permdock 0.8.0 → 0.10.0

package/dist/testing/fixtures/index.d.ts

@@ -1,5 +1,5 @@
 import { a as CatalogDocument } from "../../types-ZzRGoViD.js";
-import { i as SupabaseManifest } from "../../manifest-CzzWtnAb.js";
+import { i as SupabaseManifest } from "../../manifest-B5yF3CIq.js";
 //#region src/testing/fixtures/index.d.ts
 /**
  * The `permissions.catalog.json` of `apps/examples/next-better-supabase`, a

package/dist/testing/fixtures/index.js

@@ -1,12 +1,12 @@
-import { n as parseSupabaseManifest } from "../../manifest-wg8WkkpD.js";
+import { n as parseSupabaseManifest } from "../../manifest-BXTbHNIV.js";
 import { t as parseCatalog } from "../../parse-1_ZheTW5.js";
 //#region src/testing/fixtures/better-supabase.catalog.json
 var better_supabase_catalog_default = {
 	$schema: "https://permdock.com/schemas/catalog-v1.json",
 	version: 1,
-	generatedAt: "2026-10-21T18:26:20.894Z",
-	generator: "permdock@0.7.0",
-	fingerprint: "sha-256:2VY9uDRP6NWXTNcU989MMBZa3-z22VbDWKWkvnXaTFc",
+	generatedAt: "2026-10-25T13:10:40.583Z",
+	generator: "permdock@0.9.0",
+	fingerprint: "sha-256:vWJUJuM8Qg6Cd8ozHqIOkaPdpE4p6cxof-Hypzwe3tg",
 	resources: {
 		"staff": {
 			"id": "id",
@@ -115,29 +115,29 @@ var better_supabase_catalog_default = {
 	},
 	permissions: [
 		{
-			"key": "audit.revert",
-			"scope": "audit:revert",
+			"key": "audit.read",
+			"scope": "audit:read",
 			"resource": "audit",
-			"action": "revert",
+			"action": "read",
 			"arity": "collection",
 			"meta": {},
 			"usages": [{
 				"file": "src/policy.ts",
-				"line": 29,
+				"line": 28,
 				"call": "reference"
 			}],
 			"rowConditions": false
 		},
 		{
-			"key": "audit.view",
-			"scope": "audit:view",
+			"key": "audit.revert",
+			"scope": "audit:revert",
 			"resource": "audit",
-			"action": "view",
+			"action": "revert",
 			"arity": "collection",
 			"meta": {},
 			"usages": [{
 				"file": "src/policy.ts",
-				"line": 28,
+				"line": 29,
 				"call": "reference"
 			}],
 			"rowConditions": false
@@ -334,7 +334,7 @@ var better_supabase_catalog_default = {
 	],
 	grants: [
 		{
-			"permission": "audit.revert",
+			"permission": "audit.read",
 			"effect": "allow",
 			"role": "owner",
 			"to": {
@@ -345,7 +345,7 @@ var better_supabase_catalog_default = {
 			"scope": "organization"
 		},
 		{
-			"permission": "audit.view",
+			"permission": "audit.revert",
 			"effect": "allow",
 			"role": "owner",
 			"to": {
@@ -512,6 +512,7 @@ var better_supabase_manifest_default = {
 		"schema": "permdock",
 		"function": "custom_access_token_hook",
 		"out": "supabase/schemas/permdock/functions/custom_access_token_hook.sql",
+		"activeFrom": { "appMetadata": "active_organization" },
 		"schemas": "pg-delta"
 	},
 	helpers: {
@@ -580,15 +581,14 @@ var better_supabase_manifest_default = {
 		"args": "p_users uuid[]"
 	},
 	memberships: [{
-		"table": "public.memberships",
+		"table": "public.organization_memberships",
 		"user": { "column": "user_id" },
-		"scope": { "column": "scope" },
-		"id": { "column": "scope_id" },
+		"scope": { "value": "organization" },
+		"id": { "column": "organization_id" },
 		"role": { "column": "role" },
 		"columns": [
 			"user_id",
-			"scope",
-			"scope_id",
+			"organization_id",
 			"role"
 		]
 	}, {
@@ -722,15 +722,14 @@ var better_supabase_manifest_default = {
 			}
 		],
 		"memberships": [{
-			"table": "public.memberships",
+			"table": "public.organization_memberships",
 			"user": { "column": "user_id" },
-			"scope": { "column": "scope" },
-			"id": { "column": "scope_id" },
+			"scope": { "value": "organization" },
+			"id": { "column": "organization_id" },
 			"role": { "column": "role" },
 			"columns": [
 				"user_id",
-				"scope",
-				"scope_id",
+				"organization_id",
 				"role"
 			]
 		}, {
@@ -758,10 +757,9 @@ var better_supabase_manifest_default = {
 		"public.contacts.customer_id",
 		"public.contacts.organization_id",
 		"public.contacts.user_id",
-		"public.memberships.role",
-		"public.memberships.scope",
-		"public.memberships.scope_id",
-		"public.memberships.user_id"
+		"public.organization_memberships.organization_id",
+		"public.organization_memberships.role",
+		"public.organization_memberships.user_id"
 	],
 	markers: {
 		"hook": "v1",

package/dist/testing/index.d.ts

@@ -1,29 +1,30 @@
-import { Gt as Snapshot, J as EntitlementSource, K as DecisionProvider, Q as LimitStore, T as Policy, U as CredentialVerifier, W as CustomRoleSource, at as SettingsSource, dt as TokenVerifier, et as MembershipSource, it as RelationSource, lr as Subject, mt as WhereCompiler, or as Membership, ot as SnapshotSource, q as DecisionSink, sr as Principal, st as SubjectResolver, tn as DeliveryChannel, ut as TokenSigner } from "../policy-types-CCiDRZBH.js";
+import { G as CustomRoleSource, J as DecisionSink, T as Policy, U as CredentialVerifier, Y as EntitlementSource, Zt as Snapshot, bt as WhereCompiler, ct as SnapshotSource, dt as SubjectResolver, et as LimitStore, fr as Membership, hr as Subject, ht as TokenVerifier, mt as TokenSigner, nt as MembershipSource, ot as RelationSource, pr as Principal, q as DecisionProvider, sn as DeliveryChannel, st as SettingsSource } from "../policy-types-DGIO_gxq.js";
 import { g as ResourceInit, l as InferPermissionTree, u as Permission } from "../permission-types-CAY-GU7e.js";
 import { r as Role } from "../vocabulary-DEJ5j4mR.js";
-import { st as LegacyCheck } from "../index-BW_0MZOS.js";
-import { D as ApprovalPolicySource, _ as PrincipalSource, a as PermDock, b as Limits, h as PrincipalIdentity } from "../permdock-B6Sf4T_S.js";
-import { s as PolicySource } from "../hosted-Cmtxogd0.js";
-import { a as ApprovalDelegationSource, m as ApprovalStore } from "../types-B_tiYvk8.js";
-import { a as ProblemDetails } from "../errors-zi_4T-rx.js";
-import { c as ModelMap, t as AgentPermDock, u as ToolMap } from "../create-BSNrVuxh.js";
-import { c as AccessReviewStore } from "../types-B2mlGuhW.js";
-import { R as IdempotencyStore } from "../index-_9UiQIkt.js";
+import { st as LegacyCheck } from "../index-Cay5-Kvx.js";
+import { D as ApprovalPolicySource, _ as PrincipalSource, a as PermDock, b as Limits, h as PrincipalIdentity } from "../permdock-CprAPN3w.js";
+import { s as PolicySource } from "../hosted-DVxlLZMe.js";
+import { a as ApprovalDelegationSource, m as ApprovalStore } from "../types-DLvhVm1r.js";
+import { a as ProblemDetails } from "../errors-BIM4MFsJ.js";
+import { c as ModelMap, t as AgentPermDock, u as ToolMap } from "../create-BPUopdfL.js";
+import { c as AccessReviewStore } from "../types-B2efzoSX.js";
+import { R as IdempotencyStore } from "../index-DJwEgYzA.js";
 import { n as RevocationFeed } from "../revocations-BaUXHM1N.js";
-import { s as SupportSessionSource } from "../index-B8s204GL.js";
-import { a as AutomationSource, t as Automation } from "../automation-DqEoWHBc.js";
-import { c as DeliveryTransport, g as TransportMessages } from "../types-yUuPR5Hy.js";
-import { r as SupabaseHookManifest } from "../manifest-CzzWtnAb.js";
+import { s as SupportSessionSource } from "../index-CV-7DWeD.js";
+import { r as SupabaseHookManifest } from "../manifest-B5yF3CIq.js";
+import { n as VersionCache } from "../version-cache-Df11C2Qp.js";
 import { t as supabaseMembershipsBudget } from "../budget-hYsPz_yE.js";
-import { t as CloudApproverOptions } from "../types-AMJ5qoU_.js";
-import { n as ApprovalWaiter } from "../waiter-Bu9zAlE0.js";
-import { g as SetQueue, l as ReplayStore } from "../types-DjuMBNF9.js";
-import { r as SnapshotStorage } from "../types-HzqOtvsJ.js";
-import { x as DirectoryStore } from "../index-BT5-1VsX.js";
-import { S as SsfStreamStore } from "../index-BhxEUY9J.js";
-import { S as policyMatrix, _ as DescribePolicyConfig, a as OrmParityScenario, b as PolicyMatrixCell, c as RlsFieldsOutcome, d as RlsParityOptions, f as RlsParityReport, g as testRlsParity, h as RlsQueryResult, i as OrmParityRunInput, l as RlsParityCase, m as RlsQueryFn, n as OrmParityOptions, o as testOrmParity, p as RlsParitySubject, r as OrmParityReport, s as RlsDbOutcome, t as OrmParityCase, u as RlsParityFixture, v as MatrixCell, x as PolicyMatrixReport, y as MatrixOutcome } from "../core-hWIARPDz.js";
+import { a as AutomationSource, t as Automation } from "../automation-C6Jg75xq.js";
+import { c as DeliveryTransport, g as TransportMessages } from "../types-CN0LsqbK.js";
+import { t as CloudApproverOptions } from "../types-BB-zWDcR.js";
+import { n as ApprovalWaiter } from "../waiter-CqUKX6CY.js";
+import { g as SetQueue, l as ReplayStore } from "../types-DsHGPtkR.js";
+import { r as SnapshotStorage } from "../types-CWBsAwqn.js";
+import { x as DirectoryStore } from "../index-Dj2qF9VC.js";
+import { S as SsfStreamStore } from "../index-BinlXeU-.js";
+import { S as policyMatrix, _ as DescribePolicyConfig, a as OrmParityScenario, b as PolicyMatrixCell, c as RlsFieldsOutcome, d as RlsParityOptions, f as RlsParityReport, g as testRlsParity, h as RlsQueryResult, i as OrmParityRunInput, l as RlsParityCase, m as RlsQueryFn, n as OrmParityOptions, o as testOrmParity, p as RlsParitySubject, r as OrmParityReport, s as RlsDbOutcome, t as OrmParityCase, u as RlsParityFixture, v as MatrixCell, x as PolicyMatrixReport, y as MatrixOutcome } from "../core-CFepFiDP.js";
 import { a as SaasProject } from "../permissions-Bx6UI8n1.js";
-import { n as saasPolicy } from "../policy-Ba4bDhaj.js";
+import { n as saasPolicy } from "../policy-BycVKnXv.js";
 import { expectTypeOf } from "vitest";
 //#region src/testing/describe-policy.d.ts
 /** `policyMatrix` under Vitest: one test per cell, plus the exhaustive check. */
@@ -640,6 +641,7 @@ export declare function testSnapshotSource(source: SnapshotSource): void;
 export declare function testPolicySource(source: PolicySource, options?: {
   readonly policy?: Policy;
 }): void;
+export declare function testVersionCache(cache: VersionCache): void;
 //#endregion
 //#region src/testing/conformance/providers.d.ts
 type DecisionProviderRunnerOptions = {

package/dist/testing/index.js

@@ -2,7 +2,7 @@ import { r as isRecord } from "../compact-CAf557ZB.js";
 import { n as freezeDeep } from "../freeze-jjan0lCv.js";
 import { i as principal } from "../refs-C8BKxc_e.js";
 import { n as role, r as allow } from "../role-builder-BK2-T6oD.js";
-import { A as memoryCustomRoleSource, S as memoryLimitStore, T as approvalPoliciesFor, d as snapshotFor, x as limits } from "../src-DZ0l9UAg.js";
+import { C as memoryLimitStore, E as approvalPoliciesFor, S as limits, d as snapshotFor, j as memoryCustomRoleSource } from "../src-C_pi2Rnh.js";
 import { t as memoryRevocationFeed } from "../revocations-Bhr0aMIC.js";
 import { n as loadPrincipalByIdentity, t as loadPrincipal } from "../principal-source-C6N60GtM.js";
 import { v as resource } from "../permission-registry-B8tYxPIt.js";
@@ -15,10 +15,10 @@ import { t as byCodePoint } from "../compare-DTfyUunF.js";
 import { r as definePolicy } from "../policy-CLQ8__GF.js";
 import { c as mergeHostedGrants, l as parsePolicyDocument } from "../hosted-D0IzESu_.js";
 import { t as definePermissions } from "../permissions-CVXmRILq.js";
-import { T as validateCustomRole } from "../evaluate-Dd8Ta0Ie.js";
+import { T as validateCustomRole } from "../evaluate-BAmf_AQd.js";
 import { n as parseSnapshot } from "../snapshot-CXlzi69u.js";
 import { n as fromSnapshot } from "../from-snapshot-DCakWRsr.js";
-import { t as getPermDock } from "../permdock-L-_I_3zP.js";
+import { t as getPermDock } from "../permdock-BvjivVb9.js";
 import { t as APPROVAL_HEADER } from "../types-CcUXciSj.js";
 import { i as memoryApprovalStore } from "../store-RNFvaJJv.js";
 import { t as catalogFingerprint } from "../catalog-fingerprint-e6aCWosn.js";
@@ -34,11 +34,11 @@ import { l as sha256Hex, n as scimHandler, t as directoryMembershipSource } from
 import { c as quoteSqlTable, o as quoteSqlIdent } from "../sql-0WjxIp9g.js";
 import { i as cloudEndpoints, n as cloud, s as approverHeaders, t as bearerChallenge } from "../challenge-DImNcR7B.js";
 import { t as supabaseMembershipsBudget } from "../budget-BELja5A9.js";
-import { t as supabaseManifestSchema } from "../manifest-schema-2r37XRhD.js";
-import { t as PUSHED_POLICY_SCHEMA } from "../pushed-policy-ITwYKvvH.js";
-import { i as policyMatrixLayout, n as testRlsParity, r as policyMatrix, t as testOrmParity } from "../core-H-mbhpZc.js";
-import { i as saasPermissions } from "../permissions-mDcTWoBs.js";
-import { C as saasOrg, E as saasSeed, S as saasMemberships, a as saasProject, g as verifySaasSession, h as signSaasToken, k as saasPolicy, t as saasDoc, w as saasPrincipal, x as saasCustomRoles } from "../saas-iWnUdwCt.js";
+import { t as supabaseManifestSchema } from "../manifest-schema-DQkBK2Mr.js";
+import { t as PUSHED_POLICY_SCHEMA } from "../pushed-policy-CDuOL2de.js";
+import { i as policyMatrixLayout, n as testRlsParity, r as policyMatrix, t as testOrmParity } from "../core-DzVINFbU.js";
+import { i as saasPermissions } from "../permissions-CYcHj_w7.js";
+import { C as saasOrg, E as saasSeed, S as saasMemberships, a as saasProject, g as verifySaasSession, h as signSaasToken, k as saasPolicy, t as saasDoc, w as saasPrincipal, x as saasCustomRoles } from "../saas-DK4V-3Is.js";
 import { t as POLICY_NOT_PUBLISHED } from "../problem-types-DSsRfONQ.js";
 import { t as require__2020 } from "../2020-CJbO8Bvz.js";
 import { afterAll, assert, beforeAll, describe, expect, expectTypeOf, it, vi } from "vitest";
@@ -2456,6 +2456,59 @@ function testPolicySource(source, options = {}) {
 		});
 	}
 }
+function testVersionCache(cache) {
+	const counted = (version) => {
+		const calls = { count: 0 };
+		const read = async () => {
+			calls.count += 1;
+			return version;
+		};
+		return {
+			calls,
+			read
+		};
+	};
+	it("reads live for a write and answers a read from that entry", async () => {
+		const { calls, read } = counted(4);
+		const principal = { id: "u-version-write" };
+		expect(await cache.current(principal, read, { live: true })).toBe(4);
+		expect(await cache.current(principal, read, { live: true })).toBe(4);
+		expect(calls.count).toBe(2);
+		if (cache.maxStaleMs > 0) {
+			expect(await cache.current(principal, read, { live: false })).toBe(4);
+			expect(calls.count).toBe(2);
+		}
+	});
+	it("shares one read between concurrent reads", async () => {
+		const { calls, read } = counted(2);
+		const principal = { id: "u-version-shared" };
+		const answers = await Promise.all(Array.from({ length: 5 }, async () => cache.current(principal, read, { live: false })));
+		expect(answers).toStrictEqual([
+			2,
+			2,
+			2,
+			2,
+			2
+		]);
+		expect(calls.count).toBe(1);
+	});
+	it("stores no rejected read", async () => {
+		const principal = { id: "u-version-failed" };
+		await expect(cache.current(principal, () => Promise.reject(/* @__PURE__ */ new Error("down")), { live: false })).rejects.toThrow("down");
+		const { calls, read } = counted(1);
+		expect(await cache.current(principal, read, { live: false })).toBe(1);
+		expect(calls.count).toBe(1);
+	});
+	it("reads again after evict", async () => {
+		const { calls, read } = counted(3);
+		const principal = { id: "u-version-evict" };
+		await cache.current(principal, read, { live: false });
+		cache.evict(principal.id);
+		await cache.current(principal, read, { live: false });
+		expect(calls.count).toBe(2);
+		expect(cache.stats().reads).toBeGreaterThanOrEqual(2);
+	});
+}
 //#endregion
 //#region src/testing/cloud-api/platform.ts
 const CATALOG = "https://permdock.com/schemas/catalog-v1.json";
@@ -6249,7 +6302,8 @@ const supabaseHookManifestFixture = {
 	hook: {
 		schema: "permdock",
 		function: "custom_access_token_hook",
-		out: "supabase/permdock-hook.sql"
+		out: "supabase/permdock-hook.sql",
+		activeFrom: { appMetadata: "active_tenant" }
 	},
 	helpers: {
 		schema: "permdock",
@@ -6532,4 +6586,4 @@ const PROBLEM_EXAMPLES = Object.freeze({
 	}
 });
 //#endregion
-export { AGENT_THROWING_ROW, AGENT_THROWING_USER, PROBLEM_EXAMPLES, authzenTodoData, authzenTodoPermissions, authzenTodoPolicy, authzenTodoUsers, authzenTodoVectors, describePolicy, expectTypeOf, jwtFixtureAudience, jwtFixtureIssuer, jwtFixtureJwks, jwtFixtureTokens, policyMatrix, seedRows, snapshotFixture, supabaseClaimFixtures, supabaseClaimVectors, supabaseHookManifestFixture, supabaseMembershipsBudget, testAccessReviewStore, testAgentAdapter, testAgentRuntime, testApprovalDelegationSource, testApprovalPolicySource, testApprovalStore, testApprovalWaiter, testAuthzen, testAutomationSource, testClientParity, testClientStore, testCloudApi, testCredentialVerifier, testCustomRoleSource, testDecisionProvider, testDecisionSink, testDeliveryTransport, testDirectoryStore, testEntitlementSource, testHttpAdapter, testIdempotencyStore, testLegacyParity, testLimitStore, testMembershipSource, testOrmParity, testPolicySource, testPrincipalSource, testRelationSource, testReplayStore, testRevocationFeed, testRlsParity, testSetQueue, testSettingsSource, testSnapshotSource, testSnapshotStorage, testSsfStreamStore, testSubjectResolver, testSupportSessionSource, testTokenSigner, testTokenVerifier, testWhereCompiler };
+export { AGENT_THROWING_ROW, AGENT_THROWING_USER, PROBLEM_EXAMPLES, authzenTodoData, authzenTodoPermissions, authzenTodoPolicy, authzenTodoUsers, authzenTodoVectors, describePolicy, expectTypeOf, jwtFixtureAudience, jwtFixtureIssuer, jwtFixtureJwks, jwtFixtureTokens, policyMatrix, seedRows, snapshotFixture, supabaseClaimFixtures, supabaseClaimVectors, supabaseHookManifestFixture, supabaseMembershipsBudget, testAccessReviewStore, testAgentAdapter, testAgentRuntime, testApprovalDelegationSource, testApprovalPolicySource, testApprovalStore, testApprovalWaiter, testAuthzen, testAutomationSource, testClientParity, testClientStore, testCloudApi, testCredentialVerifier, testCustomRoleSource, testDecisionProvider, testDecisionSink, testDeliveryTransport, testDirectoryStore, testEntitlementSource, testHttpAdapter, testIdempotencyStore, testLegacyParity, testLimitStore, testMembershipSource, testOrmParity, testPolicySource, testPrincipalSource, testRelationSource, testReplayStore, testRevocationFeed, testRlsParity, testSetQueue, testSettingsSource, testSnapshotSource, testSnapshotStorage, testSsfStreamStore, testSubjectResolver, testSupportSessionSource, testTokenSigner, testTokenVerifier, testVersionCache, testWhereCompiler };

package/dist/testing/saas/index.d.ts

@@ -1,8 +1,8 @@
-import { Q as LimitStore, Rt as Instant, Zn as Actor, it as RelationSource, lr as Subject, or as Membership, rr as Delegation, sr as Principal, tr as CustomRole } from "../../policy-types-CCiDRZBH.js";
+import { Wt as Instant, et as LimitStore, fr as Membership, hr as Subject, lr as Delegation, ot as RelationSource, pr as Principal, rr as Actor, sr as CustomRole } from "../../policy-types-DGIO_gxq.js";
 import { u as Permission } from "../../permission-types-CAY-GU7e.js";
-import { o as PermDockOptions } from "../../permdock-B6Sf4T_S.js";
+import { o as PermDockOptions } from "../../permdock-CprAPN3w.js";
 import { a as SaasProject, c as saasPlans, i as SaasFolderSchema, l as saasRoles, n as SaasDocSchema, o as SaasProjectSchema, r as SaasFolder, s as saasPermissions, t as SaasDoc, u as saasTenantRoleNames } from "../../permissions-Bx6UI8n1.js";
-import { n as saasPolicy, t as SAAS_API_KEY_LIMIT } from "../../policy-Ba4bDhaj.js";
+import { n as saasPolicy, t as SAAS_API_KEY_LIMIT } from "../../policy-BycVKnXv.js";
 import { StandardSchemaV1 } from "@standard-schema/spec";
 //#region src/testing/saas/schema.d.ts
 type FieldKind = "string" | "boolean" | "nullable-string";

package/dist/testing/saas/index.js

@@ -1,3 +1,3 @@
-import { a as saasPlans, c as rowSchema, i as saasPermissions, n as SaasFolderSchema, o as saasRoles, r as SaasProjectSchema, s as saasTenantRoleNames, t as SaasDocSchema } from "../../permissions-mDcTWoBs.js";
-import { C as saasOrg, D as saasUsers, E as saasSeed, O as SAAS_API_KEY_LIMIT, S as saasMemberships, T as saasRelations, _ as verifySaasToken, a as saasProject, b as SAAS_EXPIRED_AT, c as saasUser, d as saasIssuer, f as saasJwks, g as verifySaasSession, h as signSaasToken, i as saasLimitStore, k as saasPolicy, l as SAAS_TOKEN_TTL_SECONDS, m as saasPublicJwk, n as saasFolder, o as saasScenarioOptions, p as saasPrivateJwk, r as saasFolderScenarios, s as saasScenarios, t as saasDoc, u as saasAudience, v as saasSchemaSql, w as saasPrincipal, x as saasCustomRoles, y as saasSeedSql } from "../../saas-iWnUdwCt.js";
+import { a as saasPlans, c as rowSchema, i as saasPermissions, n as SaasFolderSchema, o as saasRoles, r as SaasProjectSchema, s as saasTenantRoleNames, t as SaasDocSchema } from "../../permissions-CYcHj_w7.js";
+import { C as saasOrg, D as saasUsers, E as saasSeed, O as SAAS_API_KEY_LIMIT, S as saasMemberships, T as saasRelations, _ as verifySaasToken, a as saasProject, b as SAAS_EXPIRED_AT, c as saasUser, d as saasIssuer, f as saasJwks, g as verifySaasSession, h as signSaasToken, i as saasLimitStore, k as saasPolicy, l as SAAS_TOKEN_TTL_SECONDS, m as saasPublicJwk, n as saasFolder, o as saasScenarioOptions, p as saasPrivateJwk, r as saasFolderScenarios, s as saasScenarios, t as saasDoc, u as saasAudience, v as saasSchemaSql, w as saasPrincipal, x as saasCustomRoles, y as saasSeedSql } from "../../saas-DK4V-3Is.js";
 export { SAAS_API_KEY_LIMIT, SAAS_EXPIRED_AT, SAAS_TOKEN_TTL_SECONDS, SaasDocSchema, SaasFolderSchema, SaasProjectSchema, rowSchema, saasAudience, saasCustomRoles, saasDoc, saasFolder, saasFolderScenarios, saasIssuer, saasJwks, saasLimitStore, saasMemberships, saasOrg, saasPermissions, saasPlans, saasPolicy, saasPrincipal, saasPrivateJwk, saasProject, saasPublicJwk, saasRelations, saasRoles, saasScenarioOptions, saasScenarios, saasSchemaSql, saasSeed, saasSeedSql, saasTenantRoleNames, saasUser, saasUsers, signSaasToken, verifySaasSession, verifySaasToken };

package/dist/testing/saas/permissions.js

@@ -1 +1 @@
-export { t as SaasDocSchema, n as SaasFolderSchema, r as SaasProjectSchema, i as saasPermissions, a as saasPlans, o as saasRoles, s as saasTenantRoleNames } from "../../permissions-mDcTWoBs.js";
+export { t as SaasDocSchema, n as SaasFolderSchema, r as SaasProjectSchema, i as saasPermissions, a as saasPlans, o as saasRoles, s as saasTenantRoleNames } from "../../permissions-CYcHj_w7.js";

package/dist/trpc/index.d.ts

@@ -1,10 +1,10 @@
-import { T as Policy, sr as Principal } from "../policy-types-CCiDRZBH.js";
+import { T as Policy, pr as Principal } from "../policy-types-DGIO_gxq.js";
 import { u as Permission } from "../permission-types-CAY-GU7e.js";
-import { a as PermDock } from "../permdock-B6Sf4T_S.js";
+import { a as PermDock } from "../permdock-CprAPN3w.js";
 import { n as RevocationFeed } from "../revocations-BaUXHM1N.js";
-import { D as ConnectionOptions, T as Connection, i as OpenApiHooks } from "../server-types-CIlpSA2G.js";
-import { t as ServerAdapterOptions } from "../bind-Cp2hBHzP.js";
-import { t as StreamProtectOptions } from "../stream-ltuLdtTG.js";
+import { D as ConnectionOptions, T as Connection, i as OpenApiHooks } from "../server-types-CyRN0-Cd.js";
+import { t as ServerAdapterOptions } from "../bind-YYjvfpB9.js";
+import { t as StreamProtectOptions } from "../stream-9y9qw51m.js";
 import { AnyTRPCMiddlewareFunction } from "@trpc/server";
 //#region src/trpc/create.d.ts
 type TrpcMiddlewareOpts<TCtx = object, TInput = unknown> = {

package/dist/trpc/index.js

@@ -1,8 +1,8 @@
 import { o as problemMessage } from "../http-DKLXrFGk.js";
 import { t as problemFromError } from "../map-error-pasIGqMT.js";
-import { n as attached } from "../bind-D_sZSVA3.js";
+import { n as attached } from "../bind-BNQA9JK9.js";
 import { i as isAsyncIterable, o as reloadAfter } from "../stream-CDvF0sJm.js";
-import { i as rpcCode, n as guardStream, r as problemBody, t as bindRpcKernel } from "../rpc-fNqAIqQk.js";
+import { i as rpcCode, n as guardStream, r as problemBody, t as bindRpcKernel } from "../rpc-vHIwyXCp.js";
 import { TRPCError, isTrackedEnvelope } from "@trpc/server";
 //#region src/trpc/create.ts
 const PROBLEM = Symbol.for("permdock.problem");

package/dist/{type-helpers-BIPIDa6a.d.ts → type-helpers-c7Xo_2Cu.d.ts}

@@ -1,4 +1,4 @@
-import { j as PolicyVocabulary, mn as ScopeNames } from "./policy-types-CCiDRZBH.js";
+import { bn as ScopeNames, j as PolicyVocabulary } from "./policy-types-DGIO_gxq.js";
 import { k as POLICY_SCOPES, u as Permission } from "./permission-types-CAY-GU7e.js";
 import { n as PlanTree } from "./vocabulary-DEJ5j4mR.js";
 import { o as OperationMap } from "./operations-Ci_rT6Uo.js";

package/dist/{types-B2mlGuhW.d.ts → types-B2efzoSX.d.ts}

@@ -1,4 +1,4 @@
-import { gn as Approver } from "./policy-types-CCiDRZBH.js";
+import { Sn as Approver } from "./policy-types-DGIO_gxq.js";
 //#region src/approvals/access-reviews/types.d.ts
 type AccessReviewStatus = "open" | "closed";
 type AccessReviewItemStatus = "pending" | "kept" | "revoked";

package/dist/{types-DHKPcqzr.d.ts → types-B6ExllNo.d.ts}

@@ -1,5 +1,5 @@
-import { en as DecisionEvent, j as PolicyVocabulary } from "./policy-types-CCiDRZBH.js";
-import { a as PermDock } from "./permdock-B6Sf4T_S.js";
+import { j as PolicyVocabulary, on as DecisionEvent } from "./policy-types-DGIO_gxq.js";
+import { a as PermDock } from "./permdock-CprAPN3w.js";
 //#region src/otel/types.d.ts
 declare const GENAI_SEMCONV_PIN = "1.37.0";
 declare const GEN_AI_TOOL_NAME = "gen_ai.tool.name";

package/dist/{types-AMJ5qoU_.d.ts → types-BB-zWDcR.d.ts}

@@ -1,8 +1,8 @@
-import { dt as TokenVerifier, lr as Subject, ot as SnapshotSource, q as DecisionSink, ut as TokenSigner } from "./policy-types-CCiDRZBH.js";
-import { s as PolicySource } from "./hosted-Cmtxogd0.js";
-import { m as ApprovalStore, u as ApprovalRequest } from "./types-B_tiYvk8.js";
+import { J as DecisionSink, ct as SnapshotSource, hr as Subject, ht as TokenVerifier, mt as TokenSigner } from "./policy-types-DGIO_gxq.js";
+import { s as PolicySource } from "./hosted-DVxlLZMe.js";
+import { m as ApprovalStore, u as ApprovalRequest } from "./types-DLvhVm1r.js";
 import { a as CatalogDocument } from "./types-ZzRGoViD.js";
-import { a as CatalogFinding } from "./sink-Dvi7YZG_.js";
+import { a as CatalogFinding } from "./sink-B5zoUW_O.js";
 //#region src/cloud/types.d.ts
 type CloudEndpointOptions = {
   readonly url?: string;

package/dist/{types-djVzLlIV.d.ts → types-CEinc15V.d.ts}

@@ -1,9 +1,9 @@
-import { Gt as Snapshot, In as ApprovalRequiredDecision, Ln as Decision, Un as GrantedDecision, dt as TokenVerifier } from "./policy-types-CCiDRZBH.js";
+import { Hn as ApprovalRequiredDecision, Un as Decision, Yn as GrantedDecision, Zt as Snapshot, ht as TokenVerifier } from "./policy-types-DGIO_gxq.js";
 import { u as Permission } from "./permission-types-CAY-GU7e.js";
-import { a as PermDock } from "./permdock-B6Sf4T_S.js";
+import { a as PermDock } from "./permdock-CprAPN3w.js";
 import { t as PermissionBoundaryState } from "./boundary-C9ck-3uK.js";
-import { t as ActionResult } from "./action-result-CL-QCITA.js";
-import { d as ProtectedActionView, f as ProviderOptionsBase, g as ClientStore, l as PermissionState } from "./types-B_d_g7T3.js";
+import { t as ActionResult } from "./action-result-BcudBQOF.js";
+import { d as ProtectedActionView, f as ProviderOptionsBase, g as ClientStore, l as PermissionState } from "./types-tQB2CEnY.js";
 import { Snippet } from "svelte";
 import { Readable } from "svelte/store";
 //#region src/client/views.d.ts

package/dist/{types-yUuPR5Hy.d.ts → types-CN0LsqbK.d.ts}

@@ -1,6 +1,6 @@
-import { Un as GrantedDecision, an as EmailCategory, nn as DeliveryEvent, rn as DeliveryFailureCause, tn as DeliveryChannel } from "./policy-types-CCiDRZBH.js";
-import { s as CloudEvent } from "./sink-Dvi7YZG_.js";
-import { t as ApprovalPrompt } from "./approval-prompt-PYagyQUj.js";
+import { Yn as GrantedDecision, cn as DeliveryEvent, dn as EmailCategory, ln as DeliveryFailureCause, sn as DeliveryChannel } from "./policy-types-DGIO_gxq.js";
+import { s as CloudEvent } from "./sink-B5zoUW_O.js";
+import { t as ApprovalPrompt } from "./approval-prompt-3BqWczTt.js";
 //#region src/delivery/types.d.ts
 /**
  * Who a delivery goes to. `{ principal }` names an app principal and the

package/dist/{types-HzqOtvsJ.d.ts → types-CWBsAwqn.d.ts}

@@ -1,7 +1,7 @@
-import { Gt as Snapshot, dt as TokenVerifier, ot as SnapshotSource } from "./policy-types-CCiDRZBH.js";
-import { n as DescribeMessages } from "./describe-ByS9LgHK.js";
-import { _ as ClientStoreOptions } from "./types-B_d_g7T3.js";
-import { t as PermDockDefaults } from "./types-BJk0BKRX.js";
+import { Zt as Snapshot, ct as SnapshotSource, ht as TokenVerifier } from "./policy-types-DGIO_gxq.js";
+import { n as DescribeMessages } from "./describe-BbFPBSms.js";
+import { _ as ClientStoreOptions } from "./types-tQB2CEnY.js";
+import { t as PermDockDefaults } from "./types-rCRV4Ge-.js";
 import { ReactNode } from "react";
 //#region src/react-native/types.d.ts
 type SnapshotStorage = {

package/dist/{types-DC1Loeh3.d.ts → types-Cklw5hJo.d.ts}

@@ -1,5 +1,4 @@
-import { n as RoleMap, r as RoleThrough } from "./types-ah9NlU6j.js";
-import { s as SqlMembershipSource } from "./sources-B1Os_YUu.js";
+import { h as RoleThrough, m as RoleMap, s as SqlMembershipSource } from "./sources-oB1Hg1Fm.js";
 //#region src/cli/core/errors.d.ts
 /**
  * 0 success, 1 failure, 2 usage, 3 action required, 130 interrupted (SIGINT or
@@ -408,7 +407,9 @@ type RlsConfig = {
    */
   readonly helpersOnly?: boolean;
   /**
-   * Emit `permitted_<resource>_rows(p_permission)` and its `_for` form for
+   * Emit `permitted_<resource>_rows(p_permission)`, its `_for` form,
+   * `permitted_<resource>_rows(p_permission, p_ids)` limited to candidate ids
+   * and the row-valued `permitted_<resource>_row(p_row, p_permission)` for
    * these resources, or for every resource a grant reaches with `true`: the row
    * ids the caller may act on, as the generated policies decide them.
    */
@@ -933,6 +934,28 @@ type PowerSyncConfig = {
    * `localSnapshot` and `powerSyncSource`; none by default.
    */
   readonly manifest?: string;
+  /**
+   * Tables that are not resources, by `schema.table`, each synced as its own
+   * stream: the user's own rows, the rows that point at a resource row the user
+   * reads, or both.
+   */
+  readonly tables?: Readonly<Record<string, PowerSyncTable>>;
+};
+type PowerSyncTable = {
+  /** The user id column: the stream holds the rows whose column is the user. */
+  readonly user?: string;
+  /** The resources a row points at; the stream holds rows of any of them. */
+  readonly follow?: readonly PowerSyncFollow[];
+};
+/**
+ * A row points at a `resource` row through `field`, which holds its id; `match`
+ * keeps the rows whose columns equal the given values, for a table whose rows
+ * point at several resources.
+ */
+type PowerSyncFollow = {
+  readonly resource: string;
+  readonly field: string;
+  readonly match?: Readonly<Record<string, string>>;
 };
 type CliIo = {
   readonly stdout: (text: string) => void;

package/dist/{types-B_tiYvk8.d.ts → types-DLvhVm1r.d.ts}

@@ -1,4 +1,4 @@
-import { Dn as RelationGrantee, Rt as Instant, fr as AdapterId, gn as Approver, lr as Subject, o as ApprovalStage, or as Membership, r as ApprovalMode, un as WireDelegation } from "./policy-types-CCiDRZBH.js";
+import { Nn as RelationGrantee, Sn as Approver, Wt as Instant, fr as Membership, gn as WireDelegation, hr as Subject, o as ApprovalStage, r as ApprovalMode, vr as AdapterId } from "./policy-types-DGIO_gxq.js";
 import { M as AppData } from "./permission-types-CAY-GU7e.js";
 //#region src/approvals/types.d.ts
 type ApprovalStatus = "pending" | "approved" | "rejected" | "expired";

package/dist/{types-B4uqKDnp.d.ts → types-DlelvQk4.d.ts}

@@ -1,6 +1,6 @@
-import { Hn as ExplainedDecision, Ln as Decision, T as Policy, j as PolicyVocabulary, lr as Subject, or as Membership, sr as Principal } from "./policy-types-CCiDRZBH.js";
+import { Jn as ExplainedDecision, T as Policy, Un as Decision, fr as Membership, hr as Subject, j as PolicyVocabulary, pr as Principal } from "./policy-types-DGIO_gxq.js";
 import { f as PermissionTree, u as Permission } from "./permission-types-CAY-GU7e.js";
-import { C as PermissionCheck, a as PermDock, f as WhereResult, l as SimulateOptions, n as DecideOptions, o as PermDockOptions, r as DeriveOptions } from "./permdock-B6Sf4T_S.js";
+import { C as PermissionCheck, a as PermDock, f as WhereResult, l as SimulateOptions, n as DecideOptions, o as PermDockOptions, r as DeriveOptions } from "./permdock-CprAPN3w.js";
 //#region src/pdp/types.d.ts
 type RemotePdpAuth = {
   readonly bearer: string | (() => string | Promise<string>);

package/dist/{types-DjuMBNF9.d.ts → types-DsHGPtkR.d.ts}

@@ -1,5 +1,5 @@
-import { Y as JwtClaims, Zn as Actor, Zt as AuthEvent, dt as TokenVerifier, et as MembershipSource, lr as Subject, lt as TokenFailureCause, sr as Principal } from "./policy-types-CCiDRZBH.js";
-import { m as ApprovalStore } from "./types-B_tiYvk8.js";
+import { Z as JwtClaims, hr as Subject, ht as TokenVerifier, nt as MembershipSource, pr as Principal, pt as TokenFailureCause, rn as AuthEvent, rr as Actor } from "./policy-types-DGIO_gxq.js";
+import { m as ApprovalStore } from "./types-DLvhVm1r.js";
 import { n as RevocationFeed } from "./revocations-BaUXHM1N.js";
 import { t as ClaimsMap } from "./claims-map-D1Pb5oRq.js";
 import { t as ClientNames } from "./clients-C_NOET3z.js";

package/dist/{types-BJk0BKRX.d.ts → types-rCRV4Ge-.d.ts}

@@ -1,8 +1,8 @@
-import { Gt as Snapshot, In as ApprovalRequiredDecision, Ln as Decision, Un as GrantedDecision, dt as TokenVerifier } from "./policy-types-CCiDRZBH.js";
+import { Hn as ApprovalRequiredDecision, Un as Decision, Yn as GrantedDecision, Zt as Snapshot, ht as TokenVerifier } from "./policy-types-DGIO_gxq.js";
 import { u as Permission } from "./permission-types-CAY-GU7e.js";
-import { s as RowData } from "./permdock-B6Sf4T_S.js";
-import { n as DescribeMessages } from "./describe-ByS9LgHK.js";
-import { _ as ClientStoreOptions } from "./types-B_d_g7T3.js";
+import { s as RowData } from "./permdock-CprAPN3w.js";
+import { n as DescribeMessages } from "./describe-BbFPBSms.js";
+import { _ as ClientStoreOptions } from "./types-tQB2CEnY.js";
 import { ReactNode } from "react";
 //#region src/react/types.d.ts
 type PermDockProviderProps = ({

package/dist/{types-B_d_g7T3.d.ts → types-tQB2CEnY.d.ts}

@@ -1,8 +1,8 @@
-import { Gt as Snapshot, Ln as Decision, Zn as Actor, dt as TokenVerifier, j as PolicyVocabulary, rr as Delegation, sr as Principal } from "./policy-types-CCiDRZBH.js";
+import { Un as Decision, Zt as Snapshot, ht as TokenVerifier, j as PolicyVocabulary, lr as Delegation, pr as Principal, rr as Actor } from "./policy-types-DGIO_gxq.js";
 import { u as Permission } from "./permission-types-CAY-GU7e.js";
-import { a as PermDock } from "./permdock-B6Sf4T_S.js";
-import { n as DescribeMessages, t as DecisionDescription } from "./describe-ByS9LgHK.js";
-import { t as ActionResult } from "./action-result-CL-QCITA.js";
+import { a as PermDock } from "./permdock-CprAPN3w.js";
+import { n as DescribeMessages, t as DecisionDescription } from "./describe-BbFPBSms.js";
+import { t as ActionResult } from "./action-result-BcudBQOF.js";
 //#region src/client/refresh-on.d.ts
 /**
  * Calls `refresh` when the snapshot may be out of date (a membership event, a

package/dist/unplugin/index.d.ts

@@ -1,4 +1,4 @@
-import { s as PermDockPluginOptions } from "../types-DC1Loeh3.js";
+import { s as PermDockPluginOptions } from "../types-Cklw5hJo.js";
 import { createUnplugin } from "unplugin";
 //#region src/unplugin/index.d.ts
 type CreateUnplugin = typeof createUnplugin<PermDockPluginOptions | undefined>;

package/dist/unplugin/index.js

@@ -1,4 +1,4 @@
-import { n as createCollectScheduler, r as report } from "../watch-Cx_WciLE.js";
+import { n as createCollectScheduler, r as report } from "../watch-Bpci3hBY.js";
 import { r as peerHint } from "../peer-Q0fuZ6hx.js";
 import { createRequire } from "node:module";
 //#region src/unplugin/index.ts

package/dist/{usage-ab0PdusX.js → usage-B1ZJOUdr.js}

@@ -16,7 +16,7 @@ const usage = defineLeaf({
 		}
 	},
 	async run(ctx, { flags }) {
-		return (await import("./usage-CYeXek0p.js")).runUsage({
+		return (await import("./usage-weohzv2f.js")).runUsage({
 			cwd: ctx.cwd,
 			config: ctx.config,
 			ignore: flags.ignore,

package/dist/{usage-CxEzS4ey.js → usage-t_nXnwCW.js}

@@ -4,10 +4,10 @@ import { a as rel, r as listSourceFiles } from "./files-BSjrtIHw.js";
 import { o as USAGE_REPORT_SCHEMA } from "./version-DMQ0dnN5.js";
 import { c as jsonSchemaOf } from "./catalog-doc-DjMKzJp9.js";
 import { a as loadModule, n as asPolicy, s as pickNamed } from "./load-DjSU5KXO.js";
-import { r as runCollect } from "./collect-B7ZFAJU3.js";
+import { r as runCollect } from "./collect-WCl8cJQV.js";
 import { t as beforeFirst } from "./text-BMFRfBqc.js";
-import { t as DOCS_BASE } from "./manifest-Cgiq5oqc.js";
-import { r as findingOf } from "./output-tkju6U7R.js";
+import { t as DOCS_BASE } from "./manifest-B4ENCp2I.js";
+import { r as findingOf } from "./output-LsbLe41I.js";
 import { existsSync, readFileSync, realpathSync } from "node:fs";
 import { dirname, resolve } from "node:path";
 import { fileURLToPath, pathToFileURL } from "node:url";

package/dist/usage-weohzv2f.js

@@ -0,0 +1 @@
+export { t as runUsage } from "./usage-t_nXnwCW.js";