import { t as applyFiles } from "./files-B3AA05f1.js";
-import { i as fileDrift } from "./output-files-BIQ_9pIs.js";
-import { n as fixtureSubject, r as loadFixtures, t as fixtureRow } from "./fixtures-Bm4_K1ke.js";
-import { A as quoteQualified, O as quoteIdent, a as customRolesOn, t as CUSTOM_ROLES } from "./shared-DrGLwM3s.js";
-import { n as tableNameOf, r as tableNames } from "./tables-DimBcVWY.js";
-import { d as andConditions, l as collectGrants, o as assignableRoles, p as contextRefs, t as ownershipRules, u as roleNames } from "./ownership-qqBuGJXr.js";
+import { t as applyFiles } from "./files-CfiRtQ-m.js";
+import { i as fileDrift } from "./output-files-CM0BnH05.js";
+import { n as fixtureSubject, r as loadFixtures, t as fixtureRow } from "./fixtures-0VTW5oNq.js";
+import { A as quoteQualified, O as quoteIdent, a as customRolesOn, t as CUSTOM_ROLES } from "./shared-DyYVEjKC.js";
+import { n as tableNameOf, r as tableNames } from "./tables-BsGE6HBR.js";
+import { d as andConditions, l as collectGrants, o as assignableRoles, p as contextRefs, t as ownershipRules, u as roleNames } from "./ownership-moSRhxl_.js";
 import { t as membershipSourcesOf } from "./sources-qoIJQrJv.js";
-import { n as pgConnector } from "./pg-DQTqRrou.js";
-import { m as tableFor, t as canFixture } from "./verify-DfT0QYNh.js";
+import { n as pgConnector } from "./pg-Ddxsd5ZB.js";
+import { m as tableFor, t as canFixture } from "./verify-C8G8D5mk.js";
 import { resolve } from "node:path";
 //#region src/cli/powersync/names.ts
 function ident(name) {

package/dist/powersync-Cqzx25dI.js

@@ -0,0 +1 @@
+export { n as runPowerSync } from "./powersync-C0nsyULQ.js";

package/dist/preset/index.js

@@ -1 +1 @@
-export { s as ARCHETYPES, c as AUTH, l as BACKENDS, u as FEATURES, d as FRAMEWORKS, f as INTEGRATIONS, p as PRESET_DEFAULTS, r as PRESET_FLAGS, m as SERVICES, a as decodePreset, o as encodePreset, n as generatePreset, h as integrationsOf, i as presetFlags, t as presetMatrix, g as resolvePreset } from "../preset-BjLzeFpp.js";
+export { s as ARCHETYPES, c as AUTH, l as BACKENDS, u as FEATURES, d as FRAMEWORKS, f as INTEGRATIONS, p as PRESET_DEFAULTS, r as PRESET_FLAGS, m as SERVICES, a as decodePreset, o as encodePreset, n as generatePreset, h as integrationsOf, i as presetFlags, t as presetMatrix, g as resolvePreset } from "../preset-pPrVyGU5.js";

package/dist/{preset-BjLzeFpp.js → preset-pPrVyGU5.js}

@@ -934,16 +934,80 @@ export async function currentUser(${sessionCall(ctx).takesRequest ? "_request: R
 }
 `;
 }
+function supabaseCookieSession() {
+	return `import { createServerClient } from "@supabase/ssr";
+import { cookies } from "next/headers";
+import { subjectFromSupabase } from "permdock/supabase";
+
+/**
+ * The subject the Supabase session cookie proves, verified with getClaims();
+ * anonymous without one. proxy.ts refreshes the session before this runs, so
+ * setAll has nothing to write.
+ */
+export async function currentSubject() {
+  const store = await cookies();
+  const supabase = createServerClient(
+    ${env("SUPABASE_URL")} ?? "",
+    ${env("SUPABASE_PUBLISHABLE_KEY")} ?? "",
+    { cookies: { getAll: () => store.getAll(), setAll: () => undefined } },
+  );
+  const { data, error } = await supabase.auth.getClaims();
+  return subjectFromSupabase(error ? null : (data?.claims ?? null));
+}
+`;
+}
+/**
+* Next.js 16's `proxy.ts`: refreshes the Supabase session once per request and
+* returns the response `setAll` built, with the cache headers `@supabase/ssr`
+* passes so a CDN never stores a session cookie.
+*/
+function supabaseProxy() {
+	return `import { createServerClient } from "@supabase/ssr";
+import { type NextRequest, NextResponse } from "next/server";
+
+/** Refreshes the Supabase session; authorization happens in the pages. */
+export async function proxy(request: NextRequest) {
+  let response = NextResponse.next({ request });
+  const supabase = createServerClient(
+    ${env("SUPABASE_URL")} ?? "",
+    ${env("SUPABASE_PUBLISHABLE_KEY")} ?? "",
+    {
+      cookies: {
+        getAll: () => request.cookies.getAll(),
+        setAll: (cookiesToSet, headers) => {
+          for (const { name, value } of cookiesToSet) {
+            request.cookies.set(name, value);
+          }
+          response = NextResponse.next({ request });
+          for (const { name, value, options } of cookiesToSet) {
+            response.cookies.set(name, value, options);
+          }
+          for (const [key, value] of Object.entries(headers)) {
+            response.headers.set(key, value);
+          }
+        },
+      },
+    },
+  );
+  await supabase.auth.getClaims();
+  return response;
+}
+
+export const config = {
+  matcher: ["/((?!_next/static|_next/image|favicon.ico).*)"],
+};
+`;
+}
 function supabaseSession(ctx) {
+	if (!sessionCall(ctx).takesRequest) return supabaseCookieSession();
 	const h = headersOf(ctx);
-	const browser = sessionCall(ctx).takesRequest ? "" : "\n * A browser session keeps the token in cookies: read it there with\n * createServerClient from @supabase/ssr.";
 	return moduleText([
 		`import { createClient } from "@supabase/supabase-js";`,
 		...h.imports,
 		`import { subjectFromSupabase } from "permdock/supabase";`
 	], `/**
  * The subject the Supabase access token in the Authorization header proves;
- * anonymous without a valid one.${browser}
+ * anonymous without a valid one.
  */
 export async function currentSubject(${h.param}) {
   const requestHeaders = ${h.read};
@@ -1038,7 +1102,7 @@ function sessionFiles(ctx) {
 	const at = (name) => `${ctx.src}/${name}`;
 	switch (ctx.preset.auth) {
 		case "custom": return [ownedFile(at("session.ts"), customSession(ctx))];
-		case "supabase": return [ownedFile(at("session.ts"), supabaseSession(ctx))];
+		case "supabase": return [ownedFile(at("session.ts"), supabaseSession(ctx)), ...sessionCall(ctx).takesRequest ? [] : [ownedFile(at("proxy.ts"), supabaseProxy())]];
 		case "better-auth": return [ownedFile(at("auth.ts"), betterAuthFile()), ownedFile(at("session.ts"), betterAuthSession(ctx))];
 		case "clerk": return [ownedFile(at("session.ts"), clerkSession(ctx))];
 		case "jwt": return [ownedFile(at("session.ts"), jwtSession(ctx))];
@@ -1048,7 +1112,7 @@ function sessionFiles(ctx) {
 function authDependencies(ctx) {
 	switch (ctx.preset.auth) {
 		case "custom": return [];
-		case "supabase": return ["@supabase/supabase-js"];
+		case "supabase": return sessionCall(ctx).takesRequest ? ["@supabase/supabase-js"] : ["@supabase/ssr", "@supabase/supabase-js"];
 		case "better-auth": return ["better-auth"];
 		case "clerk": return [sessionCall(ctx).takesRequest ? "@clerk/backend" : "@clerk/nextjs"];
 		case "jwt": return ["jose"];
@@ -1489,14 +1553,17 @@ app.patch(
 );
 `)];
 		case "none":
-			if (current === "currentSubject") return [owned(`${ctx.src}/server.ts`, `import { getPermDock } from "permdock";
+			if (current === "currentSubject") return [owned(`${ctx.src}/server.ts`, `import { getPermDock, instanceCache } from "permdock";
 
 import { app } from "./permdock";
 import { currentSubject } from "./session";
 
-/** The request-scoped decision object for the caller of \`request\`; create one per request. */
+/** Instances reused while a caller's authorization version holds; one per process. */
+const instances = instanceCache();
+
+/** The decision object for the caller of \`request\`. */
 export async function permdockFor(request: Request) {
-  return getPermDock(app, await currentSubject(request));
+  return getPermDock(app, await currentSubject(request), { instances });
 }
 `)];
 			return [owned(`${ctx.src}/server.ts`, `import { getPermDockSync } from "permdock";

package/dist/prisma/index.d.ts

@@ -1,5 +1,5 @@
-import { Wt as Instant, br as Condition, hr as Subject } from "../policy-types-DGIO_gxq.js";
-import { f as WhereResult } from "../permdock-CprAPN3w.js";
+import { Kt as Instant, wr as Condition, yr as Subject } from "../policy-types-IRJVABmm.js";
+import { f as WhereResult } from "../permdock-DUWZEOLR.js";
 import { r as RelationsMapping } from "../graph-sql-BwFC4Qjs.js";
 import { n as RowCheck, t as WithSubjectOptions } from "../subject-settings-vNW8qmUH.js";
 //#region src/prisma/model-fields.d.ts

package/dist/prisma/index.js

@@ -2,7 +2,7 @@ import { t as compact } from "../compact-CAf557ZB.js";
 import { n as freezeDeep } from "../freeze-jjan0lCv.js";
 import { t as assertSafeKey } from "../paths-CUvURzHp.js";
 import { n as PermDockValidationError } from "../validation-error-CYg2kJEw.js";
-import { c as relatedTargetsSql, d as restrictedRowsSql, n as compileWhere, o as relatedRowGuard, r as escapeLike, u as renderGraphSql } from "../compile-EzEMB-7v.js";
+import { c as relatedTargetsSql, d as restrictedRowsSql, n as compileWhere, o as relatedRowGuard, r as escapeLike, u as renderGraphSql } from "../compile-B_oJqmIg.js";
 import { n as statementText, o as rowCheckOf, r as subjectStatements, s as loadPeer } from "../subject-settings-8sH5HlII.js";
 //#region src/prisma/to-where.ts
 function fieldTests(options) {

package/dist/{protected-action-DUYqb-Ma.js → protected-action-B6n6w7Rl.js}

@@ -1,6 +1,6 @@
 import { a as problemType } from "./problem-details-CLDgX1KV.js";
 import { t as approvalHeaderValue } from "./approval-header-8QV6MU4H.js";
-import { t as approvalHandle } from "./views-CD8wuL4Z.js";
+import { t as approvalHandle } from "./views-TrZYlDnM.js";
 //#region src/client/headers.ts
 /**
 * The `PermDock-Approval` header for a resume; a `TypeError` for a token that