permdock 0.5.0 → 0.6.0

package/dist/{types-BjV-fqcA.d.ts → types-C863OQiR.d.ts}

@@ -1,7 +1,7 @@
-import { Vt as Snapshot, dt as TokenVerifier, ot as SnapshotSource } from "./policy-types-DzwivBgR.js";
-import { n as DescribeMessages } from "./describe-BZUsixiL.js";
-import { h as ClientStoreOptions } from "./types-BNORmDM8.js";
-import { t as PermDockDefaults } from "./types-tIgIeIKJ.js";
+import { Vt as Snapshot, dt as TokenVerifier, ot as SnapshotSource } from "./policy-types-n0uRTsW8.js";
+import { n as DescribeMessages } from "./describe-B5qgDvEW.js";
+import { h as ClientStoreOptions } from "./types-B3_ooZgZ.js";
+import { t as PermDockDefaults } from "./types-CX7AvRqP.js";
 import { ReactNode } from "react";
 //#region src/react-native/types.d.ts
 type SnapshotStorage = {

package/dist/{types-fbZ7JEXr.d.ts → types-CVZSNocA.d.ts}

@@ -1,8 +1,8 @@
-import { Mn as ApprovalRequiredDecision, Nn as Decision, Vt as Snapshot, dt as TokenVerifier, zn as GrantedDecision } from "./policy-types-DzwivBgR.js";
-import { w as Permission } from "./vocabulary-D6lPdb4Z.js";
-import { r as PermDock } from "./permdock-D7eeLJER.js";
+import { Mn as ApprovalRequiredDecision, Nn as Decision, Vt as Snapshot, dt as TokenVerifier, zn as GrantedDecision } from "./policy-types-n0uRTsW8.js";
+import { w as Permission } from "./vocabulary-CN8H_9UF.js";
+import { r as PermDock } from "./permdock-SV8ZINYT.js";
 import { t as PermissionBoundaryState } from "./boundary-BmHxVH1J.js";
-import { l as PermissionState, m as ClientStore, u as ProviderOptionsBase } from "./types-BNORmDM8.js";
+import { l as PermissionState, m as ClientStore, u as ProviderOptionsBase } from "./types-B3_ooZgZ.js";
 import { Snippet } from "svelte";
 import { Readable } from "svelte/store";
 //#region src/client/views.d.ts

package/dist/{types-tIgIeIKJ.d.ts → types-CX7AvRqP.d.ts}

@@ -1,7 +1,7 @@
-import { Mn as ApprovalRequiredDecision, Nn as Decision, Vt as Snapshot, dt as TokenVerifier, zn as GrantedDecision } from "./policy-types-DzwivBgR.js";
-import { w as Permission } from "./vocabulary-D6lPdb4Z.js";
-import { n as DescribeMessages } from "./describe-BZUsixiL.js";
-import { h as ClientStoreOptions } from "./types-BNORmDM8.js";
+import { Mn as ApprovalRequiredDecision, Nn as Decision, Vt as Snapshot, dt as TokenVerifier, zn as GrantedDecision } from "./policy-types-n0uRTsW8.js";
+import { w as Permission } from "./vocabulary-CN8H_9UF.js";
+import { n as DescribeMessages } from "./describe-B5qgDvEW.js";
+import { h as ClientStoreOptions } from "./types-B3_ooZgZ.js";
 import { ReactNode } from "react";
 //#region src/react/types.d.ts
 type PermDockProviderProps = ({

package/dist/{types-_sHy8BQf.d.ts → types-C_IiEs64.d.ts}

@@ -1,4 +1,4 @@
-import { fn as Approver } from "./policy-types-DzwivBgR.js";
+import { fn as Approver } from "./policy-types-n0uRTsW8.js";
 //#region src/approvals/access-reviews/types.d.ts
 type AccessReviewStatus = "open" | "closed";
 type AccessReviewItemStatus = "pending" | "kept" | "revoked";

package/dist/{types-5Ut_pbKy.d.ts → types-Dfv0aTER.d.ts}

@@ -1,5 +1,5 @@
-import { n as RoleThrough } from "./types-CdlxsYQh.js";
-import { o as SqlMembershipSource } from "./sources-BV9j0DeZ.js";
+import { n as RoleThrough } from "./types-BzzaHxt3.js";
+import { o as SqlMembershipSource } from "./sources-Xc4zkszI.js";
 //#region src/cli/core/errors.d.ts
 /**
  * 0 success, 1 failure, 2 usage, 3 action required, 130 interrupted (SIGINT
@@ -381,6 +381,8 @@ type RlsCustomRoleTable = {
   readonly id?: string;
   /** A boolean column marking rows that are not custom roles (declared or system roles); those rows are skipped. */
   readonly skip?: string;
+  /** A boolean column marking a row with no tenant as a shared custom role, held at `scope` (default the first scope) in every tenant. Without it a row with no tenant is a platform role. */
+  readonly shared?: string;
 };
 /** `rls.customRoles` as an object: custom roles on, plus where existing ones live. */
 type RlsCustomRolesConfig = {

package/dist/{types-CZTnPFzM.d.ts → types-Druu9wLM.d.ts}

@@ -1,5 +1,5 @@
-import { I as ResourceRelation } from "./vocabulary-D6lPdb4Z.js";
-import { s as OperationMeta } from "./operations-CxybZErY.js";
+import { I as ResourceRelation } from "./vocabulary-CN8H_9UF.js";
+import { s as OperationMeta } from "./operations-X0VM7F3m.js";
 //#region src/catalog/types.d.ts
 type CatalogUsage = {
   readonly file: string;

package/dist/{types-ClZaWzfb.d.ts → types-_WhUP7ud.d.ts}

@@ -1,6 +1,6 @@
-import { Nn as Decision, Rn as ExplainedDecision, T as Policy, ir as Subject, j as PolicyVocabulary, nr as Membership, rr as Principal } from "./policy-types-DzwivBgR.js";
-import { E as PermissionTree, w as Permission } from "./vocabulary-D6lPdb4Z.js";
-import { c as WhereResult, i as PermDockOptions, n as DeriveOptions, o as SimulateOptions, r as PermDock, t as DecideOptions } from "./permdock-D7eeLJER.js";
+import { Nn as Decision, Rn as ExplainedDecision, T as Policy, ar as Subject, j as PolicyVocabulary, nr as Membership, rr as Principal } from "./policy-types-n0uRTsW8.js";
+import { E as PermissionTree, w as Permission } from "./vocabulary-CN8H_9UF.js";
+import { c as WhereResult, i as PermDockOptions, n as DeriveOptions, o as SimulateOptions, r as PermDock, t as DecideOptions } from "./permdock-SV8ZINYT.js";
 //#region src/pdp/types.d.ts
 type RemotePdpAuth = {
   readonly bearer: string | (() => string | Promise<string>);

package/dist/{types-BqAKcRNW.d.ts → types-lUlG3TVd.d.ts}

@@ -1,5 +1,5 @@
-import { Xt as DecisionEvent, j as PolicyVocabulary } from "./policy-types-DzwivBgR.js";
-import { r as PermDock } from "./permdock-D7eeLJER.js";
+import { Xt as DecisionEvent, j as PolicyVocabulary } from "./policy-types-n0uRTsW8.js";
+import { r as PermDock } from "./permdock-SV8ZINYT.js";
 //#region src/otel/types.d.ts
 declare const GENAI_SEMCONV_PIN = "1.37.0";
 declare const GEN_AI_TOOL_NAME = "gen_ai.tool.name";

package/dist/unplugin/index.d.ts

@@ -1,4 +1,4 @@
-import { a as PermDockPluginOptions } from "../types-5Ut_pbKy.js";
+import { a as PermDockPluginOptions } from "../types-Dfv0aTER.js";
 import { createUnplugin } from "unplugin";
 //#region src/unplugin/index.d.ts
 type CreateUnplugin = typeof createUnplugin<PermDockPluginOptions | undefined>;

package/dist/unplugin/index.js

@@ -1,4 +1,4 @@
-import { n as createCollectScheduler, r as report } from "../watch-CszoTJMq.js";
+import { n as createCollectScheduler, r as report } from "../watch-vea54PRw.js";
 import { r as peerHint } from "../peer-C8swJ2GH.js";
 import { createRequire } from "node:module";
 //#region src/unplugin/index.ts

package/dist/{usage-DHtE8j4E.js → usage-CRVl9V3t.js}

@@ -16,7 +16,7 @@ const usage = defineLeaf({
 		}
 	},
 	async run(ctx, { flags }) {
-		return (await import("./usage-CHOtwL19.js")).runUsage({
+		return (await import("./usage-CZpSQP6L.js")).runUsage({
 			cwd: ctx.cwd,
 			config: ctx.config,
 			ignore: flags.ignore,

package/dist/usage-CZpSQP6L.js

@@ -0,0 +1 @@
+export { t as runUsage } from "./usage-SveTRTyr.js";

package/dist/{usage-T5mXq98v.js → usage-SveTRTyr.js}

@@ -2,12 +2,12 @@ import { a as getResource } from "./permission-registry-Br4jSNVi.js";
 import { u as usageResult } from "./errors-CWTY6uih.js";
 import { a as rel, r as listSourceFiles } from "./files-D_JIzUrP.js";
 import { o as USAGE_REPORT_SCHEMA } from "./version-CEbQ5UeM.js";
-import { s as jsonSchemaOf } from "./catalog-doc-C9wjsfNY.js";
+import { s as jsonSchemaOf } from "./catalog-doc-Cdn7-0pQ.js";
 import { a as loadModule, n as asPolicy, s as pickNamed } from "./load-DFS_ry0W.js";
-import { r as runCollect } from "./collect-CrZJJnEF.js";
+import { r as runCollect } from "./collect-mLTY4nwb.js";
 import { t as beforeFirst } from "./text-BMFRfBqc.js";
-import { t as DOCS_BASE } from "./manifest-CtKR3GXL.js";
-import { r as findingOf } from "./output-Dyw8fyPF.js";
+import { t as DOCS_BASE } from "./manifest-dvL2XEe1.js";
+import { r as findingOf } from "./output-1im__-08.js";
 import { existsSync, readFileSync, realpathSync } from "node:fs";
 import { dirname, resolve } from "node:path";
 import { fileURLToPath, pathToFileURL } from "node:url";

package/dist/{validation-error-Bg5Tpluk.d.ts → validation-error-DHUrAkku.d.ts}

@@ -1,4 +1,4 @@
-import { a as ProblemDetails } from "./errors-C2PXIv4c.js";
+import { a as ProblemDetails } from "./errors-DH5QEGXh.js";
 import { StandardSchemaV1 } from "@standard-schema/spec";
 //#region src/core/validation-error.d.ts
 /** The base of every Problem Details `type` URI; defined here so a validation error does not pull in the Problem Details builders. */

package/dist/{verify-DbCL9bnB.js → verify-BaAKx7t6.js}

@@ -1,22 +1,22 @@
 import { a as sole, r as isRecord } from "./compact-CAf557ZB.js";
 import { a as hasConditionOp, c as isConditionRef } from "./refs-K6eWUJ0H.js";
-import { E as memoryCustomRoleSource, g as memoryRelationSource } from "./src-DLfUWFAI.js";
+import { E as memoryCustomRoleSource, g as memoryRelationSource } from "./src-Cu2m75uo.js";
 import { c as listPermissions, h as formerKeys, n as findPermission } from "./permission-registry-Br4jSNVi.js";
 import { a as expandRelation, c as isEdgeRelation, d as isSelfParented, l as isFieldRelation, o as groupEntries, p as restrictedFor, u as isPrincipalRelation } from "./resource-relations-D_jw0BFx.js";
 import { f as nowMillis, u as isoAt } from "./time-DkWjdL98.js";
 import { t as canonicalJson } from "./canonical-json-BC8_nMTw.js";
 import { d as scopeList } from "./scopes-CUPSjo9q.js";
-import { o as requiresStandIn } from "./delegation-DaXVdDhM.js";
-import { o as flattenGrantee } from "./grantee-Cn1HyUsI.js";
+import { o as requiresStandIn } from "./delegation-j6-rc37o.js";
+import { o as flattenGrantee } from "./grantee-hxrUsbpM.js";
 import { r as relationCondition, t as inheritCondition } from "./grantee-conditions-CcXf8hMM.js";
 import { p as scopeField } from "./tenancy-DN2QAx9z.js";
-import { s as policyLevels } from "./policy-DLZJ5gAp.js";
+import { s as policyLevels } from "./policy-DbM5YYtV.js";
 import { t as requiresApproval } from "./approval-required-TzNB9oQA.js";
-import { _ as membershipsClaim, c as andWhere, g as leveled, p as customRoleScope } from "./evaluate-_R8QkWaf.js";
-import { t as getPermDock } from "./permdock-B9JxkBwC.js";
+import { c as andWhere, m as customRoleScope, v as leveled, y as membershipsClaim } from "./evaluate-CNClBvcj.js";
+import { t as getPermDock } from "./permdock-BrAscV28.js";
 import { a as describeError, i as configError, u as usageResult } from "./errors-CWTY6uih.js";
 import { t as policyRowConditionKeys } from "./row-conditions-h2HythXQ.js";
-import { s as jsonSchemaOf } from "./catalog-doc-C9wjsfNY.js";
+import { s as jsonSchemaOf } from "./catalog-doc-Cdn7-0pQ.js";
 import { o as loadPolicyAt } from "./load-DFS_ry0W.js";
 import { c as relationArmSql, u as restrictedRowsSql } from "./compile-CMqMx_IN.js";
 import "./budget-NbEtbJC_.js";
@@ -24,10 +24,10 @@ import { i as qualifySqlTable, n as defaultSqlCommand } from "./sql-B5T1IL83.js"
 import "./sources-vs5dGOsS.js";
 import { t as beforeFirst } from "./text-BMFRfBqc.js";
 import { n as fixtureSubject, r as loadFixtures, t as fixtureRow } from "./fixtures-B7XrLeY7.js";
-import { F as quoteQualified, I as quoteTable, M as qualified, N as quoteIdent, P as quoteLiteral, T as columnTypesOf, _ as subjectClaimJsonSql, a as customRolesOn, j as helperSchema, r as HELPERS, v as subjectClaimSql, w as arrayColumnsOf } from "./shared-CD11nBbC.js";
-import { d as connectPgPool, f as pgConnector, l as validitySql, s as andSql, u as wrapSql } from "./policies-CO1oOymN.js";
-import { B as linkHelper, D as breakGlassHolder, F as graphHelper, I as graphSqlName, J as restrictedHelper, L as graphSqlText, M as contextRefs, N as sqlFunctionNames, O as breakGlassKey, P as CLOSURE, Q as activeUserSql, X as scopeTable, j as compileConditionSql, k as collectGrants, m as accessSql, p as requiresSql, v as capabilityAccessSql, w as apiKeyAllowsCall } from "./ownership-BatFgAA4.js";
-import { s as viewName, t as FIELD_VIEWS } from "./fields-D9tPVUUS.js";
+import { F as quoteQualified, I as quoteTable, M as qualified, N as quoteIdent, P as quoteLiteral, T as columnTypesOf, _ as subjectClaimJsonSql, a as customRolesOn, j as helperSchema, r as HELPERS, v as subjectClaimSql, w as arrayColumnsOf } from "./shared-BAK8t4Uo.js";
+import { d as connectPgPool, f as pgConnector, l as validitySql, s as andSql, u as wrapSql } from "./policies-DP2nqRoF.js";
+import { $ as activeUserSql, A as collectGrants, F as CLOSURE, I as graphHelper, L as graphSqlName, M as compileConditionSql, N as contextRefs, O as breakGlassHolder, P as sqlFunctionNames, R as graphSqlText, T as apiKeyAllowsCall, V as linkHelper, Y as restrictedHelper, Z as scopeTable, _ as capabilityAccessSql, k as breakGlassKey, m as accessSql, p as requiresSql } from "./ownership-DqaJNJPn.js";
+import { s as viewName, t as FIELD_VIEWS } from "./fields-OYG_JR78.js";
 import { createHash, randomUUID } from "node:crypto";
 //#region src/cli/rls/indexes.ts
 /** Postgres truncates identifiers longer than this, in bytes. */

package/dist/{vocabulary-D6lPdb4Z.d.ts → vocabulary-CN8H_9UF.d.ts}

@@ -265,6 +265,8 @@ type Role<K extends string = string> = {
   readonly on?: string;
   readonly assignable: boolean;
   readonly meta: RoleMeta;
+  /** A shared custom role: the platform defines it for every tenant, and a tenant admin cannot edit it. */
+  readonly shared?: true;
   readonly kind: typeof ROLE_KIND;
 };
 type Plan<K extends string = string> = {

package/dist/vue/index.d.ts

@@ -1,10 +1,10 @@
-import { Mn as ApprovalRequiredDecision, Nn as Decision, Vt as Snapshot, dt as TokenVerifier, nr as Membership } from "../policy-types-DzwivBgR.js";
-import { r as Role, w as Permission } from "../vocabulary-D6lPdb4Z.js";
-import { n as requiredPlans } from "../problem-details-DXlt-vks.js";
-import { i as describe, r as DescribeOptions, t as DecisionDescription } from "../describe-BZUsixiL.js";
+import { Mn as ApprovalRequiredDecision, Nn as Decision, Vt as Snapshot, dt as TokenVerifier, nr as Membership } from "../policy-types-n0uRTsW8.js";
+import { r as Role, w as Permission } from "../vocabulary-CN8H_9UF.js";
+import { n as requiredPlans } from "../problem-details-B45V5d2b.js";
+import { i as describe, r as DescribeOptions, t as DecisionDescription } from "../describe-B5qgDvEW.js";
 import { t as PermissionBoundaryState } from "../boundary-BmHxVH1J.js";
 import { t as approvalHeaders } from "../headers-CIbDTUTK.js";
-import { a as FilterResult, c as PermissionSet, d as RolesOptions, f as SubjectView, i as ClientStatus, l as PermissionState, n as ApprovalState, p as TenantView, r as ClientPermDock, t as ApprovalHandle, u as ProviderOptionsBase } from "../types-BNORmDM8.js";
+import { a as FilterResult, c as PermissionSet, d as RolesOptions, f as SubjectView, i as ClientStatus, l as PermissionState, n as ApprovalState, p as TenantView, r as ClientPermDock, t as ApprovalHandle, u as ProviderOptionsBase } from "../types-B3_ooZgZ.js";
 import { ComputedRef, DefineComponent, MaybeRefOrGetter, Plugin, VNode } from "vue";
 //#region src/vue/types.d.ts
 type PermDockPluginOptions = ProviderOptionsBase & {

package/dist/vue/index.js

@@ -2,8 +2,8 @@ import { r as requiredPlans } from "../problem-details-cn5X30gZ.js";
 import { t as describe } from "../describe-BybMRY7A.js";
 import { n as boundaryFallback, t as boundaryDigest } from "../boundary-BM8a_P6E.js";
 import { t as approvalHeaders } from "../headers-BIjfMaoC.js";
-import { i as isPromiseLike } from "../store-options-BqEakYRa.js";
-import { n as switchTenant, t as providerStore } from "../provider-store-B5Yrkhzr.js";
+import { i as isPromiseLike } from "../store-options-u0ycEe8s.js";
+import { n as switchTenant, t as providerStore } from "../provider-store-DM6DNcta.js";
 import { a as livePermDock, c as rolesView, d as subjectView, f as tenantView, l as scopedTenant, n as describeWith, o as permissionSet, r as filterResult, s as protectedView, t as approvalHandle, u as slotContent } from "../views-DTIIO-oQ.js";
 import { computed, defineComponent, effectScope, getCurrentScope, inject, isRef, onErrorCaptured, onScopeDispose, provide, shallowRef, toValue, watch } from "vue";
 //#region src/vue/context.ts

package/dist/{waiter-CKy4MQSY.d.ts → waiter-B986w1oK.d.ts}

@@ -1,5 +1,5 @@
-import { Rt as Instant } from "./policy-types-DzwivBgR.js";
-import { m as ApprovalStore } from "./types-CCpc2Dcv.js";
+import { Rt as Instant } from "./policy-types-n0uRTsW8.js";
+import { m as ApprovalStore } from "./types-BdtSDbBO.js";
 //#region src/workflow/waiter.d.ts
 type ApprovalWaitOptions = {
   /** When the approval request expires; the wait ends then whatever the store says. */

package/dist/watch--ovlPOc0.js

@@ -0,0 +1 @@
+export { i as watchCollect } from "./watch-vea54PRw.js";

package/dist/{watch-CszoTJMq.js → watch-vea54PRw.js}

@@ -1,7 +1,7 @@
 import { i as dateAt } from "./time-DkWjdL98.js";
 import { a as describeError } from "./errors-CWTY6uih.js";
 import { t as defaultSrcPath } from "./files-D_JIzUrP.js";
-import { r as runCollect } from "./collect-CrZJJnEF.js";
+import { r as runCollect } from "./collect-mLTY4nwb.js";
 import { n as isConfigFile, r as loadConfig } from "./config-bs_kZeYq.js";
 import { watch } from "node:fs";
 import { basename, dirname, relative, resolve, sep } from "node:path";

package/dist/webmcp/index.d.ts

@@ -1,5 +1,5 @@
-import { Nn as Decision, Vt as Snapshot } from "../policy-types-DzwivBgR.js";
-import { E as PermissionTree, w as Permission } from "../vocabulary-D6lPdb4Z.js";
+import { Nn as Decision, Vt as Snapshot } from "../policy-types-n0uRTsW8.js";
+import { E as PermissionTree, w as Permission } from "../vocabulary-CN8H_9UF.js";
 import { StandardSchemaV1 } from "@standard-schema/spec";
 //#region src/webmcp/types.d.ts
 type WebMcpClientStatus = "ready" | "pending" | "stale" | "server-only";

package/dist/{where-scope-Dv-WTP-w.js → where-scope-C9vfEphl.js}

@@ -3,11 +3,11 @@ import { n as freezeDeep } from "./freeze-CrU8nQeX.js";
 import { t as loadPrincipal } from "./principal-source-pHneukrx.js";
 import { g as secondsOf, m as rfc3339 } from "./time-DkWjdL98.js";
 import { d as scopeList, l as scopeChain, m as tenantOf, o as resolveScope, r as findScope, t as activeFor, u as scopeIdOf } from "./scopes-CUPSjo9q.js";
-import { a as readOnlyActorRefuses, n as coveredByDelegation } from "./delegation-DaXVdDhM.js";
+import { a as readOnlyActorRefuses, n as coveredByDelegation } from "./delegation-j6-rc37o.js";
 import { r as readWireValidity, t as isActive } from "./validity-CZ7-y0Cj.js";
 import { o as resourceRoleCondition } from "./grantee-conditions-CcXf8hMM.js";
 import { c as nowSeconds, n as inTeam, o as membershipField, r as isMembershipExpired } from "./tenancy-DN2QAx9z.js";
-import { i as bindConditionRefs, n as parseSnapshot } from "./snapshot-CXUWfsNy.js";
+import { i as bindConditionRefs, n as parseSnapshot } from "./snapshot-B7DkYg6g.js";
 //#region src/core/snapshot-sign.ts
 /**
 * Signs `snapshot` as a `vnd.permdock.snapshot+jwt`. `issuedAt` and

package/dist/{who-can-D0QoYbEb.js → who-can-DWBAcaCQ.js}

@@ -6,11 +6,11 @@ import { a as getResource } from "./permission-registry-Br4jSNVi.js";
 import { a as expandRelation, c as isEdgeRelation, l as isFieldRelation, u as isPrincipalRelation } from "./resource-relations-D_jw0BFx.js";
 import { s as instantAt } from "./time-DkWjdL98.js";
 import { a as normalizeMemberships, c as rootScope, d as scopeList, o as resolveScope } from "./scopes-CUPSjo9q.js";
-import { o as flattenGrantee } from "./grantee-Cn1HyUsI.js";
+import { o as flattenGrantee } from "./grantee-hxrUsbpM.js";
 import { r as relationCondition } from "./grantee-conditions-CcXf8hMM.js";
 import { c as nowSeconds, p as scopeField } from "./tenancy-DN2QAx9z.js";
 import { t as byCodePoint } from "./compare-pfyVnBjE.js";
-import { C as emptyListeners, t as evaluate } from "./evaluate-_R8QkWaf.js";
+import { T as emptyListeners, t as evaluate } from "./evaluate-CNClBvcj.js";
 import { n as relationId, t as pendingRelations } from "./relations-BnCWnJGI.js";
 import { t as relationWalk } from "./relation-walk-3OyDBF0S.js";
 //#region src/core/who-can.ts

package/dist/workflow/index.d.ts

@@ -1,5 +1,5 @@
-import { a as AutomationSource, i as AutomationRequest, l as memoryAutomationSource, n as AutomationDecision, r as AutomationMode, s as MemoryAutomationSource, t as Automation, u as parseAutomation } from "../automation-BMZPIVUM.js";
-import { i as pollingApprovalWaiter, n as ApprovalWaiter, r as PollingApprovalWaiterOptions, t as ApprovalWaitOptions } from "../waiter-CKy4MQSY.js";
-import { a as WorkflowPermDockOptions, i as WorkflowPermDock, n as AwaitApprovalOptions, o as createPermDock, r as StartAutomationResult, t as AutomationOptions } from "../create-BFfm17UA.js";
+import { a as AutomationSource, i as AutomationRequest, l as memoryAutomationSource, n as AutomationDecision, r as AutomationMode, s as MemoryAutomationSource, t as Automation, u as parseAutomation } from "../automation-BNM3TtDo.js";
+import { i as pollingApprovalWaiter, n as ApprovalWaiter, r as PollingApprovalWaiterOptions, t as ApprovalWaitOptions } from "../waiter-B986w1oK.js";
+import { a as WorkflowPermDockOptions, i as WorkflowPermDock, n as AwaitApprovalOptions, o as createPermDock, r as StartAutomationResult, t as AutomationOptions } from "../create-D_NmPOdH.js";
 import "../index-CaxrMD1A.js";
 export { type ApprovalWaitOptions, type ApprovalWaiter, type Automation, type AutomationDecision, type AutomationMode, type AutomationOptions, type AutomationRequest, type AutomationSource, type AwaitApprovalOptions, type MemoryAutomationSource, type PollingApprovalWaiterOptions, type StartAutomationResult, type WorkflowPermDock, type WorkflowPermDockOptions, createPermDock, memoryAutomationSource, parseAutomation, pollingApprovalWaiter };

package/dist/workflow/index.js

@@ -3,9 +3,9 @@ import { n as freezeDeep } from "../freeze-CrU8nQeX.js";
 import { n as findPermission } from "../permission-registry-Br4jSNVi.js";
 import { n as isThenable } from "../thenable-yD7SabqG.js";
 import { n as memoryAutomationSource, r as parseAutomation } from "../automation-DVjOckjV.js";
-import { c as withApp, t as getPermDock } from "../permdock-B9JxkBwC.js";
+import { c as withApp, t as getPermDock } from "../permdock-BrAscV28.js";
 import { o as automationEvent } from "../sink-BEZSlMS_.js";
-import { a as requestApproval, s as resumeDecision } from "../helpers-DTcZOzhF.js";
+import { a as requestApproval, s as resumeDecision } from "../helpers-CBYVMjwh.js";
 import { n as signRunTicket, r as subjectFromRunTicket } from "../run-ticket-sxFI6LAk.js";
 import { t as pollingApprovalWaiter } from "../waiter-BGUtGYoU.js";
 //#region src/workflow/create.ts

package/dist/workflow-sdk/index.d.ts

@@ -1,8 +1,8 @@
-import { Nn as Decision } from "../policy-types-DzwivBgR.js";
-import { w as Permission } from "../vocabulary-D6lPdb4Z.js";
-import { r as PermDock } from "../permdock-D7eeLJER.js";
-import { n as ApprovalWaiter } from "../waiter-CKy4MQSY.js";
-import { i as WorkflowPermDock, r as StartAutomationResult, t as AutomationOptions } from "../create-BFfm17UA.js";
+import { Nn as Decision } from "../policy-types-n0uRTsW8.js";
+import { w as Permission } from "../vocabulary-CN8H_9UF.js";
+import { r as PermDock } from "../permdock-SV8ZINYT.js";
+import { n as ApprovalWaiter } from "../waiter-B986w1oK.js";
+import { i as WorkflowPermDock, r as StartAutomationResult, t as AutomationOptions } from "../create-D_NmPOdH.js";
 //#region src/workflow-sdk/index.d.ts
 /** The part of a Workflow SDK `Hook` the waiter reads: awaiting it suspends the run. */
 export type WorkflowSdkHook = {

package/dist/{wrap-Bd1Tejur.d.ts → wrap-C5jC6sKI.d.ts}

@@ -1,5 +1,5 @@
-import { j as PolicyVocabulary } from "./policy-types-DzwivBgR.js";
-import { r as PermDock } from "./permdock-D7eeLJER.js";
+import { j as PolicyVocabulary } from "./policy-types-n0uRTsW8.js";
+import { r as PermDock } from "./permdock-SV8ZINYT.js";
 //#region src/core/wrap.d.ts
 /** A wrapper an adapter applies to each instance it builds, as `withOtel` does. */
 type PermDockWrap = <V extends PolicyVocabulary>(permdock: PermDock<V>) => PermDock<V>;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "permdock",
-  "version": "0.5.0",
+  "version": "0.6.0",
   "description": "Typed permissions for TypeScript apps, APIs, databases, and AI agents, with the permdock CLI and test runners.",
   "keywords": [
     "ai-agents",
@@ -402,7 +402,7 @@
     "@trpc/server": ">=11",
     "ai": ">=5",
     "astro": ">=5",
-    "better-supabase": ">=0.9.0 <0.10.0",
+    "better-supabase": ">=0.9.0",
     "chat": ">=4",
     "drizzle-orm": ">=0.40 || >=1.0.0-rc.0",
     "elysia": ">=1",

package/skills/permdock-data/references/queries-and-rls.md

@@ -39,7 +39,7 @@ pnpm exec permdock rls verify --introspect
 - Generated policies call `permdock_has('<key>')` and one `permitted_<scope>_ids('<key>')` per declared scope, which Postgres runs once per statement. Hand-written policies that only need membership (an organization switcher) call `member_<scope>_ids()` instead of inventing a permission key. Trusted SQL that acts for a stored user (a job, a trigger, a deferred approval) calls `permdock_has_for(p_user, '<key>')` and `permitted_<scope>_ids_for(p_user, '<key>')` in `database` mode, or the generated `permitted_<resource>_rows_for`, never a hand-written function that rewrites `request.jwt.claims`. With `rls.rowHelpers`, a hand-written policy or function that needs the rows a permission reaches through the graph calls `permitted_<resource>_rows('<permission key>')` instead of restating closure walks, link hops and `includes`. A table's own `select` or `insert` policy calls the row-valued `permitted_<resource>_row(<table>, '<permission key>')` instead, so `insert ... returning` sees the new row. Hand-written policies and functions that apply no row condition call `permitted_<scope>_ids_by_permission('<permission key>')` or `permdock_has_permission('<permission key>')` instead of spelling a positional `#n` grant key. A screen or RPC that checks many permissions on one organization calls `permitted_<scope>_permission_keys(<id>)` once (or `(<id>, array['<key>', ...])` for a few keys) instead of one helper call per key. A role editor or admin screen lists a role's keys with `permdock_role_permissions(p_role, p_scope, p_tenant, p_scope_id)` (declared roles, and custom roles of the caller's tenant in `database` mode) and the catalog with `permdock_permission_keys()` (`permdock_permission_keys('<scope>')` for the keys a role on that scope can hold), instead of joining `role_permissions` and the custom-role tables by hand; server code reads any tenant's roles with `permdock_trusted_role_permissions`, granted through `rls.trustedReaders`. Set `--tenant-type` (or `rls.tenantType`, `rls.scopeTypes`) to the scope columns' types.
 - `--authorize database` (default) reads the membership tables per statement; map each under `rls.memberships.scopes.<scope>` with `columns` for its id and its ancestors', and `via` so roles with `for` apply: a column name, or `{ value: 'staff' }` when every row has that kind (never add a generated column for it). `--authorize jwt` reads token claims and stays stale until the token refreshes; keep the token lifetime at 3600 seconds or less (PD019).
 - The helpers narrow to the tenant claim (`rls.tenantClaim`) whenever the token carries one; the Supabase hook writes it from `activeFrom`. When the app takes the tenant from the URL and one session spans tenants, set `rls.tenants: 'all'` so the database admits every member tenant, and keep filtering each query by the URL's tenant.
-- `--policy-per-role` keeps one policy per role for review. `--custom-roles` (or `rls.customRoles: true`) resolves tenant-defined roles inside the `permdock_ceiling` view. In `database` mode, save a custom role with `permdock_replace_custom_role_grants(tenant, scope, scope_id, role, allow, deny, include)` and rename or delete it with `permdock_rename_custom_role_grants` and `permdock_delete_custom_role_grants`, never with hand-written `security definer` functions or direct writes; failures raise `22023` or `42501` with the reason as the `hint`. A platform custom role passes a null tenant and scope `global`. Seeds, jobs and backends with no member caller use the `permdock_trusted_*` variants, which keep the definition checks; grant `execute` on them to a backend role in a migration of your own, never to `authenticated`. Set `rls.customRoleWrites.requires` to the permission your role editor asserts (or `'manageRoles'`) so the database refuses members who may not manage roles (`manage-roles`).
+- `--policy-per-role` keeps one policy per role for review. `--custom-roles` (or `rls.customRoles: true`) resolves tenant-defined roles inside the `permdock_ceiling` view. In `database` mode, save a custom role with `permdock_replace_custom_role_grants(tenant, scope, scope_id, role, allow, deny, include)` and rename or delete it with `permdock_rename_custom_role_grants` and `permdock_delete_custom_role_grants`, never with hand-written `security definer` functions or direct writes; failures raise `22023` or `42501` with the reason as the `hint`. A platform custom role passes a null tenant and scope `global`; a shared custom role passes a null tenant and scope id at its scope. Seeds, jobs and backends with no member caller use the `permdock_trusted_*` variants, which keep the definition checks; grant `execute` on them to a backend role in a migration of your own, never to `authenticated`. Set `rls.customRoleWrites.requires` to the permission your role editor asserts (or `'manageRoles'`) so the database refuses members who may not manage roles (`manage-roles`).
 - `--force` (or `rls.force: true`) only when the app connects as the table owner. Create views over RLS tables `with (security_invoker = true)` (PD022).
 - When read grants set `fields` and clients read tables directly, add `--fields views --revoke-columns`: clients read `<table>_visible`, whose restricted columns are null unless a grant covers them. PD030 names columns still readable.
 - `rls.suspension` drops suspended users' roles and memberships of suspended scope instances, live in both modes. `scopes.<scope>.keep: [permissions.org.restore]` lets members of a suspended instance still hold those permissions (restore, cancel deletion, export) in the helpers, `authorize()`, the token hook and in process, where the membership carries `keep`; `doctor` PD061 lists them.

package/skills/permdock-tenancy/references/ownership-and-custom-roles.md

@@ -86,6 +86,7 @@ type CustomRole = {
 - `permdock.assignablePermissions({ tenant })` is the ceiling intersected with what the subject holds. `useAssignablePermissions()` in `permdock/react` builds the editor from it.
 - The save action runs `validateCustomRole(policy, role)` and refuses the role when `ok` is false or `permissions` contains a key outside `assignablePermissions()`. `dropped` names each entry left out (`unknown-permission`, `outside-ceiling`, `condition-not-allowed`, `unknown-level`, `unknown-role`).
 - A platform custom role (`scope: 'global'`, no `tenant`, `team` or `id`) is held through `principal.roles` and capped by the allows of declared global roles marked `assignable`. `CustomRoleSource.globalRoles({ held })` returns them; `customRoleSource(reader, { read: 'held', policy })` skips that read while every held global role is declared.
+- A shared custom role (`shared: true`, no `tenant`, `team` or `id`; `scope` below global, default the first) is defined once by the platform and held by name on a membership of its scope in any tenant. `CustomRoleSource.sharedRoles({ held })` returns them. Its name wins over a tenant custom role's: pass the shared roles to `validateCustomRole(policy, role, { shared })` in the save action, which refuses a clash with `name-taken`. Require a `meta.manageRoles` permission held through a global role before saving one.
 - A stored grant under a key renamed with `definePermissions(..., { renamed })` still resolves; `validateCustomRole` lists it in `renamed` as `{ from, to }`, and `permdock doctor` PD055 prints the `update` that rewrites it.
 - For generated RLS, add `--custom-roles` (or `rls.customRoles: true`) to `permdock rls generate`. Platform roles are rows with `scope = 'global'` and a null `tenant_id`, or the top-level `role_grants` claim in `jwt` mode. With levels, `custom_role_permissions` gains a `level` column and the claim writes `key@level`.
 - To adopt custom roles the app already stores in its own tables, set `rls.customRoles.from` and `rls.customRoleWrites.roles`, then run `permdock rls generate --backfill-out <migrations dir>/`. The migration saves each role through the trusted replace function, drops entries outside the ceiling with a warning, and skips roles that already have rows; never write the copy by hand ([backfill](https://permdock.com/docs/cli/rls#backfill-from-existing-tables)).

package/dist/catalog-DjhMYYCq.js

@@ -1 +0,0 @@
-export { t as catalogFile, n as runCatalog } from "./catalog-BECMPrwc.js";

package/dist/collect-FlXJlhus.js

@@ -1 +0,0 @@
-export { r as runCollect } from "./collect-CrZJJnEF.js";

package/dist/powersync-CbzkqL_M.js

@@ -1 +0,0 @@
-export { n as runPowerSync } from "./powersync-bYUDLOAO.js";

package/dist/pull-ByOks_Tg.js

@@ -1 +0,0 @@
-export { n as runCloudPull } from "./pull-BgIfno6w.js";

package/dist/run-CNsApDpd.js

@@ -1 +0,0 @@
-export { t as run } from "./run-DOfMtc9V.js";

package/dist/supabase-hook-CXcGpHqq.js

@@ -1 +0,0 @@
-export { i as runSupabase } from "./supabase-hook-DdDQhMlw.js";

package/dist/usage-CHOtwL19.js

@@ -1 +0,0 @@
-export { t as runUsage } from "./usage-T5mXq98v.js";

package/dist/watch-Cb-NcaUw.js

@@ -1 +0,0 @@
-export { i as watchCollect } from "./watch-CszoTJMq.js";