permdock 0.2.0 → 0.3.1

package/dist/next/plugin.js

@@ -1,5 +1,5 @@
 import { i as describeError } from "../errors-CWfoNg9N.js";
-import { n as createCollectScheduler, r as report, t as collectOnce } from "../watch-UihESpsJ.js";
+import { n as createCollectScheduler, r as report, t as collectOnce } from "../watch-DVBJ9cBq.js";
 //#region src/cli/plugin.ts
 const PHASE_BUILD = "phase-production-build";
 const PHASE_DEV = "phase-development-server";

package/dist/node/index.d.ts

@@ -1,7 +1,7 @@
-import { C as Policy, D as PolicyVocabulary, Nr as Principal, ln as PermDock } from "../policy-CFZAr_Al.js";
+import { C as Policy, D as PolicyVocabulary, Nr as Principal, ln as PermDock } from "../policy-IB6yxpC3.js";
 import { f as Permission } from "../permissions-DttnqqxC.js";
-import { a as ScopeGuard, h as InvalidSignatureError, i as ProtectOptions, n as OpenApiHooks, t as Guard, w as verifyWebBotAuth, x as discoverViaSignatureAgent } from "../create-BWyx3jua.js";
-import { t as ServerAdapterOptions } from "../bind-CVy3Espv.js";
+import { a as ScopeGuard, h as InvalidSignatureError, i as ProtectOptions, n as OpenApiHooks, t as Guard, w as verifyWebBotAuth, x as discoverViaSignatureAgent } from "../create-B1d519XK.js";
+import { t as ServerAdapterOptions } from "../bind-C_ob3LKa.js";
 import { a as toRequest, i as sendResponse, n as fromResponse, r as isServerResponse, t as NodeRequest } from "../http-DPuDaChb.js";
 import { IncomingMessage, ServerResponse } from "node:http";
 //#region src/node/create.d.ts

package/dist/node/index.js

@@ -1,5 +1,5 @@
 import { i as discoverViaSignatureAgent, r as InvalidSignatureError, s as verifyWebBotAuth } from "../evaluations-tz6D9A2G.js";
-import { r as bindKernel } from "../bind-VnYn2HKq.js";
+import { r as bindKernel } from "../bind-CuzGytRf.js";
 import { i as toRequest, n as isServerResponse, r as sendResponse, t as fromResponse } from "../http-BIhmLfCc.js";
 //#region src/node/create.ts
 const nodeRequest = (req) => req;

package/dist/openai/index.d.ts

@@ -1,7 +1,7 @@
-import { C as Policy, D as PolicyVocabulary, Nr as Principal, kr as Delegation, ln as PermDock } from "../policy-CFZAr_Al.js";
+import { C as Policy, D as PolicyVocabulary, Nr as Principal, kr as Delegation, ln as PermDock } from "../policy-IB6yxpC3.js";
 import { f as Permission } from "../permissions-DttnqqxC.js";
-import { c as ApprovalRequest, f as ApprovalStore } from "../types-vKyAMtcX.js";
-import { t as InstanceOptions } from "../instance-options-BK_rNOSC.js";
+import { c as ApprovalRequest, f as ApprovalStore } from "../types-aqOHTHcp.js";
+import { t as InstanceOptions } from "../instance-options-jARdwfPN.js";
 import { t as ToolMap } from "../types-Bvc4oWT6.js";
 //#region src/openai/create.d.ts
 /** The app context passed to `run(agent, input, { context })`. */

package/dist/openai/index.js

@@ -1,7 +1,7 @@
 import { t as compact } from "../compact-y6vfu2_f.js";
 import { r as memoryApprovalStore } from "../store-DMAWwAJV.js";
 import { t as instanceOptions } from "../instance-options-Dhhcnm3y.js";
-import { n as createAgentKernel, t as approvalTokenOf } from "../kernel-GSQnMz3O.js";
+import { n as createAgentKernel, t as approvalTokenOf } from "../kernel-_RRHmnMY.js";
 //#region src/openai/create.ts
 function appContext(runContext) {
 	const context = runContext?.context;

package/dist/openapi/index.d.ts

@@ -1,6 +1,6 @@
-import { C as Policy, Ir as Condition, Nr as Principal } from "../policy-CFZAr_Al.js";
+import { C as Policy, Ir as Condition, Nr as Principal } from "../policy-IB6yxpC3.js";
 import { f as Permission, m as PermissionTree } from "../permissions-DttnqqxC.js";
-import { a as ProblemDetails } from "../errors-DAqevpNk.js";
+import { a as ProblemDetails } from "../errors-DPdqI50v.js";
 import { StandardJSONSchemaV1, StandardSchemaV1 } from "@standard-schema/spec";
 //#region src/openapi/types.d.ts
 type OpenApiTarget = "3.1" | "3.2" | "3.3";

package/dist/{openapi-Bbg4wGVL.js → openapi-CQTsgKoB.js}

@@ -1,4 +1,4 @@
-import { a as listArg, i as globalArgs, s as stringArg, t as COMMAND_DESCRIPTIONS } from "./commands-DWOrSQic.js";
+import { a as listArg, i as globalArgs, s as stringArg, t as COMMAND_DESCRIPTIONS } from "./commands-BeaGNj_o.js";
 import { defineCommand } from "citty";
 //#region src/cli/commands/openapi.ts
 function openapi(ctx) {

package/dist/orpc/index.d.ts

@@ -1,9 +1,9 @@
-import { C as Policy, D as PolicyVocabulary, Nr as Principal, ln as PermDock } from "../policy-CFZAr_Al.js";
+import { C as Policy, D as PolicyVocabulary, Nr as Principal, ln as PermDock } from "../policy-IB6yxpC3.js";
 import { f as Permission } from "../permissions-DttnqqxC.js";
 import { n as RevocationFeed } from "../revocations-Cy06JNx2.js";
-import { A as ConnectionOptions, O as Connection, n as OpenApiHooks } from "../create-BWyx3jua.js";
-import { t as ServerAdapterOptions } from "../bind-CVy3Espv.js";
-import { t as StreamProtectOptions } from "../stream-DlvG2hs-.js";
+import { A as ConnectionOptions, O as Connection, n as OpenApiHooks } from "../create-B1d519XK.js";
+import { t as ServerAdapterOptions } from "../bind-C_ob3LKa.js";
+import { t as StreamProtectOptions } from "../stream-D1RXubw2.js";
 import { Middleware } from "@orpc/server";
 //#region src/orpc/create.d.ts
 type OrpcMiddlewareOpts<TCtx extends object = object, TInput = unknown> = {

package/dist/orpc/index.js

@@ -2,9 +2,9 @@ import { t as compact } from "../compact-y6vfu2_f.js";
 import { p as isPermission } from "../permissions-DVoF6dMt.js";
 import { a as problemMessage } from "../http-SO7qGttf.js";
 import { t as problemFromError } from "../map-error-pgUWNNtG.js";
-import { n as attached } from "../bind-VnYn2HKq.js";
+import { n as attached } from "../bind-CuzGytRf.js";
 import { a as reloadAfter, r as isAsyncIterable } from "../stream-DDpvynSB.js";
-import { i as rpcCode, n as guardStream, r as problemBody, t as bindRpcKernel } from "../rpc-DOK54_CS.js";
+import { i as rpcCode, n as guardStream, r as problemBody, t as bindRpcKernel } from "../rpc-DL9Sqvb1.js";
 import { ORPCError } from "@orpc/server";
 //#region src/orpc/create.ts
 function toOpts(mw, input, next) {

package/dist/otel/index.d.ts

@@ -1,5 +1,5 @@
-import { D as PolicyVocabulary, ln as PermDock } from "../policy-CFZAr_Al.js";
-import { a as OtelOptions, i as OtelApi, n as GEN_AI_TOOL_CALL_ID, o as OtelWrap, r as GEN_AI_TOOL_NAME, s as StructuralLogger, t as GENAI_SEMCONV_PIN } from "../types-vNSDF7Dq.js";
+import { D as PolicyVocabulary, ln as PermDock } from "../policy-IB6yxpC3.js";
+import { a as OtelOptions, i as OtelApi, n as GEN_AI_TOOL_CALL_ID, o as OtelWrap, r as GEN_AI_TOOL_NAME, s as StructuralLogger, t as GENAI_SEMCONV_PIN } from "../types-QCuYJh4q.js";
 //#region src/otel/instrument.d.ts
 /**
  * Listens on one instance. Spans carry no duration and no histogram is

package/dist/{parse-local-manifest-BkGQNzAh.d.ts → parse-local-manifest-JLnaBH0S.d.ts}

@@ -1,4 +1,4 @@
-import { pt as LocalSnapshotManifest } from "./policy-CFZAr_Al.js";
+import { pt as LocalSnapshotManifest } from "./policy-IB6yxpC3.js";
 //#region src/core/parse-local-manifest.d.ts
 /**
  * Whether `value` has the shape `localSnapshotManifest(policy)` writes, with

package/dist/pdp/index.d.ts

@@ -1,5 +1,5 @@
-import { C as Policy, D as PolicyVocabulary, Nr as Principal, it as DecisionProvider, un as PermDockOptions } from "../policy-CFZAr_Al.js";
-import { a as RelationMap, c as RemotePdpEndpoints, d as SpiceDbCheck, f as SpiceDbOptions, i as PdpPermDock, l as RemotePdpMapping, n as OpenFgaTuple, o as RemotePdpAuth, r as PdpFactory, s as RemotePdpCache, t as OpenFgaOptions, u as RemotePdpOptions } from "../types-BVyImy5I.js";
+import { C as Policy, D as PolicyVocabulary, Nr as Principal, it as DecisionProvider, un as PermDockOptions } from "../policy-IB6yxpC3.js";
+import { a as RelationMap, c as RemotePdpEndpoints, d as SpiceDbCheck, f as SpiceDbOptions, i as PdpPermDock, l as RemotePdpMapping, n as OpenFgaTuple, o as RemotePdpAuth, r as PdpFactory, s as RemotePdpCache, t as OpenFgaOptions, u as RemotePdpOptions } from "../types-DxiCGmmd.js";
 //#region src/pdp/create.d.ts
 export declare function createPermDock<TUser, TPrincipal extends Principal = Principal, V extends PolicyVocabulary = PolicyVocabulary>(policy: Policy<TUser, TPrincipal, V>, user: TUser | null, options?: PermDockOptions): Promise<PdpPermDock<V>>;
 //#endregion

package/dist/pdp/index.js

@@ -5,7 +5,7 @@ import { n as PermDockValidationError } from "../validation-error-CnjZ4t92.js";
 import { a as deniedMessage, i as approvalMessage, n as PermDockDeniedError, t as PermDockApprovalRequiredError } from "../errors-Cz5zn0mW.js";
 import { d as isArazzoSimulateInput } from "../snapshot-Enxd0n-s.js";
 import { n as isThenable } from "../thenable-okc2xDsj.js";
-import { t as createPermDock$1 } from "../permdock-CzqXjCpU.js";
+import { t as createPermDock$1 } from "../permdock-CbgvLnuo.js";
 import { s as isRecord } from "../map-AcxK9o_D.js";
 import { a as postJson, c as ttlMs, i as joinUrl, n as denied, o as resourceIdOf, r as granted, s as ttlCache, t as cacheKey } from "../shared-DRu8VFVM.js";
 //#region src/pdp/create.ts

package/dist/{permdock-CzqXjCpU.js → permdock-CbgvLnuo.js}

@@ -2000,46 +2000,52 @@ function decideRoleChange(policy, principal, scopes, change, customRoles, author
 	}
 	const kind = change?.kind;
 	const target = change?.target;
-	if (typeof name !== "string" || kind !== "assign" && kind !== "revoke" && kind !== "transfer" || typeof change.id !== "string" || change.id === "" || target === null || typeof target !== "object" || typeof target.id !== "string" || target.id === "") {
+	const global = change?.scope === "global";
+	if (typeof name !== "string" || kind !== "assign" && kind !== "revoke" && kind !== "transfer" || (global ? change.id !== void 0 : typeof change.id !== "string" || change.id === "") || target === null || typeof target !== "object" || typeof target.id !== "string" || target.id === "") {
 		deny("validation");
 		return done(null);
 	}
+	const id = change.id ?? "";
 	const binding = bindingOf(policy, name);
 	const declared = declaredRoleNames$1(policy).has(name);
-	const named = declared ? [] : tenantCustomRoles(policy, customRoles).filter((role) => role.name === name);
+	const named = declared || global ? [] : tenantCustomRoles(policy, customRoles).filter((role) => role.name === name);
 	if (!declared && named.length === 0) {
 		deny("unknown-role");
 		return done(null);
 	}
-	const scope = resolveScope(scopes, change.scope);
+	const scope = global ? "global" : resolveScope(scopes, change.scope);
 	const customAt = named.map((role) => customRoleScope(role, scopes));
 	const on = declared ? binding?.on ?? findRole(policy.vocabulary?.roles, name)?.on : customAt.includes(scope) ? scope : customAt[0];
-	const heldAt = typeof on === "string" ? resolveScope(scopes, on) : void 0;
+	const heldAt = typeof on === "string" ? resolveScope(scopes, on) : global ? "global" : void 0;
 	if (scope === void 0 || heldAt === void 0 || heldAt !== scope) {
 		deny("scope", { expected: heldAt ?? null });
 		return done(null);
 	}
-	const root = scopes[0]?.name;
-	const supplied = change.within === void 0 ? void 0 : Object.entries(change.within).find(([key]) => resolveScope(scopes, key) === root)?.[1];
 	let tenant;
 	let within = change.within;
-	if (scope === root) tenant = change.id;
-	else {
-		const anchor = heldAnchor(principal, scopes, scope, change.id, now);
-		const held = anchor === void 0 ? void 0 : tenantOf(anchor, scopes);
-		if (held !== void 0) {
-			tenant = supplied === void 0 || supplied === held ? held : void 0;
-			within = anchor?.within;
-		} else if (options.trusted === true) tenant = supplied;
-	}
-	if (tenant === void 0) {
-		deny("no-membership", {
-			scope,
-			id: change.id
-		});
-		return done(null);
+	let custom;
+	if (!global) {
+		const root = scopes[0]?.name;
+		const supplied = change.within === void 0 ? void 0 : Object.entries(change.within).find(([key]) => resolveScope(scopes, key) === root)?.[1];
+		if (scope === root) tenant = id;
+		else {
+			const anchor = heldAnchor(principal, scopes, scope, id, now);
+			const held = anchor === void 0 ? void 0 : tenantOf(anchor, scopes);
+			if (held !== void 0) {
+				tenant = supplied === void 0 || supplied === held ? held : void 0;
+				within = anchor?.within;
+			} else if (options.trusted === true) tenant = supplied;
+		}
+		if (tenant === void 0) {
+			deny("no-membership", {
+				scope,
+				id
+			});
+			return done(null);
+		}
+		const found = tenant;
+		custom = named.find((role) => sameId(role.tenant, found) && customRoleScope(role, scopes) === scope && sameId(customRoleId(role) ?? id, id));
 	}
-	const custom = named.find((role) => sameId(role.tenant, tenant) && customRoleScope(role, scopes) === scope && sameId(customRoleId(role) ?? change.id, change.id));
 	if (!declared && custom === void 0) {
 		deny("unknown-role");
 		return done(null);
@@ -2054,7 +2060,7 @@ function decideRoleChange(policy, principal, scopes, change, customRoles, author
 	let by = null;
 	if (kind === "transfer") {
 		if (self) deny("self-demotion");
-		if (holdsAt(principal, name, scope, change.id, now)) by = name;
+		if (global ? (principal.roles ?? []).includes(name) : holdsAt(principal, name, scope, id, now)) by = name;
 		else deny("not-assignable-by", { holds: false });
 	} else {
 		if (self) deny(kind === "revoke" ? "self-demotion" : "not-assignable-by", { self: true });
@@ -2062,7 +2068,7 @@ function decideRoleChange(policy, principal, scopes, change, customRoles, author
 		const revocable = kind === "revoke" && custom !== void 0 && allowed.inert?.has(name);
 		if (!allowed.assignable.has(name) && revocable !== true) deny("not-assignable-by");
 		else if (custom === void 0 && usesAssigns(policy) && !allowed.manage) {
-			const held = rolesAtInstance(policy, principal, scopes, scope, change.id, within, now);
+			const held = global ? rankRoles(policy, (principal.roles ?? []).filter((role) => declaredRoleNames$1(policy).has(role))) : rolesAtInstance(policy, principal, scopes, scope, id, within, now);
 			by = held.find((role) => bindingOf(policy, role)?.assigns?.includes(name) === true) ?? null;
 			if (by === null) deny("not-assignable-by", { held });
 		}
@@ -2742,6 +2748,7 @@ function buildInstance(policy, subject, envBase, team) {
 	const relationCache = envBase.relationCache ?? /* @__PURE__ */ new Map();
 	const relations = relationReader(envBase.relations, relationCache, policy.resources);
 	const assignableAt = (tenant) => assignableIn(policy, subject, envBase.customRoles, customGrants, tenant, tenant === void 0 ? void 0 : envBase.assignable?.get(tenant));
+	const assignableGlobal = () => assignableIn(policy, subject, envBase.customRoles, customGrants, void 0, void 0, nowSeconds(), true);
 	const envFor = (emit, skipAlternatives = false) => ({
 		emit,
 		simulated: envBase.simulated,
@@ -3054,22 +3061,23 @@ function buildInstance(policy, subject, envBase, team) {
 			return audiencesOf(policy, heldRoleNames(policy, subject, subject.principal?.tenant));
 		},
 		assignableRoles(options) {
+			if (options?.scope === "global") return assignableGlobal().roles.filter((leaf) => leaf.on === void 0);
 			return assignableAt(options?.tenant ?? subject.principal?.tenant).roles;
 		},
 		assignablePermissions(options) {
-			if (options?.scope === "global") return assignableIn(policy, subject, envBase.customRoles, customGrants, void 0, void 0, nowSeconds(), true).permissions;
+			if (options?.scope === "global") return assignableGlobal().permissions;
 			const tenant = options?.tenant ?? subject.principal?.tenant;
 			return tenant === void 0 ? [] : assignableAt(tenant).permissions;
 		},
 		assignableLevels(permission, options) {
 			const of = (found) => (Object.hasOwn(found.levels, permission.key) ? found.levels[permission.key] : void 0) ?? [];
-			if (options?.scope === "global") return of(assignableIn(policy, subject, envBase.customRoles, customGrants, void 0, void 0, nowSeconds(), true));
+			if (options?.scope === "global") return of(assignableGlobal());
 			const tenant = options?.tenant ?? subject.principal?.tenant;
 			return tenant === void 0 ? [] : of(assignableAt(tenant));
 		},
 		decideRoleChange(change, options) {
 			return decideRoleChange(policy, subject.principal, scopeList(policy.scopes), change, envBase.customRoles, (tenant) => {
-				const found = assignableAt(tenant);
+				const found = tenant === void 0 ? assignableGlobal() : assignableAt(tenant);
 				return {
 					assignable: new Set(found.roles.map((leaf) => leaf.key)),
 					manage: found.manage,

package/dist/{permissions-CpZrivYv.js → permissions-RJrovw98.js}

@@ -1,5 +1,5 @@
 import { b as resource, n as definePermissions } from "./permissions-DVoF6dMt.js";
-import { s as crud } from "./src-CSbUiozF.js";
+import { s as crud } from "./src-BDwEZWrZ.js";
 import { b as definePlans, x as defineRoles } from "./grantee-Cv5Sogfv.js";
 //#region src/testing/saas/schema.ts
 function accepts(kind, value) {

package/dist/{policy-D8UFyERw.d.ts → policy-D2W7uv19.d.ts}

@@ -1,4 +1,4 @@
-import { C as Policy, Nr as Principal, Pr as Subject } from "./policy-CFZAr_Al.js";
+import { C as Policy, Nr as Principal, Pr as Subject } from "./policy-IB6yxpC3.js";
 import { c as saasPlans, l as saasRoles, s as saasPermissions } from "./permissions-CDgvKG5L.js";
 //#region src/testing/saas/policy.d.ts
 /** Daily API-key quota per subject; the bucket should be per tenant too. */

package/dist/{policy-CFZAr_Al.d.ts → policy-IB6yxpC3.d.ts}

@@ -629,13 +629,9 @@ type RoleChangeTarget = {
   /** `idp` when the identity provider owns the target's membership: the application cannot change it. */
   readonly managedBy?: "idp";
 };
-type RoleChange = {
+type RoleChangeBase = {
   readonly kind: "assign" | "revoke" | "transfer";
   readonly role: string | Role;
-  /** The scope the role is held at (a declared name or alias). */
-  readonly scope: string;
-  /** The scope instance. */
-  readonly id: string;
   /** Ids of the instance's ancestor scopes; a holder there may assign here. */
   readonly within?: Readonly<Record<string, string>>;
   readonly target: RoleChangeTarget;
@@ -646,6 +642,20 @@ type RoleChange = {
    */
   readonly holders?: number;
 };
+/**
+ * A role held at a named scope instance (`scope` is a declared name or alias
+ * and `id` the instance), or a global role: `scope: 'global'` with no `id`.
+ * A global change has no tenant, so `within` and `holders` do not apply to it.
+ */
+type RoleChange = RoleChangeBase & ({
+  /** The scope the role is held at (a declared name or alias). */
+  readonly scope: string;
+  /** The scope instance. */
+  readonly id: string;
+} | {
+  readonly scope: "global";
+  readonly id?: undefined;
+});
 /**
  * `granted` names the role that authorised the change (`null` when a
  * `meta.manageRoles` holder or the declared-role ceiling did); `denied` lists
@@ -913,8 +923,14 @@ type PermDock<V extends PolicyVocabulary = PolicyVocabulary> = {
   }) => readonly Role[];
   /** The distinct `meta.audience` values of the roles held in the active tenant, in rank order. */
   readonly audiences: () => readonly string[];
+  /**
+   * The roles the subject may hand out in a tenant (the active one by
+   * default), or with `scope: 'global'` the global roles it may hand out. A
+   * snapshot answers only the tenant form.
+   */
   readonly assignableRoles: (options?: {
     readonly tenant?: string;
+    readonly scope?: "global";
   }) => readonly Role[];
   /**
    * The custom-role ceiling the subject may hand out: in a tenant (empty

package/dist/powersync-CrBX8hY6.js

@@ -0,0 +1,2 @@
+import { n as runPowerSync } from "./powersync-Dv1_aWF7.js";
+export { runPowerSync };

package/dist/{powersync-yW1UUFzp.js → powersync-DE19b9dT.js}

@@ -1,4 +1,4 @@
-import { i as globalArgs, s as stringArg, t as COMMAND_DESCRIPTIONS } from "./commands-DWOrSQic.js";
+import { i as globalArgs, s as stringArg, t as COMMAND_DESCRIPTIONS } from "./commands-BeaGNj_o.js";
 import { defineCommand } from "citty";
 //#region src/cli/commands/powersync.ts
 function powersync(ctx) {
@@ -44,7 +44,7 @@ function powersync(ctx) {
 			const db = stringArg(parsed.db);
 			const fixtures = stringArg(parsed.fixtures);
 			const from = stringArg(parsed.from);
-			const { runPowerSync } = await import("./powersync-A8x_Yyvh.js");
+			const { runPowerSync } = await import("./powersync-CrBX8hY6.js");
 			ctx.report(await runPowerSync({
 				cwd: ctx.cwd,
 				config: ctx.config,

package/dist/{powersync-C7kLglqX.js → powersync-Dv1_aWF7.js}

@@ -1,19 +1,19 @@
 import { i as findPermission } from "./permissions-DVoF6dMt.js";
 import { c as isConditionRef, s as isConditionDate } from "./refs-KYb4ntaz.js";
-import { _ as memoryRoleSource, p as localSnapshotManifest } from "./src-CSbUiozF.js";
+import { _ as memoryRoleSource, p as localSnapshotManifest } from "./src-BDwEZWrZ.js";
 import { d as scopeList, o as resolveScope } from "./scopes-CVdPrWN-.js";
 import { t as requiresApproval } from "./approval-required-TzNB9oQA.js";
-import { t as createPermDock } from "./permdock-CzqXjCpU.js";
+import { t as createPermDock } from "./permdock-CbgvLnuo.js";
 import { o as usageResult } from "./errors-CWfoNg9N.js";
 import { a as loadModule, n as asPolicy, o as pickNamed } from "./load-DhWEB9P1.js";
 import { i as scopeMembershipTable, r as scopeColumn } from "./compile-Ba4blROR.js";
 import { i as quoteSqlLiteral, t as SQL_IDENT } from "./sql-xdg5f4Fi.js";
-import "./sources-B0UvrJ21.js";
-import { W as quoteIdent, t as CUSTOM_ROLES } from "./rls-shared-aOQ4hGTO.js";
-import { H as collectGrants, W as contextRefs, h as tableFor, w as connectPg } from "./rls-fields-BMasREhR.js";
+import "./sources-4p0-4xQm.js";
+import { G as quoteIdent, t as CUSTOM_ROLES } from "./rls-shared-Cewd_-zI.js";
+import { H as collectGrants, W as contextRefs, h as tableFor, w as connectPg } from "./rls-fields-CZOMlwHl.js";
 import { n as fixtureSubject, r as loadFixtures, t as fixtureRow } from "./fixtures-ht28Cplr.js";
-import { a as ownershipRules } from "./rls-ownership-B5Lkq62W.js";
-import { t as canFixture } from "./rls-verify-D8B7dOTh.js";
+import { a as ownershipRules } from "./rls-ownership-DcYlZ09B.js";
+import { t as canFixture } from "./rls-verify-CMv9H3wV.js";
 import { existsSync, readFileSync, writeFileSync } from "node:fs";
 import { resolve } from "node:path";
 //#region src/cli/powersync-streams.ts

package/dist/prisma/index.d.ts

@@ -1,4 +1,4 @@
-import { Ir as Condition, Pr as Subject, mn as WhereResult } from "../policy-CFZAr_Al.js";
+import { Ir as Condition, Pr as Subject, mn as WhereResult } from "../policy-IB6yxpC3.js";
 import { r as RelationsMapping } from "../graph-sql-B-dsAT6j.js";
 import { n as WithSubjectOptions, t as RowCheck } from "../row-check-Dt35czLy.js";
 //#region src/prisma/model-fields.d.ts

package/dist/{problem-details-CkL50EEf.d.ts → problem-details-DX075l9V.d.ts}

@@ -1,4 +1,4 @@
-import { Yn as Decision } from "./policy-CFZAr_Al.js";
+import { Yn as Decision } from "./policy-IB6yxpC3.js";
 //#region src/core/problem-details.d.ts
 type Disclosure = "hide" | "reveal";
 /** The plans a `not-entitled` denial asks for; empty unless every denial is `not-entitled`. */

package/dist/{protected-CNsMzrVd.d.ts → protected-BdnIEFkY.d.ts}

@@ -1,8 +1,8 @@
-import { D as PolicyVocabulary, Mr as Membership, Yn as Decision } from "./policy-CFZAr_Al.js";
+import { D as PolicyVocabulary, Mr as Membership, Yn as Decision } from "./policy-IB6yxpC3.js";
 import { f as Permission } from "./permissions-DttnqqxC.js";
 import { r as Role } from "./vocabulary-DA8a8zif.js";
-import { a as FilterResult, c as SubjectView, l as TenantView, o as PermissionSet, r as ClientPermDock, s as PermissionState, t as ApprovalHandle, u as UseRolesOptions } from "./types-kxznc7cn.js";
-import { n as ProtectedProps } from "./types-C3s9xVJG.js";
+import { a as FilterResult, c as SubjectView, l as TenantView, o as PermissionSet, r as ClientPermDock, s as PermissionState, t as ApprovalHandle, u as UseRolesOptions } from "./types-CKNSyIf_.js";
+import { n as ProtectedProps } from "./types-BnIEz1sU.js";
 import { ReactNode } from "react";
 //#region src/react/hooks.d.ts
 declare function usePermDock<V extends PolicyVocabulary = PolicyVocabulary>(): ClientPermDock<V>;

package/dist/{protected-Cs6kTaHo.js → protected-utU-SLuy.js}

@@ -1,4 +1,4 @@
-import { n as storeOf } from "./store-options-yO0V6gRn.js";
+import { n as storeOf } from "./store-options-ByhZq1jV.js";
 import { a as protectedView, c as subjectView, i as permissionSet, l as tenantView, n as filterResult, o as rolesView, s as scopedTenant, t as approvalHandle } from "./views-Soe7bGSC.js";
 import { i as PermDockStoreContext, r as PermDockSnapshotPromiseContext } from "./live-options-H2eG8dfJ.js";
 import { Suspense, use, useMemo, useSyncExternalStore } from "react";

package/dist/{protected-bZs6rbT1.d.ts → protected-xAr24FEC.d.ts}

@@ -1,8 +1,8 @@
-import { Yn as Decision, er as GrantedDecision, ln as PermDock } from "./policy-CFZAr_Al.js";
+import { Yn as Decision, er as GrantedDecision, ln as PermDock } from "./policy-IB6yxpC3.js";
 import { f as Permission } from "./permissions-DttnqqxC.js";
 import { t as PermissionBoundaryState } from "./boundary-BmHxVH1J.js";
-import { s as PermissionState } from "./types-kxznc7cn.js";
-import { t as ClientStore } from "./store-D_pjn91-.js";
+import { s as PermissionState } from "./types-CKNSyIf_.js";
+import { t as ClientStore } from "./store-jOBYpiXC.js";
 import { Snippet } from "svelte";
 //#region src/svelte/boundary.d.ts
 type PermissionBoundaryProps = {

package/dist/{provider-DLzpb2Xz.js → provider-CSQd7m92.js}

@@ -1,6 +1,6 @@
 import { t as compact } from "./compact-y6vfu2_f.js";
-import { t as emptySnapshot } from "./from-snapshot-C3sHpZNS.js";
-import { t as adapterStore } from "./store-options-yO0V6gRn.js";
+import { t as emptySnapshot } from "./from-snapshot-CTLijvdm.js";
+import { t as adapterStore } from "./store-options-ByhZq1jV.js";
 import { i as PermDockStoreContext, n as useKeyed, r as PermDockSnapshotPromiseContext, t as useLiveOptions } from "./live-options-H2eG8dfJ.js";
 import { useLayoutEffect } from "react";
 import { jsx } from "react/jsx-runtime";

package/dist/{provider-Cjr62YMV.d.ts → provider-DZY281jO.d.ts}

@@ -1,4 +1,4 @@
-import { t as PermDockProviderProps } from "./types-C3s9xVJG.js";
+import { t as PermDockProviderProps } from "./types-BnIEz1sU.js";
 import { ReactElement } from "react";
 //#region src/react/provider.d.ts
 declare function PermDockProvider(props: PermDockProviderProps): ReactElement;

package/dist/{provider-store-DNyC1y48.js → provider-store-Cfbvo4DE.js}

@@ -1,6 +1,6 @@
 import { t as compact } from "./compact-y6vfu2_f.js";
-import { t as emptySnapshot } from "./from-snapshot-C3sHpZNS.js";
-import { i as isPromiseLike, t as adapterStore } from "./store-options-yO0V6gRn.js";
+import { t as emptySnapshot } from "./from-snapshot-CTLijvdm.js";
+import { i as isPromiseLike, t as adapterStore } from "./store-options-ByhZq1jV.js";
 //#region src/client/provider-store.ts
 /**
 * Store options that read `read()` on every request, so a rotated token, a

package/dist/react/index.d.ts

@@ -1,8 +1,8 @@
-import { n as requiredPlans } from "../problem-details-CkL50EEf.js";
-import { i as describe } from "../describe-PdoqESvg.js";
+import { n as requiredPlans } from "../problem-details-DX075l9V.js";
+import { i as describe } from "../describe-DMYiCjJV.js";
 import { t as approvalHeaders } from "../headers-Cf-zWvsO.js";
-import { a as FilterResult, c as SubjectView, i as ClientStatus, l as TenantView, n as ApprovalState, o as PermissionSet, r as ClientPermDock, s as PermissionState, t as ApprovalHandle } from "../types-kxznc7cn.js";
-import { n as ProtectedProps, t as PermDockProviderProps } from "../types-C3s9xVJG.js";
-import { a as useFilter, c as usePermission, d as useSubject, f as useTenant, i as useAssignableRoles, l as usePermissions, n as useApproval, o as useMemberships, r as useAssignablePermissions, s as usePermDock, t as Protected, u as useRoles } from "../protected-CNsMzrVd.js";
-import { t as PermDockProvider } from "../provider-Cjr62YMV.js";
+import { a as FilterResult, c as SubjectView, i as ClientStatus, l as TenantView, n as ApprovalState, o as PermissionSet, r as ClientPermDock, s as PermissionState, t as ApprovalHandle } from "../types-CKNSyIf_.js";
+import { n as ProtectedProps, t as PermDockProviderProps } from "../types-BnIEz1sU.js";
+import { a as useFilter, c as usePermission, d as useSubject, f as useTenant, i as useAssignableRoles, l as usePermissions, n as useApproval, o as useMemberships, r as useAssignablePermissions, s as usePermDock, t as Protected, u as useRoles } from "../protected-BdnIEFkY.js";
+import { t as PermDockProvider } from "../provider-DZY281jO.js";
 export { type ApprovalHandle, type ApprovalState, type ClientPermDock, type ClientStatus, type FilterResult, PermDockProvider, type PermDockProviderProps, type PermissionSet, type PermissionState, Protected, type ProtectedProps, type SubjectView, type TenantView, approvalHeaders, describe, requiredPlans, useApproval, useAssignablePermissions, useAssignableRoles, useFilter, useMemberships, usePermDock, usePermission, usePermissions, useRoles, useSubject, useTenant };

package/dist/react/index.js

@@ -2,6 +2,6 @@
 import { r as requiredPlans } from "../problem-details-_AMOYz-w.js";
 import { t as describe } from "../describe-B_gVZEVi.js";
 import { t as approvalHeaders } from "../headers-BZSDieNT.js";
-import { a as useFilter, c as usePermission, d as useSubject, f as useTenant, i as useAssignableRoles, l as usePermissions, n as useApproval, o as useMemberships, r as useAssignablePermissions, s as usePermDock, t as Protected, u as useRoles } from "../protected-Cs6kTaHo.js";
-import { t as PermDockProvider } from "../provider-DLzpb2Xz.js";
+import { a as useFilter, c as usePermission, d as useSubject, f as useTenant, i as useAssignableRoles, l as usePermissions, n as useApproval, o as useMemberships, r as useAssignablePermissions, s as usePermDock, t as Protected, u as useRoles } from "../protected-utU-SLuy.js";
+import { t as PermDockProvider } from "../provider-CSQd7m92.js";
 export { PermDockProvider, Protected, approvalHeaders, describe, requiredPlans, useApproval, useAssignablePermissions, useAssignableRoles, useFilter, useMemberships, usePermDock, usePermission, usePermissions, useRoles, useSubject, useTenant };

package/dist/react/provider-client.d.ts

@@ -1,2 +1,2 @@
-import { t as PermDockProvider } from "../provider-Cjr62YMV.js";
+import { t as PermDockProvider } from "../provider-DZY281jO.js";
 export { PermDockProvider };

package/dist/react/provider-client.js

@@ -1,3 +1,3 @@
 "use client";
-import { t as PermDockProvider } from "../provider-DLzpb2Xz.js";
+import { t as PermDockProvider } from "../provider-CSQd7m92.js";
 export { PermDockProvider };

package/dist/react-native/index.d.ts

@@ -1,13 +1,13 @@
-import { At as SnapshotSource, Dr as CustomRole, Ft as TokenVerifier, Mr as Membership, Tt as Snapshot, pt as LocalSnapshotManifest } from "../policy-CFZAr_Al.js";
+import { At as SnapshotSource, Dr as CustomRole, Ft as TokenVerifier, Mr as Membership, Tt as Snapshot, pt as LocalSnapshotManifest } from "../policy-IB6yxpC3.js";
 import { f as Permission } from "../permissions-DttnqqxC.js";
-import { n as requiredPlans } from "../problem-details-CkL50EEf.js";
-import { i as describe } from "../describe-PdoqESvg.js";
-import { t as parseLocalSnapshotManifest } from "../parse-local-manifest-BkGQNzAh.js";
+import { n as requiredPlans } from "../problem-details-DX075l9V.js";
+import { i as describe } from "../describe-DMYiCjJV.js";
+import { t as parseLocalSnapshotManifest } from "../parse-local-manifest-JLnaBH0S.js";
 import { t as approvalHeaders } from "../headers-Cf-zWvsO.js";
-import { a as FilterResult, c as SubjectView, i as ClientStatus, l as TenantView, n as ApprovalState, o as PermissionSet, r as ClientPermDock, s as PermissionState, t as ApprovalHandle } from "../types-kxznc7cn.js";
-import { n as ProtectedProps } from "../types-C3s9xVJG.js";
-import { a as useFilter, c as usePermission, d as useSubject, f as useTenant, i as useAssignableRoles, l as usePermissions, n as useApproval, o as useMemberships, r as useAssignablePermissions, s as usePermDock, t as Protected, u as useRoles } from "../protected-CNsMzrVd.js";
-import { t as ClientStore } from "../store-D_pjn91-.js";
+import { a as FilterResult, c as SubjectView, i as ClientStatus, l as TenantView, n as ApprovalState, o as PermissionSet, r as ClientPermDock, s as PermissionState, t as ApprovalHandle } from "../types-CKNSyIf_.js";
+import { n as ProtectedProps } from "../types-BnIEz1sU.js";
+import { a as useFilter, c as usePermission, d as useSubject, f as useTenant, i as useAssignableRoles, l as usePermissions, n as useApproval, o as useMemberships, r as useAssignablePermissions, s as usePermDock, t as Protected, u as useRoles } from "../protected-BdnIEFkY.js";
+import { t as ClientStore } from "../store-jOBYpiXC.js";
 import { ReactElement, ReactNode } from "react";
 //#region src/react-native/guards.d.ts
 /** `true` once the provider has a snapshot to answer from: storage was read or a seed was given. Hide the splash screen on it. */

package/dist/react-native/index.js

@@ -8,12 +8,12 @@ import { n as parseSnapshot, o as bindConditionRefs } from "../snapshot-Enxd0n-s
 import { s as flattenGrantee } from "../grantee-Cv5Sogfv.js";
 import { p as resolveActiveTenant, u as nowSeconds } from "../validity-uOp8UpYn.js";
 import { n as isThenable } from "../thenable-okc2xDsj.js";
-import { r as heldRoleNames, t as emptySnapshot } from "../from-snapshot-C3sHpZNS.js";
+import { r as heldRoleNames, t as emptySnapshot } from "../from-snapshot-CTLijvdm.js";
 import { t as parseLocalSnapshotManifest } from "../parse-local-manifest-BrMozJCo.js";
 import { t as approvalHeaders } from "../headers-BZSDieNT.js";
-import { n as storeOf, r as isJws, t as adapterStore } from "../store-options-yO0V6gRn.js";
+import { n as storeOf, r as isJws, t as adapterStore } from "../store-options-ByhZq1jV.js";
 import { i as PermDockStoreContext, n as useKeyed, t as useLiveOptions } from "../live-options-H2eG8dfJ.js";
-import { a as useFilter, c as usePermission, d as useSubject, f as useTenant, i as useAssignableRoles, l as usePermissions, n as useApproval, o as useMemberships, r as useAssignablePermissions, s as usePermDock, t as Protected, u as useRoles } from "../protected-Cs6kTaHo.js";
+import { a as useFilter, c as usePermission, d as useSubject, f as useTenant, i as useAssignableRoles, l as usePermissions, n as useApproval, o as useMemberships, r as useAssignablePermissions, s as usePermDock, t as Protected, u as useRoles } from "../protected-utU-SLuy.js";
 import { useEffect, useMemo, useRef } from "react";
 import { jsx } from "react/jsx-runtime";
 //#region src/react-native/guards.ts

package/dist/{replay-sqBGMnNs.d.ts → replay-CYyiLiwO.d.ts}

@@ -1,4 +1,4 @@
-import { g as ReplayStore } from "./types-9AWO9EGt.js";
+import { g as ReplayStore } from "./types-Cq_H8N_X.js";
 //#region src/ssf/replay.d.ts
 declare function memoryReplayStore(): ReplayStore;
 //#endregion

package/dist/{rls-BMNydpHk.js → rls-DiinlRML.js}

@@ -4,21 +4,21 @@ import { d as scopeList, o as resolveScope } from "./scopes-CVdPrWN-.js";
 import { E as listRoles, s as flattenGrantee } from "./grantee-Cv5Sogfv.js";
 import { h as scopeField } from "./validity-uOp8UpYn.js";
 import { i as describeError, o as usageResult } from "./errors-CWfoNg9N.js";
-import { s as policyRowConditionKeys } from "./catalog-doc-Dsc9y7sd.js";
+import { t as policyRowConditionKeys } from "./row-conditions-h2HythXQ.js";
 import { a as loadModule, n as asPolicy, o as pickNamed } from "./load-DhWEB9P1.js";
 import "./budget-NbEtbJC_.js";
 import { n as escapeSqlIdent } from "./sql-xdg5f4Fi.js";
-import "./sources-B0UvrJ21.js";
+import "./sources-4p0-4xQm.js";
 import { i as SEEDS_MARKER, r as INDEXES_MARKER, t as GRANTS_MARKER } from "./markers-B0hYLvMD.js";
 import { n as requirePeer } from "./peer-BOr_kJE1.js";
-import { f as splitUndiffed, n as supabaseConfig } from "./supabase-config-Bs44dare.js";
-import { B as parseMembershipsFlag, C as graphHelper, G as quoteLiteral, H as permittedIdsHelper, K as quoteTable, L as memberIdsHelper, Q as sessionLiveHelperSql, U as qualifiedTable$1, W as quoteIdent$1, X as scopeTable, Y as scopeSources, Z as scopeTypeOf, a as qualified$1, d as SESSION_LIVE_HELPER, et as subjectClaimJsonSql, n as HELPERS, nt as subjectIdSql, v as checkSuspension, w as graphSqlName } from "./rls-shared-aOQ4hGTO.js";
-import { A as helpersSql, B as breakGlassHolder, C as readTableIndexFacts, E as accessSql, F as seedSql, H as collectGrants, S as pruneIndexTargets, T as connectPgPool, U as roleNames, V as breakGlassKey, a as fieldViewsSql, b as indexTargets, c as assemblePolicies, d as readOnlyActorPolicies, f as branchClauses, g as permissionHelpersSql, h as tableFor, i as fieldViews, l as orSql, m as compileGrants, n as columnGrantSql, o as rowBranches, q as apiKeysPlan, r as columnRevokeSql, u as readOnlyActorKinds, v as permittedByPermissionHelper, x as indexesSql, y as COLUMNS_SQL } from "./rls-fields-BMasREhR.js";
-import { c as helperCallKeys, i as HELPER_TABLES, n as graphPlan, r as graphSql, s as callsHelper, t as closureDepths } from "./rls-graph-pc9fuXYm.js";
-import { a as ownershipRules, o as ownershipSql, r as assignmentSql } from "./rls-ownership-B5Lkq62W.js";
-import { _ as seedsMigration, d as resolveAuthorize, f as driftOf, g as pgDeltaPath, h as partPath, l as parseRbacAuthorize, m as parseSplit, o as supabaseHookSql, p as isSeedsDirectory, t as grantsLabel, u as rbacScaffold, v as writeSqlFiles } from "./supabase-hook-BuxLQLpU.js";
-import { n as runRlsVerify } from "./rls-verify-D8B7dOTh.js";
-import { t as supautilsRejections } from "./supautils-DYZnzRWV.js";
+import { f as splitUndiffed, n as supabaseConfig } from "./supabase-config-Bj3iDH2I.js";
+import { $ as sessionLiveHelperSql, G as quoteIdent$1, K as quoteLiteral, Q as scopeTypeOf, R as memberIdsHelper, T as graphSqlName, U as permittedIdsHelper, V as parseMembershipsFlag, W as qualifiedTable$1, X as scopeSources, Z as scopeTable, f as SESSION_LIVE_HELPER, o as qualified$1, q as quoteTable, r as HELPERS, rt as subjectIdSql, tt as subjectClaimJsonSql, w as graphHelper, y as checkSuspension } from "./rls-shared-Cewd_-zI.js";
+import { A as helpersSql, B as breakGlassHolder, C as readTableIndexFacts, E as accessSql, F as seedSql, H as collectGrants, S as pruneIndexTargets, T as connectPgPool, U as roleNames, V as breakGlassKey, a as fieldViewsSql, b as indexTargets, c as assemblePolicies, d as readOnlyActorPolicies, f as branchClauses, g as permissionHelpersSql, h as tableFor, i as fieldViews, l as orSql, m as compileGrants, n as columnGrantSql, o as rowBranches, q as apiKeysPlan, r as columnRevokeSql, u as readOnlyActorKinds, v as permittedByPermissionHelper, x as indexesSql, y as COLUMNS_SQL } from "./rls-fields-CZOMlwHl.js";
+import { c as helperCallKeys, i as HELPER_TABLES, n as graphPlan, r as graphSql, s as callsHelper, t as closureDepths } from "./rls-graph-CHwx0V8q.js";
+import { a as ownershipRules, o as ownershipSql, r as assignmentSql } from "./rls-ownership-DcYlZ09B.js";
+import { _ as seedsMigration, d as resolveAuthorize, f as driftOf, g as pgDeltaPath, h as partPath, l as parseRbacAuthorize, m as parseSplit, o as supabaseHookSql, p as isSeedsDirectory, t as grantsLabel, u as rbacScaffold, v as writeSqlFiles } from "./supabase-hook-ntETYCQu.js";
+import { n as runRlsVerify } from "./rls-verify-CMv9H3wV.js";
+import { t as supautilsRejections } from "./supautils-u8jXTGrt.js";
 import { basename, delimiter, join, resolve } from "node:path";
 import { spawnSync } from "node:child_process";
 //#region src/cli/rls-advisors.ts
@@ -2363,7 +2363,7 @@ async function migrate(input) {
 		output: generated.output
 	};
 	await requirePeer(() => import("pgsql-parser"), "pgsql-parser", "permdock rls migrate", input.cwd);
-	const { migrateTarget, runRlsMigrate } = await import("./rls-migrate-7wikfrVI.js");
+	const { migrateTarget, runRlsMigrate } = await import("./rls-migrate-CN4TlJTO.js");
 	return runRlsMigrate({
 		cwd: input.cwd,
 		sql: input.sql,
@@ -2471,7 +2471,7 @@ async function runRls(input) {
 		}
 		case "import": {
 			await requirePeer(() => import("pgsql-parser"), "pgsql-parser", "permdock rls import", input.cwd);
-			const { runRlsImport } = await import("./rls-import-D8F7j35Q.js");
+			const { runRlsImport } = await import("./rls-import-4lLW_pbb.js");
 			return runRlsImport({
 				cwd: input.cwd,
 				config: input.config,