permdock 0.8.0 → 0.10.0

package/dist/{policy-Ba4bDhaj.d.ts → policy-BycVKnXv.d.ts}

@@ -1,4 +1,4 @@
-import { T as Policy, lr as Subject, sr as Principal } from "./policy-types-CCiDRZBH.js";
+import { T as Policy, hr as Subject, pr as Principal } from "./policy-types-DGIO_gxq.js";
 import { c as saasPlans, l as saasRoles, s as saasPermissions } from "./permissions-Bx6UI8n1.js";
 //#region src/testing/saas/policy.d.ts
 /** Daily API-key quota per subject; the bucket should be per tenant too. */

package/dist/{policy-from-catalog-CJgOm6aq.js → policy-from-catalog-CU3An8uP.js}

@@ -11,7 +11,7 @@ import { o as isPortableCondition } from "./hosted-D0IzESu_.js";
 import { t as definePermissions } from "./permissions-CVXmRILq.js";
 import { n as copyJson, t as checkSchema } from "./json-schema-BPGa-RjQ.js";
 import { t as parseCatalog } from "./parse-1_ZheTW5.js";
-import { n as parsePushedPolicy } from "./pushed-policy-ITwYKvvH.js";
+import { n as parsePushedPolicy } from "./pushed-policy-CDuOL2de.js";
 //#region src/catalog/json-schema-validator.ts
 const ANNOTATIONS = /* @__PURE__ */ new Set([
 	"$schema",

package/dist/{policy-types-CCiDRZBH.d.ts → policy-types-DGIO_gxq.d.ts}

@@ -429,6 +429,12 @@ type Subject<TPrincipal extends Principal = Principal> = {
   readonly context: Readonly<Record<string, unknown>>;
   readonly session?: string;
   readonly expiresAt?: number;
+  /**
+   * When the verified token was issued (`iat`), in seconds since the epoch. A
+   * `VersionCache` trusts the token's `authzVersion` for its `maxStaleMs` after
+   * it.
+   */
+  readonly issuedAt?: number;
   /**
    * The token's memberships are behind the source's authorization version:
    * `fresh` permissions deny.
@@ -1708,6 +1714,28 @@ type DecisionProvider = {
     readonly subject: Subject;
   }) => Promise<readonly string[] | null | undefined>;
 };
+/**
+ * Shares one read per key within one `getPermDock` call: the first call runs
+ * `read`, every later call with the same key gets its answer. A source created
+ * once at module scope uses it so the reads of one instance share a single
+ * query and no answer outlives the instance.
+ */
+type SourceMemo = <T>(key: string, read: () => T) => T;
+/** What `getPermDock` passes to every source call besides its query. */
+type SourceContext = {
+  /** Absent when the source is called outside `getPermDock`. */
+  readonly memo?: SourceMemo;
+};
+/**
+ * Whether an instance answers reads or writes: `read` may judge a token fresh
+ * from a shared `VersionCache` within its `maxStaleMs`; `write` reads the
+ * version live.
+ */
+type Intent = "read" | "write";
+/** The custom-role sources' second argument. */
+type CustomRoleContext = SourceContext & {
+  readonly held: readonly string[];
+};
 type CustomRoleSource = {
   /** Names the implementation in errors and events. */
   readonly name?: string;
@@ -1716,27 +1744,21 @@ type CustomRoleSource = {
    * the subject's live memberships hold there, declared or not, so a source can
    * skip its read when none of them is a custom role.
    */
-  rolesFor: (tenant: string, context?: {
-    readonly held: readonly string[];
-  }) => CustomRole[] | Promise<CustomRole[]>;
+  rolesFor: (tenant: string, context?: CustomRoleContext) => CustomRole[] | Promise<CustomRole[]>;
   assignable?: (tenant: string) => string[] | Promise<string[]>;
   /**
    * Platform custom roles (`scope: 'global'`), read once per signed-in subject,
    * with `held`, the global role names the subject holds. A role here with a
    * tenant is ignored.
    */
-  globalRoles?: (context?: {
-    readonly held: readonly string[];
-  }) => CustomRole[] | Promise<CustomRole[]>;
+  globalRoles?: (context?: CustomRoleContext) => CustomRole[] | Promise<CustomRole[]>;
   /**
    * Shared custom roles (`shared: true`), defined once for every tenant and
    * read once per subject with a tenant membership, with `held`, the role names
    * its live memberships hold in any tenant. A role here without `shared: true`
    * is ignored.
    */
-  sharedRoles?: (context?: {
-    readonly held: readonly string[];
-  }) => CustomRole[] | Promise<CustomRole[]>;
+  sharedRoles?: (context?: CustomRoleContext) => CustomRole[] | Promise<CustomRole[]>;
 };
 /**
  * A `CustomRoleSource` built for the subject the instance serves, for an
@@ -1746,6 +1768,23 @@ type CustomRoleSource = {
  * `source-threw`.
  */
 type CustomRoleSourceFactory = (subject: Subject) => CustomRoleSource | undefined;
+/**
+ * The principal `MembershipSource.version` is asked about: what its token
+ * claims.
+ */
+type VersionQuery = {
+  readonly id: string;
+  readonly roles?: readonly string[];
+  readonly memberships?: readonly Membership[];
+  readonly authzVersion?: number;
+  /** When the token was issued, in seconds since the epoch (`iat`). */
+  readonly issuedAt?: number;
+};
+/** `MembershipSource.version`'s second argument. */
+type VersionContext = SourceContext & {
+  /** Absent outside `getPermDock`, where the read is live. */
+  readonly intent?: Intent;
+};
 /** One member of a scope instance, as `MembershipSource.list` returns it. */
 type MemberEntry = {
   readonly principal: {
@@ -1759,7 +1798,7 @@ type MembershipSource = {
   membershipsFor: (principal: {
     readonly id: string;
     readonly kind?: string;
-  }, options: {
+  }, options: SourceContext & {
     readonly tenant?: string;
   }) => Membership[] | Promise<Membership[]>;
   /**
@@ -1775,13 +1814,10 @@ type MembershipSource = {
    * change. A token whose `authzVersion` is behind it is stale for the policy's
    * `fresh` permissions. `roles` and `memberships` are what the token claims,
    * so a source can read more than the version in the same call when the claims
-   * show it will be needed.
+   * show it will be needed. `authzVersion` and `issuedAt` (seconds) are the
+   * token's, for a `VersionCache`.
    */
-  version?: (principal: {
-    readonly id: string;
-    readonly roles?: readonly string[];
-    readonly memberships?: readonly Membership[];
-  }) => number | undefined | Promise<number | undefined>;
+  version?: (principal: VersionQuery, context?: VersionContext) => number | undefined | Promise<number | undefined>;
   /**
    * The global roles the principal holds now. With `onStale: 'reread'`, a stale
    * token's `principal.roles` is replaced by this answer, so a revoked platform
@@ -1791,7 +1827,7 @@ type MembershipSource = {
   globalRolesFor?: (principal: {
     readonly id: string;
     readonly kind?: string;
-  }) => readonly string[] | Promise<readonly string[]>;
+  }, context?: SourceContext) => readonly string[] | Promise<readonly string[]>;
   /**
    * Keep the memberships the verified token carries and read this source only
    * when the token says they were truncated (`claimsFirst`).
@@ -2640,4 +2676,4 @@ type SubjectOf<P> = {
   readonly expiresAt?: number;
 };
 //#endregion
-export { MemberEntry as $, AuthorizationDetail as $n, CredentialEvent as $t, PolicyScopes as A, assurance as An, CredentialRequest as At, ValidateMode as B, DenialReason as Bn, LocalMembershipRows as Bt, MembershipFixture as C, user as Cn, SqlFunctionArg as Cr, Credential as Ct, PolicyDelegation as D, RelationGrantee as Dn, isConditionDate as Dr, CredentialPermissionInput as Dt, PolicyAppDataSchemas as E, InheritGrantee as En, isCondition as Er, CredentialPermission as Et, RoleScope as F, AppObligation as Fn, isFeedId as Ft, CustomRoleSourceFactory as G, MatchedGrant as Gn, Snapshot as Gt, WireValidity as H, ExplainedDecision as Hn, LocalRowValue as Ht, SeparationConflict as I, ApprovalRequiredDecision as In, parseCredential as It, EntitlementSource as J, Trace as Jn, SnapshotNotEntitled as Jt, DecisionProvider as K, Obligation as Kn, SnapshotAssignable as Kt, SubjectOf as L, Decision as Ln, InstanceHandle as Lt, PrincipalOf as M, inherit as Mn, credentialDelegation as Mt, RoleBinding as N, plan as Nn, credentialPolicyViolation as Nt, PolicyOAuthScope as O, actor as On, isConditionRef as Or, CredentialPolicy as Ot, RoleOptions as P, relation as Pn, decideCredential as Pt, LimitStore as Q, Assurance as Qn, AutomationEvent as Qt, SupportAccessOptions as R, Denial as Rn, Instant as Rt, HostedGrantRef as S, holder as Sn, RestrictedAncestors as Sr, ApiKeyPrincipal as St, Policy as T, GranteeInput as Tn, hasConditionOp as Tr, CredentialKind as Tt, CredentialVerifier as U, GrantedDecision as Un, LocalSnapshotManifest as Ut, VocabularyFromInput as V, DeniedDecision as Vn, LocalRowColumn as Vt, CustomRoleSource as W, LimitDetail as Wn, LocalSnapshotRows as Wt, LimitConsumeInput as X, TraceSkipReason as Xn, AccessEvent as Xt, JwtClaims as Y, TraceSkip as Yn, SnapshotScope as Yt, LimitRemaining as Z, Actor as Zn, AuthEvent as Zt, GrantLimit as _, ApproverInput as _n, MemberOfCondition as _r, SupportSessionDecision as _t, ApprovalRequirement as a, EmailCategory as an, JsonWebKeyLike as ar, SettingsSource as at, GrantScope as b, allOf as bn, RelatedCondition as br, decideSupportSession as bt, BreakGlassOptions as c, WireDecision as cn, SharedCustomRole as cr, TenantSettings as ct, ClosureContext as d, PolicyScopesInput as dn, ActorKind as dr, TokenVerifier as dt, DecisionEvent as en, Binding as er, MembershipSource as et, ClosureGrantFn as f, Scope as fn, AdapterId as fr, VerificationFailure as ft, GrantCondition as g, Approver as gn, ConditionValue as gr, SupportSession as gt, Grant as h, AnyOfApprover as hn, ConditionRef as hr, DecideSupportSessionOptions as ht, ApprovalOption as i, DirectoryEvent as in, GnapAccess as ir, RelationSource as it, PolicyVocabulary as j, authenticated as jn, DecideCredentialOptions as jt, PolicyOptions as k, anyone as kn, isSqlFunctionField as kr, CredentialPolicyViolation as kt, BreakGlassRequirements as l, WireDenial as ln, Subject as lr, TokenFailureCause as lt, DelegationTarget as m, ScopeNames as mn, Condition as mr, WhereCompiler as mt, ApprovalEscalation as n, DeliveryEvent as nn, CustomRoleGrant as nr, RelationGroup as nt, ApprovalStage as o, MembershipEvent as on, Membership as or, SnapshotSource as ot, DelegationInput as p, ScopeDeclaration as pn, MembershipVia as pr, VerifiedToken as pt, DecisionSink as q, Quota as qn, SnapshotGrant as qt, ApprovalMode as r, DeliveryFailureCause as rn, Delegation as rr, RelationHolder as rt, AssuranceRequirement as s, SinkEvent as sn, Principal as sr, SubjectResolver as st, ActivationOption as t, DeliveryChannel as tn, CustomRole as tr, RelationChain as tt, BreakGlassSpec as u, WireDelegation as un, VerifiedClaims as ur, TokenSigner as ut, GrantMeta as v, PermissionApprover as vn, MemberOfParent as vr, SupportSessionPolicy as vt, ObligationInput as w, Grantee as wn, SqlFunctionCondition as wr, CredentialDecision as wt, GrantValidity as x, anyOf as xn, RelatedHop as xr, parseSupportSession as xt, GrantOptions as y, UserApprover as yn, OpaqueCondition as yr, SupportSessionRequest as yt, SupportConsent as z, DenialDetails as zn, LocalCustomRoleTable as zt };
+export { LimitRemaining as $, Quota as $n, SnapshotGrant as $t, PolicyScopes as A, Grantee as An, SqlFunctionCondition as Ar, CredentialDecision as At, ValidateMode as B, relation as Bn, decideCredential as Bt, MembershipFixture as C, ApproverInput as Cn, MemberOfCondition as Cr, SupportSessionDecision as Ct, PolicyDelegation as D, anyOf as Dn, RelatedHop as Dr, parseSupportSession as Dt, PolicyAppDataSchemas as E, allOf as En, RelatedCondition as Er, decideSupportSession as Et, RoleScope as F, anyone as Fn, isSqlFunctionField as Fr, CredentialPolicyViolation as Ft, CustomRoleSource as G, DenialDetails as Gn, LocalCustomRoleTable as Gt, WireValidity as H, ApprovalRequiredDecision as Hn, parseCredential as Ht, SeparationConflict as I, assurance as In, CredentialRequest as It, DecisionSink as J, ExplainedDecision as Jn, LocalRowValue as Jt, CustomRoleSourceFactory as K, DenialReason as Kn, LocalMembershipRows as Kt, SubjectOf as L, authenticated as Ln, DecideCredentialOptions as Lt, PrincipalOf as M, InheritGrantee as Mn, isCondition as Mr, CredentialPermission as Mt, RoleBinding as N, RelationGrantee as Nn, isConditionDate as Nr, CredentialPermissionInput as Nt, PolicyOAuthScope as O, holder as On, RestrictedAncestors as Or, ApiKeyPrincipal as Ot, RoleOptions as P, actor as Pn, isConditionRef as Pr, CredentialPolicy as Pt, LimitConsumeInput as Q, Obligation as Qn, SnapshotAssignable as Qt, SupportAccessOptions as R, inherit as Rn, credentialDelegation as Rt, HostedGrantRef as S, Approver as Sn, ConditionValue as Sr, SupportSession as St, Policy as T, UserApprover as Tn, OpaqueCondition as Tr, SupportSessionRequest as Tt, CredentialVerifier as U, Decision as Un, InstanceHandle as Ut, VocabularyFromInput as V, AppObligation as Vn, isFeedId as Vt, CustomRoleContext as W, Denial as Wn, Instant as Wt, Intent as X, LimitDetail as Xn, LocalSnapshotRows as Xt, EntitlementSource as Y, GrantedDecision as Yn, LocalSnapshotManifest as Yt, JwtClaims as Z, MatchedGrant as Zn, Snapshot as Zt, GrantLimit as _, PolicyScopesInput as _n, ActorKind as _r, VerifiedToken as _t, ApprovalRequirement as a, CredentialEvent as an, AuthorizationDetail as ar, RelationHolder as at, GrantScope as b, ScopeNames as bn, Condition as br, WhereCompiler as bt, BreakGlassOptions as c, DeliveryEvent as cn, CustomRoleGrant as cr, SnapshotSource as ct, ClosureContext as d, EmailCategory as dn, JsonWebKeyLike as dr, SubjectResolver as dt, SnapshotNotEntitled as en, Trace as er, LimitStore as et, ClosureGrantFn as f, MembershipEvent as fn, Membership as fr, TenantSettings as ft, GrantCondition as g, WireDelegation as gn, VerifiedClaims as gr, VerificationFailure as gt, Grant as h, WireDenial as hn, Subject as hr, TokenVerifier as ht, ApprovalOption as i, AutomationEvent as in, Assurance as ir, RelationGroup as it, PolicyVocabulary as j, GranteeInput as jn, hasConditionOp as jr, CredentialKind as jt, PolicyOptions as k, user as kn, SqlFunctionArg as kr, Credential as kt, BreakGlassRequirements as l, DeliveryFailureCause as ln, Delegation as lr, SourceContext as lt, DelegationTarget as m, WireDecision as mn, SharedCustomRole as mr, TokenSigner as mt, ApprovalEscalation as n, AccessEvent as nn, TraceSkipReason as nr, MembershipSource as nt, ApprovalStage as o, DecisionEvent as on, Binding as or, RelationSource as ot, DelegationInput as p, SinkEvent as pn, Principal as pr, TokenFailureCause as pt, DecisionProvider as q, DeniedDecision as qn, LocalRowColumn as qt, ApprovalMode as r, AuthEvent as rn, Actor as rr, RelationChain as rt, AssuranceRequirement as s, DeliveryChannel as sn, CustomRole as sr, SettingsSource as st, ActivationOption as t, SnapshotScope as tn, TraceSkip as tr, MemberEntry as tt, BreakGlassSpec as u, DirectoryEvent as un, GnapAccess as ur, SourceMemo as ut, GrantMeta as v, Scope as vn, AdapterId as vr, VersionContext as vt, ObligationInput as w, PermissionApprover as wn, MemberOfParent as wr, SupportSessionPolicy as wt, GrantValidity as x, AnyOfApprover as xn, ConditionRef as xr, DecideSupportSessionOptions as xt, GrantOptions as y, ScopeDeclaration as yn, MembershipVia as yr, VersionQuery as yt, SupportConsent as z, plan as zn, credentialPolicyViolation as zt };

package/dist/{postgrest-DicQyqm-.d.ts → postgrest-D5nUGm-c.d.ts}

@@ -1,4 +1,4 @@
-import { $ as MemberEntry, T as Policy, W as CustomRoleSource, et as MembershipSource, lr as Subject, or as Membership, sr as Principal, tr as CustomRole } from "./policy-types-CCiDRZBH.js";
+import { G as CustomRoleSource, T as Policy, fr as Membership, hr as Subject, nt as MembershipSource, pr as Principal, sr as CustomRole, tt as MemberEntry } from "./policy-types-DGIO_gxq.js";
 //#region src/supabase/postgrest.d.ts
 /**
  * What a supabase-js `rpc` call resolves to: `data` or an `error` with a
@@ -122,8 +122,9 @@ declare function readSubjectRecord(value: unknown): SubjectRecord | undefined;
  * stale token; when the version function is missing it falls back to
  * `subject_for`. With `policy`, a token that claims a custom role has its
  * subject read in one `subject_for` call instead, and custom roles are read
- * only for a subject that holds one. Each user and each instance is read once
- * per `postgrestSources` call, so create it per request or per job.
+ * only for a subject that holds one. It keeps no answers: create it once at
+ * module scope, and `getPermDock` shares each read within one instance. Pass
+ * `claimsFirst(…, { versions })` to share version reads across instances.
  */
 declare function postgrestSources(client: SupabaseRpcCaller, options?: PostgrestSourcesOptions): PostgrestSources;
 //#endregion

package/dist/{postgrest-D4nuPXIQ.js → postgrest-DAxFltvO.js}

@@ -5,7 +5,7 @@ import { t as anonymousSubject } from "./subject-BGoM5o8B.js";
 import { t as readClaim } from "./claims-map-CKkoAAYF.js";
 import { t as clientNameOf } from "./clients-DYr3U86j.js";
 import "./budget-BELja5A9.js";
-import { a as hookApiNames } from "./sources-CMAM-2A3.js";
+import { a as hookApiNames } from "./sources-C4vkzZJV.js";
 //#region src/supabase/subject.ts
 const REGISTERED = /* @__PURE__ */ new Set([
 	"sub",
@@ -361,6 +361,7 @@ function mapClaims(claims, options) {
 	});
 	const session = typeof claims["session_id"] === "string" ? claims["session_id"] : void 0;
 	const expiresAt = typeof claims["exp"] === "number" ? claims["exp"] : void 0;
+	const issuedAt = typeof claims["iat"] === "number" && Number.isFinite(claims["iat"]) ? claims["iat"] : void 0;
 	return freezeDeep(compact({
 		principal,
 		actor,
@@ -368,6 +369,7 @@ function mapClaims(claims, options) {
 		context: {},
 		session,
 		expiresAt,
+		issuedAt,
 		liveSession: options.liveSession === true && session !== void 0 ? true : void 0
 	}));
 }
@@ -485,6 +487,9 @@ function readSubjectRecord(value) {
 		claims: isRecord(value["claims"]) && Object.keys(value["claims"]).length > 0 ? value["claims"] : void 0
 	});
 }
+function once(memo, key, read) {
+	return memo === void 0 ? read() : memo(key, read);
+}
 /**
 * Membership, custom-role and subject sources over the `subject_for(p_user)`,
 * `authz_version_for(p_user)` and `members_of(p_scope, p_id)` functions
@@ -494,8 +499,9 @@ function readSubjectRecord(value) {
 * stale token; when the version function is missing it falls back to
 * `subject_for`. With `policy`, a token that claims a custom role has its
 * subject read in one `subject_for` call instead, and custom roles are read
-* only for a subject that holds one. Each user and each instance is read once
-* per `postgrestSources` call, so create it per request or per job.
+* only for a subject that holds one. It keeps no answers: create it once at
+* module scope, and `getPermDock` shares each read within one instance. Pass
+* `claimsFirst(…, { versions })` to share version reads across instances.
 */
 function postgrestSources(client, options = {}) {
 	const api = options.api;
@@ -506,73 +512,46 @@ function postgrestSources(client, options = {}) {
 	const versionFn = options.versionFn ?? names?.authzVersionFor ?? "authz_version_for";
 	const declared = options.policy === void 0 ? void 0 : options.policy.index.declaredRoles;
 	const onlyDeclared = (held) => declared !== void 0 && held?.every((name) => declared.has(name)) === true;
-	const loaded = /* @__PURE__ */ new Map();
-	const versions = /* @__PURE__ */ new Map();
-	const listed = /* @__PURE__ */ new Map();
-	const list = (query) => {
-		const key = JSON.stringify([query.scope, query.id]);
-		const cached = listed.get(key);
-		if (cached !== void 0) return cached.then((entries) => [...entries]);
-		const pending = Promise.resolve(callRpc(client, schema, membersFn, {
+	const list = async (query) => {
+		const result = await callRpc(client, schema, membersFn, {
 			p_scope: query.scope,
 			p_id: query.id
-		})).then((result) => {
-			if (result.error !== null) throw new Error(`PermDock: ${schema}.${membersFn} failed: ${result.error.message}`);
-			return readMemberEntries(result.data);
-		});
-		listed.set(key, pending);
-		return pending.then((entries) => [...entries]);
-	};
-	const record = (userId) => {
-		const cached = loaded.get(userId);
-		if (cached !== void 0) return cached;
-		const pending = Promise.resolve(callRpc(client, schema, fn, { p_user: userId })).then((result) => {
-			if (result.error !== null) throw new Error(`PermDock: ${schema}.${fn} failed: ${result.error.message}`);
-			return readSubjectRecord(result.data);
 		});
-		loaded.set(userId, pending);
-		return pending;
-	};
-	const version = (userId) => {
-		const read = loaded.get(userId);
-		if (read !== void 0) return read.then((found) => found?.authzVersion);
-		const cached = versions.get(userId);
-		if (cached !== void 0) return cached;
-		const pending = Promise.resolve(callRpc(client, schema, versionFn, { p_user: userId })).then((result) => result.error === null ? versionOf(result.data) : record(userId).then((found) => found?.authzVersion));
-		versions.set(userId, pending);
-		return pending;
+		if (result.error !== null) throw new Error(`PermDock: ${schema}.${membersFn} failed: ${result.error.message}`);
+		return readMemberEntries(result.data);
 	};
-	const live = async (userId) => {
-		const found = await record(userId);
+	const record = (userId, memo) => once(memo, `${schema}.${fn}:${userId}`, async () => {
+		const result = await callRpc(client, schema, fn, { p_user: userId });
+		if (result.error !== null) throw new Error(`PermDock: ${schema}.${fn} failed: ${result.error.message}`);
+		return readSubjectRecord(result.data);
+	});
+	const version = (userId, memo) => once(memo, `${schema}.${versionFn}:${userId}`, async () => {
+		const result = await callRpc(client, schema, versionFn, { p_user: userId });
+		return result.error === null ? versionOf(result.data) : (await record(userId, memo))?.authzVersion;
+	});
+	const live = async (userId, memo) => {
+		const found = await record(userId, memo);
 		return found?.active === true ? found : void 0;
 	};
 	return {
 		memberships: {
-			async membershipsFor(principal) {
-				return [...(await live(principal.id))?.memberships ?? []];
+			async membershipsFor(principal, query) {
+				return [...(await live(principal.id, query.memo))?.memberships ?? []];
 			},
-			version(principal) {
-				return declared !== void 0 && !onlyDeclared([...principal.roles ?? [], ...(principal.memberships ?? []).flatMap((membership) => membership.roles)]) ? record(principal.id).then((found) => found?.authzVersion) : version(principal.id);
+			version(principal, context) {
+				return declared !== void 0 && !onlyDeclared([...principal.roles ?? [], ...(principal.memberships ?? []).flatMap((membership) => membership.roles)]) ? record(principal.id, context?.memo).then((found) => found?.authzVersion) : version(principal.id, context?.memo);
 			},
 			list,
-			async globalRolesFor(principal) {
-				return [...(await live(principal.id))?.roles ?? []];
+			async globalRolesFor(principal, context) {
+				return [...(await live(principal.id, context?.memo))?.roles ?? []];
 			}
 		},
 		customRoles(principal) {
+			const held = async (context, keep) => onlyDeclared(context?.held) ? [] : ((await live(principal.id, context?.memo))?.customRoles ?? []).filter(keep);
 			return {
-				async rolesFor(tenant, context) {
-					if (onlyDeclared(context?.held)) return [];
-					return ((await live(principal.id))?.customRoles ?? []).filter((role) => role.tenant === tenant);
-				},
-				async globalRoles(context) {
-					if (onlyDeclared(context?.held)) return [];
-					return ((await live(principal.id))?.customRoles ?? []).filter((role) => role.scope === "global");
-				},
-				async sharedRoles(context) {
-					if (onlyDeclared(context?.held)) return [];
-					return ((await live(principal.id))?.customRoles ?? []).filter((role) => role.shared === true);
-				}
+				rolesFor: (tenant, context) => held(context, (role) => role.tenant === tenant),
+				globalRoles: (context) => held(context, (role) => role.scope === "global"),
+				sharedRoles: (context) => held(context, (role) => role.shared === true)
 			};
 		},
 		async subject(userId) {
@@ -620,7 +599,7 @@ function postgrestSources(client, options = {}) {
 				principal
 			};
 		},
-		record
+		record: (userId) => record(userId)
 	};
 }
 //#endregion

package/dist/{powersync-DXqGuq9A.js → powersync-B_8uwz7f.js}

@@ -14,7 +14,7 @@ const generate = defineLeaf({
 	async run(ctx, { flags }) {
 		const out = fileOut("powersync", flags.out);
 		const from = given(flags.policy);
-		const { runPowerSync } = await import("./powersync-Djf-zCpB.js");
+		const { runPowerSync } = await import("./powersync-CSzDCHRu.js");
 		return runPowerSync({
 			cwd: ctx.cwd,
 			config: ctx.config,
@@ -45,7 +45,7 @@ const verify = defineLeaf({
 		const db = await dbUrl(ctx, flags, { required: true });
 		const fixtures = given(flags.fixtures);
 		const from = given(flags.policy);
-		const { runPowerSync } = await import("./powersync-Djf-zCpB.js");
+		const { runPowerSync } = await import("./powersync-CSzDCHRu.js");
 		return runPowerSync({
 			cwd: ctx.cwd,
 			config: ctx.config,

package/dist/powersync-CSzDCHRu.js

@@ -0,0 +1 @@
+export { n as runPowerSync } from "./powersync-DUT-UKgw.js";