permdock 0.7.0 → 0.9.0

package/dist/tanstack-start/index.d.ts

@@ -1,13 +1,16 @@
-import { Gt as Snapshot, T as Policy, j as PolicyVocabulary, sr as Principal } from "../policy-types-B-F-qAZk.js";
-import { u as Permission } from "../permission-types-DhNEmoRG.js";
-import { a as OperationInput, t as Operation } from "../operations-BNLes61x.js";
-import { a as PermDock } from "../permdock-Dco6dyCK.js";
-import { D as ConnectionOptions, T as Connection, f as InvalidSignatureError, i as OpenApiHooks, o as ProtectOptions, u as SnapshotQuery, v as discoverViaSignatureAgent, x as webBotAuthVerifier } from "../server-types-C4gZUEZy.js";
-import { a as ProtectTarget, n as FetchAdapterOptions, t as ContextReader } from "../fetch-adapter-CuhyYwC1.js";
+import { T as Policy, Zt as Snapshot, j as PolicyVocabulary, pr as Principal } from "../policy-types-DGIO_gxq.js";
+import { u as Permission } from "../permission-types-CAY-GU7e.js";
+import { a as OperationInput, t as Operation } from "../operations-Ci_rT6Uo.js";
+import { a as PermDock } from "../permdock-CprAPN3w.js";
+import { D as ConnectionOptions, T as Connection, f as InvalidSignatureError, i as OpenApiHooks, o as ProtectOptions, u as SnapshotQuery, v as discoverViaSignatureAgent, x as webBotAuthVerifier } from "../server-types-CyRN0-Cd.js";
+import { a as ProtectTarget, n as FetchAdapterOptions, t as ContextReader } from "../fetch-adapter-BIbBAtPZ.js";
 import { RequestMiddleware, RequestMiddlewareAfterServer, createMiddleware } from "@tanstack/react-start";
 //#region src/tanstack-start/create.d.ts
 type TanStackStartPermDockOptions<TUser = unknown> = FetchAdapterOptions<Request, TUser>;
-/** The server context `middleware()` adds for later middleware, server functions and server routes. */
+/**
+ * The server context `middleware()` adds for later middleware, server functions
+ * and server routes.
+ */
 type TanStackStartPermDockContext<V extends PolicyVocabulary = PolicyVocabulary> = {
   readonly permdock: PermDock<V>;
 };
@@ -15,9 +18,15 @@ type TanStackStartPermDockContext<V extends PolicyVocabulary = PolicyVocabulary>
 type TanStackStartGuardedContext<TData = unknown, V extends PolicyVocabulary = PolicyVocabulary> = TanStackStartPermDockContext<V> & {
   readonly permdockData: TData;
 };
-/** A request middleware for `createStart`'s `requestMiddleware`, a server route's `server.middleware` or a server function's `.middleware([...])`. */
+/**
+ * A request middleware for `createStart`'s `requestMiddleware`, a server
+ * route's `server.middleware` or a server function's `.middleware([...])`.
+ */
 type TanStackStartMiddleware<TContext> = RequestMiddlewareAfterServer<StartRegister, undefined, TContext>;
-/** The register `createMiddleware` builds with; Start's middleware types are invariant in it. */
+/**
+ * The register `createMiddleware` builds with; Start's middleware types are
+ * invariant in it.
+ */
 type StartRegister = ReturnType<typeof createMiddleware> extends RequestMiddleware<infer TRegister> ? TRegister : never;
 type TanStackStartProtect<V extends PolicyVocabulary = PolicyVocabulary> = {
   <T = unknown>(permission: Permission | null, data?: ContextReader<Request, T | null | undefined>, protectOptions?: ProtectOptions): TanStackStartMiddleware<TanStackStartGuardedContext<NonNullable<T>, V>>;
@@ -35,7 +44,10 @@ type TanStackStartPermDockHandlers = {
 type TanStackStartPermDock<V extends PolicyVocabulary = PolicyVocabulary> = {
   /** Adds `context.permdock`; a bad Web Bot Auth signature is a `401`. */
   readonly middleware: () => TanStackStartMiddleware<TanStackStartPermDockContext<V>>;
-  /** A refusal ends the request with Problem Details; a grant adds `context.permdock` and `context.permdockData`. */
+  /**
+   * A refusal ends the request with Problem Details; a grant adds
+   * `context.permdock` and `context.permdockData`.
+   */
   readonly protect: TanStackStartProtect<V>;
   /** The instance for a server function: `getPermDock(getRequest())`. */
   readonly getPermDock: (request: Request) => Promise<PermDock<V>>;

package/dist/tanstack-start/index.js

@@ -1,5 +1,5 @@
-import { l as InvalidSignatureError, p as webBotAuthVerifier, u as discoverViaSignatureAgent } from "../evaluations-DReoiVBw.js";
-import { t as fetchAdapter } from "../fetch-adapter-De-u6vhJ.js";
+import { l as InvalidSignatureError, p as webBotAuthVerifier, u as discoverViaSignatureAgent } from "../evaluations-IBceAeKT.js";
+import { t as fetchAdapter } from "../fetch-adapter-dPTgJVHd.js";
 import { createMiddleware } from "@tanstack/react-start";
 //#region src/tanstack-start/create.ts
 function createPermDock(policy, options) {

package/dist/{target-Bw37TFNA.js → target-qdEAnnhU.js}

@@ -1,5 +1,5 @@
-import { a as ownRecord } from "./paths-DXSHAMIa.js";
-import { n as sha256, t as bytesToBase64Url } from "./sha256-D9ihqmvd.js";
+import { a as ownRecord } from "./paths-CUvURzHp.js";
+import { n as sha256, t as bytesToBase64Url } from "./sha256-C-4WXKIu.js";
 //#region src/delivery/target.ts
 /**
 * Whether `value` is a target the router checked for `channel`: a non-empty
@@ -13,8 +13,8 @@ function isDeliveryTarget(value, channel) {
 }
 /**
 * The idempotency key for one recipient of delivery `id`: `pdd_` and the
-* base64url SHA-256 of the delivery id, channel and recipient. It fits the
-* tag and header charsets of every provider, `[A-Za-z0-9_-]`.
+* base64url SHA-256 of the delivery id, channel and recipient. It fits the tag
+* and header charsets of every provider, `[A-Za-z0-9_-]`.
 */
 function idempotencyKeyFor(id, channel, recipient) {
 	return `pdd_${bytesToBase64Url(sha256(JSON.stringify([
@@ -27,8 +27,8 @@ const ATOM = "[A-Za-z0-9!#$%&'*+/=?^_`{|}~-]+";
 const ADDR_SPEC = /* @__PURE__ */ new RegExp(`^${ATOM}(?:\\.${ATOM})*@(?:[A-Za-z0-9](?:[A-Za-z0-9-]{0,61}[A-Za-z0-9])?\\.)+[A-Za-z0-9](?:[A-Za-z0-9-]{0,61}[A-Za-z0-9])?$`, "u");
 /**
 * An RFC 5322 `addr-spec` in dot-atom form with a DNS domain, at most 254
-* characters (RFC 5321 path limit). Quoted local parts, comments and
-* domain literals are refused.
+* characters (RFC 5321 path limit). Quoted local parts, comments and domain
+* literals are refused.
 */
 function isAddrSpec(value) {
 	return value.length <= 254 && ADDR_SPEC.test(value);

package/dist/{tenancy-CmeBQ6Nv.js → tenancy-5d1zVBvK.js}

@@ -1,7 +1,7 @@
-import { o as sameId, t as expiredAt } from "./expiry-D4_YKRKD.js";
-import { l as isFieldRelation } from "./resource-relations-D_jw0BFx.js";
-import { o as epochSeconds } from "./time-DkWjdL98.js";
-import { d as scopeIdOf, h as tenantOf, l as rootScope, r as findScope, s as resolveScope, t as activeFor, u as scopeChain } from "./scopes-BHsc-wp-.js";
+import { o as sameId, t as expiredAt } from "./expiry-6XByK0dm.js";
+import { l as isFieldRelation } from "./resource-relations-8-pCScBO.js";
+import { o as epochSeconds } from "./time-nR1JesoH.js";
+import { d as scopeIdOf, h as tenantOf, l as rootScope, r as findScope, s as resolveScope, t as activeFor, u as scopeChain } from "./scopes-0Up_UA2t.js";
 //#region src/core/tenancy.ts
 function nowSeconds(now) {
 	return now ?? epochSeconds();
@@ -25,21 +25,27 @@ function heldRoleNamesIn(principal, scopes, tenant, now) {
 	for (const membership of principal?.memberships ?? []) if (!isMembershipExpired(membership, now) && membership.keep === void 0 && tenantOf(membership, scopes) === tenant) for (const name of membership.roles) names.add(name);
 	return [...names];
 }
-/** `requested` when a live membership sits in that instance of the first scope; never a default. */
+/**
+* `requested` when a live membership sits in that instance of the first scope;
+* never a default.
+*/
 function resolveActiveTenant(principal, requested, scopes, now) {
 	if (requested === void 0) return principal.tenant;
 	return (principal.memberships ?? []).some((membership) => !isMembershipExpired(membership, now) && tenantOf(membership, scopes) === requested) ? requested : void 0;
 }
-/** `permdock.team(id)`: only memberships inside that instance of the second scope. */
+/**
+* `permdock.team(id)`: only memberships inside that instance of the second
+* scope.
+*/
 function inTeam(membership, scopes, team) {
 	if (team === void 0) return true;
 	const second = scopes[1]?.name;
 	return second !== void 0 && scopeIdOf(membership, second) === team;
 }
 /**
-* Whether `resource` declares a `memberOf` relation to `scope` on `field`:
-* its rows are partitioned by that scope, so a row without the field matches
-* no membership.
+* Whether `resource` declares a `memberOf` relation to `scope` on `field`: its
+* rows are partitioned by that scope, so a row without the field matches no
+* membership.
 */
 function relatesTo(resource, field, scope, scopes) {
 	if (resource === void 0) return false;
@@ -50,11 +56,11 @@ function memberOfFields(resource, scope, scopes) {
 	return [...new Set(Object.values(resource.relations).flatMap((relation) => isFieldRelation(relation) && relation.memberOf !== void 0 && resolveScope(scopes, relation.memberOf) === scope ? [relation.field] : []))];
 }
 /**
-* The field of `resource` that holds `scope`'s instance id: the scope's
-* `key` when one of the resource's `memberOf` relations names it, otherwise
-* the field of its one `memberOf` relation to the scope. A table whose own
-* id is the instance (`organizations.id`) declares
-* `{ self: { field: 'id', memberOf: 'organization' } }`.
+* The field of `resource` that holds `scope`'s instance id: the scope's `key`
+* when one of the resource's `memberOf` relations names it, otherwise the field
+* of its one `memberOf` relation to the scope. A table whose own id is the
+* instance (`organizations.id`) declares `{ self: { field: 'id', memberOf:
+* 'organization' } }`.
 */
 function scopeField(resource, scope, scopes) {
 	const key = findScope(scopes, scope)?.key;
@@ -92,9 +98,9 @@ function rowInScope(membership, scopes, row, partitioned, fieldOf) {
 	return { ok: true };
 }
 /**
-* Whether a membership answers an instance check for `row`: any membership
-* with a row object, otherwise only the first scope or the instance of the
-* second scope that `team(id)` selected.
+* Whether a membership answers an instance check for `row`: any membership with
+* a row object, otherwise only the first scope or the instance of the second
+* scope that `team(id)` selected.
 */
 function nestedAppliesWithoutRow(membership, scopes, row, team) {
 	if (row !== null && typeof row === "object") return true;
@@ -200,8 +206,8 @@ function matchResourceMembership(membership, roleResource, row, resource, resour
 /**
 * The row field that holds the id of a `membershipResource` membership: the
 * row's own id field when the row is of that resource, the declared parent
-* field of the matching ancestor otherwise (the row carries it, never a
-* walk-up query), `undefined` when the resource is not on the row's chain.
+* field of the matching ancestor otherwise (the row carries it, never a walk-up
+* query), `undefined` when the resource is not on the row's chain.
 */
 function membershipField(resource, membershipResource, resources) {
 	if (resource === void 0) return;

package/dist/terminal/index.d.ts

@@ -1,9 +1,9 @@
-import { Ln as Decision, Rt as Instant, T as Policy, j as PolicyVocabulary, lr as Subject, sr as Principal } from "../policy-types-B-F-qAZk.js";
-import { u as Permission } from "../permission-types-DhNEmoRG.js";
-import { a as PermDock } from "../permdock-Dco6dyCK.js";
-import { m as ApprovalStore } from "../types-DC44-hqb.js";
-import { a as ProblemDetails, t as ApprovalHint } from "../errors-B_Qg9D3e.js";
-import { t as InstanceOptions } from "../instance-options-CU0YQCLH.js";
+import { T as Policy, Un as Decision, Wt as Instant, hr as Subject, j as PolicyVocabulary, pr as Principal } from "../policy-types-DGIO_gxq.js";
+import { u as Permission } from "../permission-types-CAY-GU7e.js";
+import { a as PermDock } from "../permdock-CprAPN3w.js";
+import { m as ApprovalStore } from "../types-DLvhVm1r.js";
+import { a as ProblemDetails, t as ApprovalHint } from "../errors-BIM4MFsJ.js";
+import { t as InstanceOptions } from "../instance-options-CoHn-0e8.js";
 //#region src/terminal/types.d.ts
 type TokenSourceName = "device" | "keychain" | "env" | "ci-oidc";
 type TokenSource = TokenSourceName | {
@@ -42,7 +42,10 @@ type InteractiveConfirm = (input: {
   readonly reason: string;
   readonly token: string;
 }) => Promise<boolean>;
-/** Asks the user to type `expected` before a destructive action; resolves with what they typed. */
+/**
+ * Asks the user to type `expected` before a destructive action; resolves with
+ * what they typed.
+ */
 type TypedConfirm = (input: {
   readonly permission: string;
   readonly resource: {
@@ -67,17 +70,17 @@ type TerminalRuntime = {
 };
 /** The shape of `Entry` from `@napi-rs/keyring`. */
 type KeyringEntry = {
-  getPassword(): string | null | undefined;
-  setPassword(password: string): void;
-  deletePassword(): unknown;
+  getPassword: () => string | null | undefined;
+  setPassword: (password: string) => void;
+  deletePassword: () => unknown;
 };
 type TerminalStorageOptions = {
   readonly service: string;
   readonly dir?: string;
   /**
    * `Entry` from `@napi-rs/keyring`: tokens go to the OS keychain under
-   * `service`, one entry per profile. Without it, or when the keychain
-   * throws, they go to the mode-0600 credentials file.
+   * `service`, one entry per profile. Without it, or when the keychain throws,
+   * they go to the mode-0600 credentials file.
    */
   readonly keyring?: new (service: string, account: string) => KeyringEntry;
 };
@@ -92,9 +95,15 @@ type TerminalPermDockOptions<TUser = unknown> = InstanceOptions & {
     readonly confirm?: InteractiveConfirm;
     readonly typed?: TypedConfirm;
   };
-  /** Runs a destructive action without the typed confirmation; defaults to `--yes` / `-y` in argv. */
+  /**
+   * Runs a destructive action without the typed confirmation; defaults to
+   * `--yes` / `-y` in argv.
+   */
   readonly yes?: boolean;
-  /** Decides and prints the decision without running the action; defaults to `--dry-run` in argv. */
+  /**
+   * Decides and prints the decision without running the action; defaults to
+   * `--dry-run` in argv.
+   */
   readonly dryRun?: boolean;
   readonly output?: {
     readonly json?: boolean;

package/dist/terminal/index.js

@@ -1,14 +1,14 @@
 import { t as compact } from "../compact-CAf557ZB.js";
-import { a as deniedMessage, i as approvalMessage, n as PermDockDeniedError, t as PermDockApprovalRequiredError } from "../errors-BKy0EfhN.js";
-import { h as secondsAt } from "../time-DkWjdL98.js";
+import { a as deniedMessage, i as approvalMessage, n as PermDockDeniedError, t as PermDockApprovalRequiredError } from "../errors-B6R_lg2a.js";
+import { h as secondsAt } from "../time-nR1JesoH.js";
 import { n as resourceRef } from "../resource-ref-CaS9yVPi.js";
-import { l as withApp } from "../permdock-BfWEeMqk.js";
+import { l as withApp } from "../permdock-BvjivVb9.js";
 import { r as isSubject } from "../subject-BGoM5o8B.js";
-import { n as readBodyText } from "../body-text-QcXok_SI.js";
-import { l as storedApprovalToken, s as resumeDecision } from "../helpers-DY3vXuGs.js";
+import { n as readBodyText } from "../body-text-DQhcmqdY.js";
+import { l as storedApprovalToken, s as resumeDecision } from "../helpers-DJicaG6f.js";
 import { t as timeoutSignal } from "../timeout-D51niuQP.js";
-import { n as resolveOrNull, t as buildInstance } from "../build-instance-DxE7czo9.js";
-import { a as refreshCredential, o as revokeCredential, s as runDeviceFlow, t as TERMINAL_TIMEOUT_MS } from "../device-BARQ8eYG.js";
+import { n as resolveOrNull, t as buildInstance } from "../build-instance-BWXqwQYU.js";
+import { a as refreshCredential, o as revokeCredential, s as runDeviceFlow, t as TERMINAL_TIMEOUT_MS } from "../device-BwbJNmb2.js";
 import { i as writeCredentials, n as deleteCredentials, r as readCredentials } from "../storage-C2bWdvJH.js";
 import { createInterface } from "node:readline";
 //#region src/terminal/exit.ts
@@ -191,17 +191,14 @@ async function resolveToken(sources, options) {
 				if (options.storage === void 0) break;
 				const stored = readCredentials(options.storage, options.profile, options.runtime);
 				if (stored === null) break;
-				if (stored.expires_at !== void 0 && stored.expires_at <= now()) {
-					if (options.device !== void 0) {
-						const refreshed = await refreshCredential(options.device, stored, options.runtime);
-						if (refreshed !== null) {
-							writeCredentials(options.storage, options.profile, refreshed, options.runtime);
-							return refreshed.access_token;
-						}
-					}
-					break;
+				if (stored.expires_at === void 0 || stored.expires_at > now()) return stored.access_token;
+				if (options.device === void 0) break;
+				const refreshed = await refreshCredential(options.device, stored, options.runtime);
+				if (refreshed !== null) {
+					writeCredentials(options.storage, options.profile, refreshed, options.runtime);
+					return refreshed.access_token;
 				}
-				return stored.access_token;
+				break;
 			}
 			case "ci-oidc": {
 				const oidc = await fromCiOidc(options.runtime, source);
@@ -243,9 +240,9 @@ function envOf(options) {
 	return options.runtime?.env ?? process.env;
 }
 /**
-* The local y/N is the requester answering for themselves, so it stands in
-* for an approval only where the grant allows that (`distinct: false`) and no
-* agent is acting for the user.
+* The local y/N is the requester answering for themselves, so it stands in for
+* an approval only where the grant allows that (`distinct: false`) and no agent
+* is acting for the user.
 */
 function answersLocally(decision, subject) {
 	const approval = decision.grant.approval;

package/dist/testing/core.d.ts

@@ -1,2 +1,2 @@
-import { S as policyMatrix, _ as DescribePolicyConfig, a as OrmParityScenario, b as PolicyMatrixCell, c as RlsFieldsOutcome, d as RlsParityOptions, f as RlsParityReport, g as testRlsParity, h as RlsQueryResult, i as OrmParityRunInput, l as RlsParityCase, m as RlsQueryFn, n as OrmParityOptions, o as testOrmParity, p as RlsParitySubject, r as OrmParityReport, s as RlsDbOutcome, t as OrmParityCase, u as RlsParityFixture, v as MatrixCell, x as PolicyMatrixReport, y as MatrixOutcome } from "../core-CQkE8Esr.js";
+import { S as policyMatrix, _ as DescribePolicyConfig, a as OrmParityScenario, b as PolicyMatrixCell, c as RlsFieldsOutcome, d as RlsParityOptions, f as RlsParityReport, g as testRlsParity, h as RlsQueryResult, i as OrmParityRunInput, l as RlsParityCase, m as RlsQueryFn, n as OrmParityOptions, o as testOrmParity, p as RlsParitySubject, r as OrmParityReport, s as RlsDbOutcome, t as OrmParityCase, u as RlsParityFixture, v as MatrixCell, x as PolicyMatrixReport, y as MatrixOutcome } from "../core-CFepFiDP.js";
 export { type DescribePolicyConfig, type MatrixCell, type MatrixOutcome, type OrmParityCase, type OrmParityOptions, type OrmParityReport, type OrmParityRunInput, type OrmParityScenario, type PolicyMatrixCell, type PolicyMatrixReport, type RlsDbOutcome, type RlsFieldsOutcome, type RlsParityCase, type RlsParityFixture, type RlsParityOptions, type RlsParityReport, type RlsParitySubject, type RlsQueryFn, type RlsQueryResult, policyMatrix, testOrmParity, testRlsParity };

package/dist/testing/core.js

@@ -1 +1 @@
-export { r as policyMatrix, t as testOrmParity, n as testRlsParity } from "../core-B5-w6Kw9.js";
+export { r as policyMatrix, t as testOrmParity, n as testRlsParity } from "../core-DzVINFbU.js";

package/dist/testing/fixtures/index.d.ts

@@ -1,12 +1,15 @@
-import { a as CatalogDocument } from "../../types-BXMYB7BY.js";
-import { i as SupabaseManifest } from "../../manifest-BVhExYhw.js";
+import { a as CatalogDocument } from "../../types-ZzRGoViD.js";
+import { i as SupabaseManifest } from "../../manifest-CzzWtnAb.js";
 //#region src/testing/fixtures/index.d.ts
 /**
  * The `permissions.catalog.json` of `apps/examples/next-better-supabase`, a
- * `catalog-v1` document with resources, permissions, scopes, roles, grants
- * and delegations, for testing a catalog consumer such as a Cloud.
+ * `catalog-v1` document with resources, permissions, scopes, roles, grants and
+ * delegations, for testing a catalog consumer such as a Cloud.
  */
 export declare const betterSupabaseCatalog: CatalogDocument;
-/** The `permdock.manifest.json` of the same app, a `supabase-manifest-v1` document. */
+/**
+ * The `permdock.manifest.json` of the same app, a `supabase-manifest-v1`
+ * document.
+ */
 export declare const betterSupabaseManifest: SupabaseManifest;
 //#endregion

package/dist/testing/fixtures/index.js

@@ -1,12 +1,12 @@
-import { n as parseSupabaseManifest } from "../../manifest-B79YuF2T.js";
-import { t as parseCatalog } from "../../parse-Ddhz2xf4.js";
+import { n as parseSupabaseManifest } from "../../manifest-wg8WkkpD.js";
+import { t as parseCatalog } from "../../parse-1_ZheTW5.js";
 //#region src/testing/fixtures/better-supabase.catalog.json
 var better_supabase_catalog_default = {
 	$schema: "https://permdock.com/schemas/catalog-v1.json",
 	version: 1,
-	generatedAt: "2026-10-21T08:41:54.277Z",
-	generator: "permdock@0.6.0",
-	fingerprint: "sha-256:xLa3QGuqXtLe6WtPEyf2NaV_qr0vBW2qg2jRN5rBJdA",
+	generatedAt: "2026-10-21T18:26:20.894Z",
+	generator: "permdock@0.7.0",
+	fingerprint: "sha-256:2VY9uDRP6NWXTNcU989MMBZa3-z22VbDWKWkvnXaTFc",
 	resources: {
 		"staff": {
 			"id": "id",
@@ -106,6 +106,11 @@ var better_supabase_catalog_default = {
 			"id": "id",
 			"schema": null,
 			"definedIn": "src/permissions.ts"
+		},
+		"roles": {
+			"id": "id",
+			"schema": null,
+			"definedIn": "src/permissions.ts"
 		}
 	},
 	permissions: [
@@ -147,7 +152,7 @@ var better_supabase_catalog_default = {
 			"usages": [
 				{
 					"file": "src/agent/tools.ts",
-					"line": 80,
+					"line": 86,
 					"call": "tools"
 				},
 				{
@@ -172,7 +177,7 @@ var better_supabase_catalog_default = {
 				},
 				{
 					"file": "src/policy.ts",
-					"line": 41,
+					"line": 42,
 					"call": "reference"
 				}
 			],
@@ -188,7 +193,7 @@ var better_supabase_catalog_default = {
 			"usages": [
 				{
 					"file": "src/lib/share.ts",
-					"line": 51,
+					"line": 54,
 					"call": "can"
 				},
 				{
@@ -198,12 +203,12 @@ var better_supabase_catalog_default = {
 				},
 				{
 					"file": "src/policy.ts",
-					"line": 41,
+					"line": 42,
 					"call": "reference"
 				},
 				{
 					"file": "src/policy.ts",
-					"line": 45,
+					"line": 46,
 					"call": "allow"
 				}
 			],
@@ -218,7 +223,7 @@ var better_supabase_catalog_default = {
 			"meta": {},
 			"usages": [{
 				"file": "src/agent/tools.ts",
-				"line": 82,
+				"line": 88,
 				"call": "tools"
 			}, {
 				"file": "src/policy.ts",
@@ -227,6 +232,20 @@ var better_supabase_catalog_default = {
 			}],
 			"rowConditions": false
 		},
+		{
+			"key": "roles.manage",
+			"scope": "roles:manage",
+			"resource": "roles",
+			"action": "manage",
+			"arity": "collection",
+			"meta": {},
+			"usages": [{
+				"file": "src/policy.ts",
+				"line": 30,
+				"call": "reference"
+			}],
+			"rowConditions": false
+		},
 		{
 			"key": "staff.list",
 			"scope": "staff:list",
@@ -247,7 +266,7 @@ var better_supabase_catalog_default = {
 				},
 				{
 					"file": "src/app/api/staff/route.ts",
-					"line": 12,
+					"line": 15,
 					"call": "tools"
 				},
 				{
@@ -257,7 +276,7 @@ var better_supabase_catalog_default = {
 				},
 				{
 					"file": "src/policy.ts",
-					"line": 36,
+					"line": 37,
 					"call": "reference"
 				}
 			],
@@ -276,7 +295,7 @@ var better_supabase_catalog_default = {
 				"call": "reference"
 			}, {
 				"file": "src/policy.ts",
-				"line": 36,
+				"line": 37,
 				"call": "reference"
 			}],
 			"rowConditions": false
@@ -402,6 +421,17 @@ var better_supabase_catalog_default = {
 			},
 			"scope": "organization"
 		},
+		{
+			"permission": "roles.manage",
+			"effect": "allow",
+			"role": "owner",
+			"to": {
+				"kind": "role",
+				"role": "owner",
+				"scope": "organization"
+			},
+			"scope": "organization"
+		},
 		{
 			"permission": "staff.list",
 			"effect": "allow",
@@ -750,6 +780,34 @@ var better_supabase_manifest_default = {
 			"storage.file_buckets.upload"
 		]
 	},
+	names: {
+		"schema": "permdock",
+		"gucPrefix": "app",
+		"claims": {
+			"tenant": "tenant_id",
+			"role": "user_role"
+		},
+		"scopes": {
+			"organization": {
+				"permittedIds": "permitted_organization_ids",
+				"permittedIdsFor": "permitted_organization_ids_for",
+				"memberIds": "member_organization_ids",
+				"memberIdsFor": "member_organization_ids_for",
+				"permittedUsers": "permitted_organization_users"
+			},
+			"customer": {
+				"permittedIds": "permitted_customer_ids",
+				"permittedIdsFor": "permitted_customer_ids_for",
+				"memberIds": "member_customer_ids",
+				"memberIdsFor": "member_customer_ids_for",
+				"permittedUsers": "permitted_customer_users"
+			}
+		},
+		"resources": {
+			"staff": { "table": "staff" },
+			"quotes": { "table": "quotes" }
+		}
+	},
 	managementApi: {
 		"hook_custom_access_token_enabled": true,
 		"hook_custom_access_token_uri": "pg-functions://postgres/permdock/custom_access_token_hook",
@@ -760,11 +818,14 @@ var better_supabase_manifest_default = {
 //#region src/testing/fixtures/index.ts
 /**
 * The `permissions.catalog.json` of `apps/examples/next-better-supabase`, a
-* `catalog-v1` document with resources, permissions, scopes, roles, grants
-* and delegations, for testing a catalog consumer such as a Cloud.
+* `catalog-v1` document with resources, permissions, scopes, roles, grants and
+* delegations, for testing a catalog consumer such as a Cloud.
 */
 const betterSupabaseCatalog = parseCatalog(better_supabase_catalog_default);
-/** The `permdock.manifest.json` of the same app, a `supabase-manifest-v1` document. */
+/**
+* The `permdock.manifest.json` of the same app, a `supabase-manifest-v1`
+* document.
+*/
 const betterSupabaseManifest = parseSupabaseManifest(better_supabase_manifest_default);
 //#endregion
 export { betterSupabaseCatalog, betterSupabaseManifest };