permdock 0.3.0 → 0.3.1

package/dist/{arazzo-CKwwqFWz.js → arazzo-C9chp3ST.js}

@@ -1,4 +1,4 @@
-import { a as listArg, i as globalArgs, s as stringArg, t as COMMAND_DESCRIPTIONS } from "./commands-DSxCqG9A.js";
+import { a as listArg, i as globalArgs, s as stringArg, t as COMMAND_DESCRIPTIONS } from "./commands-BeaGNj_o.js";
 import { defineCommand } from "citty";
 //#region src/cli/commands/arazzo.ts
 function arazzo(ctx) {

package/dist/{catalog-dFZdWCGN.js → catalog-CYj-mX2O.js}

@@ -1,4 +1,4 @@
-import { a as listArg, i as globalArgs, s as stringArg, t as COMMAND_DESCRIPTIONS } from "./commands-DSxCqG9A.js";
+import { a as listArg, i as globalArgs, s as stringArg, t as COMMAND_DESCRIPTIONS } from "./commands-BeaGNj_o.js";
 import { defineCommand } from "citty";
 //#region src/cli/commands/catalog.ts
 function catalog(ctx) {

package/dist/cli/bin.js

@@ -1,5 +1,5 @@
 #!/usr/bin/env node
-import { t as run } from "../run-DKDbM4Du.js";
+import { t as run } from "../run-BWc9qqvE.js";
 import { n as streamHasColors } from "../style-CTm1AXDT.js";
 //#region src/cli/bin.ts
 const result = await run(process.argv.slice(2), {

package/dist/cli/index.js

@@ -1,5 +1,5 @@
 import { t as catalogPath } from "../catalog-path-CnI0XTFK.js";
 import { t as defineConfig } from "../config-BJiM-xAm.js";
 import { o as parseGrantsMarker, s as parseHookMarker } from "../markers-B0hYLvMD.js";
-import { t as run } from "../run-DKDbM4Du.js";
+import { t as run } from "../run-BWc9qqvE.js";
 export { catalogPath, defineConfig, parseGrantsMarker, parseHookMarker, run };

package/dist/{cloud-CB_ELYuX.js → cloud-CfwZ39Rl.js}

@@ -1,4 +1,4 @@
-import { i as globalArgs, s as stringArg, t as COMMAND_DESCRIPTIONS } from "./commands-DSxCqG9A.js";
+import { i as globalArgs, s as stringArg, t as COMMAND_DESCRIPTIONS } from "./commands-BeaGNj_o.js";
 import { defineCommand } from "citty";
 //#region src/cli/commands/cloud.ts
 function cloud(ctx) {

package/dist/{collect-DClJsheJ.js → collect-CHB22Sx4.js}

@@ -1,5 +1,5 @@
 import { i as describeError } from "./errors-CWfoNg9N.js";
-import { a as listArg, i as globalArgs, s as stringArg, t as COMMAND_DESCRIPTIONS } from "./commands-DSxCqG9A.js";
+import { a as listArg, i as globalArgs, s as stringArg, t as COMMAND_DESCRIPTIONS } from "./commands-BeaGNj_o.js";
 import { defineCommand } from "citty";
 //#region src/cli/commands/collect.ts
 function collect(ctx) {

package/dist/{commands-DSxCqG9A.js → commands-BeaGNj_o.js}

@@ -76,19 +76,19 @@ const COMMAND_DESCRIPTIONS = {
 };
 /** Every top-level command, loaded only when it runs or its own `--help` is asked for. */
 const commands = {
-	collect: async () => (await import("./collect-DClJsheJ.js")).collect,
-	catalog: async () => (await import("./catalog-dFZdWCGN.js")).catalog,
-	diff: async () => (await import("./diff-DBIhz_f2.js")).diff,
-	usage: async () => (await import("./usage-GTixvDDU.js")).usage,
-	doctor: async () => (await import("./doctor-BwCAMLx_.js")).doctor,
-	config: async () => (await import("./config-Dnszbv-6.js")).config,
-	skills: async () => (await import("./skills-Bx-U0irG.js")).skills,
-	openapi: async () => (await import("./openapi-l0xYHkcv.js")).openapi,
-	rls: async () => (await import("./rls-B4ur8nKQ.js")).rls,
-	arazzo: async () => (await import("./arazzo-CKwwqFWz.js")).arazzo,
-	cloud: async () => (await import("./cloud-CB_ELYuX.js")).cloud,
-	supabase: async () => (await import("./supabase-Boqb9a_Y.js")).supabase,
-	powersync: async () => (await import("./powersync-DliZK_-y.js")).powersync
+	collect: async () => (await import("./collect-CHB22Sx4.js")).collect,
+	catalog: async () => (await import("./catalog-CYj-mX2O.js")).catalog,
+	diff: async () => (await import("./diff-C9RDjjhs.js")).diff,
+	usage: async () => (await import("./usage-B0YuTQRO.js")).usage,
+	doctor: async () => (await import("./doctor-Djh6JDEk.js")).doctor,
+	config: async () => (await import("./config-ir40y8m0.js")).config,
+	skills: async () => (await import("./skills-C5CbhhpG.js")).skills,
+	openapi: async () => (await import("./openapi-CQTsgKoB.js")).openapi,
+	rls: async () => (await import("./rls-P-BeBx0n.js")).rls,
+	arazzo: async () => (await import("./arazzo-C9chp3ST.js")).arazzo,
+	cloud: async () => (await import("./cloud-CfwZ39Rl.js")).cloud,
+	supabase: async () => (await import("./supabase-s4o9s1O1.js")).supabase,
+	powersync: async () => (await import("./powersync-DE19b9dT.js")).powersync
 };
 function isCommand(name) {
 	return Object.hasOwn(commands, name);

package/dist/{config-Dnszbv-6.js → config-ir40y8m0.js}

@@ -1,4 +1,4 @@
-import { i as globalArgs, t as COMMAND_DESCRIPTIONS } from "./commands-DSxCqG9A.js";
+import { i as globalArgs, t as COMMAND_DESCRIPTIONS } from "./commands-BeaGNj_o.js";
 import { defineCommand } from "citty";
 //#region src/cli/commands/config.ts
 function config(ctx) {
@@ -19,7 +19,7 @@ function config(ctx) {
 			}
 		},
 		async run({ args: parsed }) {
-			const { runConfig } = await import("./config-report-DMvWKUxL.js");
+			const { runConfig } = await import("./config-report-CdCgbRnV.js");
 			ctx.report(runConfig({
 				cwd: ctx.cwd,
 				config: ctx.config,

package/dist/{config-report-DMvWKUxL.js → config-report-CdCgbRnV.js}

@@ -3,8 +3,8 @@ import { t as catalogPath } from "./catalog-path-CnI0XTFK.js";
 import { i as rel, t as defaultSrcPath } from "./files-DWUN9PzI.js";
 import { n as guessPermissions, t as barrelFile } from "./collect-DSTE3ml9.js";
 import "./sources-4p0-4xQm.js";
-import { r as MIGRATION_DIRS } from "./supabase-config-BpPXt3x1.js";
-import { t as DEFAULT_SENSITIVE_ACTIONS } from "./doctor-collect-CHk6XWOA.js";
+import { r as MIGRATION_DIRS } from "./supabase-config-Bj3iDH2I.js";
+import { t as DEFAULT_SENSITIVE_ACTIONS } from "./doctor-collect-CjdO0wQX.js";
 //#region src/cli/config-report.ts
 function configReport(input) {
 	const { cwd, config } = input;

package/dist/{diff-DBIhz_f2.js → diff-C9RDjjhs.js}

@@ -1,4 +1,4 @@
-import { i as globalArgs, s as stringArg, t as COMMAND_DESCRIPTIONS } from "./commands-DSxCqG9A.js";
+import { i as globalArgs, s as stringArg, t as COMMAND_DESCRIPTIONS } from "./commands-BeaGNj_o.js";
 import { defineCommand } from "citty";
 //#region src/cli/commands/diff.ts
 function diff(ctx) {

package/dist/{doctor-BwCAMLx_.js → doctor-Djh6JDEk.js}

@@ -1,4 +1,4 @@
-import { a as listArg, i as globalArgs, t as COMMAND_DESCRIPTIONS } from "./commands-DSxCqG9A.js";
+import { a as listArg, i as globalArgs, t as COMMAND_DESCRIPTIONS } from "./commands-BeaGNj_o.js";
 import { n as ask, t as CANCELLED } from "./prompt-CXYhLfsS.js";
 import { defineCommand } from "citty";
 //#region src/cli/commands/doctor.ts
@@ -34,7 +34,7 @@ function doctor(ctx) {
 				}
 				fix = answer;
 			}
-			const result = await (await import("./doctor-igIiM_Hl.js")).runDoctor({
+			const result = await (await import("./doctor-DvH0IQff.js")).runDoctor({
 				cwd: ctx.cwd,
 				config: ctx.config,
 				only: listArg(rawArgs, "only"),

package/dist/{doctor-igIiM_Hl.js → doctor-DvH0IQff.js}

@@ -12,14 +12,14 @@ import { d as keptKeys, r as PERMDOCK_SCHEMA } from "./sources-4p0-4xQm.js";
 import "./markers-B0hYLvMD.js";
 import { t as createStyle } from "./style-CTm1AXDT.js";
 import { i as runSkillsInstall } from "./skills-Biq5uup3.js";
-import { a as pd006, c as pd022, d as group, h as tableKey, i as pd005, l as pd028, n as supabaseConfig, o as pd009, p as sqlStatements, r as MIGRATION_DIRS, s as pd012, t as pd045, u as pd040 } from "./supabase-config-BpPXt3x1.js";
-import { m as compileGrants } from "./rls-fields-74oZPXWL.js";
+import { a as pd006, c as pd022, d as group, h as tableKey, i as pd005, l as pd028, n as supabaseConfig, o as pd009, p as sqlStatements, r as MIGRATION_DIRS, s as pd012, t as pd045, u as pd040 } from "./supabase-config-Bj3iDH2I.js";
+import { m as compileGrants } from "./rls-fields-CZOMlwHl.js";
 import { a as pd010, c as pd014, d as pd038, f as pd041, i as pd008, l as pd015, n as pd001, o as pd011, p as pd057, r as pd007, s as pd013, u as pd036 } from "./usage-ItS7nLcl.js";
-import { C as pd035, E as policyOf, S as pd034, T as pd055, _ as pd029, a as pd004, b as pd032, c as pd018, d as pd021, f as pd023, g as pd027, h as pd026, i as pd003, l as pd019, m as pd025, n as collectedOf, o as pd016, p as pd024, r as pd002, s as pd017, u as pd020, v as pd030, w as pd037, x as pd033, y as pd031 } from "./doctor-collect-CHk6XWOA.js";
-import { a as ownershipRules, i as guardedTables } from "./rls-ownership-RuFqaqGz.js";
-import { a as supabaseHookManifest, c as attrsPlan, h as partPath, n as hookOut, s as pd039 } from "./supabase-hook-CSLQ4zJ3.js";
-import { r as staleFiles, t as powersyncFiles } from "./powersync-BylawD_U.js";
-import { t as supautilsRejections } from "./supautils-Cn4R4cJ4.js";
+import { C as pd035, E as policyOf, S as pd034, T as pd055, _ as pd029, a as pd004, b as pd032, c as pd018, d as pd021, f as pd023, g as pd027, h as pd026, i as pd003, l as pd019, m as pd025, n as collectedOf, o as pd016, p as pd024, r as pd002, s as pd017, u as pd020, v as pd030, w as pd037, x as pd033, y as pd031 } from "./doctor-collect-CjdO0wQX.js";
+import { a as ownershipRules, i as guardedTables } from "./rls-ownership-DcYlZ09B.js";
+import { a as supabaseHookManifest, c as attrsPlan, h as partPath, n as hookOut, s as pd039 } from "./supabase-hook-ntETYCQu.js";
+import { r as staleFiles, t as powersyncFiles } from "./powersync-Dv1_aWF7.js";
+import { t as supautilsRejections } from "./supautils-u8jXTGrt.js";
 import { existsSync, readFileSync } from "node:fs";
 import { join, resolve } from "node:path";
 //#region src/cli/doctor-assignments.ts

package/dist/{doctor-collect-CHk6XWOA.js → doctor-collect-CjdO0wQX.js}

@@ -10,9 +10,9 @@ import { a as loadModule, n as asPolicy, o as pickNamed } from "./load-DhWEB9P1.
 import { r as runCollect } from "./collect-DSTE3ml9.js";
 import { i as quoteSqlLiteral } from "./sql-xdg5f4Fi.js";
 import "./sources-4p0-4xQm.js";
-import { n as supabaseConfig, r as MIGRATION_DIRS } from "./supabase-config-BpPXt3x1.js";
+import { n as supabaseConfig, r as MIGRATION_DIRS } from "./supabase-config-Bj3iDH2I.js";
 import { T as graphSqlName } from "./rls-shared-Cewd_-zI.js";
-import { W as contextRefs, h as tableFor, p as commandFor } from "./rls-fields-74oZPXWL.js";
+import { W as contextRefs, h as tableFor, p as commandFor } from "./rls-fields-CZOMlwHl.js";
 import { d as rowConditionMessage, l as helperTablePolicies, n as graphPlan, o as ROW_CONDITION_FIX } from "./rls-graph-CHwx0V8q.js";
 import { t as runUsage } from "./usage-ItS7nLcl.js";
 import { existsSync, readFileSync } from "node:fs";

package/dist/{openapi-l0xYHkcv.js → openapi-CQTsgKoB.js}

@@ -1,4 +1,4 @@
-import { a as listArg, i as globalArgs, s as stringArg, t as COMMAND_DESCRIPTIONS } from "./commands-DSxCqG9A.js";
+import { a as listArg, i as globalArgs, s as stringArg, t as COMMAND_DESCRIPTIONS } from "./commands-BeaGNj_o.js";
 import { defineCommand } from "citty";
 //#region src/cli/commands/openapi.ts
 function openapi(ctx) {

package/dist/powersync-CrBX8hY6.js

@@ -0,0 +1,2 @@
+import { n as runPowerSync } from "./powersync-Dv1_aWF7.js";
+export { runPowerSync };

package/dist/{powersync-DliZK_-y.js → powersync-DE19b9dT.js}

@@ -1,4 +1,4 @@
-import { i as globalArgs, s as stringArg, t as COMMAND_DESCRIPTIONS } from "./commands-DSxCqG9A.js";
+import { i as globalArgs, s as stringArg, t as COMMAND_DESCRIPTIONS } from "./commands-BeaGNj_o.js";
 import { defineCommand } from "citty";
 //#region src/cli/commands/powersync.ts
 function powersync(ctx) {
@@ -44,7 +44,7 @@ function powersync(ctx) {
 			const db = stringArg(parsed.db);
 			const fixtures = stringArg(parsed.fixtures);
 			const from = stringArg(parsed.from);
-			const { runPowerSync } = await import("./powersync-e_AZrKbg.js");
+			const { runPowerSync } = await import("./powersync-CrBX8hY6.js");
 			ctx.report(await runPowerSync({
 				cwd: ctx.cwd,
 				config: ctx.config,

package/dist/{powersync-BylawD_U.js → powersync-Dv1_aWF7.js}

@@ -10,10 +10,10 @@ import { i as scopeMembershipTable, r as scopeColumn } from "./compile-Ba4blROR.
 import { i as quoteSqlLiteral, t as SQL_IDENT } from "./sql-xdg5f4Fi.js";
 import "./sources-4p0-4xQm.js";
 import { G as quoteIdent, t as CUSTOM_ROLES } from "./rls-shared-Cewd_-zI.js";
-import { H as collectGrants, W as contextRefs, h as tableFor, w as connectPg } from "./rls-fields-74oZPXWL.js";
+import { H as collectGrants, W as contextRefs, h as tableFor, w as connectPg } from "./rls-fields-CZOMlwHl.js";
 import { n as fixtureSubject, r as loadFixtures, t as fixtureRow } from "./fixtures-ht28Cplr.js";
-import { a as ownershipRules } from "./rls-ownership-RuFqaqGz.js";
-import { t as canFixture } from "./rls-verify-CVQTHTh5.js";
+import { a as ownershipRules } from "./rls-ownership-DcYlZ09B.js";
+import { t as canFixture } from "./rls-verify-CMv9H3wV.js";
 import { existsSync, readFileSync, writeFileSync } from "node:fs";
 import { resolve } from "node:path";
 //#region src/cli/powersync-streams.ts

package/dist/{rls-DQtdgTHB.js → rls-DiinlRML.js}

@@ -11,14 +11,14 @@ import { n as escapeSqlIdent } from "./sql-xdg5f4Fi.js";
 import "./sources-4p0-4xQm.js";
 import { i as SEEDS_MARKER, r as INDEXES_MARKER, t as GRANTS_MARKER } from "./markers-B0hYLvMD.js";
 import { n as requirePeer } from "./peer-BOr_kJE1.js";
-import { f as splitUndiffed, n as supabaseConfig } from "./supabase-config-BpPXt3x1.js";
+import { f as splitUndiffed, n as supabaseConfig } from "./supabase-config-Bj3iDH2I.js";
 import { $ as sessionLiveHelperSql, G as quoteIdent$1, K as quoteLiteral, Q as scopeTypeOf, R as memberIdsHelper, T as graphSqlName, U as permittedIdsHelper, V as parseMembershipsFlag, W as qualifiedTable$1, X as scopeSources, Z as scopeTable, f as SESSION_LIVE_HELPER, o as qualified$1, q as quoteTable, r as HELPERS, rt as subjectIdSql, tt as subjectClaimJsonSql, w as graphHelper, y as checkSuspension } from "./rls-shared-Cewd_-zI.js";
-import { A as helpersSql, B as breakGlassHolder, C as readTableIndexFacts, E as accessSql, F as seedSql, H as collectGrants, S as pruneIndexTargets, T as connectPgPool, U as roleNames, V as breakGlassKey, a as fieldViewsSql, b as indexTargets, c as assemblePolicies, d as readOnlyActorPolicies, f as branchClauses, g as permissionHelpersSql, h as tableFor, i as fieldViews, l as orSql, m as compileGrants, n as columnGrantSql, o as rowBranches, q as apiKeysPlan, r as columnRevokeSql, u as readOnlyActorKinds, v as permittedByPermissionHelper, x as indexesSql, y as COLUMNS_SQL } from "./rls-fields-74oZPXWL.js";
+import { A as helpersSql, B as breakGlassHolder, C as readTableIndexFacts, E as accessSql, F as seedSql, H as collectGrants, S as pruneIndexTargets, T as connectPgPool, U as roleNames, V as breakGlassKey, a as fieldViewsSql, b as indexTargets, c as assemblePolicies, d as readOnlyActorPolicies, f as branchClauses, g as permissionHelpersSql, h as tableFor, i as fieldViews, l as orSql, m as compileGrants, n as columnGrantSql, o as rowBranches, q as apiKeysPlan, r as columnRevokeSql, u as readOnlyActorKinds, v as permittedByPermissionHelper, x as indexesSql, y as COLUMNS_SQL } from "./rls-fields-CZOMlwHl.js";
 import { c as helperCallKeys, i as HELPER_TABLES, n as graphPlan, r as graphSql, s as callsHelper, t as closureDepths } from "./rls-graph-CHwx0V8q.js";
-import { a as ownershipRules, o as ownershipSql, r as assignmentSql } from "./rls-ownership-RuFqaqGz.js";
-import { _ as seedsMigration, d as resolveAuthorize, f as driftOf, g as pgDeltaPath, h as partPath, l as parseRbacAuthorize, m as parseSplit, o as supabaseHookSql, p as isSeedsDirectory, t as grantsLabel, u as rbacScaffold, v as writeSqlFiles } from "./supabase-hook-CSLQ4zJ3.js";
-import { n as runRlsVerify } from "./rls-verify-CVQTHTh5.js";
-import { t as supautilsRejections } from "./supautils-Cn4R4cJ4.js";
+import { a as ownershipRules, o as ownershipSql, r as assignmentSql } from "./rls-ownership-DcYlZ09B.js";
+import { _ as seedsMigration, d as resolveAuthorize, f as driftOf, g as pgDeltaPath, h as partPath, l as parseRbacAuthorize, m as parseSplit, o as supabaseHookSql, p as isSeedsDirectory, t as grantsLabel, u as rbacScaffold, v as writeSqlFiles } from "./supabase-hook-ntETYCQu.js";
+import { n as runRlsVerify } from "./rls-verify-CMv9H3wV.js";
+import { t as supautilsRejections } from "./supautils-u8jXTGrt.js";
 import { basename, delimiter, join, resolve } from "node:path";
 import { spawnSync } from "node:child_process";
 //#region src/cli/rls-advisors.ts
@@ -2471,7 +2471,7 @@ async function runRls(input) {
 		}
 		case "import": {
 			await requirePeer(() => import("pgsql-parser"), "pgsql-parser", "permdock rls import", input.cwd);
-			const { runRlsImport } = await import("./rls-import-BTFVk3jH.js");
+			const { runRlsImport } = await import("./rls-import-4lLW_pbb.js");
 			return runRlsImport({
 				cwd: input.cwd,
 				config: input.config,

package/dist/{rls-B4ur8nKQ.js → rls-P-BeBx0n.js}

@@ -1,4 +1,4 @@
-import { i as globalArgs, s as stringArg, t as COMMAND_DESCRIPTIONS } from "./commands-DSxCqG9A.js";
+import { i as globalArgs, s as stringArg, t as COMMAND_DESCRIPTIONS } from "./commands-BeaGNj_o.js";
 import { defineCommand } from "citty";
 //#region src/cli/commands/rls.ts
 function rls(ctx) {
@@ -189,7 +189,7 @@ function rls(ctx) {
 			}
 		},
 		async run({ args: parsed }) {
-			const result = await (await import("./rls-DQtdgTHB.js")).runRls({
+			const result = await (await import("./rls-DiinlRML.js")).runRls({
 				cwd: ctx.cwd,
 				config: ctx.config,
 				rest: parsed._,

package/dist/{rls-fields-74oZPXWL.js → rls-fields-CZOMlwHl.js}

@@ -610,8 +610,12 @@ function roleNames(policy) {
 function qualify(name, schema) {
 	return name.includes(".") ? name : `${schema}.${name}`;
 }
+function throughTenant(through, roles) {
+	if (through === void 0 || roles?.tenant === void 0) return;
+	return qualify(roles.table, "public") === through.table ? roles.tenant : void 0;
+}
 /** Resolves `source` against `schema`, aliasing the table `alias` and the roles table `<alias>k`. */
-function globalRoleSource(source, schema, alias) {
+function globalRoleSource(source, schema, alias, roles) {
 	const table = qualify(source.table, schema);
 	const user = source.user ?? "user_id";
 	const role = roleColumn(source.role ?? "role", table, alias, {
@@ -619,14 +623,17 @@ function globalRoleSource(source, schema, alias) {
 		prefix: "PermDock CLI",
 		indent: "    "
 	});
+	const tenant = role.lateral ? void 0 : throughTenant(role.through, roles);
+	const global = tenant === void 0 ? "" : ` and ${alias}k.${quoteIdent(tenant)} is null`;
 	return {
 		table,
 		user,
-		from: `${quoteTable(table)} ${alias}${role.join}`,
+		from: `${quoteTable(table)} ${alias}${role.join}${global}`,
 		userSql: `${alias}.${quoteIdent(user)}`,
 		roleSql: role.sql,
 		role: roleManifest(role),
-		...role.through === void 0 ? {} : { through: role.through }
+		...role.through === void 0 ? {} : { through: role.through },
+		...tenant === void 0 ? {} : { tenant }
 	};
 }
 //#endregion
@@ -1484,7 +1491,7 @@ function qualifiedName(name) {
 */
 function globalRolesSql(ctx) {
 	if (ctx.roles === void 0) return "";
-	const source = globalRoleSource(ctx.roles, "public", "t");
+	const source = globalRoleSource(ctx.roles, "public", "t", ctx.customRoles?.table);
 	const table = quoteTable(qualifiedName(ctx.roles.table));
 	const user = quoteIdent(source.user);
 	const fn = qualified$1(ctx, GLOBAL_ROLES.replace);
@@ -1509,9 +1516,10 @@ function globalRolesSql(ctx) {
 		const id = quoteIdent(through.id);
 		const key = quoteIdent(through.key);
 		const ref = quoteIdent(through.ref);
+		const global = source.tenant === void 0 ? "" : ` and k.${quoteIdent(source.tenant)} is null`;
 		body = `  select string_agg(w.r, ', ' order by w.r) into v_unknown
   from (${wanted}) w(r)
-  where not exists (select 1 from ${keys} k where k.${key}::text = w.r);
+  where not exists (select 1 from ${keys} k where k.${key}::text = w.r${global});
   if v_unknown is not null then
     raise exception using
       errcode = '22023',
@@ -1523,12 +1531,12 @@ function globalRolesSql(ctx) {
     and not exists (
       select 1 from ${keys} k
       where k.${id} = t.${ref}
-        and k.${key}::text = any(coalesce(p_roles, '{}'::text[]))
+        and k.${key}::text = any(coalesce(p_roles, '{}'::text[]))${global}
     );
   insert into ${table} (${user}, ${ref})
   select p_user, k.${id}
   from ${keys} k
-  where k.${key}::text in (${wanted})
+  where k.${key}::text in (${wanted})${global}
     and not exists (
       select 1 from ${table} t where t.${user} = p_user and t.${ref} = k.${id}
     );`;
@@ -1694,7 +1702,7 @@ function globalRoleRows(ctx) {
 		from: `${qualified$1(ctx, "user_roles")} ur`,
 		userSql: "ur.user_id",
 		roleSql: "ur.role::text"
-	} : globalRoleSource(ctx.roles, "public", "ur");
+	} : globalRoleSource(ctx.roles, "public", "ur", ctx.customRoles?.table);
 }
 function customKeysJoin(ctx, scope, allows, denies, includes) {
 	return `  cross join lateral ${qualified$1(ctx, CUSTOM_ROLES.keys)}(

package/dist/{rls-import-BTFVk3jH.js → rls-import-4lLW_pbb.js}

@@ -1,7 +1,7 @@
 import { o as usageResult } from "./errors-CWfoNg9N.js";
 import { i as quoteSqlLiteral, n as escapeSqlIdent } from "./sql-xdg5f4Fi.js";
 import { V as parseMembershipsFlag, r as HELPERS } from "./rls-shared-Cewd_-zI.js";
-import { t as FIELD_VIEWS, w as connectPg } from "./rls-fields-74oZPXWL.js";
+import { t as FIELD_VIEWS, w as connectPg } from "./rls-fields-CZOMlwHl.js";
 import { n as emptySchema, r as isSchemaKind, t as emitPermissionsModule } from "./generate-CH7ThJ14.js";
 import { existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
 import { dirname, resolve } from "node:path";

package/dist/{rls-ownership-RuFqaqGz.js → rls-ownership-DcYlZ09B.js}

@@ -2,7 +2,7 @@ import { l as scopeChain, o as resolveScope } from "./scopes-CVdPrWN-.js";
 import { S as findRole } from "./grantee-Cv5Sogfv.js";
 import { l as roleColumn } from "./sources-4p0-4xQm.js";
 import { B as memberVia, G as quoteIdent, I as memberForSources, K as quoteLiteral, L as memberForTable, M as kindFilterSql, S as globalKindFilterSql, W as qualifiedTable, X as scopeSources, Y as roleKindSql, Z as scopeTable, at as tenantTypeOf, c as signedIn, o as qualified, q as quoteTable, rt as subjectIdSql, t as CUSTOM_ROLES, z as memberRoleOf } from "./rls-shared-Cewd_-zI.js";
-import { D as claimKeptLines, I as sourceFilters, L as sourcesKeep, M as membershipRows, N as membershipTable, O as disabledColumn, P as roleRows, R as hasCustomRoleChecksFor, j as memberColumn, k as globalRoleRows } from "./rls-fields-74oZPXWL.js";
+import { D as claimKeptLines, I as sourceFilters, L as sourcesKeep, M as membershipRows, N as membershipTable, O as disabledColumn, P as roleRows, R as hasCustomRoleChecksFor, j as memberColumn, k as globalRoleRows } from "./rls-fields-CZOMlwHl.js";
 //#region src/cli/rls-ownership.ts
 /** Objects the ownership rules add next to the helpers. Names are part of the SQL contract. */
 const OWNERSHIP = {

package/dist/{rls-verify-CVQTHTh5.js → rls-verify-CMv9H3wV.js}

@@ -11,7 +11,7 @@ import { a as loadModule, n as asPolicy, o as pickNamed } from "./load-DhWEB9P1.
 import "./budget-NbEtbJC_.js";
 import "./sources-4p0-4xQm.js";
 import { G as quoteIdent, K as quoteLiteral, b as columnTypesOf, q as quoteTable } from "./rls-shared-Cewd_-zI.js";
-import { p as commandFor, s as viewName, t as FIELD_VIEWS, w as connectPg } from "./rls-fields-74oZPXWL.js";
+import { p as commandFor, s as viewName, t as FIELD_VIEWS, w as connectPg } from "./rls-fields-CZOMlwHl.js";
 import { a as HELPER_TABLE_POLICIES_SQL, d as rowConditionMessage, n as graphPlan, u as helperTablePoliciesFromRows } from "./rls-graph-CHwx0V8q.js";
 import { n as fixtureSubject, r as loadFixtures, t as fixtureRow } from "./fixtures-ht28Cplr.js";
 import { resolve } from "node:path";

package/dist/{run-DKDbM4Du.js → run-BWc9qqvE.js}

@@ -1,7 +1,7 @@
 import { a as exitCodeOf, i as describeError, n as cliErrorKind, r as cliProblem } from "./errors-CWfoNg9N.js";
 import { o as cliVersion } from "./version-BvacVTZR.js";
 import { a as resolveCwd, i as readConfig } from "./config-BJiM-xAm.js";
-import { i as globalArgs, n as commands, o as resolveArgs, r as isCommand, s as stringArg, t as COMMAND_DESCRIPTIONS } from "./commands-DSxCqG9A.js";
+import { i as globalArgs, n as commands, o as resolveArgs, r as isCommand, s as stringArg, t as COMMAND_DESCRIPTIONS } from "./commands-BeaGNj_o.js";
 import { stripVTControlCharacters } from "node:util";
 import { defineCommand, parseArgs, renderUsage, runCommand } from "citty";
 //#region src/cli/run.ts

package/dist/{skills-Bx-U0irG.js → skills-C5CbhhpG.js}

@@ -1,4 +1,4 @@
-import { a as listArg, i as globalArgs, t as COMMAND_DESCRIPTIONS } from "./commands-DSxCqG9A.js";
+import { a as listArg, i as globalArgs, t as COMMAND_DESCRIPTIONS } from "./commands-BeaGNj_o.js";
 import { r as pick, t as CANCELLED } from "./prompt-CXYhLfsS.js";
 import { n as detectedAgents, r as runSkills, t as SKILL_AGENTS } from "./skills-Biq5uup3.js";
 import { defineCommand } from "citty";

package/dist/{supabase-config-BpPXt3x1.js → supabase-config-Bj3iDH2I.js}

@@ -1,6 +1,6 @@
 import { i as describeError } from "./errors-CWfoNg9N.js";
 import { a as sqlFiles, i as rel } from "./files-DWUN9PzI.js";
-import { t as FIELD_VIEWS } from "./rls-fields-74oZPXWL.js";
+import { t as FIELD_VIEWS } from "./rls-fields-CZOMlwHl.js";
 import { existsSync, readFileSync, readdirSync, statSync } from "node:fs";
 import { dirname, join, posix, resolve } from "node:path";
 import { createRequire } from "node:module";

package/dist/supabase-hook-gd3s8bxB.js

@@ -0,0 +1,2 @@
+import { i as runSupabase } from "./supabase-hook-ntETYCQu.js";
+export { runSupabase };

package/dist/{supabase-hook-CSLQ4zJ3.js → supabase-hook-ntETYCQu.js}

@@ -10,10 +10,10 @@ import "./budget-NbEtbJC_.js";
 import { c as hookApiNames, d as keptKeys, t as AUTHZ_VERSION_TABLE, u as roleManifest } from "./sources-4p0-4xQm.js";
 import { i as readMemberships } from "./manifest-iaoBXHKc.js";
 import { a as hookMarkerFields, n as HOOK_MARKER, t as GRANTS_MARKER } from "./markers-B0hYLvMD.js";
-import { f as splitUndiffed, h as tableKey, m as decidingColumns, n as supabaseConfig, r as MIGRATION_DIRS } from "./supabase-config-BpPXt3x1.js";
+import { f as splitUndiffed, h as tableKey, m as decidingColumns, n as supabaseConfig, r as MIGRATION_DIRS } from "./supabase-config-Bj3iDH2I.js";
 import { D as hasMemberFor, F as memberForHelper, G as quoteIdent, H as permittedForHelper, I as memberForSources, K as quoteLiteral, L as memberForTable, Q as scopeTypeOf, R as memberIdsHelper, U as permittedIdsHelper, W as qualifiedTable, at as tenantTypeOf, g as activeRowSql, p as USER_ID_HELPER, q as quoteTable, r as HELPERS, y as checkSuspension, z as memberRoleOf } from "./rls-shared-Cewd_-zI.js";
-import { G as API_KEY_ALLOWS, K as apiKeyFields, U as roleNames, _ as permissionKeysForHelper, w as connectPg, z as globalRoleSource } from "./rls-fields-74oZPXWL.js";
-import { a as ownershipRules, i as guardedTables, n as OWNERSHIP, t as ASSIGNMENTS } from "./rls-ownership-RuFqaqGz.js";
+import { G as API_KEY_ALLOWS, K as apiKeyFields, U as roleNames, _ as permissionKeysForHelper, w as connectPg, z as globalRoleSource } from "./rls-fields-CZOMlwHl.js";
+import { a as ownershipRules, i as guardedTables, n as OWNERSHIP, t as ASSIGNMENTS } from "./rls-ownership-DcYlZ09B.js";
 import { existsSync, mkdirSync, readFileSync, readdirSync, statSync, writeFileSync } from "node:fs";
 import { dirname, join, resolve } from "node:path";
 /** `--check`: one entry per file that is missing or differs, naming its part; a differing file carries a short diff. */
@@ -1310,7 +1310,7 @@ function hookParts(scopes, config, overrides) {
 		tenantClaim,
 		users: suspension?.users,
 		hook,
-		roles: hook.roles === false ? void 0 : globalRoleSource(hook.roles ?? config.rls?.roles ?? { table: `${schema}.user_roles` }, "public", "r"),
+		roles: hook.roles === false ? void 0 : globalRoleSource(hook.roles ?? config.rls?.roles ?? { table: `${schema}.user_roles` }, "public", "r", config.rls?.customRoleWrites?.roles),
 		active: activeFromSql(overrides.activeFrom ?? hook.activeFrom, root),
 		attrs: hook.attrs === void 0 ? void 0 : attrsPlan(hook.attrs),
 		extra: extraPlan.claims,

package/dist/{supabase-Boqb9a_Y.js → supabase-s4o9s1O1.js}

@@ -1,4 +1,4 @@
-import { i as globalArgs, s as stringArg, t as COMMAND_DESCRIPTIONS } from "./commands-DSxCqG9A.js";
+import { i as globalArgs, s as stringArg, t as COMMAND_DESCRIPTIONS } from "./commands-BeaGNj_o.js";
 import { defineCommand } from "citty";
 //#region src/cli/commands/supabase.ts
 function supabase(ctx) {
@@ -61,7 +61,7 @@ function supabase(ctx) {
 			const budget = stringArg(parsed.budget);
 			const schema = stringArg(parsed.schema);
 			const grantsOut = stringArg(parsed["grants-out"]);
-			const { runSupabase } = await import("./supabase-hook-6sYLXg_u.js");
+			const { runSupabase } = await import("./supabase-hook-gd3s8bxB.js");
 			ctx.report(await runSupabase({
 				cwd: ctx.cwd,
 				config: ctx.config,

package/dist/{supautils-Cn4R4cJ4.js → supautils-u8jXTGrt.js}

@@ -1,4 +1,4 @@
-import { d as group, p as sqlStatements } from "./supabase-config-BpPXt3x1.js";
+import { d as group, p as sqlStatements } from "./supabase-config-Bj3iDH2I.js";
 //#region src/cli/supautils.ts
 /** `supautils.reserved_roles` of supabase/postgres 17.11.0.002 (supautils 3.4.4). */
 const RESERVED_ROLES = /* @__PURE__ */ new Set([

package/dist/{usage-GTixvDDU.js → usage-B0YuTQRO.js}

@@ -1,4 +1,4 @@
-import { a as listArg, i as globalArgs, t as COMMAND_DESCRIPTIONS } from "./commands-DSxCqG9A.js";
+import { a as listArg, i as globalArgs, t as COMMAND_DESCRIPTIONS } from "./commands-BeaGNj_o.js";
 import { defineCommand } from "citty";
 //#region src/cli/commands/usage.ts
 function usage(ctx) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "permdock",
-  "version": "0.3.0",
+  "version": "0.3.1",
   "description": "Typed permissions for TypeScript apps, APIs, databases, and AI agents, with the permdock CLI and test runners.",
   "keywords": [
     "ai-agents",

package/dist/powersync-e_AZrKbg.js

@@ -1,2 +0,0 @@
-import { n as runPowerSync } from "./powersync-BylawD_U.js";
-export { runPowerSync };

package/dist/supabase-hook-6sYLXg_u.js

@@ -1,2 +0,0 @@
-import { i as runSupabase } from "./supabase-hook-CSLQ4zJ3.js";
-export { runSupabase };