permdock 0.6.0 → 0.7.0

package/dist/{protected-RFGpakN9.d.ts → protected-BwZYL1X_.d.ts}

@@ -1,8 +1,9 @@
-import { Nn as Decision, j as PolicyVocabulary, nr as Membership } from "./policy-types-n0uRTsW8.js";
-import { r as Role, w as Permission } from "./vocabulary-CN8H_9UF.js";
-import { r as DescribeOptions, t as DecisionDescription } from "./describe-B5qgDvEW.js";
-import { a as FilterResult, c as PermissionSet, d as RolesOptions, f as SubjectView, l as PermissionState, o as GateMode, p as TenantView, r as ClientPermDock, s as GateView, t as ApprovalHandle } from "./types-B3_ooZgZ.js";
-import { r as ProtectedProps } from "./types-CX7AvRqP.js";
+import { Ln as Decision, j as PolicyVocabulary, or as Membership } from "./policy-types-B-F-qAZk.js";
+import { u as Permission } from "./permission-types-DhNEmoRG.js";
+import { r as Role } from "./vocabulary-Bg3eeT2H.js";
+import { r as DescribeOptions, t as DecisionDescription } from "./describe-O0SwYIK8.js";
+import { a as FilterResult, c as PermissionSet, d as RolesOptions, f as SubjectView, l as PermissionState, o as GateMode, p as TenantView, r as ClientPermDock, s as GateView, t as ApprovalHandle } from "./types-CKV71kKh.js";
+import { r as ProtectedProps } from "./types-CQVEQawv.js";
 import { ReactNode } from "react";
 //#region src/react/hooks.d.ts
 declare function usePermDock<V extends PolicyVocabulary = PolicyVocabulary>(): ClientPermDock<V>;

package/dist/{protected-BlF0F6wL.js → protected-DXE3cQYg.js}

@@ -1,5 +1,5 @@
-import { n as storeOf } from "./store-options-u0ycEe8s.js";
-import { c as rolesView, d as subjectView, f as tenantView, i as gateView, l as scopedTenant, n as describeWith, o as permissionSet, r as filterResult, s as protectedView, t as approvalHandle, u as slotContent } from "./views-DTIIO-oQ.js";
+import { n as storeOf } from "./store-options-B_poyYvg.js";
+import { c as rolesView, d as subjectView, f as tenantView, i as gateView, l as scopedTenant, n as describeWith, o as permissionSet, r as filterResult, s as protectedView, t as approvalHandle, u as slotContent } from "./views-BB8E9dTP.js";
 import { a as PermDockUiContext, i as PermDockStoreContext, r as PermDockSnapshotPromiseContext } from "./live-options-BaAFCIiu.js";
 import { Suspense, use, useMemo, useSyncExternalStore } from "react";
 import { jsx } from "react/jsx-runtime";

package/dist/{provider-B1al-AZz.js → provider-BQsTYYy0.js}

@@ -1,6 +1,6 @@
 import { t as compact } from "./compact-CAf557ZB.js";
-import { t as emptySnapshot } from "./from-snapshot-CTCMsFZk.js";
-import { t as adapterStore } from "./store-options-u0ycEe8s.js";
+import { t as emptySnapshot } from "./from-snapshot-Bz469dIh.js";
+import { t as adapterStore } from "./store-options-B_poyYvg.js";
 import { a as PermDockUiContext, i as PermDockStoreContext, n as useKeyed, r as PermDockSnapshotPromiseContext, t as useLiveOptions } from "./live-options-BaAFCIiu.js";
 import { useLayoutEffect, useMemo } from "react";
 import { jsx } from "react/jsx-runtime";

package/dist/{provider-DILL9oPK.d.ts → provider-Csk-THAn.d.ts}

@@ -1,4 +1,4 @@
-import { n as PermDockProviderProps } from "./types-CX7AvRqP.js";
+import { n as PermDockProviderProps } from "./types-CQVEQawv.js";
 import { ReactElement } from "react";
 //#region src/react/provider.d.ts
 declare function PermDockProvider(props: PermDockProviderProps): ReactElement;

package/dist/{provider-store-DM6DNcta.js → provider-store-IgqQipCO.js}

@@ -1,6 +1,6 @@
 import { t as compact } from "./compact-CAf557ZB.js";
-import { t as emptySnapshot } from "./from-snapshot-CTCMsFZk.js";
-import { i as isPromiseLike, t as adapterStore } from "./store-options-u0ycEe8s.js";
+import { t as emptySnapshot } from "./from-snapshot-Bz469dIh.js";
+import { i as isPromiseLike, t as adapterStore } from "./store-options-B_poyYvg.js";
 //#region src/client/provider-store.ts
 /**
 * Store options that read `read()` on every request, so a rotated token, a

package/dist/{pull-jEwbf80J.js → pull-CN5OLxrF.js}

@@ -1,15 +1,15 @@
 import { r as isRecord } from "./compact-CAf557ZB.js";
-import { t as catalogFingerprint } from "./catalog-fingerprint-CCP0-yQS.js";
-import { a as describeError } from "./errors-CWTY6uih.js";
+import { t as catalogFingerprint } from "./catalog-fingerprint-C144oW4M.js";
+import { a as describeError } from "./errors-DpP_U6Bf.js";
 import { s as writeFileEnsuringDir } from "./files-D_JIzUrP.js";
 import { s as cliVersion } from "./version-CEbQ5UeM.js";
-import { a as formatCatalogJson } from "./catalog-doc-Cdn7-0pQ.js";
+import { o as formatCatalogJson } from "./catalog-doc-CV9s6B1S.js";
 import { t as catalogPath } from "./catalog-path-CnI0XTFK.js";
-import { t as parseSupabaseManifest } from "./manifest-C8IzW3Do.js";
-import { t as parseCatalog } from "./parse-Cxq0WxrA.js";
+import { n as parseSupabaseManifest } from "./manifest-B79YuF2T.js";
+import { t as parseCatalog } from "./parse-Ddhz2xf4.js";
 import { t as POLICY_NOT_PUBLISHED } from "./problem-types-CJ2325SZ.js";
-import { n as httpRequest, t as authFailure } from "./http-DXJ37RDA.js";
-import { l as cloudUrl, n as cliRuntime, o as readAuth } from "./auth-DRLEizbL.js";
+import { n as httpRequest, t as authFailure } from "./http-Ca3Sr5x1.js";
+import { l as cloudUrl, n as cliRuntime, o as readAuth } from "./auth-CscUX8Sy.js";
 import { n as formatManifestJson } from "./manifest-json-CAGzls-C.js";
 import { existsSync, readFileSync, rmSync } from "node:fs";
 import { relative, resolve } from "node:path";

package/dist/pull-Cty6Ovyu.js

@@ -0,0 +1 @@
+export { n as runCloudPull } from "./pull-CN5OLxrF.js";

package/dist/{push-BD4f15co.js → push-tVdG8dUL.js}

@@ -1,13 +1,15 @@
-import { t as catalogFingerprint } from "./catalog-fingerprint-CCP0-yQS.js";
-import { a as describeError } from "./errors-CWTY6uih.js";
+import { r as isRecord } from "./compact-CAf557ZB.js";
+import { n as PermDockValidationError } from "./validation-error-ZfUHbKvf.js";
+import { t as catalogFingerprint } from "./catalog-fingerprint-C144oW4M.js";
+import { a as describeError, n as CliError } from "./errors-DpP_U6Bf.js";
 import { s as cliVersion } from "./version-CEbQ5UeM.js";
-import { i as loadConfiguredPolicy } from "./load-DFS_ry0W.js";
-import { t as parseSupabaseManifest } from "./manifest-C8IzW3Do.js";
-import { t as parseCatalog } from "./parse-Cxq0WxrA.js";
-import { r as pushedPolicy } from "./pushed-policy-CqtxkV4G.js";
-import { n as runCatalog } from "./catalog-HD2gf5mY.js";
-import { n as httpRequest, t as authFailure } from "./http-DXJ37RDA.js";
-import { a as pushAuth, l as cloudUrl, n as cliRuntime, u as firstNonEmpty } from "./auth-DRLEizbL.js";
+import { i as loadConfiguredPolicy } from "./load-DxroEzH1.js";
+import { n as parseSupabaseManifest } from "./manifest-B79YuF2T.js";
+import { t as parseCatalog } from "./parse-Ddhz2xf4.js";
+import { r as pushedPolicy } from "./pushed-policy-CmYeSQqq.js";
+import { n as runCatalog } from "./catalog-D69WhFii.js";
+import { n as httpRequest, t as authFailure } from "./http-Ca3Sr5x1.js";
+import { a as pushAuth, l as cloudUrl, n as cliRuntime, u as firstNonEmpty } from "./auth-CscUX8Sy.js";
 import "./manifest-json-CAGzls-C.js";
 import { existsSync, readFileSync } from "node:fs";
 import { resolve } from "node:path";
@@ -34,6 +36,43 @@ function readManifest(cwd, flag) {
 		};
 	}
 }
+/** The built catalog, or a `catalog_invalid` problem listing every issue with its path. */
+function checkedCatalog(output) {
+	try {
+		return parseCatalog(output);
+	} catch (error) {
+		if (!(error instanceof PermDockValidationError)) throw error;
+		const issues = error.issues.map((issue) => ({
+			path: (issue.path ?? []).map(String).join("."),
+			message: issue.message
+		}));
+		throw new CliError("failed", [`permdock cloud push: the catalog has ${String(issues.length)} ${issues.length === 1 ? "issue" : "issues"}`, ...issues.map((issue) => `  ${issue.path}: ${issue.message}`)].join("\n"), {
+			code: "catalog_invalid",
+			extensions: { issues }
+		});
+	}
+}
+/** The environment `GET /v1/environment` names for the push credential. */
+async function keyEnvironment(io, url, bearer) {
+	const response = await httpRequest(io, {
+		url: `${url}/v1/environment`,
+		service: "PermDock Cloud",
+		headers: {
+			authorization: `Bearer ${bearer}`,
+			accept: "application/json"
+		}
+	});
+	const body = response.ok ? await response.json().catch(() => void 0) : void 0;
+	const environment = isRecord(body) ? body["environment"] : void 0;
+	if (typeof environment === "string" && environment !== "") return environment;
+	throw new CliError("failed", `permdock cloud push: PermDock Cloud did not name the credential's environment (HTTP ${String(response.status)})`, { next: [{
+		command: "permdock cloud push --project <environment>",
+		when: "to name the environment"
+	}, {
+		command: "export PERMDOCK_CLOUD_ENV=<environment>",
+		when: "in CI"
+	}] });
+}
 async function runCloud(input) {
 	const manifest = readManifest(input.cwd, input.manifest);
 	if (!manifest.ok) return {
@@ -53,7 +92,7 @@ async function runCloud(input) {
 		code: built.code,
 		output: built.output
 	};
-	const catalog = parseCatalog(built.output);
+	const catalog = checkedCatalog(built.output);
 	const fingerprint = catalogFingerprint(catalog);
 	const loaded = await loadConfiguredPolicy(input.cwd, input.config.policy);
 	const policy = loaded === void 0 ? void 0 : pushedPolicy(loaded);
@@ -68,17 +107,18 @@ async function runCloud(input) {
 		manifest: manifest.manifest !== void 0
 	};
 	const url = cloudUrl(input.url, input.env);
-	const environment = firstNonEmpty(input.project, input.env["PERMDOCK_CLOUD_ENV"], input.env["VERCEL_ENV"], "production");
-	const describe = (verb) => input.json ? JSON.stringify({
+	const configured = firstNonEmpty(input.project, input.env["PERMDOCK_CLOUD_ENV"]);
+	const describe = (verb, environment) => input.json ? JSON.stringify({
 		...summary,
 		environment,
 		status: verb
 	}) : `${verb} catalog ${fingerprint} (${String(summary.permissions)} permissions, ${String(hostable.length)} hostable${summary.manifest ? ", with manifest" : ""}) to ${environment}`;
 	if (input.dryRun) return {
 		code: 0,
-		output: describe("would push")
+		output: describe("would push", configured === "" ? "the key's environment" : configured)
 	};
 	const auth = await pushAuth(url, input.env, cliRuntime(input.io, input.env));
+	const environment = configured === "" ? await keyEnvironment(input.io, url, auth.bearer) : configured;
 	const response = await httpRequest(input.io, {
 		url: `${url}/v1/environments/${encodeURIComponent(environment)}/catalog`,
 		method: "POST",
@@ -109,7 +149,7 @@ async function runCloud(input) {
 	};
 	return {
 		code: 0,
-		output: describe("pushed")
+		output: describe("pushed", environment)
 	};
 }
 //#endregion

package/dist/{pushed-policy-DCW91KQU.d.ts → pushed-policy-BbcY9r_4.d.ts}

@@ -1,4 +1,4 @@
-import { Gt as SnapshotScope, H as WireValidity, T as Policy, _ as GrantLimit, a as ApprovalRequirement, bn as Grantee, jn as AppObligation, u as BreakGlassSpec, ur as Condition, v as GrantMeta } from "./policy-types-n0uRTsW8.js";
+import { Fn as AppObligation, H as WireValidity, T as Policy, Yt as SnapshotScope, _ as GrantLimit, a as ApprovalRequirement, mr as Condition, u as BreakGlassSpec, v as GrantMeta, wn as Grantee } from "./policy-types-B-F-qAZk.js";
 import { t as JsonSchemaNode } from "./json-schema-CN_iLFH2.js";
 //#region src/catalog/pushed-policy.d.ts
 /**

package/dist/{pushed-policy-CqtxkV4G.js → pushed-policy-CmYeSQqq.js}

@@ -3,7 +3,7 @@ import { n as freezeDeep } from "./freeze-CrU8nQeX.js";
 import { n as PermDockValidationError } from "./validation-error-ZfUHbKvf.js";
 import { n as RFC3339_PATTERN } from "./time-DkWjdL98.js";
 import { i as wireValidity } from "./validity-CZ7-y0Cj.js";
-import { n as snapshotScopes } from "./instance-snapshot-BOEhcqIF.js";
+import { n as snapshotScopes } from "./instance-snapshot-CjcwnEiV.js";
 import { n as copyJson, r as forbiddenKeyPath, t as checkSchema } from "./json-schema-B-vAwlde.js";
 //#region src/catalog/pushed-policy.ts
 const strings = {

package/dist/react/index.d.ts

@@ -1,8 +1,8 @@
-import { n as requiredPlans } from "../problem-details-B45V5d2b.js";
-import { i as describe } from "../describe-B5qgDvEW.js";
+import { n as requiredPlans } from "../problem-details-Tcfmj3bV.js";
+import { i as describe } from "../describe-O0SwYIK8.js";
 import { t as approvalHeaders } from "../headers-CIbDTUTK.js";
-import { a as FilterResult, c as PermissionSet, f as SubjectView, i as ClientStatus, l as PermissionState, n as ApprovalState, o as GateMode, p as TenantView, r as ClientPermDock, s as GateView, t as ApprovalHandle } from "../types-B3_ooZgZ.js";
-import { n as PermDockProviderProps, r as ProtectedProps, t as PermDockDefaults } from "../types-CX7AvRqP.js";
-import { a as useDescribe, c as useMemberships, d as usePermissions, f as useRoles, i as useAssignableRoles, l as usePermDock, m as useTenant, n as useApproval, o as useFilter, p as useSubject, r as useAssignablePermissions, s as useGate, t as Protected, u as usePermission } from "../protected-RFGpakN9.js";
-import { t as PermDockProvider } from "../provider-DILL9oPK.js";
+import { a as FilterResult, c as PermissionSet, f as SubjectView, i as ClientStatus, l as PermissionState, n as ApprovalState, o as GateMode, p as TenantView, r as ClientPermDock, s as GateView, t as ApprovalHandle } from "../types-CKV71kKh.js";
+import { n as PermDockProviderProps, r as ProtectedProps, t as PermDockDefaults } from "../types-CQVEQawv.js";
+import { a as useDescribe, c as useMemberships, d as usePermissions, f as useRoles, i as useAssignableRoles, l as usePermDock, m as useTenant, n as useApproval, o as useFilter, p as useSubject, r as useAssignablePermissions, s as useGate, t as Protected, u as usePermission } from "../protected-BwZYL1X_.js";
+import { t as PermDockProvider } from "../provider-Csk-THAn.js";
 export { type ApprovalHandle, type ApprovalState, type ClientPermDock, type ClientStatus, type FilterResult, type GateMode, type GateView, type PermDockDefaults, PermDockProvider, type PermDockProviderProps, type PermissionSet, type PermissionState, Protected, type ProtectedProps, type SubjectView, type TenantView, approvalHeaders, describe, requiredPlans, useApproval, useAssignablePermissions, useAssignableRoles, useDescribe, useFilter, useGate, useMemberships, usePermDock, usePermission, usePermissions, useRoles, useSubject, useTenant };

package/dist/react/index.js

@@ -1,7 +1,7 @@
 "use client";
 import { r as requiredPlans } from "../problem-details-cn5X30gZ.js";
-import { t as describe } from "../describe-BybMRY7A.js";
+import { t as describe } from "../describe-DZlnEtLy.js";
 import { t as approvalHeaders } from "../headers-BIjfMaoC.js";
-import { a as useDescribe, c as useMemberships, d as usePermissions, f as useRoles, i as useAssignableRoles, l as usePermDock, m as useTenant, n as useApproval, o as useFilter, p as useSubject, r as useAssignablePermissions, s as useGate, t as Protected, u as usePermission } from "../protected-BlF0F6wL.js";
-import { t as PermDockProvider } from "../provider-B1al-AZz.js";
+import { a as useDescribe, c as useMemberships, d as usePermissions, f as useRoles, i as useAssignableRoles, l as usePermDock, m as useTenant, n as useApproval, o as useFilter, p as useSubject, r as useAssignablePermissions, s as useGate, t as Protected, u as usePermission } from "../protected-DXE3cQYg.js";
+import { t as PermDockProvider } from "../provider-BQsTYYy0.js";
 export { PermDockProvider, Protected, approvalHeaders, describe, requiredPlans, useApproval, useAssignablePermissions, useAssignableRoles, useDescribe, useFilter, useGate, useMemberships, usePermDock, usePermission, usePermissions, useRoles, useSubject, useTenant };

package/dist/react/provider-client.d.ts

@@ -1,2 +1,2 @@
-import { t as PermDockProvider } from "../provider-DILL9oPK.js";
+import { t as PermDockProvider } from "../provider-Csk-THAn.js";
 export { PermDockProvider };

package/dist/react/provider-client.js

@@ -1,2 +1,2 @@
 "use client";
-export { t as PermDockProvider } from "../provider-B1al-AZz.js";
+export { t as PermDockProvider } from "../provider-BQsTYYy0.js";

package/dist/react-native/index.d.ts

@@ -1,13 +1,13 @@
-import { Bt as LocalSnapshotManifest, Rt as Instant, Vt as Snapshot, Zn as CustomRole, nr as Membership, ot as SnapshotSource } from "../policy-types-n0uRTsW8.js";
-import { w as Permission } from "../vocabulary-CN8H_9UF.js";
-import { n as requiredPlans } from "../problem-details-B45V5d2b.js";
-import { i as describe } from "../describe-B5qgDvEW.js";
-import { t as parseLocalSnapshotManifest } from "../parse-local-manifest-5ODwqu8b.js";
+import { Bt as LocalMembershipRows, Gt as Snapshot, Ht as LocalRowValue, Rt as Instant, Ut as LocalSnapshotManifest, Vt as LocalRowColumn, Wt as LocalSnapshotRows, or as Membership, ot as SnapshotSource, tr as CustomRole } from "../policy-types-B-F-qAZk.js";
+import { u as Permission } from "../permission-types-DhNEmoRG.js";
+import { n as requiredPlans } from "../problem-details-Tcfmj3bV.js";
+import { i as describe } from "../describe-O0SwYIK8.js";
+import { t as parseLocalSnapshotManifest } from "../parse-local-manifest-e4mdwAKd.js";
 import { t as approvalHeaders } from "../headers-CIbDTUTK.js";
-import { a as FilterResult, c as PermissionSet, f as SubjectView, i as ClientStatus, l as PermissionState, m as ClientStore, n as ApprovalState, o as GateMode, p as TenantView, r as ClientPermDock, s as GateView, t as ApprovalHandle } from "../types-B3_ooZgZ.js";
-import { r as ProtectedProps, t as PermDockDefaults } from "../types-CX7AvRqP.js";
-import { a as useDescribe, c as useMemberships, d as usePermissions, f as useRoles, i as useAssignableRoles, l as usePermDock, m as useTenant, n as useApproval, o as useFilter, p as useSubject, r as useAssignablePermissions, s as useGate, t as Protected, u as usePermission } from "../protected-RFGpakN9.js";
-import { a as SubscribeOnline, i as SubscribeForeground, n as ReactNativePermDockProviderProps, r as SnapshotStorage, t as NativeRevalidate } from "../types-C863OQiR.js";
+import { a as FilterResult, c as PermissionSet, f as SubjectView, i as ClientStatus, l as PermissionState, m as ClientStore, n as ApprovalState, o as GateMode, p as TenantView, r as ClientPermDock, s as GateView, t as ApprovalHandle } from "../types-CKV71kKh.js";
+import { r as ProtectedProps, t as PermDockDefaults } from "../types-CQVEQawv.js";
+import { a as useDescribe, c as useMemberships, d as usePermissions, f as useRoles, i as useAssignableRoles, l as usePermDock, m as useTenant, n as useApproval, o as useFilter, p as useSubject, r as useAssignablePermissions, s as useGate, t as Protected, u as usePermission } from "../protected-BwZYL1X_.js";
+import { a as SubscribeOnline, i as SubscribeForeground, n as ReactNativePermDockProviderProps, r as SnapshotStorage, t as NativeRevalidate } from "../types-CeIscIKp.js";
 import { ReactElement } from "react";
 //#region src/react-native/guards.d.ts
 /** `true` once the provider has a snapshot to answer from: storage was read or a seed was given. Hide the splash screen on it. */
@@ -77,10 +77,24 @@ type PowerSyncSourceOptions<Q extends string> = {
   readonly queries: Readonly<Record<Q, PowerSyncQuery>>;
   /** Maps the rows of each query to the signed-in user's memberships and roles. */
   readonly read: (rows: Readonly<Record<Q, readonly unknown[]>>) => LocalSnapshotData;
+} | {
+  /** The manifest `permdock powersync generate` writes, with its `rows` section. */
+  readonly manifest: LocalSnapshotManifest;
+  /** The signed-in user's id; the source reads the rows `manifest.rows` names. */
+  readonly user: string;
+  /** The active tenant: the first scope's instance the UI shows. */
+  readonly tenant?: string;
+  /** Attributes conditions read, such as `claims` for `principal.claims.team_ids`. */
+  readonly attributes?: Readonly<Record<string, unknown>>;
+  readonly queries?: undefined;
+  readonly read?: undefined;
 };
 /**
  * A `localSnapshot` source over a PowerSync database: `get` runs every query
- * with `db.getAll`, and a `db.watch` per query reports changes. A watch
+ * with `db.getAll`, and a `db.watch` per query reports changes. Without
+ * `queries` and `read`, it reads the tables `manifest.rows` names: the
+ * memberships of every source with null roles dropped, the global roles and
+ * the custom roles with their levels. A watch
  * result with unchanged content re-renders nothing (`connectSource`). The source
  * takes the database as an argument; `permdock/react-native` never imports
  * `@powersync/*`.
@@ -156,4 +170,4 @@ type NativeStoreOptions = Omit<ReactNativePermDockProviderProps, "children" | "h
 export declare function connectSource(store: ClientStore, source: SnapshotSource, subscribeForeground?: SubscribeForeground): () => void;
 export declare function nativeStore(options: NativeStoreOptions): ClientStore;
 //#endregion
-export { type AppStateModule, type ApprovalHandle, type ApprovalState, type ClientPermDock, type ClientStatus, type FilterResult, type GateMode, type GateView, type LocalSnapshotData, type LocalSnapshotManifest, type LocalSnapshotOptions, type MmkvInstance, type NativeRevalidate, type NetInfoModule, type PermDockDefaults, type PermissionSet, type PermissionState, type PowerSyncQuery, type PowerSyncSourceOptions, type PowerSyncWatchable, Protected, type ProtectedProps, type ReactNativePermDockProviderProps, type SecureStoreModule, type SnapshotSource, type SnapshotStorage, type SubjectView, type SubscribeForeground, type SubscribeOnline, type TenantView, approvalHeaders, describe, parseLocalSnapshotManifest, requiredPlans, useApproval, useAssignablePermissions, useAssignableRoles, useDescribe, useFilter, useGate, useMemberships, usePermDock, usePermission, usePermissions, useRoles, useSubject, useTenant };
+export { type AppStateModule, type ApprovalHandle, type ApprovalState, type ClientPermDock, type ClientStatus, type FilterResult, type GateMode, type GateView, type LocalMembershipRows, type LocalRowColumn, type LocalRowValue, type LocalSnapshotData, type LocalSnapshotManifest, type LocalSnapshotOptions, type LocalSnapshotRows, type MmkvInstance, type NativeRevalidate, type NetInfoModule, type PermDockDefaults, type PermissionSet, type PermissionState, type PowerSyncQuery, type PowerSyncSourceOptions, type PowerSyncWatchable, Protected, type ProtectedProps, type ReactNativePermDockProviderProps, type SecureStoreModule, type SnapshotSource, type SnapshotStorage, type SubjectView, type SubscribeForeground, type SubscribeOnline, type TenantView, approvalHeaders, describe, parseLocalSnapshotManifest, requiredPlans, useApproval, useAssignablePermissions, useAssignableRoles, useDescribe, useFilter, useGate, useMemberships, usePermDock, usePermission, usePermissions, useRoles, useSubject, useTenant };

package/dist/react-native/index.js

@@ -1,20 +1,20 @@
 "use client";
-import { t as compact } from "../compact-CAf557ZB.js";
+import { r as isRecord, t as compact } from "../compact-CAf557ZB.js";
 import { n as freezeDeep } from "../freeze-CrU8nQeX.js";
 import { r as requiredPlans } from "../problem-details-cn5X30gZ.js";
-import { t as describe } from "../describe-BybMRY7A.js";
+import { t as describe } from "../describe-DZlnEtLy.js";
 import { n as isThenable } from "../thenable-yD7SabqG.js";
 import { h as secondsAt, m as rfc3339 } from "../time-DkWjdL98.js";
-import { a as normalizeMemberships, d as scopeList, m as tenantOf$1, o as resolveScope } from "../scopes-CUPSjo9q.js";
-import { o as flattenGrantee } from "../grantee-hxrUsbpM.js";
-import { d as resolveActiveTenant } from "../tenancy-DN2QAx9z.js";
-import { i as bindConditionRefs, n as parseSnapshot } from "../snapshot-B7DkYg6g.js";
-import { r as heldRoleNames, t as emptySnapshot } from "../from-snapshot-CTCMsFZk.js";
-import { t as parseLocalSnapshotManifest } from "../parse-local-manifest-CVSs6J9I.js";
+import { f as scopeList, h as tenantOf$1, o as normalizeMemberships, s as resolveScope } from "../scopes-BHsc-wp-.js";
+import { o as flattenGrantee } from "../grantee-BrRANrpT.js";
+import { d as resolveActiveTenant } from "../tenancy-CmeBQ6Nv.js";
+import { i as bindConditionRefs, n as parseSnapshot } from "../snapshot-CbGmYiJx.js";
+import { r as heldRoleNames, t as emptySnapshot } from "../from-snapshot-Bz469dIh.js";
+import { t as parseLocalSnapshotManifest } from "../parse-local-manifest-T1Q8X3A2.js";
 import { t as approvalHeaders } from "../headers-BIjfMaoC.js";
-import { n as storeOf, r as isJws, t as adapterStore } from "../store-options-u0ycEe8s.js";
+import { n as storeOf, r as isJws, t as adapterStore } from "../store-options-B_poyYvg.js";
 import { a as PermDockUiContext, i as PermDockStoreContext, n as useKeyed, t as useLiveOptions } from "../live-options-BaAFCIiu.js";
-import { a as useDescribe, c as useMemberships, d as usePermissions, f as useRoles, i as useAssignableRoles, l as usePermDock, m as useTenant, n as useApproval, o as useFilter, p as useSubject, r as useAssignablePermissions, s as useGate, t as Protected, u as usePermission } from "../protected-BlF0F6wL.js";
+import { a as useDescribe, c as useMemberships, d as usePermissions, f as useRoles, i as useAssignableRoles, l as usePermDock, m as useTenant, n as useApproval, o as useFilter, p as useSubject, r as useAssignablePermissions, s as useGate, t as Protected, u as usePermission } from "../protected-DXE3cQYg.js";
 import { useEffect, useMemo, useRef } from "react";
 import { jsx } from "react/jsx-runtime";
 //#region src/react-native/guards.ts
@@ -216,33 +216,221 @@ function localSnapshot(options) {
 	});
 }
 //#endregion
+//#region src/react-native/powersync-rows.ts
+function isColumns(roles) {
+	return Array.isArray(roles);
+}
+function quoted(name) {
+	return `"${name.replaceAll("\"", "\"\"")}"`;
+}
+/** The synced tables `rows` names, each read whole: the subject streams sync only the user's own rows. */
+function rowTables(rows) {
+	const tables = /* @__PURE__ */ new Set();
+	const column = (item) => {
+		if ("through" in item) tables.add(item.through.table);
+	};
+	for (const source of rows.memberships) {
+		tables.add(source.table);
+		column(source.user);
+		if (isColumns(source.roles)) for (const item of source.roles) column(item);
+	}
+	if (rows.roles !== void 0) {
+		tables.add(rows.roles.table);
+		for (const item of rows.roles.roles) column(item);
+	}
+	if (rows.customRoles !== void 0) {
+		tables.add(rows.customRoles.permissions);
+		tables.add(rows.customRoles.includes);
+	}
+	return [...tables];
+}
+function rowQuery(table) {
+	return `SELECT * FROM ${quoted(table)}`;
+}
+function text(value) {
+	if (typeof value === "string") return value === "" ? void 0 : value;
+	return typeof value === "number" || typeof value === "bigint" ? String(value) : void 0;
+}
+function isSet(row, column) {
+	const value = column === void 0 ? void 0 : row[column];
+	return value !== void 0 && value !== null;
+}
+function rowsOf(tables, table) {
+	return (tables[table] ?? []).filter(isRecord);
+}
+/** The value a column holds, read through its referenced table or map; `undefined` for none. */
+function columnValue(row, column, tables) {
+	const raw = text(row[column.column]);
+	if (raw === void 0) return;
+	if ("through" in column) {
+		const { through } = column;
+		const target = rowsOf(tables, through.table).find((item) => text(item[through.id]) === raw);
+		return target === void 0 ? void 0 : text(target[through.column]);
+	}
+	if ("map" in column) return Object.hasOwn(column.map, raw) ? column.map[raw] ?? void 0 : void 0;
+	return raw;
+}
+function membershipsOf(source, tables, user) {
+	const byInstance = /* @__PURE__ */ new Map();
+	for (const row of rowsOf(tables, source.table)) {
+		if (columnValue(row, source.user, tables) !== user || isSet(row, source.expiresAt) || isSet(row, source.disabledAt)) continue;
+		const scope = "value" in source.scope ? source.scope.value : text(row[source.scope.column]);
+		const id = text(row[source.id]);
+		const via = source.via === void 0 ? void 0 : "value" in source.via ? source.via.value : text(row[source.via.column]);
+		const roles = isColumns(source.roles) ? source.roles.flatMap((column) => {
+			const key = columnValue(row, column, tables);
+			return key === void 0 ? [] : [key];
+		}) : source.roles.value;
+		if (scope === void 0 || id === void 0 || roles.length === 0) continue;
+		const key = JSON.stringify([
+			scope,
+			id,
+			via ?? null
+		]);
+		const entry = byInstance.get(key) ?? {
+			scope,
+			id,
+			via,
+			roles: /* @__PURE__ */ new Set()
+		};
+		for (const role of roles) entry.roles.add(role);
+		byInstance.set(key, entry);
+	}
+	return [...byInstance.values()].map((entry) => compact({
+		scope: entry.scope,
+		id: entry.id,
+		roles: [...entry.roles].toSorted(),
+		via: entry.via
+	}));
+}
+function roleKeyOf(row) {
+	const name = text(row["role"]);
+	const scope = text(row["scope"]);
+	return name === void 0 || scope === void 0 ? void 0 : {
+		tenant: text(row["tenant_id"]),
+		scope,
+		id: text(row["scope_id"]),
+		name
+	};
+}
+function customRoleOf({ key, grants, includes }) {
+	const body = {
+		name: key.name,
+		grants,
+		includes
+	};
+	if (key.scope === "global") return {
+		...body,
+		scope: "global"
+	};
+	if (key.tenant === void 0) return {
+		...body,
+		shared: true,
+		scope: key.scope
+	};
+	return compact({
+		...body,
+		tenant: key.tenant,
+		scope: key.scope,
+		id: key.id
+	});
+}
+/** Custom roles from the custom-role rows: a tenant role, a shared role (no tenant) or a global role. */
+function customRolesOf(permissions, includes) {
+	const roles = /* @__PURE__ */ new Map();
+	const entry = (key) => {
+		const id = JSON.stringify([
+			key.tenant ?? null,
+			key.scope,
+			key.id ?? null,
+			key.name
+		]);
+		const found = roles.get(id) ?? {
+			key,
+			grants: [],
+			includes: []
+		};
+		roles.set(id, found);
+		return found;
+	};
+	for (const row of permissions) {
+		const key = roleKeyOf(row);
+		const permission = text(row["permission"]);
+		const effect = row["effect"] === "deny" ? "deny" : "allow";
+		const level = text(row["level"]);
+		if (key !== void 0 && permission !== void 0) entry(key).grants.push(compact({
+			permission,
+			effect,
+			level
+		}));
+	}
+	for (const row of includes) {
+		const key = roleKeyOf(row);
+		const include = text(row["include_role"]);
+		if (key !== void 0 && include !== void 0) entry(key).includes.push(include);
+	}
+	return [...roles.values()].map(customRoleOf);
+}
+/** The user's memberships, global roles and custom roles from the rows of the tables `rows` names. */
+function readRows(rows, tables, principal) {
+	const { id: user, tenant, attributes } = principal;
+	const memberships = rows.memberships.flatMap((source) => membershipsOf(source, tables, user));
+	const global = rows.roles;
+	const roles = global === void 0 ? [] : rowsOf(tables, global.table).flatMap((row) => text(row[global.user]) === user ? global.roles.flatMap((column) => {
+		const key = columnValue(row, column, tables);
+		return key === void 0 ? [] : [key];
+	}) : []);
+	const custom = rows.customRoles;
+	return {
+		principal: {
+			id: user,
+			roles: [...new Set(roles)].toSorted(),
+			memberships,
+			...tenant === void 0 ? {} : { tenant },
+			...attributes === void 0 ? {} : { attributes }
+		},
+		...custom === void 0 ? {} : { customRoles: customRolesOf(rowsOf(tables, custom.permissions), rowsOf(tables, custom.includes)) }
+	};
+}
+//#endregion
 //#region src/react-native/powersync.ts
+function planOf(options) {
+	if (!("user" in options)) return options;
+	const { rows } = options.manifest;
+	if (rows === void 0) throw new TypeError("PermDock: powerSyncSource needs queries and read, or a manifest with rows (run permdock powersync generate with powersync.manifest)");
+	const principal = compact({
+		id: options.user,
+		tenant: options.tenant,
+		attributes: options.attributes
+	});
+	return {
+		queries: Object.fromEntries(rowTables(rows).map((table) => [table, { sql: rowQuery(table) }])),
+		read: (tables) => readRows(rows, tables, principal)
+	};
+}
 /**
 * A `localSnapshot` source over a PowerSync database: `get` runs every query
-* with `db.getAll`, and a `db.watch` per query reports changes. A watch
+* with `db.getAll`, and a `db.watch` per query reports changes. Without
+* `queries` and `read`, it reads the tables `manifest.rows` names: the
+* memberships of every source with null roles dropped, the global roles and
+* the custom roles with their levels. A watch
 * result with unchanged content re-renders nothing (`connectSource`). The source
 * takes the database as an argument; `permdock/react-native` never imports
 * `@powersync/*`.
 */
 function powerSyncSource(db, options) {
-	const names = Object.keys(options.queries);
+	const plan = planOf(options);
 	return localSnapshot({
 		manifest: options.manifest,
 		read: async () => {
-			const results = await Promise.all(names.map(async (name) => {
-				const query = options.queries[name];
+			const results = await Promise.all(Object.entries(plan.queries).map(async ([name, query]) => {
 				return [name, await db.getAll(query.sql, [...query.parameters ?? []])];
 			}));
-			const rows = {};
-			for (const [name, list] of results) rows[name] = list;
-			return options.read(rows);
+			return plan.read(Object.fromEntries(results));
 		},
 		subscribe: (listener) => {
 			const controller = new AbortController();
-			for (const name of names) {
-				const query = options.queries[name];
-				db.watch(query.sql, [...query.parameters ?? []], { onResult: listener }, { signal: controller.signal });
-			}
+			for (const query of Object.values(plan.queries)) db.watch(query.sql, [...query.parameters ?? []], { onResult: listener }, { signal: controller.signal });
 			return () => {
 				controller.abort();
 			};

package/dist/{refs-K6eWUJ0H.js → refs-CNJBiTFo.js}

@@ -68,6 +68,20 @@ function createRef(path) {
 }
 const principal = createRef("principal");
 const context = createRef("context");
+/**
+* `principal.claims.<path>` for a dot path such as `team_ids` or
+* `attrs.region`, typed `SubjectRef` under `noUncheckedIndexedAccess` and
+* `noPropertyAccessFromIndexSignature`.
+*/
+function claim(path) {
+	const segments = splitPath(path);
+	if (segments.length === 0) throw new Error("PermDock: claim() needs a claim path");
+	return createRef([
+		"principal",
+		"claims",
+		...segments
+	].join("."));
+}
 function isSubjectRef(value) {
 	if (value === null || typeof value !== "object" || !("ref" in value) || typeof value.ref !== "string") return false;
 	const ref = value.ref;
@@ -88,4 +102,4 @@ function resolveConditionRef(ref, resolved) {
 	}
 }
 //#endregion
-export { hasConditionOp as a, isConditionRef as c, resolveConditionRef as i, isSqlFunctionField as l, isSubjectRef as n, isCondition as o, principal as r, isConditionDate as s, context as t, parentHop as u };
+export { resolveConditionRef as a, isConditionDate as c, parentHop as d, principal as i, isConditionRef as l, context as n, hasConditionOp as o, isSubjectRef as r, isCondition as s, claim as t, isSqlFunctionField as u };

package/dist/{replay-Bkm-Ne4l.d.ts → replay-DCDD_ZfL.d.ts}

@@ -1,4 +1,4 @@
-import { l as ReplayStore } from "./types-C791HFu9.js";
+import { l as ReplayStore } from "./types-cTos-H7p.js";
 //#region src/ssf/replay.d.ts
 declare function memoryReplayStore(): ReplayStore;
 //#endregion

package/dist/{request-context-C81Pip9n.js → request-context-BykKLmyE.js}

@@ -1,6 +1,6 @@
 import { t as assertAppData } from "./app-data-MuyzVqX8.js";
-import { n as wrapPermDock } from "./wrap-gX61EtpB.js";
-import { t as buildInstance } from "./build-instance-Bu_eDqYw.js";
+import { n as wrapPermDock } from "./wrap-CiSc_KCq.js";
+import { t as buildInstance } from "./build-instance-DxE7czo9.js";
 //#region src/core/request-context.ts
 /**
 * Errors an adapter raises around one instance (a `context` hook that threw,

package/dist/resend/index.d.ts

@@ -1,7 +1,7 @@
-import { q as DecisionSink } from "../policy-types-n0uRTsW8.js";
-import { n as ApprovalUrl, t as ApprovalPrompt } from "../approval-prompt-DvSSPQJX.js";
-import { d as EmailTransport, o as DeliveryResult, u as EmailMessage } from "../types-BtHtcKMr.js";
-import { l as ReplayStore } from "../types-C791HFu9.js";
+import { q as DecisionSink } from "../policy-types-B-F-qAZk.js";
+import { n as ApprovalUrl, t as ApprovalPrompt } from "../approval-prompt-K0faOLFp.js";
+import { d as EmailTransport, o as DeliveryResult, u as EmailMessage } from "../types-g7Oy6Zg4.js";
+import { l as ReplayStore } from "../types-cTos-H7p.js";
 //#region src/resend/approval-email.d.ts
 type ApprovalEmailOptions = {
   /** The app's approval page: a base the request id is appended to, or a function of the prompt. Must be https. */