permdock 0.9.0 → 0.11.0

package/dist/{manifest-B2QPh19C.js → manifest-Cav1rjNQ.js}

@@ -30,20 +30,20 @@ const SECTIONS = [
 				docs: "init",
 				effects: ["files"],
 				config: false,
-				load: async () => (await import("./init-txYTuW9u.js")).init
+				load: async () => (await import("./init-CY7THM2v.js")).init
 			}),
 			group("preset", "Decode a preset code, or print its permdock.com/create link", "preset", [leaf("decode", "Print what a preset code holds", {
 				examples: ["permdock preset decode p1AQIDBAc"],
 				docs: "preset",
 				effects: [],
 				config: false,
-				load: async () => (await import("./init-txYTuW9u.js")).presetDecode
+				load: async () => (await import("./init-CY7THM2v.js")).presetDecode
 			}), leaf("url", "Print the permdock.com/create link that opens a code", {
 				examples: ["permdock preset url p1AQIDBAc"],
 				docs: "preset",
 				effects: [],
 				config: false,
-				load: async () => (await import("./init-txYTuW9u.js")).presetUrl
+				load: async () => (await import("./init-CY7THM2v.js")).presetUrl
 			})]),
 			group("skills", "Install, update or list the PermDock Agent Skills", "skills", [
 				leaf("install", "Copy the Agent Skills into the agent folders", {
@@ -55,21 +55,21 @@ const SECTIONS = [
 					docs: "skills",
 					effects: ["files"],
 					config: false,
-					load: async () => (await import("./skills-C9uKfSF5.js")).install
+					load: async () => (await import("./skills-BZc81VLt.js")).install
 				}),
 				leaf("update", "Replace installed skills with this version's", {
 					examples: ["permdock skills update"],
 					docs: "skills",
 					effects: ["files"],
 					config: false,
-					load: async () => (await import("./skills-C9uKfSF5.js")).update
+					load: async () => (await import("./skills-BZc81VLt.js")).update
 				}),
 				leaf("list", "List the skills and where each is installed", {
 					examples: ["permdock skills list"],
 					docs: "skills",
 					effects: [],
 					config: false,
-					load: async () => (await import("./skills-C9uKfSF5.js")).list
+					load: async () => (await import("./skills-BZc81VLt.js")).list
 				})
 			]),
 			leaf("doctor", "Check a PermDock installation and print a fix for each finding", {
@@ -82,7 +82,7 @@ const SECTIONS = [
 				effects: ["files"],
 				config: true,
 				findings: true,
-				load: async () => (await import("./doctor-LPMYjSqO.js")).doctor
+				load: async () => (await import("./doctor-DxyVeUEE.js")).doctor
 			}),
 			leaf("completion", "Print the shell completion script for bash, zsh or fish", {
 				examples: ["permdock completion zsh > ~/.zfunc/_permdock", "eval \"$(permdock completion bash)\""],
@@ -90,7 +90,7 @@ const SECTIONS = [
 				effects: [],
 				config: false,
 				shellOutput: true,
-				load: async () => (await import("./completion-_bc0OUQ-.js")).completion
+				load: async () => (await import("./completion-DLTuCf53.js")).completion
 			})
 		]
 	},
@@ -106,7 +106,7 @@ const SECTIONS = [
 				docs: "collect",
 				effects: ["files"],
 				config: true,
-				load: async () => (await import("./collect-B80GYEot.js")).collect
+				load: async () => (await import("./collect-D9Tt0Bcx.js")).collect
 			}),
 			leaf("catalog", "Export the catalog as catalog JSON, JSON Schema or Markdown", {
 				examples: ["permdock catalog --out permissions.catalog.json", "permdock catalog --kind markdown"],
@@ -124,7 +124,7 @@ const SECTIONS = [
 				docs: "gen",
 				effects: ["files"],
 				config: true,
-				load: async () => (await import("./gen-BFfzZSLH.js")).gen
+				load: async () => (await import("./gen-DwgCSC6V.js")).gen
 			}),
 			leaf("usage", "Report unused, ungranted and role-less permissions and conditions on undeclared fields", {
 				examples: ["permdock usage", "permdock usage --fail-on warning"],
@@ -132,7 +132,7 @@ const SECTIONS = [
 				effects: [],
 				config: true,
 				findings: true,
-				load: async () => (await import("./usage-CBzgwfIs.js")).usage
+				load: async () => (await import("./usage-heV5KOiU.js")).usage
 			}),
 			leaf("diff", "Compare two policies or catalogs; exit 1 on a breaking change", {
 				examples: ["permdock diff main.catalog.json permissions.catalog.json", "permdock diff ./old-policy.ts ./src/policy.ts --impact"],
@@ -147,7 +147,7 @@ const SECTIONS = [
 				effects: [],
 				config: true,
 				findings: true,
-				load: async () => (await import("./config-D5XrLWpk.js")).config
+				load: async () => (await import("./config-CmydKZr2.js")).config
 			})
 		]
 	},
@@ -164,14 +164,14 @@ const SECTIONS = [
 						"network"
 					],
 					config: true,
-					load: async () => (await import("./rls-Ba9wN0SP.js")).generate
+					load: async () => (await import("./rls-BYHN5bcJ.js")).generate
 				}),
 				leaf("import", "Turn existing RLS policies into a generated definition", {
 					examples: ["permdock rls import --sql schema.sql --out src/permissions.generated.ts", "permdock rls import --db-url-stdin --out src/permissions.generated.ts"],
 					docs: "rls",
 					effects: ["files", "database:read"],
 					config: true,
-					load: async () => (await import("./rls-Ba9wN0SP.js")).importPolicies
+					load: async () => (await import("./rls-BYHN5bcJ.js")).importPolicies
 				}),
 				leaf("verify", "Run the fixtures against the policies, or compare a live database", {
 					examples: [
@@ -183,21 +183,21 @@ const SECTIONS = [
 					effects: ["files", "database:read"],
 					config: true,
 					findings: true,
-					load: async () => (await import("./rls-Ba9wN0SP.js")).verify
+					load: async () => (await import("./rls-BYHN5bcJ.js")).verify
 				}),
 				leaf("migrate", "Rewrite hand-written policies onto the generated helpers", {
 					examples: ["permdock rls migrate --sql supabase/migrations --dry-run", "permdock rls migrate --sql supabase/migrations"],
 					docs: "rls",
 					effects: ["rewrite", "files"],
 					config: true,
-					load: async () => (await import("./rls-Ba9wN0SP.js")).migrate
+					load: async () => (await import("./rls-BYHN5bcJ.js")).migrate
 				}),
 				leaf("explain", "Show the tables, membership sources and triggers the SQL binds to", {
 					examples: ["permdock rls explain", "permdock rls explain --db-url-stdin --json"],
 					docs: "rls",
 					effects: ["database:read"],
 					config: true,
-					load: async () => (await import("./rls-Ba9wN0SP.js")).explain
+					load: async () => (await import("./rls-BYHN5bcJ.js")).explain
 				})
 			]),
 			group("supabase", "Generate the Supabase Custom Access Token Hook, or inspect its manifest", "supabase", [group("hook", "The Custom Access Token Hook", "supabase", [leaf("generate", "Compile the membership sources into the hook migration", {
@@ -205,26 +205,26 @@ const SECTIONS = [
 				docs: "supabase",
 				effects: ["files", "database:read"],
 				config: true,
-				load: async () => (await import("./supabase-SBs3MYUE.js")).hookGenerate
+				load: async () => (await import("./supabase-CBEK6KEo.js")).hookGenerate
 			})]), leaf("inspect", "Print or write the hook and helper manifest", {
 				examples: ["permdock supabase inspect", "permdock supabase inspect --out"],
 				docs: "supabase",
 				effects: ["files"],
 				config: true,
-				load: async () => (await import("./supabase-SBs3MYUE.js")).inspect
+				load: async () => (await import("./supabase-CBEK6KEo.js")).inspect
 			})]),
 			group("powersync", "Generate PowerSync Sync Streams from the policy, or verify them", "powersync", [leaf("generate", "Compile the read grants into sync-config.yaml", {
 				examples: ["permdock powersync generate", "permdock powersync generate --check"],
 				docs: "powersync",
 				effects: ["files"],
 				config: true,
-				load: async () => (await import("./powersync-Bg8u-JcR.js")).generate
+				load: async () => (await import("./powersync-CBcsEvdr.js")).generate
 			}), leaf("verify", "Fail on stale streams or a stream that syncs a denied row", {
 				examples: ["permdock powersync verify", "permdock powersync verify --db-url-stdin"],
 				docs: "powersync",
 				effects: ["database:read"],
 				config: true,
-				load: async () => (await import("./powersync-Bg8u-JcR.js")).verify
+				load: async () => (await import("./powersync-CBcsEvdr.js")).verify
 			})]),
 			group("scim", "Generate the Postgres tables postgresDirectoryStore keeps a SCIM directory in", "scim", [leaf("generate", "Write the tenant-keyed users, groups and members tables", {
 				examples: [
@@ -247,13 +247,13 @@ const SECTIONS = [
 				docs: "openapi",
 				effects: ["files"],
 				config: true,
-				load: async () => (await import("./openapi-BIpw3Mb7.js")).emit
+				load: async () => (await import("./openapi-gMQQSzNn.js")).emit
 			}), leaf("import", "Turn an OpenAPI document into a generated definition", {
 				examples: ["permdock openapi import --doc openapi.yaml --out src/permissions.generated.ts"],
 				docs: "openapi",
 				effects: ["files", "network"],
 				config: false,
-				load: async () => (await import("./openapi-BIpw3Mb7.js")).importDocument
+				load: async () => (await import("./openapi-gMQQSzNn.js")).importDocument
 			})]),
 			group("arazzo", "Check Arazzo workflows against the permissions", "arazzo", [leaf("check", "Resolve every Arazzo step to x-permdock-permissions", {
 				examples: ["permdock arazzo check --doc arazzo.json --openapi openapi.json"],
@@ -261,7 +261,7 @@ const SECTIONS = [
 				effects: [],
 				config: true,
 				findings: true,
-				load: async () => (await import("./arazzo-BpS7LnV0.js")).check
+				load: async () => (await import("./arazzo-BXaEhGHM.js")).check
 			})]),
 			leaf("scan", "List authorization checks written without PermDock, to adopt it in an existing app", {
 				examples: ["permdock scan", "permdock scan --src app,lib --pattern isBeta"],
@@ -269,7 +269,7 @@ const SECTIONS = [
 				effects: [],
 				config: true,
 				findings: true,
-				load: async () => (await import("./scan-CRTj6fke.js")).scan
+				load: async () => (await import("./scan-CvFWW_fU.js")).scan
 			}),
 			group("casl", "Import CASL rules into a generated module", "casl", [leaf("import", "Turn CASL rules per role into a permissions and policy module", {
 				examples: ["permdock casl import --rules rules.json --out src/permissions.generated.ts"],
@@ -283,7 +283,7 @@ const SECTIONS = [
 				docs: "casbin",
 				effects: ["files"],
 				config: false,
-				load: async () => (await import("./casbin-B7_yS-oo.js")).casbinImport
+				load: async () => (await import("./casbin-BuTZnSPv.js")).casbinImport
 			})])
 		]
 	},
@@ -295,34 +295,34 @@ const SECTIONS = [
 				docs: "login",
 				effects: ["network", "files"],
 				config: false,
-				load: async () => (await import("./login-CfImTJGb.js")).login
+				load: async () => (await import("./login-C5XLYZSF.js")).login
 			}),
 			leaf("logout", "Revoke and delete the stored PermDock Cloud login", {
 				examples: ["permdock logout"],
 				docs: "login",
 				effects: ["network", "files"],
 				config: false,
-				load: async () => (await import("./login-CfImTJGb.js")).logout
+				load: async () => (await import("./login-C5XLYZSF.js")).logout
 			}),
 			leaf("whoami", "Print the PermDock Cloud identity the CLI acts as", {
 				examples: ["permdock whoami", "permdock whoami --json"],
 				docs: "login",
 				effects: [],
 				config: false,
-				load: async () => (await import("./login-CfImTJGb.js")).whoami
+				load: async () => (await import("./login-C5XLYZSF.js")).whoami
 			}),
 			group("cloud", "Publish to or pull from a PermDock Cloud project", "cloud", [leaf("push", "Publish the catalog, policy and manifest to a Cloud project", {
 				examples: ["permdock cloud push --dry-run", "permdock cloud push --project prj_123"],
 				docs: "cloud",
 				effects: ["network", "cloud:write"],
 				config: true,
-				load: async () => (await import("./cloud-3kWfjnYy.js")).push
+				load: async () => (await import("./cloud-DiAiYFRo.js")).push
 			}), leaf("pull", "Write a Cloud project's published catalog and manifest", {
 				examples: ["permdock cloud pull --project prj_123"],
 				docs: "cloud",
 				effects: ["network", "files"],
 				config: true,
-				load: async () => (await import("./cloud-3kWfjnYy.js")).pull
+				load: async () => (await import("./cloud-DiAiYFRo.js")).pull
 			})])
 		]
 	},
@@ -333,7 +333,7 @@ const SECTIONS = [
 			docs: "codemod",
 			effects: ["rewrite"],
 			config: false,
-			load: async () => (await import("./codemod-D9Aiii1r.js")).codemod
+			load: async () => (await import("./codemod-_q_ZI01S.js")).codemod
 		})]
 	}
 ];
@@ -345,7 +345,7 @@ const COMPLETE_LEAF = leaf("__complete", "Print completion candidates for a part
 	config: false,
 	shellOutput: true,
 	hidden: true,
-	load: async () => (await import("./completion-_bc0OUQ-.js")).complete
+	load: async () => (await import("./completion-DLTuCf53.js")).complete
 });
 const ROOT = group("permdock", "Collect, export, diff and check the permissions a PermDock policy declares", "", [...SECTIONS.flatMap((section) => section.entries), COMPLETE_LEAF]);
 /** Each leaf with its path from the root, in manifest order. */

package/dist/{manifest-schema-2r37XRhD.js → manifest-schema-DQkBK2Mr.js}

@@ -47,6 +47,28 @@ const supabaseManifestSchema = freezeDeep({
 						type: "string",
 						pattern: "^[A-Za-z_][A-Za-z0-9_]*\\.[A-Za-z_][A-Za-z0-9_]*$"
 					}
+				},
+				activeFrom: {
+					description: "Where the hook reads the active first-scope id (supabase.hook.activeFrom): an app_metadata key, or a column of a table joined on id. Absent from a manifest written before 0.10.",
+					oneOf: [{
+						type: "object",
+						required: ["appMetadata"],
+						additionalProperties: false,
+						properties: { appMetadata: { type: "string" } }
+					}, {
+						type: "object",
+						required: [
+							"table",
+							"column",
+							"id"
+						],
+						additionalProperties: false,
+						properties: {
+							table: { type: "string" },
+							column: { type: "string" },
+							id: { type: "string" }
+						}
+					}]
 				}
 			}
 		},
@@ -450,7 +472,12 @@ const supabaseManifestSchema = freezeDeep({
 							pattern: "^[A-Za-z_][A-Za-z0-9_]*\\.[A-Za-z_][A-Za-z0-9_]*$"
 						},
 						id: { $ref: "#/$defs/identifier" },
-						column: { $ref: "#/$defs/identifier" }
+						column: { $ref: "#/$defs/identifier" },
+						on: {
+							description: "Every referencing column to the column of table it matches, when the reference spans several columns.",
+							type: "object",
+							additionalProperties: { $ref: "#/$defs/identifier" }
+						}
 					}
 				}
 			}

package/dist/{migrate-B7oP_sQU.js → migrate-BJHxQqT5.js}

@@ -3,11 +3,11 @@ import { i as dateAt } from "./time-nR1JesoH.js";
 import { a as describeError } from "./errors-Vpu6rKHl.js";
 import { o as sqlFiles } from "./files-BSjrtIHw.js";
 import { r as escapeSqlIdent, s as quoteSqlLiteral } from "./sql-0WjxIp9g.js";
-import "./sources-CMAM-2A3.js";
+import "./sources-C4vkzZJV.js";
 import { a as RETIRE_MARKER } from "./markers-BeHZ4x9Q.js";
 import { i as refuseDirty, t as applyFiles } from "./files-B3AA05f1.js";
 import { f as writeOutputFiles, n as dataMigrationFile } from "./output-files-BIQ_9pIs.js";
-import { r as HELPERS } from "./shared-Afctg7B0.js";
+import { r as HELPERS } from "./shared-DrGLwM3s.js";
 import { o as sqlStatements } from "./deciding-columns-NB4wcyBf.js";
 import { i as retireSql, r as retirePlan } from "./retire-B2xffQgY.js";
 import { existsSync, readFileSync } from "node:fs";

package/dist/{module-values-BJTBdo6y.js → module-values-B1EVTkHP.js}

@@ -1,7 +1,7 @@
 import { c as listPermissions } from "./permission-registry-B8tYxPIt.js";
 import { i as configError } from "./errors-Vpu6rKHl.js";
 import { a as loadModule, s as pickNamed, t as asPermissionTree } from "./load-DjSU5KXO.js";
-import { i as isModuleKey, n as MODULE_KEYS } from "./config-shape-ykV0Vm2n.js";
+import { i as isModuleKey, n as MODULE_KEYS } from "./config-shape-tsxHx71E.js";
 import { existsSync, readFileSync, statSync } from "node:fs";
 import { dirname, relative, resolve } from "node:path";
 import { parseSync } from "oxc-parser";

package/dist/next/index.d.ts

@@ -65,13 +65,26 @@ type ServerPermissionState = {
   readonly status: "ready";
   readonly decision: Decision;
 };
-type NextPermDockProviderProps = {
-  readonly children: ReactNode;
-  readonly tenant?: string;
+type NextPermDockProviderProps = NextPermDockProviderDisplay & ({
+  /**
+   * The snapshot to hand to the client, usually from the app's `'use
+   * cache: private'` loader around `getSnapshot`, so a prefetch carries
+   * it. The loader decides what it includes.
+   */
+  readonly snapshot: Promise<Snapshot>;
+  readonly include?: never;
+  readonly tenants?: never;
+} | {
+  /** Without `snapshot`, the provider builds one outside any cache. */
+  readonly snapshot?: undefined;
   readonly include?: readonly (Permission | {
     readonly [key: string]: unknown;
   })[];
   readonly tenants?: "all";
+});
+type NextPermDockProviderDisplay = {
+  readonly children: ReactNode;
+  readonly tenant?: string;
   /** Overrides the factory's `endpoint`; `false` is snapshot-only. */
   readonly endpoint?: string | false;
   /**

package/dist/next/index.js

@@ -251,7 +251,7 @@ function createPermDock(policy, given) {
 		} });
 	};
 	const PermDockProvider = (props) => {
-		const snapshotPromise = getPermDock(props.tenant === void 0 ? void 0 : { tenant: props.tenant }).then((permdock) => permdock.snapshot(compact({
+		const snapshotPromise = props.snapshot ?? getPermDock(props.tenant === void 0 ? void 0 : { tenant: props.tenant }).then((permdock) => permdock.snapshot(compact({
 			include: props.include,
 			tenants: props.tenants
 		})));

package/dist/next/plugin.d.ts

@@ -1,4 +1,4 @@
-import { s as PermDockPluginOptions } from "../types-CzOeVvcC.js";
+import { s as PermDockPluginOptions } from "../types-Cklw5hJo.js";
 //#region src/cli/plugin.d.ts
 /** Any object: Next's `NextConfig` is an interface, so no index signature. */
 type NextConfigLike = object;

package/dist/next/plugin.js

@@ -1,5 +1,5 @@
 import { a as describeError } from "../errors-Vpu6rKHl.js";
-import { n as createCollectScheduler, r as report, t as collectOnce } from "../watch-BFDKqmUa.js";
+import { n as createCollectScheduler, r as report, t as collectOnce } from "../watch-Bpci3hBY.js";
 //#region src/cli/plugin.ts
 const PHASE_BUILD = "phase-production-build";
 const PHASE_DEV = "phase-development-server";

package/dist/{openapi-BGeuunWC.js → openapi-CuePQL4z.js}

@@ -7,7 +7,7 @@ import { a as loadModule, n as asPolicy, s as pickNamed, t as asPermissionTree }
 import { t as shortDiff } from "./text-diff-BtfSmdUo.js";
 import { c as openapiVersion, o as createPermDock } from "./openapi-BOsx0xn9.js";
 import { i as fileDrift } from "./output-files-BIQ_9pIs.js";
-import { n as validateOverlay, t as validateOpenapi } from "./schema-BTsE1WRT.js";
+import { n as validateOverlay, t as validateOpenapi } from "./schema-CQzIJdEd.js";
 import { existsSync } from "node:fs";
 import { resolve } from "node:path";
 //#region src/cli/openapi/openapi.ts

package/dist/{openapi-BIpw3Mb7.js → openapi-gMQQSzNn.js}

@@ -80,7 +80,7 @@ const emit = defineLeaf({
 		}
 	},
 	async run(ctx, { flags }) {
-		return (await import("./openapi-BGeuunWC.js")).runOpenapi({
+		return (await import("./openapi-CuePQL4z.js")).runOpenapi({
 			cwd: ctx.cwd,
 			config: ctx.config,
 			rest: ["emit"],
@@ -122,7 +122,7 @@ const importDocument = defineLeaf({
 	async run(ctx, { flags }) {
 		const doc = given(flags.doc);
 		if (doc === void 0) throw missingInput("openapi import", ["--doc"], "the OpenAPI document to import");
-		return (await import("./import-ACkOrv6g.js")).runOpenapiImport({
+		return (await import("./import-t1yqnCyG.js")).runOpenapiImport({
 			cwd: ctx.cwd,
 			doc,
 			out: fileOut("openapi import", flags.out),

package/dist/{output-DV5dwOTs.js → output-CtyBwTNB.js}

@@ -1,5 +1,5 @@
 import { s as cliVersion } from "./version-DMQ0dnN5.js";
-import { t as DOCS_BASE } from "./manifest-B2QPh19C.js";
+import { t as DOCS_BASE } from "./manifest-Cav1rjNQ.js";
 //#region src/cli/core/output.ts
 const CLI_RESULT_SCHEMA = "https://permdock.com/schemas/cli-result-v1.json";
 function envelope(input) {

package/dist/{ownership-DA5YdYTm.js → ownership-qqBuGJXr.js}

@@ -9,9 +9,9 @@ import { r as relationCondition, t as inheritCondition } from "./grantee-conditi
 import { i as configError } from "./errors-Vpu6rKHl.js";
 import { i as qualifySqlTable } from "./sql-0WjxIp9g.js";
 import { a as scopeMembershipTable, i as scopeColumn, s as relatedSql } from "./compile-EzEMB-7v.js";
-import { l as roleColumn } from "./sources-CMAM-2A3.js";
-import { A as quoteQualified, D as qualified, E as helperSchema, L as sqlType, M as textArrayLiteral, O as quoteIdent, R as tenantTypeOf, S as CLAIM, T as declaredArray, _ as subjectClaimJsonSql, b as tenantClaimSql, d as keyTenantSql, f as kindFilterSql, h as roleKindSql, j as quoteTable, k as quoteLiteral, m as memberVia, p as liveSessionSql, s as signedIn, t as CUSTOM_ROLES, u as globalKindFilterSql, v as subjectClaimSql, y as subjectIdSql } from "./shared-Afctg7B0.js";
-import { $ as graphSqlText, A as claimKeptLines, B as hasCustomRoleChecksFor, F as globalRoleRows, I as membershipRows, L as roleRows, M as memberColumn, N as sourceFilters, P as sourcesKeep, U as storedTenant, X as CLOSURE, Z as graphHelper, _t as activeMembershipSql, c as holderSources, ct as memberIdsHelper, d as sourceRowsSql, f as sourceTransferTriggerSql, g as OWNERSHIP, gt as activeInstancesSql, h as ASSIGNMENTS, ht as scopeTable, it as linkHelper, j as disabledColumn, l as pairsSql, m as transferTriggerSql, mt as scopeSources, nt as inheritedRowsHelper, p as holdersTriggerSql, pt as restrictedHelper, st as memberForTable, u as sourceHoldersTriggerSql, ut as memberRoleOf, yt as activeUserSql } from "./tables-BqrxBCir.js";
+import { l as roleColumn } from "./sources-C4vkzZJV.js";
+import { A as quoteQualified, D as qualified, E as helperSchema, L as sqlType, M as textArrayLiteral, O as quoteIdent, R as tenantTypeOf, S as CLAIM, T as declaredArray, _ as subjectClaimJsonSql, b as tenantClaimSql, d as keyTenantSql, f as kindFilterSql, h as roleKindSql, j as quoteTable, k as quoteLiteral, m as memberVia, p as liveSessionSql, s as signedIn, t as CUSTOM_ROLES, u as globalKindFilterSql, v as subjectClaimSql, y as subjectIdSql } from "./shared-DrGLwM3s.js";
+import { $ as graphSqlText, A as claimKeptLines, B as hasCustomRoleChecksFor, F as globalRoleRows, I as membershipRows, L as roleRows, M as memberColumn, N as sourceFilters, P as sourcesKeep, U as storedTenant, X as CLOSURE, Z as graphHelper, _t as activeMembershipSql, c as holderSources, ct as memberIdsHelper, d as sourceRowsSql, f as sourceTransferTriggerSql, g as OWNERSHIP, gt as activeInstancesSql, h as ASSIGNMENTS, ht as scopeTable, it as linkHelper, j as disabledColumn, l as pairsSql, m as transferTriggerSql, mt as scopeSources, nt as inheritedRowsHelper, p as holdersTriggerSql, pt as restrictedHelper, st as memberForTable, u as sourceHoldersTriggerSql, ut as memberRoleOf, yt as activeUserSql } from "./tables-DimBcVWY.js";
 //#region src/cli/sql/conditions.ts
 const MAX_CLAIM_DEPTH = 8;
 /**

package/dist/{postgrest-5Dr3W64L.js → postgrest-DAxFltvO.js}

@@ -5,7 +5,7 @@ import { t as anonymousSubject } from "./subject-BGoM5o8B.js";
 import { t as readClaim } from "./claims-map-CKkoAAYF.js";
 import { t as clientNameOf } from "./clients-DYr3U86j.js";
 import "./budget-BELja5A9.js";
-import { a as hookApiNames } from "./sources-CMAM-2A3.js";
+import { a as hookApiNames } from "./sources-C4vkzZJV.js";
 //#region src/supabase/subject.ts
 const REGISTERED = /* @__PURE__ */ new Set([
 	"sub",

package/dist/powersync-6vgKevSi.js

@@ -0,0 +1 @@
+export { n as runPowerSync } from "./powersync-CD8-Ypao.js";

package/dist/{powersync-Bg8u-JcR.js → powersync-CBcsEvdr.js}

@@ -14,7 +14,7 @@ const generate = defineLeaf({
 	async run(ctx, { flags }) {
 		const out = fileOut("powersync", flags.out);
 		const from = given(flags.policy);
-		const { runPowerSync } = await import("./powersync-B701tvhE.js");
+		const { runPowerSync } = await import("./powersync-6vgKevSi.js");
 		return runPowerSync({
 			cwd: ctx.cwd,
 			config: ctx.config,
@@ -45,7 +45,7 @@ const verify = defineLeaf({
 		const db = await dbUrl(ctx, flags, { required: true });
 		const fixtures = given(flags.fixtures);
 		const from = given(flags.policy);
-		const { runPowerSync } = await import("./powersync-B701tvhE.js");
+		const { runPowerSync } = await import("./powersync-6vgKevSi.js");
 		return runPowerSync({
 			cwd: ctx.cwd,
 			config: ctx.config,