permdock 0.9.0 → 0.10.0

package/dist/version-cache-Df11C2Qp.d.ts

@@ -0,0 +1,51 @@
+import { Wt as Instant, yt as VersionQuery } from "./policy-types-DGIO_gxq.js";
+//#region src/core/version-cache.d.ts
+type VersionCacheStats = {
+  /** Version reads the cache started. */
+  readonly reads: number;
+  /** Calls answered by a read already in flight. */
+  readonly shared: number;
+  /** Calls answered from an entry or a token claim, with no read. */
+  readonly hits: number;
+  readonly evictions: number;
+  readonly size: number;
+};
+/**
+ * Current authorization versions shared by every instance in a process:
+ * `claimsFirst(source, { versions })` reads through it.
+ */
+type VersionCache = {
+  readonly name?: string;
+  /** How old an entry may be when an instance with intent `read` uses it. */
+  readonly maxStaleMs: number;
+  /**
+   * The current version of `principal`. With `live: false`, an entry at most
+   * `maxStaleMs` old answers, a read in flight is shared, and a token claim
+   * newer than the entry raises it; with `live: true`, `read` runs.
+   */
+  current: (principal: VersionQuery, read: () => number | undefined | Promise<number | undefined>, options: {
+    readonly live: boolean;
+  }) => number | undefined | Promise<number | undefined>;
+  /** Drops `principal`'s entry, so the next instance reads the version. */
+  evict: (principal: string) => void;
+  stats: () => VersionCacheStats;
+};
+type MemoryVersionCacheOptions = {
+  /**
+   * How stale a read may be, in milliseconds: the entry lifetime and the
+   * longest a removed member keeps read access. Clamped to 0 to 60,000.
+   */
+  readonly maxStaleMs: number;
+  /** Principals kept; the least recently used goes first. Default 10,000. */
+  readonly maxEntries?: number;
+  /** The clock, read only when an instance asks for a version. */
+  readonly now?: () => Instant;
+};
+/**
+ * An in-process `VersionCache`: a bounded LRU keyed by principal id that keeps
+ * resolved versions and shares reads in flight. Create it once at module
+ * scope.
+ */
+declare function memoryVersionCache(options: MemoryVersionCacheOptions): VersionCache;
+//#endregion
+export { memoryVersionCache as i, VersionCache as n, VersionCacheStats as r, MemoryVersionCacheOptions as t };

package/dist/{watch-BFDKqmUa.js → watch-Bpci3hBY.js}

@@ -2,7 +2,7 @@ import { i as dateAt } from "./time-nR1JesoH.js";
 import { a as describeError } from "./errors-Vpu6rKHl.js";
 import { t as defaultSrcPath } from "./files-BSjrtIHw.js";
 import { r as runCollect } from "./collect-WCl8cJQV.js";
-import { n as isConfigFile, r as loadConfig } from "./config-BwPBfN0t.js";
+import { n as isConfigFile, r as loadConfig } from "./config-BR23fL8m.js";
 import { watch } from "node:fs";
 import { basename, dirname, relative, resolve, sep } from "node:path";
 //#region src/cli/watch.ts

package/dist/watch-COuvly20.js

@@ -0,0 +1 @@
+export { i as watchCollect } from "./watch-Bpci3hBY.js";

package/dist/workflow/index.d.ts

@@ -1,5 +1,5 @@
 import { a as AutomationSource, i as AutomationRequest, l as memoryAutomationSource, n as AutomationDecision, r as AutomationMode, s as MemoryAutomationSource, t as Automation, u as parseAutomation } from "../automation-C6Jg75xq.js";
 import { i as pollingApprovalWaiter, n as ApprovalWaiter, r as PollingApprovalWaiterOptions, t as ApprovalWaitOptions } from "../waiter-CqUKX6CY.js";
-import { a as WorkflowPermDockOptions, i as WorkflowPermDock, n as AwaitApprovalOptions, o as createPermDock, r as StartAutomationResult, t as AutomationOptions } from "../create-BamXmeob.js";
+import { a as WorkflowPermDockOptions, i as WorkflowPermDock, n as AwaitApprovalOptions, o as createPermDock, r as StartAutomationResult, t as AutomationOptions } from "../create-CDd9c22W.js";
 import "../index-CaxrMD1A.js";
 export { type ApprovalWaitOptions, type ApprovalWaiter, type Automation, type AutomationDecision, type AutomationMode, type AutomationOptions, type AutomationRequest, type AutomationSource, type AwaitApprovalOptions, type MemoryAutomationSource, type PollingApprovalWaiterOptions, type StartAutomationResult, type WorkflowPermDock, type WorkflowPermDockOptions, createPermDock, memoryAutomationSource, parseAutomation, pollingApprovalWaiter };

package/dist/workflow/index.js

@@ -1,12 +1,13 @@
 import { t as compact } from "../compact-CAf557ZB.js";
 import { n as freezeDeep } from "../freeze-jjan0lCv.js";
+import { a as isId } from "../expiry-6XByK0dm.js";
 import { n as findPermission } from "../permission-registry-B8tYxPIt.js";
 import { n as isThenable } from "../thenable-BNSM1U2R.js";
 import { n as memoryAutomationSource, r as parseAutomation } from "../automation-x3KEUusw.js";
 import { l as withApp, t as getPermDock } from "../permdock-BvjivVb9.js";
 import { o as automationEvent } from "../sink-D9_vh372.js";
 import { a as requestApproval, s as resumeDecision } from "../helpers-DJicaG6f.js";
-import { i as subjectFromRunTicket, r as signRunTicket } from "../run-ticket-Dv7aF7Dk.js";
+import { i as subjectFromRunTicket, r as signRunTicket } from "../run-ticket-DfnZCh-u.js";
 import { t as pollingApprovalWaiter } from "../waiter-aBLM63_f.js";
 //#region src/workflow/create.ts
 function writeQuietly(sink, event) {
@@ -121,12 +122,22 @@ function createPermDock(policy, given) {
 				}]
 			});
 		}
+		const { resource } = startOptions;
+		if (resource !== void 0 && !(isId(resource.type) && isId(resource.id))) return deniedStart("validation", { cause: "resource-invalid" });
 		const scopes = [];
+		const bound = [];
 		for (const key of automation.permissions) {
 			const leaf = findPermission(policy.permissions, key);
 			if (leaf === void 0) return deniedStart("validation", { permission: key });
-			scopes.push(leaf.scope);
+			if (resource !== void 0 && leaf.resource === resource.type) bound.push(leaf.action);
+			else scopes.push(leaf.scope);
 		}
+		if (resource !== void 0 && bound.length === 0) return deniedStart("validation", { resource: resource.type });
+		const authorizationDetails = resource === void 0 ? void 0 : [{
+			type: resource.type,
+			identifier: resource.id,
+			actions: bound
+		}];
 		const runId = startOptions.id ?? globalThis.crypto.randomUUID();
 		const runAutomation = {
 			id: automation.id,
@@ -139,11 +150,15 @@ function createPermDock(policy, given) {
 				id: automation.id,
 				kind: "automation"
 			},
-			delegation: { scopes },
+			delegation: compact({
+				scopes,
+				authorizationDetails
+			}),
 			automation: runAutomation,
 			tenant: automation.tenant,
 			trigger: startOptions.trigger,
 			binding: startOptions.binding,
+			resource,
 			id: runId,
 			expiresIn
 		}), signer, compact({
@@ -158,10 +173,11 @@ function createPermDock(policy, given) {
 		return freezeDeep({
 			outcome: "started",
 			ticket: signed,
-			run: {
+			run: compact({
 				id: runId,
-				automation: runAutomation
-			}
+				automation: runAutomation,
+				resource
+			})
 		});
 	};
 	const opened = async (ticket, permission, data, decideOptions) => {

package/dist/workflow-sdk/index.d.ts

@@ -2,7 +2,7 @@ import { Un as Decision } from "../policy-types-DGIO_gxq.js";
 import { u as Permission } from "../permission-types-CAY-GU7e.js";
 import { a as PermDock } from "../permdock-CprAPN3w.js";
 import { n as ApprovalWaiter } from "../waiter-CqUKX6CY.js";
-import { i as WorkflowPermDock, r as StartAutomationResult, t as AutomationOptions } from "../create-BamXmeob.js";
+import { i as WorkflowPermDock, r as StartAutomationResult, t as AutomationOptions } from "../create-CDd9c22W.js";
 //#region src/workflow-sdk/index.d.ts
 /**
  * The part of a Workflow SDK `Hook` the waiter reads: awaiting it suspends the

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "permdock",
-  "version": "0.9.0",
+  "version": "0.10.0",
   "description": "Typed permissions for TypeScript apps, APIs, databases, and AI agents, with the permdock CLI and test runners.",
   "keywords": [
     "ai-agents",
@@ -353,7 +353,7 @@
     "ajv": "8.20.0",
     "astro": "7.4.0",
     "babel-plugin-react-compiler": "1.0.0",
-    "better-supabase": "0.13.0",
+    "better-supabase": "0.18.0",
     "better-supabase-floor": "npm:better-supabase@0.13.0",
     "chat": "4.42.0",
     "diff": "9.0.0",

package/schemas/run-v1.json

@@ -121,6 +121,22 @@
           "maxItems": 64
         }
       }
+    },
+    "resource": {
+      "type": "object",
+      "required": ["type", "id"],
+      "properties": {
+        "type": {
+          "type": "string",
+          "minLength": 1,
+          "maxLength": 256
+        },
+        "id": {
+          "type": "string",
+          "minLength": 1,
+          "maxLength": 256
+        }
+      }
     }
   },
   "anyOf": [

package/schemas/supabase-manifest-v1.json

@@ -43,6 +43,27 @@
             "type": "string",
             "pattern": "^[A-Za-z_][A-Za-z0-9_]*\\.[A-Za-z_][A-Za-z0-9_]*$"
           }
+        },
+        "activeFrom": {
+          "description": "Where the hook reads the active first-scope id (supabase.hook.activeFrom): an app_metadata key, or a column of a table joined on id. Absent from a manifest written before 0.10.",
+          "oneOf": [
+            {
+              "type": "object",
+              "required": ["appMetadata"],
+              "additionalProperties": false,
+              "properties": { "appMetadata": { "type": "string" } }
+            },
+            {
+              "type": "object",
+              "required": ["table", "column", "id"],
+              "additionalProperties": false,
+              "properties": {
+                "table": { "type": "string" },
+                "column": { "type": "string" },
+                "id": { "type": "string" }
+              }
+            }
+          ]
         }
       }
     },
@@ -562,6 +583,13 @@
             },
             "column": {
               "$ref": "#/$defs/identifier"
+            },
+            "on": {
+              "description": "Every referencing column to the column of table it matches, when the reference spans several columns.",
+              "type": "object",
+              "additionalProperties": {
+                "$ref": "#/$defs/identifier"
+              }
             }
           }
         }

package/skills/permdock-agents/references/operations-automations-chat.md

@@ -127,6 +127,7 @@ run.can(permissions.invoice.send, invoice);
 ```
 
 - `start(id, { caller, trigger })` reads the live automation, checks the caller's `run` permission and signs a run ticket (`vnd.permdock.run+jwt`, 24 hours by default). Without `caller`, only server code starts it.
+- `start(id, { resource: { type, id } })` binds the run to one record: its permissions on `type` go into an `authorization_details` entry with `identifier: id`, so they hold on that row only; a type none of its permissions is on denies the start.
 - `getPermDock(ticket)` rebuilds the run on every step. A new version, a revoked automation or a publisher who is gone gives an instance that denies everything.
 - `awaitApproval(ticket, permission, row)` decides, parks on the `waiter` while `approval-required`, then decides again with the token against the publisher's rights as of then.
 - `openApproval(ticket, permission, row)` and `resumeApproval(ticket, permission, token, row)` are the two halves, for runners that wait outside the call. A request still pending denies with reason `approval`.

package/skills/permdock-wire/references/adapters.md

@@ -501,9 +501,9 @@ const subject = subjectFromSupabase(claims, {
 
 Write the claims with `permdock supabase hook generate`; `permdock supabase inspect --out` writes the manifest (helper names, tenant claim, budget, claims written) that `authorizationProvider` from `permdock/better-supabase` turns into better-supabase's `authorization` config. No `@supabase/supabase-js` peer. Pair with `permdock rls generate`, or keep SQL as authority and run `permdock rls verify --db-url-stdin` against `sqlFunction` twins ([database-first](https://permdock.com/docs/adapters/rls)); the generic RLS workflow is in the `permdock-data` skill.
 
-With better-supabase, set `authorization: authorizationProvider({ manifest, catalog })` in `better-supabase.config.ts` (with `rls.customRoles` its `canAssign` and `canAssignFor` call `permdock_can_assign_any` and its `_for` form, so custom roles are assignable through better-supabase; regenerate the manifest after turning custom roles on), pass `authorizer({ policy })` to the server (`createNext`, `createHono`, `createMcp`) so every `permission` a resource, action, route guard or tool declares is decided by PermDock from the verified claims (`operations` maps tables for `permissions: true`; a missing or anonymous claim denies), build bucket and topic `access` policies with `bucketPolicy` and `topicPolicy`, and map its session with `subjectFromBetterSupabase(session)` (all from `permdock/better-supabase`): the active tenant's `features` become `principal.plans`. Pass `plans: { keys }` when better-supabase's `entitlements.claim.keys` shortens feature keys, and `apiKeys: { permissions, manifest }` so an `apiKey` session maps to the key's credential subject instead of the anonymous one. For `createMcp` tools, put the permission in `meta` and spread `toolPolicy({ permdock })` into the options: tools without one are hidden and refused, and approval-required calls are refused because `createMcp` collects no approvals. Wrap a `CredentialProvider` with `credentialGuard(provider, { permdock, use, revoke? })` so PermDock decides each token use. `authorizationProvider({ ..., approver })` lets holders of that permission approve AI tool calls, never their own. `approvers: { 'ai-tool': holder(p), 'support-session': ..., 'invoice.send': ... }` fills `isApprover` through `permdock_is_approver` (needs `rls.approvals`); only `user()`, `holder()` and `anyOf()` approvers, and a kind it does not name has no approver. `accessReviewApplier({ client, reviews, policy, demoteTo?, email?, permdockFor? })` applies a review's revoked items: `update_member_role` to the `demoteTo` role when that role lacks the permission, else `remove_member`, plus `revoke_invitation` for the member's matching invitations, then `markApplied`; pass the reviewer's client so the blocks' own checks run. better-supabase's `createAgentRuntime({ toolApproval })` takes `toolApproval` from `permdock/ai-sdk` as it is. Validate its claims with `betterSupabase.claims(supabaseClaims().extend(appSchema))` (`supabaseClaims` from `permdock/supabase`, any Standard Schema as `appSchema`) instead of a hand-written copy of the claim shape. A `supabase.hook.claims` function that needs the user's organizations calls `<schema>.member_organization_ids_for(user_id)` (generated by `rls generate`, executable by `supabase_auth_admin` only) instead of querying the membership tables itself. With a scope named `team` or `teams`, `authorizationProvider` fills better-supabase's `teamIdsOf` with `<schema>.member_team_ids_of(user)`, which answers only for the caller, so with `blocks.access.model: 'provider'` better-supabase's `team_ids_of()` and team-sharing policies read PermDock's memberships. A token Supabase's OAuth server issued to a third-party app (`client_id`) becomes an `oauth-client` actor limited to its `scope`; `deny(permission, { to: actor('oauth-client') })` keeps such apps out, in the app and, through `rls generate`, in Postgres. A better-supabase support session (`act.kind: 'support'`) is actor kind `support` with `sessionId` and `readOnly`, and `actingAs` (`act.kind: 'impersonation'`) is kind `impersonation`; neither has a delegation, so they reach nothing until a policy delegation names `actor('support')` or `actor('impersonation')`, and `readOnly: true` (also when `read_only` is absent) narrows that to read-only permissions. Generated RLS reads memberships, not `act`, so a support token sent to the Data API writes as the user: add a restrictive `for update` (and `insert` / `delete`) policy per writable table that requires `act ->> 'read_only' = 'false'` when `act` is a support or session level ([support access](https://permdock.com/docs/guides/support-access)). With `rls.anonymousSignIns: 'deny'`, pass `anonymousSignIns: 'deny'` to the subject mapper too (doctor PD057). Check a deployed database against the generated policies with `permdock rls verify --introspect`.
+With better-supabase, set `auth.authorization: authorizationProvider({ manifest, catalog })` in `better-supabase.config.ts` (top-level `authorization` before 0.15) (with `rls.customRoles` its `canAssign` and `canAssignFor` call `permdock_can_assign_any` and its `_for` form, so custom roles are assignable through better-supabase; regenerate the manifest after turning custom roles on), pass `authorizer({ policy })` to the server (`createNext`, `createHono`, `createMcp`) so every `permission` a resource, action, route guard or tool declares is decided by PermDock from the verified claims (`operations` maps tables for `permissions: true`; a missing or anonymous claim denies), build bucket and topic `access` policies with `bucketPolicy` and `topicPolicy`, and map its session with `subjectFromBetterSupabase(session)` (all from `permdock/better-supabase`): the active tenant's `features` become `principal.plans`. Pass `plans: { keys }` when better-supabase's `entitlements.claim.keys` shortens feature keys, and `apiKeys: { permissions, manifest }` so an `apiKey` session maps to the key's credential subject instead of the anonymous one. For `createMcp` tools, put the permission in `meta` and spread `toolPolicy({ permdock })` into the options: tools without one are hidden and refused, and approval-required calls are refused because `createMcp` collects no approvals. Wrap a `CredentialProvider` with `credentialGuard(provider, { permdock, use, revoke? })` so PermDock decides each token use. `authorizationProvider({ ..., approver })` lets holders of that permission approve AI tool calls, never their own. `approvers: { 'ai-tool': holder(p), 'support-session': ..., 'invoice.send': ... }` fills `isApprover` through `permdock_is_approver` (needs `rls.approvals`); only `user()`, `holder()` and `anyOf()` approvers, and a kind it does not name has no approver. `accessReviewApplier({ client, reviews, policy, demoteTo?, email?, permdockFor? })` applies a review's revoked items: `update_member_role` to the `demoteTo` role when that role lacks the permission, else `remove_member`, plus `revoke_invitation` for the member's matching invitations, then `markApplied`; pass the reviewer's client so the blocks' own checks run. better-supabase's `createAgentRuntime({ toolApproval })` takes `toolApproval` from `permdock/ai-sdk` as it is. Validate its claims with `betterSupabase.claims(supabaseClaims().extend(appSchema))` (`supabaseClaims` from `permdock/supabase`, any Standard Schema as `appSchema`) instead of a hand-written copy of the claim shape. A `supabase.hook.claims` function that needs the user's organizations calls `<schema>.member_organization_ids_for(user_id)` (generated by `rls generate`, executable by `supabase_auth_admin` only) instead of querying the membership tables itself. With a scope named `team` or `teams`, `authorizationProvider` fills better-supabase's `teamIdsOf` with `<schema>.member_team_ids_of(user)`, which answers only for the caller, so with `blocks.permissions.model: 'provider'` (`blocks.access` before 0.15) better-supabase's `team_ids_of()` and team-sharing policies read PermDock's memberships. A token Supabase's OAuth server issued to a third-party app (`client_id`) becomes an `oauth-client` actor limited to its `scope`; `deny(permission, { to: actor('oauth-client') })` keeps such apps out, in the app and, through `rls generate`, in Postgres. A better-supabase support session (`act.kind: 'support'`) is actor kind `support` with `sessionId` and `readOnly`, and `actingAs` (`act.kind: 'impersonation'`) is kind `impersonation`; neither has a delegation, so they reach nothing until a policy delegation names `actor('support')` or `actor('impersonation')`, and `readOnly: true` (also when `read_only` is absent) narrows that to read-only permissions. Generated RLS reads memberships, not `act`, so a support token sent to the Data API writes as the user: add a restrictive `for update` (and `insert` / `delete`) policy per writable table that requires `act ->> 'read_only' = 'false'` when `act` is a support or session level ([support access](https://permdock.com/docs/guides/support-access)). With `rls.anonymousSignIns: 'deny'`, pass `anonymousSignIns: 'deny'` to the subject mapper too (doctor PD057). Check a deployed database against the generated policies with `permdock rls verify --introspect`.
 
-The other better-supabase slots, all from `permdock/better-supabase` ([better-supabase](https://permdock.com/docs/adapters/better-supabase)): `hookCan(permdock)` and `handlerCan({ getPermDock })` are the `can` options of `authorizeHook` and `protectWebHandler` in `better-supabase/workflow-sdk`; they decide with no row, so a permission with a row condition denies there and is checked inside the handler, and `handlerCan` answers `undefined` (401) without a signed-in principal. `supportPolicy({ policy, options?, writable?, approval?, approved? })` is the `authorize` option of `supportSessions`; it decides each start with `decideSupportSession` as the admin, and an `approval-required` start passes only once `approved(input, pending)` returns `{ approvedBy }` for an approver other than the admin. `subscriberPolicy({ policy, principals, events, row?, sender? })` filters outbox, webhook or realtime subscribers to those who may read the event (exact type, then the longest `prefix.*`, then `*`; a type with no entry reaches no one). `principalSource({ claims, identities? })` is a `PrincipalSource` over the claims better-supabase mints, for `decideFor`, `subscribersFor` and delivery; only links the app created through a signed-in flow or a verified address go in `identities`. `authorizationHooks({ policy, claims, service?, principals?, events?, approvers?, support?, tickets? })` is the `authorization` option of `createServer`: it answers automation publish and run-as, delegated OAuth scopes, `approverOf`, identities, delivery audiences, support sessions and run tickets from the claims better-supabase mints now, never from the request.
+The other better-supabase slots, all from `permdock/better-supabase` ([better-supabase](https://permdock.com/docs/adapters/better-supabase)): `hookCan(permdock)` and `handlerCan({ getPermDock })` are the `can` options of `authorizeHook` and `protectWebHandler` in `better-supabase/workflow-sdk`; they decide with no row unless the `data` option loads one (`hookCan(permdock, { data: (tenant, key) => row })`, `handlerCan(source, { data: (request, key) => row })`), so without it a permission with a row condition denies, and `handlerCan` answers `undefined` (401) without a signed-in principal. `supportPolicy({ policy, options?, writable?, approval?, approved? })` is the `authorize` option of `supportSessions`; it decides each start with `decideSupportSession` as the admin, and an `approval-required` start passes only once `approved(input, pending)` returns `{ approvedBy }` for an approver other than the admin. `subscriberPolicy({ policy, principals, events, row?, sender? })` filters outbox, webhook or realtime subscribers to those who may read the event (exact type, then the longest `prefix.*`, then `*`; a type with no entry reaches no one). `principalSource({ claims, identities? })` is a `PrincipalSource` over the claims better-supabase mints, for `decideFor`, `subscribersFor` and delivery; only links the app created through a signed-in flow or a verified address go in `identities`. `authorizationHooks({ policy, claims, service?, principals?, events?, approvers?, support?, tickets? })` is the `authorization` option of `createServer`: it answers automation publish and run-as, delegated OAuth scopes, `approverOf`, identities, delivery audiences, support sessions and run tickets from the claims better-supabase mints now, never from the request.
 
 `claims` is whatever Supabase verified: `data.claims` from `supabase.auth.getClaims()` on an `@supabase/ssr` server client, or `jwtClaims` from `@supabase/server` (`ctx.jwtClaims` in `withSupabase` or a `pipeline`, and `c.var.jwtClaims` after a framework bridge such as `toHono([withClaims(), withPermDock()])`). `@supabase/server/adapters/*` and `c.var.supabaseContext` are deprecated and removed on 1 December 2026; do not write new code against them ([Hono, H3, Elysia and NestJS](https://permdock.com/docs/adapters/supabase#hono-h3-elysia-and-nestjs)). Pass `null` for anonymous callers; never `getSession().access_token` (unverified). An API-key auth mode (`secret`, `publishable`) has `jwtClaims: null` and is the anonymous subject, not a user.
 

package/dist/powersync-B701tvhE.js

@@ -1 +0,0 @@
-export { n as runPowerSync } from "./powersync-CJrT1DSc.js";

package/dist/pull-C3EEGzSw.js

@@ -1 +0,0 @@
-export { n as runCloudPull } from "./pull-2nJr0qg_.js";

package/dist/run-Ck22anC2.js

@@ -1 +0,0 @@
-export { t as run } from "./run-PbRlXTfh.js";

package/dist/sources-CWG32C0G.d.ts

@@ -1,312 +0,0 @@
-import { nt as MembershipSource } from "./policy-types-DGIO_gxq.js";
-import { n as RoleMap, r as RoleThrough, x as SupabaseSuspension } from "./types-BMVDHvI0.js";
-import { t as SqlQuery } from "./sql-B80DFdpG.js";
-import { c as SupabaseManifestMembership } from "./manifest-CzzWtnAb.js";
-//#region src/supabase/roles.d.ts
-/** A roles table a role column references, by `schema.table`. */
-type RoleKeys = {
-  readonly table: string;
-  /** The roles table column the reference points at. */
-  readonly id: string;
-  /** The roles table column holding the role key. */
-  readonly key: string;
-  /** The referencing table's column. */
-  readonly ref: string;
-};
-/**
- * One role source of a membership row: a key column, or a reference to a roles
- * table.
- */
-type RoleSource = string | RoleThrough | RoleMap;
-/** A role source, or several the row holds at once. */
-type RoleSpec = RoleSource | readonly RoleSource[];
-/**
- * A roles table whose tenant rows are written by tenants. A role key read
- * through it from a tenant row that is one of `declared` reads as null, so a
- * tenant cannot claim the grants of a declared role by naming a role after it.
- */
-type RoleGuard = {
-  /** `schema.table`, or `public`. */
-  readonly table: string;
-  /** The tenant column of the roles table. */
-  readonly tenant: string;
-  /**
-   * A tenant row with this column true is the application's own copy of a
-   * declared role.
-   */
-  readonly skip?: string | undefined;
-  readonly declared: readonly string[];
-};
-//#endregion
-//#region src/supabase/sources.d.ts
-type Common = {
-  readonly table: string;
-  /**
-   * Runs the lookups; without it the source only describes SQL (for `permdock
-   * supabase hook generate`).
-   */
-  readonly query?: SqlQuery;
-  /**
-   * Drop suspended users and memberships under suspended instances, like
-   * `rls.suspension`.
-   */
-  readonly suspension?: SupabaseSuspension;
-};
-type MembershipTableOptions = Common & {
-  /**
-   * Column names; `user`, `scope`, `id` and `role` default to `user_id`,
-   * `scope`, `scope_id`, `role`.
-   */
-  readonly columns?: {
-    /** The user id column, or a reference to a table that holds the user id. */
-    readonly user?: string | RoleThrough;
-    readonly scope?: string;
-    readonly id?: string;
-    /** A `jsonb` column of ancestor ids keyed by scope name. */
-    readonly within?: string;
-    /**
-     * The role key column, a reference to a roles table that holds the key, or
-     * several of them: the row holds every non-null key.
-     */
-    readonly role?: RoleSpec;
-    readonly via?: string;
-    readonly expiresAt?: string;
-    readonly disabledAt?: string;
-    /** The principal id that wrote the membership (`grantedBy`). */
-    readonly grantedBy?: string;
-    /** Free-text justification recorded on the membership (`reason`). */
-    readonly reason?: string;
-    /** A subgroup column filling `member.group`. */
-    readonly group?: string;
-    /**
-     * A text column; the value `idp` marks the row as owned by the identity
-     * provider.
-     */
-    readonly managedBy?: string;
-    /** A `text[]` column of seats. */
-    readonly seats?: string;
-    /** A `jsonb` column of app data (`Membership.x`); never written into claims. */
-    readonly x?: string;
-  };
-};
-type MembershipJunctionOptions = Common & {
-  /** The declared scope every row is a membership of. */
-  readonly scope: string;
-  /**
-   * The user id column (default `user_id`), or a reference to a table that
-   * holds the user id.
-   */
-  readonly user?: string | RoleThrough;
-  /** The column holding the scope instance id. Default `<scope>_id`. */
-  readonly id?: string;
-  /** Ancestor id columns keyed by scope name. */
-  readonly within?: Readonly<Record<string, string>>;
-  /**
-   * A role column, a reference to a roles table that holds the key, fixed roles
-   * every row holds (a contact table with no role column), or `{ sources }`:
-   * several role columns whose non-null keys the row holds.
-   */
-  readonly roles: string | RoleThrough | RoleMap | readonly string[] | {
-    readonly sources: readonly RoleSource[];
-  };
-  /** The membership kind every row has (`contact`, `staff`, `partner`). */
-  readonly via?: string;
-  readonly expiresAt?: string;
-  readonly disabledAt?: string;
-  /** The principal id that wrote the membership (`grantedBy`). */
-  readonly grantedBy?: string;
-  /** Free-text justification recorded on the membership (`reason`). */
-  readonly reason?: string;
-  /** A subgroup filling `member.group`: a fixed name every row has, or a column. */
-  readonly group?: string | {
-    readonly column: string;
-  };
-  /**
-   * `idp` when the identity provider owns every row, or a text column holding
-   * `idp` per row.
-   */
-  readonly managedBy?: "idp" | {
-    readonly column: string;
-  };
-  /** A `text[]` column of seats. */
-  readonly seats?: string;
-  /** A `jsonb` column of app data (`Membership.x`); never written into claims. */
-  readonly x?: string;
-};
-/**
- * What `permdock supabase hook generate` compiles; the same SQL the source
- * runs.
- */
-type MembershipSql = {
-  readonly table: string;
-  /**
-   * The table's user column: the user id, or with `userThrough` the reference
-   * to the row holding it.
-   */
-  readonly user: string;
-  /**
-   * The table that holds the user id when `user` references it; a change of
-   * that id bumps the old and the new user.
-   */
-  readonly userThrough?: RoleKeys;
-  /**
-   * `<table>.<user>%type`: the PL/pgSQL type of the user id column, for a
-   * variable `select` compares with.
-   */
-  readonly userType: string;
-  /**
-   * The `select` of claim rows for one user, with every filter applied. `user`
-   * must have the column's type (a `userType` variable, or an untyped `$1`
-   * Postgres infers): the column is compared uncast so its index applies.
-   * `keep` adds the `keep` column; it defaults to `keeps`, and a `union` with a
-   * source that keeps passes `true`.
-   */
-  select: (user: string, keep?: boolean) => string;
-  /** The `select` of member rows for one scope instance (`$1` scope, `$2` id). */
-  list: (keep?: boolean) => string;
-  /**
-   * A suspended scope on the source keeps permissions: rows of its suspended
-   * instances stay, with a `keep` column.
-   */
-  readonly keeps: boolean;
-  /**
-   * A text column holding `idp` for rows the identity provider owns; `''` when
-   * every row is owned.
-   */
-  readonly managed?: string;
-  /** Other tables the `select` reads (suspension tables). */
-  readonly reads: readonly string[];
-  /**
-   * The roles table the role column references; a key change bumps every
-   * holder's authorization version.
-   */
-  readonly through?: RoleKeys;
-  /** Every roles table the role columns reference, `through` first. */
-  readonly throughs: readonly RoleKeys[];
-  /**
-   * Every column that decides who holds which membership: user, scope, id,
-   * `within`, role, `via` and expiry.
-   */
-  readonly columns: readonly string[];
-  /**
-   * For a single-scope source: its scope and the scopes whose ids each row
-   * carries.
-   */
-  readonly scope?: string;
-  readonly holds?: readonly string[];
-  /** The source's entry in the hook manifest's `memberships`. */
-  readonly manifest: SupabaseManifestMembership;
-  /** What the ownership triggers count; absent on a source that is not a table. */
-  readonly holders?: MembershipHolders;
-  /**
-   * The rows as plain columns, for Sync Streams and `powerSyncSource`; a source
-   * without it does not sync.
-   */
-  readonly stream?: MembershipStream;
-};
-/**
- * One membership source as columns a Sync Streams query can filter on. Tables
- * are `schema.table`; a `through` table is qualified in the source's schema
- * when it names none.
- */
-type MembershipStream = {
-  readonly table: string;
-  /** The user id column, or the reference to the table that holds the user id. */
-  readonly user: string | RoleThrough;
-  /** The scope column, or the scope every row is a membership of. */
-  readonly scope: {
-    readonly column: string;
-  } | {
-    readonly value: string;
-  };
-  readonly id: string;
-  /**
-   * The role sources (the row holds every non-null key), or the fixed roles
-   * every row holds.
-   */
-  readonly roles: RoleSpec | {
-    readonly value: readonly string[];
-  };
-  /** The membership kind column, or the kind every row has. */
-  readonly via?: {
-    readonly column: string;
-  } | {
-    readonly value: string;
-  };
-  readonly expiresAt?: string;
-  readonly disabledAt?: string;
-  /**
-   * A row may hold no role key: such a row is no membership, and a reader drops
-   * it.
-   */
-  readonly nullableRoles: boolean;
-  /**
-   * The guard the source reads its roles table with: a tenant row named like a
-   * declared role is no role.
-   */
-  readonly guard?: RoleGuard;
-};
-/**
- * The rows of a membership table, for the holder-count and transfer-only
- * triggers `permdock rls generate` puts on it. No suspension filter: a
- * suspended holder still holds the role.
- */
-type MembershipHolders = {
-  /**
-   * `<table>.<id column>%type`: the type of a variable `rows` compares the id
-   * column with.
-   */
-  readonly idType: string;
-  /**
-   * The instance id of scope `scope` the PL/pgSQL record `row` holds, as text;
-   * null on a row of another scope.
-   */
-  id: (scope: string, row: string) => string;
-  /**
-   * `select id, user_id, role, via, live` over the rows of scope `scope` in
-   * `from` (default the table): one row per held role key, `live` false once
-   * expired. `id` is an expression of `idType` the id column must equal.
-   */
-  rows: (scope: string, options?: {
-    readonly id?: string;
-    readonly from?: string;
-  }) => string;
-};
-type SqlMembershipSource = MembershipSource & {
-  readonly sql: MembershipSql;
-  /**
-   * The same source with the role keys of tenant rows of `guard.table` named
-   * like a declared role read as null.
-   */
-  readonly guarded?: (guard: RoleGuard) => SqlMembershipSource;
-};
-/** The part of `@supabase/server`'s `PostgresApi` a `SqlQuery` needs. */
-type SupabasePostgres = {
-  readonly queryRaw: (text: string, params?: unknown[]) => Promise<readonly Record<string, unknown>[]>;
-};
-declare function supabasePostgresQuery(postgres: SupabasePostgres): SqlQuery;
-/**
- * Memberships from one table holding every scope: a row per user, scope,
- * instance and role (`user_id, scope, scope_id, role`), with optional `within`,
- * `via`, expiry, owner and seat columns. Rows of the same instance merge into
- * one membership.
- */
-declare function tableMembershipSource(options: MembershipTableOptions): SqlMembershipSource;
-/**
- * Memberships from a table of one scope (`customer_contacts`): every row is a
- * membership of `scope`, with roles from a column or fixed (`['contact']`), a
- * fixed `via`, and ancestor ids from `within` columns.
- */
-declare function junctionMembershipSource(options: MembershipJunctionOptions): SqlMembershipSource;
-declare const AUTHZ_VERSION_TABLE = "permdock_authz_version";
-/**
- * Reads the authorization version `permdock supabase hook generate` keeps in
- * `<schema>.permdock_authz_version`: pass it to `claimsFirst(sources, { version
- * })`.
- */
-declare function authzVersion(options: {
-  readonly query: SqlQuery;
-  readonly schema?: string;
-}): NonNullable<MembershipSource["version"]>;
-//#endregion
-export { MembershipStream as a, SupabasePostgres as c, supabasePostgresQuery as d, tableMembershipSource as f, MembershipSql as i, authzVersion as l, MembershipHolders as n, MembershipTableOptions as o, MembershipJunctionOptions as r, SqlMembershipSource as s, AUTHZ_VERSION_TABLE as t, junctionMembershipSource as u };

package/dist/supabase-hook-C0FyEACZ.js

@@ -1 +0,0 @@
-export { i as runSupabase } from "./supabase-hook-CrgU06WH.js";

package/dist/usage-0hjZPIRX.js

@@ -1 +0,0 @@
-export { t as runUsage } from "./usage-B9EtHWLa.js";

package/dist/watch-ClLuO2TL.js

@@ -1 +0,0 @@
-export { i as watchCollect } from "./watch-BFDKqmUa.js";