@happyvertical/smrt-users 0.53.1 → 0.53.2

package/dist/manifest.json

@@ -2,7 +2,7 @@
   "version": "1.0.0",
   "timestamp": 0,
   "packageName": "@happyvertical/smrt-users",
-  "packageVersion": "0.53.1",
+  "packageVersion": "0.53.2",
   "objects": {
     "@happyvertical/smrt-users:AccessRequestCollection": {
       "name": "accessrequestcollection",
@@ -2469,23 +2469,24 @@
         },
         "indexes": [
           {
-            "name": "role_permissions_slug_context_idx",
+            "name": "role_permissions_role_id_permission_id_idx",
             "columns": [
-              "slug",
-              "context"
+              "role_id",
+              "permission_id"
             ],
             "unique": true
           },
           {
-            "name": "role_permissions_created_at_idx",
+            "name": "role_permissions_slug_context_idx",
             "columns": [
-              "created_at"
+              "slug",
+              "context"
             ]
           },
           {
-            "name": "role_permissions_role_id_idx",
+            "name": "role_permissions_created_at_idx",
             "columns": [
-              "role_id"
+              "created_at"
             ]
           },
           {
@@ -6201,7 +6202,8 @@
           "required": true,
           "related": "Role",
           "_meta": {
-            "required": true
+            "required": true,
+            "onDelete": "NO ACTION"
           }
         },
         "permissionId": {
@@ -6209,7 +6211,8 @@
           "required": true,
           "related": "Permission",
           "_meta": {
-            "required": true
+            "required": true,
+            "onDelete": "NO ACTION"
           }
         }
       },
@@ -6227,7 +6230,11 @@
             "get"
           ]
         },
-        "cli": true
+        "cli": true,
+        "conflictColumns": [
+          "role_id",
+          "permission_id"
+        ]
       },
       "extends": "SmrtObject",
       "exportName": "RolePermission",
@@ -6300,23 +6307,24 @@
         },
         "indexes": [
           {
-            "name": "role_permissions_slug_context_idx",
+            "name": "role_permissions_role_id_permission_id_idx",
             "columns": [
-              "slug",
-              "context"
+              "role_id",
+              "permission_id"
             ],
             "unique": true
           },
           {
-            "name": "role_permissions_created_at_idx",
+            "name": "role_permissions_slug_context_idx",
             "columns": [
-              "created_at"
+              "slug",
+              "context"
             ]
           },
           {
-            "name": "role_permissions_role_id_idx",
+            "name": "role_permissions_created_at_idx",
             "columns": [
-              "role_id"
+              "created_at"
             ]
           },
           {

package/dist/migrations/deduplicateRolePermissions.d.ts

@@ -0,0 +1,23 @@
+import type { DatabaseInterface } from '@happyvertical/sql';
+/** Options for the explicit, maintenance-window grant migration. */
+export interface DeduplicateRolePermissionsOptions {
+    /** Inspect the duplicate count without changing rows or indexes. */
+    dryRun?: boolean;
+    /** Confirm all application writers and seeders are stopped. */
+    maintenanceConfirmed?: boolean;
+}
+/** Result of the grant migration; removed is zero for a dry run. */
+export interface DeduplicateRolePermissionsResult {
+    duplicates: number;
+    removed: number;
+}
+/**
+ * Keep the oldest grant for each role/permission pair and install its unique
+ * index. Run BEFORE ordinary schema migration, with every writer stopped;
+ * old application versions cannot safely seed against the new constraint.
+ * Equal timestamps use the lowest id; null timestamps sort last. The surviving
+ * row is unchanged. Deletion, index creation and change notification commit
+ * together, so failure leaves the old grants intact. Re-running is safe.
+ */
+export declare function deduplicateRolePermissions(db: DatabaseInterface, options?: DeduplicateRolePermissionsOptions): Promise<DeduplicateRolePermissionsResult>;
+//# sourceMappingURL=deduplicateRolePermissions.d.ts.map

package/dist/migrations/deduplicateRolePermissions.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"deduplicateRolePermissions.d.ts","sourceRoot":"","sources":["../../src/migrations/deduplicateRolePermissions.ts"],"names":[],"mappings":"AAMA,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,oBAAoB,CAAC;AAE5D,oEAAoE;AACpE,MAAM,WAAW,iCAAiC;IAChD,oEAAoE;IACpE,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,+DAA+D;IAC/D,oBAAoB,CAAC,EAAE,OAAO,CAAC;CAChC;AAED,oEAAoE;AACpE,MAAM,WAAW,gCAAgC;IAC/C,UAAU,EAAE,MAAM,CAAC;IACnB,OAAO,EAAE,MAAM,CAAC;CACjB;AASD;;;;;;;GAOG;AACH,wBAAsB,0BAA0B,CAC9C,EAAE,EAAE,iBAAiB,EACrB,OAAO,GAAE,iCAAsC,GAC9C,OAAO,CAAC,gCAAgC,CAAC,CA0C3C"}

package/dist/models/RolePermission.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"RolePermission.d.ts","sourceRoot":"","sources":["../../src/models/RolePermission.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,EAEL,UAAU,EACV,KAAK,iBAAiB,EAEvB,MAAM,0BAA0B,CAAC;AAElC;;GAEG;AACH,MAAM,WAAW,qBAAsB,SAAQ,iBAAiB;IAC9D,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAED;;;;;;;;;;;;;;;GAeG;AACH,qBAQa,cAAe,SAAQ,UAAU;IAC5C;;OAEG;IAEH,MAAM,CAAC,EAAE,MAAM,CAAC;IAEhB;;OAEG;IAEH,YAAY,CAAC,EAAE,MAAM,CAAC;gBAEV,OAAO,GAAE,qBAA0B;CAMhD"}
+{"version":3,"file":"RolePermission.d.ts","sourceRoot":"","sources":["../../src/models/RolePermission.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,EAEL,UAAU,EACV,KAAK,iBAAiB,EAEvB,MAAM,0BAA0B,CAAC;AAElC;;GAEG;AACH,MAAM,WAAW,qBAAsB,SAAQ,iBAAiB;IAC9D,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAED;;;;;;;;;;;;;;;GAeG;AACH,qBAUa,cAAe,SAAQ,UAAU;IAC5C;;OAEG;IAEH,MAAM,CAAC,EAAE,MAAM,CAAC;IAEhB;;OAEG;IAEH,YAAY,CAAC,EAAE,MAAM,CAAC;gBAEV,OAAO,GAAE,qBAA0B;CAMhD"}

package/dist/smrt-knowledge.json

@@ -3,14 +3,14 @@
   "sensitiveFieldsExcluded": true,
   "generatedAt": "1970-01-01T00:00:00.000Z",
   "packageName": "@happyvertical/smrt-users",
-  "packageVersion": "0.53.1",
+  "packageVersion": "0.53.2",
   "sourceManifestPath": "dist/manifest.json",
   "agentDocPath": "AGENTS.md",
   "sourceHashes": {
-    "manifest": "fc68ca0cea3daeb52ea7c4e0fd986ecb9be9990bf55a8a6172012c05b1ad0bf7",
-    "packageJson": "630c651ff5e1838c32455ff53bcdd11cf356421b0fe342fcf717b86b449c0929",
+    "manifest": "5797e206986b4434600dc15517fbdad2edb04b0aabccc666df3d2c86c49beb16",
+    "packageJson": "885471aa0e4cb4c00f2b10dcc39f9474efeffcdc297ddef079442434bfed5923",
     "agents": "c1bd1dcae5f1662f31d01d0cff19cb3f774715eb71ecfd249eb429e5f64a3eb7",
-    "moduleDoc:agents/permissions.md": "6797e8c1cac7f1af34611b7b0a7a53e61806cab250ea1afb1a820356b7d2b233",
+    "moduleDoc:agents/permissions.md": "5f6c0afab7e1fd0887b0d29b5a5b5ab2635694207bade70145d3cbfdb62ba78c",
     "moduleDoc:agents/oidc-provisioning.md": "5efa607ff23b9a693391e0c02670324a8cea4114d4968c9718f10a763da919c6",
     "moduleDoc:agents/mobile-auth.md": "25e85e83f43e3a46383a92fa809f3a003b4545c3026e78dbe1bccbbc35161e18",
     "moduleDoc:agents/terminal-auth-testing.md": "8a84c16a19e381427aed81d3b1882344c427fe22a70e87f5ac2db836b1a6822d",
@@ -5665,6 +5665,10 @@
         }
       ],
       "methods": [],
+      "conflictColumns": [
+        "role_id",
+        "permission_id"
+      ],
       "surfaces": [
         {
           "kind": "api",
@@ -10591,7 +10595,7 @@
     {
       "path": "agents/permissions.md",
       "module": "permissions",
-      "content": "# Permissions and tenant inheritance\n\nRead for `src/services/PermissionResolver.ts`, operation guards, role seeding,\nRLS, and tenant-hierarchy changes. Integration examples live in README's\nmanifest-derived permission catalog and PostgreSQL RLS sections.\n\n## Membership selection\n\n1. A direct target-tenant membership pins resolution: active resolves normally;\n   pending/suspended returns empty. Never union direct and ancestor roles.\n2. Otherwise walk hierarchyPath nearest-first for the nearest active ancestor\n   membership whose role has inheritsToDescendants. Skip inactive/unflagged\n   ancestors; they neither grant nor block. No qualifying ancestor means empty.\n3. Run later layers against the target tenant. Only target-tenant groups apply;\n   membership overrides travel with the chosen ancestor membership.\n   inheritedFromTenantId reports that ancestor, null for direct resolution.\n\nVerify hierarchyPath link-by-link against loaded parentTenantId rows before\ntrusting it: excess depth, self-reference, duplicates or inconsistent paths\nfail closed. Bound traversal by MAX_TENANT_HIERARCHY_DEPTH. Tenant status is not\nconsulted, matching direct resolution. Long-lived user/tenant caches must\ninvalidate ancestor membership changes and inheritsToDescendants flips;\nrequest-scoped caches do not survive those requests.\n\n`loadSessionContext().tenantAuthorization` is authoritative for required-tenant\nconsumers; membership null can mean inherited authority.\n\n4. If no membership resolved at all, apply the opt-in ancestor-read policy\n   (smrt#2939): the user's ACTIVE memberships on VERIFIED DESCENDANTS of the\n   target, whose role slug is declared in `permissions.ancestorRead.roles` and\n   within `maxDepth` hops, contribute `<collection>.read` for declared\n   collections, intersected with BOTH that role's own catalog grants (so a\n   descendant-side tenant GRANT, group role, or membership GRANT cannot widen\n   it) AND the principal's effective permissions in that descendant (so its\n   DENY cascade and membership DENY apply). Only a SYSTEM\n   role (`tenantId` null, `isSystem: true`) matches a declared slug: slugs are\n   not unique across a hierarchy, so a tenant-scoped custom role of the same\n   name must not opt its tenant in. Off by default;\n   read-only; never lateral; never reached when a direct or inherited\n   membership already decided. The target tenant's DENY still subtracts.\n   `ancestorReadFromTenantIds` reports the contributing descendants. The grant\n   carries no membership, so `membershipId`/`tenantAuthorization.membershipId`\n   stay null and a consumer requiring a non-empty membership still refuses.\n\n## Permission precedence\n\nApply these layers in order, later layers overriding earlier ones:\n\n1. Ancestor TenantPermissionOverride cascade (GRANT adds, DENY removes).\n2. Selected membership role permissions.\n3. Target-tenant group-role permissions.\n4. Tenant cascade's net DENY removes role/group grants.\n5. Membership GRANT may re-add a tenant-denied slug.\n6. Membership DENY removes last and always wins.\n\nThe tenant block is the cascade's net result, not the union of historical DENYs:\na child's more-specific GRANT can override a parent DENY. Use a direct child\nmembership or tenant DENY to attenuate inherited role authority.\n`getGroupIdsForTenant(userId, tenantId)` is required; getGroupIds is cross-tenant.\n\n## Hierarchies and seeding\n\n- `Tenant.save()` derives hierarchyPath/hierarchyLevel from the REAL\n  parentTenantId chain on every save (never from an ancestor's stored path),\n  refuses missing parents, cycles and over-depth before writing, and\n  re-materializes descendants by raw column update (so STI subclass columns\n  are never clobbered). createChild/moveToParent/makeRoot are thin wrappers.\n  `materializeTenantHierarchy(db, { dryRun })` / `smrt\n  db:materialize-tenant-hierarchy` backfills legacy rows: idempotent, one\n  transaction, refuses a broken chain without writing (#3036). A NEW or\n  CHANGED parent link is authority-bearing, so `Tenant.save()` first loads the\n  parent through TenantCollection (the caller's tenancy scope) and refuses an\n  invisible one on every path — helpers, `create({ parentTenantId })`, or a\n  plain assignment + save; system context bypasses as usual, and an unchanged\n  link is never re-checked. getTree(rootId?)\n  returns UI structure. Maximum depth is 10.\n- Tenant override cascade requires parent cascadePermissions and child\n  inheritPermissions. These flags do not gate the independent, per-role\n  inheritsToDescendants membership flow.\n- `permissions.ancestorRead` in the `users` package config declares upward,\n  read-only visibility: `{ roles, collections, maxDepth? }`. Both lists are\n  required and non-empty and `maxDepth >= 1`, else the policy is OFF — there is\n  no partially valid declaration. `isAncestorReadableSlug()` is the single place\n  the read-only bound is enforced; only a two-segment `<collection>.<action>`\n  slug whose action normalizes to `read` on a declared collection passes.\n  `PermissionResolver.create(options, { ancestorReadPolicy })` binds one\n  resolver; `null` forces it off. It grants the OPERATION at the ancestor, never\n  row visibility — sibling rows stay scoped by the tenancy interceptor and RLS.\n- seedSystemRoles({ inheritsToDescendants: ['owner', 'admin'] }) flags listed\n  slugs additively, never unflags omitted ones, and rejects unknown slugs.\n  Default seeds are exact-tenant.\n- RolePermissionCollection.seedRolePermissions() or\n  seedSystemRoles({ seedPermissions: true }) maps owner/admin to all catalog\n  permissions, member to ordinary-resource read/create, viewer to read. Member\n  create excludes identity/RBAC/security resources and their joins/overrides.\n  Seeding is additive/idempotent; removal requires prune: true. Catalog sync\n  and grants plan from one read, then commit in `SEEDING_BATCH_SIZE` batches\n  (#3323): never one durable commit per row (an fsync each on local SQLite),\n  and never one catalog-wide transaction (`@happyvertical/sql` transaction\n  scopes cost superlinearly per statement). Pass a caller transaction's handle.\n- When a package adds built-in self-personalization permissions after role\n  creation, explicitly call seedDefaultRolePersonalizationPermissions(). It\n  upgrades owner/admin/member/viewer idempotently and never grants custom roles.\n\n## Guards and RLS\n\nPermissionCatalogService derives collection.action slugs from manifests,\nincluding custom actions; list/get map to read. Guards derive a class's slug\nthrough the same resolution (explicit `collection`, manifest entry, then its\nSTI base's), so an STI subtype resolves its STI base's collection\n(`Network extends Tenant` -> `tenants.update`) in every build, including a\nbundle decorated before its manifest loads (#3125). Hand-written mutations in form\nhandlers, endpoints, CLI and jobs use assertOperationPermission(). It requires\ncatalog presence then resolves permissions, throwing fail-closed by default.\nUse onDeny: 'return', checkOperationPermission or hasOperationPermission only\nwhen the caller handles a structured/boolean denial.\n\nGenerated SvelteKit write routes (POST/PUT/PATCH/DELETE CRUD and mutating\ncustom actions) enforce the same `collection.action` slug (custom actions use\n`collection.<method>`; actions hosted on a collection class use the item collection, which the catalog now emits) after authentication: the slug must be in the request's\nsession permission snapshot (`locals.permissions`/`permissionSet`/\n`smrtPermissions` or `locals.tenantContext.permissions`), otherwise 403. Only\n`locals.tenantContext.superAdminBypass` skips it; `api.public: true` stays open.\n\nResource-anchored guards receive the resource tenant ID. When it differs from\nthe session tenant, omit the session membership so the resolver selects the\nappropriate authority; mismatched supplied membership/tenant fails closed.\nInherited root-admin authority can then authorize descendant resources without\napplication-side membership fan-out.\n\nResolution cost must not scale with catalog size in objects (#3047): role →\npermission ids and ids → slugs are `list({ select })` projection reads (the\ncollections' beforeList interceptors still run; no RolePermission/Permission\nis hydrated), so an owner mapped to the whole catalog costs two queries and\nno per-permission objects. Keep new resolver reads projections when only ids\nor slugs are needed, and do not add public collection methods for them — each\nbecomes a custom-action slug in the manifest-derived catalog. The resolver's\ncollections never inherit `defaultListLimit`/`maxListLimit` from the caller's\noptions, and id-list reads chunk at `IN_LIST_CHUNK_SIZE` with an explicit\nlimit: a truncated authorization read would narrow the result silently.\n`issue-3047-permission-resolution-cost-postgres.test.ts` pins the hydration\nbudget and a golden equivalence matrix recorded on the hydrating resolver.\n\nThe same rule holds for every framework-internal authorization read (#3048):\ncollections that back a decision — the resolver's, the ResourceGrant exact-tuple\nread in `checkResourceOperationPermission()` (DENY wins only if every row is\nread), and TenantService's owned-tenant quota count — are created through\n`withoutListBounds()` (`src/services/authorization-read-options.ts`), which\nstrips only the caller's list bounds. Use it for any new decision read;\n`issue-3048-authorization-list-bounds-postgres.test.ts` pins it.\n\nPermissionResolver runs every resolution inside smrt-tenancy's system context\n(#3036). Its reads are deliberately cross-tenant and framework-owned — the\nancestor TenantPermissionOverride batch, ancestor memberships for\ninheritsToDescendants, descendant memberships for ancestor-read — and are keyed\nby the explicit (userId, tenantId); with those classes registered tenant-scoped\n(`autoFilter`) the consumer's filter otherwise threw TenantIsolationError or\nsilently narrowed them. It returns slugs and ids only, never rows, and the\ncaller's own reads stay filtered. Do not move a resolver read back under the\nambient tenant; the Postgres regression suite\n`issue-3036-hierarchy-resolution-postgres.test.ts` pins this. Because nothing\nbackstops those reads any more, the tenant-override cascade verifies its chain\ntoo: it uses hierarchyPath only when it agrees link-by-link with\nparentTenantId, otherwise walks the real parent links (so a forged path cannot\ncascade an unrelated tenant in, and a never-materialized row still gets its real\nancestors' DENYs — and GRANTs), and throws TenantHierarchyError on a broken\nreal chain: a per-request failure for that tenant's whole subtree, which\n`smrt db:materialize-tenant-hierarchy --dry-run` reports ahead of time (see\nREADME \"Upgrading an existing fleet\").\n`getTenantInheritanceChain()` returns Tenant rows, so it is NOT run in system\ncontext; it reports the same verified chain the cascade applies when the\ncaller can read every ancestor. Otherwise it never reports PARENT_NOT_FOUND\nfor a row the caller simply cannot see: an interceptor refusal surfaces as\nTenantIsolationError, and a silently filtered row (e.g. RLS) ends the chain at\nthe nearest readable ancestor. Descendant path rewrites are raw column updates recorded through\n`bumpChangeFeed`; `updated_at` is intentionally not bumped (derived columns;\nevery save recomputes them). They are not atomic with the moving row's save —\nan interrupted subtree fails closed until re-saved or backfilled.\n\nSystem context and super-admin bypass are honored. Pass\nallowSuperAdminBypass: false for money or separation-of-duties operations that\nrequire an explicit grant.\n\ngeneratePostgresPermissionSql/applyPostgresPermissionPolicies enforce generated\nRLS using smrt.permissions and smrt.tenant_id, installed with set_config by\nwithSessionPermissionContext. This bounds REST, MCP and in-process database\naccess once principal context is set. Child-tenant sessions receive resolved\ninherited permissions automatically, but RLS row filtering remains bound to the\nsession tenant: a root session's app-level guard authorization does not itself\npermit child rows through RLS. Preserve this distinction.\n"
+      "content": "# Permissions and tenant inheritance\n\nRead for `src/services/PermissionResolver.ts`, operation guards, role seeding,\nRLS, and tenant-hierarchy changes. Integration examples live in README's\nmanifest-derived permission catalog and PostgreSQL RLS sections.\n\n## Membership selection\n\n1. A direct target-tenant membership pins resolution: active resolves normally;\n   pending/suspended returns empty. Never union direct and ancestor roles.\n2. Otherwise walk hierarchyPath nearest-first for the nearest active ancestor\n   membership whose role has inheritsToDescendants. Skip inactive/unflagged\n   ancestors; they neither grant nor block. No qualifying ancestor means empty.\n3. Run later layers against the target tenant. Only target-tenant groups apply;\n   membership overrides travel with the chosen ancestor membership.\n   inheritedFromTenantId reports that ancestor, null for direct resolution.\n\nVerify hierarchyPath link-by-link against loaded parentTenantId rows before\ntrusting it: excess depth, self-reference, duplicates or inconsistent paths\nfail closed. Bound traversal by MAX_TENANT_HIERARCHY_DEPTH. Tenant status is not\nconsulted, matching direct resolution. Long-lived user/tenant caches must\ninvalidate ancestor membership changes and inheritsToDescendants flips;\nrequest-scoped caches do not survive those requests.\n\n`loadSessionContext().tenantAuthorization` is authoritative for required-tenant\nconsumers; membership null can mean inherited authority.\n\n4. If no membership resolved at all, apply the opt-in ancestor-read policy\n   (smrt#2939): the user's ACTIVE memberships on VERIFIED DESCENDANTS of the\n   target, whose role slug is declared in `permissions.ancestorRead.roles` and\n   within `maxDepth` hops, contribute `<collection>.read` for declared\n   collections, intersected with BOTH that role's own catalog grants (so a\n   descendant-side tenant GRANT, group role, or membership GRANT cannot widen\n   it) AND the principal's effective permissions in that descendant (so its\n   DENY cascade and membership DENY apply). Only a SYSTEM\n   role (`tenantId` null, `isSystem: true`) matches a declared slug: slugs are\n   not unique across a hierarchy, so a tenant-scoped custom role of the same\n   name must not opt its tenant in. Off by default;\n   read-only; never lateral; never reached when a direct or inherited\n   membership already decided. The target tenant's DENY still subtracts.\n   `ancestorReadFromTenantIds` reports the contributing descendants. The grant\n   carries no membership, so `membershipId`/`tenantAuthorization.membershipId`\n   stay null and a consumer requiring a non-empty membership still refuses.\n\n## Permission precedence\n\nApply these layers in order, later layers overriding earlier ones:\n\n1. Ancestor TenantPermissionOverride cascade (GRANT adds, DENY removes).\n2. Selected membership role permissions.\n3. Target-tenant group-role permissions.\n4. Tenant cascade's net DENY removes role/group grants.\n5. Membership GRANT may re-add a tenant-denied slug.\n6. Membership DENY removes last and always wins.\n\nThe tenant block is the cascade's net result, not the union of historical DENYs:\na child's more-specific GRANT can override a parent DENY. Use a direct child\nmembership or tenant DENY to attenuate inherited role authority.\n`getGroupIdsForTenant(userId, tenantId)` is required; getGroupIds is cross-tenant.\n\n## Hierarchies and seeding\n\n- `Tenant.save()` derives hierarchyPath/hierarchyLevel from the REAL\n  parentTenantId chain on every save (never from an ancestor's stored path),\n  refuses missing parents, cycles and over-depth before writing, and\n  re-materializes descendants by raw column update (so STI subclass columns\n  are never clobbered). createChild/moveToParent/makeRoot are thin wrappers.\n  `materializeTenantHierarchy(db, { dryRun })` / `smrt\n  db:materialize-tenant-hierarchy` backfills legacy rows: idempotent, one\n  transaction, refuses a broken chain without writing (#3036). A NEW or\n  CHANGED parent link is authority-bearing, so `Tenant.save()` first loads the\n  parent through TenantCollection (the caller's tenancy scope) and refuses an\n  invisible one on every path — helpers, `create({ parentTenantId })`, or a\n  plain assignment + save; system context bypasses as usual, and an unchanged\n  link is never re-checked. getTree(rootId?)\n  returns UI structure. Maximum depth is 10.\n- Tenant override cascade requires parent cascadePermissions and child\n  inheritPermissions. These flags do not gate the independent, per-role\n  inheritsToDescendants membership flow.\n- `permissions.ancestorRead` in the `users` package config declares upward,\n  read-only visibility: `{ roles, collections, maxDepth? }`. Both lists are\n  required and non-empty and `maxDepth >= 1`, else the policy is OFF — there is\n  no partially valid declaration. `isAncestorReadableSlug()` is the single place\n  the read-only bound is enforced; only a two-segment `<collection>.<action>`\n  slug whose action normalizes to `read` on a declared collection passes.\n  `PermissionResolver.create(options, { ancestorReadPolicy })` binds one\n  resolver; `null` forces it off. It grants the OPERATION at the ancestor, never\n  row visibility — sibling rows stay scoped by the tenancy interceptor and RLS.\n- seedSystemRoles({ inheritsToDescendants: ['owner', 'admin'] }) flags listed\n  slugs additively, never unflags omitted ones, and rejects unknown slugs.\n  Default seeds are exact-tenant.\n- RolePermissionCollection.seedRolePermissions() or\n  seedSystemRoles({ seedPermissions: true }) maps owner/admin to all catalog\n  permissions, member to ordinary-resource read/create, viewer to read. Member\n  create excludes identity/RBAC/security resources and their joins/overrides.\n  Seeding is additive/idempotent; removal requires prune: true. Catalog sync\n  and grants plan from one read, then commit in `SEEDING_BATCH_SIZE` batches\n  (#3323): never one durable commit per row (an fsync each on local SQLite),\n  and never one catalog-wide transaction (`@happyvertical/sql` transaction\n  scopes cost superlinearly per statement). Pass a caller transaction's handle.\n- When a package adds built-in self-personalization permissions after role\n  creation, explicitly call seedDefaultRolePersonalizationPermissions(). It\n  upgrades owner/admin/member/viewer idempotently and never grants custom roles.\n\n## Guards and RLS\n\nPermissionCatalogService derives collection.action slugs from manifests,\nincluding custom actions; list/get map to read. Guards derive a class's slug\nthrough the same resolution (explicit `collection`, manifest entry, then its\nSTI base's), so an STI subtype resolves its STI base's collection\n(`Network extends Tenant` -> `tenants.update`) in every build, including a\nbundle decorated before its manifest loads (#3125). Hand-written mutations in form\nhandlers, endpoints, CLI and jobs use assertOperationPermission(). It requires\ncatalog presence then resolves permissions, throwing fail-closed by default.\nUse onDeny: 'return', checkOperationPermission or hasOperationPermission only\nwhen the caller handles a structured/boolean denial.\n\nGenerated SvelteKit write routes (POST/PUT/PATCH/DELETE CRUD and mutating\ncustom actions) enforce the same `collection.action` slug (custom actions use\n`collection.<method>`; actions hosted on a collection class use the item collection, which the catalog now emits) after authentication: the slug must be in the request's\nsession permission snapshot (`locals.permissions`/`permissionSet`/\n`smrtPermissions` or `locals.tenantContext.permissions`), otherwise 403. Only\n`locals.tenantContext.superAdminBypass` skips it; `api.public: true` stays open.\n\nResource-anchored guards receive the resource tenant ID. When it differs from\nthe session tenant, omit the session membership so the resolver selects the\nappropriate authority; mismatched supplied membership/tenant fails closed.\nInherited root-admin authority can then authorize descendant resources without\napplication-side membership fan-out.\n\nResolution cost must not scale with catalog size in objects (#3047): role →\npermission ids and ids → slugs are `list({ select })` projection reads (the\ncollections' beforeList interceptors still run; no RolePermission/Permission\nis hydrated), so an owner mapped to the whole catalog costs two queries and\nno per-permission objects. Keep new resolver reads projections when only ids\nor slugs are needed, and do not add public collection methods for them — each\nbecomes a custom-action slug in the manifest-derived catalog. The resolver's\ncollections never inherit `defaultListLimit`/`maxListLimit` from the caller's\noptions, and id-list reads chunk at `IN_LIST_CHUNK_SIZE` with an explicit\nlimit: a truncated authorization read would narrow the result silently.\n`issue-3047-permission-resolution-cost-postgres.test.ts` pins the hydration\nbudget and a golden equivalence matrix recorded on the hydrating resolver.\n\nThe same rule holds for every framework-internal authorization read (#3048):\ncollections that back a decision — the resolver's, the ResourceGrant exact-tuple\nread in `checkResourceOperationPermission()` (DENY wins only if every row is\nread), and TenantService's owned-tenant quota count — are created through\n`withoutListBounds()` (`src/services/authorization-read-options.ts`), which\nstrips only the caller's list bounds. Use it for any new decision read;\n`issue-3048-authorization-list-bounds-postgres.test.ts` pins it.\n\nPermissionResolver runs every resolution inside smrt-tenancy's system context\n(#3036). Its reads are deliberately cross-tenant and framework-owned — the\nancestor TenantPermissionOverride batch, ancestor memberships for\ninheritsToDescendants, descendant memberships for ancestor-read — and are keyed\nby the explicit (userId, tenantId); with those classes registered tenant-scoped\n(`autoFilter`) the consumer's filter otherwise threw TenantIsolationError or\nsilently narrowed them. It returns slugs and ids only, never rows, and the\ncaller's own reads stay filtered. Do not move a resolver read back under the\nambient tenant; the Postgres regression suite\n`issue-3036-hierarchy-resolution-postgres.test.ts` pins this. Because nothing\nbackstops those reads any more, the tenant-override cascade verifies its chain\ntoo: it uses hierarchyPath only when it agrees link-by-link with\nparentTenantId, otherwise walks the real parent links (so a forged path cannot\ncascade an unrelated tenant in, and a never-materialized row still gets its real\nancestors' DENYs — and GRANTs), and throws TenantHierarchyError on a broken\nreal chain: a per-request failure for that tenant's whole subtree, which\n`smrt db:materialize-tenant-hierarchy --dry-run` reports ahead of time (see\nREADME \"Upgrading an existing fleet\").\n`getTenantInheritanceChain()` returns Tenant rows, so it is NOT run in system\ncontext; it reports the same verified chain the cascade applies when the\ncaller can read every ancestor. Otherwise it never reports PARENT_NOT_FOUND\nfor a row the caller simply cannot see: an interceptor refusal surfaces as\nTenantIsolationError, and a silently filtered row (e.g. RLS) ends the chain at\nthe nearest readable ancestor. Descendant path rewrites are raw column updates recorded through\n`bumpChangeFeed`; `updated_at` is intentionally not bumped (derived columns;\nevery save recomputes them). They are not atomic with the moving row's save —\nan interrupted subtree fails closed until re-saved or backfilled.\n\nSystem context and super-admin bypass are honored. Pass\nallowSuperAdminBypass: false for money or separation-of-duties operations that\nrequire an explicit grant.\n\ngeneratePostgresPermissionSql/applyPostgresPermissionPolicies enforce generated\nRLS using smrt.permissions and smrt.tenant_id, installed with set_config by\nwithSessionPermissionContext. This bounds REST, MCP and in-process database\naccess once principal context is set. Child-tenant sessions receive resolved\ninherited permissions automatically, but RLS row filtering remains bound to the\nsession tenant: a root session's app-level guard authorization does not itself\npermit child rows through RLS. Preserve this distinction.\n\nRolePermission's natural key is `(role_id, permission_id)` (#3329); repeated or\nconcurrent inserts converge without changing the grant ID. Existing deployments\nmust run `deduplicateRolePermissions()` with stopped writers before ordinary\nschema migration; see README's \"Upgrade duplicate role grants\". It keeps the\noldest row and installs uniqueness atomically. Runtime seeding never performs\nthis schema repair.\n"
     },
     {
       "path": "agents/oidc-provisioning.md",

package/dist/sveltekit.js

@@ -1,4 +1,4 @@
-import { C as OidcLoginService, D as resolveOidcProviderConfig, E as getUsersOidcConfig, S as OidcLoginError, T as encodeOidcTransaction, _ as readMobileBearerToken, a as TerminalAuthRateLimitError, g as MobileAuthService, h as MobileAuthError, i as TerminalAuthError, m as withSessionPermissionContext, o as TerminalAuthService, s as OperationPermissionError, v as validateMobileRedirectUri, w as decodeOidcTransaction, y as SessionService } from "./chunks/TerminalAuthService-DKDfXpDG.js";
+import { C as OidcLoginService, D as resolveOidcProviderConfig, E as getUsersOidcConfig, S as OidcLoginError, T as encodeOidcTransaction, _ as readMobileBearerToken, a as TerminalAuthRateLimitError, g as MobileAuthService, h as MobileAuthError, i as TerminalAuthError, m as withSessionPermissionContext, o as TerminalAuthService, s as OperationPermissionError, v as validateMobileRedirectUri, w as decodeOidcTransaction, y as SessionService } from "./chunks/TerminalAuthService-DG8HwPgq.js";
 import { DiscoveryArtifactValidationError, SMRT_APP_RESULT_CONTRACT, SMRT_APP_RESULT_SCHEMA, SMRT_APP_RESULT_VERSION, SMRT_DISCOVERY_CONFORMANCE_ARTIFACT_SCHEMA, SMRT_DISCOVERY_CONFORMANCE_SCHEMA, SMRT_DISCOVERY_CONFORMANCE_VERSION, SMRT_MCP_RESULT_METADATA_KEY, canonicalizeDiscoveryArtifact, createDiscoveryConformanceArtifact, deriveCommandRequirements, validateDiscoveryConformanceArtifact } from "./app-contract.js";
 import { ObjectRegistry, createClassNamePredicate, resolveCustomActionMetadata, resolveEffectiveActionMetadata } from "@happyvertical/smrt-core";
 import { createLogger } from "@happyvertical/logger";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@happyvertical/smrt-users",
-  "version": "0.53.1",
+  "version": "0.53.2",
   "smrtJsdoc": "strict",
   "description": "Multi-tenant user management for the SMRT framework - users, tenants, roles, permissions, groups",
   "type": "module",
@@ -48,18 +48,18 @@
   },
   "dependencies": {
     "@happyvertical/logger": "^0.98.0",
-    "@happyvertical/smrt-config": "0.53.1",
-    "@happyvertical/smrt-core": "0.53.1",
-    "@happyvertical/smrt-mobile-contract": "0.53.1",
-    "@happyvertical/smrt-profiles": "0.53.1",
-    "@happyvertical/smrt-tenancy": "0.53.1",
-    "@happyvertical/smrt-types": "0.53.1",
-    "@happyvertical/smrt-ui": "0.53.1",
+    "@happyvertical/smrt-config": "0.53.2",
+    "@happyvertical/smrt-core": "0.53.2",
+    "@happyvertical/smrt-mobile-contract": "0.53.2",
+    "@happyvertical/smrt-profiles": "0.53.2",
+    "@happyvertical/smrt-tenancy": "0.53.2",
+    "@happyvertical/smrt-types": "0.53.2",
+    "@happyvertical/smrt-ui": "0.53.2",
     "@happyvertical/sql": "^0.98.0",
     "jose": "^6.2.12"
   },
   "devDependencies": {
-    "@happyvertical/smrt-vitest": "0.53.1",
+    "@happyvertical/smrt-vitest": "0.53.2",
     "@sveltejs/package": "^2.5.8",
     "@sveltejs/vite-plugin-svelte": "^7.3.0",
     "@types/node": "24.13.6",
@@ -92,12 +92,12 @@
     "access": "public"
   },
   "scripts": {
-    "build": "vite build --mode library && svelte-package -i src/svelte -o dist/svelte --tsconfig tsconfig.svelte.json",
+    "build": "vite build --mode library && svelte-package -i src/svelte -o dist/svelte --tsconfig tsconfig.svelte.json && node ../../scripts/prune-svelte-package-artifacts.js dist",
     "build:watch": "vite build --mode library --watch",
     "clean": "rm -rf dist",
     "dev": "npm run build:watch",
     "test": "vitest run",
-    "test:postgres": "node ../../scripts/run-with-ci-postgres.mjs -- pnpm exec vitest run src/__tests__/permission-postgres-rls.test.ts src/__tests__/principal-permission-context-postgres.test.ts src/__tests__/oidc-provisioning-postgres.test.ts src/__tests__/legacy-user-profile-backfill-postgres.test.ts src/__tests__/terminal-auth-postgres.test.ts src/__tests__/resource-grant-postgres.test.ts src/__tests__/issue-3036-hierarchy-resolution-postgres.test.ts src/__tests__/issue-3047-permission-resolution-cost-postgres.test.ts src/__tests__/issue-3048-authorization-list-bounds-postgres.test.ts",
+    "test:postgres": "node ../../scripts/run-with-ci-postgres.mjs -- pnpm exec vitest run src/__tests__/permission-postgres-rls.test.ts src/__tests__/principal-permission-context-postgres.test.ts src/__tests__/oidc-provisioning-postgres.test.ts src/__tests__/legacy-user-profile-backfill-postgres.test.ts src/__tests__/terminal-auth-postgres.test.ts src/__tests__/resource-grant-postgres.test.ts src/__tests__/issue-3036-hierarchy-resolution-postgres.test.ts src/__tests__/issue-3047-permission-resolution-cost-postgres.test.ts src/__tests__/issue-3048-authorization-list-bounds-postgres.test.ts src/__tests__/issue-3329-concurrent-seeding-postgres.test.ts src/__tests__/issue-3329-grant-dedup.test.ts",
     "typecheck": "tsc --noEmit && node ../../scripts/svelte-check-a11y.mjs --tsconfig ./tsconfig.svelte.json",
     "check": "pnpm exec svelte-check --tsconfig ./tsconfig.svelte.json",
     "verify:pack": "node ../../scripts/verify-package-types-exports.js ."

package/dist/__tests__/helpers/oidc-test-server.d.ts

@@ -1,45 +0,0 @@
-/**
- * Shared OIDC test-IdP harness: a real HTTP server implementing discovery,
- * JWKS, token, and userinfo endpoints with jose-signed ID tokens. Extracted
- * from oidc-login-service.test.ts so the mobile handler suite (issue #1748)
- * exercises the same provider-generic PKCE surface instead of inventing a
- * second mock.
- */
-import { type DatabaseInterface } from '@happyvertical/smrt-core/migrations';
-export interface OidcTestServerOptions {
-    authorizationResponseIssuerSupported?: boolean;
-    audience?: string | string[];
-    authorizedParty?: string;
-    idTokenEmailVerified?: boolean;
-    includeEmailInIdToken?: boolean;
-    userInfoEmailVerified?: boolean;
-}
-export interface OidcTestServer {
-    close: () => Promise<void>;
-    issuer: string;
-    /** Nonce stamped into subsequently issued ID tokens. */
-    setNonce: (value: string) => void;
-    tokenRequests: Array<{
-        authorization?: string;
-        params: URLSearchParams;
-    }>;
-    userinfoRequests: Array<{
-        authorization?: string;
-    }>;
-}
-/**
- * Schema for the tables OIDC user provisioning touches
- * (`UserCollection.getOrCreateFromOidc`): the smrt-profiles trio plus users
- * and sessions. Extend with further DDL per suite as needed.
- *
- * Tenant-scoped tables (`profile_types`, `profiles`) key on
- * `(tenant_id, slug, context, _meta_type)` since smrt#2360 — keep this DDL in
- * step with the framework schema or `save()`'s ON CONFLICT cannot bind.
- */
-export declare const OIDC_USERS_TEST_SCHEMA = "\nCREATE TABLE IF NOT EXISTS \"_smrt_backfills\" (\n  \"name\" TEXT PRIMARY KEY NOT NULL,\n  \"applied_at\" TIMESTAMP DEFAULT current_timestamp,\n  \"description\" TEXT,\n  \"package_name\" TEXT\n);\n\nCREATE TABLE IF NOT EXISTS \"profile_types\" (\n  \"id\" TEXT PRIMARY KEY NOT NULL,\n  \"slug\" TEXT NOT NULL,\n  \"context\" TEXT NOT NULL DEFAULT '',\n  \"_meta_type\" TEXT NOT NULL,\n  \"_meta_data\" JSON,\n  \"created_at\" TIMESTAMP NOT NULL DEFAULT current_timestamp,\n  \"updated_at\" TIMESTAMP NOT NULL DEFAULT current_timestamp,\n  \"tenant_id\" TEXT,\n  \"name\" TEXT DEFAULT '',\n  \"description\" TEXT\n);\nCREATE UNIQUE INDEX IF NOT EXISTS \"profile_types_slug_context_meta_type_idx\" ON \"profile_types\" (\"tenant_id\", \"slug\", \"context\", \"_meta_type\");\nCREATE INDEX IF NOT EXISTS \"profile_types_meta_type_idx\" ON \"profile_types\" (\"_meta_type\");\n\nCREATE TABLE IF NOT EXISTS \"profiles\" (\n  \"id\" TEXT PRIMARY KEY NOT NULL,\n  \"slug\" TEXT NOT NULL,\n  \"context\" TEXT NOT NULL DEFAULT '',\n  \"_meta_type\" TEXT NOT NULL,\n  \"_meta_data\" JSON,\n  \"created_at\" TIMESTAMP NOT NULL DEFAULT current_timestamp,\n  \"updated_at\" TIMESTAMP NOT NULL DEFAULT current_timestamp,\n  \"tenant_id\" TEXT,\n  \"type_id\" TEXT,\n  \"email\" TEXT,\n  \"email_key\" TEXT,\n  \"name\" TEXT DEFAULT '',\n  \"description\" TEXT,\n  \"is_public\" BOOLEAN DEFAULT FALSE\n);\nCREATE UNIQUE INDEX IF NOT EXISTS \"profiles_slug_context_meta_type_idx\" ON \"profiles\" (\"tenant_id\", \"slug\", \"context\", \"_meta_type\");\nCREATE INDEX IF NOT EXISTS \"profiles_meta_type_idx\" ON \"profiles\" (\"_meta_type\");\nCREATE INDEX IF NOT EXISTS \"profiles_email_key_idx\" ON \"profiles\" (\"email_key\");\n\nCREATE TABLE IF NOT EXISTS \"oidc_profile_email_reservations\" (\n  \"id\" TEXT PRIMARY KEY NOT NULL,\n  \"slug\" TEXT NOT NULL,\n  \"context\" TEXT NOT NULL DEFAULT '',\n  \"created_at\" TIMESTAMP NOT NULL DEFAULT current_timestamp,\n  \"updated_at\" TIMESTAMP NOT NULL DEFAULT current_timestamp,\n  \"profile_id\" TEXT NOT NULL,\n  \"email_key\" TEXT NOT NULL\n);\nCREATE UNIQUE INDEX IF NOT EXISTS \"oidc_profile_email_reservations_slug_context_idx\" ON \"oidc_profile_email_reservations\" (\"slug\", \"context\");\nCREATE UNIQUE INDEX IF NOT EXISTS \"oidc_profile_email_reservations_profile_id_idx\" ON \"oidc_profile_email_reservations\" (\"profile_id\");\nCREATE UNIQUE INDEX IF NOT EXISTS \"oidc_profile_email_reservations_email_key_idx\" ON \"oidc_profile_email_reservations\" (\"email_key\");\n\nCREATE TABLE IF NOT EXISTS \"oidc_identities\" (\n  \"id\" TEXT PRIMARY KEY NOT NULL,\n  \"slug\" TEXT NOT NULL,\n  \"context\" TEXT NOT NULL DEFAULT '',\n  \"created_at\" TIMESTAMP NOT NULL DEFAULT current_timestamp,\n  \"updated_at\" TIMESTAMP NOT NULL DEFAULT current_timestamp,\n  \"profile_id\" TEXT NOT NULL,\n  \"provider\" TEXT DEFAULT '',\n  \"issuer\" TEXT DEFAULT '',\n  \"subject\" TEXT DEFAULT '',\n  \"identity_key\" TEXT,\n  \"email\" TEXT DEFAULT '',\n  \"last_used_at\" TIMESTAMP\n);\nCREATE UNIQUE INDEX IF NOT EXISTS \"oidc_identities_slug_context_idx\" ON \"oidc_identities\" (\"slug\", \"context\");\nCREATE UNIQUE INDEX IF NOT EXISTS \"oidc_identities_identity_key_idx\" ON \"oidc_identities\" (\"identity_key\");\n\nCREATE TABLE IF NOT EXISTS \"users\" (\n  \"id\" TEXT PRIMARY KEY NOT NULL,\n  \"slug\" TEXT NOT NULL,\n  \"context\" TEXT NOT NULL DEFAULT '',\n  \"created_at\" TIMESTAMP NOT NULL DEFAULT current_timestamp,\n  \"updated_at\" TIMESTAMP NOT NULL DEFAULT current_timestamp,\n  \"profile_id\" TEXT DEFAULT '',\n  \"email\" TEXT DEFAULT '',\n  \"email_key\" TEXT,\n  \"status\" TEXT,\n  \"last_login_at\" TIMESTAMP\n);\nCREATE UNIQUE INDEX IF NOT EXISTS \"users_slug_context_idx\" ON \"users\" (\"slug\", \"context\");\nCREATE UNIQUE INDEX IF NOT EXISTS \"users_profile_id_idx\" ON \"users\" (\"profile_id\");\nCREATE UNIQUE INDEX IF NOT EXISTS \"users_email_key_idx\" ON \"users\" (\"email_key\");\n\nCREATE TABLE IF NOT EXISTS \"sessions\" (\n  \"id\" TEXT PRIMARY KEY NOT NULL,\n  \"slug\" TEXT NOT NULL,\n  \"context\" TEXT NOT NULL DEFAULT '',\n  \"created_at\" TIMESTAMP NOT NULL DEFAULT current_timestamp,\n  \"updated_at\" TIMESTAMP NOT NULL DEFAULT current_timestamp,\n  \"user_id\" TEXT DEFAULT '',\n  \"tenant_id\" TEXT,\n  \"status\" TEXT,\n  \"expires_at\" TIMESTAMP,\n  \"user_agent\" TEXT DEFAULT '',\n  \"ip_address\" TEXT DEFAULT '',\n  \"last_accessed_at\" TIMESTAMP,\n  \"data\" JSON DEFAULT '{}'\n);\nCREATE UNIQUE INDEX IF NOT EXISTS \"sessions_slug_context_idx\" ON \"sessions\" (\"slug\", \"context\");\n";
-/** Mark a freshly-created, empty test schema ready for indexed OIDC reads. */
-export declare function prepareOidcEmailKeyBackfills(db: DatabaseInterface): Promise<void>;
-/** Close every server started by this harness (call from `afterAll`). */
-export declare function closeAllOidcServers(): Promise<void>;
-export declare function startOidcServer(options?: OidcTestServerOptions): Promise<OidcTestServer>;
-//# sourceMappingURL=oidc-test-server.d.ts.map

package/dist/__tests__/helpers/oidc-test-server.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"oidc-test-server.d.ts","sourceRoot":"","sources":["../../../src/__tests__/helpers/oidc-test-server.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AASH,OAAO,EAEL,KAAK,iBAAiB,EACvB,MAAM,qCAAqC,CAAC;AAK7C,MAAM,WAAW,qBAAqB;IACpC,oCAAoC,CAAC,EAAE,OAAO,CAAC;IAC/C,QAAQ,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC;IAC7B,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,oBAAoB,CAAC,EAAE,OAAO,CAAC;IAC/B,qBAAqB,CAAC,EAAE,OAAO,CAAC;IAChC,qBAAqB,CAAC,EAAE,OAAO,CAAC;CACjC;AAED,MAAM,WAAW,cAAc;IAC7B,KAAK,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;IAC3B,MAAM,EAAE,MAAM,CAAC;IACf,wDAAwD;IACxD,QAAQ,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,IAAI,CAAC;IAClC,aAAa,EAAE,KAAK,CAAC;QAAE,aAAa,CAAC,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,eAAe,CAAA;KAAE,CAAC,CAAC;IAC1E,gBAAgB,EAAE,KAAK,CAAC;QAAE,aAAa,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;CACrD;AAED;;;;;;;;GAQG;AACH,eAAO,MAAM,sBAAsB,g/IAyGlC,CAAC;AAEF,8EAA8E;AAC9E,wBAAsB,4BAA4B,CAChD,EAAE,EAAE,iBAAiB,GACpB,OAAO,CAAC,IAAI,CAAC,CAUf;AAaD,yEAAyE;AACzE,wBAAsB,mBAAmB,IAAI,OAAO,CAAC,IAAI,CAAC,CAEzD;AAiBD,wBAAsB,eAAe,CACnC,OAAO,GAAE,qBAA0B,GAClC,OAAO,CAAC,cAAc,CAAC,CAgIzB"}

package/dist/__tests__/helpers/postgres-rls-reset.d.ts

@@ -1,15 +0,0 @@
-import type { DatabaseInterface } from '@happyvertical/sql';
-/**
- * Remove every row-level-security policy `applyPostgresPermissionPolicies()`
- * installed in the current schema, and turn RLS back off on those tables.
- *
- * The policies are DDL: they commit on the shared per-package database and
- * outlive the isolated transaction a suite rolls back. Left behind, they
- * FORCE RLS onto every tenant-scoped table for each later suite in the
- * package. Under a superuser connection that was invisible (superusers bypass
- * RLS); under the CI lane's NOSUPERUSER/NOBYPASSRLS role it rejects ordinary
- * writes in unrelated suites, e.g. `resource_grants` in
- * `resource-grant-postgres.test.ts`.
- */
-export declare function resetPostgresPermissionPolicies(db: DatabaseInterface): Promise<void>;
-//# sourceMappingURL=postgres-rls-reset.d.ts.map

package/dist/__tests__/helpers/postgres-rls-reset.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"postgres-rls-reset.d.ts","sourceRoot":"","sources":["../../../src/__tests__/helpers/postgres-rls-reset.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,oBAAoB,CAAC;AAE5D;;;;;;;;;;;GAWG;AACH,wBAAsB,+BAA+B,CACnD,EAAE,EAAE,iBAAiB,GACpB,OAAO,CAAC,IAAI,CAAC,CA2Bf"}