permdock 0.7.0 → 0.9.0

package/dist/{postgres-store-BL9M_CA1.js → postgres-store-DcyrPS-r.js}

@@ -1,7 +1,7 @@
 import { r as isRecord, t as compact } from "./compact-CAf557ZB.js";
-import { n as freezeDeep } from "./freeze-CrU8nQeX.js";
-import { d as isoNow } from "./time-DkWjdL98.js";
-import { o as quoteSqlIdent, u as sqlRows } from "./sql-B96movIM.js";
+import { n as freezeDeep } from "./freeze-jjan0lCv.js";
+import { d as isoNow } from "./time-nR1JesoH.js";
+import { o as quoteSqlIdent, u as sqlRows } from "./sql-0WjxIp9g.js";
 //#region src/scim/types.ts
 const SCIM_CONTENT_TYPE = "application/scim+json";
 const USER_SCHEMA = "urn:ietf:params:scim:schemas:core:2.0:User";
@@ -11,7 +11,10 @@ const ERROR_SCHEMA = "urn:ietf:params:scim:api:messages:2.0:Error";
 const PATCH_SCHEMA = "urn:ietf:params:scim:api:messages:2.0:PatchOp";
 /** The RFC 7643 section 3.3 Group extension that carries PermDock roles. */
 const ROLES_EXTENSION = "urn:ietf:params:scim:schemas:extension:permdock:2.0:Group";
-/** The extension that carries the application's own data (`x`) on a User or a Group. */
+/**
+* The extension that carries the application's own data (`x`) on a User or a
+* Group.
+*/
 const APP_DATA_EXTENSION = "urn:ietf:params:scim:schemas:extension:permdock:2.0:AppData";
 var DirectoryUniquenessError = class extends Error {
 	name = "DirectoryUniquenessError";
@@ -30,11 +33,17 @@ var DirectoryNotFoundError = class extends Error {
 function isNamedError(error, name, code) {
 	return error instanceof Error && error.name === name && Reflect.get(error, "code") === code;
 }
-/** Matches by `name` and `code`, so an error from another copy of the module still maps. */
+/**
+* Matches by `name` and `code`, so an error from another copy of the module
+* still maps.
+*/
 function isDirectoryUniquenessError(error) {
 	return isNamedError(error, "DirectoryUniquenessError", "uniqueness");
 }
-/** Matches by `name` and `code`, so an error from another copy of the module still maps. */
+/**
+* Matches by `name` and `code`, so an error from another copy of the module
+* still maps.
+*/
 function isDirectoryNotFoundError(error) {
 	return isNamedError(error, "DirectoryNotFoundError", "not-found");
 }
@@ -231,7 +240,10 @@ function matchCompare(actual, op, expected) {
 		default: return op;
 	}
 }
-/** RFC 7644 §3.4.2.2: `pr` needs a non-empty value; a multi-valued one needs an item. */
+/**
+* RFC 7644 §3.4.2.2: `pr` needs a non-empty value; a multi-valued one needs an
+* item.
+*/
 function present(value) {
 	if (Array.isArray(value)) return value.some(present);
 	return value !== void 0 && value !== null && value !== "";
@@ -537,13 +549,19 @@ function memoryDirectoryStore() {
 }
 //#endregion
 //#region src/scim/postgres-store.ts
-/** The tables `permdock scim generate` writes; their names are the contract this store reads. */
+/**
+* The tables `permdock scim generate` writes; their names are the contract this
+* store reads.
+*/
 const SCIM_TABLES = {
 	users: "scim_users",
 	groups: "scim_groups",
 	members: "scim_group_members"
 };
-/** The constraints whose violation is a SCIM `409 uniqueness`, by the attribute they cover. */
+/**
+* The constraints whose violation is a SCIM `409 uniqueness`, by the attribute
+* they cover.
+*/
 const SCIM_UNIQUE = {
 	userName: "scim_users_user_name_key",
 	userExternalId: "scim_users_external_id_key",
@@ -623,7 +641,10 @@ function storedGroup(value) {
 		})
 	};
 }
-/** A stored or IdP-sent `meta.created` the database can read; anything else is "now". */
+/**
+* A stored or IdP-sent `meta.created` the database can read; anything else is
+* "now".
+*/
 function createdParam(created) {
 	return created !== "" && !Number.isNaN(Date.parse(created)) ? created : null;
 }
@@ -653,7 +674,10 @@ function constraintOf(error) {
 	}
 	return "";
 }
-/** A unique violation (`23505`) as `DirectoryUniquenessError`; any other error is rethrown. */
+/**
+* A unique violation (`23505`) as `DirectoryUniquenessError`; any other error
+* is rethrown.
+*/
 function uniqueness(error, kind) {
 	if (isRecord(error) && error["code"] === "23505") {
 		const constraint = constraintOf(error);
@@ -779,7 +803,10 @@ function groupParams(tenant, group, createdOrRevision, now) {
 		uniqueMembers(group)
 	];
 }
-/** Reads the row, applies the operations and writes only if no other write landed in between; `write` answers `null` then. */
+/**
+* Reads the row, applies the operations and writes only if no other write
+* landed in between; `write` answers `null` then.
+*/
 async function patch(read, ops, step, write, label) {
 	for (let attempt = 0; attempt < PATCH_ATTEMPTS; attempt += 1) {
 		const current = await read();
@@ -880,10 +907,10 @@ function findSql(kind, tables, clause, page) {
 }
 /**
 * A `DirectoryStore` over the tables `permdock scim generate` writes, called
-* through a `SqlQuery` that may read and write them (the table owner, or a
-* role granted on them). Every method is one statement, so a pool needs no
-* transaction: a group and its members change together, and a PATCH that
-* races another write re-reads the row and applies its operations again.
+* through a `SqlQuery` that may read and write them (the table owner, or a role
+* granted on them). Every method is one statement, so a pool needs no
+* transaction: a group and its members change together, and a PATCH that races
+* another write re-reads the row and applies its operations again.
 */
 function postgresDirectoryStore(query, options = {}) {
 	const schema = quoteSqlIdent(options.schema ?? "permdock");

package/dist/{postgrest-r5faDIzD.js → postgrest-5Dr3W64L.js}

@@ -1,11 +1,11 @@
 import { r as isRecord, t as compact } from "./compact-CAf557ZB.js";
-import { n as freezeDeep } from "./freeze-CrU8nQeX.js";
-import { r as validateRecord } from "./thenable-yD7SabqG.js";
+import { n as freezeDeep } from "./freeze-jjan0lCv.js";
+import { r as validateRecord } from "./thenable-BNSM1U2R.js";
 import { t as anonymousSubject } from "./subject-BGoM5o8B.js";
-import { t as readClaim } from "./claims-map-7oQ3ue4X.js";
-import { t as clientNameOf } from "./clients-DjU5ABMy.js";
-import "./budget-NbEtbJC_.js";
-import { a as hookApiNames } from "./sources-B-zYB4GS.js";
+import { t as readClaim } from "./claims-map-CKkoAAYF.js";
+import { t as clientNameOf } from "./clients-DYr3U86j.js";
+import "./budget-BELja5A9.js";
+import { a as hookApiNames } from "./sources-CMAM-2A3.js";
 //#region src/supabase/subject.ts
 const REGISTERED = /* @__PURE__ */ new Set([
 	"sub",
@@ -28,14 +28,20 @@ const REGISTERED = /* @__PURE__ */ new Set([
 	"client_id",
 	"scope"
 ]);
-/** Top-level first, then `app_metadata`. `null` counts as absent: the RBAC hook writes `null` for a user with no role row. */
+/**
+* Top-level first, then `app_metadata`. `null` counts as absent: the RBAC hook
+* writes `null` for a user with no role row.
+*/
 function claimNamed(claims, name) {
 	const top = Object.hasOwn(claims, name) ? claims[name] : void 0;
 	if (top !== void 0 && top !== null) return top;
 	const meta = claims["app_metadata"];
 	if (isRecord(meta) && Object.hasOwn(meta, name)) return meta[name] ?? void 0;
 }
-/** A `ClaimPath`: a name read at the top level, then in `app_metadata`; or a function over the claims. */
+/**
+* A `ClaimPath`: a name read at the top level, then in `app_metadata`; or a
+* function over the claims.
+*/
 function claimAt(claims, path) {
 	return typeof path === "string" ? claimNamed(claims, path) : readClaim(claims, path);
 }
@@ -45,7 +51,10 @@ function asRoles(value, declared) {
 	const allowed = new Set(declared);
 	return raw.filter((role) => allowed.has(role));
 }
-/** Reads the `memberships` claim; an entry it cannot read is dropped and its index reported. */
+/**
+* Reads the `memberships` claim; an entry it cannot read is dropped and its
+* index reported.
+*/
 function readMemberships(value) {
 	if (!Array.isArray(value)) return {
 		memberships: [],
@@ -106,7 +115,10 @@ function memberOf(value) {
 function asStrings(value) {
 	return Array.isArray(value) ? value.filter((item) => typeof item === "string") : [];
 }
-/** `claims[plans][tenant]`: only the active tenant's entry, never another tenant's. */
+/**
+* `claims[plans][tenant]`: only the active tenant's entry, never another
+* tenant's.
+*/
 function plansFor(claims, name, tenant) {
 	if (name === void 0 || tenant === void 0) return [];
 	const byTenant = claimAt(claims, name);
@@ -127,11 +139,13 @@ function isToolList(value) {
 	return Array.isArray(value) && value.every((tool) => typeof tool === "string" && tool !== "");
 }
 /**
-* The outer `act` level by its `kind`, the marker a support tool writes: none is an OAuth client
-* or agent chain, `support` a support session (with `session_id`), `impersonation` an admin acting
-* as the user, `agent` an agent run with the `tools` it may call. Any other `kind`, a support level
-* without `session_id`, and an agent level with `session_id`, `tools` that are not non-empty
-* strings or a `read_only` that is not a boolean are invalid, as better-supabase reads them.
+* The outer `act` level by its `kind`, the marker a support tool writes: none
+* is an OAuth client or agent chain, `support` a support session (with
+* `session_id`), `impersonation` an admin acting as the user, `agent` an agent
+* run with the `tools` it may call. Any other `kind`, a support level without
+* `session_id`, and an agent level with `session_id`, `tools` that are not
+* non-empty strings or a `read_only` that is not a boolean are invalid, as
+* better-supabase reads them.
 */
 function actingParty(outer, id) {
 	const marked = Object.hasOwn(outer, "kind") ? outer["kind"] : void 0;
@@ -214,14 +228,15 @@ function readActor(claims) {
 	return NO_ACTOR;
 }
 /**
-* Who acts for the user: the outermost `sub` of an RFC 8693 `act` chain (the current
-* actor; nested levels are prior actors, kept on `chain` for audit), else the
-* OAuth `client_id` of a third-party app. The outer level's `kind` names the actor:
-* none is `oauth-client`, `support` a support session, `impersonation` an admin acting as the
-* user. Reads only `act` and `client_id`; the caller applies the role rule first (`anon` and
-* `service_role` are anonymous and carry no actor). An `act` that is not a chain of objects each
-* with a non-empty `sub`, that names another `kind`, or a support level without `session_id`,
-* is `{ ok: false }` and must deny.
+* Who acts for the user: the outermost `sub` of an RFC 8693 `act` chain (the
+* current actor; nested levels are prior actors, kept on `chain` for audit),
+* else the OAuth `client_id` of a third-party app. The outer level's `kind`
+* names the actor: none is `oauth-client`, `support` a support session,
+* `impersonation` an admin acting as the user. Reads only `act` and
+* `client_id`; the caller applies the role rule first (`anon` and
+* `service_role` are anonymous and carry no actor). An `act` that is not a
+* chain of objects each with a non-empty `sub`, that names another `kind`, or a
+* support level without `session_id`, is `{ ok: false }` and must deny.
 */
 function actorOf(claims) {
 	try {
@@ -346,6 +361,7 @@ function mapClaims(claims, options) {
 	});
 	const session = typeof claims["session_id"] === "string" ? claims["session_id"] : void 0;
 	const expiresAt = typeof claims["exp"] === "number" ? claims["exp"] : void 0;
+	const issuedAt = typeof claims["iat"] === "number" && Number.isFinite(claims["iat"]) ? claims["iat"] : void 0;
 	return freezeDeep(compact({
 		principal,
 		actor,
@@ -353,6 +369,7 @@ function mapClaims(claims, options) {
 		context: {},
 		session,
 		expiresAt,
+		issuedAt,
 		liveSession: options.liveSession === true && session !== void 0 ? true : void 0
 	}));
 }
@@ -370,8 +387,9 @@ function subjectFromSupabase(claims, options = {}) {
 	}
 }
 /**
-* A verified session object (`{ kind, claims }`) in, `Subject` out.
-* Only `kind: 'user'` sessions map; `anon`, `service`, `invalid` and anything else are anonymous.
+* A verified session object (`{ kind, claims }`) in, `Subject` out. Only `kind:
+* 'user'` sessions map; `anon`, `service`, `invalid` and anything else are
+* anonymous.
 */
 function subjectFromSupabaseSession(session, options = {}) {
 	try {
@@ -442,7 +460,10 @@ function versionOf(value) {
 	const version = typeof value === "string" ? Number(value) : value;
 	return typeof version === "number" && Number.isFinite(version) ? version : void 0;
 }
-/** Reads `subject_for`'s JSON; anything it cannot read is left out, and a malformed record is no record. */
+/**
+* Reads `subject_for`'s JSON; anything it cannot read is left out, and a
+* malformed record is no record.
+*/
 function readSubjectRecord(value) {
 	if (!isRecord(value) || typeof value["id"] !== "string") return;
 	if (value["active"] !== true) return {
@@ -466,17 +487,21 @@ function readSubjectRecord(value) {
 		claims: isRecord(value["claims"]) && Object.keys(value["claims"]).length > 0 ? value["claims"] : void 0
 	});
 }
+function once(memo, key, read) {
+	return memo === void 0 ? read() : memo(key, read);
+}
 /**
 * Membership, custom-role and subject sources over the `subject_for(p_user)`,
 * `authz_version_for(p_user)` and `members_of(p_scope, p_id)` functions
-* `permdock supabase hook generate` writes, for a backend that reaches
-* Postgres only through PostgREST. `memberships.version` reads only the
-* version, so `claimsFirst` with `onStale: 'reread'` reads the full subject
-* only for a stale token; when the version function is missing it falls back
-* to `subject_for`. With `policy`, a token that claims a custom role has its
+* `permdock supabase hook generate` writes, for a backend that reaches Postgres
+* only through PostgREST. `memberships.version` reads only the version, so
+* `claimsFirst` with `onStale: 'reread'` reads the full subject only for a
+* stale token; when the version function is missing it falls back to
+* `subject_for`. With `policy`, a token that claims a custom role has its
 * subject read in one `subject_for` call instead, and custom roles are read
-* only for a subject that holds one. Each user and each instance is read once per
-* `postgrestSources` call, so create it per request or per job.
+* only for a subject that holds one. It keeps no answers: create it once at
+* module scope, and `getPermDock` shares each read within one instance. Pass
+* `claimsFirst(…, { versions })` to share version reads across instances.
 */
 function postgrestSources(client, options = {}) {
 	const api = options.api;
@@ -487,73 +512,46 @@ function postgrestSources(client, options = {}) {
 	const versionFn = options.versionFn ?? names?.authzVersionFor ?? "authz_version_for";
 	const declared = options.policy === void 0 ? void 0 : options.policy.index.declaredRoles;
 	const onlyDeclared = (held) => declared !== void 0 && held?.every((name) => declared.has(name)) === true;
-	const loaded = /* @__PURE__ */ new Map();
-	const versions = /* @__PURE__ */ new Map();
-	const listed = /* @__PURE__ */ new Map();
-	const list = (query) => {
-		const key = JSON.stringify([query.scope, query.id]);
-		const cached = listed.get(key);
-		if (cached !== void 0) return cached.then((entries) => [...entries]);
-		const pending = Promise.resolve(callRpc(client, schema, membersFn, {
+	const list = async (query) => {
+		const result = await callRpc(client, schema, membersFn, {
 			p_scope: query.scope,
 			p_id: query.id
-		})).then((result) => {
-			if (result.error !== null) throw new Error(`PermDock: ${schema}.${membersFn} failed: ${result.error.message}`);
-			return readMemberEntries(result.data);
-		});
-		listed.set(key, pending);
-		return pending.then((entries) => [...entries]);
-	};
-	const record = (userId) => {
-		const cached = loaded.get(userId);
-		if (cached !== void 0) return cached;
-		const pending = Promise.resolve(callRpc(client, schema, fn, { p_user: userId })).then((result) => {
-			if (result.error !== null) throw new Error(`PermDock: ${schema}.${fn} failed: ${result.error.message}`);
-			return readSubjectRecord(result.data);
 		});
-		loaded.set(userId, pending);
-		return pending;
+		if (result.error !== null) throw new Error(`PermDock: ${schema}.${membersFn} failed: ${result.error.message}`);
+		return readMemberEntries(result.data);
 	};
-	const version = (userId) => {
-		const read = loaded.get(userId);
-		if (read !== void 0) return read.then((found) => found?.authzVersion);
-		const cached = versions.get(userId);
-		if (cached !== void 0) return cached;
-		const pending = Promise.resolve(callRpc(client, schema, versionFn, { p_user: userId })).then((result) => result.error === null ? versionOf(result.data) : record(userId).then((found) => found?.authzVersion));
-		versions.set(userId, pending);
-		return pending;
-	};
-	const live = async (userId) => {
-		const found = await record(userId);
+	const record = (userId, memo) => once(memo, `${schema}.${fn}:${userId}`, async () => {
+		const result = await callRpc(client, schema, fn, { p_user: userId });
+		if (result.error !== null) throw new Error(`PermDock: ${schema}.${fn} failed: ${result.error.message}`);
+		return readSubjectRecord(result.data);
+	});
+	const version = (userId, memo) => once(memo, `${schema}.${versionFn}:${userId}`, async () => {
+		const result = await callRpc(client, schema, versionFn, { p_user: userId });
+		return result.error === null ? versionOf(result.data) : (await record(userId, memo))?.authzVersion;
+	});
+	const live = async (userId, memo) => {
+		const found = await record(userId, memo);
 		return found?.active === true ? found : void 0;
 	};
 	return {
 		memberships: {
-			async membershipsFor(principal) {
-				return [...(await live(principal.id))?.memberships ?? []];
+			async membershipsFor(principal, query) {
+				return [...(await live(principal.id, query.memo))?.memberships ?? []];
 			},
-			version(principal) {
-				return declared !== void 0 && !onlyDeclared([...principal.roles ?? [], ...(principal.memberships ?? []).flatMap((membership) => membership.roles)]) ? record(principal.id).then((found) => found?.authzVersion) : version(principal.id);
+			version(principal, context) {
+				return declared !== void 0 && !onlyDeclared([...principal.roles ?? [], ...(principal.memberships ?? []).flatMap((membership) => membership.roles)]) ? record(principal.id, context?.memo).then((found) => found?.authzVersion) : version(principal.id, context?.memo);
 			},
 			list,
-			async globalRolesFor(principal) {
-				return [...(await live(principal.id))?.roles ?? []];
+			async globalRolesFor(principal, context) {
+				return [...(await live(principal.id, context?.memo))?.roles ?? []];
 			}
 		},
 		customRoles(principal) {
+			const held = async (context, keep) => onlyDeclared(context?.held) ? [] : ((await live(principal.id, context?.memo))?.customRoles ?? []).filter(keep);
 			return {
-				async rolesFor(tenant, context) {
-					if (onlyDeclared(context?.held)) return [];
-					return ((await live(principal.id))?.customRoles ?? []).filter((role) => role.tenant === tenant);
-				},
-				async globalRoles(context) {
-					if (onlyDeclared(context?.held)) return [];
-					return ((await live(principal.id))?.customRoles ?? []).filter((role) => role.scope === "global");
-				},
-				async sharedRoles(context) {
-					if (onlyDeclared(context?.held)) return [];
-					return ((await live(principal.id))?.customRoles ?? []).filter((role) => role.shared === true);
-				}
+				rolesFor: (tenant, context) => held(context, (role) => role.tenant === tenant),
+				globalRoles: (context) => held(context, (role) => role.scope === "global"),
+				sharedRoles: (context) => held(context, (role) => role.shared === true)
 			};
 		},
 		async subject(userId) {
@@ -601,7 +599,7 @@ function postgrestSources(client, options = {}) {
 				principal
 			};
 		},
-		record
+		record: (userId) => record(userId)
 	};
 }
 //#endregion

package/dist/{postgrest-CYacM_u7.d.ts → postgrest-D5nUGm-c.d.ts}

@@ -1,6 +1,9 @@
-import { $ as MemberEntry, T as Policy, W as CustomRoleSource, et as MembershipSource, lr as Subject, or as Membership, sr as Principal, tr as CustomRole } from "./policy-types-B-F-qAZk.js";
+import { G as CustomRoleSource, T as Policy, fr as Membership, hr as Subject, nt as MembershipSource, pr as Principal, sr as CustomRole, tt as MemberEntry } from "./policy-types-DGIO_gxq.js";
 //#region src/supabase/postgrest.d.ts
-/** What a supabase-js `rpc` call resolves to: `data` or an `error` with a message. */
+/**
+ * What a supabase-js `rpc` call resolves to: `data` or an `error` with a
+ * message.
+ */
 type SupabaseRpcResult = {
   readonly data: unknown;
   readonly error: {
@@ -13,13 +16,13 @@ type SupabaseRpcResult = {
  * function, such as a `service_role` client after the grant the docs show.
  */
 type SupabaseRpcClient = {
-  schema(name: string): {
-    rpc(fn: string, args: Readonly<Record<string, unknown>>): PromiseLike<SupabaseRpcResult>;
+  schema: (name: string) => {
+    rpc: (fn: string, args: Readonly<Record<string, unknown>>) => PromiseLike<SupabaseRpcResult>;
   };
 };
 type SupabaseRpcCaller = {
-  schema(name: never): {
-    rpc(fn: never, args: never): PromiseLike<SupabaseRpcResult>;
+  schema: (name: never) => {
+    rpc: (fn: never, args: never) => PromiseLike<SupabaseRpcResult>;
   };
 };
 type PostgrestSourcesOptions = {
@@ -34,18 +37,24 @@ type PostgrestSourcesOptions = {
     readonly schema?: string;
     readonly prefix?: string;
   };
-  /** Schema of the functions. Default `permdock`, where the hook generates `subject_for` and `members_of`. */
+  /**
+   * Schema of the functions. Default `permdock`, where the hook generates
+   * `subject_for` and `members_of`.
+   */
   readonly schema?: string;
   /** Function name, for a wrapper in an exposed schema. Default `subject_for`. */
   readonly fn?: string;
   readonly membersFn?: string;
-  /** The version-only function `memberships.version` calls. Default `authz_version_for`. */
+  /**
+   * The version-only function `memberships.version` calls. Default
+   * `authz_version_for`.
+   */
   readonly versionFn?: string;
   /**
    * The policy whose declared roles tell custom roles apart. With it,
-   * `customRoles` reads nothing while every role the subject holds is
-   * declared, and `memberships.version` reads the whole subject in one call
-   * when the token claims a custom role, which the custom roles need anyway.
+   * `customRoles` reads nothing while every role the subject holds is declared,
+   * and `memberships.version` reads the whole subject in one call when the
+   * token claims a custom role, which the custom roles need anyway.
    */
   readonly policy?: Policy;
 };
@@ -58,53 +67,64 @@ type SubjectRecord = {
   readonly memberships: readonly Membership[];
   readonly customRoles: readonly CustomRole[];
   readonly authzVersion?: number;
-  /** The token claims the hook adds besides the memberships: `team_ids` and each `supabase.hook.claims` entry. */
+  /**
+   * The token claims the hook adds besides the memberships: `team_ids` and each
+   * `supabase.hook.claims` entry.
+   */
   readonly claims?: Readonly<Record<string, unknown>>;
 };
 type PostgrestSources = {
   /**
-   * Memberships and the authorization version of any principal, and `list`,
-   * the live members of one scope instance through `members_of`, for
-   * `countHolders` and `whoCan`. Wrap it in `claimsFirst` to read only when
-   * the token was truncated.
+   * Memberships and the authorization version of any principal, and `list`, the
+   * live members of one scope instance through `members_of`, for `countHolders`
+   * and `whoCan`. Wrap it in `claimsFirst` to read only when the token was
+   * truncated.
    */
   readonly memberships: MembershipSource & {
-    list(query: {
+    list: (query: {
       readonly scope: string;
       readonly id: string;
-    }): Promise<MemberEntry[]>;
+    }) => Promise<MemberEntry[]>;
   };
   /** The custom roles `principal` holds, for `createPermDock`'s `customRoles`. */
-  customRoles(principal: {
+  customRoles: (principal: {
     readonly id: string;
-  }): CustomRoleSource;
-  /** The subject the hook would mint for `userId`: anonymous when the user is unknown or suspended. */
-  subject(userId: string): Promise<Subject>;
+  }) => CustomRoleSource;
+  /**
+   * The subject the hook would mint for `userId`: anonymous when the user is
+   * unknown or suspended.
+   */
+  subject: (userId: string) => Promise<Subject>;
   /**
    * `subject` with its principal read again: roles, memberships and
    * authorization version come from the database, the token's other claims
-   * stay, and `actor`, `delegation`, `session`, `expiresAt` and the context
-   * are kept as they were, so a refreshed OAuth client keeps its ceiling. An
+   * stay, and `actor`, `delegation`, `session`, `expiresAt` and the context are
+   * kept as they were, so a refreshed OAuth client keeps its ceiling. An
    * unknown or suspended user becomes a subject with no principal that still
-   * carries the actor and delegation. A subject with no principal is returned as is.
+   * carries the actor and delegation. A subject with no principal is returned
+   * as is.
    */
-  refresh<P extends Principal>(subject: Subject<P>): Promise<Subject<P>>;
+  refresh: <P extends Principal>(subject: Subject<P>) => Promise<Subject<P>>;
   /** The raw record, `undefined` for an unknown user. */
-  record(userId: string): Promise<SubjectRecord | undefined>;
+  record: (userId: string) => Promise<SubjectRecord | undefined>;
 };
-/** Reads `subject_for`'s JSON; anything it cannot read is left out, and a malformed record is no record. */
+/**
+ * Reads `subject_for`'s JSON; anything it cannot read is left out, and a
+ * malformed record is no record.
+ */
 declare function readSubjectRecord(value: unknown): SubjectRecord | undefined;
 /**
  * Membership, custom-role and subject sources over the `subject_for(p_user)`,
  * `authz_version_for(p_user)` and `members_of(p_scope, p_id)` functions
- * `permdock supabase hook generate` writes, for a backend that reaches
- * Postgres only through PostgREST. `memberships.version` reads only the
- * version, so `claimsFirst` with `onStale: 'reread'` reads the full subject
- * only for a stale token; when the version function is missing it falls back
- * to `subject_for`. With `policy`, a token that claims a custom role has its
+ * `permdock supabase hook generate` writes, for a backend that reaches Postgres
+ * only through PostgREST. `memberships.version` reads only the version, so
+ * `claimsFirst` with `onStale: 'reread'` reads the full subject only for a
+ * stale token; when the version function is missing it falls back to
+ * `subject_for`. With `policy`, a token that claims a custom role has its
  * subject read in one `subject_for` call instead, and custom roles are read
- * only for a subject that holds one. Each user and each instance is read once per
- * `postgrestSources` call, so create it per request or per job.
+ * only for a subject that holds one. It keeps no answers: create it once at
+ * module scope, and `getPermDock` shares each read within one instance. Pass
+ * `claimsFirst(…, { versions })` to share version reads across instances.
  */
 declare function postgrestSources(client: SupabaseRpcCaller, options?: PostgrestSourcesOptions): PostgrestSources;
 //#endregion

package/dist/powersync-B701tvhE.js

@@ -0,0 +1 @@
+export { n as runPowerSync } from "./powersync-CJrT1DSc.js";

package/dist/{powersync-13odBwiM.js → powersync-Bg8u-JcR.js}

@@ -1,5 +1,5 @@
 import { t as defineLeaf } from "./command-L8EstFNm.js";
-import { c as given, d as policyFlag, n as dbUrl, o as fileOut, r as dbUrlFlags, t as checkFlag } from "./flags-aaeRAdiD.js";
+import { c as given, d as policyFlag, n as dbUrl, o as fileOut, r as dbUrlFlags, t as checkFlag } from "./flags-DXjoTVbS.js";
 //#region src/cli/commands/powersync.ts
 const generate = defineLeaf({
 	flags: {
@@ -14,7 +14,7 @@ const generate = defineLeaf({
 	async run(ctx, { flags }) {
 		const out = fileOut("powersync", flags.out);
 		const from = given(flags.policy);
-		const { runPowerSync } = await import("./powersync-CExtTLyA.js");
+		const { runPowerSync } = await import("./powersync-B701tvhE.js");
 		return runPowerSync({
 			cwd: ctx.cwd,
 			config: ctx.config,
@@ -45,7 +45,7 @@ const verify = defineLeaf({
 		const db = await dbUrl(ctx, flags, { required: true });
 		const fixtures = given(flags.fixtures);
 		const from = given(flags.policy);
-		const { runPowerSync } = await import("./powersync-CExtTLyA.js");
+		const { runPowerSync } = await import("./powersync-B701tvhE.js");
 		return runPowerSync({
 			cwd: ctx.cwd,
 			config: ctx.config,