permdock 0.9.0 → 0.10.0

package/dist/{supabase-hook-CrgU06WH.js → supabase-hook-BT2P9wah.js}

@@ -8,23 +8,23 @@ import { a as SUPABASE_MANIFEST_SCHEMA } from "./version-DMQ0dnN5.js";
 import { c as requirePolicy } from "./load-DjSU5KXO.js";
 import { i as qualifySqlTable } from "./sql-0WjxIp9g.js";
 import { i as scopeColumn } from "./compile-EzEMB-7v.js";
-import { t as authorizeSql } from "./supabase-DnMMg5Fn.js";
+import { t as authorizeSql } from "./supabase-B1EfuD47.js";
 import "./budget-BELja5A9.js";
-import { a as hookApiNames, d as keptKeys, t as AUTHZ_VERSION_TABLE, u as roleManifest } from "./sources-CMAM-2A3.js";
-import { o as readMemberships } from "./postgrest-5Dr3W64L.js";
+import { a as hookApiNames, d as keptKeys, t as AUTHZ_VERSION_TABLE, u as roleManifest } from "./sources-C4vkzZJV.js";
+import { o as readMemberships } from "./postgrest-DAxFltvO.js";
 import { t as beforeFirst } from "./text-BMFRfBqc.js";
 import { n as GRANTS_MARKER, r as HOOK_MARKER, s as hookMarkerFields } from "./markers-BeHZ4x9Q.js";
 import { n as formatManifestJson, t as MANIFEST_FILE } from "./manifest-json-CAGzls-C.js";
 import { n as MIGRATION_DIRS } from "./constants-DcJABbLW.js";
 import { f as writeOutputFiles, l as partPath, r as driftOf, u as pgDeltaPath } from "./output-files-BIQ_9pIs.js";
-import { A as quoteQualified, D as qualified, F as firstScopeType, I as scopeTypeOf, O as quoteIdent, R as tenantTypeOf, a as customRolesOn, j as quoteTable, k as quoteLiteral, l as USER_ID_HELPER, r as HELPERS, y as subjectIdSql } from "./shared-Afctg7B0.js";
-import { E as TOKEN_SCOPE_ALLOWS, J as apiKeyFields, K as API_KEY_ALLOWS, R as globalRoleSource, _ as PERMISSION_HELPERS, at as memberForHelper, b as permissionKeysForHelper, bt as checkSuspension, ct as memberIdsHelper, dt as permittedForHelper, et as hasMemberFor, ft as permittedIdsHelper, g as OWNERSHIP, h as ASSIGNMENTS, lt as memberOfHelper, ot as memberForSources, rt as isTeamScope, st as memberForTable, tt as hasPermittedUsers, ut as memberRoleOf, v as checkName, vt as activeRowSql, x as permittedByPermissionHelper } from "./tables-BqrxBCir.js";
-import { a as guardedTables, t as ownershipRules, u as roleNames } from "./ownership-DA5YdYTm.js";
+import { A as quoteQualified, D as qualified, F as firstScopeType, I as scopeTypeOf, O as quoteIdent, R as tenantTypeOf, a as customRolesOn, j as quoteTable, k as quoteLiteral, l as USER_ID_HELPER, r as HELPERS, y as subjectIdSql } from "./shared-DrGLwM3s.js";
+import { E as TOKEN_SCOPE_ALLOWS, J as apiKeyFields, K as API_KEY_ALLOWS, R as globalRoleSource, _ as PERMISSION_HELPERS, at as memberForHelper, b as permissionKeysForHelper, bt as checkSuspension, ct as memberIdsHelper, dt as permittedForHelper, et as hasMemberFor, ft as permittedIdsHelper, g as OWNERSHIP, h as ASSIGNMENTS, lt as memberOfHelper, ot as memberForSources, rt as isTeamScope, st as memberForTable, tt as hasPermittedUsers, ut as memberRoleOf, v as checkName, vt as activeRowSql, x as permittedByPermissionHelper } from "./tables-DimBcVWY.js";
+import { a as guardedTables, t as ownershipRules, u as roleNames } from "./ownership-qqBuGJXr.js";
 import { t as membershipSourcesOf } from "./sources-qoIJQrJv.js";
 import { a as splitUndiffed, r as tableKey, t as decidingColumns } from "./deciding-columns-NB4wcyBf.js";
 import { n as pgConnector } from "./pg-DQTqRrou.js";
-import { r as permittedUsersHelper, t as resolveNames } from "./resolve-names-ConCSj1y.js";
-import { c as ACTOR_MAY_WRITE, f as readOnlyActorKinds } from "./fields-D0vUI6dq.js";
+import { c as ACTOR_MAY_WRITE, f as readOnlyActorKinds } from "./fields-DI8s3cPl.js";
+import { r as permittedUsersHelper, t as resolveNames } from "./resolve-names-Y1Cb22cp.js";
 import { existsSync, readFileSync, readdirSync } from "node:fs";
 import { dirname, join, posix, resolve } from "node:path";
 //#region ../../node_modules/.pnpm/smol-toml@1.9.1/node_modules/smol-toml/dist/error.js
@@ -1577,28 +1577,39 @@ function positiveInteger(value, label) {
 	return number;
 }
 /**
-* SQL for the active first-scope id, as text, for user `uid`; a table source
-* compares its id column with `v_active_user`, declared as `userType`.
+* Where the hook reads the active first-scope id: `supabase.hook.activeFrom`,
+* or `app_metadata.active_<root>` by default.
 */
-function activeFromSql(input, root) {
+function activeSource(input, root) {
 	const spec = input ?? `app_metadata.active_${root}`;
 	if (typeof spec === "string" && spec.startsWith("app_metadata.")) {
 		const key = spec.slice(13);
 		if (!/^[A-Za-z_][A-Za-z0-9_]*$/u.test(key)) throw configError(`PermDock CLI: unsafe app_metadata key '${key}'`);
-		return { sql: `claims -> 'app_metadata' ->> ${quoteLiteral(key)}` };
+		return { appMetadata: key };
 	}
-	const parsed = typeof spec === "string" ? (() => {
-		const dot = spec.lastIndexOf(".");
-		if (dot <= 0) throw configError(`PermDock CLI: --active-from must be app_metadata.<key> or <table>.<column>, got '${spec}'`);
-		return {
-			table: spec.slice(0, dot),
-			column: spec.slice(dot + 1)
-		};
-	})() : spec;
-	const id = "id" in parsed && parsed.id !== void 0 ? parsed.id : "id";
+	if (typeof spec !== "string") return {
+		table: spec.table,
+		column: spec.column,
+		id: spec.id ?? "id"
+	};
+	const dot = spec.lastIndexOf(".");
+	if (dot <= 0) throw configError(`PermDock CLI: --active-from must be app_metadata.<key> or <table>.<column>, got '${spec}'`);
 	return {
-		sql: `(select a.${quoteIdent(parsed.column)}::text from ${quoteQualified(parsed.table)} a where a.${quoteIdent(id)} = v_active_user)`,
-		userType: `${quoteQualified(parsed.table)}.${quoteIdent(id)}%type`
+		table: spec.slice(0, dot),
+		column: spec.slice(dot + 1),
+		id: "id"
+	};
+}
+/**
+* SQL for the active first-scope id, as text, for user `uid`; a table source
+* compares its id column with `v_active_user`, declared as `userType`.
+*/
+function activeFromSql(input, root) {
+	const from = activeSource(input, root);
+	if ("appMetadata" in from) return { sql: `claims -> 'app_metadata' ->> ${quoteLiteral(from.appMetadata)}` };
+	return {
+		sql: `(select a.${quoteIdent(from.column)}::text from ${quoteQualified(from.table)} a where a.${quoteIdent(from.id)} = v_active_user)`,
+		userType: `${quoteQualified(from.table)}.${quoteIdent(from.id)}%type`
 	};
 }
 /**
@@ -1615,9 +1626,9 @@ function typedUsers(parts) {
 	].map((line) => `\n  ${line}`).join("");
 }
 function checkSources(parts) {
-	if (parts.sources.length === 0) throw configError("PermDock CLI: supabase.hook.memberships needs at least one tableMembershipSource or junctionMembershipSource source");
+	if (parts.sources.length === 0) throw configError("PermDock CLI: supabase.hook.memberships needs at least one tableMembershipSource, junctionMembershipSource or blockMembershipSource source");
 	for (const source of parts.sources) {
-		if (source.sql === void 0 || typeof source.sql.select !== "function") throw configError("PermDock CLI: supabase.hook.memberships takes tableMembershipSource / junctionMembershipSource sources from permdock/supabase");
+		if (source.sql === void 0 || typeof source.sql.select !== "function") throw configError("PermDock CLI: supabase.hook.memberships takes tableMembershipSource, junctionMembershipSource or blockMembershipSource sources from permdock/supabase");
 		const scope = source.sql.scope;
 		if (scope === void 0) continue;
 		if (resolveScope(parts.scopes, scope) !== scope) throw configError(`PermDock CLI: the ${source.sql.table} source names scope '${scope}', which the policy does not declare by that name`);
@@ -2177,9 +2188,11 @@ grant execute on function ${fn}(jsonb, text) to authenticated;
 }
 /**
 * Everything `rls.approvals` writes: the generated or adopted store, the
-* approver check and, with `delegations: true`, the covers.
+* approver check and, with `delegations: true`, the covers. With
+* `actorMayWrite`, the covers' write policies call
+* `permdock_actor_may_write()`.
 */
-function approvalsSql(ctx, approvals, jsonSchema) {
+function approvalsSql(ctx, approvals, jsonSchema, actorMayWrite = false) {
 	if (approvals === void 0 || approvals === false) return;
 	if (approvals === true) return approvalStoreSql(ctx, jsonSchema) + isApproverSql(ctx);
 	const { table, delegations } = approvals;
@@ -2199,7 +2212,7 @@ function approvalsSql(ctx, approvals, jsonSchema) {
 		...approvals,
 		table
 	}, jsonSchema);
-	return store + isApproverSql(ctx) + (delegations === true ? approvalDelegationsSql(ctx) : "");
+	return store + isApproverSql(ctx) + (delegations === true ? approvalDelegationsSql(ctx, actorMayWrite) : "");
 }
 /**
 * The objects `rls.approvals.delegations` adds; `tableApprovalDelegationSource`
@@ -2218,7 +2231,7 @@ const DELEGATIONS = {
 * cover needs `rls.mode: "database"`, where the `_for` helpers exist; in `jwt`
 * mode only `user()` approvers pass.
 */
-function approvalDelegationsSql(ctx) {
+function approvalDelegationsSql(ctx, actorMayWrite = false) {
 	const table = qualified(ctx, DELEGATIONS.table);
 	const fn = qualified(ctx, APPROVAL_STORE.isApprover);
 	const covers = qualified(ctx, DELEGATIONS.covers);
@@ -2235,7 +2248,8 @@ function approvalDelegationsSql(ctx) {
           where i.id::text = p_tenant
         )` : "false";
 	const policy = (name) => quoteIdent(`${DELEGATIONS.table}_${name}`);
-	const own = `delegator::text = ${me} and (tenant is null or ${member("tenant")})`;
+	const mine = `delegator::text = ${me}${actorMayWrite ? ` and (select ${qualified(ctx, ACTOR_MAY_WRITE)}())` : ""}`;
+	const own = `${mine} and (tenant is null or ${member("tenant")})`;
 	return `
 -- approval delegations: out-of-office covers a user writes for themselves; tableApprovalDelegationSource and permdock_is_approver read them
 create table if not exists ${table} (
@@ -2266,12 +2280,12 @@ create policy ${policy("insert")} on ${table}
 drop policy if exists ${policy("update")} on ${table};
 create policy ${policy("update")} on ${table}
   for update to authenticated
-  using (delegator::text = ${me})
+  using (${mine})
   with check (${own});
 drop policy if exists ${policy("delete")} on ${table};
 create policy ${policy("delete")} on ${table}
   for delete to authenticated
-  using (delegator::text = ${me});
+  using (${mine});
 
 -- approval delegations: whether a delegator's own rights match approvers.by; only permdock_is_approver calls it
 create or replace function ${covers}(p_delegator ${user}, p_approvers jsonb, p_tenant text)
@@ -2839,6 +2853,7 @@ function hookParts(scopes, config, overrides) {
 		hook,
 		roles: hook.roles === false ? void 0 : globalRoleSource(hook.roles ?? config.rls?.roles ?? { table: `${schema}.user_roles` }, "public", "r", config.rls?.customRoleWrites?.roles),
 		active: activeFromSql(overrides.activeFrom ?? hook.activeFrom, root),
+		activeFrom: activeSource(overrides.activeFrom ?? hook.activeFrom, root),
 		attrs: hook.attrs === void 0 ? void 0 : attrsPlan(hook.attrs),
 		extra: extraPlan.claims,
 		before: beforePlan(hook.before),
@@ -2857,6 +2872,45 @@ function hookParts(scopes, config, overrides) {
 	return parts;
 }
 //#endregion
+//#region src/cli/supabase-hook/teams.ts
+/**
+* The `member_team_ids_of` helper the hook file writes from
+* `supabase.hook.teams`, or `undefined` when there is no teams table or `rls
+* generate` already writes one for a `team` or `teams` scope.
+*/
+function hookTeamsHelper(parts) {
+	if (parts.hook.teams === void 0) return;
+	return parts.helpers.memberFor.some((scope) => isTeamScope(scope)) ? void 0 : memberOfHelper("team");
+}
+/**
+* `member_team_ids_of(p_user uuid)`: the teams `supabase.hook.teams` lists for
+* the caller, the rows the hook writes to `team_ids`. Any other `p_user`, and a
+* suspended user, gets no rows, so `authenticated` may execute it. The team
+* column is a uuid, as the `team_ids` claim is.
+*/
+function teamIdsOfSql(parts) {
+	const name = hookTeamsHelper(parts);
+	const teams = parts.hook.teams;
+	if (name === void 0 || teams === void 0) return "";
+	const fn = `${quoteIdent(parts.helpers.schema)}.${quoteIdent(name)}`;
+	const active = parts.users === void 0 ? "" : `\n    and ${activeRowSql(parts.users, "p_user")}`;
+	return `-- the caller's teams from supabase.hook.teams, for better-supabase's teamIdsOf
+create or replace function ${fn}(p_user uuid)
+returns setof uuid
+language sql
+stable
+security definer
+set search_path = ''
+as $$
+  select t.${quoteIdent(teams.team)}
+  from ${quoteQualified(teams.table)} t
+  where t.${quoteIdent(teams.user)} = p_user
+    and p_user = (select auth.uid())${active}
+$$;
+revoke execute on function ${fn}(uuid) from public, anon;
+grant execute on function ${fn}(uuid) to authenticated;`;
+}
+//#endregion
 //#region src/cli/supabase-hook/version.ts
 const VERSION_TRIGGER = "permdock_authz_version";
 const AUTHZ_VERSION_BUMP = "permdock_bump_authz_version_for";
@@ -3059,9 +3113,8 @@ function roleKeyHolders(parts) {
 				holder.userThrough.key
 			],
 			tableKey(holder.through.table),
-			holder.through.id,
 			holder.through.key,
-			holder.through.ref
+			holder.through.match
 		]);
 		if (seen.has(key)) return false;
 		seen.add(key);
@@ -3074,13 +3127,16 @@ function roleKeyHolders(parts) {
 */
 function roleKeysBumpSql(holders, versionTable, indent) {
 	return `${indent}if tg_op = 'UPDATE'
-${indent}  and ${[...new Set(holders.flatMap((holder) => [holder.through.key, holder.through.id]))].map((column) => `new.${quoteIdent(column)} is not distinct from old.${quoteIdent(column)}`).join(`\n${indent}  and `)} then
+${indent}  and ${[...new Set(holders.flatMap((holder) => [holder.through.key, ...holder.through.match.map(([, id]) => id)]))].map((column) => `new.${quoteIdent(column)} is not distinct from old.${quoteIdent(column)}`).join(`\n${indent}  and `)} then
 ${indent}  return null;
 ${indent}end if;
 ${indent}insert into ${versionTable} as v (user_id, version)
 ${indent}select distinct h.user_id, 1
 ${indent}from (
-${indent}  ${holders.map((holder) => holder.userThrough === void 0 ? `select h.${quoteIdent(holder.user)}::uuid as user_id from ${quoteQualified(holder.table)} h where h.${quoteIdent(holder.through.ref)} = old.${quoteIdent(holder.through.id)}` : `select u.${quoteIdent(holder.userThrough.key)}::uuid as user_id from ${quoteQualified(holder.table)} h join ${quoteQualified(holder.userThrough.table)} u on u.${quoteIdent(holder.userThrough.id)} = h.${quoteIdent(holder.user)} where h.${quoteIdent(holder.through.ref)} = old.${quoteIdent(holder.through.id)}`).join(`\n${indent}  union\n${indent}  `)}
+${indent}  ${holders.map((holder) => {
+		const held = holder.through.match.map(([ref, id]) => `h.${quoteIdent(ref)} = old.${quoteIdent(id)}`).join(" and ");
+		return holder.userThrough === void 0 ? `select h.${quoteIdent(holder.user)}::uuid as user_id from ${quoteQualified(holder.table)} h where ${held}` : `select u.${quoteIdent(holder.userThrough.key)}::uuid as user_id from ${quoteQualified(holder.table)} h join ${quoteQualified(holder.userThrough.table)} u on u.${quoteIdent(holder.userThrough.id)} = h.${quoteIdent(holder.user)} where ${held}`;
+	}).join(`\n${indent}  union\n${indent}  `)}
 ${indent}) h
 ${indent}where h.user_id is not null
 ${indent}  and exists (select 1 from auth.users au where au.id = h.user_id)
@@ -3139,15 +3195,20 @@ create trigger ${quoteIdent(VERSION_TRIGGER)}
 //#region src/cli/supabase-hook/manifest.ts
 function helperList(parts, types) {
 	const client = ["authenticated"];
-	return [helperEntry(HELPERS.has, "p_grant text", "boolean", client), ...parts.scopes.flatMap((scope) => {
-		const returns = `setof ${types.get(scope.name) ?? "uuid"}`;
-		return [
-			helperEntry(permittedIdsHelper(scope.name), "p_grant text", returns, client),
-			helperEntry(memberIdsHelper(scope.name), "", returns, client),
-			...parts.helpers.memberFor.includes(scope.name) ? [helperEntry(memberForHelper(scope.name), "p_user uuid", returns, parts.extra.length === 0 ? [] : ["supabase_auth_admin"])] : [],
-			...parts.helpers.memberFor.includes(scope.name) && isTeamScope(scope.name) ? [helperEntry(memberOfHelper(scope.name), "p_user uuid", returns, client)] : []
-		];
-	})];
+	const teams = hookTeamsHelper(parts);
+	return [
+		helperEntry(HELPERS.has, "p_grant text", "boolean", client),
+		...parts.scopes.flatMap((scope) => {
+			const returns = `setof ${types.get(scope.name) ?? "uuid"}`;
+			return [
+				helperEntry(permittedIdsHelper(scope.name), "p_grant text", returns, client),
+				helperEntry(memberIdsHelper(scope.name), "", returns, client),
+				...parts.helpers.memberFor.includes(scope.name) ? [helperEntry(memberForHelper(scope.name), "p_user uuid", returns, parts.extra.length === 0 ? [] : ["supabase_auth_admin"])] : [],
+				...parts.helpers.memberFor.includes(scope.name) && isTeamScope(scope.name) ? [helperEntry(memberOfHelper(scope.name), "p_user uuid", returns, client)] : []
+			];
+		}),
+		...teams === void 0 ? [] : [helperEntry(teams, "p_user uuid", "setof uuid", client)]
+	];
 }
 function helperEntry(name, args, returns, execute) {
 	return {
@@ -3277,7 +3338,8 @@ function manifestOf(parts, out, config, policy) {
 			schema: parts.schema,
 			function: "custom_access_token_hook",
 			out,
-			...parts.before.length === 0 ? {} : { before: parts.before }
+			...parts.before.length === 0 ? {} : { before: parts.before },
+			activeFrom: parts.activeFrom
 		},
 		helpers: {
 			schema: parts.helpers.schema,
@@ -3421,6 +3483,7 @@ ${toml}${grantsOut === void 0 ? "" : `\n-- what supabase db diff drops from this
 		subjectForSql(parts, config),
 		authzVersionForSql(parts),
 		membersOfSql(parts),
+		teamIdsOfSql(parts),
 		apiWrappersSql(parts),
 		grantsSql(parts),
 		managedSql(parts)
@@ -3622,4 +3685,4 @@ async function runSupabase(input) {
 	};
 }
 //#endregion
-export { supabaseConfig as _, supabaseHookManifest as a, resolveAuthorize as b, pd039 as c, schemasRefusal as d, declarativeSql as f, readSupabaseConfig as g, pd074 as h, runSupabase as i, isSupabaseSchemas as l, pd045 as m, hookOut as n, supabaseHookSql as o, attrsPlan as p, loadScopes as r, approvalsSql as s, grantsLabel as t, resolveSchemas as u, parseRbacAuthorize as v, rbacScaffold as y };
+export { readSupabaseConfig as _, supabaseHookManifest as a, rbacScaffold as b, activeSource as c, resolveSchemas as d, schemasRefusal as f, pd074 as g, pd045 as h, runSupabase as i, pd039 as l, attrsPlan as m, hookOut as n, supabaseHookSql as o, declarativeSql as p, loadScopes as r, approvalsSql as s, grantsLabel as t, isSupabaseSchemas as u, supabaseConfig as v, resolveAuthorize as x, parseRbacAuthorize as y };

package/dist/supabase-hook-CbvGAutK.js

@@ -0,0 +1 @@
+export { i as runSupabase } from "./supabase-hook-BT2P9wah.js";

package/dist/{supautils-ByezN3b8.js → supautils-DBKOoyjn.js}

@@ -5,18 +5,18 @@ import { l as policyLevels } from "./policy-CLQ8__GF.js";
 import { a as describeError, i as configError } from "./errors-Vpu6rKHl.js";
 import { d as sqlTextArray, i as qualifySqlTable } from "./sql-0WjxIp9g.js";
 import "./budget-BELja5A9.js";
-import { l as roleColumn } from "./sources-CMAM-2A3.js";
+import { l as roleColumn } from "./sources-C4vkzZJV.js";
 import { t as beforeFirst } from "./text-BMFRfBqc.js";
 import { c as parseSplit } from "./output-files-BIQ_9pIs.js";
-import { b as resolveAuthorize } from "./supabase-hook-CrgU06WH.js";
-import { A as quoteQualified, C as parseMembershipsFlag, D as qualified, F as firstScopeType, O as quoteIdent, R as tenantTypeOf, a as customRolesOn, j as quoteTable, k as quoteLiteral, s as signedIn, t as CUSTOM_ROLES } from "./shared-Afctg7B0.js";
-import { G as byKey, H as rolesTableScope, O as tokenScopesPlan, Q as graphSqlName, V as raiseSql, W as byCodeUnit, Y as apiKeysPlan, a as closureDepths, bt as checkSuspension, i as tablelessResources, o as graphPlan, r as tableNames, t as resolveVias, z as currentKeyExpr } from "./tables-BqrxBCir.js";
-import { o as assignableRoles, r as unsatisfiedKinds, t as ownershipRules, u as roleNames } from "./ownership-DA5YdYTm.js";
+import { x as resolveAuthorize } from "./supabase-hook-BT2P9wah.js";
+import { A as quoteQualified, C as parseMembershipsFlag, D as qualified, F as firstScopeType, O as quoteIdent, R as tenantTypeOf, a as customRolesOn, j as quoteTable, k as quoteLiteral, s as signedIn, t as CUSTOM_ROLES } from "./shared-DrGLwM3s.js";
+import { G as byKey, H as rolesTableScope, O as tokenScopesPlan, Q as graphSqlName, V as raiseSql, W as byCodeUnit, Y as apiKeysPlan, a as closureDepths, bt as checkSuspension, i as tablelessResources, o as graphPlan, r as tableNames, t as resolveVias, z as currentKeyExpr } from "./tables-DimBcVWY.js";
+import { o as assignableRoles, r as unsatisfiedKinds, t as ownershipRules, u as roleNames } from "./ownership-qqBuGJXr.js";
 import { t as membershipSourcesOf } from "./sources-qoIJQrJv.js";
 import { i as group, o as sqlStatements } from "./deciding-columns-NB4wcyBf.js";
-import { t as resolveNames } from "./resolve-names-ConCSj1y.js";
-import { d as orSql, h as branchClauses } from "./fields-D0vUI6dq.js";
-import { m as tableFor } from "./verify-DlUcTDBz.js";
+import { d as orSql, h as branchClauses } from "./fields-DI8s3cPl.js";
+import { t as resolveNames } from "./resolve-names-Y1Cb22cp.js";
+import { m as tableFor } from "./verify-jHrbmn-E.js";
 //#region src/cli/rls/custom-role-rebuild.ts
 const PREFIX = "PermDock CLI";
 /** A column of the roles-table row `r`. */

package/dist/{tables-BqrxBCir.js → tables-DimBcVWY.js}

@@ -8,8 +8,8 @@ import { a as delegatedScopeMap } from "./permdock-BvjivVb9.js";
 import { i as configError } from "./errors-Vpu6rKHl.js";
 import { d as sqlTextArray, i as qualifySqlTable, t as SQL_IDENT } from "./sql-0WjxIp9g.js";
 import { a as scopeMembershipTable, d as restrictedRowsSql, i as scopeColumn, l as relationArmSql } from "./compile-EzEMB-7v.js";
-import { d as keptKeys, l as roleColumn, u as roleManifest } from "./sources-CMAM-2A3.js";
-import { A as quoteQualified, D as qualified, E as helperSchema, I as scopeTypeOf, O as quoteIdent, R as tenantTypeOf, _ as subjectClaimJsonSql, d as keyTenantSql, f as kindFilterSql, h as roleKindSql, i as allowEntry, j as quoteTable, k as quoteLiteral, m as memberVia, n as GLOBAL_ROLES, o as rootName, r as HELPERS, s as signedIn, t as CUSTOM_ROLES, u as globalKindFilterSql, v as subjectClaimSql, w as CLI, x as userIdHelperSql, y as subjectIdSql } from "./shared-Afctg7B0.js";
+import { d as keptKeys, l as roleColumn, u as roleManifest } from "./sources-C4vkzZJV.js";
+import { A as quoteQualified, D as qualified, E as helperSchema, I as scopeTypeOf, O as quoteIdent, R as tenantTypeOf, _ as subjectClaimJsonSql, d as keyTenantSql, f as kindFilterSql, h as roleKindSql, i as allowEntry, j as quoteTable, k as quoteLiteral, m as memberVia, n as GLOBAL_ROLES, o as rootName, r as HELPERS, s as signedIn, t as CUSTOM_ROLES, u as globalKindFilterSql, v as subjectClaimSql, w as CLI, x as userIdHelperSql, y as subjectIdSql } from "./shared-DrGLwM3s.js";
 //#region src/cli/sql/active.ts
 function checkActiveRow(label, row) {
 	quoteTable(row.table);

package/dist/testing/fixtures/index.d.ts

@@ -1,5 +1,5 @@
 import { a as CatalogDocument } from "../../types-ZzRGoViD.js";
-import { i as SupabaseManifest } from "../../manifest-CzzWtnAb.js";
+import { i as SupabaseManifest } from "../../manifest-B5yF3CIq.js";
 //#region src/testing/fixtures/index.d.ts
 /**
  * The `permissions.catalog.json` of `apps/examples/next-better-supabase`, a

package/dist/testing/fixtures/index.js

@@ -1,12 +1,12 @@
-import { n as parseSupabaseManifest } from "../../manifest-wg8WkkpD.js";
+import { n as parseSupabaseManifest } from "../../manifest-BXTbHNIV.js";
 import { t as parseCatalog } from "../../parse-1_ZheTW5.js";
 //#region src/testing/fixtures/better-supabase.catalog.json
 var better_supabase_catalog_default = {
 	$schema: "https://permdock.com/schemas/catalog-v1.json",
 	version: 1,
-	generatedAt: "2026-10-21T18:26:20.894Z",
-	generator: "permdock@0.7.0",
-	fingerprint: "sha-256:2VY9uDRP6NWXTNcU989MMBZa3-z22VbDWKWkvnXaTFc",
+	generatedAt: "2026-10-25T13:10:40.583Z",
+	generator: "permdock@0.9.0",
+	fingerprint: "sha-256:vWJUJuM8Qg6Cd8ozHqIOkaPdpE4p6cxof-Hypzwe3tg",
 	resources: {
 		"staff": {
 			"id": "id",
@@ -115,29 +115,29 @@ var better_supabase_catalog_default = {
 	},
 	permissions: [
 		{
-			"key": "audit.revert",
-			"scope": "audit:revert",
+			"key": "audit.read",
+			"scope": "audit:read",
 			"resource": "audit",
-			"action": "revert",
+			"action": "read",
 			"arity": "collection",
 			"meta": {},
 			"usages": [{
 				"file": "src/policy.ts",
-				"line": 29,
+				"line": 28,
 				"call": "reference"
 			}],
 			"rowConditions": false
 		},
 		{
-			"key": "audit.view",
-			"scope": "audit:view",
+			"key": "audit.revert",
+			"scope": "audit:revert",
 			"resource": "audit",
-			"action": "view",
+			"action": "revert",
 			"arity": "collection",
 			"meta": {},
 			"usages": [{
 				"file": "src/policy.ts",
-				"line": 28,
+				"line": 29,
 				"call": "reference"
 			}],
 			"rowConditions": false
@@ -334,7 +334,7 @@ var better_supabase_catalog_default = {
 	],
 	grants: [
 		{
-			"permission": "audit.revert",
+			"permission": "audit.read",
 			"effect": "allow",
 			"role": "owner",
 			"to": {
@@ -345,7 +345,7 @@ var better_supabase_catalog_default = {
 			"scope": "organization"
 		},
 		{
-			"permission": "audit.view",
+			"permission": "audit.revert",
 			"effect": "allow",
 			"role": "owner",
 			"to": {
@@ -512,6 +512,7 @@ var better_supabase_manifest_default = {
 		"schema": "permdock",
 		"function": "custom_access_token_hook",
 		"out": "supabase/schemas/permdock/functions/custom_access_token_hook.sql",
+		"activeFrom": { "appMetadata": "active_organization" },
 		"schemas": "pg-delta"
 	},
 	helpers: {
@@ -580,15 +581,14 @@ var better_supabase_manifest_default = {
 		"args": "p_users uuid[]"
 	},
 	memberships: [{
-		"table": "public.memberships",
+		"table": "public.organization_memberships",
 		"user": { "column": "user_id" },
-		"scope": { "column": "scope" },
-		"id": { "column": "scope_id" },
+		"scope": { "value": "organization" },
+		"id": { "column": "organization_id" },
 		"role": { "column": "role" },
 		"columns": [
 			"user_id",
-			"scope",
-			"scope_id",
+			"organization_id",
 			"role"
 		]
 	}, {
@@ -722,15 +722,14 @@ var better_supabase_manifest_default = {
 			}
 		],
 		"memberships": [{
-			"table": "public.memberships",
+			"table": "public.organization_memberships",
 			"user": { "column": "user_id" },
-			"scope": { "column": "scope" },
-			"id": { "column": "scope_id" },
+			"scope": { "value": "organization" },
+			"id": { "column": "organization_id" },
 			"role": { "column": "role" },
 			"columns": [
 				"user_id",
-				"scope",
-				"scope_id",
+				"organization_id",
 				"role"
 			]
 		}, {
@@ -758,10 +757,9 @@ var better_supabase_manifest_default = {
 		"public.contacts.customer_id",
 		"public.contacts.organization_id",
 		"public.contacts.user_id",
-		"public.memberships.role",
-		"public.memberships.scope",
-		"public.memberships.scope_id",
-		"public.memberships.user_id"
+		"public.organization_memberships.organization_id",
+		"public.organization_memberships.role",
+		"public.organization_memberships.user_id"
 	],
 	markers: {
 		"hook": "v1",

package/dist/testing/index.d.ts

@@ -1,7 +1,7 @@
 import { G as CustomRoleSource, J as DecisionSink, T as Policy, U as CredentialVerifier, Y as EntitlementSource, Zt as Snapshot, bt as WhereCompiler, ct as SnapshotSource, dt as SubjectResolver, et as LimitStore, fr as Membership, hr as Subject, ht as TokenVerifier, mt as TokenSigner, nt as MembershipSource, ot as RelationSource, pr as Principal, q as DecisionProvider, sn as DeliveryChannel, st as SettingsSource } from "../policy-types-DGIO_gxq.js";
 import { g as ResourceInit, l as InferPermissionTree, u as Permission } from "../permission-types-CAY-GU7e.js";
 import { r as Role } from "../vocabulary-DEJ5j4mR.js";
-import { Ut as VersionCache, st as LegacyCheck } from "../index-vYjMrXyK.js";
+import { st as LegacyCheck } from "../index-Cay5-Kvx.js";
 import { D as ApprovalPolicySource, _ as PrincipalSource, a as PermDock, b as Limits, h as PrincipalIdentity } from "../permdock-CprAPN3w.js";
 import { s as PolicySource } from "../hosted-DVxlLZMe.js";
 import { a as ApprovalDelegationSource, m as ApprovalStore } from "../types-DLvhVm1r.js";
@@ -11,10 +11,11 @@ import { c as AccessReviewStore } from "../types-B2efzoSX.js";
 import { R as IdempotencyStore } from "../index-DJwEgYzA.js";
 import { n as RevocationFeed } from "../revocations-BaUXHM1N.js";
 import { s as SupportSessionSource } from "../index-CV-7DWeD.js";
+import { r as SupabaseHookManifest } from "../manifest-B5yF3CIq.js";
+import { n as VersionCache } from "../version-cache-Df11C2Qp.js";
+import { t as supabaseMembershipsBudget } from "../budget-hYsPz_yE.js";
 import { a as AutomationSource, t as Automation } from "../automation-C6Jg75xq.js";
 import { c as DeliveryTransport, g as TransportMessages } from "../types-CN0LsqbK.js";
-import { r as SupabaseHookManifest } from "../manifest-CzzWtnAb.js";
-import { t as supabaseMembershipsBudget } from "../budget-hYsPz_yE.js";
 import { t as CloudApproverOptions } from "../types-BB-zWDcR.js";
 import { n as ApprovalWaiter } from "../waiter-CqUKX6CY.js";
 import { g as SetQueue, l as ReplayStore } from "../types-DsHGPtkR.js";

package/dist/testing/index.js

@@ -34,7 +34,7 @@ import { l as sha256Hex, n as scimHandler, t as directoryMembershipSource } from
 import { c as quoteSqlTable, o as quoteSqlIdent } from "../sql-0WjxIp9g.js";
 import { i as cloudEndpoints, n as cloud, s as approverHeaders, t as bearerChallenge } from "../challenge-DImNcR7B.js";
 import { t as supabaseMembershipsBudget } from "../budget-BELja5A9.js";
-import { t as supabaseManifestSchema } from "../manifest-schema-2r37XRhD.js";
+import { t as supabaseManifestSchema } from "../manifest-schema-DQkBK2Mr.js";
 import { t as PUSHED_POLICY_SCHEMA } from "../pushed-policy-CDuOL2de.js";
 import { i as policyMatrixLayout, n as testRlsParity, r as policyMatrix, t as testOrmParity } from "../core-DzVINFbU.js";
 import { i as saasPermissions } from "../permissions-CYcHj_w7.js";
@@ -6302,7 +6302,8 @@ const supabaseHookManifestFixture = {
 	hook: {
 		schema: "permdock",
 		function: "custom_access_token_hook",
-		out: "supabase/permdock-hook.sql"
+		out: "supabase/permdock-hook.sql",
+		activeFrom: { appMetadata: "active_tenant" }
 	},
 	helpers: {
 		schema: "permdock",

package/dist/{types-CzOeVvcC.d.ts → types-Cklw5hJo.d.ts}

@@ -1,5 +1,4 @@
-import { n as RoleMap, r as RoleThrough } from "./types-BMVDHvI0.js";
-import { s as SqlMembershipSource } from "./sources-CWG32C0G.js";
+import { h as RoleThrough, m as RoleMap, s as SqlMembershipSource } from "./sources-oB1Hg1Fm.js";
 //#region src/cli/core/errors.d.ts
 /**
  * 0 success, 1 failure, 2 usage, 3 action required, 130 interrupted (SIGINT or
@@ -935,6 +934,28 @@ type PowerSyncConfig = {
    * `localSnapshot` and `powerSyncSource`; none by default.
    */
   readonly manifest?: string;
+  /**
+   * Tables that are not resources, by `schema.table`, each synced as its own
+   * stream: the user's own rows, the rows that point at a resource row the user
+   * reads, or both.
+   */
+  readonly tables?: Readonly<Record<string, PowerSyncTable>>;
+};
+type PowerSyncTable = {
+  /** The user id column: the stream holds the rows whose column is the user. */
+  readonly user?: string;
+  /** The resources a row points at; the stream holds rows of any of them. */
+  readonly follow?: readonly PowerSyncFollow[];
+};
+/**
+ * A row points at a `resource` row through `field`, which holds its id; `match`
+ * keeps the rows whose columns equal the given values, for a table whose rows
+ * point at several resources.
+ */
+type PowerSyncFollow = {
+  readonly resource: string;
+  readonly field: string;
+  readonly match?: Readonly<Record<string, string>>;
 };
 type CliIo = {
   readonly stdout: (text: string) => void;

package/dist/unplugin/index.d.ts

@@ -1,4 +1,4 @@
-import { s as PermDockPluginOptions } from "../types-CzOeVvcC.js";
+import { s as PermDockPluginOptions } from "../types-Cklw5hJo.js";
 import { createUnplugin } from "unplugin";
 //#region src/unplugin/index.d.ts
 type CreateUnplugin = typeof createUnplugin<PermDockPluginOptions | undefined>;

package/dist/unplugin/index.js

@@ -1,4 +1,4 @@
-import { n as createCollectScheduler, r as report } from "../watch-BFDKqmUa.js";
+import { n as createCollectScheduler, r as report } from "../watch-Bpci3hBY.js";
 import { r as peerHint } from "../peer-Q0fuZ6hx.js";
 import { createRequire } from "node:module";
 //#region src/unplugin/index.ts

package/dist/{usage-CBzgwfIs.js → usage-B1ZJOUdr.js}

@@ -16,7 +16,7 @@ const usage = defineLeaf({
 		}
 	},
 	async run(ctx, { flags }) {
-		return (await import("./usage-0hjZPIRX.js")).runUsage({
+		return (await import("./usage-weohzv2f.js")).runUsage({
 			cwd: ctx.cwd,
 			config: ctx.config,
 			ignore: flags.ignore,

package/dist/{usage-B9EtHWLa.js → usage-t_nXnwCW.js}

@@ -6,8 +6,8 @@ import { c as jsonSchemaOf } from "./catalog-doc-DjMKzJp9.js";
 import { a as loadModule, n as asPolicy, s as pickNamed } from "./load-DjSU5KXO.js";
 import { r as runCollect } from "./collect-WCl8cJQV.js";
 import { t as beforeFirst } from "./text-BMFRfBqc.js";
-import { t as DOCS_BASE } from "./manifest-B2QPh19C.js";
-import { r as findingOf } from "./output-DV5dwOTs.js";
+import { t as DOCS_BASE } from "./manifest-B4ENCp2I.js";
+import { r as findingOf } from "./output-LsbLe41I.js";
 import { existsSync, readFileSync, realpathSync } from "node:fs";
 import { dirname, resolve } from "node:path";
 import { fileURLToPath, pathToFileURL } from "node:url";

package/dist/usage-weohzv2f.js

@@ -0,0 +1 @@
+export { t as runUsage } from "./usage-t_nXnwCW.js";

package/dist/{verify-DlUcTDBz.js → verify-jHrbmn-E.js}

@@ -20,16 +20,16 @@ import { o as loadPolicyAt } from "./load-DjSU5KXO.js";
 import { i as qualifySqlTable, n as defaultSqlCommand, t as SQL_IDENT } from "./sql-0WjxIp9g.js";
 import { a as scopeMembershipTable, i as scopeColumn } from "./compile-EzEMB-7v.js";
 import "./budget-BELja5A9.js";
-import "./sources-CMAM-2A3.js";
+import "./sources-C4vkzZJV.js";
 import { t as beforeFirst } from "./text-BMFRfBqc.js";
-import { t as DOCS_BASE } from "./manifest-B2QPh19C.js";
+import { t as DOCS_BASE } from "./manifest-B4ENCp2I.js";
 import { n as fixtureSubject, r as loadFixtures, t as fixtureRow } from "./fixtures-A1_sp_tR.js";
-import { A as quoteQualified, N as arrayColumnsOf, O as quoteIdent, P as columnTypesOf, _ as subjectClaimJsonSql, a as customRolesOn, j as quoteTable, k as quoteLiteral, r as HELPERS, v as subjectClaimSql } from "./shared-Afctg7B0.js";
-import { C as accessSql, D as tokenScopeAllowsCall, S as requiresSql, ht as scopeTable, k as capabilityAccessSql, n as tableNameOf, o as graphPlan, q as apiKeyAllowsCall, r as tableNames } from "./tables-BqrxBCir.js";
-import { c as breakGlassKey, f as compileConditionSql, l as collectGrants, m as sqlFunctionNames, p as contextRefs, s as breakGlassHolder } from "./ownership-DA5YdYTm.js";
+import { A as quoteQualified, N as arrayColumnsOf, O as quoteIdent, P as columnTypesOf, _ as subjectClaimJsonSql, a as customRolesOn, j as quoteTable, k as quoteLiteral, r as HELPERS, v as subjectClaimSql } from "./shared-DrGLwM3s.js";
+import { C as accessSql, D as tokenScopeAllowsCall, S as requiresSql, ht as scopeTable, k as capabilityAccessSql, n as tableNameOf, o as graphPlan, q as apiKeyAllowsCall, r as tableNames } from "./tables-DimBcVWY.js";
+import { c as breakGlassKey, f as compileConditionSql, l as collectGrants, m as sqlFunctionNames, p as contextRefs, s as breakGlassHolder } from "./ownership-qqBuGJXr.js";
 import { t as membershipSourcesOf } from "./sources-qoIJQrJv.js";
 import { n as pgConnector, t as connectPgPool } from "./pg-DQTqRrou.js";
-import { _ as wrapSql, g as validitySql, m as andSql, s as viewName, t as FIELD_VIEWS } from "./fields-D0vUI6dq.js";
+import { _ as wrapSql, g as validitySql, m as andSql, s as viewName, t as FIELD_VIEWS } from "./fields-DI8s3cPl.js";
 import { resolve } from "node:path";
 import { createHash, randomUUID } from "node:crypto";
 //#region src/cli/rls/indexes.ts