permdock 0.2.0 → 0.3.0

package/dist/next/plugin.js

@@ -1,5 +1,5 @@
 import { i as describeError } from "../errors-CWfoNg9N.js";
-import { n as createCollectScheduler, r as report, t as collectOnce } from "../watch-UihESpsJ.js";
+import { n as createCollectScheduler, r as report, t as collectOnce } from "../watch-DVBJ9cBq.js";
 //#region src/cli/plugin.ts
 const PHASE_BUILD = "phase-production-build";
 const PHASE_DEV = "phase-development-server";

package/dist/node/index.d.ts

@@ -1,7 +1,7 @@
-import { C as Policy, D as PolicyVocabulary, Nr as Principal, ln as PermDock } from "../policy-CFZAr_Al.js";
+import { C as Policy, D as PolicyVocabulary, Nr as Principal, ln as PermDock } from "../policy-IB6yxpC3.js";
 import { f as Permission } from "../permissions-DttnqqxC.js";
-import { a as ScopeGuard, h as InvalidSignatureError, i as ProtectOptions, n as OpenApiHooks, t as Guard, w as verifyWebBotAuth, x as discoverViaSignatureAgent } from "../create-BWyx3jua.js";
-import { t as ServerAdapterOptions } from "../bind-CVy3Espv.js";
+import { a as ScopeGuard, h as InvalidSignatureError, i as ProtectOptions, n as OpenApiHooks, t as Guard, w as verifyWebBotAuth, x as discoverViaSignatureAgent } from "../create-B1d519XK.js";
+import { t as ServerAdapterOptions } from "../bind-C_ob3LKa.js";
 import { a as toRequest, i as sendResponse, n as fromResponse, r as isServerResponse, t as NodeRequest } from "../http-DPuDaChb.js";
 import { IncomingMessage, ServerResponse } from "node:http";
 //#region src/node/create.d.ts

package/dist/node/index.js

@@ -1,5 +1,5 @@
 import { i as discoverViaSignatureAgent, r as InvalidSignatureError, s as verifyWebBotAuth } from "../evaluations-tz6D9A2G.js";
-import { r as bindKernel } from "../bind-VnYn2HKq.js";
+import { r as bindKernel } from "../bind-CuzGytRf.js";
 import { i as toRequest, n as isServerResponse, r as sendResponse, t as fromResponse } from "../http-BIhmLfCc.js";
 //#region src/node/create.ts
 const nodeRequest = (req) => req;

package/dist/openai/index.d.ts

@@ -1,7 +1,7 @@
-import { C as Policy, D as PolicyVocabulary, Nr as Principal, kr as Delegation, ln as PermDock } from "../policy-CFZAr_Al.js";
+import { C as Policy, D as PolicyVocabulary, Nr as Principal, kr as Delegation, ln as PermDock } from "../policy-IB6yxpC3.js";
 import { f as Permission } from "../permissions-DttnqqxC.js";
-import { c as ApprovalRequest, f as ApprovalStore } from "../types-vKyAMtcX.js";
-import { t as InstanceOptions } from "../instance-options-BK_rNOSC.js";
+import { c as ApprovalRequest, f as ApprovalStore } from "../types-aqOHTHcp.js";
+import { t as InstanceOptions } from "../instance-options-jARdwfPN.js";
 import { t as ToolMap } from "../types-Bvc4oWT6.js";
 //#region src/openai/create.d.ts
 /** The app context passed to `run(agent, input, { context })`. */

package/dist/openai/index.js

@@ -1,7 +1,7 @@
 import { t as compact } from "../compact-y6vfu2_f.js";
 import { r as memoryApprovalStore } from "../store-DMAWwAJV.js";
 import { t as instanceOptions } from "../instance-options-Dhhcnm3y.js";
-import { n as createAgentKernel, t as approvalTokenOf } from "../kernel-GSQnMz3O.js";
+import { n as createAgentKernel, t as approvalTokenOf } from "../kernel-_RRHmnMY.js";
 //#region src/openai/create.ts
 function appContext(runContext) {
 	const context = runContext?.context;

package/dist/openapi/index.d.ts

@@ -1,6 +1,6 @@
-import { C as Policy, Ir as Condition, Nr as Principal } from "../policy-CFZAr_Al.js";
+import { C as Policy, Ir as Condition, Nr as Principal } from "../policy-IB6yxpC3.js";
 import { f as Permission, m as PermissionTree } from "../permissions-DttnqqxC.js";
-import { a as ProblemDetails } from "../errors-DAqevpNk.js";
+import { a as ProblemDetails } from "../errors-DPdqI50v.js";
 import { StandardJSONSchemaV1, StandardSchemaV1 } from "@standard-schema/spec";
 //#region src/openapi/types.d.ts
 type OpenApiTarget = "3.1" | "3.2" | "3.3";

package/dist/{openapi-Bbg4wGVL.js → openapi-l0xYHkcv.js}

@@ -1,4 +1,4 @@
-import { a as listArg, i as globalArgs, s as stringArg, t as COMMAND_DESCRIPTIONS } from "./commands-DWOrSQic.js";
+import { a as listArg, i as globalArgs, s as stringArg, t as COMMAND_DESCRIPTIONS } from "./commands-DSxCqG9A.js";
 import { defineCommand } from "citty";
 //#region src/cli/commands/openapi.ts
 function openapi(ctx) {

package/dist/orpc/index.d.ts

@@ -1,9 +1,9 @@
-import { C as Policy, D as PolicyVocabulary, Nr as Principal, ln as PermDock } from "../policy-CFZAr_Al.js";
+import { C as Policy, D as PolicyVocabulary, Nr as Principal, ln as PermDock } from "../policy-IB6yxpC3.js";
 import { f as Permission } from "../permissions-DttnqqxC.js";
 import { n as RevocationFeed } from "../revocations-Cy06JNx2.js";
-import { A as ConnectionOptions, O as Connection, n as OpenApiHooks } from "../create-BWyx3jua.js";
-import { t as ServerAdapterOptions } from "../bind-CVy3Espv.js";
-import { t as StreamProtectOptions } from "../stream-DlvG2hs-.js";
+import { A as ConnectionOptions, O as Connection, n as OpenApiHooks } from "../create-B1d519XK.js";
+import { t as ServerAdapterOptions } from "../bind-C_ob3LKa.js";
+import { t as StreamProtectOptions } from "../stream-D1RXubw2.js";
 import { Middleware } from "@orpc/server";
 //#region src/orpc/create.d.ts
 type OrpcMiddlewareOpts<TCtx extends object = object, TInput = unknown> = {

package/dist/orpc/index.js

@@ -2,9 +2,9 @@ import { t as compact } from "../compact-y6vfu2_f.js";
 import { p as isPermission } from "../permissions-DVoF6dMt.js";
 import { a as problemMessage } from "../http-SO7qGttf.js";
 import { t as problemFromError } from "../map-error-pgUWNNtG.js";
-import { n as attached } from "../bind-VnYn2HKq.js";
+import { n as attached } from "../bind-CuzGytRf.js";
 import { a as reloadAfter, r as isAsyncIterable } from "../stream-DDpvynSB.js";
-import { i as rpcCode, n as guardStream, r as problemBody, t as bindRpcKernel } from "../rpc-DOK54_CS.js";
+import { i as rpcCode, n as guardStream, r as problemBody, t as bindRpcKernel } from "../rpc-DL9Sqvb1.js";
 import { ORPCError } from "@orpc/server";
 //#region src/orpc/create.ts
 function toOpts(mw, input, next) {

package/dist/otel/index.d.ts

@@ -1,5 +1,5 @@
-import { D as PolicyVocabulary, ln as PermDock } from "../policy-CFZAr_Al.js";
-import { a as OtelOptions, i as OtelApi, n as GEN_AI_TOOL_CALL_ID, o as OtelWrap, r as GEN_AI_TOOL_NAME, s as StructuralLogger, t as GENAI_SEMCONV_PIN } from "../types-vNSDF7Dq.js";
+import { D as PolicyVocabulary, ln as PermDock } from "../policy-IB6yxpC3.js";
+import { a as OtelOptions, i as OtelApi, n as GEN_AI_TOOL_CALL_ID, o as OtelWrap, r as GEN_AI_TOOL_NAME, s as StructuralLogger, t as GENAI_SEMCONV_PIN } from "../types-QCuYJh4q.js";
 //#region src/otel/instrument.d.ts
 /**
  * Listens on one instance. Spans carry no duration and no histogram is

package/dist/{parse-local-manifest-BkGQNzAh.d.ts → parse-local-manifest-JLnaBH0S.d.ts}

@@ -1,4 +1,4 @@
-import { pt as LocalSnapshotManifest } from "./policy-CFZAr_Al.js";
+import { pt as LocalSnapshotManifest } from "./policy-IB6yxpC3.js";
 //#region src/core/parse-local-manifest.d.ts
 /**
  * Whether `value` has the shape `localSnapshotManifest(policy)` writes, with

package/dist/pdp/index.d.ts

@@ -1,5 +1,5 @@
-import { C as Policy, D as PolicyVocabulary, Nr as Principal, it as DecisionProvider, un as PermDockOptions } from "../policy-CFZAr_Al.js";
-import { a as RelationMap, c as RemotePdpEndpoints, d as SpiceDbCheck, f as SpiceDbOptions, i as PdpPermDock, l as RemotePdpMapping, n as OpenFgaTuple, o as RemotePdpAuth, r as PdpFactory, s as RemotePdpCache, t as OpenFgaOptions, u as RemotePdpOptions } from "../types-BVyImy5I.js";
+import { C as Policy, D as PolicyVocabulary, Nr as Principal, it as DecisionProvider, un as PermDockOptions } from "../policy-IB6yxpC3.js";
+import { a as RelationMap, c as RemotePdpEndpoints, d as SpiceDbCheck, f as SpiceDbOptions, i as PdpPermDock, l as RemotePdpMapping, n as OpenFgaTuple, o as RemotePdpAuth, r as PdpFactory, s as RemotePdpCache, t as OpenFgaOptions, u as RemotePdpOptions } from "../types-DxiCGmmd.js";
 //#region src/pdp/create.d.ts
 export declare function createPermDock<TUser, TPrincipal extends Principal = Principal, V extends PolicyVocabulary = PolicyVocabulary>(policy: Policy<TUser, TPrincipal, V>, user: TUser | null, options?: PermDockOptions): Promise<PdpPermDock<V>>;
 //#endregion

package/dist/pdp/index.js

@@ -5,7 +5,7 @@ import { n as PermDockValidationError } from "../validation-error-CnjZ4t92.js";
 import { a as deniedMessage, i as approvalMessage, n as PermDockDeniedError, t as PermDockApprovalRequiredError } from "../errors-Cz5zn0mW.js";
 import { d as isArazzoSimulateInput } from "../snapshot-Enxd0n-s.js";
 import { n as isThenable } from "../thenable-okc2xDsj.js";
-import { t as createPermDock$1 } from "../permdock-CzqXjCpU.js";
+import { t as createPermDock$1 } from "../permdock-CbgvLnuo.js";
 import { s as isRecord } from "../map-AcxK9o_D.js";
 import { a as postJson, c as ttlMs, i as joinUrl, n as denied, o as resourceIdOf, r as granted, s as ttlCache, t as cacheKey } from "../shared-DRu8VFVM.js";
 //#region src/pdp/create.ts

package/dist/{permdock-CzqXjCpU.js → permdock-CbgvLnuo.js}

@@ -2000,46 +2000,52 @@ function decideRoleChange(policy, principal, scopes, change, customRoles, author
 	}
 	const kind = change?.kind;
 	const target = change?.target;
-	if (typeof name !== "string" || kind !== "assign" && kind !== "revoke" && kind !== "transfer" || typeof change.id !== "string" || change.id === "" || target === null || typeof target !== "object" || typeof target.id !== "string" || target.id === "") {
+	const global = change?.scope === "global";
+	if (typeof name !== "string" || kind !== "assign" && kind !== "revoke" && kind !== "transfer" || (global ? change.id !== void 0 : typeof change.id !== "string" || change.id === "") || target === null || typeof target !== "object" || typeof target.id !== "string" || target.id === "") {
 		deny("validation");
 		return done(null);
 	}
+	const id = change.id ?? "";
 	const binding = bindingOf(policy, name);
 	const declared = declaredRoleNames$1(policy).has(name);
-	const named = declared ? [] : tenantCustomRoles(policy, customRoles).filter((role) => role.name === name);
+	const named = declared || global ? [] : tenantCustomRoles(policy, customRoles).filter((role) => role.name === name);
 	if (!declared && named.length === 0) {
 		deny("unknown-role");
 		return done(null);
 	}
-	const scope = resolveScope(scopes, change.scope);
+	const scope = global ? "global" : resolveScope(scopes, change.scope);
 	const customAt = named.map((role) => customRoleScope(role, scopes));
 	const on = declared ? binding?.on ?? findRole(policy.vocabulary?.roles, name)?.on : customAt.includes(scope) ? scope : customAt[0];
-	const heldAt = typeof on === "string" ? resolveScope(scopes, on) : void 0;
+	const heldAt = typeof on === "string" ? resolveScope(scopes, on) : global ? "global" : void 0;
 	if (scope === void 0 || heldAt === void 0 || heldAt !== scope) {
 		deny("scope", { expected: heldAt ?? null });
 		return done(null);
 	}
-	const root = scopes[0]?.name;
-	const supplied = change.within === void 0 ? void 0 : Object.entries(change.within).find(([key]) => resolveScope(scopes, key) === root)?.[1];
 	let tenant;
 	let within = change.within;
-	if (scope === root) tenant = change.id;
-	else {
-		const anchor = heldAnchor(principal, scopes, scope, change.id, now);
-		const held = anchor === void 0 ? void 0 : tenantOf(anchor, scopes);
-		if (held !== void 0) {
-			tenant = supplied === void 0 || supplied === held ? held : void 0;
-			within = anchor?.within;
-		} else if (options.trusted === true) tenant = supplied;
-	}
-	if (tenant === void 0) {
-		deny("no-membership", {
-			scope,
-			id: change.id
-		});
-		return done(null);
+	let custom;
+	if (!global) {
+		const root = scopes[0]?.name;
+		const supplied = change.within === void 0 ? void 0 : Object.entries(change.within).find(([key]) => resolveScope(scopes, key) === root)?.[1];
+		if (scope === root) tenant = id;
+		else {
+			const anchor = heldAnchor(principal, scopes, scope, id, now);
+			const held = anchor === void 0 ? void 0 : tenantOf(anchor, scopes);
+			if (held !== void 0) {
+				tenant = supplied === void 0 || supplied === held ? held : void 0;
+				within = anchor?.within;
+			} else if (options.trusted === true) tenant = supplied;
+		}
+		if (tenant === void 0) {
+			deny("no-membership", {
+				scope,
+				id
+			});
+			return done(null);
+		}
+		const found = tenant;
+		custom = named.find((role) => sameId(role.tenant, found) && customRoleScope(role, scopes) === scope && sameId(customRoleId(role) ?? id, id));
 	}
-	const custom = named.find((role) => sameId(role.tenant, tenant) && customRoleScope(role, scopes) === scope && sameId(customRoleId(role) ?? change.id, change.id));
 	if (!declared && custom === void 0) {
 		deny("unknown-role");
 		return done(null);
@@ -2054,7 +2060,7 @@ function decideRoleChange(policy, principal, scopes, change, customRoles, author
 	let by = null;
 	if (kind === "transfer") {
 		if (self) deny("self-demotion");
-		if (holdsAt(principal, name, scope, change.id, now)) by = name;
+		if (global ? (principal.roles ?? []).includes(name) : holdsAt(principal, name, scope, id, now)) by = name;
 		else deny("not-assignable-by", { holds: false });
 	} else {
 		if (self) deny(kind === "revoke" ? "self-demotion" : "not-assignable-by", { self: true });
@@ -2062,7 +2068,7 @@ function decideRoleChange(policy, principal, scopes, change, customRoles, author
 		const revocable = kind === "revoke" && custom !== void 0 && allowed.inert?.has(name);
 		if (!allowed.assignable.has(name) && revocable !== true) deny("not-assignable-by");
 		else if (custom === void 0 && usesAssigns(policy) && !allowed.manage) {
-			const held = rolesAtInstance(policy, principal, scopes, scope, change.id, within, now);
+			const held = global ? rankRoles(policy, (principal.roles ?? []).filter((role) => declaredRoleNames$1(policy).has(role))) : rolesAtInstance(policy, principal, scopes, scope, id, within, now);
 			by = held.find((role) => bindingOf(policy, role)?.assigns?.includes(name) === true) ?? null;
 			if (by === null) deny("not-assignable-by", { held });
 		}
@@ -2742,6 +2748,7 @@ function buildInstance(policy, subject, envBase, team) {
 	const relationCache = envBase.relationCache ?? /* @__PURE__ */ new Map();
 	const relations = relationReader(envBase.relations, relationCache, policy.resources);
 	const assignableAt = (tenant) => assignableIn(policy, subject, envBase.customRoles, customGrants, tenant, tenant === void 0 ? void 0 : envBase.assignable?.get(tenant));
+	const assignableGlobal = () => assignableIn(policy, subject, envBase.customRoles, customGrants, void 0, void 0, nowSeconds(), true);
 	const envFor = (emit, skipAlternatives = false) => ({
 		emit,
 		simulated: envBase.simulated,
@@ -3054,22 +3061,23 @@ function buildInstance(policy, subject, envBase, team) {
 			return audiencesOf(policy, heldRoleNames(policy, subject, subject.principal?.tenant));
 		},
 		assignableRoles(options) {
+			if (options?.scope === "global") return assignableGlobal().roles.filter((leaf) => leaf.on === void 0);
 			return assignableAt(options?.tenant ?? subject.principal?.tenant).roles;
 		},
 		assignablePermissions(options) {
-			if (options?.scope === "global") return assignableIn(policy, subject, envBase.customRoles, customGrants, void 0, void 0, nowSeconds(), true).permissions;
+			if (options?.scope === "global") return assignableGlobal().permissions;
 			const tenant = options?.tenant ?? subject.principal?.tenant;
 			return tenant === void 0 ? [] : assignableAt(tenant).permissions;
 		},
 		assignableLevels(permission, options) {
 			const of = (found) => (Object.hasOwn(found.levels, permission.key) ? found.levels[permission.key] : void 0) ?? [];
-			if (options?.scope === "global") return of(assignableIn(policy, subject, envBase.customRoles, customGrants, void 0, void 0, nowSeconds(), true));
+			if (options?.scope === "global") return of(assignableGlobal());
 			const tenant = options?.tenant ?? subject.principal?.tenant;
 			return tenant === void 0 ? [] : of(assignableAt(tenant));
 		},
 		decideRoleChange(change, options) {
 			return decideRoleChange(policy, subject.principal, scopeList(policy.scopes), change, envBase.customRoles, (tenant) => {
-				const found = assignableAt(tenant);
+				const found = tenant === void 0 ? assignableGlobal() : assignableAt(tenant);
 				return {
 					assignable: new Set(found.roles.map((leaf) => leaf.key)),
 					manage: found.manage,

package/dist/{permissions-CpZrivYv.js → permissions-RJrovw98.js}

@@ -1,5 +1,5 @@
 import { b as resource, n as definePermissions } from "./permissions-DVoF6dMt.js";
-import { s as crud } from "./src-CSbUiozF.js";
+import { s as crud } from "./src-BDwEZWrZ.js";
 import { b as definePlans, x as defineRoles } from "./grantee-Cv5Sogfv.js";
 //#region src/testing/saas/schema.ts
 function accepts(kind, value) {

package/dist/{policy-D8UFyERw.d.ts → policy-D2W7uv19.d.ts}

@@ -1,4 +1,4 @@
-import { C as Policy, Nr as Principal, Pr as Subject } from "./policy-CFZAr_Al.js";
+import { C as Policy, Nr as Principal, Pr as Subject } from "./policy-IB6yxpC3.js";
 import { c as saasPlans, l as saasRoles, s as saasPermissions } from "./permissions-CDgvKG5L.js";
 //#region src/testing/saas/policy.d.ts
 /** Daily API-key quota per subject; the bucket should be per tenant too. */

package/dist/{policy-CFZAr_Al.d.ts → policy-IB6yxpC3.d.ts}

@@ -629,13 +629,9 @@ type RoleChangeTarget = {
   /** `idp` when the identity provider owns the target's membership: the application cannot change it. */
   readonly managedBy?: "idp";
 };
-type RoleChange = {
+type RoleChangeBase = {
   readonly kind: "assign" | "revoke" | "transfer";
   readonly role: string | Role;
-  /** The scope the role is held at (a declared name or alias). */
-  readonly scope: string;
-  /** The scope instance. */
-  readonly id: string;
   /** Ids of the instance's ancestor scopes; a holder there may assign here. */
   readonly within?: Readonly<Record<string, string>>;
   readonly target: RoleChangeTarget;
@@ -646,6 +642,20 @@ type RoleChange = {
    */
   readonly holders?: number;
 };
+/**
+ * A role held at a named scope instance (`scope` is a declared name or alias
+ * and `id` the instance), or a global role: `scope: 'global'` with no `id`.
+ * A global change has no tenant, so `within` and `holders` do not apply to it.
+ */
+type RoleChange = RoleChangeBase & ({
+  /** The scope the role is held at (a declared name or alias). */
+  readonly scope: string;
+  /** The scope instance. */
+  readonly id: string;
+} | {
+  readonly scope: "global";
+  readonly id?: undefined;
+});
 /**
  * `granted` names the role that authorised the change (`null` when a
  * `meta.manageRoles` holder or the declared-role ceiling did); `denied` lists
@@ -913,8 +923,14 @@ type PermDock<V extends PolicyVocabulary = PolicyVocabulary> = {
   }) => readonly Role[];
   /** The distinct `meta.audience` values of the roles held in the active tenant, in rank order. */
   readonly audiences: () => readonly string[];
+  /**
+   * The roles the subject may hand out in a tenant (the active one by
+   * default), or with `scope: 'global'` the global roles it may hand out. A
+   * snapshot answers only the tenant form.
+   */
   readonly assignableRoles: (options?: {
     readonly tenant?: string;
+    readonly scope?: "global";
   }) => readonly Role[];
   /**
    * The custom-role ceiling the subject may hand out: in a tenant (empty

package/dist/{powersync-C7kLglqX.js → powersync-BylawD_U.js}

@@ -1,19 +1,19 @@
 import { i as findPermission } from "./permissions-DVoF6dMt.js";
 import { c as isConditionRef, s as isConditionDate } from "./refs-KYb4ntaz.js";
-import { _ as memoryRoleSource, p as localSnapshotManifest } from "./src-CSbUiozF.js";
+import { _ as memoryRoleSource, p as localSnapshotManifest } from "./src-BDwEZWrZ.js";
 import { d as scopeList, o as resolveScope } from "./scopes-CVdPrWN-.js";
 import { t as requiresApproval } from "./approval-required-TzNB9oQA.js";
-import { t as createPermDock } from "./permdock-CzqXjCpU.js";
+import { t as createPermDock } from "./permdock-CbgvLnuo.js";
 import { o as usageResult } from "./errors-CWfoNg9N.js";
 import { a as loadModule, n as asPolicy, o as pickNamed } from "./load-DhWEB9P1.js";
 import { i as scopeMembershipTable, r as scopeColumn } from "./compile-Ba4blROR.js";
 import { i as quoteSqlLiteral, t as SQL_IDENT } from "./sql-xdg5f4Fi.js";
-import "./sources-B0UvrJ21.js";
-import { W as quoteIdent, t as CUSTOM_ROLES } from "./rls-shared-aOQ4hGTO.js";
-import { H as collectGrants, W as contextRefs, h as tableFor, w as connectPg } from "./rls-fields-BMasREhR.js";
+import "./sources-4p0-4xQm.js";
+import { G as quoteIdent, t as CUSTOM_ROLES } from "./rls-shared-Cewd_-zI.js";
+import { H as collectGrants, W as contextRefs, h as tableFor, w as connectPg } from "./rls-fields-74oZPXWL.js";
 import { n as fixtureSubject, r as loadFixtures, t as fixtureRow } from "./fixtures-ht28Cplr.js";
-import { a as ownershipRules } from "./rls-ownership-B5Lkq62W.js";
-import { t as canFixture } from "./rls-verify-D8B7dOTh.js";
+import { a as ownershipRules } from "./rls-ownership-RuFqaqGz.js";
+import { t as canFixture } from "./rls-verify-CVQTHTh5.js";
 import { existsSync, readFileSync, writeFileSync } from "node:fs";
 import { resolve } from "node:path";
 //#region src/cli/powersync-streams.ts

package/dist/{powersync-yW1UUFzp.js → powersync-DliZK_-y.js}

@@ -1,4 +1,4 @@
-import { i as globalArgs, s as stringArg, t as COMMAND_DESCRIPTIONS } from "./commands-DWOrSQic.js";
+import { i as globalArgs, s as stringArg, t as COMMAND_DESCRIPTIONS } from "./commands-DSxCqG9A.js";
 import { defineCommand } from "citty";
 //#region src/cli/commands/powersync.ts
 function powersync(ctx) {
@@ -44,7 +44,7 @@ function powersync(ctx) {
 			const db = stringArg(parsed.db);
 			const fixtures = stringArg(parsed.fixtures);
 			const from = stringArg(parsed.from);
-			const { runPowerSync } = await import("./powersync-A8x_Yyvh.js");
+			const { runPowerSync } = await import("./powersync-e_AZrKbg.js");
 			ctx.report(await runPowerSync({
 				cwd: ctx.cwd,
 				config: ctx.config,

package/dist/powersync-e_AZrKbg.js

@@ -0,0 +1,2 @@
+import { n as runPowerSync } from "./powersync-BylawD_U.js";
+export { runPowerSync };

package/dist/prisma/index.d.ts

@@ -1,4 +1,4 @@
-import { Ir as Condition, Pr as Subject, mn as WhereResult } from "../policy-CFZAr_Al.js";
+import { Ir as Condition, Pr as Subject, mn as WhereResult } from "../policy-IB6yxpC3.js";
 import { r as RelationsMapping } from "../graph-sql-B-dsAT6j.js";
 import { n as WithSubjectOptions, t as RowCheck } from "../row-check-Dt35czLy.js";
 //#region src/prisma/model-fields.d.ts

package/dist/{problem-details-CkL50EEf.d.ts → problem-details-DX075l9V.d.ts}

@@ -1,4 +1,4 @@
-import { Yn as Decision } from "./policy-CFZAr_Al.js";
+import { Yn as Decision } from "./policy-IB6yxpC3.js";
 //#region src/core/problem-details.d.ts
 type Disclosure = "hide" | "reveal";
 /** The plans a `not-entitled` denial asks for; empty unless every denial is `not-entitled`. */

package/dist/{protected-CNsMzrVd.d.ts → protected-BdnIEFkY.d.ts}

@@ -1,8 +1,8 @@
-import { D as PolicyVocabulary, Mr as Membership, Yn as Decision } from "./policy-CFZAr_Al.js";
+import { D as PolicyVocabulary, Mr as Membership, Yn as Decision } from "./policy-IB6yxpC3.js";
 import { f as Permission } from "./permissions-DttnqqxC.js";
 import { r as Role } from "./vocabulary-DA8a8zif.js";
-import { a as FilterResult, c as SubjectView, l as TenantView, o as PermissionSet, r as ClientPermDock, s as PermissionState, t as ApprovalHandle, u as UseRolesOptions } from "./types-kxznc7cn.js";
-import { n as ProtectedProps } from "./types-C3s9xVJG.js";
+import { a as FilterResult, c as SubjectView, l as TenantView, o as PermissionSet, r as ClientPermDock, s as PermissionState, t as ApprovalHandle, u as UseRolesOptions } from "./types-CKNSyIf_.js";
+import { n as ProtectedProps } from "./types-BnIEz1sU.js";
 import { ReactNode } from "react";
 //#region src/react/hooks.d.ts
 declare function usePermDock<V extends PolicyVocabulary = PolicyVocabulary>(): ClientPermDock<V>;

package/dist/{protected-Cs6kTaHo.js → protected-utU-SLuy.js}

@@ -1,4 +1,4 @@
-import { n as storeOf } from "./store-options-yO0V6gRn.js";
+import { n as storeOf } from "./store-options-ByhZq1jV.js";
 import { a as protectedView, c as subjectView, i as permissionSet, l as tenantView, n as filterResult, o as rolesView, s as scopedTenant, t as approvalHandle } from "./views-Soe7bGSC.js";
 import { i as PermDockStoreContext, r as PermDockSnapshotPromiseContext } from "./live-options-H2eG8dfJ.js";
 import { Suspense, use, useMemo, useSyncExternalStore } from "react";

package/dist/{protected-bZs6rbT1.d.ts → protected-xAr24FEC.d.ts}

@@ -1,8 +1,8 @@
-import { Yn as Decision, er as GrantedDecision, ln as PermDock } from "./policy-CFZAr_Al.js";
+import { Yn as Decision, er as GrantedDecision, ln as PermDock } from "./policy-IB6yxpC3.js";
 import { f as Permission } from "./permissions-DttnqqxC.js";
 import { t as PermissionBoundaryState } from "./boundary-BmHxVH1J.js";
-import { s as PermissionState } from "./types-kxznc7cn.js";
-import { t as ClientStore } from "./store-D_pjn91-.js";
+import { s as PermissionState } from "./types-CKNSyIf_.js";
+import { t as ClientStore } from "./store-jOBYpiXC.js";
 import { Snippet } from "svelte";
 //#region src/svelte/boundary.d.ts
 type PermissionBoundaryProps = {

package/dist/{provider-DLzpb2Xz.js → provider-CSQd7m92.js}

@@ -1,6 +1,6 @@
 import { t as compact } from "./compact-y6vfu2_f.js";
-import { t as emptySnapshot } from "./from-snapshot-C3sHpZNS.js";
-import { t as adapterStore } from "./store-options-yO0V6gRn.js";
+import { t as emptySnapshot } from "./from-snapshot-CTLijvdm.js";
+import { t as adapterStore } from "./store-options-ByhZq1jV.js";
 import { i as PermDockStoreContext, n as useKeyed, r as PermDockSnapshotPromiseContext, t as useLiveOptions } from "./live-options-H2eG8dfJ.js";
 import { useLayoutEffect } from "react";
 import { jsx } from "react/jsx-runtime";

package/dist/{provider-Cjr62YMV.d.ts → provider-DZY281jO.d.ts}

@@ -1,4 +1,4 @@
-import { t as PermDockProviderProps } from "./types-C3s9xVJG.js";
+import { t as PermDockProviderProps } from "./types-BnIEz1sU.js";
 import { ReactElement } from "react";
 //#region src/react/provider.d.ts
 declare function PermDockProvider(props: PermDockProviderProps): ReactElement;

package/dist/{provider-store-DNyC1y48.js → provider-store-Cfbvo4DE.js}

@@ -1,6 +1,6 @@
 import { t as compact } from "./compact-y6vfu2_f.js";
-import { t as emptySnapshot } from "./from-snapshot-C3sHpZNS.js";
-import { i as isPromiseLike, t as adapterStore } from "./store-options-yO0V6gRn.js";
+import { t as emptySnapshot } from "./from-snapshot-CTLijvdm.js";
+import { i as isPromiseLike, t as adapterStore } from "./store-options-ByhZq1jV.js";
 //#region src/client/provider-store.ts
 /**
 * Store options that read `read()` on every request, so a rotated token, a

package/dist/react/index.d.ts

@@ -1,8 +1,8 @@
-import { n as requiredPlans } from "../problem-details-CkL50EEf.js";
-import { i as describe } from "../describe-PdoqESvg.js";
+import { n as requiredPlans } from "../problem-details-DX075l9V.js";
+import { i as describe } from "../describe-DMYiCjJV.js";
 import { t as approvalHeaders } from "../headers-Cf-zWvsO.js";
-import { a as FilterResult, c as SubjectView, i as ClientStatus, l as TenantView, n as ApprovalState, o as PermissionSet, r as ClientPermDock, s as PermissionState, t as ApprovalHandle } from "../types-kxznc7cn.js";
-import { n as ProtectedProps, t as PermDockProviderProps } from "../types-C3s9xVJG.js";
-import { a as useFilter, c as usePermission, d as useSubject, f as useTenant, i as useAssignableRoles, l as usePermissions, n as useApproval, o as useMemberships, r as useAssignablePermissions, s as usePermDock, t as Protected, u as useRoles } from "../protected-CNsMzrVd.js";
-import { t as PermDockProvider } from "../provider-Cjr62YMV.js";
+import { a as FilterResult, c as SubjectView, i as ClientStatus, l as TenantView, n as ApprovalState, o as PermissionSet, r as ClientPermDock, s as PermissionState, t as ApprovalHandle } from "../types-CKNSyIf_.js";
+import { n as ProtectedProps, t as PermDockProviderProps } from "../types-BnIEz1sU.js";
+import { a as useFilter, c as usePermission, d as useSubject, f as useTenant, i as useAssignableRoles, l as usePermissions, n as useApproval, o as useMemberships, r as useAssignablePermissions, s as usePermDock, t as Protected, u as useRoles } from "../protected-BdnIEFkY.js";
+import { t as PermDockProvider } from "../provider-DZY281jO.js";
 export { type ApprovalHandle, type ApprovalState, type ClientPermDock, type ClientStatus, type FilterResult, PermDockProvider, type PermDockProviderProps, type PermissionSet, type PermissionState, Protected, type ProtectedProps, type SubjectView, type TenantView, approvalHeaders, describe, requiredPlans, useApproval, useAssignablePermissions, useAssignableRoles, useFilter, useMemberships, usePermDock, usePermission, usePermissions, useRoles, useSubject, useTenant };

package/dist/react/index.js

@@ -2,6 +2,6 @@
 import { r as requiredPlans } from "../problem-details-_AMOYz-w.js";
 import { t as describe } from "../describe-B_gVZEVi.js";
 import { t as approvalHeaders } from "../headers-BZSDieNT.js";
-import { a as useFilter, c as usePermission, d as useSubject, f as useTenant, i as useAssignableRoles, l as usePermissions, n as useApproval, o as useMemberships, r as useAssignablePermissions, s as usePermDock, t as Protected, u as useRoles } from "../protected-Cs6kTaHo.js";
-import { t as PermDockProvider } from "../provider-DLzpb2Xz.js";
+import { a as useFilter, c as usePermission, d as useSubject, f as useTenant, i as useAssignableRoles, l as usePermissions, n as useApproval, o as useMemberships, r as useAssignablePermissions, s as usePermDock, t as Protected, u as useRoles } from "../protected-utU-SLuy.js";
+import { t as PermDockProvider } from "../provider-CSQd7m92.js";
 export { PermDockProvider, Protected, approvalHeaders, describe, requiredPlans, useApproval, useAssignablePermissions, useAssignableRoles, useFilter, useMemberships, usePermDock, usePermission, usePermissions, useRoles, useSubject, useTenant };

package/dist/react/provider-client.d.ts

@@ -1,2 +1,2 @@
-import { t as PermDockProvider } from "../provider-Cjr62YMV.js";
+import { t as PermDockProvider } from "../provider-DZY281jO.js";
 export { PermDockProvider };

package/dist/react/provider-client.js

@@ -1,3 +1,3 @@
 "use client";
-import { t as PermDockProvider } from "../provider-DLzpb2Xz.js";
+import { t as PermDockProvider } from "../provider-CSQd7m92.js";
 export { PermDockProvider };

package/dist/react-native/index.d.ts

@@ -1,13 +1,13 @@
-import { At as SnapshotSource, Dr as CustomRole, Ft as TokenVerifier, Mr as Membership, Tt as Snapshot, pt as LocalSnapshotManifest } from "../policy-CFZAr_Al.js";
+import { At as SnapshotSource, Dr as CustomRole, Ft as TokenVerifier, Mr as Membership, Tt as Snapshot, pt as LocalSnapshotManifest } from "../policy-IB6yxpC3.js";
 import { f as Permission } from "../permissions-DttnqqxC.js";
-import { n as requiredPlans } from "../problem-details-CkL50EEf.js";
-import { i as describe } from "../describe-PdoqESvg.js";
-import { t as parseLocalSnapshotManifest } from "../parse-local-manifest-BkGQNzAh.js";
+import { n as requiredPlans } from "../problem-details-DX075l9V.js";
+import { i as describe } from "../describe-DMYiCjJV.js";
+import { t as parseLocalSnapshotManifest } from "../parse-local-manifest-JLnaBH0S.js";
 import { t as approvalHeaders } from "../headers-Cf-zWvsO.js";
-import { a as FilterResult, c as SubjectView, i as ClientStatus, l as TenantView, n as ApprovalState, o as PermissionSet, r as ClientPermDock, s as PermissionState, t as ApprovalHandle } from "../types-kxznc7cn.js";
-import { n as ProtectedProps } from "../types-C3s9xVJG.js";
-import { a as useFilter, c as usePermission, d as useSubject, f as useTenant, i as useAssignableRoles, l as usePermissions, n as useApproval, o as useMemberships, r as useAssignablePermissions, s as usePermDock, t as Protected, u as useRoles } from "../protected-CNsMzrVd.js";
-import { t as ClientStore } from "../store-D_pjn91-.js";
+import { a as FilterResult, c as SubjectView, i as ClientStatus, l as TenantView, n as ApprovalState, o as PermissionSet, r as ClientPermDock, s as PermissionState, t as ApprovalHandle } from "../types-CKNSyIf_.js";
+import { n as ProtectedProps } from "../types-BnIEz1sU.js";
+import { a as useFilter, c as usePermission, d as useSubject, f as useTenant, i as useAssignableRoles, l as usePermissions, n as useApproval, o as useMemberships, r as useAssignablePermissions, s as usePermDock, t as Protected, u as useRoles } from "../protected-BdnIEFkY.js";
+import { t as ClientStore } from "../store-jOBYpiXC.js";
 import { ReactElement, ReactNode } from "react";
 //#region src/react-native/guards.d.ts
 /** `true` once the provider has a snapshot to answer from: storage was read or a seed was given. Hide the splash screen on it. */

package/dist/react-native/index.js

@@ -8,12 +8,12 @@ import { n as parseSnapshot, o as bindConditionRefs } from "../snapshot-Enxd0n-s
 import { s as flattenGrantee } from "../grantee-Cv5Sogfv.js";
 import { p as resolveActiveTenant, u as nowSeconds } from "../validity-uOp8UpYn.js";
 import { n as isThenable } from "../thenable-okc2xDsj.js";
-import { r as heldRoleNames, t as emptySnapshot } from "../from-snapshot-C3sHpZNS.js";
+import { r as heldRoleNames, t as emptySnapshot } from "../from-snapshot-CTLijvdm.js";
 import { t as parseLocalSnapshotManifest } from "../parse-local-manifest-BrMozJCo.js";
 import { t as approvalHeaders } from "../headers-BZSDieNT.js";
-import { n as storeOf, r as isJws, t as adapterStore } from "../store-options-yO0V6gRn.js";
+import { n as storeOf, r as isJws, t as adapterStore } from "../store-options-ByhZq1jV.js";
 import { i as PermDockStoreContext, n as useKeyed, t as useLiveOptions } from "../live-options-H2eG8dfJ.js";
-import { a as useFilter, c as usePermission, d as useSubject, f as useTenant, i as useAssignableRoles, l as usePermissions, n as useApproval, o as useMemberships, r as useAssignablePermissions, s as usePermDock, t as Protected, u as useRoles } from "../protected-Cs6kTaHo.js";
+import { a as useFilter, c as usePermission, d as useSubject, f as useTenant, i as useAssignableRoles, l as usePermissions, n as useApproval, o as useMemberships, r as useAssignablePermissions, s as usePermDock, t as Protected, u as useRoles } from "../protected-utU-SLuy.js";
 import { useEffect, useMemo, useRef } from "react";
 import { jsx } from "react/jsx-runtime";
 //#region src/react-native/guards.ts

package/dist/{replay-sqBGMnNs.d.ts → replay-CYyiLiwO.d.ts}

@@ -1,4 +1,4 @@
-import { g as ReplayStore } from "./types-9AWO9EGt.js";
+import { g as ReplayStore } from "./types-Cq_H8N_X.js";
 //#region src/ssf/replay.d.ts
 declare function memoryReplayStore(): ReplayStore;
 //#endregion

package/dist/{rls-CEvs64Kj.js → rls-B4ur8nKQ.js}

@@ -1,4 +1,4 @@
-import { i as globalArgs, s as stringArg, t as COMMAND_DESCRIPTIONS } from "./commands-DWOrSQic.js";
+import { i as globalArgs, s as stringArg, t as COMMAND_DESCRIPTIONS } from "./commands-DSxCqG9A.js";
 import { defineCommand } from "citty";
 //#region src/cli/commands/rls.ts
 function rls(ctx) {
@@ -189,7 +189,7 @@ function rls(ctx) {
 			}
 		},
 		async run({ args: parsed }) {
-			const result = await (await import("./rls-BMNydpHk.js")).runRls({
+			const result = await (await import("./rls-DQtdgTHB.js")).runRls({
 				cwd: ctx.cwd,
 				config: ctx.config,
 				rest: parsed._,