permdock 0.16.0 → 0.18.0

package/dist/{postgrest-DAxFltvO.js → postgrest-BrjrckDG.js}

@@ -1,10 +1,11 @@
 import { r as isRecord, t as compact } from "./compact-CAf557ZB.js";
 import { n as freezeDeep } from "./freeze-jjan0lCv.js";
 import { r as validateRecord } from "./thenable-BNSM1U2R.js";
-import { t as anonymousSubject } from "./subject-BGoM5o8B.js";
+import { f as nowMillis } from "./time-nR1JesoH.js";
+import { t as anonymousSubject } from "./subject-C7RddW0G.js";
 import { t as readClaim } from "./claims-map-CKkoAAYF.js";
 import { t as clientNameOf } from "./clients-DYr3U86j.js";
-import "./budget-BELja5A9.js";
+import "./budget-BBCPDOGP.js";
 import { a as hookApiNames } from "./sources-C4vkzZJV.js";
 //#region src/supabase/subject.ts
 const REGISTERED = /* @__PURE__ */ new Set([
@@ -79,14 +80,12 @@ function asMembership(item) {
 	const scope = typeof item["scope"] === "string" ? item["scope"] : void 0;
 	const id = typeof item["id"] === "string" ? item["id"] : void 0;
 	const within = isRecord(item["within"]) ? Object.fromEntries(Object.entries(item["within"]).filter((entry) => typeof entry[1] === "string")) : void 0;
-	const tenant = typeof item["tenant"] === "string" ? item["tenant"] : void 0;
-	const team = typeof item["team"] === "string" ? item["team"] : void 0;
 	const onRecord = isRecord(item["on"]) ? item["on"] : void 0;
 	const on = onRecord !== void 0 && typeof onRecord["resource"] === "string" && typeof onRecord["id"] === "string" ? {
 		resource: onRecord["resource"],
 		id: onRecord["id"]
 	} : void 0;
-	if ((scope === void 0 || id === void 0) && tenant === void 0 && team === void 0 && on === void 0) return;
+	if ((scope === void 0 || id === void 0) && on === void 0) return;
 	const keep = item["keep"];
 	if (keep !== void 0 && (!Array.isArray(keep) || !keep.every((key) => typeof key === "string" && key !== ""))) return;
 	return compact({
@@ -94,8 +93,6 @@ function asMembership(item) {
 		scope,
 		id,
 		within,
-		tenant,
-		team,
 		on,
 		via: typeof item["via"] === "string" ? item["via"] : void 0,
 		expiresAt: typeof item["expires_at"] === "number" ? item["expires_at"] : void 0,
@@ -487,8 +484,41 @@ function readSubjectRecord(value) {
 		claims: isRecord(value["claims"]) && Object.keys(value["claims"]).length > 0 ? value["claims"] : void 0
 	});
 }
-function once(memo, key, read) {
-	return memo === void 0 ? read() : memo(key, read);
+/**
+* Uncached version reads of one principal closer together than this count as
+* one request reading the version more than once.
+*/
+const REPEAT_WINDOW_MS = 1e3;
+const REPEAT_TRACKED = 1e3;
+/** Read through `globalThis` so the entry loads on runtimes without `process`. */
+function isDevelopment() {
+	const proc = Reflect.get(globalThis, "process");
+	if (typeof proc !== "object" || proc === null) return false;
+	const env = Reflect.get(proc, "env");
+	return typeof env === "object" && env !== null && Reflect.get(env, "NODE_ENV") === "development";
+}
+/**
+* In development, warns once when one principal's version is read twice within
+* `REPEAT_WINDOW_MS`: a request that builds its instance more than once instead
+* of sharing it through `instanceCache` or `permdockFor`.
+*/
+function repeatedVersionReads() {
+	if (!isDevelopment()) return () => void 0;
+	const last = /* @__PURE__ */ new Map();
+	let warned = false;
+	return (userId) => {
+		if (warned) return;
+		const at = nowMillis();
+		const previous = last.get(userId);
+		if (previous !== void 0 && at - previous < REPEAT_WINDOW_MS) {
+			warned = true;
+			last.clear();
+			console.warn("PermDock: the authorization version of one user was read more than once within a second. Share one instance per request through instanceCache and permdockFor, or pass version: { known }.");
+			return;
+		}
+		if (last.size >= REPEAT_TRACKED) last.clear();
+		last.set(userId, at);
+	};
 }
 /**
 * Membership, custom-role and subject sources over the `subject_for(p_user)`,
@@ -496,12 +526,12 @@ function once(memo, key, read) {
 * `permdock supabase hook generate` writes, for a backend that reaches Postgres
 * only through PostgREST. `memberships.version` reads only the version, so
 * `claimsFirst` with `onStale: 'reread'` reads the full subject only for a
-* stale token; when the version function is missing it falls back to
-* `subject_for`. With `policy`, a token that claims a custom role has its
-* subject read in one `subject_for` call instead, and custom roles are read
-* only for a subject that holds one. It keeps no answers: create it once at
-* module scope, and `getPermDock` shares each read within one instance. Pass
-* `claimsFirst(…, { versions })` to share version reads across instances.
+* stale token; a missing version function throws, and `permdock doctor` PD083
+* reports it. With `policy`, a token that claims a custom role has its subject
+* read in one `subject_for` call instead, and custom roles are read only for a
+* subject that holds one. It keeps no answers: create it once at module scope,
+* and `getPermDock` shares each read within one instance. Pass `claimsFirst(…,
+* { versions })` to share version reads across instances.
 */
 function postgrestSources(client, options = {}) {
 	const api = options.api;
@@ -512,7 +542,29 @@ function postgrestSources(client, options = {}) {
 	const versionFn = options.versionFn ?? names?.authzVersionFor ?? "authz_version_for";
 	const declared = options.policy === void 0 ? void 0 : options.policy.index.declaredRoles;
 	const onlyDeclared = (held) => declared !== void 0 && held?.every((name) => declared.has(name)) === true;
-	const list = async (query) => {
+	const hook = options.onSourceCall;
+	const noteVersionRead = repeatedVersionReads();
+	const once = (memo, method, key, read) => {
+		let ran = false;
+		const started = performance.now();
+		const run = () => {
+			ran = true;
+			return read();
+		};
+		const answer = memo === void 0 ? run() : memo(key, run);
+		if (hook === void 0) return answer;
+		return answer.finally(() => {
+			try {
+				hook({
+					source: "postgrest",
+					method,
+					durationMs: performance.now() - started,
+					cached: !ran
+				});
+			} catch {}
+		});
+	};
+	const members = async (query) => {
 		const result = await callRpc(client, schema, membersFn, {
 			p_scope: query.scope,
 			p_id: query.id
@@ -520,14 +572,17 @@ function postgrestSources(client, options = {}) {
 		if (result.error !== null) throw new Error(`PermDock: ${schema}.${membersFn} failed: ${result.error.message}`);
 		return readMemberEntries(result.data);
 	};
-	const record = (userId, memo) => once(memo, `${schema}.${fn}:${userId}`, async () => {
+	const list = (query) => once(void 0, `${schema}.${membersFn}`, "", () => members(query));
+	const record = (userId, memo) => once(memo, `${schema}.${fn}`, `${schema}.${fn}:${userId}`, async () => {
 		const result = await callRpc(client, schema, fn, { p_user: userId });
 		if (result.error !== null) throw new Error(`PermDock: ${schema}.${fn} failed: ${result.error.message}`);
 		return readSubjectRecord(result.data);
 	});
-	const version = (userId, memo) => once(memo, `${schema}.${versionFn}:${userId}`, async () => {
+	const version = (userId, memo) => once(memo, `${schema}.${versionFn}`, `${schema}.${versionFn}:${userId}`, async () => {
+		noteVersionRead(userId);
 		const result = await callRpc(client, schema, versionFn, { p_user: userId });
-		return result.error === null ? versionOf(result.data) : (await record(userId, memo))?.authzVersion;
+		if (result.error !== null) throw new Error(`PermDock: ${schema}.${versionFn} failed: ${result.error.message}`);
+		return versionOf(result.data);
 	});
 	const live = async (userId, memo) => {
 		const found = await record(userId, memo);

package/dist/{postgrest-D5nUGm-c.d.ts → postgrest-D84p5dbA.d.ts}

@@ -1,4 +1,4 @@
-import { G as CustomRoleSource, T as Policy, fr as Membership, hr as Subject, nt as MembershipSource, pr as Principal, sr as CustomRole, tt as MemberEntry } from "./policy-types-DGIO_gxq.js";
+import { E as Policy, K as CustomRoleSource, _r as Principal, dr as CustomRole, gr as Membership, nt as MemberEntry, rt as MembershipSource, ut as SourceCall, yr as Subject } from "./policy-types-D-GwfQTc.js";
 //#region src/supabase/postgrest.d.ts
 /**
  * What a supabase-js `rpc` call resolves to: `data` or an `error` with a
@@ -57,6 +57,11 @@ type PostgrestSourcesOptions = {
    * token claims a custom role, which the custom roles need anyway.
    */
   readonly policy?: Policy;
+  /**
+   * Called after every function read with its duration and whether the
+   * instance's memo answered it. A hook that throws is ignored.
+   */
+  readonly onSourceCall?: (call: SourceCall) => void;
 };
 /** One user as `subject_for(p_user)` returns it. */
 type SubjectRecord = {
@@ -119,12 +124,12 @@ declare function readSubjectRecord(value: unknown): SubjectRecord | undefined;
  * `permdock supabase hook generate` writes, for a backend that reaches Postgres
  * only through PostgREST. `memberships.version` reads only the version, so
  * `claimsFirst` with `onStale: 'reread'` reads the full subject only for a
- * stale token; when the version function is missing it falls back to
- * `subject_for`. With `policy`, a token that claims a custom role has its
- * subject read in one `subject_for` call instead, and custom roles are read
- * only for a subject that holds one. It keeps no answers: create it once at
- * module scope, and `getPermDock` shares each read within one instance. Pass
- * `claimsFirst(…, { versions })` to share version reads across instances.
+ * stale token; a missing version function throws, and `permdock doctor` PD083
+ * reports it. With `policy`, a token that claims a custom role has its subject
+ * read in one `subject_for` call instead, and custom roles are read only for a
+ * subject that holds one. It keeps no answers: create it once at module scope,
+ * and `getPermDock` shares each read within one instance. Pass `claimsFirst(…,
+ * { versions })` to share version reads across instances.
  */
 declare function postgrestSources(client: SupabaseRpcCaller, options?: PostgrestSourcesOptions): PostgrestSources;
 //#endregion

package/dist/{powersync-CBhTBhG2.js → powersync-9PYOE1wt.js}

@@ -1,26 +1,59 @@
 import { r as isRecord, t as compact } from "./compact-CAf557ZB.js";
 import { c as isConditionDate, l as isConditionRef, o as hasConditionOp } from "./refs-C8BKxc_e.js";
-import { g as localSnapshotManifest, j as memoryCustomRoleSource } from "./src-C_pi2Rnh.js";
+import { A as memoryCustomRoleSource, g as localSnapshotManifest } from "./src-Brzq_0in.js";
 import { n as findPermission } from "./permission-registry-B8tYxPIt.js";
-import { f as scopeList, s as resolveScope } from "./scopes-0Up_UA2t.js";
-import { l as policyLevels } from "./policy-CLQ8__GF.js";
+import { d as scopeList, s as resolveScope } from "./scopes-BSdYaGHs.js";
+import { l as policyLevels } from "./policy-cV_wwPb8.js";
 import { t as requiresApproval } from "./approval-required-TzNB9oQA.js";
-import { t as getPermDock } from "./permdock-BvjivVb9.js";
-import { u as usageResult } from "./errors-Vpu6rKHl.js";
-import { c as requirePolicy } from "./load-DjSU5KXO.js";
+import { t as getPermDock } from "./permdock-D-_WrdKu.js";
+import { u as usageResult } from "./errors-BhRkoNS7.js";
+import { c as requirePolicy } from "./load-BaEamml-.js";
 import { s as quoteSqlLiteral, t as SQL_IDENT } from "./sql-0WjxIp9g.js";
-import { a as scopeMembershipTable, i as scopeColumn } from "./compile-EzEMB-7v.js";
-import { d as keptKeys } from "./sources-C4vkzZJV.js";
-import { t as applyFiles } from "./files-B3AA05f1.js";
-import { i as fileDrift } from "./output-files-BIQ_9pIs.js";
-import { n as fixtureSubject, r as loadFixtures, t as fixtureRow } from "./fixtures-Bm4_K1ke.js";
-import { A as quoteQualified, O as quoteIdent, a as customRolesOn, t as CUSTOM_ROLES } from "./shared-DrGLwM3s.js";
-import { n as tableNameOf, r as tableNames } from "./tables-DimBcVWY.js";
-import { d as andConditions, l as collectGrants, o as assignableRoles, p as contextRefs, t as ownershipRules, u as roleNames } from "./ownership-qqBuGJXr.js";
+import { a as scopeMembershipTable, i as scopeColumn } from "./compile-B_oJqmIg.js";
+import { d as keptKeys, t as AUTHZ_VERSION_TABLE } from "./sources-C4vkzZJV.js";
+import { t as applyFiles } from "./files-CfiRtQ-m.js";
+import { i as fileDrift } from "./output-files-CM0BnH05.js";
+import { n as fixtureSubject, r as loadFixtures, t as fixtureRow } from "./fixtures-Cemqurt8.js";
+import { A as quoteQualified, O as quoteIdent, a as customRolesOn, t as CUSTOM_ROLES } from "./shared-DyYVEjKC.js";
+import { n as tableNameOf, r as tableNames } from "./tables-BfOk0ymL.js";
+import { d as andConditions, l as collectGrants, o as assignableRoles, p as contextRefs, t as ownershipRules, u as roleNames } from "./ownership-D-mIt-w0.js";
 import { t as membershipSourcesOf } from "./sources-qoIJQrJv.js";
-import { n as pgConnector } from "./pg-DQTqRrou.js";
-import { m as tableFor, t as canFixture } from "./verify-DfT0QYNh.js";
+import { n as pgConnector } from "./pg-Ddxsd5ZB.js";
+import { m as tableFor, t as canFixture } from "./verify-Bpj0hauG.js";
 import { resolve } from "node:path";
+//#region src/cli/powersync/claims.ts
+/** The `/docs` section that explains why a claim stream needs a reconnect. */
+const RECONNECT_DOCS = "/docs/adapters/react-native#role-and-tenant-changes";
+/** A dialect that records every claim name a query reads. */
+function claimRecorder(dialect) {
+	const names = /* @__PURE__ */ new Set();
+	return {
+		names,
+		dialect: {
+			...dialect,
+			claim: (name) => {
+				names.add(name);
+				return dialect.claim(name);
+			},
+			claims: (name) => {
+				names.add(name);
+				return dialect.claims(name);
+			}
+		}
+	};
+}
+/** The recorded claims the kept queries still read, sorted. */
+function claimsIn(queries, names, dialect) {
+	return [...names].filter((name) => queries.some((query) => query.includes(dialect.claim(name)) || query.includes(dialect.claims(name)))).toSorted();
+}
+/**
+* One line per stream that reads a token claim: PowerSync keeps the claims a
+* connection started with, so a changed claim needs a reconnect.
+*/
+function claimWarnings(streams) {
+	return streams.filter((stream) => stream.claims.length > 0).map((stream) => `stream ${stream.name} reads token claims ${stream.claims.join(", ")}: PowerSync keeps the claims it connected with, so refresh the session and reconnect after a role or tenant change (${RECONNECT_DOCS})`);
+}
+//#endregion
 //#region src/cli/powersync/names.ts
 function ident(name) {
 	if (!SQL_IDENT.test(name)) throw new TypeError(`PermDock CLI: '${name}' is not a plain identifier, which Sync Streams need`);
@@ -217,6 +250,21 @@ function roleTableRows(stream, dialect, keep = false) {
 	});
 }
 //#endregion
+//#region src/cli/powersync/version.ts
+/** The user column of `permdock_authz_version`. */
+const VERSION_USER = "user_id";
+/** The version column of `permdock_authz_version`. */
+const VERSION_COLUMN = "version";
+/**
+* `<schema>.permdock_authz_version` when `supabase.hook` keeps the version
+* table, the one `supabase hook generate` writes; otherwise `undefined`.
+*/
+function authzVersionTable(config) {
+	const hook = config.supabase?.hook;
+	if (hook === void 0 || hook.version === false) return;
+	return `${hook.schema ?? config.rls?.schema ?? "permdock"}.${AUTHZ_VERSION_TABLE}`;
+}
+//#endregion
 //#region src/cli/powersync/rows.ts
 function throughColumn(through, device) {
 	const [pair] = Object.entries(through.on);
@@ -298,7 +346,13 @@ function localRows(policy, config, devices) {
 	const schema = rls?.schema ?? "permdock";
 	const database = rls?.authorize === "database";
 	const global = rls?.roles ?? (database ? { table: `${schema}.user_roles` } : void 0);
+	const versionTable = authzVersionTable(config);
 	return compact({
+		version: versionTable === void 0 ? void 0 : {
+			table: device(versionTable),
+			user: VERSION_USER,
+			version: VERSION_COLUMN
+		},
 		memberships,
 		roles: global === void 0 ? void 0 : {
 			table: device(global.table),
@@ -846,6 +900,11 @@ function subjectStreams(ctx) {
 			for (const ids of tenantIds) add(table, `SELECT * FROM ${from} WHERE ${tenant} IN (${ids})`);
 		}
 	}
+	const versionTable = authzVersionTable(ctx.config);
+	if (versionTable !== void 0) {
+		const table = bare(versionTable, dialect);
+		add(table, `SELECT * FROM ${fromTable(versionTable, dialect)} WHERE ${dialect.column(table, VERSION_USER)} = ${dialect.user}`, VERSION_USER);
+	}
 	const out = [];
 	const names = /* @__PURE__ */ new Set();
 	for (const [table, entry] of tables) {
@@ -916,13 +975,14 @@ function powersyncPlan(policy, config, dialect = POWERSYNC) {
 }
 function planWith(policy, config, dialect) {
 	const scopes = scopeList(policy.scopes);
+	const recorder = claimRecorder(dialect);
 	const grants = collectGrants(policy);
 	const ctx = {
 		policy,
 		config,
 		scopes,
 		kinds: ownershipRules(policy, scopes)?.kinds ?? {},
-		dialect,
+		dialect: recorder.dialect,
 		sources: guardedSources(policy, config),
 		grants,
 		depth: 0,
@@ -1006,7 +1066,8 @@ function planWith(policy, config, dialect) {
 			resource,
 			table,
 			id,
-			queries: [...queries]
+			queries: [...queries],
+			claims: claimsIn([...queries], recorder.names, dialect)
 		});
 	}
 	const tables = tableStreams(config.powersync?.tables ?? {}, dialect, new Set(streams.map((stream) => stream.name)), (resource) => ({
@@ -1034,6 +1095,60 @@ function planWith(policy, config, dialect) {
 	};
 }
 //#endregion
+//#region src/cli/powersync/verify-claims.ts
+function text(row, key) {
+	const value = isRecord(row) ? row[key] : void 0;
+	return typeof value === "string" || typeof value === "number" || typeof value === "bigint" ? String(value) : void 0;
+}
+function changedClaims(fixture) {
+	const before = fixture.subject.claims ?? {};
+	const after = fixture.after.claims ?? before;
+	return new Set([...Object.keys(before), ...Object.keys(after)].filter((name) => JSON.stringify(before[name]) !== JSON.stringify(after[name])));
+}
+/** The rows the stream syncs to the user with these claims, by id. */
+async function rowsFor(query, stream, user, claims) {
+	const rows = /* @__PURE__ */ new Map();
+	for (const sql of stream.queries) for (const row of await query(`select q.* from (${sql}) q where $1::text is not null and $2::jsonb is not null`, [user, JSON.stringify(claims)])) {
+		const id = text(row, stream.id);
+		if (id !== void 0) rows.set(id, row);
+	}
+	return rows;
+}
+/**
+* Check a claims change against every stream that reads a changed claim, or the
+* fixture's `stream`.
+*/
+async function verifyClaimsChange(input) {
+	const { fixture, plan, mismatches } = input;
+	const label = `claims change for ${fixture.subject.id}`;
+	const changed = changedClaims(fixture);
+	const streams = fixture.stream === void 0 ? plan.streams.filter((stream) => stream.claims.some((name) => changed.has(name))) : plan.streams.filter((stream) => stream.name === fixture.stream);
+	if (streams.length === 0) {
+		mismatches.push(fixture.stream === void 0 ? `${label}: no stream reads a changed claim` : `${label}: no stream named ${fixture.stream}`);
+		return;
+	}
+	const action = input.config.powersync?.action ?? "read";
+	const subject = {
+		...fixture.subject,
+		...fixture.after
+	};
+	for (const stream of streams) {
+		const before = await rowsFor(input.query, stream, fixture.subject.id, fixture.subject.claims ?? {});
+		const after = await rowsFor(input.query, stream, fixture.subject.id, subject.claims ?? {});
+		if (before.size === after.size && [...before.keys()].every((id) => after.has(id))) mismatches.push(`${label}: stream ${stream.name} syncs the same rows before and after the change`);
+		const permission = findPermission(input.policy.permissions, `${stream.resource}.${action}`);
+		if (permission === void 0) continue;
+		for (const [id, row] of after) {
+			const tenant = input.root === void 0 ? void 0 : text(row, input.root);
+			const permdock = await getPermDock(input.policy, fixtureSubject({
+				...subject,
+				...tenant === void 0 ? {} : { tenant }
+			}), { customRoles: memoryCustomRoleSource(input.customRoles) });
+			if (!canFixture(permdock, permission, row)) mismatches.push(`${label}: stream ${stream.name} syncs ${stream.table} row ${id} after the change, which the policy denies`);
+		}
+	}
+}
+//#endregion
 //#region src/cli/powersync/verify-followed.ts
 /** Check a non-resource row against its own-user rule or readable parents. */
 async function verifyFollowedRow(input) {
@@ -1074,7 +1189,8 @@ async function verifyFollowedRow(input) {
 	const holds = await input.synced({
 		...stream,
 		resource: fixture.table,
-		id: "id"
+		id: "id",
+		claims: []
 	}, fixture);
 	if (holds === void 0) mismatches.push(`${label}: fixture row needs id`);
 	else if (holds && !granted) mismatches.push(`${label}: stream ${stream.name} syncs a row the policy denies`);
@@ -1120,6 +1236,12 @@ function powersyncYaml(plan) {
 	const lines = [
 		"# Generated by permdock powersync generate from the policy. Do not edit.",
 		...plan.publication === void 0 ? [] : ["# Tables outside public must be in the powersync publication:", `# ${plan.publication}`],
+		...plan.streams.some((stream) => stream.claims.length > 0) ? [
+			"# Streams that read token claims keep the claims a connection started with:",
+			"# refresh the session and reconnect PowerSync after a role or tenant change.",
+			`# https://permdock.com${RECONNECT_DOCS}`,
+			...plan.streams.filter((stream) => stream.claims.length > 0).map((stream) => `#   ${stream.name} reads ${stream.claims.join(", ")}`)
+		] : [],
 		"config:",
 		"  edition: 3",
 		"",
@@ -1175,6 +1297,7 @@ function powersyncFiles(policy, config, out) {
 	return {
 		files,
 		warnings: plan.warnings,
+		claims: claimWarnings(plan.streams),
 		...plan.publication === void 0 ? {} : { publication: plan.publication }
 	};
 }
@@ -1235,6 +1358,19 @@ async function verifyStreams(input) {
 			for (const stream of [...plan.subject, ...plan.tables]) if (stream.user !== void 0 && await leaks(query, stream, stream.user, fixture)) mismatches.push(`stream ${stream.name} syncs another user's ${stream.table} rows to ${fixture.subject.id}`);
 		}
 		for (const fixture of input.fixtures) {
+			if ("after" in fixture) {
+				await verifyClaimsChange({
+					policy: input.policy,
+					config: input.config,
+					customRoles: input.customRoles,
+					plan,
+					fixture,
+					root,
+					query,
+					mismatches
+				});
+				continue;
+			}
 			if ("table" in fixture) {
 				await verifyFollowedRow({
 					policy: input.policy,
@@ -1320,12 +1456,13 @@ async function runPowerSync(input) {
 			output: [
 				...files.map((file) => `wrote ${file.path}`),
 				...compiled.publication === void 0 ? [] : [`add the tables outside public to the powersync publication: ${compiled.publication}`],
-				...warnings
+				...warnings,
+				...compiled.claims.map((line) => `PD084: ${line}`)
 			].join("\n")
 		};
 	}
 	const mismatches = stale.map((file) => `${file.path} ${file.missing ? "is missing" : "differs from the policy"}: run permdock powersync generate`);
-	const notes = [...warnings];
+	const notes = [...warnings, ...compiled.claims.map((line) => `PD084: ${line}`)];
 	if (input.db !== void 0) try {
 		const fixturesPath = input.fixtures ?? input.config.rls?.fixtures ?? "rls.fixtures.json";
 		const { fixtures, customRoles } = await loadFixtures(input.cwd, fixturesPath, true);

package/dist/{powersync-DAfo0EL5.js → powersync-DStC_g0B.js}

@@ -1,5 +1,5 @@
 import { t as defineLeaf } from "./command-L8EstFNm.js";
-import { c as given, d as policyFlag, n as dbUrl, o as fileOut, r as dbUrlFlags, t as checkFlag } from "./flags-DXjoTVbS.js";
+import { c as given, d as policyFlag, n as dbUrl, o as fileOut, r as dbUrlFlags, t as checkFlag } from "./flags-BlmpmXoY.js";
 //#region src/cli/commands/powersync.ts
 const generate = defineLeaf({
 	flags: {
@@ -14,7 +14,7 @@ const generate = defineLeaf({
 	async run(ctx, { flags }) {
 		const out = fileOut("powersync", flags.out);
 		const from = given(flags.policy);
-		const { runPowerSync } = await import("./powersync-0QVP_DuR.js");
+		const { runPowerSync } = await import("./powersync-xNRlC4jN.js");
 		return runPowerSync({
 			cwd: ctx.cwd,
 			config: ctx.config,
@@ -45,7 +45,7 @@ const verify = defineLeaf({
 		const db = await dbUrl(ctx, flags, { required: true });
 		const fixtures = given(flags.fixtures);
 		const from = given(flags.policy);
-		const { runPowerSync } = await import("./powersync-0QVP_DuR.js");
+		const { runPowerSync } = await import("./powersync-xNRlC4jN.js");
 		return runPowerSync({
 			cwd: ctx.cwd,
 			config: ctx.config,

package/dist/powersync-xNRlC4jN.js

@@ -0,0 +1 @@
+export { n as runPowerSync } from "./powersync-9PYOE1wt.js";

package/dist/preset/index.js

@@ -1 +1 @@
-export { s as ARCHETYPES, c as AUTH, l as BACKENDS, u as FEATURES, d as FRAMEWORKS, f as INTEGRATIONS, p as PRESET_DEFAULTS, r as PRESET_FLAGS, m as SERVICES, a as decodePreset, o as encodePreset, n as generatePreset, h as integrationsOf, i as presetFlags, t as presetMatrix, g as resolvePreset } from "../preset-BjLzeFpp.js";
+export { s as ARCHETYPES, c as AUTH, l as BACKENDS, u as FEATURES, d as FRAMEWORKS, f as INTEGRATIONS, p as PRESET_DEFAULTS, r as PRESET_FLAGS, m as SERVICES, a as decodePreset, o as encodePreset, n as generatePreset, h as integrationsOf, i as presetFlags, t as presetMatrix, g as resolvePreset } from "../preset-pPrVyGU5.js";

package/dist/{preset-BjLzeFpp.js → preset-pPrVyGU5.js}

@@ -934,16 +934,80 @@ export async function currentUser(${sessionCall(ctx).takesRequest ? "_request: R
 }
 `;
 }
+function supabaseCookieSession() {
+	return `import { createServerClient } from "@supabase/ssr";
+import { cookies } from "next/headers";
+import { subjectFromSupabase } from "permdock/supabase";
+
+/**
+ * The subject the Supabase session cookie proves, verified with getClaims();
+ * anonymous without one. proxy.ts refreshes the session before this runs, so
+ * setAll has nothing to write.
+ */
+export async function currentSubject() {
+  const store = await cookies();
+  const supabase = createServerClient(
+    ${env("SUPABASE_URL")} ?? "",
+    ${env("SUPABASE_PUBLISHABLE_KEY")} ?? "",
+    { cookies: { getAll: () => store.getAll(), setAll: () => undefined } },
+  );
+  const { data, error } = await supabase.auth.getClaims();
+  return subjectFromSupabase(error ? null : (data?.claims ?? null));
+}
+`;
+}
+/**
+* Next.js 16's `proxy.ts`: refreshes the Supabase session once per request and
+* returns the response `setAll` built, with the cache headers `@supabase/ssr`
+* passes so a CDN never stores a session cookie.
+*/
+function supabaseProxy() {
+	return `import { createServerClient } from "@supabase/ssr";
+import { type NextRequest, NextResponse } from "next/server";
+
+/** Refreshes the Supabase session; authorization happens in the pages. */
+export async function proxy(request: NextRequest) {
+  let response = NextResponse.next({ request });
+  const supabase = createServerClient(
+    ${env("SUPABASE_URL")} ?? "",
+    ${env("SUPABASE_PUBLISHABLE_KEY")} ?? "",
+    {
+      cookies: {
+        getAll: () => request.cookies.getAll(),
+        setAll: (cookiesToSet, headers) => {
+          for (const { name, value } of cookiesToSet) {
+            request.cookies.set(name, value);
+          }
+          response = NextResponse.next({ request });
+          for (const { name, value, options } of cookiesToSet) {
+            response.cookies.set(name, value, options);
+          }
+          for (const [key, value] of Object.entries(headers)) {
+            response.headers.set(key, value);
+          }
+        },
+      },
+    },
+  );
+  await supabase.auth.getClaims();
+  return response;
+}
+
+export const config = {
+  matcher: ["/((?!_next/static|_next/image|favicon.ico).*)"],
+};
+`;
+}
 function supabaseSession(ctx) {
+	if (!sessionCall(ctx).takesRequest) return supabaseCookieSession();
 	const h = headersOf(ctx);
-	const browser = sessionCall(ctx).takesRequest ? "" : "\n * A browser session keeps the token in cookies: read it there with\n * createServerClient from @supabase/ssr.";
 	return moduleText([
 		`import { createClient } from "@supabase/supabase-js";`,
 		...h.imports,
 		`import { subjectFromSupabase } from "permdock/supabase";`
 	], `/**
  * The subject the Supabase access token in the Authorization header proves;
- * anonymous without a valid one.${browser}
+ * anonymous without a valid one.
  */
 export async function currentSubject(${h.param}) {
   const requestHeaders = ${h.read};
@@ -1038,7 +1102,7 @@ function sessionFiles(ctx) {
 	const at = (name) => `${ctx.src}/${name}`;
 	switch (ctx.preset.auth) {
 		case "custom": return [ownedFile(at("session.ts"), customSession(ctx))];
-		case "supabase": return [ownedFile(at("session.ts"), supabaseSession(ctx))];
+		case "supabase": return [ownedFile(at("session.ts"), supabaseSession(ctx)), ...sessionCall(ctx).takesRequest ? [] : [ownedFile(at("proxy.ts"), supabaseProxy())]];
 		case "better-auth": return [ownedFile(at("auth.ts"), betterAuthFile()), ownedFile(at("session.ts"), betterAuthSession(ctx))];
 		case "clerk": return [ownedFile(at("session.ts"), clerkSession(ctx))];
 		case "jwt": return [ownedFile(at("session.ts"), jwtSession(ctx))];
@@ -1048,7 +1112,7 @@ function sessionFiles(ctx) {
 function authDependencies(ctx) {
 	switch (ctx.preset.auth) {
 		case "custom": return [];
-		case "supabase": return ["@supabase/supabase-js"];
+		case "supabase": return sessionCall(ctx).takesRequest ? ["@supabase/supabase-js"] : ["@supabase/ssr", "@supabase/supabase-js"];
 		case "better-auth": return ["better-auth"];
 		case "clerk": return [sessionCall(ctx).takesRequest ? "@clerk/backend" : "@clerk/nextjs"];
 		case "jwt": return ["jose"];
@@ -1489,14 +1553,17 @@ app.patch(
 );
 `)];
 		case "none":
-			if (current === "currentSubject") return [owned(`${ctx.src}/server.ts`, `import { getPermDock } from "permdock";
+			if (current === "currentSubject") return [owned(`${ctx.src}/server.ts`, `import { getPermDock, instanceCache } from "permdock";
 
 import { app } from "./permdock";
 import { currentSubject } from "./session";
 
-/** The request-scoped decision object for the caller of \`request\`; create one per request. */
+/** Instances reused while a caller's authorization version holds; one per process. */
+const instances = instanceCache();
+
+/** The decision object for the caller of \`request\`. */
 export async function permdockFor(request: Request) {
-  return getPermDock(app, await currentSubject(request));
+  return getPermDock(app, await currentSubject(request), { instances });
 }
 `)];
 			return [owned(`${ctx.src}/server.ts`, `import { getPermDockSync } from "permdock";

package/dist/prisma/index.d.ts

@@ -1,5 +1,5 @@
-import { Wt as Instant, br as Condition, hr as Subject } from "../policy-types-DGIO_gxq.js";
-import { f as WhereResult } from "../permdock-CprAPN3w.js";
+import { Kt as Instant, wr as Condition, yr as Subject } from "../policy-types-D-GwfQTc.js";
+import { f as WhereResult } from "../permdock-ffY4CMd9.js";
 import { r as RelationsMapping } from "../graph-sql-BwFC4Qjs.js";
 import { n as RowCheck, t as WithSubjectOptions } from "../subject-settings-vNW8qmUH.js";
 //#region src/prisma/model-fields.d.ts

package/dist/prisma/index.js

@@ -2,7 +2,7 @@ import { t as compact } from "../compact-CAf557ZB.js";
 import { n as freezeDeep } from "../freeze-jjan0lCv.js";
 import { t as assertSafeKey } from "../paths-CUvURzHp.js";
 import { n as PermDockValidationError } from "../validation-error-CYg2kJEw.js";
-import { c as relatedTargetsSql, d as restrictedRowsSql, n as compileWhere, o as relatedRowGuard, r as escapeLike, u as renderGraphSql } from "../compile-EzEMB-7v.js";
+import { c as relatedTargetsSql, d as restrictedRowsSql, n as compileWhere, o as relatedRowGuard, r as escapeLike, u as renderGraphSql } from "../compile-B_oJqmIg.js";
 import { n as statementText, o as rowCheckOf, r as subjectStatements, s as loadPeer } from "../subject-settings-8sH5HlII.js";
 //#region src/prisma/to-where.ts
 function fieldTests(options) {