permdock 0.4.0 → 0.6.0

package/dist/react/index.js

@@ -1,7 +1,7 @@
 "use client";
-import { r as requiredPlans } from "../problem-details-DECUnXAn.js";
-import { t as describe } from "../describe-Cgkp7eP0.js";
-import { t as approvalHeaders } from "../headers-BZSDieNT.js";
-import { a as useDescribe, c as usePermDock, d as useRoles, f as useSubject, i as useAssignableRoles, l as usePermission, n as useApproval, o as useFilter, p as useTenant, r as useAssignablePermissions, s as useMemberships, t as Protected, u as usePermissions } from "../protected-BN7BUdY1.js";
-import { t as PermDockProvider } from "../provider-Bi-0HNL3.js";
-export { PermDockProvider, Protected, approvalHeaders, describe, requiredPlans, useApproval, useAssignablePermissions, useAssignableRoles, useDescribe, useFilter, useMemberships, usePermDock, usePermission, usePermissions, useRoles, useSubject, useTenant };
+import { r as requiredPlans } from "../problem-details-cn5X30gZ.js";
+import { t as describe } from "../describe-BybMRY7A.js";
+import { t as approvalHeaders } from "../headers-BIjfMaoC.js";
+import { a as useDescribe, c as useMemberships, d as usePermissions, f as useRoles, i as useAssignableRoles, l as usePermDock, m as useTenant, n as useApproval, o as useFilter, p as useSubject, r as useAssignablePermissions, s as useGate, t as Protected, u as usePermission } from "../protected-BlF0F6wL.js";
+import { t as PermDockProvider } from "../provider-B1al-AZz.js";
+export { PermDockProvider, Protected, approvalHeaders, describe, requiredPlans, useApproval, useAssignablePermissions, useAssignableRoles, useDescribe, useFilter, useGate, useMemberships, usePermDock, usePermission, usePermissions, useRoles, useSubject, useTenant };

package/dist/react/provider-client.d.ts

@@ -1,2 +1,2 @@
-import { t as PermDockProvider } from "../provider-kwHC9CZD.js";
+import { t as PermDockProvider } from "../provider-DILL9oPK.js";
 export { PermDockProvider };

package/dist/react/provider-client.js

@@ -1,3 +1,2 @@
 "use client";
-import { t as PermDockProvider } from "../provider-Bi-0HNL3.js";
-export { PermDockProvider };
+export { t as PermDockProvider } from "../provider-B1al-AZz.js";

package/dist/react-native/index.d.ts

@@ -1,13 +1,14 @@
-import { Dr as Membership, Sr as CustomRole, an as Snapshot, at as SnapshotSource, in as LocalSnapshotManifest, ut as TokenVerifier } from "../policy-types-sp9P1iIV.js";
-import { d as Permission } from "../permission-types-Dg39z9Kv.js";
-import { n as requiredPlans } from "../problem-details-rIIo8B2C.js";
-import { i as describe, n as DescribeMessages } from "../describe-C3ldA9os.js";
-import { t as parseLocalSnapshotManifest } from "../parse-local-manifest-DvYUR0QL.js";
-import { t as approvalHeaders } from "../headers-Cf-zWvsO.js";
-import { a as ClientPermDock, c as PermissionSet, d as SubjectView, f as TenantView, i as ApprovalState, l as PermissionState, n as ClientStoreOptions, o as ClientStatus, r as ApprovalHandle, s as FilterResult, t as ClientStore } from "../store-9KO4BlkB.js";
-import { r as ProtectedProps, t as PermDockDefaults } from "../types-DHrmBJLH.js";
-import { a as useDescribe, c as usePermDock, d as useRoles, f as useSubject, i as useAssignableRoles, l as usePermission, n as useApproval, o as useFilter, p as useTenant, r as useAssignablePermissions, s as useMemberships, t as Protected, u as usePermissions } from "../protected-B3_P7xuw.js";
-import { ReactElement, ReactNode } from "react";
+import { Bt as LocalSnapshotManifest, Rt as Instant, Vt as Snapshot, Zn as CustomRole, nr as Membership, ot as SnapshotSource } from "../policy-types-n0uRTsW8.js";
+import { w as Permission } from "../vocabulary-CN8H_9UF.js";
+import { n as requiredPlans } from "../problem-details-B45V5d2b.js";
+import { i as describe } from "../describe-B5qgDvEW.js";
+import { t as parseLocalSnapshotManifest } from "../parse-local-manifest-5ODwqu8b.js";
+import { t as approvalHeaders } from "../headers-CIbDTUTK.js";
+import { a as FilterResult, c as PermissionSet, f as SubjectView, i as ClientStatus, l as PermissionState, m as ClientStore, n as ApprovalState, o as GateMode, p as TenantView, r as ClientPermDock, s as GateView, t as ApprovalHandle } from "../types-B3_ooZgZ.js";
+import { r as ProtectedProps, t as PermDockDefaults } from "../types-CX7AvRqP.js";
+import { a as useDescribe, c as useMemberships, d as usePermissions, f as useRoles, i as useAssignableRoles, l as usePermDock, m as useTenant, n as useApproval, o as useFilter, p as useSubject, r as useAssignablePermissions, s as useGate, t as Protected, u as usePermission } from "../protected-RFGpakN9.js";
+import { a as SubscribeOnline, i as SubscribeForeground, n as ReactNativePermDockProviderProps, r as SnapshotStorage, t as NativeRevalidate } from "../types-C863OQiR.js";
+import { ReactElement } from "react";
 //#region src/react-native/guards.d.ts
 /** `true` once the provider has a snapshot to answer from: storage was read or a seed was given. Hide the splash screen on it. */
 export declare function useSnapshotReady(): boolean;
@@ -32,7 +33,7 @@ type LocalSnapshotData = {
     /** Attributes conditions read, such as `claims` for `principal.claims.team_ids`. */
     readonly attributes?: Readonly<Record<string, unknown>>;
   } | null;
-  /** The tenant's custom roles, in the shape a `RoleSource` returns. */
+  /** The tenant's custom roles, in the shape a `CustomRoleSource` returns. */
   readonly customRoles?: readonly CustomRole[];
 };
 type LocalSnapshotOptions = {
@@ -46,7 +47,7 @@ type LocalSnapshotOptions = {
  * The snapshot a server would send for `data`, built from the manifest. It
  * drives UI guards only: the server still decides every request.
  */
-export declare function buildLocalSnapshot(manifest: LocalSnapshotManifest, data: LocalSnapshotData, now?: number): Snapshot;
+export declare function buildLocalSnapshot(manifest: LocalSnapshotManifest, data: LocalSnapshotData, at?: Instant): Snapshot;
 /**
  * A snapshot source over the device's own membership rows (SQLite, a
  * PowerSync or Electric replica): offline, the UI guards answer from them.
@@ -54,7 +55,7 @@ export declare function buildLocalSnapshot(manifest: LocalSnapshotManifest, data
 export declare function localSnapshot(options: LocalSnapshotOptions): SnapshotSource;
 //#endregion
 //#region src/react-native/powersync.d.ts
-/** The `PowerSyncDatabase` methods `powersyncSource` calls. */
+/** The `PowerSyncDatabase` methods `powerSyncSource` calls. */
 type PowerSyncWatchable = {
   getAll(sql: string, parameters?: unknown[]): Promise<unknown[]>;
   watch(sql: string, parameters: unknown[] | undefined, handler: {
@@ -84,62 +85,13 @@ type PowerSyncSourceOptions<Q extends string> = {
  * takes the database as an argument; `permdock/react-native` never imports
  * `@powersync/*`.
  */
-export declare function powersyncSource<Q extends string>(db: PowerSyncWatchable, options: PowerSyncSourceOptions<Q>): SnapshotSource;
-//#endregion
-//#region src/react-native/types.d.ts
-type PermDockStorage = {
-  getItem(key: string): string | null | Promise<string | null>;
-  setItem(key: string, value: string): void | Promise<void>;
-  removeItem(key: string): void | Promise<void>;
-};
-type NativeRevalidate = "launch" | "focus" | number;
-/**
- * Calls `listener` when the app changes state; `active` is `false` when it
- * goes to the background. A listener called without an argument counts as
- * a return to the foreground.
- */
-type SubscribeForeground = (listener: (active?: boolean) => void) => () => void;
-/** Calls `listener` with `false` when the device loses connectivity and `true` when it returns. */
-type SubscribeOnline = (listener: (online: boolean) => void) => () => void;
-type NativePermDockProviderProps = {
-  readonly storage: PermDockStorage;
-  /**
-   * The signed-in principal's id, or `null` when nobody is signed in. Only a
-   * persisted snapshot for this id is read or written; `null` clears storage.
-   */
-  readonly subjectId: string | null;
-  readonly snapshot?: Snapshot | string;
-  readonly snapshotUrl?: string;
-  /** Hydrates from the device's own rows (`localSnapshot`); with `snapshotUrl` too, the latest answer wins. */
-  readonly source?: SnapshotSource;
-  readonly endpoint?: string;
-  readonly approvals?: string;
-  readonly tenant?: string;
-  readonly revalidate?: NativeRevalidate;
-  readonly subscribeForeground?: SubscribeForeground;
-  readonly subscribeOnline?: SubscribeOnline;
-  readonly fetch?: typeof fetch;
-  readonly headers?: Readonly<Record<string, string>>;
-  readonly maxAge?: number;
-  readonly verifier?: TokenVerifier;
-  /** What every `<Protected>` below renders for a slot it leaves out. */
-  readonly defaults?: PermDockDefaults;
-  /** Localised text for `useDescribe()`. */
-  readonly messages?: DescribeMessages;
-  /** Called with each snapshot the store accepts, after it is persisted. */
-  readonly onSnapshot?: NonNullable<ClientStoreOptions["onSnapshot"]>;
-  /** Called when the store drops its snapshot, after storage is cleared. */
-  readonly onClear?: () => void;
-  /** Milliseconds between approval status polls. Defaults to 2000. */
-  readonly approvalInterval?: number;
-  readonly children: ReactNode;
-};
+export declare function powerSyncSource<Q extends string>(db: PowerSyncWatchable, options: PowerSyncSourceOptions<Q>): SnapshotSource;
 //#endregion
 //#region src/react-native/provider.d.ts
-export declare function PermDockProvider(props: NativePermDockProviderProps): ReactElement;
+export declare function PermDockProvider(props: ReactNativePermDockProviderProps): ReactElement;
 //#endregion
 //#region src/react-native/storage.d.ts
-export declare function memoryStorage(initial?: Readonly<Record<string, string>>): PermDockStorage;
+export declare function memorySnapshotStorage(initial?: Readonly<Record<string, string>>): SnapshotStorage;
 //#endregion
 //#region src/react-native/storage-adapters.d.ts
 /** The `expo-secure-store` functions `secureStoreStorage` calls. */
@@ -158,13 +110,13 @@ type MmkvInstance = {
   delete(key: string): unknown;
 });
 /**
- * A `PermDockStorage` over `expo-secure-store`. Values are split into chunks
+ * A `SnapshotStorage` over `expo-secure-store`. Values are split into chunks
  * of at most 2048 bytes under `<key>.<n>`; `<key>` holds the chunk count and
  * is written last, so an interrupted write reads as absent.
  */
-export declare function secureStoreStorage(store: SecureStoreModule, options?: object): PermDockStorage;
-/** A synchronous `PermDockStorage` over a `react-native-mmkv` instance: the first frame already has the snapshot. */
-export declare function mmkvStorage(mmkv: MmkvInstance): PermDockStorage;
+export declare function secureStoreStorage(store: SecureStoreModule, options?: object): SnapshotStorage;
+/** A synchronous `SnapshotStorage` over a `react-native-mmkv` instance: the first frame already has the snapshot. */
+export declare function mmkvStorage(mmkv: MmkvInstance): SnapshotStorage;
 //#endregion
 //#region src/react-native/subscriptions.d.ts
 /** The `AppState` export of `react-native`, as `appStateForeground` calls it. */
@@ -190,7 +142,7 @@ export declare function appStateForeground(appState: AppStateModule): SubscribeF
 export declare function netInfoOnline(netInfo: NetInfoModule): SubscribeOnline;
 //#endregion
 //#region src/react-native/store.d.ts
-type NativeStoreOptions = Omit<NativePermDockProviderProps, "children" | "headers" | "defaults" | "messages"> & {
+type NativeStoreOptions = Omit<ReactNativePermDockProviderProps, "children" | "headers" | "defaults" | "messages"> & {
   readonly headers?: Readonly<Record<string, string>> | (() => Readonly<Record<string, string>> | undefined);
   /** A store this one replaces: its snapshot and tenant seed this store, so guards do not flip while it boots. */
   readonly previous?: ClientStore;
@@ -202,6 +154,6 @@ type NativeStoreOptions = Omit<NativePermDockProviderProps, "children" | "header
  * snapshot. Returns the unsubscribe.
  */
 export declare function connectSource(store: ClientStore, source: SnapshotSource, subscribeForeground?: SubscribeForeground): () => void;
-export declare function createNativeStore(options: NativeStoreOptions): ClientStore;
+export declare function nativeStore(options: NativeStoreOptions): ClientStore;
 //#endregion
-export { type AppStateModule, type ApprovalHandle, type ApprovalState, type ClientPermDock, type ClientStatus, type FilterResult, type LocalSnapshotData, type LocalSnapshotManifest, type LocalSnapshotOptions, type MmkvInstance, type NativePermDockProviderProps, type NativeRevalidate, type NetInfoModule, type PermDockDefaults, type PermDockStorage, type PermissionSet, type PermissionState, type PowerSyncQuery, type PowerSyncSourceOptions, type PowerSyncWatchable, Protected, type ProtectedProps, type SecureStoreModule, type SnapshotSource, type SubjectView, type SubscribeForeground, type SubscribeOnline, type TenantView, approvalHeaders, describe, parseLocalSnapshotManifest, requiredPlans, useApproval, useAssignablePermissions, useAssignableRoles, useDescribe, useFilter, useMemberships, usePermDock, usePermission, usePermissions, useRoles, useSubject, useTenant };
+export { type AppStateModule, type ApprovalHandle, type ApprovalState, type ClientPermDock, type ClientStatus, type FilterResult, type GateMode, type GateView, type LocalSnapshotData, type LocalSnapshotManifest, type LocalSnapshotOptions, type MmkvInstance, type NativeRevalidate, type NetInfoModule, type PermDockDefaults, type PermissionSet, type PermissionState, type PowerSyncQuery, type PowerSyncSourceOptions, type PowerSyncWatchable, Protected, type ProtectedProps, type ReactNativePermDockProviderProps, type SecureStoreModule, type SnapshotSource, type SnapshotStorage, type SubjectView, type SubscribeForeground, type SubscribeOnline, type TenantView, approvalHeaders, describe, parseLocalSnapshotManifest, requiredPlans, useApproval, useAssignablePermissions, useAssignableRoles, useDescribe, useFilter, useGate, useMemberships, usePermDock, usePermission, usePermissions, useRoles, useSubject, useTenant };

package/dist/react-native/index.js

@@ -1,19 +1,20 @@
 "use client";
 import { t as compact } from "../compact-CAf557ZB.js";
 import { n as freezeDeep } from "../freeze-CrU8nQeX.js";
-import { n as isThenable } from "../thenable-QSmvt-vZ.js";
-import { r as requiredPlans } from "../problem-details-DECUnXAn.js";
-import { t as describe } from "../describe-Cgkp7eP0.js";
-import { a as normalizeMemberships, d as scopeList, m as tenantOf$1, o as resolveScope } from "../scopes-tvpa34ep.js";
-import { n as parseSnapshot, o as bindConditionRefs } from "../snapshot-Dc9CHPME.js";
-import { o as flattenGrantee } from "../grantee-CXY-0C87.js";
-import { c as nowSeconds, d as resolveActiveTenant } from "../tenancy-DshjqY0n.js";
-import { r as heldRoleNames, t as emptySnapshot } from "../from-snapshot-7REQZe0H.js";
-import { t as parseLocalSnapshotManifest } from "../parse-local-manifest-C-q02Pal.js";
-import { t as approvalHeaders } from "../headers-BZSDieNT.js";
-import { n as storeOf, r as isJws, t as adapterStore } from "../store-options-CbUHDoSe.js";
+import { r as requiredPlans } from "../problem-details-cn5X30gZ.js";
+import { t as describe } from "../describe-BybMRY7A.js";
+import { n as isThenable } from "../thenable-yD7SabqG.js";
+import { h as secondsAt, m as rfc3339 } from "../time-DkWjdL98.js";
+import { a as normalizeMemberships, d as scopeList, m as tenantOf$1, o as resolveScope } from "../scopes-CUPSjo9q.js";
+import { o as flattenGrantee } from "../grantee-hxrUsbpM.js";
+import { d as resolveActiveTenant } from "../tenancy-DN2QAx9z.js";
+import { i as bindConditionRefs, n as parseSnapshot } from "../snapshot-B7DkYg6g.js";
+import { r as heldRoleNames, t as emptySnapshot } from "../from-snapshot-CTCMsFZk.js";
+import { t as parseLocalSnapshotManifest } from "../parse-local-manifest-CVSs6J9I.js";
+import { t as approvalHeaders } from "../headers-BIjfMaoC.js";
+import { n as storeOf, r as isJws, t as adapterStore } from "../store-options-u0ycEe8s.js";
 import { a as PermDockUiContext, i as PermDockStoreContext, n as useKeyed, t as useLiveOptions } from "../live-options-BaAFCIiu.js";
-import { a as useDescribe, c as usePermDock, d as useRoles, f as useSubject, i as useAssignableRoles, l as usePermission, n as useApproval, o as useFilter, p as useTenant, r as useAssignablePermissions, s as useMemberships, t as Protected, u as usePermissions } from "../protected-BN7BUdY1.js";
+import { a as useDescribe, c as useMemberships, d as usePermissions, f as useRoles, i as useAssignableRoles, l as usePermDock, m as useTenant, n as useApproval, o as useFilter, p as useSubject, r as useAssignablePermissions, s as useGate, t as Protected, u as usePermission } from "../protected-BlF0F6wL.js";
 import { useEffect, useMemo, useRef } from "react";
 import { jsx } from "react/jsx-runtime";
 //#region src/react-native/guards.ts
@@ -122,7 +123,7 @@ function isList(value) {
 	return Array.isArray(value);
 }
 function customScope(role, scopes) {
-	if (role.scope === "global") return "global";
+	if (role.scope === "global") return role.shared === true ? void 0 : "global";
 	if (role.scope !== void 0) return resolveScope(scopes, role.scope);
 	return role.team === void 0 ? scopes[0]?.name : scopes[1]?.name;
 }
@@ -130,7 +131,8 @@ function customScope(role, scopes) {
 * The snapshot a server would send for `data`, built from the manifest. It
 * drives UI guards only: the server still decides every request.
 */
-function buildLocalSnapshot(manifest, data, now = Math.floor(nowSeconds())) {
+function buildLocalSnapshot(manifest, data, at) {
+	const now = secondsAt(at);
 	if (manifest === null || typeof manifest !== "object" || manifest.v !== 1 || !isList(manifest.grants)) throw new Error("PermDock: unsupported local snapshot manifest");
 	const scopes = scopeList(manifest.scopes);
 	const input = data.principal;
@@ -173,7 +175,9 @@ function buildLocalSnapshot(manifest, data, now = Math.floor(nowSeconds())) {
 		}
 		for (const membership of memberships) if (scoped.every((item) => declared.has(item.role) && membership.roles.includes(item.role) && (typeof item.scope === "string" ? membership.scope === item.scope : membership.on !== void 0))) attach(grant, membership);
 	}
-	const custom = (data.customRoles ?? []).filter((role) => role !== null && typeof role === "object" && typeof role.name === "string" && !declared.has(role.name));
+	const formed = (data.customRoles ?? []).filter((role) => role !== null && typeof role === "object" && typeof role.name === "string" && !declared.has(role.name));
+	const sharedNames = new Set(formed.filter((role) => role.shared === true).map((role) => role.name));
+	const custom = formed.filter((role) => role.shared === true || role.scope === "global" || !sharedNames.has(role.name));
 	for (const role of custom) {
 		const scope = customScope(role, scopes);
 		const table = scope !== void 0 && Object.hasOwn(manifest.custom, scope) ? manifest.custom[scope] : void 0;
@@ -184,12 +188,12 @@ function buildLocalSnapshot(manifest, data, now = Math.floor(nowSeconds())) {
 			continue;
 		}
 		const id = role.team ?? role.id;
-		for (const membership of memberships) if (membership.scope === scope && typeof role.tenant === "string" && tenantOf$1(membership, scopes) === role.tenant && (id === void 0 || membership.id === id) && membership.roles.includes(role.name)) for (const grant of resolved) attach(grant, membership);
+		for (const membership of memberships) if (membership.scope === scope && (role.shared === true ? role.tenant === void 0 && id === void 0 && tenantOf$1(membership, scopes) !== void 0 : typeof role.tenant === "string" && tenantOf$1(membership, scopes) === role.tenant) && (id === void 0 || membership.id === id) && membership.roles.includes(role.name)) for (const grant of resolved) attach(grant, membership);
 	}
 	const roles = subject.principal === null ? [] : heldRoleNames(subject, tenant, scopes, { rank: manifest.rank ?? [] }, now);
 	return freezeDeep(compact({
 		v: 1,
-		issuedAt: now,
+		issuedAt: rfc3339(now),
 		subject: {
 			principal,
 			context: {}
@@ -220,7 +224,7 @@ function localSnapshot(options) {
 * takes the database as an argument; `permdock/react-native` never imports
 * `@powersync/*`.
 */
-function powersyncSource(db, options) {
+function powerSyncSource(db, options) {
 	const names = Object.keys(options.queries);
 	return localSnapshot({
 		manifest: options.manifest,
@@ -249,7 +253,7 @@ function powersyncSource(db, options) {
 //#region src/react-native/storage.ts
 const SNAPSHOT_KEY = "permdock.snapshot";
 const TENANT_KEY = "permdock.tenant";
-function memoryStorage(initial = {}) {
+function memorySnapshotStorage(initial = {}) {
 	const map = new Map(Object.entries(initial));
 	return {
 		getItem(key) {
@@ -366,7 +370,7 @@ function clearStorage(storage) {
 function contentKey(snapshot) {
 	return JSON.stringify({
 		...snapshot,
-		issuedAt: 0
+		issuedAt: ""
 	});
 }
 /**
@@ -425,7 +429,7 @@ function parseSeed(given) {
 		return;
 	}
 }
-function createNativeStore(options) {
+function nativeStore(options) {
 	const storage = guardStorage(options.storage);
 	const signed = options.verifier !== void 0;
 	const revalidates = options.snapshotUrl !== void 0 || options.source !== void 0;
@@ -488,7 +492,7 @@ function createNativeStore(options) {
 function PermDockProvider(props) {
 	const live = useLiveOptions(props, false);
 	const shown = useRef(null);
-	const store = useKeyed(() => createNativeStore(compact({
+	const store = useKeyed(() => nativeStore(compact({
 		storage: props.storage,
 		subjectId: props.subjectId,
 		snapshot: props.snapshot,
@@ -636,7 +640,7 @@ function chunkKey(key, index) {
 	return `${key}.${index}`;
 }
 /**
-* A `PermDockStorage` over `expo-secure-store`. Values are split into chunks
+* A `SnapshotStorage` over `expo-secure-store`. Values are split into chunks
 * of at most 2048 bytes under `<key>.<n>`; `<key>` holds the chunk count and
 * is written last, so an interrupted write reads as absent.
 */
@@ -671,7 +675,7 @@ function secureStoreStorage(store, options) {
 		}
 	};
 }
-/** A synchronous `PermDockStorage` over a `react-native-mmkv` instance: the first frame already has the snapshot. */
+/** A synchronous `SnapshotStorage` over a `react-native-mmkv` instance: the first frame already has the snapshot. */
 function mmkvStorage(mmkv) {
 	return {
 		getItem: (key) => mmkv.getString(key) ?? null,
@@ -709,4 +713,4 @@ function netInfoOnline(netInfo) {
 	});
 }
 //#endregion
-export { PermDockProvider, Protected, appStateForeground, approvalHeaders, buildLocalSnapshot, connectSource, createNativeStore, describe, localSnapshot, memoryStorage, mmkvStorage, netInfoOnline, parseLocalSnapshotManifest, powersyncSource, requiredPlans, secureStoreStorage, useApproval, useAssignablePermissions, useAssignableRoles, useDescribe, useFilter, useMemberships, usePermDock, usePermission, usePermissionGuard, usePermissions, useRoles, useSnapshotReady, useSubject, useTenant };
+export { PermDockProvider, Protected, appStateForeground, approvalHeaders, buildLocalSnapshot, connectSource, describe, localSnapshot, memorySnapshotStorage, mmkvStorage, nativeStore, netInfoOnline, parseLocalSnapshotManifest, powerSyncSource, requiredPlans, secureStoreStorage, useApproval, useAssignablePermissions, useAssignableRoles, useDescribe, useFilter, useGate, useMemberships, usePermDock, usePermission, usePermissionGuard, usePermissions, useRoles, useSnapshotReady, useSubject, useTenant };

package/dist/{refs-f3imMjNW.js → refs-K6eWUJ0H.js}

@@ -1,5 +1,5 @@
 import { n as freezeDeep } from "./freeze-CrU8nQeX.js";
-import { a as assertSafeKey, l as readPath, u as splitPath } from "./thenable-QSmvt-vZ.js";
+import { o as readPath, s as splitPath, t as assertSafeKey } from "./paths-DXSHAMIa.js";
 //#region src/conditions/ast.ts
 function parentHop(parent) {
 	return typeof parent === "string" ? { field: parent } : parent;

package/dist/{relation-walk-BXnlLtg2.js → relation-walk-3OyDBF0S.js}

@@ -1,6 +1,6 @@
 import { r as isRecord } from "./compact-CAf557ZB.js";
-import { s as ownGet } from "./thenable-QSmvt-vZ.js";
-import { n as relationId } from "./relations-CvmSpG67.js";
+import { r as ownGet } from "./paths-DXSHAMIa.js";
+import { n as relationId } from "./relations-BnCWnJGI.js";
 //#region src/core/relation-walk.ts
 /** Whether the holder's period covers `now`. */
 function activeNow(holder, now) {

package/dist/{relations-CvmSpG67.js → relations-BnCWnJGI.js}

@@ -1,7 +1,7 @@
 import { r as isRecord } from "./compact-CAf557ZB.js";
-import { n as isThenable } from "./thenable-QSmvt-vZ.js";
-import { t as idText } from "./ids-DC4V4CFu.js";
-import { a as expandRelation } from "./resource-relations-D1Un3pcz.js";
+import { i as idText } from "./expiry-D4_YKRKD.js";
+import { n as isThenable } from "./thenable-yD7SabqG.js";
+import { a as expandRelation } from "./resource-relations-D_jw0BFx.js";
 //#region src/core/relations.ts
 function isInstant(value) {
 	return value === void 0 || typeof value === "number" && Number.isFinite(value);

package/dist/renames-CGj7YwcQ.js

@@ -0,0 +1,175 @@
+//#region src/cli/core/renames.ts
+const DB_COMMANDS = [
+	"rls generate",
+	"rls import",
+	"rls verify",
+	"supabase hook generate",
+	"powersync verify"
+];
+const FLAG_RENAMES = [
+	{
+		commands: DB_COMMANDS,
+		from: "--db",
+		to: "--db-url-stdin",
+		hint: "--db-url-stdin or DATABASE_URL"
+	},
+	{
+		commands: DB_COMMANDS,
+		from: "--db-url",
+		to: "--db-url-stdin",
+		hint: "--db-url-stdin or DATABASE_URL"
+	},
+	{
+		commands: ["rls generate"],
+		from: "--force",
+		to: "--force-rls"
+	},
+	{
+		commands: ["rls verify"],
+		from: "--format",
+		to: "--kind"
+	},
+	{
+		commands: ["rls verify"],
+		from: "--emit",
+		to: "--kind"
+	},
+	{
+		commands: ["catalog"],
+		from: "--format",
+		to: "--kind",
+		values: {
+			json: "catalog",
+			schema: "json-schema",
+			markdown: "markdown"
+		}
+	},
+	{
+		commands: ["openapi emit"],
+		from: "--format",
+		to: "--kind"
+	},
+	{
+		commands: [
+			"rls generate",
+			"rls verify",
+			"rls migrate",
+			"powersync generate",
+			"powersync verify",
+			"openapi emit"
+		],
+		from: "--from",
+		to: "--policy"
+	},
+	{
+		commands: ["catalog", "arazzo check"],
+		from: "--from",
+		to: "--permissions"
+	},
+	{
+		commands: ["rls import", "openapi import"],
+		from: "--schema",
+		to: "--validator"
+	},
+	{
+		commands: [
+			"usage",
+			"config",
+			"doctor"
+		],
+		from: "--strict",
+		to: "--fail-on",
+		hint: "--fail-on warning",
+		rewrite: "--fail-on warning"
+	},
+	{
+		commands: ["login"],
+		from: "--write",
+		to: "--scope",
+		hint: "--scope catalog:write",
+		rewrite: "--scope catalog:write"
+	},
+	{
+		commands: ["skills install", "skills update"],
+		from: "--agent",
+		to: "--for"
+	},
+	{
+		commands: ["skills install", "skills update"],
+		from: "--client",
+		to: "--for"
+	},
+	{
+		commands: ["init"],
+		from: "--agent",
+		to: "--integration"
+	},
+	{
+		commands: ["init"],
+		from: "--ui",
+		to: "--integration"
+	},
+	{
+		commands: ["init"],
+		from: "--src",
+		to: "--out-dir"
+	},
+	{
+		commands: [
+			"rls generate",
+			"rls verify",
+			"rls migrate"
+		],
+		from: "--rbac-scaffold",
+		to: "--rbac",
+		hint: "--rbac supabase",
+		rewrite: "--rbac supabase"
+	},
+	{
+		commands: ["rls migrate"],
+		from: "--write",
+		hint: "rls migrate writes by default; --dry-run prints the plan without writing",
+		rewrite: ""
+	},
+	{
+		commands: ["cloud push"],
+		from: "--environment",
+		to: "--project",
+		hint: "--project <id>: a project id is its environment"
+	},
+	{
+		commands: ["scan"],
+		from: "--legacy",
+		hint: "permdock scan lists the checks written without PermDock; drop --legacy",
+		rewrite: ""
+	}
+];
+const COMMAND_MOVES = [
+	{
+		from: "openapi",
+		to: "openapi emit"
+	},
+	{
+		from: "skills",
+		to: "skills install"
+	},
+	{
+		from: "arazzo",
+		to: "arazzo check"
+	}
+];
+const DEFAULT_CHANGES = [{
+	command: "rls migrate",
+	unless: ["--write", "--retire-out"],
+	add: "--dry-run"
+}];
+/** The rename that matches `flag` (as typed, before any `=`) on `command`. */
+function flagRename(command, flag) {
+	return FLAG_RENAMES.find((rename) => rename.from === flag && rename.commands.includes(command));
+}
+function renameMessage(command, rename) {
+	const replacement = rename.hint ?? rename.to;
+	return replacement === void 0 ? `${command}: ${rename.from} was removed in 0.5.0.` : rename.to === void 0 ? `${command}: ${rename.from} was removed in 0.5.0: ${replacement}.` : `${command}: ${rename.from} is ${replacement} since 0.5.0.`;
+}
+//#endregion
+export { renameMessage as i, DEFAULT_CHANGES as n, flagRename as r, COMMAND_MOVES as t };

package/dist/{replay-COpmZUfx.d.ts → replay-Bkm-Ne4l.d.ts}

@@ -1,4 +1,4 @@
-import { g as ReplayStore } from "./types-C0dee0Qf.js";
+import { l as ReplayStore } from "./types-C791HFu9.js";
 //#region src/ssf/replay.d.ts
 declare function memoryReplayStore(): ReplayStore;
 //#endregion

package/dist/{replay-BsOyTrdV.js → replay-Du1tJjG7.js}

@@ -1,7 +1,8 @@
+import { o as epochSeconds } from "./time-DkWjdL98.js";
 //#region src/ssf/replay.ts
 function memoryReplayStore() {
 	const seen = /* @__PURE__ */ new Map();
-	function evict(now = Date.now() / 1e3) {
+	function evict(now = epochSeconds()) {
 		for (const [jti, expiresAt] of seen) if (expiresAt !== void 0 && expiresAt <= now) seen.delete(jti);
 	}
 	return {

package/dist/{request-context-BVM7aWNs.js → request-context-C81Pip9n.js}

@@ -1,6 +1,6 @@
-import { t as assertAppData } from "./app-data-CV8pqqMi.js";
-import { n as wrapPermDock } from "./wrap-DWsU_5Bd.js";
-import { t as buildInstance } from "./build-instance-DIIV9DbC.js";
+import { t as assertAppData } from "./app-data-MuyzVqX8.js";
+import { n as wrapPermDock } from "./wrap-gX61EtpB.js";
+import { t as buildInstance } from "./build-instance-Bu_eDqYw.js";
 //#region src/core/request-context.ts
 /**
 * Errors an adapter raises around one instance (a `context` hook that threw,