permdock 0.16.0 → 0.18.0

package/dist/react-native/index.js

@@ -2,20 +2,21 @@
 import { r as isRecord, t as compact } from "../compact-CAf557ZB.js";
 import { n as freezeDeep } from "../freeze-jjan0lCv.js";
 import { r as requiredPlans } from "../problem-details-CLDgX1KV.js";
-import { n as describe } from "../describe-Bb4hGK5d.js";
+import { n as describe } from "../describe-BZAlPHxT.js";
 import { n as isThenable } from "../thenable-BNSM1U2R.js";
 import { h as secondsAt, m as rfc3339 } from "../time-nR1JesoH.js";
-import { f as scopeList, h as tenantOf$1, o as normalizeMemberships, s as resolveScope } from "../scopes-0Up_UA2t.js";
+import { d as scopeList, o as normalizeMemberships, p as tenantOf$1, s as resolveScope } from "../scopes-BSdYaGHs.js";
 import { o as flattenGrantee } from "../grantee-Dke-9rd1.js";
 import { t as byCodePoint } from "../compare-DTfyUunF.js";
-import { d as resolveActiveTenant, r as isMembershipExpired } from "../tenancy-5d1zVBvK.js";
-import { a as bindConditionRefs, n as parseSnapshot } from "../snapshot-CXlzi69u.js";
-import { r as heldRoleNames, t as emptySnapshot } from "../from-snapshot-DCakWRsr.js";
-import { t as parseLocalSnapshotManifest } from "../parse-local-manifest-DEiCF4ah.js";
-import { r as approvalHeaders } from "../protected-action-DUYqb-Ma.js";
-import { i as isJws, n as storeOf, r as eventSourceRefresh, t as adapterStore } from "../store-options-Dil3lraY.js";
+import { d as resolveActiveTenant, r as isMembershipExpired } from "../tenancy-DvOHHk3-.js";
+import { a as bindConditionRefs, n as parseSnapshot } from "../snapshot-DN_8J27z.js";
+import { r as heldRoleNames, t as emptySnapshot } from "../from-snapshot-DMlSSo9b.js";
+import { t as parseLocalSnapshotManifest } from "../parse-local-manifest-CxcSMQgl.js";
+import { r as approvalHeaders } from "../protected-action-OpOxtTsN.js";
+import { a as eventSourceRefresh, c as isJws, n as storeOf, r as authzChangeRefresh, t as adapterStore } from "../store-options--zWn48PK.js";
 import { a as PermDockUiContext, i as PermDockStoreContext, n as useKeyed, t as useLiveOptions } from "../live-options-BBIT68le.js";
-import { a as useAssignableRoles, c as useGate, d as usePermission, f as usePermissions, h as useTenant, i as useAssignablePermissions, l as useMemberships, m as useSubject, n as Protected, o as useDescribe, p as useRoles, r as useApproval, s as useFilter, t as useProtectedAction, u as usePermDock } from "../protected-action-QEA8arRB.js";
+import { a as useAssignableRoles, c as useGate, d as usePermission, f as usePermissions, g as useTenant, h as useSubject, i as useAssignablePermissions, l as useMemberships, m as useRoles, n as Protected, o as useDescribe, r as useApproval, s as useFilter, t as useProtectedAction, u as usePermDock } from "../protected-action-B40tU3yP.js";
+import { r as authzUserTopic, t as AUTHZ_EVENT } from "../authz-topic-Dbc-HDOS.js";
 import { useEffect, useMemo, useRef } from "react";
 import { jsx } from "react/jsx-runtime";
 //#region src/react-native/guards.ts
@@ -316,7 +317,8 @@ function buildLocalSnapshot(manifest, data, at) {
 			customRoles: tenantCustom
 		})],
 		scopes: manifest.scopes,
-		vocabulary: manifest.vocabulary
+		vocabulary: manifest.vocabulary,
+		authzVersion: Number.isSafeInteger(data.authzVersion) && (data.authzVersion ?? -1) >= 0 ? data.authzVersion : void 0
 	}));
 }
 /**
@@ -334,6 +336,7 @@ function localSnapshot(options) {
 function isColumns(roles) {
 	return Array.isArray(roles);
 }
+/** A SQLite identifier in double quotes. */
 function quoted(name) {
 	return `"${name.replaceAll("\"", "\"\"")}"`;
 }
@@ -359,6 +362,7 @@ function rowTables(rows) {
 		tables.add(rows.customRoles.permissions);
 		tables.add(rows.customRoles.includes);
 	}
+	if (rows.version !== void 0) tables.add(rows.version.table);
 	return [...tables];
 }
 function rowQuery(table) {
@@ -495,8 +499,21 @@ function customRolesOf(permissions, includes) {
 	return [...roles.values()].map(customRoleOf);
 }
 /**
-* The user's memberships, global roles and custom roles from the rows of the
-* tables `rows` names.
+* The highest version on the user's rows of the version table. SQLite returns a
+* `bigint` column as a number, or as text past 2^53.
+*/
+function versionOf(table, tables, user) {
+	if (table === void 0) return;
+	let found;
+	for (const row of rowsOf(tables, table.table)) {
+		const value = Number(text(row[table.version]));
+		if (text(row[table.user]) === user && Number.isSafeInteger(value) && value >= 0 && (found === void 0 || value > found)) found = value;
+	}
+	return found;
+}
+/**
+* The user's memberships, global roles, custom roles and authorization version
+* from the rows of the tables `rows` names.
 */
 function readRows(rows, tables, principal) {
 	const { id: user, tenant, attributes } = principal;
@@ -507,7 +524,9 @@ function readRows(rows, tables, principal) {
 		return key === void 0 ? [] : [key];
 	}) : []);
 	const custom = rows.customRoles;
+	const authzVersion = versionOf(rows.version, tables, user);
 	return {
+		...authzVersion === void 0 ? {} : { authzVersion },
 		principal: {
 			id: user,
 			roles: [...new Set(roles)].toSorted(),
@@ -649,6 +668,173 @@ function powerSyncSourceCache(db) {
 	} });
 }
 //#endregion
+//#region src/react-native/subscriptions.ts
+/**
+* `subscribeForeground` over `AppState`: `active` returns to the foreground and
+* `background` leaves it. iOS `inactive` (a system sheet over the app) is
+* neither.
+*/
+function appStateForeground(appState) {
+	return (listener) => {
+		const subscription = appState.addEventListener("change", (state) => {
+			if (state === "active") listener(true);
+			else if (state === "background") listener(false);
+		});
+		return () => {
+			subscription.remove();
+		};
+	};
+}
+/**
+* `subscribeOnline` over NetInfo. An unknown (`null`) connection counts as
+* online.
+*/
+function netInfoOnline(netInfo) {
+	return (listener) => netInfo.addEventListener((state) => {
+		listener(state.isConnected !== false && state.isInternetReachable !== false);
+	});
+}
+//#endregion
+//#region src/react-native/native-refresh.ts
+/** The `authz_ver` claim of an access token, read without verifying it. */
+function tokenVersion(token) {
+	const payload = token.split(".")[1];
+	if (payload === void 0) return;
+	try {
+		const base64 = payload.replaceAll("-", "+").replaceAll("_", "/");
+		const claims = JSON.parse(atob(base64.padEnd(Math.ceil(base64.length / 4) * 4, "=")));
+		const version = isRecord(claims) ? claims["authz_ver"] : void 0;
+		return typeof version === "number" && Number.isSafeInteger(version) && version >= 0 ? version : void 0;
+	} catch {
+		return;
+	}
+}
+function highest(rows) {
+	let found;
+	for (const row of rows) {
+		const value = Number(isRecord(row) ? row["version"] : void 0);
+		if (Number.isSafeInteger(value) && value >= 0 && (found === void 0 || value > found)) found = value;
+	}
+	return found;
+}
+async function currentSession(supabase) {
+	try {
+		return (await supabase.auth.getSession()).data.session;
+	} catch {
+		return null;
+	}
+}
+/**
+* A `refreshOn` trigger for an Expo app on Supabase: on each message on the
+* user's private `authz:<uid>` topic it refreshes the Supabase session, then
+* reconnects PowerSync so streams that read token claims see the new ones, then
+* refreshes the snapshot. Passes run one at a time; signals during a pass fold
+* into one more. The channel closes in the background and rejoins on
+* foreground, where one catch-up pass runs: a version check with
+* `powersync.manifest`, else a full pass. It never imports `@supabase/*` or
+* `@powersync/*`.
+*/
+function nativeRefresh(options) {
+	const { supabase, powersync } = options;
+	const versionRows = powersync?.manifest?.rows?.version;
+	return (refresh) => {
+		let closed = false;
+		let online = true;
+		let held = false;
+		let running = false;
+		let again = false;
+		let channel;
+		let joins = 0;
+		let watching;
+		const pass = async () => {
+			try {
+				await supabase.auth.refreshSession();
+				if (powersync !== void 0) {
+					await powersync.db.disconnect();
+					await powersync.db.connect(powersync.connector);
+				}
+			} catch {}
+			if (!closed) refresh();
+		};
+		const signal = () => {
+			if (closed) return;
+			if (!online) {
+				held = true;
+				return;
+			}
+			if (running) {
+				again = true;
+				return;
+			}
+			running = true;
+			pass().finally(() => {
+				running = false;
+				if (again) {
+					again = false;
+					signal();
+				}
+			});
+		};
+		const versionSql = versionRows === void 0 ? void 0 : `SELECT ${quoted(versionRows.version)} AS version FROM ${quoted(versionRows.table)} WHERE ${quoted(versionRows.user)} = ?`;
+		const checkVersion = async () => {
+			if (versionSql === void 0 || powersync === void 0) return;
+			const current = await currentSession(supabase);
+			if (current === null || closed) return;
+			const token = tokenVersion(current.access_token);
+			try {
+				const synced = highest(await powersync.db.getAll(versionSql, [current.user.id]));
+				if (token !== void 0 && synced !== void 0 && synced > token) signal();
+			} catch {}
+		};
+		const leave = () => {
+			joins += 1;
+			if (channel !== void 0) {
+				supabase.removeChannel(channel);
+				channel = void 0;
+			}
+		};
+		const join = async () => {
+			joins += 1;
+			const generation = joins;
+			const current = await currentSession(supabase);
+			if (closed || generation !== joins || current === null) return;
+			channel = supabase.channel(authzUserTopic(current.user.id), { config: { private: true } });
+			channel.on("broadcast", { event: AUTHZ_EVENT }, () => {
+				signal();
+			});
+			channel.subscribe();
+			if (versionSql !== void 0 && powersync !== void 0 && watching === void 0) {
+				watching = new AbortController();
+				powersync.db.watch(versionSql, [current.user.id], { onResult: () => {
+					checkVersion();
+				} }, { signal: watching.signal });
+			}
+		};
+		join();
+		const offForeground = appStateForeground(options.appState)((active) => {
+			leave();
+			if (active === false) return;
+			join();
+			if (versionSql === void 0) signal();
+			else checkVersion();
+		});
+		const offOnline = options.netInfo === void 0 ? void 0 : netInfoOnline(options.netInfo)((next) => {
+			online = next;
+			if (next && held) {
+				held = false;
+				signal();
+			}
+		});
+		return () => {
+			closed = true;
+			leave();
+			offForeground();
+			offOnline?.();
+			watching?.abort();
+		};
+	};
+}
+//#endregion
 //#region src/react-native/storage.ts
 const SNAPSHOT_KEY = "permdock.snapshot";
 const TENANT_KEY = "permdock.tenant";
@@ -1099,31 +1285,4 @@ function mmkvStorage(mmkv) {
 	};
 }
 //#endregion
-//#region src/react-native/subscriptions.ts
-/**
-* `subscribeForeground` over `AppState`: `active` returns to the foreground and
-* `background` leaves it. iOS `inactive` (a system sheet over the app) is
-* neither.
-*/
-function appStateForeground(appState) {
-	return (listener) => {
-		const subscription = appState.addEventListener("change", (state) => {
-			if (state === "active") listener(true);
-			else if (state === "background") listener(false);
-		});
-		return () => {
-			subscription.remove();
-		};
-	};
-}
-/**
-* `subscribeOnline` over NetInfo. An unknown (`null`) connection counts as
-* online.
-*/
-function netInfoOnline(netInfo) {
-	return (listener) => netInfo.addEventListener((state) => {
-		listener(state.isConnected !== false && state.isInternetReachable !== false);
-	});
-}
-//#endregion
-export { PermDockProvider, Protected, appStateForeground, approvalHeaders, buildLocalSnapshot, connectSource, describe, eventSourceRefresh, localSnapshot, memorySnapshotStorage, mmkvStorage, nativeStore, netInfoOnline, parseLocalSnapshotManifest, powerSyncSource, powerSyncSourceCache, requiredPlans, secureStoreStorage, useApproval, useAssignablePermissions, useAssignableRoles, useDescribe, useFilter, useGate, useMemberships, usePermDock, usePermission, usePermissionGuard, usePermissions, useProtectedAction, useRoles, useSnapshotReady, useSubject, useTenant };
+export { PermDockProvider, Protected, appStateForeground, approvalHeaders, authzChangeRefresh, buildLocalSnapshot, connectSource, describe, eventSourceRefresh, localSnapshot, memorySnapshotStorage, mmkvStorage, nativeRefresh, nativeStore, netInfoOnline, parseLocalSnapshotManifest, powerSyncSource, powerSyncSourceCache, requiredPlans, secureStoreStorage, useApproval, useAssignablePermissions, useAssignableRoles, useDescribe, useFilter, useGate, useMemberships, usePermDock, usePermission, usePermissionGuard, usePermissions, useProtectedAction, useRoles, useSnapshotReady, useSubject, useTenant };

package/dist/refresh-on-L9UOwATg.d.ts

@@ -0,0 +1,49 @@
+//#region src/client/refresh-on.d.ts
+/**
+ * Calls `refresh` when the snapshot may be out of date (a membership event, a
+ * window focus, a realtime message) and returns the unsubscribe. A refresh
+ * re-fetches the signed snapshot; it never grants by itself.
+ */
+type RefreshTrigger = (refresh: () => void) => () => void;
+type EventSourceRefreshOptions = {
+  /**
+   * CloudEvent `type` values that refresh; a trailing `*` matches a prefix.
+   * Defaults to `com.permdock.membership.*` and `com.permdock.catalog.*`.
+   */
+  readonly types?: readonly string[];
+  readonly withCredentials?: boolean;
+};
+/**
+ * A `refreshOn` trigger over Server-Sent Events: each `message` whose data is a
+ * structured CloudEvent with a matching `type` refreshes the snapshot. Without
+ * a global `EventSource` it never fires.
+ */
+declare function eventSourceRefresh(url: string, options?: EventSourceRefreshOptions): RefreshTrigger;
+/** A `refreshOn` trigger on window `focus`. Without a window it never fires. */
+declare function focusRefresh(): RefreshTrigger;
+/**
+ * A `refreshOn` trigger on `visibilitychange` to visible, when a background tab
+ * comes back. Without a `document` it never fires.
+ */
+declare function visibilityRefresh(): RefreshTrigger;
+/**
+ * A `refreshOn` trigger on every message to the `BroadcastChannel` `name`, so
+ * one tab that learns of a change refreshes the others. Without a global
+ * `BroadcastChannel` it never fires.
+ */
+declare function broadcastChannelRefresh(name: string): RefreshTrigger;
+type AuthzChangeRefresh = {
+  /** Pass to `refreshOn`. */
+  readonly trigger: RefreshTrigger;
+  /** Pass to better-supabase's `<SessionProvider onAuthzChange>`. */
+  readonly notify: () => void;
+};
+/**
+ * A `refreshOn` trigger that fires on `notify()`. better-supabase's
+ * `SessionProvider` already listens on the user's `authz:<uid>` topic and
+ * shares changes across tabs, so `onAuthzChange={notify}` refreshes the
+ * snapshot without a second Realtime channel.
+ */
+declare function authzChangeRefresh(): AuthzChangeRefresh;
+//#endregion
+export { broadcastChannelRefresh as a, visibilityRefresh as c, authzChangeRefresh as i, EventSourceRefreshOptions as n, eventSourceRefresh as o, RefreshTrigger as r, focusRefresh as s, AuthzChangeRefresh as t };

package/dist/{replay-Bs9Df2fQ.d.ts → replay-E5X9E1lC.d.ts}

@@ -1,4 +1,4 @@
-import { l as ReplayStore } from "./types-DsHGPtkR.js";
+import { l as ReplayStore } from "./types-Ck1KOfug.js";
 //#region src/ssf/replay.d.ts
 declare function memoryReplayStore(): ReplayStore;
 //#endregion

package/dist/{request-context-Duzdf0cd.js → request-context-DM6_jY1n.js}

@@ -1,6 +1,6 @@
 import { t as assertAppData } from "./app-data-UNNm07jV.js";
-import { n as wrapPermDock } from "./wrap-B2wziJI_.js";
-import { t as buildInstance } from "./build-instance-BWXqwQYU.js";
+import { n as wrapPermDock } from "./wrap-C5PWzgkq.js";
+import { t as buildInstance } from "./build-instance-BFMFQdE_.js";
 //#region src/core/request-context.ts
 /**
 * Errors an adapter raises around one instance (a `context` hook that threw, an

package/dist/{request-schema-DhX7UbfQ.js → request-schema-CMP8Cmxd.js}

@@ -81,6 +81,11 @@ const APPROVAL_REQUEST_SCHEMA = {
 		vouched: { type: "string" },
 		note: { type: "string" },
 		consumedAt: { $ref: "#/$defs/instant" },
+		fingerprint: {
+			type: "string",
+			pattern: "^[0-9a-f]{64}$",
+			description: "The approvalFingerprint the request was opened under; a resume under another one is refused."
+		},
 		x: {
 			type: "object",
 			description: "The application's own data, set when the request opens: plain JSON, never read by a decision."

package/dist/resend/index.d.ts

@@ -1,7 +1,7 @@
-import { J as DecisionSink } from "../policy-types-DGIO_gxq.js";
-import { n as ApprovalUrl, t as ApprovalPrompt } from "../approval-prompt-3BqWczTt.js";
-import { d as EmailTransport, o as DeliveryResult, u as EmailMessage } from "../types-CN0LsqbK.js";
-import { l as ReplayStore } from "../types-DsHGPtkR.js";
+import { Y as DecisionSink } from "../policy-types-D-GwfQTc.js";
+import { n as ApprovalUrl, t as ApprovalPrompt } from "../approval-prompt-Bg7gDSqd.js";
+import { d as EmailTransport, o as DeliveryResult, u as EmailMessage } from "../types-CCEeSCMB.js";
+import { l as ReplayStore } from "../types-Ck1KOfug.js";
 //#region src/resend/approval-email.d.ts
 type ApprovalEmailOptions = {
   /**

package/dist/{resolve-names-Y1Cb22cp.js → resolve-names-CBl4r4_r.js}

@@ -1,12 +1,12 @@
 import { n as freezeDeep } from "./freeze-jjan0lCv.js";
 import { c as listPermissions } from "./permission-registry-B8tYxPIt.js";
-import { f as scopeList } from "./scopes-0Up_UA2t.js";
-import { i as configError } from "./errors-Vpu6rKHl.js";
-import "./budget-BELja5A9.js";
+import { d as scopeList } from "./scopes-BSdYaGHs.js";
+import { i as configError } from "./errors-BhRkoNS7.js";
+import "./budget-BBCPDOGP.js";
 import "./sources-C4vkzZJV.js";
-import { A as quoteQualified, D as qualified, I as scopeTypeOf, O as quoteIdent } from "./shared-DrGLwM3s.js";
-import { F as globalRoleRows, Q as graphSqlName, Z as graphHelper, _ as PERMISSION_HELPERS, at as memberForHelper, c as holderSources, ct as memberIdsHelper, dt as permittedForHelper, ft as permittedIdsHelper, ht as scopeTable, lt as memberOfHelper, nt as inheritedRowsHelper, o as graphPlan, pt as restrictedHelper, r as tableNames, rt as isTeamScope, tt as hasPermittedUsers, v as checkName, x as permittedByPermissionHelper } from "./tables-DimBcVWY.js";
-import { t as FIELD_VIEWS } from "./fields-DI8s3cPl.js";
+import { A as quoteQualified, D as qualified, I as scopeTypeOf, O as quoteIdent } from "./shared-DyYVEjKC.js";
+import { F as globalRoleRows, Q as graphSqlName, Z as graphHelper, _ as PERMISSION_HELPERS, at as memberForHelper, c as holderSources, ct as memberIdsHelper, dt as permittedForHelper, ft as permittedIdsHelper, ht as scopeTable, lt as memberOfHelper, nt as inheritedRowsHelper, o as graphPlan, pt as restrictedHelper, r as tableNames, rt as isTeamScope, tt as hasPermittedUsers, v as checkName, x as permittedByPermissionHelper } from "./tables-BfOk0ymL.js";
+import { t as FIELD_VIEWS } from "./fields-CrjL6A49.js";
 //#region src/cli/rls/permission-holders.ts
 /**
 * `permitted_<scope>_users(p_permission, p_id)`. Names are part of the SQL

package/dist/{rls-tHu7N_Pe.js → rls-DGBL-jDY.js}

@@ -1,32 +1,32 @@
 import { t as compact } from "./compact-CAf557ZB.js";
 import { c as listPermissions, u as renamedKeys } from "./permission-registry-B8tYxPIt.js";
 import { i as dateAt } from "./time-nR1JesoH.js";
-import { p as scopeField } from "./tenancy-5d1zVBvK.js";
-import { a as describeError, i as configError, o as exitCodeOfError, u as usageResult } from "./errors-Vpu6rKHl.js";
+import { p as scopeField } from "./tenancy-DvOHHk3-.js";
+import { a as describeError, i as configError, o as exitCodeOfError, u as usageResult } from "./errors-BhRkoNS7.js";
 import { t as policyRowConditionKeys } from "./row-conditions-BAGHOmVq.js";
 import { o as sqlFiles } from "./files-BSjrtIHw.js";
-import { c as requirePolicy } from "./load-DjSU5KXO.js";
+import { c as requirePolicy } from "./load-BaEamml-.js";
 import { i as qualifySqlTable, r as escapeSqlIdent } from "./sql-0WjxIp9g.js";
 import "./sources-C4vkzZJV.js";
-import { t as policyFromCatalog } from "./policy-from-catalog-CU3An8uP.js";
+import { t as policyFromCatalog } from "./policy-from-catalog-B68hGC0S.js";
 import { t as beforeFirst } from "./text-BMFRfBqc.js";
 import { i as INDEXES_MARKER, n as GRANTS_MARKER, o as SEEDS_MARKER, t as BACKFILL_MARKER } from "./markers-BeHZ4x9Q.js";
-import { a as nonEmptyOr } from "./output-DlICTjBh.js";
-import { i as requirePeer, n as packageManagerOf, t as addLine } from "./peer-Q0fuZ6hx.js";
+import { a as nonEmptyOr } from "./output-BFWLER4r.js";
+import { i as requirePeer, n as packageManagerOf, t as addLine } from "./peer-BuK9F53f.js";
 import { t as POLICY_NOT_PUBLISHED } from "./problem-types-DSsRfONQ.js";
-import { t as fetchProjectPolicy } from "./pull-CQCGy1gv.js";
+import { t as fetchProjectPolicy } from "./pull-DLP4I1Kl.js";
 import { n as MIGRATION_DIRS } from "./constants-DcJABbLW.js";
-import { a as isSeedsDirectory, c as parseSplit, d as seedsMigration, f as writeOutputFiles, l as partPath, n as dataMigrationFile, r as driftOf, u as pgDeltaPath } from "./output-files-BIQ_9pIs.js";
-import { b as rbacScaffold, d as resolveSchemas, f as schemasRefusal, o as supabaseHookSql, p as declarativeSql, s as approvalsSql, t as grantsLabel, u as isSupabaseSchemas, y as parseRbacAuthorize } from "./supabase-hook-HPgwYb9V.js";
-import { A as quoteQualified, D as qualified$1, I as scopeTypeOf, O as quoteIdent$1, _ as subjectClaimJsonSql, c as SESSION_LIVE_HELPER, g as sessionLiveHelperSql, j as quoteTable, k as quoteLiteral, r as HELPERS, t as CUSTOM_ROLES, y as subjectIdSql } from "./shared-DrGLwM3s.js";
-import { C as accessSql, G as byKey, T as seedSql, Z as graphHelper, ct as memberIdsHelper, ft as permittedIdsHelper, ht as scopeTable, mt as scopeSources, r as tableNames, s as graphSql, w as helpersSql, x as permittedByPermissionHelper, y as permissionHelpersSql } from "./tables-DimBcVWY.js";
-import { c as breakGlassKey, i as assignmentSql, l as collectGrants, n as ownershipSql, s as breakGlassHolder } from "./ownership-qqBuGJXr.js";
+import { a as isSeedsDirectory, c as parseSplit, d as seedsMigration, f as writeOutputFiles, l as partPath, n as dataMigrationFile, r as driftOf, u as pgDeltaPath } from "./output-files-CM0BnH05.js";
+import { b as rbacScaffold, d as resolveSchemas, f as schemasRefusal, o as supabaseHookSql, p as declarativeSql, s as approvalsSql, t as grantsLabel, u as isSupabaseSchemas, y as parseRbacAuthorize } from "./supabase-hook-DX38Hj8h.js";
+import { A as quoteQualified, D as qualified$1, I as scopeTypeOf, O as quoteIdent$1, _ as subjectClaimJsonSql, c as SESSION_LIVE_HELPER, g as sessionLiveHelperSql, j as quoteTable, k as quoteLiteral, r as HELPERS, t as CUSTOM_ROLES, y as subjectIdSql } from "./shared-DyYVEjKC.js";
+import { C as accessSql, G as byKey, T as seedSql, Z as graphHelper, ct as memberIdsHelper, ft as permittedIdsHelper, ht as scopeTable, mt as scopeSources, r as tableNames, s as graphSql, w as helpersSql, x as permittedByPermissionHelper, y as permissionHelpersSql } from "./tables-BfOk0ymL.js";
+import { c as breakGlassKey, i as assignmentSql, l as collectGrants, n as ownershipSql, s as breakGlassHolder } from "./ownership-D-mIt-w0.js";
 import { a as splitUndiffed } from "./deciding-columns-NB4wcyBf.js";
-import { t as connectPgPool } from "./pg-DQTqRrou.js";
-import { a as fieldViewsSql, c as ACTOR_MAY_WRITE, f as readOnlyActorKinds, i as fieldViews, l as actorMayWriteSql, n as columnGrantSql, o as rowBranches, p as readOnlyActorPolicies, r as columnRevokeSql, u as assemblePolicies } from "./fields-DI8s3cPl.js";
-import { n as permissionHoldersSql } from "./resolve-names-Y1Cb22cp.js";
-import { _ as indexTargets, a as verifyResult, b as readTableIndexFacts, c as callsHelper, g as INDEX_COLUMNS_SQL, h as COLUMNS_SQL, i as verifyIgnores, l as helperCallKeys, m as tableFor, n as runRlsVerify, o as HELPER_TABLES, p as compileGrants, r as rlsFinding, v as indexesSql, y as pruneIndexTargets } from "./verify-DfT0QYNh.js";
-import { a as buildContext, c as levelKeys, d as rebuildPlan, i as splitsPart, l as rowHelpersSql, n as generateOptions, o as CANDIDATES, r as isRefusal, s as inheritTargets, t as supautilsRejections, u as DROPPED_LIST } from "./supautils-SwE642N1.js";
+import { t as connectPgPool } from "./pg-Ddxsd5ZB.js";
+import { a as fieldViewsSql, c as ACTOR_MAY_WRITE, f as readOnlyActorKinds, i as fieldViews, l as actorMayWriteSql, n as columnGrantSql, o as rowBranches, p as readOnlyActorPolicies, r as columnRevokeSql, u as assemblePolicies } from "./fields-CrjL6A49.js";
+import { n as permissionHoldersSql } from "./resolve-names-CBl4r4_r.js";
+import { _ as indexTargets, a as verifyResult, b as readTableIndexFacts, c as callsHelper, g as INDEX_COLUMNS_SQL, h as COLUMNS_SQL, i as verifyIgnores, l as helperCallKeys, m as tableFor, n as runRlsVerify, o as HELPER_TABLES, p as compileGrants, r as rlsFinding, v as indexesSql, y as pruneIndexTargets } from "./verify-Bpj0hauG.js";
+import { a as buildContext, c as levelKeys, d as rebuildPlan, i as splitsPart, l as rowHelpersSql, n as generateOptions, o as CANDIDATES, r as isRefusal, s as inheritTargets, t as supautilsRejections, u as DROPPED_LIST } from "./supautils-BGf6zRvM.js";
 import { readFileSync } from "node:fs";
 import { basename, delimiter, join } from "node:path";
 import { spawn } from "node:child_process";
@@ -1601,7 +1601,7 @@ function generateSql(input, policy, options, built, warnings) {
 	const checked = preflight(input, built);
 	if (isRefusal(checked)) return checked;
 	const { jsonSchema } = checked;
-	if (jsonSchema !== void 0 && jsonSchema !== false && (rls?.approvals === void 0 || rls.approvals === false)) warnings.push("rls.jsonSchema constrains the approval store's body, which needs rls.approvals: true; nothing else is jsonb");
+	if (jsonSchema !== void 0 && jsonSchema !== false && (rls?.approvals === void 0 || rls.approvals === false || typeof rls.approvals === "object" && rls.approvals.store === false)) warnings.push("rls.jsonSchema constrains the approval store's body, which needs rls.approvals: true; nothing else is jsonb");
 	const generated = generatePolicies(input, policy, options, built, warnings);
 	if (isRefusal(generated)) return generated;
 	const assembled = preambleSql(input, policy, options, built, generated, jsonSchema, warnings);
@@ -2496,7 +2496,7 @@ async function migrate(input) {
 		output: generated.output
 	};
 	await requirePeer(() => import("pgsql-parser"), "pgsql-parser", "permdock rls migrate", input.cwd, PGSQL_PARSER_MAJOR);
-	const { migrateTarget, runRlsMigrate } = await import("./migrate-BJHxQqT5.js");
+	const { migrateTarget, runRlsMigrate } = await import("./migrate-BbY5-Khy.js");
 	return runRlsMigrate({
 		cwd: input.cwd,
 		sql: input.sql,
@@ -2612,7 +2612,7 @@ async function runRls(input) {
 		}
 		case "import": {
 			await requirePeer(() => import("pgsql-parser"), "pgsql-parser", "permdock rls import", input.cwd, PGSQL_PARSER_MAJOR);
-			const { runRlsImport } = await import("./import-CNBF96hB.js");
+			const { runRlsImport } = await import("./import-C1XXpG_m.js");
 			return runRlsImport({
 				cwd: input.cwd,
 				config: input.config,

package/dist/{rls-C5ZGzR_B.js → rls-pAHGYgTb.js}

@@ -1,6 +1,6 @@
-import { c as missingInput } from "./errors-Vpu6rKHl.js";
+import { c as missingInput } from "./errors-BhRkoNS7.js";
 import { t as defineLeaf } from "./command-L8EstFNm.js";
-import { c as given, d as policyFlag, f as validatorFlag, i as dryRunFlag, l as outFlag, n as dbUrl, o as fileOut, r as dbUrlFlags, t as checkFlag } from "./flags-DXjoTVbS.js";
+import { c as given, d as policyFlag, f as validatorFlag, i as dryRunFlag, l as outFlag, n as dbUrl, o as fileOut, r as dbUrlFlags, t as checkFlag } from "./flags-BlmpmXoY.js";
 //#region src/cli/commands/rls.ts
 const membershipsFlag = { memberships: {
 	type: "string",
@@ -192,7 +192,7 @@ async function rlsInput(ctx, verb, shape, options) {
 	};
 }
 async function runRls(input) {
-	return (await import("./rls-tHu7N_Pe.js")).runRls(input);
+	return (await import("./rls-DGBL-jDY.js")).runRls(input);
 }
 const generate = defineLeaf({
 	flags: {
@@ -215,7 +215,7 @@ const generate = defineLeaf({
 			valueHint: "parts",
 			list: true,
 			async complete() {
-				const { SPLIT_PARTS } = await import("./output-files-BHOIlrfD.js");
+				const { SPLIT_PARTS } = await import("./output-files-BYscrQl-.js");
 				return SPLIT_PARTS;
 			}
 		},