Agent notes
Why every app route carries about 0.9 MB of access snapshot in its HTML, and the PermDock changes that would remove it.
Every HTML response of the SaaS app inlines the PermDock access snapshot twice. This page records the measurement and proposes the PermDock library changes that fix it. CentraKit keeps the app unchanged until the library offers them, because the two obvious app-side cuts are not safe.
Measured on the hosted develop deployment as test@example.com, a platform admin with 11 organization memberships, on 7 November 2026.
| Route | HTML size |
|---|---|
/brinkman-almen/ | 1,246,077 |
/brinkman-almen/orders | 1,468,543 |
/brinkman-almen/products | 1,795,657 |
On the orders route the Flight payload holds two script chunks of 458,644 characters each. Both are the same snapshot, written under two row ids, one for the provider around the shell and one for the provider around the sidebar. Together they are 917 KB of the 1.47 MB response. The markup outside scripts is another 401 KB.
Inside one snapshot, grants is 393,838 characters of the 458,644. It is an array of 2,209 objects such as {"permission":"platform.admin.access","effect":"allow","role":"platform-admin","to":{"kind":"role","role":"platform-admin","scope":"global"}}. Almost all of these rows come from the static policy, not from the user, and the vocabulary (1,329 characters) already carries the role names. tenants is only 430 characters, so the size does not grow with the number of organizations.
1bd9fcca6. The outer provider renders before the snapshot settles, so the server sidebar loses Inbox and Chats while the browser adopts the settled snapshot.getSnapshot a stable identity, for example the value of issuedAt plus sessionId, and let a nested PermDockProvider that receives the same promise reuse the parent store instead of serializing a second copy. This removes 459 KB per route without touching the hydration order.omitStatic: true. Grants that come straight from the policy are identical for every user with the same role, so the client can compute them from the shared policy bundle, which the browser caches, and the snapshot carries only memberships and exceptions.Change 1 alone halves the cost, and change 2 or 3 brings the snapshot under 60 KB. When the library ships them, CentraKit updates the permdock dependency, removes the second provider only if the nested reuse is not offered, and measures the three routes above again.
Last updated on