permdock 0.8.0 → 0.10.0

package/dist/{validation-error-YGg2mXyH.d.ts → validation-error-uvp-kyfO.d.ts}

@@ -1,4 +1,4 @@
-import { a as ProblemDetails } from "./errors-zi_4T-rx.js";
+import { a as ProblemDetails } from "./errors-BIM4MFsJ.js";
 import { StandardSchemaV1 } from "@standard-schema/spec";
 //#region src/core/validation-error.d.ts
 /**

package/dist/{verify-DZeqoWu5.js → verify-jHrbmn-E.js}

@@ -1,6 +1,6 @@
 import { a as sole, r as isRecord } from "./compact-CAf557ZB.js";
 import { l as isConditionRef, o as hasConditionOp } from "./refs-C8BKxc_e.js";
-import { A as memoryCustomRoleSource, b as memoryRelationSource } from "./src-DZ0l9UAg.js";
+import { j as memoryCustomRoleSource, x as memoryRelationSource } from "./src-C_pi2Rnh.js";
 import { c as listPermissions, h as formerKeys, n as findPermission } from "./permission-registry-B8tYxPIt.js";
 import { c as isEdgeRelation, l as isFieldRelation, u as isPrincipalRelation } from "./resource-relations-8-pCScBO.js";
 import { f as nowMillis, u as isoAt } from "./time-nR1JesoH.js";
@@ -10,8 +10,8 @@ import { o as requiresStandIn } from "./delegation-CDB6_keF.js";
 import { p as scopeField } from "./tenancy-5d1zVBvK.js";
 import { l as policyLevels, t as coveredLevels } from "./policy-CLQ8__GF.js";
 import { t as requiresApproval } from "./approval-required-TzNB9oQA.js";
-import { c as andWhere, m as customRoleScope, v as leveled, y as membershipsClaim } from "./evaluate-Dd8Ta0Ie.js";
-import { t as getPermDock } from "./permdock-L-_I_3zP.js";
+import { c as andWhere, m as customRoleScope, v as leveled, y as membershipsClaim } from "./evaluate-BAmf_AQd.js";
+import { t as getPermDock } from "./permdock-BvjivVb9.js";
 import { a as describeError, i as configError, u as usageResult } from "./errors-Vpu6rKHl.js";
 import { t as policyRowConditionKeys } from "./row-conditions-BAGHOmVq.js";
 import { s as writeFileEnsuringDir } from "./files-BSjrtIHw.js";
@@ -20,16 +20,16 @@ import { o as loadPolicyAt } from "./load-DjSU5KXO.js";
 import { i as qualifySqlTable, n as defaultSqlCommand, t as SQL_IDENT } from "./sql-0WjxIp9g.js";
 import { a as scopeMembershipTable, i as scopeColumn } from "./compile-EzEMB-7v.js";
 import "./budget-BELja5A9.js";
-import "./sources-CMAM-2A3.js";
+import "./sources-C4vkzZJV.js";
 import { t as beforeFirst } from "./text-BMFRfBqc.js";
-import { t as DOCS_BASE } from "./manifest-Cgiq5oqc.js";
+import { t as DOCS_BASE } from "./manifest-B4ENCp2I.js";
 import { n as fixtureSubject, r as loadFixtures, t as fixtureRow } from "./fixtures-A1_sp_tR.js";
-import { A as quoteQualified, N as arrayColumnsOf, O as quoteIdent, P as columnTypesOf, _ as subjectClaimJsonSql, a as customRolesOn, j as quoteTable, k as quoteLiteral, r as HELPERS, v as subjectClaimSql } from "./shared-Afctg7B0.js";
-import { C as accessSql, D as tokenScopeAllowsCall, S as requiresSql, ht as scopeTable, k as capabilityAccessSql, n as tableNameOf, o as graphPlan, q as apiKeyAllowsCall, r as tableNames } from "./tables-DeMNEy6V.js";
-import { c as breakGlassKey, f as compileConditionSql, l as collectGrants, m as sqlFunctionNames, p as contextRefs, s as breakGlassHolder } from "./ownership-B4L59T9u.js";
+import { A as quoteQualified, N as arrayColumnsOf, O as quoteIdent, P as columnTypesOf, _ as subjectClaimJsonSql, a as customRolesOn, j as quoteTable, k as quoteLiteral, r as HELPERS, v as subjectClaimSql } from "./shared-DrGLwM3s.js";
+import { C as accessSql, D as tokenScopeAllowsCall, S as requiresSql, ht as scopeTable, k as capabilityAccessSql, n as tableNameOf, o as graphPlan, q as apiKeyAllowsCall, r as tableNames } from "./tables-DimBcVWY.js";
+import { c as breakGlassKey, f as compileConditionSql, l as collectGrants, m as sqlFunctionNames, p as contextRefs, s as breakGlassHolder } from "./ownership-qqBuGJXr.js";
 import { t as membershipSourcesOf } from "./sources-qoIJQrJv.js";
 import { n as pgConnector, t as connectPgPool } from "./pg-DQTqRrou.js";
-import { _ as wrapSql, g as validitySql, m as andSql, s as viewName, t as FIELD_VIEWS } from "./fields-D0vUI6dq.js";
+import { _ as wrapSql, g as validitySql, m as andSql, s as viewName, t as FIELD_VIEWS } from "./fields-DI8s3cPl.js";
 import { resolve } from "node:path";
 import { createHash, randomUUID } from "node:crypto";
 //#region src/cli/rls/indexes.ts

package/dist/version-cache-Df11C2Qp.d.ts

@@ -0,0 +1,51 @@
+import { Wt as Instant, yt as VersionQuery } from "./policy-types-DGIO_gxq.js";
+//#region src/core/version-cache.d.ts
+type VersionCacheStats = {
+  /** Version reads the cache started. */
+  readonly reads: number;
+  /** Calls answered by a read already in flight. */
+  readonly shared: number;
+  /** Calls answered from an entry or a token claim, with no read. */
+  readonly hits: number;
+  readonly evictions: number;
+  readonly size: number;
+};
+/**
+ * Current authorization versions shared by every instance in a process:
+ * `claimsFirst(source, { versions })` reads through it.
+ */
+type VersionCache = {
+  readonly name?: string;
+  /** How old an entry may be when an instance with intent `read` uses it. */
+  readonly maxStaleMs: number;
+  /**
+   * The current version of `principal`. With `live: false`, an entry at most
+   * `maxStaleMs` old answers, a read in flight is shared, and a token claim
+   * newer than the entry raises it; with `live: true`, `read` runs.
+   */
+  current: (principal: VersionQuery, read: () => number | undefined | Promise<number | undefined>, options: {
+    readonly live: boolean;
+  }) => number | undefined | Promise<number | undefined>;
+  /** Drops `principal`'s entry, so the next instance reads the version. */
+  evict: (principal: string) => void;
+  stats: () => VersionCacheStats;
+};
+type MemoryVersionCacheOptions = {
+  /**
+   * How stale a read may be, in milliseconds: the entry lifetime and the
+   * longest a removed member keeps read access. Clamped to 0 to 60,000.
+   */
+  readonly maxStaleMs: number;
+  /** Principals kept; the least recently used goes first. Default 10,000. */
+  readonly maxEntries?: number;
+  /** The clock, read only when an instance asks for a version. */
+  readonly now?: () => Instant;
+};
+/**
+ * An in-process `VersionCache`: a bounded LRU keyed by principal id that keeps
+ * resolved versions and shares reads in flight. Create it once at module
+ * scope.
+ */
+declare function memoryVersionCache(options: MemoryVersionCacheOptions): VersionCache;
+//#endregion
+export { memoryVersionCache as i, VersionCache as n, VersionCacheStats as r, MemoryVersionCacheOptions as t };

package/dist/vue/index.d.ts

@@ -1,13 +1,13 @@
-import { Gt as Snapshot, In as ApprovalRequiredDecision, Ln as Decision, dt as TokenVerifier, j as PolicyVocabulary, or as Membership } from "../policy-types-CCiDRZBH.js";
+import { Hn as ApprovalRequiredDecision, Un as Decision, Zt as Snapshot, fr as Membership, ht as TokenVerifier, j as PolicyVocabulary } from "../policy-types-DGIO_gxq.js";
 import { u as Permission } from "../permission-types-CAY-GU7e.js";
 import { r as Role } from "../vocabulary-DEJ5j4mR.js";
-import { d as UncheckedData, s as RowData } from "../permdock-B6Sf4T_S.js";
-import { c as requiredPlans } from "../errors-zi_4T-rx.js";
-import { i as describe, r as DescribeOptions, t as DecisionDescription } from "../describe-ByS9LgHK.js";
+import { d as UncheckedData, s as RowData } from "../permdock-CprAPN3w.js";
+import { c as requiredPlans } from "../errors-BIM4MFsJ.js";
+import { i as describe, r as DescribeOptions, t as DecisionDescription } from "../describe-BbFPBSms.js";
 import { t as PermissionBoundaryState } from "../boundary-C9ck-3uK.js";
-import { n as ProtectedAction, t as ActionResult } from "../action-result-CL-QCITA.js";
+import { n as ProtectedAction, t as ActionResult } from "../action-result-BcudBQOF.js";
 import { t as approvalHeaders } from "../headers-B9jQxjtW.js";
-import { a as FilterResult, b as eventSourceRefresh, c as PermissionSet, d as ProtectedActionView, f as ProviderOptionsBase, h as TenantView, i as ClientStatus, l as PermissionState, m as SubjectView, n as ApprovalState, o as GateMode, p as RolesOptions, r as ClientPermDock, s as GateView, t as ApprovalHandle, v as EventSourceRefreshOptions, y as RefreshTrigger } from "../types-B_d_g7T3.js";
+import { a as FilterResult, b as eventSourceRefresh, c as PermissionSet, d as ProtectedActionView, f as ProviderOptionsBase, h as TenantView, i as ClientStatus, l as PermissionState, m as SubjectView, n as ApprovalState, o as GateMode, p as RolesOptions, r as ClientPermDock, s as GateView, t as ApprovalHandle, v as EventSourceRefreshOptions, y as RefreshTrigger } from "../types-tQB2CEnY.js";
 import { ComputedRef, DefineComponent, MaybeRefOrGetter, Plugin, VNode } from "vue";
 //#region src/vue/types.d.ts
 type PermDockPluginOptions = ProviderOptionsBase & {

package/dist/{waiter-Bu9zAlE0.d.ts → waiter-CqUKX6CY.d.ts}

@@ -1,5 +1,5 @@
-import { Rt as Instant } from "./policy-types-CCiDRZBH.js";
-import { m as ApprovalStore } from "./types-B_tiYvk8.js";
+import { Wt as Instant } from "./policy-types-DGIO_gxq.js";
+import { m as ApprovalStore } from "./types-DLvhVm1r.js";
 //#region src/workflow/waiter.d.ts
 type ApprovalWaitOptions = {
   /**

package/dist/{watch-Cx_WciLE.js → watch-Bpci3hBY.js}

@@ -1,8 +1,8 @@
 import { i as dateAt } from "./time-nR1JesoH.js";
 import { a as describeError } from "./errors-Vpu6rKHl.js";
 import { t as defaultSrcPath } from "./files-BSjrtIHw.js";
-import { r as runCollect } from "./collect-B7ZFAJU3.js";
-import { n as isConfigFile, r as loadConfig } from "./config-BwPBfN0t.js";
+import { r as runCollect } from "./collect-WCl8cJQV.js";
+import { n as isConfigFile, r as loadConfig } from "./config-BR23fL8m.js";
 import { watch } from "node:fs";
 import { basename, dirname, relative, resolve, sep } from "node:path";
 //#region src/cli/watch.ts

package/dist/watch-COuvly20.js

@@ -0,0 +1 @@
+export { i as watchCollect } from "./watch-Bpci3hBY.js";

package/dist/webmcp/index.d.ts

@@ -1,4 +1,4 @@
-import { Gt as Snapshot, Ln as Decision } from "../policy-types-CCiDRZBH.js";
+import { Un as Decision, Zt as Snapshot } from "../policy-types-DGIO_gxq.js";
 import { f as PermissionTree, u as Permission } from "../permission-types-CAY-GU7e.js";
 import { StandardSchemaV1 } from "@standard-schema/spec";
 //#region src/webmcp/types.d.ts

package/dist/{who-can-rI7dCR9Q.js → who-can-BoDJm0Nc.js}

@@ -10,7 +10,7 @@ import { o as flattenGrantee } from "./grantee-Dke-9rd1.js";
 import { t as byCodePoint } from "./compare-DTfyUunF.js";
 import { r as relationCondition } from "./grantee-conditions-BrYPe-w0.js";
 import { c as nowSeconds, p as scopeField } from "./tenancy-5d1zVBvK.js";
-import { D as emptyListeners, t as evaluate } from "./evaluate-Dd8Ta0Ie.js";
+import { D as emptyListeners, t as evaluate } from "./evaluate-BAmf_AQd.js";
 import { n as relationId, t as pendingRelations } from "./relations-BxvRvDHK.js";
 import { t as relationWalk } from "./relation-walk-DK_gkgL7.js";
 //#region src/core/who-can.ts

package/dist/workflow/index.d.ts

@@ -1,5 +1,5 @@
-import { a as AutomationSource, i as AutomationRequest, l as memoryAutomationSource, n as AutomationDecision, r as AutomationMode, s as MemoryAutomationSource, t as Automation, u as parseAutomation } from "../automation-DqEoWHBc.js";
-import { i as pollingApprovalWaiter, n as ApprovalWaiter, r as PollingApprovalWaiterOptions, t as ApprovalWaitOptions } from "../waiter-Bu9zAlE0.js";
-import { a as WorkflowPermDockOptions, i as WorkflowPermDock, n as AwaitApprovalOptions, o as createPermDock, r as StartAutomationResult, t as AutomationOptions } from "../create-CM1FciYG.js";
+import { a as AutomationSource, i as AutomationRequest, l as memoryAutomationSource, n as AutomationDecision, r as AutomationMode, s as MemoryAutomationSource, t as Automation, u as parseAutomation } from "../automation-C6Jg75xq.js";
+import { i as pollingApprovalWaiter, n as ApprovalWaiter, r as PollingApprovalWaiterOptions, t as ApprovalWaitOptions } from "../waiter-CqUKX6CY.js";
+import { a as WorkflowPermDockOptions, i as WorkflowPermDock, n as AwaitApprovalOptions, o as createPermDock, r as StartAutomationResult, t as AutomationOptions } from "../create-CDd9c22W.js";
 import "../index-CaxrMD1A.js";
 export { type ApprovalWaitOptions, type ApprovalWaiter, type Automation, type AutomationDecision, type AutomationMode, type AutomationOptions, type AutomationRequest, type AutomationSource, type AwaitApprovalOptions, type MemoryAutomationSource, type PollingApprovalWaiterOptions, type StartAutomationResult, type WorkflowPermDock, type WorkflowPermDockOptions, createPermDock, memoryAutomationSource, parseAutomation, pollingApprovalWaiter };

package/dist/workflow/index.js

@@ -1,12 +1,13 @@
 import { t as compact } from "../compact-CAf557ZB.js";
 import { n as freezeDeep } from "../freeze-jjan0lCv.js";
+import { a as isId } from "../expiry-6XByK0dm.js";
 import { n as findPermission } from "../permission-registry-B8tYxPIt.js";
 import { n as isThenable } from "../thenable-BNSM1U2R.js";
 import { n as memoryAutomationSource, r as parseAutomation } from "../automation-x3KEUusw.js";
-import { l as withApp, t as getPermDock } from "../permdock-L-_I_3zP.js";
+import { l as withApp, t as getPermDock } from "../permdock-BvjivVb9.js";
 import { o as automationEvent } from "../sink-D9_vh372.js";
 import { a as requestApproval, s as resumeDecision } from "../helpers-DJicaG6f.js";
-import { i as subjectFromRunTicket, r as signRunTicket } from "../run-ticket-Dv7aF7Dk.js";
+import { i as subjectFromRunTicket, r as signRunTicket } from "../run-ticket-DfnZCh-u.js";
 import { t as pollingApprovalWaiter } from "../waiter-aBLM63_f.js";
 //#region src/workflow/create.ts
 function writeQuietly(sink, event) {
@@ -121,12 +122,22 @@ function createPermDock(policy, given) {
 				}]
 			});
 		}
+		const { resource } = startOptions;
+		if (resource !== void 0 && !(isId(resource.type) && isId(resource.id))) return deniedStart("validation", { cause: "resource-invalid" });
 		const scopes = [];
+		const bound = [];
 		for (const key of automation.permissions) {
 			const leaf = findPermission(policy.permissions, key);
 			if (leaf === void 0) return deniedStart("validation", { permission: key });
-			scopes.push(leaf.scope);
+			if (resource !== void 0 && leaf.resource === resource.type) bound.push(leaf.action);
+			else scopes.push(leaf.scope);
 		}
+		if (resource !== void 0 && bound.length === 0) return deniedStart("validation", { resource: resource.type });
+		const authorizationDetails = resource === void 0 ? void 0 : [{
+			type: resource.type,
+			identifier: resource.id,
+			actions: bound
+		}];
 		const runId = startOptions.id ?? globalThis.crypto.randomUUID();
 		const runAutomation = {
 			id: automation.id,
@@ -139,11 +150,15 @@ function createPermDock(policy, given) {
 				id: automation.id,
 				kind: "automation"
 			},
-			delegation: { scopes },
+			delegation: compact({
+				scopes,
+				authorizationDetails
+			}),
 			automation: runAutomation,
 			tenant: automation.tenant,
 			trigger: startOptions.trigger,
 			binding: startOptions.binding,
+			resource,
 			id: runId,
 			expiresIn
 		}), signer, compact({
@@ -158,10 +173,11 @@ function createPermDock(policy, given) {
 		return freezeDeep({
 			outcome: "started",
 			ticket: signed,
-			run: {
+			run: compact({
 				id: runId,
-				automation: runAutomation
-			}
+				automation: runAutomation,
+				resource
+			})
 		});
 	};
 	const opened = async (ticket, permission, data, decideOptions) => {

package/dist/workflow-sdk/index.d.ts

@@ -1,8 +1,8 @@
-import { Ln as Decision } from "../policy-types-CCiDRZBH.js";
+import { Un as Decision } from "../policy-types-DGIO_gxq.js";
 import { u as Permission } from "../permission-types-CAY-GU7e.js";
-import { a as PermDock } from "../permdock-B6Sf4T_S.js";
-import { n as ApprovalWaiter } from "../waiter-Bu9zAlE0.js";
-import { i as WorkflowPermDock, r as StartAutomationResult, t as AutomationOptions } from "../create-CM1FciYG.js";
+import { a as PermDock } from "../permdock-CprAPN3w.js";
+import { n as ApprovalWaiter } from "../waiter-CqUKX6CY.js";
+import { i as WorkflowPermDock, r as StartAutomationResult, t as AutomationOptions } from "../create-CDd9c22W.js";
 //#region src/workflow-sdk/index.d.ts
 /**
  * The part of a Workflow SDK `Hook` the waiter reads: awaiting it suspends the

package/dist/{wrap-DlJE3gS_.d.ts → wrap-DxXB54Wu.d.ts}

@@ -1,5 +1,5 @@
-import { j as PolicyVocabulary } from "./policy-types-CCiDRZBH.js";
-import { a as PermDock } from "./permdock-B6Sf4T_S.js";
+import { j as PolicyVocabulary } from "./policy-types-DGIO_gxq.js";
+import { a as PermDock } from "./permdock-CprAPN3w.js";
 //#region src/core/wrap.d.ts
 /** A wrapper an adapter applies to each instance it builds, as `withOtel` does. */
 type PermDockWrap = <V extends PolicyVocabulary>(permdock: PermDock<V>) => PermDock<V>;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "permdock",
-  "version": "0.8.0",
+  "version": "0.10.0",
   "description": "Typed permissions for TypeScript apps, APIs, databases, and AI agents, with the permdock CLI and test runners.",
   "keywords": [
     "ai-agents",
@@ -353,7 +353,7 @@
     "ajv": "8.20.0",
     "astro": "7.4.0",
     "babel-plugin-react-compiler": "1.0.0",
-    "better-supabase": "0.13.0",
+    "better-supabase": "0.18.0",
     "better-supabase-floor": "npm:better-supabase@0.13.0",
     "chat": "4.42.0",
     "diff": "9.0.0",
@@ -364,7 +364,7 @@
     "fastest-levenshtein": "1.0.16",
     "fastify": "5.12.7",
     "h3": "2.0.2",
-    "happy-dom": "20.14.5",
+    "happy-dom": "21.0.4",
     "hono": "4.13.13",
     "jose": "6.2.12",
     "kysely": "0.29.6",

package/schemas/run-v1.json

@@ -121,6 +121,22 @@
           "maxItems": 64
         }
       }
+    },
+    "resource": {
+      "type": "object",
+      "required": ["type", "id"],
+      "properties": {
+        "type": {
+          "type": "string",
+          "minLength": 1,
+          "maxLength": 256
+        },
+        "id": {
+          "type": "string",
+          "minLength": 1,
+          "maxLength": 256
+        }
+      }
     }
   },
   "anyOf": [

package/schemas/supabase-manifest-v1.json

@@ -43,6 +43,27 @@
             "type": "string",
             "pattern": "^[A-Za-z_][A-Za-z0-9_]*\\.[A-Za-z_][A-Za-z0-9_]*$"
           }
+        },
+        "activeFrom": {
+          "description": "Where the hook reads the active first-scope id (supabase.hook.activeFrom): an app_metadata key, or a column of a table joined on id. Absent from a manifest written before 0.10.",
+          "oneOf": [
+            {
+              "type": "object",
+              "required": ["appMetadata"],
+              "additionalProperties": false,
+              "properties": { "appMetadata": { "type": "string" } }
+            },
+            {
+              "type": "object",
+              "required": ["table", "column", "id"],
+              "additionalProperties": false,
+              "properties": {
+                "table": { "type": "string" },
+                "column": { "type": "string" },
+                "id": { "type": "string" }
+              }
+            }
+          ]
         }
       }
     },
@@ -562,6 +583,13 @@
             },
             "column": {
               "$ref": "#/$defs/identifier"
+            },
+            "on": {
+              "description": "Every referencing column to the column of table it matches, when the reference spans several columns.",
+              "type": "object",
+              "additionalProperties": {
+                "$ref": "#/$defs/identifier"
+              }
             }
           }
         }

package/skills/permdock-agents/references/operations-automations-chat.md

@@ -127,6 +127,7 @@ run.can(permissions.invoice.send, invoice);
 ```
 
 - `start(id, { caller, trigger })` reads the live automation, checks the caller's `run` permission and signs a run ticket (`vnd.permdock.run+jwt`, 24 hours by default). Without `caller`, only server code starts it.
+- `start(id, { resource: { type, id } })` binds the run to one record: its permissions on `type` go into an `authorization_details` entry with `identifier: id`, so they hold on that row only; a type none of its permissions is on denies the start.
 - `getPermDock(ticket)` rebuilds the run on every step. A new version, a revoked automation or a publisher who is gone gives an instance that denies everything.
 - `awaitApproval(ticket, permission, row)` decides, parks on the `waiter` while `approval-required`, then decides again with the token against the publisher's rights as of then.
 - `openApproval(ticket, permission, row)` and `resumeApproval(ticket, permission, token, row)` are the two halves, for runners that wait outside the call. A request still pending denies with reason `approval`.

package/skills/permdock-data/references/queries-and-rls.md

@@ -36,7 +36,7 @@ pnpm exec permdock rls verify --introspect
 ```
 
 - List the scope instances a permission reaches in process with `permdock.permittedIds(permission, scope, { within })`, never a loop of `can` over memberships with a made-up row.
-- Generated policies call `permdock_has('<key>')` and one `permitted_<scope>_ids('<key>')` per declared scope, which Postgres runs once per statement. Hand-written policies that only need membership (an organization switcher) call `member_<scope>_ids()` instead of inventing a permission key. A policy that passes a user id, such as better-supabase's team sharing, calls `member_team_ids_of(<user>)` on Supabase: it answers only when the id is the caller's. Trusted SQL that acts for a stored user (a job, a trigger, a deferred approval) calls `permdock_has_for(p_user, '<key>')` and `permitted_<scope>_ids_for(p_user, '<key>')` in `database` mode, or the generated `permitted_<resource>_rows_for`, never a hand-written function that rewrites `request.jwt.claims`. With `rls.rowHelpers`, a hand-written policy or function that needs the rows a permission reaches through the graph calls `permitted_<resource>_rows('<permission key>')` instead of restating closure walks, link hops and `includes`. A table's own `select` or `insert` policy calls the row-valued `permitted_<resource>_row(<table>, '<permission key>')` instead, so `insert ... returning` sees the new row. Hand-written policies and functions that apply no row condition call `permitted_<scope>_ids_by_permission('<permission key>')` or `permdock_has_permission('<permission key>')` instead of spelling a positional `#n` grant key. A screen or RPC that checks many permissions on one organization calls `permitted_<scope>_permission_keys(<id>)` once (or `(<id>, array['<key>', ...])` for a few keys) instead of one helper call per key. A role editor or admin screen lists a role's keys with `permdock_role_permissions(p_role, p_scope, p_tenant, p_scope_id)` (declared roles, and custom roles of the caller's tenant in `database` mode) and the catalog with `permdock_permission_keys()` (`permdock_permission_keys('<scope>')` for the keys a role on that scope can hold), instead of joining `role_permissions` and the custom-role tables by hand; server code reads any tenant's roles with `permdock_trusted_role_permissions`, granted through `rls.trustedReaders`. Set `--tenant-type` (or `rls.scopeTypes`, keyed by scope name or `tenant` and `team`) to the scope columns' types.
+- Generated policies call `permdock_has('<key>')` and one `permitted_<scope>_ids('<key>')` per declared scope, which Postgres runs once per statement. Hand-written policies that only need membership (an organization switcher) call `member_<scope>_ids()` instead of inventing a permission key. A policy that passes a user id, such as better-supabase's team sharing, calls `member_team_ids_of(<user>)` on Supabase: it answers only when the id is the caller's. Trusted SQL that acts for a stored user (a job, a trigger, a deferred approval) calls `permdock_has_for(p_user, '<key>')` and `permitted_<scope>_ids_for(p_user, '<key>')` in `database` mode, or the generated `permitted_<resource>_rows_for`, never a hand-written function that rewrites `request.jwt.claims`. With `rls.rowHelpers`, a hand-written policy or function that needs the rows a permission reaches through the graph calls `permitted_<resource>_rows('<permission key>')` instead of restating closure walks, link hops and `includes`. A table's own `select` or `insert` policy calls the row-valued `permitted_<resource>_row(<table>, '<permission key>')` instead, so `insert ... returning` sees the new row. A function that checks a known set of rows (one tenant's, a page, a batch) calls `permitted_<resource>_rows('<permission key>', <text[] of ids>)`, which reads only those ids, instead of the one-argument form, which reads the whole table, or a `permitted_<resource>_row` call per row. Hand-written policies and functions that apply no row condition call `permitted_<scope>_ids_by_permission('<permission key>')` or `permdock_has_permission('<permission key>')` instead of spelling a positional `#n` grant key. A screen or RPC that checks many permissions on one organization calls `permitted_<scope>_permission_keys(<id>)` once (or `(<id>, array['<key>', ...])` for a few keys) instead of one helper call per key. A role editor or admin screen lists a role's keys with `permdock_role_permissions(p_role, p_scope, p_tenant, p_scope_id)` (declared roles, and custom roles of the caller's tenant in `database` mode) and the catalog with `permdock_permission_keys()` (`permdock_permission_keys('<scope>')` for the keys a role on that scope can hold), instead of joining `role_permissions` and the custom-role tables by hand; server code reads any tenant's roles with `permdock_trusted_role_permissions`, granted through `rls.trustedReaders`. Set `--tenant-type` (or `rls.scopeTypes`, keyed by scope name or `tenant` and `team`) to the scope columns' types.
 - `--authorize database` (default) reads the membership tables per statement; map each under `rls.memberships.scopes.<scope>` with `columns` for its id and its ancestors', and `via` so roles with `for` apply: a column name, or `{ value: 'staff' }` when every row has that kind (never add a generated column for it). `--authorize jwt` reads token claims and stays stale until the token refreshes; keep the token lifetime at 3600 seconds or less (PD019).
 - When the role column holds values that are not role keys, give the membership source `role: { column, map: { value: 'role' } }`; a value mapped to `null` grants nothing. `permdock rls explain` prints the tables, membership sources, custom roles table and triggers a generate run binds to, without writing a file. `rls.seeds: 'function'` writes the `role_permissions` rows as `<schema>.seed()` instead of inserts; run `select <schema>.seed();` after each deploy, and PD054 checks the function body.
 - `rls verify --introspect` checks each `security definer` helper by its full signature, so every overload is checked on its own. A helper finding id names the signature (`helper-definer:permdock.permdock_has(text):helper`); write `rls.verify.ignore` entries with it.

package/skills/permdock-wire/references/adapters.md

@@ -501,9 +501,9 @@ const subject = subjectFromSupabase(claims, {
 
 Write the claims with `permdock supabase hook generate`; `permdock supabase inspect --out` writes the manifest (helper names, tenant claim, budget, claims written) that `authorizationProvider` from `permdock/better-supabase` turns into better-supabase's `authorization` config. No `@supabase/supabase-js` peer. Pair with `permdock rls generate`, or keep SQL as authority and run `permdock rls verify --db-url-stdin` against `sqlFunction` twins ([database-first](https://permdock.com/docs/adapters/rls)); the generic RLS workflow is in the `permdock-data` skill.
 
-With better-supabase, set `authorization: authorizationProvider({ manifest, catalog })` in `better-supabase.config.ts` (with `rls.customRoles` its `canAssign` and `canAssignFor` call `permdock_can_assign_any` and its `_for` form, so custom roles are assignable through better-supabase; regenerate the manifest after turning custom roles on), pass `authorizer({ policy })` to the server (`createNext`, `createHono`, `createMcp`) so every `permission` a resource, action, route guard or tool declares is decided by PermDock from the verified claims (`operations` maps tables for `permissions: true`; a missing or anonymous claim denies), build bucket and topic `access` policies with `bucketPolicy` and `topicPolicy`, and map its session with `subjectFromBetterSupabase(session)` (all from `permdock/better-supabase`): the active tenant's `features` become `principal.plans`. Pass `plans: { keys }` when better-supabase's `entitlements.claim.keys` shortens feature keys, and `apiKeys: { permissions, manifest }` so an `apiKey` session maps to the key's credential subject instead of the anonymous one. For `createMcp` tools, put the permission in `meta` and spread `toolPolicy({ permdock })` into the options: tools without one are hidden and refused, and approval-required calls are refused because `createMcp` collects no approvals. Wrap a `CredentialProvider` with `credentialGuard(provider, { permdock, use, revoke? })` so PermDock decides each token use. `authorizationProvider({ ..., approver })` lets holders of that permission approve AI tool calls, never their own. `approvers: { 'ai-tool': holder(p), 'support-session': ..., 'invoice.send': ... }` fills `isApprover` through `permdock_is_approver` (needs `rls.approvals`); only `user()`, `holder()` and `anyOf()` approvers, and a kind it does not name has no approver. `accessReviewApplier({ client, reviews, policy, demoteTo?, email?, permdockFor? })` applies a review's revoked items: `update_member_role` to the `demoteTo` role when that role lacks the permission, else `remove_member`, plus `revoke_invitation` for the member's matching invitations, then `markApplied`; pass the reviewer's client so the blocks' own checks run. better-supabase's `createAgentRuntime({ toolApproval })` takes `toolApproval` from `permdock/ai-sdk` as it is. Validate its claims with `betterSupabase.claims(supabaseClaims().extend(appSchema))` (`supabaseClaims` from `permdock/supabase`, any Standard Schema as `appSchema`) instead of a hand-written copy of the claim shape. A `supabase.hook.claims` function that needs the user's organizations calls `<schema>.member_organization_ids_for(user_id)` (generated by `rls generate`, executable by `supabase_auth_admin` only) instead of querying the membership tables itself. With a scope named `team` or `teams`, `authorizationProvider` fills better-supabase's `teamIdsOf` with `<schema>.member_team_ids_of(user)`, which answers only for the caller, so with `blocks.access.model: 'provider'` better-supabase's `team_ids_of()` and team-sharing policies read PermDock's memberships. A token Supabase's OAuth server issued to a third-party app (`client_id`) becomes an `oauth-client` actor limited to its `scope`; `deny(permission, { to: actor('oauth-client') })` keeps such apps out, in the app and, through `rls generate`, in Postgres. A better-supabase support session (`act.kind: 'support'`) is actor kind `support` with `sessionId` and `readOnly`, and `actingAs` (`act.kind: 'impersonation'`) is kind `impersonation`; neither has a delegation, so they reach nothing until a policy delegation names `actor('support')` or `actor('impersonation')`, and `readOnly: true` (also when `read_only` is absent) narrows that to read-only permissions. Generated RLS reads memberships, not `act`, so a support token sent to the Data API writes as the user: add a restrictive `for update` (and `insert` / `delete`) policy per writable table that requires `act ->> 'read_only' = 'false'` when `act` is a support or session level ([support access](https://permdock.com/docs/guides/support-access)). With `rls.anonymousSignIns: 'deny'`, pass `anonymousSignIns: 'deny'` to the subject mapper too (doctor PD057). Check a deployed database against the generated policies with `permdock rls verify --introspect`.
+With better-supabase, set `auth.authorization: authorizationProvider({ manifest, catalog })` in `better-supabase.config.ts` (top-level `authorization` before 0.15) (with `rls.customRoles` its `canAssign` and `canAssignFor` call `permdock_can_assign_any` and its `_for` form, so custom roles are assignable through better-supabase; regenerate the manifest after turning custom roles on), pass `authorizer({ policy })` to the server (`createNext`, `createHono`, `createMcp`) so every `permission` a resource, action, route guard or tool declares is decided by PermDock from the verified claims (`operations` maps tables for `permissions: true`; a missing or anonymous claim denies), build bucket and topic `access` policies with `bucketPolicy` and `topicPolicy`, and map its session with `subjectFromBetterSupabase(session)` (all from `permdock/better-supabase`): the active tenant's `features` become `principal.plans`. Pass `plans: { keys }` when better-supabase's `entitlements.claim.keys` shortens feature keys, and `apiKeys: { permissions, manifest }` so an `apiKey` session maps to the key's credential subject instead of the anonymous one. For `createMcp` tools, put the permission in `meta` and spread `toolPolicy({ permdock })` into the options: tools without one are hidden and refused, and approval-required calls are refused because `createMcp` collects no approvals. Wrap a `CredentialProvider` with `credentialGuard(provider, { permdock, use, revoke? })` so PermDock decides each token use. `authorizationProvider({ ..., approver })` lets holders of that permission approve AI tool calls, never their own. `approvers: { 'ai-tool': holder(p), 'support-session': ..., 'invoice.send': ... }` fills `isApprover` through `permdock_is_approver` (needs `rls.approvals`); only `user()`, `holder()` and `anyOf()` approvers, and a kind it does not name has no approver. `accessReviewApplier({ client, reviews, policy, demoteTo?, email?, permdockFor? })` applies a review's revoked items: `update_member_role` to the `demoteTo` role when that role lacks the permission, else `remove_member`, plus `revoke_invitation` for the member's matching invitations, then `markApplied`; pass the reviewer's client so the blocks' own checks run. better-supabase's `createAgentRuntime({ toolApproval })` takes `toolApproval` from `permdock/ai-sdk` as it is. Validate its claims with `betterSupabase.claims(supabaseClaims().extend(appSchema))` (`supabaseClaims` from `permdock/supabase`, any Standard Schema as `appSchema`) instead of a hand-written copy of the claim shape. A `supabase.hook.claims` function that needs the user's organizations calls `<schema>.member_organization_ids_for(user_id)` (generated by `rls generate`, executable by `supabase_auth_admin` only) instead of querying the membership tables itself. With a scope named `team` or `teams`, `authorizationProvider` fills better-supabase's `teamIdsOf` with `<schema>.member_team_ids_of(user)`, which answers only for the caller, so with `blocks.permissions.model: 'provider'` (`blocks.access` before 0.15) better-supabase's `team_ids_of()` and team-sharing policies read PermDock's memberships. A token Supabase's OAuth server issued to a third-party app (`client_id`) becomes an `oauth-client` actor limited to its `scope`; `deny(permission, { to: actor('oauth-client') })` keeps such apps out, in the app and, through `rls generate`, in Postgres. A better-supabase support session (`act.kind: 'support'`) is actor kind `support` with `sessionId` and `readOnly`, and `actingAs` (`act.kind: 'impersonation'`) is kind `impersonation`; neither has a delegation, so they reach nothing until a policy delegation names `actor('support')` or `actor('impersonation')`, and `readOnly: true` (also when `read_only` is absent) narrows that to read-only permissions. Generated RLS reads memberships, not `act`, so a support token sent to the Data API writes as the user: add a restrictive `for update` (and `insert` / `delete`) policy per writable table that requires `act ->> 'read_only' = 'false'` when `act` is a support or session level ([support access](https://permdock.com/docs/guides/support-access)). With `rls.anonymousSignIns: 'deny'`, pass `anonymousSignIns: 'deny'` to the subject mapper too (doctor PD057). Check a deployed database against the generated policies with `permdock rls verify --introspect`.
 
-The other better-supabase slots, all from `permdock/better-supabase` ([better-supabase](https://permdock.com/docs/adapters/better-supabase)): `hookCan(permdock)` and `handlerCan({ getPermDock })` are the `can` options of `authorizeHook` and `protectWebHandler` in `better-supabase/workflow-sdk`; they decide with no row, so a permission with a row condition denies there and is checked inside the handler, and `handlerCan` answers `undefined` (401) without a signed-in principal. `supportPolicy({ policy, options?, writable?, approval?, approved? })` is the `authorize` option of `supportSessions`; it decides each start with `decideSupportSession` as the admin, and an `approval-required` start passes only once `approved(input, pending)` returns `{ approvedBy }` for an approver other than the admin. `subscriberPolicy({ policy, principals, events, row?, sender? })` filters outbox, webhook or realtime subscribers to those who may read the event (exact type, then the longest `prefix.*`, then `*`; a type with no entry reaches no one). `principalSource({ claims, identities? })` is a `PrincipalSource` over the claims better-supabase mints, for `decideFor`, `subscribersFor` and delivery; only links the app created through a signed-in flow or a verified address go in `identities`. `authorizationHooks({ policy, claims, service?, principals?, events?, approvers?, support?, tickets? })` is the `authorization` option of `createServer`: it answers automation publish and run-as, delegated OAuth scopes, `approverOf`, identities, delivery audiences, support sessions and run tickets from the claims better-supabase mints now, never from the request.
+The other better-supabase slots, all from `permdock/better-supabase` ([better-supabase](https://permdock.com/docs/adapters/better-supabase)): `hookCan(permdock)` and `handlerCan({ getPermDock })` are the `can` options of `authorizeHook` and `protectWebHandler` in `better-supabase/workflow-sdk`; they decide with no row unless the `data` option loads one (`hookCan(permdock, { data: (tenant, key) => row })`, `handlerCan(source, { data: (request, key) => row })`), so without it a permission with a row condition denies, and `handlerCan` answers `undefined` (401) without a signed-in principal. `supportPolicy({ policy, options?, writable?, approval?, approved? })` is the `authorize` option of `supportSessions`; it decides each start with `decideSupportSession` as the admin, and an `approval-required` start passes only once `approved(input, pending)` returns `{ approvedBy }` for an approver other than the admin. `subscriberPolicy({ policy, principals, events, row?, sender? })` filters outbox, webhook or realtime subscribers to those who may read the event (exact type, then the longest `prefix.*`, then `*`; a type with no entry reaches no one). `principalSource({ claims, identities? })` is a `PrincipalSource` over the claims better-supabase mints, for `decideFor`, `subscribersFor` and delivery; only links the app created through a signed-in flow or a verified address go in `identities`. `authorizationHooks({ policy, claims, service?, principals?, events?, approvers?, support?, tickets? })` is the `authorization` option of `createServer`: it answers automation publish and run-as, delegated OAuth scopes, `approverOf`, identities, delivery audiences, support sessions and run tickets from the claims better-supabase mints now, never from the request.
 
 `claims` is whatever Supabase verified: `data.claims` from `supabase.auth.getClaims()` on an `@supabase/ssr` server client, or `jwtClaims` from `@supabase/server` (`ctx.jwtClaims` in `withSupabase` or a `pipeline`, and `c.var.jwtClaims` after a framework bridge such as `toHono([withClaims(), withPermDock()])`). `@supabase/server/adapters/*` and `c.var.supabaseContext` are deprecated and removed on 1 December 2026; do not write new code against them ([Hono, H3, Elysia and NestJS](https://permdock.com/docs/adapters/supabase#hono-h3-elysia-and-nestjs)). Pass `null` for anonymous callers; never `getSession().access_token` (unverified). An API-key auth mode (`secret`, `publishable`) has `jwtClaims: null` and is the anonymous subject, not a user.
 
@@ -517,7 +517,8 @@ Supabase specifics for generated RLS (the generic flags and parity checks are in
 - Under `migra`, generate `--split helpers,seeds,policies,hook --out supabase/schemas/identity/056_permdock_{part}.sql --seeds-out supabase/migrations/` and write the schema and function privileges and the `security_invoker` view option with `--grants-out` into a migration created by `supabase migration new` after the first `db diff`; `db diff` drops those, so never append them to a migration by hand. Table grants and policies stay in the schema files, where `db diff` keeps them. Keep the helpers part ahead of every file that calls the helpers in `schema_paths` (`permdock doctor` PD042, PD043).
 - `--authorize jwt` reads the hook's claims: enable the printed `[auth.hook.custom_access_token]` stanza in `supabase/config.toml`. The generated hook writes the canonical `memberships` claim from the `rls.memberships.scopes` tables, so do not hand-write one.
 - For more than one membership table, declare `tableMembershipSource` / `junctionMembershipSource` sources once (from `permdock/supabase`, with a `query` on the server), pass the array as `memberships` (wrapped in `claimsFirst(sources, { version: authzVersion({ query }) })` to trust the token until it is truncated or stale), put the same sources under `supabase.hook.memberships` in `permdock.config.ts`, and run `permdock supabase hook generate`; add the printed `config.toml` block (`jwt_expiry = 900`). List member-removal and payout permissions in `definePolicy({ fresh })`.
-- When the server has only supabase-js (no `SqlQuery`), never re-read memberships, global roles or custom roles with the admin client: grant `subject_for(p_user)` and `authz_version_for(p_user)` (written next to the hook) to the backend role, expose them through `public` wrappers when `permdock` is not an exposed schema, and use `postgrestSources(admin, { schema, fn, versionFn, policy })`: `claimsFirst(sources.memberships)` (with `onStale: 'reread'` a fresh token costs one version call, and with `policy` a token that claims a custom role costs one `subject_for` call), `customRoles: sources.customRoles(principal)`, and `await sources.subject(userId)` for a job acting for a stored user.
+- When the server has only supabase-js (no `SqlQuery`), never re-read memberships, global roles or custom roles with the admin client: grant `subject_for(p_user)` and `authz_version_for(p_user)` (written next to the hook) to the backend role, expose them through `public` wrappers when `permdock` is not an exposed schema, and use `postgrestSources(admin, { schema, fn, versionFn, policy })`: `claimsFirst(sources.memberships)` (with `onStale: 'reread'` a fresh token costs one version call, and with `policy` a token that claims a custom role costs one `subject_for` call), `customRoles: sources.customRoles(principal)`, and `await sources.subject(userId)` for a job acting for a stored user. Create `postgrestSources` and the `claimsFirst` source once at module scope, never per request or per cache scope: they keep no answers, and `getPermDock` shares each read within one instance.
+- When a page builds many instances (Next.js `'use cache: private'` islands, PPR) or an API serves many `GET`s per user, add `versions: memoryVersionCache({ maxStaleMs: 5_000 })` to `claimsFirst(sources.memberships, { onStale: 'reread' })` at module scope. Rendering and `GET` / `HEAD` / `OPTIONS` use intent `read` and share one version call per `maxStaleMs`; `protectAction`, other HTTP methods and core `getPermDock` use `write` and read live. Before a mutation outside `protectAction` in Next.js, call `getPermDock({ intent: 'write' })`. After a role change call `versions.evict(userId)` ([freshness and the version cache](https://permdock.com/docs/adapters/supabase#freshness-and-the-version-cache)).
 - When a role table stores a role id (`user_roles.role_id`, `organization_users.role_id` referencing `roles`), read the key through it with `{ through: 'roles', on: { role_id: 'id' }, column: 'key' }`: in `rls.roles`, in `tableMembershipSource` `columns.role` or `junctionMembershipSource` `roles`, and in an `rls.memberships` table's `role`. Never copy keys into the membership table. Keep tenant custom-role keys apart from declared role names.
 - When one membership row holds roles in several columns (a `tier` and a `role_id`), list them instead of building a union view: `role: ['tier', { through: 'roles', on: { role_id: 'id' }, column: 'key' }]` in `rls.memberships` and `tableMembershipSource` `columns.role`, `roles: { sources: [...] }` in `junctionMembershipSource`. The row holds every non-null key, and the holder-count triggers stay on the real table.
 - When a membership table names a profile instead of a login (`customer_contacts.contact_profile_id` referencing `contact_profiles`, whose `user_id` is the login), read the user through it with `junctionMembershipSource` `user` or `tableMembershipSource` `columns.user`: `{ through: 'contact_profiles', on: { contact_profile_id: 'id' }, column: 'user_id' }`. Never copy `user_id` onto the membership rows. Keep `contact_profiles.user_id` server-owned (PD028).

package/dist/catalog-mRQQQhNK.js

@@ -1 +0,0 @@
-export { t as catalogFile, n as runCatalog } from "./catalog-BFpz2EmT.js";

package/dist/collect-B5BL3klN.js

@@ -1 +0,0 @@
-export { r as runCollect } from "./collect-B7ZFAJU3.js";

package/dist/powersync-Djf-zCpB.js

@@ -1 +0,0 @@
-export { n as runPowerSync } from "./powersync-DHNQX06W.js";

package/dist/pull-B65ndFNZ.js

@@ -1 +0,0 @@
-export { n as runCloudPull } from "./pull-CwpGaQSi.js";

package/dist/run-D-JE8QWb.js

@@ -1 +0,0 @@
-export { t as run } from "./run-Bz26OTfO.js";