permdock 0.8.0 → 0.10.0

package/dist/{powersync-DHNQX06W.js → powersync-DUT-UKgw.js}

@@ -1,25 +1,25 @@
 import { t as compact } from "./compact-CAf557ZB.js";
-import { c as isConditionDate, l as isConditionRef } from "./refs-C8BKxc_e.js";
-import { A as memoryCustomRoleSource, g as localSnapshotManifest } from "./src-DZ0l9UAg.js";
+import { c as isConditionDate, l as isConditionRef, o as hasConditionOp } from "./refs-C8BKxc_e.js";
+import { g as localSnapshotManifest, j as memoryCustomRoleSource } from "./src-C_pi2Rnh.js";
 import { n as findPermission } from "./permission-registry-B8tYxPIt.js";
 import { f as scopeList, s as resolveScope } from "./scopes-0Up_UA2t.js";
 import { l as policyLevels } from "./policy-CLQ8__GF.js";
 import { t as requiresApproval } from "./approval-required-TzNB9oQA.js";
-import { t as getPermDock } from "./permdock-L-_I_3zP.js";
+import { t as getPermDock } from "./permdock-BvjivVb9.js";
 import { u as usageResult } from "./errors-Vpu6rKHl.js";
 import { c as requirePolicy } from "./load-DjSU5KXO.js";
 import { s as quoteSqlLiteral, t as SQL_IDENT } from "./sql-0WjxIp9g.js";
 import { a as scopeMembershipTable, i as scopeColumn } from "./compile-EzEMB-7v.js";
-import "./sources-CMAM-2A3.js";
+import "./sources-C4vkzZJV.js";
 import { t as applyFiles } from "./files-B3AA05f1.js";
 import { i as fileDrift } from "./output-files-BIQ_9pIs.js";
 import { n as fixtureSubject, r as loadFixtures, t as fixtureRow } from "./fixtures-A1_sp_tR.js";
-import { O as quoteIdent, a as customRolesOn, t as CUSTOM_ROLES } from "./shared-Afctg7B0.js";
-import { r as tableNames } from "./tables-DeMNEy6V.js";
-import { d as andConditions, l as collectGrants, o as assignableRoles, p as contextRefs, t as ownershipRules, u as roleNames } from "./ownership-B4L59T9u.js";
+import { O as quoteIdent, a as customRolesOn, t as CUSTOM_ROLES } from "./shared-DrGLwM3s.js";
+import { r as tableNames } from "./tables-DimBcVWY.js";
+import { d as andConditions, l as collectGrants, o as assignableRoles, p as contextRefs, t as ownershipRules, u as roleNames } from "./ownership-qqBuGJXr.js";
 import { t as membershipSourcesOf } from "./sources-qoIJQrJv.js";
 import { n as pgConnector } from "./pg-DQTqRrou.js";
-import { m as tableFor, t as canFixture } from "./verify-DZeqoWu5.js";
+import { m as tableFor, t as canFixture } from "./verify-jHrbmn-E.js";
 import { resolve } from "node:path";
 //#region src/cli/powersync/names.ts
 function ident(name) {
@@ -87,7 +87,7 @@ function scopeSourcesOf(sources, name) {
 /** The source's stream form, or why its rows cannot filter a stream. */
 function streamOf(source) {
 	const { stream } = source.sql;
-	if (stream === void 0) return `the ${source.sql.table} membership source has no stream form: build it with tableMembershipSource or junctionMembershipSource`;
+	if (stream === void 0) return `the ${source.sql.table} membership source has no stream form: build it with tableMembershipSource, junctionMembershipSource or blockMembershipSource`;
 	if (stream.expiresAt !== void 0) return `the ${stream.table} membership source has no stream: it has an expiry`;
 	if (stream.disabledAt !== void 0) return `the ${stream.table} membership source has no stream: it has disabledAt`;
 	return stream;
@@ -399,6 +399,65 @@ function customRoleItems(ctx, grants, resource, key, table) {
 	}) };
 }
 //#endregion
+//#region src/cli/powersync/tables.ts
+/**
+* One stream per `powersync.tables` entry: the user's own rows, and the rows
+* that point at a resource row the user reads. A stream of the user's own rows
+* alone carries `user`, so `verify` checks it holds no other user's row.
+*/
+function tableStreams(tables, dialect, taken, permitted) {
+	const streams = [];
+	const warnings = [];
+	const omitted = [];
+	for (const [source, spec] of Object.entries(tables)) {
+		const table = bare(source, dialect);
+		const from = fromTable(source, dialect);
+		const queries = [];
+		const follows = spec.follow ?? [];
+		const invalid = [...spec.user === void 0 ? [] : [spec.user], ...follows.flatMap((follow) => [follow.field, ...Object.keys(follow.match ?? {})])].find((column) => !SQL_IDENT.test(column));
+		if (taken.has(table) || invalid !== void 0) {
+			omitted.push({
+				resource: source,
+				reason: invalid === void 0 ? `a resource stream is named ${table}` : `${invalid} is not a column name`
+			});
+			continue;
+		}
+		if (spec.user !== void 0) queries.push(`SELECT * FROM ${from} WHERE ${dialect.column(table, spec.user)} = ${dialect.user}`);
+		for (const follow of follows) {
+			const { ids, gaps } = permitted(follow.resource);
+			for (const gap of gaps) warnings.push(`${source} under-syncs: ${gap}`);
+			if (ids === void 0) {
+				warnings.push(`${source} does not sync the rows of ${follow.resource}: no grant of its read permission compiles, or it has a deny grant`);
+				continue;
+			}
+			const match = Object.entries(follow.match ?? {}).map(([column, value]) => `${dialect.column(table, column)} = ${dialect.literal(value)}`);
+			for (const query of ids) queries.push(`SELECT * FROM ${from} WHERE ${[`${dialect.column(table, follow.field)} IN (${query})`, ...match].join(" AND ")}`);
+		}
+		if (queries.length === 0) {
+			omitted.push({
+				resource: source,
+				reason: "no query compiles"
+			});
+			continue;
+		}
+		streams.push(spec.user !== void 0 && follows.length === 0 ? {
+			name: table,
+			table,
+			user: spec.user,
+			queries
+		} : {
+			name: table,
+			table,
+			queries
+		});
+	}
+	return {
+		streams,
+		warnings,
+		omitted
+	};
+}
+//#endregion
 //#region src/cli/powersync/streams.ts
 const POWERSYNC = {
 	user: "auth.user_id()",
@@ -419,6 +478,8 @@ const POSTGRES = {
 * than truncated.
 */
 const MAX_QUERIES = 32;
+/** Nested `inherit()` grants a stream follows; a longer chain syncs nothing. */
+const MAX_INHERIT_DEPTH = 4;
 /** Every combination of one clause list from each input, ANDed. */
 function product(lists) {
 	let out = [[]];
@@ -502,15 +563,85 @@ function conditionSql(condition, table, ctx) {
 			return membershipSql(scope, left, condition.roles, ctx);
 		}
 		case "sqlFunction": return conditionSql(condition.twin, table, ctx);
+		case "related": return relatedSql(condition, table, ctx);
 		case "not":
 		case "contains":
-		case "related":
 		case "opaque":
 		case "liveSession": return;
 		default: return condition;
 	}
 }
 /**
+* An `inherit()` condition: the row's `field` among the ids of the `resource`
+* rows the user reaches with `permission`, one nested `IN (SELECT …)` per link
+* hop. A relation reads the closure table, which Sync Streams cannot.
+*/
+function relatedSql(condition, table, ctx) {
+	const { permission } = condition;
+	if (permission === void 0 || condition.relation !== "" || condition.ids !== void 0 || condition.depth > 0 || condition.restrictedAncestors !== void 0 || ctx.depth >= MAX_INHERIT_DEPTH || !SQL_IDENT.test(condition.field)) return;
+	let ids = permittedSql(condition.resource, permission, {
+		...ctx,
+		depth: ctx.depth + 1
+	});
+	const hops = condition.hops ?? [];
+	for (let index = hops.length - 1; index > 0 && ids !== void 0; index -= 1) {
+		const hop = hops[index];
+		const node = ctx.policy.resources.get(hops[index - 1]?.resource ?? "");
+		const link = hop !== void 0 && node !== void 0 && Object.hasOwn(node.links, hop.link) ? node.links[hop.link] : void 0;
+		if (node === void 0 || link === void 0 || !SQL_IDENT.test(node.id) || !SQL_IDENT.test(link.field)) return;
+		const source = tableFor(node.name, tableNames(ctx.config.rls?.tables));
+		const name = bare(source, ctx.dialect);
+		ids = ids.map((query) => `SELECT ${ctx.dialect.column(name, node.id)} FROM ${fromTable(source, ctx.dialect)} WHERE ${ctx.dialect.column(name, link.field)} IN (${query})`);
+	}
+	const open = condition.restricted === void 0 ? [[]] : conditionSql({
+		op: "or",
+		conditions: [{
+			op: "isNull",
+			field: condition.restricted,
+			value: true
+		}, {
+			op: "eq",
+			field: condition.restricted,
+			value: false
+		}]
+	}, table, ctx);
+	if (ids === void 0 || open === void 0) return;
+	const left = ctx.dialect.column(table, condition.field);
+	return product([ids.map((query) => [`${left} IN (${query})`]), open]);
+}
+/**
+* The `SELECT`s of the ids of the `resource` rows the user reaches with `key`:
+* `[]` when no grant gives it, `undefined` when a deny grant could subtract
+* rows or no grant compiles. A grant that does not compile leaves its rows out,
+* which the caller reports as an under-sync.
+*/
+function permittedSql(resource, key, ctx) {
+	const node = ctx.policy.resources.get(resource);
+	const items = ctx.grants.filter((item) => item.grant.permission.key === key);
+	if (node === void 0 || !SQL_IDENT.test(node.id) || items.some((item) => item.grant.effect === "deny")) return;
+	const source = tableFor(resource, tableNames(ctx.config.rls?.tables));
+	const table = bare(source, ctx.dialect);
+	const custom = customRoleItems(ctx, ctx.grants, resource, key, table);
+	if (custom.skipped !== void 0) ctx.gaps.push(custom.skipped);
+	const reaches = [...items.map((item) => ({
+		item,
+		access: unsupported(item) ?? accessSql(item, table, ctx)
+	})), ...custom.items.map((entry) => ({
+		item: entry.item,
+		access: entry.access
+	}))];
+	const queries = /* @__PURE__ */ new Set();
+	for (const { item, access } of reaches) {
+		const where = typeof access === "string" || item.where === void 0 ? [[]] : conditionSql(item.where, table, ctx);
+		if (typeof access === "string" || where === void 0) {
+			ctx.gaps.push(`inherit() of ${key} leaves out ${item.label}: ${typeof access === "string" ? access : "its condition has no Sync Streams form"}`);
+			continue;
+		}
+		for (const clauses of product([access, where])) queries.add(`SELECT ${ctx.dialect.column(table, node.id)} FROM ${fromTable(source, ctx.dialect)}${clauses.length === 0 ? "" : ` WHERE ${clauses.join(" AND ")}`}`);
+	}
+	return queries.size === 0 && reaches.length > 0 ? void 0 : [...queries];
+}
+/**
 * One `IN (SELECT …)` per role source of the membership table: the row's `left`
 * is an instance the user holds `roles` in.
 */
@@ -758,6 +889,7 @@ function powersyncPlan(policy, config, dialect = POWERSYNC) {
 }
 function planWith(policy, config, dialect) {
 	const scopes = scopeList(policy.scopes);
+	const grants = collectGrants(policy);
 	const ctx = {
 		policy,
 		config,
@@ -765,10 +897,11 @@ function planWith(policy, config, dialect) {
 		kinds: ownershipRules(policy, scopes)?.kinds ?? {},
 		dialect,
 		sources: guardedSources(policy, config),
+		grants,
+		depth: 0,
 		gaps: []
 	};
 	const action = config.powersync?.action ?? "read";
-	const grants = collectGrants(policy);
 	const resources = config.powersync?.resources ?? [...policy.resources.keys()].filter((name) => grants.some((item) => item.grant.permission.resource === name && item.grant.permission.action === action));
 	const streams = [];
 	const omitted = [];
@@ -849,11 +982,22 @@ function planWith(policy, config, dialect) {
 			queries: [...queries]
 		});
 	}
+	const tables = tableStreams(config.powersync?.tables ?? {}, dialect, new Set(streams.map((stream) => stream.name)), (resource) => ({
+		ids: permittedSql(resource, `${resource}.${action}`, ctx),
+		gaps: [...new Set(ctx.gaps.splice(0))]
+	}));
+	warnings.push(...tables.warnings);
+	omitted.push(...tables.omitted);
 	const subject = subjectStreams(ctx);
-	const outside = [...new Set([...streams, ...subject].flatMap((stream) => stream.queries.flatMap((query) => [...query.matchAll(QUOTED_TABLE)].map(([, schema, name]) => `${schema ?? ""}.${name ?? ""}`))))].toSorted();
+	const outside = [...new Set([
+		...streams,
+		...subject,
+		...tables.streams
+	].flatMap((stream) => stream.queries.flatMap((query) => [...query.matchAll(QUOTED_TABLE)].map(([, schema, name]) => `${schema ?? ""}.${name ?? ""}`))))].toSorted();
 	return {
 		streams,
 		subject,
+		tables: tables.streams,
 		omitted,
 		warnings,
 		unsynced,
@@ -862,31 +1006,6 @@ function planWith(policy, config, dialect) {
 		...outside.length === 0 ? {} : { publication: `alter publication powersync add table ${outside.join(", ")};` }
 	};
 }
-/**
-* A YAML scalar quoted as oxfmt and Prettier write it: single quotes around a
-* `"`, unless a backslash needs a double-quoted escape.
-*/
-function yamlString(text) {
-	return text.includes("\"") && !text.includes("\\") ? `'${text.replaceAll("'", "''")}'` : JSON.stringify(text);
-}
-/**
-* `sync-config.yaml`: edition 3 Sync Streams, one auto-subscribed stream per
-* synced resource.
-*/
-function powersyncYaml(plan) {
-	const lines = [
-		"# Generated by permdock powersync generate from the policy. Do not edit.",
-		...plan.publication === void 0 ? [] : ["# Tables outside public must be in the powersync publication:", `# ${plan.publication}`],
-		"config:",
-		"  edition: 3",
-		"",
-		"streams:"
-	];
-	if (plan.streams.length === 0 && plan.subject.length === 0) lines[lines.length - 1] = "streams: {}";
-	for (const stream of [...plan.streams, ...plan.subject]) lines.push(`  ${stream.name}:`, "    auto_subscribe: true", "    queries:", ...stream.queries.map((query) => `      - ${yamlString(query)}`));
-	for (const item of plan.omitted) lines.push(`# ${item.resource}: not synced, ${item.reason}`);
-	return `${lines.join("\n")}\n`;
-}
 //#endregion
 //#region src/cli/powersync/verify-gaps.ts
 function heldRoles(subject) {
@@ -911,6 +1030,37 @@ function warnedFor(unsynced, permission, subject, customRoles) {
 	});
 }
 //#endregion
+//#region src/cli/powersync/yaml.ts
+/**
+* A YAML scalar quoted as oxfmt and Prettier write it: single quotes around a
+* `"`, unless a backslash needs a double-quoted escape.
+*/
+function yamlString(text) {
+	return text.includes("\"") && !text.includes("\\") ? `'${text.replaceAll("'", "''")}'` : JSON.stringify(text);
+}
+/**
+* `sync-config.yaml`: edition 3 Sync Streams, one auto-subscribed stream per
+* synced resource.
+*/
+function powersyncYaml(plan) {
+	const lines = [
+		"# Generated by permdock powersync generate from the policy. Do not edit.",
+		...plan.publication === void 0 ? [] : ["# Tables outside public must be in the powersync publication:", `# ${plan.publication}`],
+		"config:",
+		"  edition: 3",
+		"",
+		"streams:"
+	];
+	if (plan.streams.length === 0 && plan.subject.length === 0 && plan.tables.length === 0) lines[lines.length - 1] = "streams: {}";
+	for (const stream of [
+		...plan.streams,
+		...plan.subject,
+		...plan.tables
+	]) lines.push(`  ${stream.name}:`, "    auto_subscribe: true", "    queries:", ...stream.queries.map((query) => `      - ${yamlString(query)}`));
+	for (const item of plan.omitted) lines.push(`# ${item.resource}: not synced, ${item.reason}`);
+	return `${lines.join("\n")}\n`;
+}
+//#endregion
 //#region src/cli/powersync/powersync.ts
 const POWERSYNC_HELP = `permdock powersync generate [--out sync-config.yaml] [--check]
 permdock powersync verify [--db-url-stdin] [--fixtures rls.fixtures.json]`;
@@ -997,6 +1147,7 @@ async function synced(query, stream, fixture) {
 }
 async function verifyStreams(input) {
 	const plan = powersyncPlan(input.policy, input.config, POSTGRES);
+	const inherited = new Set(collectGrants(input.policy).filter((item) => hasConditionOp(item.where, "related")).map((item) => item.grant.permission.key));
 	const mismatches = [];
 	const notes = [];
 	const client = await input.connect(input.db);
@@ -1007,7 +1158,7 @@ async function verifyStreams(input) {
 		for (const fixture of input.fixtures) {
 			if (checked.has(fixture.subject.id)) continue;
 			checked.add(fixture.subject.id);
-			for (const stream of plan.subject) if (stream.user !== void 0 && await leaks(query, stream, stream.user, fixture)) mismatches.push(`stream ${stream.name} syncs another user's ${stream.table} rows to ${fixture.subject.id}`);
+			for (const stream of [...plan.subject, ...plan.tables]) if (stream.user !== void 0 && await leaks(query, stream, stream.user, fixture)) mismatches.push(`stream ${stream.name} syncs another user's ${stream.table} rows to ${fixture.subject.id}`);
 		}
 		for (const fixture of input.fixtures) {
 			const permission = findPermission(input.policy.permissions, fixture.action);
@@ -1021,6 +1172,7 @@ async function verifyStreams(input) {
 			const granted = canFixture(permdock, permission, fixtureRow(fixture, permission.kind));
 			const holds = await synced(query, stream, fixture);
 			if (holds === void 0) notes.push(`${fixture.action} for ${fixture.subject.id}: not checked against stream ${stream.name}: the fixture row has no ${stream.id}`);
+			else if (holds && !granted && inherited.has(permission.key)) notes.push(`${fixture.action} for ${fixture.subject.id}: stream ${stream.name} syncs the row through inherit(), which verify does not check: can() here has no relation source`);
 			else if (holds && !granted) mismatches.push(`${fixture.action} for ${fixture.subject.id}: stream ${stream.name} syncs a row the policy denies`);
 			else if (granted && !holds && warnedFor(plan.unsynced, permission.key, fixture.subject, input.customRoles)) notes.push(`${fixture.action} for ${fixture.subject.id}: granted, not synced (the app reads it from the server)`);
 			else if (granted && !holds) mismatches.push(`${fixture.action} for ${fixture.subject.id}: granted, but stream ${stream.name} does not sync the row and generate gave no warning for it`);

package/dist/prisma/index.d.ts

@@ -1,5 +1,5 @@
-import { Rt as Instant, lr as Subject, mr as Condition } from "../policy-types-CCiDRZBH.js";
-import { f as WhereResult } from "../permdock-B6Sf4T_S.js";
+import { Wt as Instant, br as Condition, hr as Subject } from "../policy-types-DGIO_gxq.js";
+import { f as WhereResult } from "../permdock-CprAPN3w.js";
 import { r as RelationsMapping } from "../graph-sql-BwFC4Qjs.js";
 import { n as RowCheck, t as WithSubjectOptions } from "../subject-settings-vNW8qmUH.js";
 //#region src/prisma/model-fields.d.ts

package/dist/{protected-action-BE7N_Luo.d.ts → protected-action-D8x73IGm.d.ts}

@@ -1,11 +1,11 @@
-import { Ln as Decision, j as PolicyVocabulary, or as Membership } from "./policy-types-CCiDRZBH.js";
+import { Un as Decision, fr as Membership, j as PolicyVocabulary } from "./policy-types-DGIO_gxq.js";
 import { u as Permission } from "./permission-types-CAY-GU7e.js";
 import { r as Role } from "./vocabulary-DEJ5j4mR.js";
-import { d as UncheckedData, s as RowData } from "./permdock-B6Sf4T_S.js";
-import { r as DescribeOptions, t as DecisionDescription } from "./describe-ByS9LgHK.js";
-import { n as ProtectedAction } from "./action-result-CL-QCITA.js";
-import { a as FilterResult, c as PermissionSet, h as TenantView, l as PermissionState, m as SubjectView, o as GateMode, p as RolesOptions, r as ClientPermDock, s as GateView, t as ApprovalHandle, u as ProtectedActionHandle } from "./types-B_d_g7T3.js";
-import { r as ProtectedProps } from "./types-BJk0BKRX.js";
+import { d as UncheckedData, s as RowData } from "./permdock-CprAPN3w.js";
+import { r as DescribeOptions, t as DecisionDescription } from "./describe-BbFPBSms.js";
+import { n as ProtectedAction } from "./action-result-BcudBQOF.js";
+import { a as FilterResult, c as PermissionSet, h as TenantView, l as PermissionState, m as SubjectView, o as GateMode, p as RolesOptions, r as ClientPermDock, s as GateView, t as ApprovalHandle, u as ProtectedActionHandle } from "./types-tQB2CEnY.js";
+import { r as ProtectedProps } from "./types-rCRV4Ge-.js";
 import { ReactNode } from "react";
 //#region src/react/hooks.d.ts
 declare function usePermDock<V extends PolicyVocabulary = PolicyVocabulary>(): ClientPermDock<V>;

package/dist/{provider-DXfq5c2d.d.ts → provider-DfLeek9O.d.ts}

@@ -1,4 +1,4 @@
-import { n as PermDockProviderProps } from "./types-BJk0BKRX.js";
+import { n as PermDockProviderProps } from "./types-rCRV4Ge-.js";
 import { ReactElement } from "react";
 //#region src/react/provider.d.ts
 declare function PermDockProvider(props: PermDockProviderProps): ReactElement;

package/dist/{pull-CwpGaQSi.js → pull-DQCgvJSC.js}

@@ -5,9 +5,9 @@ import { s as writeFileEnsuringDir } from "./files-BSjrtIHw.js";
 import { s as cliVersion } from "./version-DMQ0dnN5.js";
 import { o as formatCatalogJson } from "./catalog-doc-DjMKzJp9.js";
 import { t as catalogPath } from "./catalog-path-CnI0XTFK.js";
-import { n as parseSupabaseManifest } from "./manifest-wg8WkkpD.js";
+import { n as parseSupabaseManifest } from "./manifest-BXTbHNIV.js";
 import { t as parseCatalog } from "./parse-1_ZheTW5.js";
-import { a as nonEmptyOr } from "./output-tkju6U7R.js";
+import { a as nonEmptyOr } from "./output-LsbLe41I.js";
 import { t as POLICY_NOT_PUBLISHED } from "./problem-types-DSsRfONQ.js";
 import { n as httpRequest, t as authFailure } from "./http-DOL33cO0.js";
 import { l as cloudUrl, n as cliRuntime, o as readAuth } from "./auth--yPyZNgr.js";

package/dist/pull-DYbyod1f.js

@@ -0,0 +1 @@
+export { n as runCloudPull } from "./pull-DQCgvJSC.js";

package/dist/{push-DgssgzkK.js → push-Dq_ca4-j.js}

@@ -4,10 +4,10 @@ import { t as catalogFingerprint } from "./catalog-fingerprint-e6aCWosn.js";
 import { a as describeError, n as CliError } from "./errors-Vpu6rKHl.js";
 import { s as cliVersion } from "./version-DMQ0dnN5.js";
 import { i as loadConfiguredPolicy } from "./load-DjSU5KXO.js";
-import { n as parseSupabaseManifest } from "./manifest-wg8WkkpD.js";
+import { n as parseSupabaseManifest } from "./manifest-BXTbHNIV.js";
 import { t as parseCatalog } from "./parse-1_ZheTW5.js";
-import { r as pushedPolicy } from "./pushed-policy-ITwYKvvH.js";
-import { n as runCatalog } from "./catalog-BFpz2EmT.js";
+import { r as pushedPolicy } from "./pushed-policy-CDuOL2de.js";
+import { n as runCatalog } from "./catalog-CGlSwU6j.js";
 import { n as httpRequest, t as authFailure } from "./http-DOL33cO0.js";
 import { a as pushAuth, l as cloudUrl, n as cliRuntime, u as firstNonEmpty } from "./auth--yPyZNgr.js";
 import "./manifest-json-CAGzls-C.js";

package/dist/{pushed-policy-ITwYKvvH.js → pushed-policy-CDuOL2de.js}

@@ -3,7 +3,7 @@ import { n as freezeDeep } from "./freeze-jjan0lCv.js";
 import { n as PermDockValidationError } from "./validation-error-CYg2kJEw.js";
 import { n as RFC3339_PATTERN } from "./time-nR1JesoH.js";
 import { i as wireValidity } from "./validity-Buc7w8E9.js";
-import { n as snapshotScopes } from "./instance-snapshot--JWiTrvO.js";
+import { n as snapshotScopes } from "./instance-snapshot-DuWf1cT3.js";
 import { n as copyJson, r as forbiddenKeyPath, t as checkSchema } from "./json-schema-BPGa-RjQ.js";
 //#region src/catalog/pushed-policy.ts
 const strings = {

package/dist/{pushed-policy-D1Eoi6NM.d.ts → pushed-policy-CryQheKq.d.ts}

@@ -1,4 +1,4 @@
-import { Fn as AppObligation, H as WireValidity, T as Policy, Yt as SnapshotScope, _ as GrantLimit, a as ApprovalRequirement, mr as Condition, u as BreakGlassSpec, v as GrantMeta, wn as Grantee } from "./policy-types-CCiDRZBH.js";
+import { An as Grantee, H as WireValidity, T as Policy, Vn as AppObligation, _ as GrantLimit, a as ApprovalRequirement, br as Condition, tn as SnapshotScope, u as BreakGlassSpec, v as GrantMeta } from "./policy-types-DGIO_gxq.js";
 import { t as JsonSchemaNode } from "./json-schema-BfXgnRNT.js";
 //#region src/catalog/pushed-policy.d.ts
 /**

package/dist/react/index.d.ts

@@ -1,9 +1,9 @@
-import { c as requiredPlans } from "../errors-zi_4T-rx.js";
-import { i as describe } from "../describe-ByS9LgHK.js";
-import { n as ProtectedAction, t as ActionResult } from "../action-result-CL-QCITA.js";
+import { c as requiredPlans } from "../errors-BIM4MFsJ.js";
+import { i as describe } from "../describe-BbFPBSms.js";
+import { n as ProtectedAction, t as ActionResult } from "../action-result-BcudBQOF.js";
 import { t as approvalHeaders } from "../headers-B9jQxjtW.js";
-import { a as FilterResult, b as eventSourceRefresh, c as PermissionSet, d as ProtectedActionView, h as TenantView, i as ClientStatus, l as PermissionState, m as SubjectView, n as ApprovalState, o as GateMode, p as RolesOptions, r as ClientPermDock, s as GateView, t as ApprovalHandle, u as ProtectedActionHandle, v as EventSourceRefreshOptions, y as RefreshTrigger } from "../types-B_d_g7T3.js";
-import { n as PermDockProviderProps, r as ProtectedProps, t as PermDockDefaults } from "../types-BJk0BKRX.js";
-import { a as useAssignableRoles, c as useGate, d as usePermission, f as usePermissions, h as useTenant, i as useAssignablePermissions, l as useMemberships, m as useSubject, n as Protected, o as useDescribe, p as useRoles, r as useApproval, s as useFilter, t as useProtectedAction, u as usePermDock } from "../protected-action-BE7N_Luo.js";
-import { t as PermDockProvider } from "../provider-DXfq5c2d.js";
+import { a as FilterResult, b as eventSourceRefresh, c as PermissionSet, d as ProtectedActionView, h as TenantView, i as ClientStatus, l as PermissionState, m as SubjectView, n as ApprovalState, o as GateMode, p as RolesOptions, r as ClientPermDock, s as GateView, t as ApprovalHandle, u as ProtectedActionHandle, v as EventSourceRefreshOptions, y as RefreshTrigger } from "../types-tQB2CEnY.js";
+import { n as PermDockProviderProps, r as ProtectedProps, t as PermDockDefaults } from "../types-rCRV4Ge-.js";
+import { a as useAssignableRoles, c as useGate, d as usePermission, f as usePermissions, h as useTenant, i as useAssignablePermissions, l as useMemberships, m as useSubject, n as Protected, o as useDescribe, p as useRoles, r as useApproval, s as useFilter, t as useProtectedAction, u as usePermDock } from "../protected-action-D8x73IGm.js";
+import { t as PermDockProvider } from "../provider-DfLeek9O.js";
 export { type ActionResult, type ApprovalHandle, type ApprovalState, type ClientPermDock, type ClientStatus, type EventSourceRefreshOptions, type FilterResult, type GateMode, type GateView, type PermDockDefaults, PermDockProvider, type PermDockProviderProps, type PermissionSet, type PermissionState, Protected, type ProtectedAction, type ProtectedActionHandle, type ProtectedActionView, type ProtectedProps, type RefreshTrigger, type RolesOptions, type SubjectView, type TenantView, approvalHeaders, describe, eventSourceRefresh, requiredPlans, useApproval, useAssignablePermissions, useAssignableRoles, useDescribe, useFilter, useGate, useMemberships, usePermDock, usePermission, usePermissions, useProtectedAction, useRoles, useSubject, useTenant };

package/dist/react/provider-client.d.ts

@@ -1,2 +1,2 @@
-import { t as PermDockProvider } from "../provider-DXfq5c2d.js";
+import { t as PermDockProvider } from "../provider-DfLeek9O.js";
 export { PermDockProvider };

package/dist/react-native/index.d.ts

@@ -1,14 +1,14 @@
-import { Bt as LocalMembershipRows, Gt as Snapshot, Ht as LocalRowValue, Rt as Instant, Ut as LocalSnapshotManifest, Vt as LocalRowColumn, Wt as LocalSnapshotRows, or as Membership, ot as SnapshotSource, tr as CustomRole } from "../policy-types-CCiDRZBH.js";
+import { Jt as LocalRowValue, Kt as LocalMembershipRows, Wt as Instant, Xt as LocalSnapshotRows, Yt as LocalSnapshotManifest, Zt as Snapshot, ct as SnapshotSource, fr as Membership, qt as LocalRowColumn, sr as CustomRole } from "../policy-types-DGIO_gxq.js";
 import { u as Permission } from "../permission-types-CAY-GU7e.js";
-import { c as requiredPlans } from "../errors-zi_4T-rx.js";
-import { i as describe } from "../describe-ByS9LgHK.js";
-import { t as parseLocalSnapshotManifest } from "../parse-local-manifest-BQhTlLQS.js";
-import { n as ProtectedAction, t as ActionResult } from "../action-result-CL-QCITA.js";
+import { c as requiredPlans } from "../errors-BIM4MFsJ.js";
+import { i as describe } from "../describe-BbFPBSms.js";
+import { t as parseLocalSnapshotManifest } from "../parse-local-manifest-CCmbhnxP.js";
+import { n as ProtectedAction, t as ActionResult } from "../action-result-BcudBQOF.js";
 import { t as approvalHeaders } from "../headers-B9jQxjtW.js";
-import { a as FilterResult, b as eventSourceRefresh, c as PermissionSet, d as ProtectedActionView, g as ClientStore, h as TenantView, i as ClientStatus, l as PermissionState, m as SubjectView, n as ApprovalState, o as GateMode, p as RolesOptions, r as ClientPermDock, s as GateView, t as ApprovalHandle, u as ProtectedActionHandle, v as EventSourceRefreshOptions, y as RefreshTrigger } from "../types-B_d_g7T3.js";
-import { r as ProtectedProps, t as PermDockDefaults } from "../types-BJk0BKRX.js";
-import { a as useAssignableRoles, c as useGate, d as usePermission, f as usePermissions, h as useTenant, i as useAssignablePermissions, l as useMemberships, m as useSubject, n as Protected, o as useDescribe, p as useRoles, r as useApproval, s as useFilter, t as useProtectedAction, u as usePermDock } from "../protected-action-BE7N_Luo.js";
-import { a as SubscribeOnline, i as SubscribeForeground, n as ReactNativePermDockProviderProps, r as SnapshotStorage, t as NativeRevalidate } from "../types-HzqOtvsJ.js";
+import { a as FilterResult, b as eventSourceRefresh, c as PermissionSet, d as ProtectedActionView, g as ClientStore, h as TenantView, i as ClientStatus, l as PermissionState, m as SubjectView, n as ApprovalState, o as GateMode, p as RolesOptions, r as ClientPermDock, s as GateView, t as ApprovalHandle, u as ProtectedActionHandle, v as EventSourceRefreshOptions, y as RefreshTrigger } from "../types-tQB2CEnY.js";
+import { r as ProtectedProps, t as PermDockDefaults } from "../types-rCRV4Ge-.js";
+import { a as useAssignableRoles, c as useGate, d as usePermission, f as usePermissions, h as useTenant, i as useAssignablePermissions, l as useMemberships, m as useSubject, n as Protected, o as useDescribe, p as useRoles, r as useApproval, s as useFilter, t as useProtectedAction, u as usePermDock } from "../protected-action-D8x73IGm.js";
+import { a as SubscribeOnline, i as SubscribeForeground, n as ReactNativePermDockProviderProps, r as SnapshotStorage, t as NativeRevalidate } from "../types-CWBsAwqn.js";
 import { ReactElement } from "react";
 //#region src/react-native/guards.d.ts
 /**

package/dist/{replay-DNftIb_R.d.ts → replay-Bs9Df2fQ.d.ts}

@@ -1,4 +1,4 @@
-import { l as ReplayStore } from "./types-DjuMBNF9.js";
+import { l as ReplayStore } from "./types-DsHGPtkR.js";
 //#region src/ssf/replay.d.ts
 declare function memoryReplayStore(): ReplayStore;
 //#endregion

package/dist/{request-context-C25ilqiJ.js → request-context-Duzdf0cd.js}

@@ -1,6 +1,6 @@
 import { t as assertAppData } from "./app-data-UNNm07jV.js";
 import { n as wrapPermDock } from "./wrap-B2wziJI_.js";
-import { t as buildInstance } from "./build-instance-CNWaYJyr.js";
+import { t as buildInstance } from "./build-instance-BWXqwQYU.js";
 //#region src/core/request-context.ts
 /**
 * Errors an adapter raises around one instance (a `context` hook that threw, an

package/dist/resend/index.d.ts

@@ -1,7 +1,7 @@
-import { q as DecisionSink } from "../policy-types-CCiDRZBH.js";
-import { n as ApprovalUrl, t as ApprovalPrompt } from "../approval-prompt-PYagyQUj.js";
-import { d as EmailTransport, o as DeliveryResult, u as EmailMessage } from "../types-yUuPR5Hy.js";
-import { l as ReplayStore } from "../types-DjuMBNF9.js";
+import { J as DecisionSink } from "../policy-types-DGIO_gxq.js";
+import { n as ApprovalUrl, t as ApprovalPrompt } from "../approval-prompt-3BqWczTt.js";
+import { d as EmailTransport, o as DeliveryResult, u as EmailMessage } from "../types-CN0LsqbK.js";
+import { l as ReplayStore } from "../types-DsHGPtkR.js";
 //#region src/resend/approval-email.d.ts
 type ApprovalEmailOptions = {
   /**

package/dist/{resolve-names-CF7xXLSG.js → resolve-names-Y1Cb22cp.js}

@@ -3,10 +3,10 @@ import { c as listPermissions } from "./permission-registry-B8tYxPIt.js";
 import { f as scopeList } from "./scopes-0Up_UA2t.js";
 import { i as configError } from "./errors-Vpu6rKHl.js";
 import "./budget-BELja5A9.js";
-import "./sources-CMAM-2A3.js";
-import { A as quoteQualified, D as qualified, I as scopeTypeOf, O as quoteIdent } from "./shared-Afctg7B0.js";
-import { F as globalRoleRows, Q as graphSqlName, Z as graphHelper, _ as PERMISSION_HELPERS, at as memberForHelper, c as holderSources, ct as memberIdsHelper, dt as permittedForHelper, ft as permittedIdsHelper, ht as scopeTable, lt as memberOfHelper, nt as inheritedRowsHelper, o as graphPlan, pt as restrictedHelper, r as tableNames, rt as isTeamScope, tt as hasPermittedUsers, v as checkName, x as permittedByPermissionHelper } from "./tables-DeMNEy6V.js";
-import { t as FIELD_VIEWS } from "./fields-D0vUI6dq.js";
+import "./sources-C4vkzZJV.js";
+import { A as quoteQualified, D as qualified, I as scopeTypeOf, O as quoteIdent } from "./shared-DrGLwM3s.js";
+import { F as globalRoleRows, Q as graphSqlName, Z as graphHelper, _ as PERMISSION_HELPERS, at as memberForHelper, c as holderSources, ct as memberIdsHelper, dt as permittedForHelper, ft as permittedIdsHelper, ht as scopeTable, lt as memberOfHelper, nt as inheritedRowsHelper, o as graphPlan, pt as restrictedHelper, r as tableNames, rt as isTeamScope, tt as hasPermittedUsers, v as checkName, x as permittedByPermissionHelper } from "./tables-DimBcVWY.js";
+import { t as FIELD_VIEWS } from "./fields-DI8s3cPl.js";
 //#region src/cli/rls/permission-holders.ts
 /**
 * `permitted_<scope>_users(p_permission, p_id)`. Names are part of the SQL