permdock 0.9.0 → 0.11.0

package/dist/better-supabase/index.js

@@ -11,6 +11,7 @@ import { r as sha256Digest } from "../sha256-C-4WXKIu.js";
 import { t as decideSupportSession } from "../support-session-BsmPCbz8.js";
 import { f as scopeList } from "../scopes-0Up_UA2t.js";
 import { o as flattenGrantee } from "../grantee-Dke-9rd1.js";
+import { _ as claimsFirst } from "../instance-snapshot-DuWf1cT3.js";
 import { a as delegatedScopeMap, s as scopesReaching, t as getPermDock } from "../permdock-BvjivVb9.js";
 import { t as anonymousSubject } from "../subject-BGoM5o8B.js";
 import { i as linkPolicyViolation, n as capabilityOf, r as capabilitySubject } from "../capability-BqX94r07.js";
@@ -18,11 +19,12 @@ import { r as credentialSubject, s as parseCredential } from "../credential-Cyyy
 import { t as AccessReviewError } from "../errors-BDUwg2qC.js";
 import { t as policyRowConditionKeys } from "../row-conditions-BAGHOmVq.js";
 import { n as subscribersFor } from "../audience-DTjR8xet.js";
-import { l as sqlIdent, s as quoteSqlLiteral } from "../sql-0WjxIp9g.js";
-import "../sources-CMAM-2A3.js";
-import { c as subjectFromSupabaseSession, t as callRpc } from "../postgrest-5Dr3W64L.js";
-import { n as parseSupabaseManifest, t as hasTokenHook } from "../manifest-wg8WkkpD.js";
+import { i as qualifySqlTable, l as sqlIdent, s as quoteSqlLiteral } from "../sql-0WjxIp9g.js";
+import { o as junctionMembershipSource } from "../sources-C4vkzZJV.js";
+import { c as subjectFromSupabaseSession, t as callRpc } from "../postgrest-DAxFltvO.js";
+import { n as parseSupabaseManifest, t as hasTokenHook } from "../manifest-BXTbHNIV.js";
 import { t as parseCatalog } from "../parse-1_ZheTW5.js";
+import { n as activeTenantMismatch, t as activeOrganizationFrom } from "../active-tenant-DVee32-T.js";
 import { AsyncResult, dbError } from "better-supabase";
 //#region src/better-supabase/access-reviews.ts
 const NOT_MEMBER = "ORGANIZATION_NOT_MEMBER";
@@ -289,6 +291,17 @@ function isApiKeySession(session) {
 	const record = Object.fromEntries(Object.entries(session));
 	return record["kind"] === "apiKey" && typeof record["keyId"] === "string" && typeof record["name"] === "string" && Array.isArray(record["scopes"]) && record["scopes"].every((scope) => typeof scope === "string");
 }
+function isSessionSnapshot(session) {
+	return isRecord(session) && !Object.hasOwn(session, "kind") && typeof session["accessToken"] === "string" && typeof session["userId"] === "string" && isRecord(session["claims"]);
+}
+/** A snapshot as a user session; one whose `sub` is not its `userId` is none. */
+function snapshotSession(snapshot) {
+	const { claims } = snapshot;
+	return isRecord(claims) && claims["sub"] === snapshot.userId ? {
+		kind: "user",
+		claims
+	} : null;
+}
 function apiKeySubject(session, options) {
 	const roles = typeof options.serviceRoles === "function" ? options.serviceRoles(session) : options.serviceRoles ?? manifestServiceRoles(options.manifest);
 	const credential = keyCredential({
@@ -309,14 +322,16 @@ function apiKeySubject(session, options) {
 * verified `apiKey` session is the key's credential subject: a personal key
 * acts as its user within the key's scopes, a tenant key as a `service`
 * principal holding `serviceRoles`. Without `apiKeys`, and for `anon`,
-* `service` and `invalid` sessions, the subject is anonymous.
+* `service` and `invalid` sessions, the subject is anonymous. A
+* `SessionSnapshot` maps as the user session of its claims.
 */
 function subjectFromBetterSupabase(session, options = {}) {
 	const { apiKeys, plans = "features", claims, ...rest } = options;
 	if (isApiKeySession(session)) return apiKeys === void 0 ? anonymousSubject() : apiKeySubject(session, apiKeys);
+	const user = isSessionSnapshot(session) ? snapshotSession(session) : session;
 	const claim = typeof plans === "string" ? plans : plans.claim ?? "features";
 	const keys = typeof plans === "string" ? void 0 : plans.keys;
-	return subjectFromSupabaseSession(keys === void 0 ? session : decodedFeatures(session, claim, keys), {
+	return subjectFromSupabaseSession(keys === void 0 ? user : decodedFeatures(user, claim, keys), {
 		...rest,
 		claims: {
 			memberships: "memberships",
@@ -442,8 +457,12 @@ function supportPolicy(options) {
 }
 //#endregion
 //#region src/better-supabase/hooks.ts
-/** better-supabase's claim that caps a context to the permission keys it lists. */
-const PERMISSION_CAP_CLAIM = "bs_permission_cap";
+/**
+* better-supabase's claim that caps a context to the permission keys it lists:
+* `bs_permission_cap` before 0.15, `bsb_permission_cap` from 0.15. A run sets
+* both, so the cap holds on every version in the peer range.
+*/
+const PERMISSION_CAP_CLAIMS = ["bs_permission_cap", "bsb_permission_cap"];
 /**
 * Whether `permdock` is granted `key` with no row; an unknown key and
 * `approval-required` are `false`.
@@ -522,7 +541,7 @@ function authorizationHooks(options) {
 				if (!isRecord(claims) || !await holdsAll(claims, ref)) return null;
 				return Object.freeze({
 					...claims,
-					[PERMISSION_CAP_CLAIM]: [...ref.permissions]
+					...Object.fromEntries(PERMISSION_CAP_CLAIMS.map((claim) => [claim, [...ref.permissions]]))
 				});
 			} catch {
 				return null;
@@ -745,7 +764,8 @@ const HOLDERS_OF = "permitted_{scope}_users";
 /**
 * better-supabase calls `teamIdsOf` from RLS policies as `authenticated`, so it
 * fills from the caller-bound `member_<scope>_ids_of`, never from the `_for`
-* form only `supabase_auth_admin` may execute.
+* form only `supabase_auth_admin` may execute. Without a team scope, the hook
+* writes `member_team_ids_of` from `supabase.hook.teams`.
 */
 const TEAM_IDS_OF = "member_{scope}_ids_of";
 /** The scope names better-supabase reads as its teams (doctor BS417). */
@@ -806,12 +826,25 @@ function membershipOf(source, scope, problems) {
 		table: source.table,
 		userColumn: source.user.column,
 		scope: "column" in source.scope ? { column: source.scope.column } : { value: scope },
-		idColumn: source.id.column
+		idColumn: source.id.column,
+		...rolesTableOf(source)
 	};
 }
+/**
+* The role set a member's roles come from, one row per scope id, user and role:
+* a role read through a reference over several columns.
+*/
+function rolesTableOf(source) {
+	const roles = isRoleList(source.role) ? source.role : [source.role];
+	for (const role of roles) if ("through" in role && role.through.on !== void 0) return { rolesTable: role.through.table };
+	return {};
+}
+function isRoleList(role) {
+	return Array.isArray(role);
+}
 function roleSourceOf(source) {
 	const role = source.role;
-	if (Array.isArray(role) || !("column" in role) || !("through" in role)) return;
+	if (Array.isArray(role) || !("column" in role) || !("through" in role) || role.through.on !== void 0) return;
 	return {
 		table: source.table,
 		role: {
@@ -846,13 +879,15 @@ function permissionsOf(catalog, scopes) {
 		};
 	});
 }
-function tokenHookOf(manifest) {
+function tokenHookOf(manifest, activeTenant) {
 	const owned = manifest.claims.filter((claim) => claim.source === "permdock");
 	const registered = manifest.claims.filter((claim) => claim.source !== "permdock");
 	const budgeted = manifest.claims.filter((claim) => claim.budget);
+	const activeFrom = activeTenant === "resolver" || manifest.hook.activeFrom === void 0 ? void 0 : activeOrganizationFrom(manifest.hook.activeFrom, manifest.tenantClaim);
 	return {
 		function: `${manifest.hook.schema}.${manifest.hook.function}`,
 		tenantClaim: manifest.tenantClaim,
+		...activeFrom === void 0 ? {} : { activeOrganizationFrom: activeFrom },
 		ownedClaims: owned.map((claim) => claim.name),
 		...registered.length > 0 ? { registeredClaims: registered.map((claim) => ({
 			name: claim.name,
@@ -944,13 +979,14 @@ function delegatedScopes(catalog) {
 * templates, the membership tables, suspension rows, the token hook and every
 * catalog key with `sqlComplete` set from its `rowConditions`. A `_for`
 * template and `permissionsFor` are set only when the manifest lists their
-* helper, which `rls.mode: 'database'` writes; `isApprover` only with
-* `approvers` and `permdock_is_approver`, and otherwise `canApprove` only with
-* `approver`. `holdersOf` (`permitted_<tenant scope>_users`) and
-* `actorMayWrite` (`permdock_actor_may_write()`) are set when the manifest
-* lists their helper, and so is `teamIdsOf` (`member_<scope>_ids_of({user})`)
-* for a scope named `team` or `teams`. Throws when the manifest or catalog is
-* invalid, or when the tenant scope is ambiguous.
+* helper, which `rls.mode: 'database'` writes. `isApprover` is set with
+* `approvers` or `approver` and `permdock_is_approver`: `approver` fills its
+* `'ai-tool'` entry. `canApprove` is never set. `holdersOf` (`permitted_<tenant
+* scope>_users`) and `actorMayWrite` (`permdock_actor_may_write()`) are set
+* when the manifest lists their helper, and so is `teamIdsOf`
+* (`member_<scope>_ids_of({user})`) for a scope named `team` or `teams`. Throws
+* when the manifest or catalog is invalid, or when the tenant scope is
+* ambiguous.
 */
 function authorizationProvider(options) {
 	const manifest = parseSupabaseManifest(options.manifest);
@@ -958,6 +994,11 @@ function authorizationProvider(options) {
 	const rls = manifest.rls;
 	const problems = [];
 	if (catalog === void 0) problems.push("No catalog: better-supabase cannot check that the permission keys its SQL modules use (ai_chat, workflow, inbox and the rest) exist. Pass `catalog`.");
+	const activeFrom = hasTokenHook(manifest) ? manifest.hook.activeFrom : void 0;
+	if (options.activeTenant !== void 0 && activeFrom !== void 0) {
+		const mismatch = activeTenantMismatch(activeFrom, manifest.tenantClaim, options.activeTenant);
+		if (mismatch !== void 0) problems.push(mismatch);
+	}
 	const tenantScope = tenantScopeOf(manifest, options.scope);
 	const scopeNames = rls.scopes.map((scope) => scope.name);
 	const helpers = new Map(rls.helpers.map((helper) => [helper.name, helper]));
@@ -1037,7 +1078,7 @@ function authorizationProvider(options) {
 		});
 	}
 	let teamIdsOf;
-	const teamHelper = scopeNames.filter((scope) => TEAM_SCOPE.test(scope)).map((scope) => helpers.get(TEAM_IDS_OF.replace("{scope}", scope))).find((helper) => helper !== void 0);
+	const teamHelper = scopeNames.filter((scope) => TEAM_SCOPE.test(scope)).map((scope) => helpers.get(TEAM_IDS_OF.replace("{scope}", scope))).find((helper) => helper !== void 0) ?? helpers.get(TEAM_IDS_OF.replace("{scope}", "team"));
 	if (teamHelper !== void 0) {
 		const fn = `${schema}.${sqlIdent(teamHelper.name)}`;
 		teamIdsOf = `${fn}({user})`;
@@ -1098,11 +1139,24 @@ function authorizationProvider(options) {
 		...Object.keys(operations).length > 0 ? { operations } : {},
 		...Object.keys(delegated).length > 0 ? { delegation: { scopes: delegated } } : {},
 		decidingColumns: manifest.decidingColumns,
-		...hasTokenHook(manifest) ? { tokenHook: tokenHookOf(manifest) } : {},
+		...hasTokenHook(manifest) ? { tokenHook: tokenHookOf(manifest, options.activeTenant) } : {},
 		...problems.length > 0 ? { problems } : {}
 	});
 }
 //#endregion
+//#region src/better-supabase/report.ts
+/** `PermDock denied <key>: <first denial reason>.` */
+function deniedMessage(key, decision) {
+	const why = decision.denials[0]?.reason;
+	return why === void 0 ? `PermDock denied ${key}.` : `PermDock denied ${key}: ${why}.`;
+}
+function report(sink, error, context) {
+	if (sink === void 0) return;
+	try {
+		sink(error, context);
+	} catch {}
+}
+//#endregion
 //#region src/better-supabase/authorizer.ts
 const OPERATIONS = /* @__PURE__ */ new Set([
 	"list",
@@ -1111,10 +1165,18 @@ const OPERATIONS = /* @__PURE__ */ new Set([
 	"update",
 	"delete"
 ]);
+const READ_ACTIONS = /* @__PURE__ */ new Set([
+	"read",
+	"list",
+	"view"
+]);
 const denied = (reason) => ({
 	outcome: "denied",
 	reason
 });
+function isVersionCache(value) {
+	return isRecord(value) && typeof value["maxStaleMs"] === "number" && typeof value["current"] === "function" && typeof value["evict"] === "function";
+}
 function outcomeOf(decision, key) {
 	switch (decision.outcome) {
 		case "granted": return { outcome: "granted" };
@@ -1122,10 +1184,7 @@ function outcomeOf(decision, key) {
 			outcome: "approval-required",
 			approval: { id: decision.token }
 		};
-		case "denied": {
-			const why = decision.denials[0]?.reason;
-			return denied(why === void 0 ? `PermDock denied ${key}.` : `PermDock denied ${key}: ${why}.`);
-		}
+		case "denied": return denied(deniedMessage(key, decision));
 		default: return decision;
 	}
 }
@@ -1144,23 +1203,59 @@ function claimsOf(request) {
 	const claims = subject.properties?.["claims"];
 	return isRecord(claims) ? claims : void 0;
 }
+const tenantOf = (request) => {
+	const tenant = request.context["tenant"];
+	return typeof tenant === "string" ? tenant : null;
+};
+const keyOf = (request) => isPermission(request.action) ? request.action.key : null;
 /**
 * better-supabase's `authorizer` for PermDock: every resource, action, route
 * guard and MCP tool that declares a `permission` is decided with `decide`. The
 * subject is mapped from the verified claims with `subjectFromBetterSupabase`;
 * the request's `context.tenant` selects the active tenant only among the
 * memberships the claims hold. A caller without claims is anonymous, and a
-* throw denies.
+* throw denies. With better-supabase 0.15's runtime `memo`, the checks of one
+* request scope share an instance per claims, tenant and intent.
 */
 function authorizer(options) {
 	const { operations } = options;
-	const instanceFor = async (claims, tenant) => {
+	const intentOf = (request, batch) => {
+		if (options.intent !== void 0) return options.intent(request);
+		if (batch) return "read";
+		return isPermission(request.action) && READ_ACTIONS.has(request.action.action) ? "read" : "write";
+	};
+	const membershipsFor = (runtime) => {
+		if (options.memberships === void 0) return {};
+		const versions = isVersionCache(runtime?.versions) ? runtime.versions : options.versions;
+		return { memberships: claimsFirst(options.memberships, {
+			onStale: "reread",
+			...options.version === void 0 ? {} : { version: options.version },
+			...versions === void 0 ? {} : { versions }
+		}) };
+	};
+	const instanceFor = async (claims, tenant, intent, runtime) => {
 		const session = claims === void 0 ? null : {
 			kind: "user",
 			claims
 		};
-		const base = await getPermDock(options.policy, subjectFromBetterSupabase(session, options.subject), options.options);
-		return typeof tenant === "string" ? base.tenant(tenant) : base;
+		const base = await getPermDock(options.policy, subjectFromBetterSupabase(session, options.subject), {
+			...options.options,
+			...membershipsFor(runtime),
+			intent
+		});
+		return tenant === null ? base : base.tenant(tenant);
+	};
+	const scoped = (claims, tenant, intent, runtime) => runtime?.memo === void 0 ? instanceFor(claims, tenant, intent, runtime) : runtime.memo.once(`permdock:authorizer:${JSON.stringify([
+		claims ?? null,
+		tenant,
+		intent
+	])}`, () => instanceFor(claims, tenant, intent, runtime));
+	const failed = (error, request) => {
+		report(options.onError, error, {
+			permission: keyOf(request),
+			tenant: tenantOf(request)
+		});
+		return denied("The permission check failed.");
 	};
 	return Object.freeze({
 		apiVersion: 1,
@@ -1173,39 +1268,98 @@ function authorizer(options) {
 			if (!OPERATIONS.has(operation) || !Object.hasOwn(operations, table)) return void 0;
 			return operations[table]?.[operation];
 		} },
-		async evaluate(request) {
+		async evaluate(request, runtime) {
 			try {
-				return decideWith(await instanceFor(claimsOf(request), request.context["tenant"]), request);
-			} catch {
-				return denied("The permission check failed.");
+				return decideWith(await scoped(claimsOf(request), tenantOf(request), intentOf(request, false), runtime), request);
+			} catch (error) {
+				return failed(error, request);
 			}
 		},
-		evaluations(requests) {
+		evaluations(requests, runtime) {
 			const cache = /* @__PURE__ */ new Map();
-			const shared = (claims, tenant) => {
-				let byTenant = cache.get(claims);
-				if (byTenant === void 0) {
-					byTenant = /* @__PURE__ */ new Map();
-					cache.set(claims, byTenant);
+			const shared = (request) => {
+				const claims = claimsOf(request);
+				const tenant = tenantOf(request);
+				const intent = intentOf(request, true);
+				let byKey = cache.get(claims);
+				if (byKey === void 0) {
+					byKey = /* @__PURE__ */ new Map();
+					cache.set(claims, byKey);
 				}
-				let instance = byTenant.get(tenant);
+				const key = JSON.stringify([tenant, intent]);
+				let instance = byKey.get(key);
 				if (instance === void 0) {
-					instance = instanceFor(claims, tenant);
-					byTenant.set(tenant, instance);
+					instance = scoped(claims, tenant, intent, runtime);
+					byKey.set(key, instance);
 				}
 				return instance;
 			};
 			return Promise.all(requests.map(async (request) => {
 				try {
-					return decideWith(await shared(claimsOf(request), request.context["tenant"]), request);
-				} catch {
-					return denied("The permission check failed.");
+					return decideWith(await shared(request), request);
+				} catch (error) {
+					return failed(error, request);
 				}
 			}));
 		}
 	});
 }
 //#endregion
+//#region src/better-supabase/block-memberships.ts
+function roleOf(options, columns) {
+	const column = columns.role;
+	if (options.roles !== void 0 && options.roleThrough !== void 0) throw new TypeError("PermDock: blockMembershipSource takes roles or roleThrough, not both; a junction holds role keys");
+	if (options.roles === "many") return {
+		through: `${qualifySqlTable(columns.table).split(".")[0] ?? "better_supabase"}.membership_roles`,
+		on: {
+			[columns.tenant]: columns.tenant,
+			[columns.user]: columns.user
+		},
+		column: "role"
+	};
+	if (options.roles !== void 0) return {
+		through: options.roles.table,
+		on: { [options.roles.id ?? "id"]: options.roles.membership },
+		column: options.roles.role
+	};
+	if (options.roleThrough !== void 0) return {
+		through: options.roleThrough.table,
+		on: { [column]: options.roleThrough.id },
+		column: options.roleThrough.column
+	};
+	return column;
+}
+/**
+* Memberships from better-supabase's `memberships` block table: one row per
+* user and organization, its role key in `role`, a custom role's key through
+* `roleThrough`, or several roles from a `roles` junction or, with `roles:
+* "many"`, from better-supabase's `membership_roles`. A row with `disabled_at`
+* set is no membership.
+*/
+function blockMembershipSource(options = {}) {
+	const c = options.columns ?? {};
+	const scope = options.scope ?? "organization";
+	const disabledAt = c.disabledAt === null ? void 0 : c.disabledAt ?? "disabled_at";
+	const table = options.table ?? "better_supabase.memberships";
+	const tenant = c.tenant ?? "organization_id";
+	const user = c.user ?? "user_id";
+	return junctionMembershipSource({
+		table,
+		scope,
+		id: tenant,
+		user,
+		roles: roleOf(options, {
+			table,
+			role: c.role ?? "role",
+			tenant,
+			user
+		}),
+		...disabledAt === void 0 ? {} : { disabledAt },
+		...options.query === void 0 ? {} : { query: options.query },
+		...options.suspension === void 0 ? {} : { suspension: options.suspension }
+	});
+}
+//#endregion
 //#region src/better-supabase/policies.ts
 /**
 * PermDock splits a key with row conditions into `key#1`, `key#2`, ... in the
@@ -1339,7 +1493,8 @@ const refused = (reason) => ({
 * tools whose `meta` is a PermDock permission. A tool without a permission is
 * hidden and refused. `authorize` grants only a `granted` decision: an
 * approval-required call is refused, because `createMcp` has no approval flow.
-* A throw anywhere refuses.
+* A denial's text names the first denial reason. A throw anywhere refuses and
+* reaches `onError`.
 */
 function toolPolicy(options) {
 	return Object.freeze({
@@ -1353,10 +1508,14 @@ function toolPolicy(options) {
 				switch (decision.outcome) {
 					case "granted": return { allowed: true };
 					case "approval-required": return refused(`${permission.key} needs approval, which this server does not collect.`);
-					case "denied": return refused(`PermDock denied ${permission.key}.`);
+					case "denied": return refused(deniedMessage(permission.key, decision));
 					default: return decision;
 				}
-			} catch {
+			} catch (error) {
+				report(options.onError, error, {
+					permission: permission.key,
+					tenant: null
+				});
 				return refused("The permission check failed.");
 			}
 		},
@@ -1365,7 +1524,11 @@ function toolPolicy(options) {
 			if (!isPermission(permission)) return false;
 			try {
 				return (await options.permdock(ctx)).mayUse(permission);
-			} catch {
+			} catch (error) {
+				report(options.onError, error, {
+					permission: permission.key,
+					tenant: null
+				});
 				return false;
 			}
 		}
@@ -1585,12 +1748,12 @@ async function subjectFromShareLink(token, options) {
 //#region src/better-supabase/workflow.ts
 /**
 * Whether `permdock` is granted the permission `key` (a catalog key or scope)
-* with no row.
+* on `row`.
 */
-function grants(permdock, key) {
+function grants(permdock, key, row) {
 	try {
 		const permission = findPermission(permdock.permissions, key);
-		return permission !== void 0 && permdock.decide(permission, void 0).outcome === "granted";
+		return permission !== void 0 && permdock.decide(permission, row).outcome === "granted";
 	} catch {
 		return false;
 	}
@@ -1598,25 +1761,40 @@ function grants(permdock, key) {
 /**
 * The `can` option of better-supabase's `authorizeHook`, for the caller's
 * `permdock`: `true` only when the caller is a member of the hook's tenant and
-* `decide` grants the permission its `hookMetadata` names there. An unknown
-* key, `approval-required` and a throw are `false`.
+* `decide` grants the permission its `hookMetadata` names there, on the row
+* `options.data` loads. An unknown key, `approval-required` and a throw are
+* `false`.
 */
-function hookCan(permdock) {
-	return (tenant, key) => {
+function hookCan(permdock, options = {}) {
+	const { data } = options;
+	const decideIn = (tenant, key, row) => {
+		try {
+			return permdock.tenants().includes(tenant) && grants(permdock.tenant(tenant), key, row);
+		} catch {
+			return false;
+		}
+	};
+	if (data === void 0) return (tenant, key) => decideIn(tenant, key);
+	return async (tenant, key) => {
+		let row;
 		try {
-			return permdock.tenants().includes(tenant) && grants(permdock.tenant(tenant), key);
+			if (!permdock.tenants().includes(tenant)) return false;
+			row = await data(tenant, key);
 		} catch {
 			return false;
 		}
+		return decideIn(tenant, key, row);
 	};
 }
 /**
 * The `can` option of better-supabase's `protectWebHandler`: `undefined` (401)
 * when the request has no signed-in principal or `getPermDock` throws,
 * otherwise whether `decide` grants the permission in the request's active
-* tenant. An unknown key and `approval-required` are `false` (403).
+* tenant, on the row `options.data` loads. An unknown key, `approval-required`
+* and a throwing `data` are `false` (403).
 */
-function handlerCan(source) {
+function handlerCan(source, options = {}) {
+	const { data } = options;
 	return async (request, key) => {
 		let permdock;
 		try {
@@ -1625,8 +1803,14 @@ function handlerCan(source) {
 			return;
 		}
 		if (permdock.subject.principal === null) return;
-		return grants(permdock, key);
+		if (data === void 0) return grants(permdock, key);
+		try {
+			const row = await data(request, key);
+			return grants(permdock, key, row);
+		} catch {
+			return false;
+		}
 	};
 }
 //#endregion
-export { accessReviewApplier, apiKeyClaimOptions, apiKeyVerifier, authorizationHooks, authorizationProvider, authorizer, bucketPolicy, credentialGuard, handlerCan, hookCan, principalFromMemberships, principalSource, roleOrderFromCatalog, subjectFromBetterSupabase, subjectFromShareLink, subscriberPolicy, supportPolicy, toolPolicy, topicPolicy };
+export { accessReviewApplier, apiKeyClaimOptions, apiKeyVerifier, authorizationHooks, authorizationProvider, authorizer, blockMembershipSource, bucketPolicy, credentialGuard, handlerCan, hookCan, principalFromMemberships, principalSource, roleOrderFromCatalog, subjectFromBetterSupabase, subjectFromShareLink, subscriberPolicy, supportPolicy, toolPolicy, topicPolicy };

package/dist/{casbin-B7_yS-oo.js → casbin-BuTZnSPv.js}

@@ -16,7 +16,7 @@ const casbinImport = defineLeaf({
 		...outFlag
 	},
 	async run(ctx, { flags }) {
-		const { runCasbinImport } = await import("./casbin-bHyIxTNQ.js");
+		const { runCasbinImport } = await import("./casbin-DTi6HSsl.js");
 		return runCasbinImport({
 			cwd: ctx.cwd,
 			model: given(flags.model),

package/dist/{casbin-bHyIxTNQ.js → casbin-DTi6HSsl.js}

@@ -1,4 +1,4 @@
-import { a as nonEmptyOr } from "./output-DV5dwOTs.js";
+import { a as nonEmptyOr } from "./output-CtyBwTNB.js";
 import { t as applyFiles } from "./files-B3AA05f1.js";
 import { n as isIdentifier, t as emitPolicyModule } from "./policy-module-xym9fnSq.js";
 import { existsSync, readFileSync } from "node:fs";

package/dist/cli/bin.js

@@ -11,7 +11,7 @@ if (argv.length === 1 && (argv[0] === "--version" || argv[0] === "-v")) {
 	const [{ isCi }, { trapSignals }, { run }, { streamHasColors }] = await Promise.all([
 		import("../env-DJZrPjRi.js"),
 		import("../signals-B1vHR3fN.js"),
-		import("../run-Ck22anC2.js"),
+		import("../run-0vOholnN.js"),
 		import("../style-DblOtSga.js")
 	]);
 	const signals = trapSignals();

package/dist/cli/index.d.ts

@@ -3,7 +3,7 @@ import { f as PermissionTree } from "../permission-types-CAY-GU7e.js";
 import { o as OperationMap } from "../operations-Ci_rT6Uo.js";
 import { a as CatalogDocument, d as CatalogRole, f as CatalogScope, l as CatalogPermission, m as CatalogUsage, n as CatalogApproval, p as CatalogSupportAccess, r as CatalogBreakGlass, t as CatalogActivation, u as CatalogResource } from "../types-ZzRGoViD.js";
 import { a as pushedPolicy, i as parsePushedPolicy, n as PushedGrant, r as PushedPolicy, t as PUSHED_POLICY_SCHEMA } from "../pushed-policy-CryQheKq.js";
-import { _ as RlsSuspension, a as GenKind, c as RlsActiveRow, d as RlsDialect, f as RlsFunctionMapping, g as RlsSuspendedScope, h as RlsSuspendedMembership, i as GenConfig, l as RlsApiKeys, m as RlsMemberships, n as CliIo, o as PermDockConfig, p as RlsMembershipTable, r as CollectConfig, t as CatalogConfig, u as RlsConfig, v as RlsTarget, y as RunResult } from "../types-CzOeVvcC.js";
+import { _ as RlsSuspension, a as GenKind, c as RlsActiveRow, d as RlsDialect, f as RlsFunctionMapping, g as RlsSuspendedScope, h as RlsSuspendedMembership, i as GenConfig, l as RlsApiKeys, m as RlsMemberships, n as CliIo, o as PermDockConfig, p as RlsMembershipTable, r as CollectConfig, t as CatalogConfig, u as RlsConfig, v as RlsTarget, y as RunResult } from "../types-Cklw5hJo.js";
 import { o as ResourceNameOf, r as PermissionKeyOf, s as ScopeNameOf, t as ActionNameOf } from "../type-helpers-c7Xo_2Cu.js";
 //#region src/cli/catalog-path.d.ts
 /**
@@ -76,6 +76,11 @@ type ConfigChecks<C> = [PolicyOf<C>] extends [never] ? unknown : {
   readonly powersync?: {
     readonly resources?: readonly ResourceNameOf<PolicyOf<C>>[];
     readonly action?: ActionNameOf<PolicyOf<C>>;
+    readonly tables?: Readonly<Record<string, {
+      readonly follow?: readonly {
+        readonly resource: ResourceNameOf<PolicyOf<C>>;
+      }[];
+    }>>;
   };
 };
 //#endregion

package/dist/cli/index.js

@@ -1,8 +1,8 @@
 import { t as catalogPath } from "../catalog-path-CnI0XTFK.js";
-import { t as defineConfig } from "../config-BwPBfN0t.js";
+import { t as defineConfig } from "../config-BR23fL8m.js";
 import { n as parsePushedPolicy, r as pushedPolicy, t as PUSHED_POLICY_SCHEMA } from "../pushed-policy-CDuOL2de.js";
 import { c as parseGrantsMarker, l as parseHookMarker } from "../markers-BeHZ4x9Q.js";
-import { t as run } from "../run-PbRlXTfh.js";
+import { t as run } from "../run-B5nyNKe8.js";
 //#region src/cli/token-schemas.ts
 const ID = {
 	type: "string",
@@ -85,6 +85,14 @@ const RUN_TICKET_SCHEMA = {
 					maxItems: 64
 				}
 			}
+		},
+		resource: {
+			type: "object",
+			required: ["type", "id"],
+			properties: {
+				type: ID,
+				id: ID
+			}
 		}
 	},
 	anyOf: [{

package/dist/{cloud-3kWfjnYy.js → cloud-DiAiYFRo.js}

@@ -41,7 +41,7 @@ const push = defineLeaf({
 	},
 	async run(ctx, { flags }) {
 		const env = await withStdinSecret(ctx, "key", flags["key-stdin"], "PERMDOCK_CLOUD_KEY");
-		return (await import("./push-Bn-lMEmI.js")).runCloud({
+		return (await import("./push-Dq_ca4-j.js")).runCloud({
 			cwd: ctx.cwd,
 			config: ctx.config,
 			url: given(flags.url),
@@ -70,7 +70,7 @@ const pull = defineLeaf({
 	},
 	async run(ctx, { flags }) {
 		const env = await withStdinSecret(ctx, "token", flags["token-stdin"], "PERMDOCK_CLOUD_TOKEN");
-		return (await import("./pull-C3EEGzSw.js")).runCloudPull({
+		return (await import("./pull-DfJALUbS.js")).runCloudPull({
 			cwd: ctx.cwd,
 			config: ctx.config,
 			url: given(flags.url),

package/dist/{codemod-Bv5i-Mzo.js → codemod-C1U8_Zu3.js}

@@ -1,7 +1,7 @@
 import { n as CliError } from "./errors-Vpu6rKHl.js";
 import { a as rel } from "./files-BSjrtIHw.js";
 import { t as beforeFirst } from "./text-BMFRfBqc.js";
-import { n as ROOT } from "./manifest-B2QPh19C.js";
+import { n as ROOT } from "./manifest-Cav1rjNQ.js";
 import { i as renameMessage, n as DEFAULT_CHANGES, r as flagRename, t as COMMAND_MOVES } from "./renames-CGj7YwcQ.js";
 import { i as refuseDirty, t as applyFiles } from "./files-B3AA05f1.js";
 import { readFileSync, readdirSync, statSync } from "node:fs";

package/dist/{codemod-D9Aiii1r.js → codemod-_q_ZI01S.js}

@@ -7,7 +7,7 @@ const codemod = defineLeaf({
 		description: "The release to migrate to (0.5)",
 		required: true,
 		async complete() {
-			return (await import("./codemod-Bv5i-Mzo.js")).codemodVersions();
+			return (await import("./codemod-C1U8_Zu3.js")).codemodVersions();
 		}
 	}, {
 		name: "paths",
@@ -22,7 +22,7 @@ const codemod = defineLeaf({
 		}
 	},
 	async run(ctx, { flags, args, rest }) {
-		return (await import("./codemod-Bv5i-Mzo.js")).runCodemod({
+		return (await import("./codemod-C1U8_Zu3.js")).runCodemod({
 			cwd: ctx.cwd,
 			version: args["version"],
 			paths: rest,