permdock 0.1.0 → 0.3.0

package/dist/{compile-D22iwvuV.js → compile-Ba4blROR.js}

@@ -1,8 +1,9 @@
 import { n as isReadonlyArray, r as sole, t as compact } from "./compact-y6vfu2_f.js";
-import { d as isFieldRelation, h as isSelfParented, p as isPrincipalRelation, r as expandRelation, u as isEdgeRelation, x as assertSafeKey } from "./permissions-DC7GROPA.js";
-import { c as isConditionRef, i as resolveConditionRef, s as isConditionDate, u as parentHop } from "./refs-ChLSxbST.js";
-import { a as resolveScope, c as scopeChain, d as subjectMemberships, f as tenantOf, s as rootScope, u as scopeList } from "./scopes-cKVp_WTw.js";
-import { i as PermDockValidationError } from "./errors-Iy71s7Oj.js";
+import { S as restrictedFor, d as isEdgeRelation, f as isFieldRelation, g as isSelfParented, l as groupEntries, m as isPrincipalRelation, r as expandRelation, w as assertSafeKey } from "./permissions-DVoF6dMt.js";
+import { c as isConditionRef, i as resolveConditionRef, s as isConditionDate, u as parentHop } from "./refs-KYb4ntaz.js";
+import { n as PermDockValidationError } from "./validation-error-CnjZ4t92.js";
+import { t as expiredAt } from "./expiry-BoBJ8Tvc.js";
+import { c as rootScope, d as scopeList, l as scopeChain, m as tenantOf, o as resolveScope, p as subjectMemberships } from "./scopes-CVdPrWN-.js";
 //#region src/conditions/graph-sql.ts
 /** A Postgres identifier, schema-qualified names split on `.`. */
 function quoteSqlName(name) {
@@ -48,25 +49,38 @@ function groupHolders(build, resource, relation) {
 /** Who a row of the edge names, when it is not a group of the edge's own resource. */
 function edgeHolderFilter(build, node, spec, alias) {
 	const holder = col(alias, spec.subject ?? "user_id");
-	const subject = `${holder}::text`;
 	const groups = spec.groups;
 	if (groups === void 0) return [text(`${holder} = `), { subject: true }];
-	const kind = col(alias, groups.column);
-	const direct = groups.direct === void 0 ? [text(`(${kind} is null`)] : [text(`(${kind} is null or ${kind} = `), { value: groups.direct }];
-	const parts = [
+	const kind = groups.column === void 0 ? void 0 : col(alias, groups.column);
+	const direct = kind === void 0 ? [
+		text(`(${holder} = `),
+		{ subject: true },
+		text(")")
+	] : [
 		text("(("),
-		...direct,
+		...groups.direct === void 0 ? [text(`${kind} is null`)] : [text(`${kind} is null or ${kind} = `), { value: groups.direct }],
 		text(`) and ${holder} = `),
 		{ subject: true },
 		text(")")
 	];
-	for (const [resource, relation] of Object.entries(groups.resources)) {
-		if (resource === node.name) continue;
-		parts.push(text(` or (${kind} = `), { value: resource }, text(` and ${subject} in (`), ...groupHolders(build, resource, relation), text("))"));
+	const parts = [text("("), ...direct];
+	for (const group of groupEntries(spec)) {
+		if (group.resource === node.name) continue;
+		const id = `${col(alias, group.subject)}::text in (`;
+		parts.push(...kind === void 0 ? [text(` or (${id}`)] : [
+			text(` or (${kind} = `),
+			{ value: group.resource },
+			text(` and ${id}`)
+		], ...groupHolders(build, group.resource, group.relation), text("))"));
 	}
 	parts.push(text(")"));
 	return parts;
 }
+/** The nested-group step of an edge whose groups include its own resource: the row names a group of `node`. */
+function selfGroupWhere(spec, node, subject, alias) {
+	const column = spec.groups?.column;
+	return column === void 0 ? [text(`${subject} is not null`)] : [text(`${col(alias, column)} = `), { value: node.name }];
+}
 /**
 * One concrete relation's arm: `select <id>::text as id ...` for every
 * instance of `node` the subject holds `relation` on, through groups too.
@@ -82,14 +96,16 @@ function relationArm(build, node, relation) {
 			...edgeHolderFilter(build, node, spec, e),
 			...edgeRowFilter(spec, e)
 		];
-		if (spec.groups?.resources[node.name] === void 0 || spec.groups === void 0) return base;
+		const self = groupEntries(spec).find((group) => group.resource === node.name);
+		if (self === void 0) return base;
 		const g = nextAlias(build, "g");
 		const n = nextAlias(build, "e");
+		const subject = col(n, self.subject);
 		return [
 			text(`select ${g}.id from (with recursive ${g}(id, level) as (select b.id, 0 from (`),
 			...base,
-			text(`) b union select ${col(n, object)}::text, ${g}.level + 1 from ${edge} ${n} join ${g} on ${col(n, spec.subject ?? "user_id")}::text = ${g}.id where ${col(n, spec.groups.column)} = `),
-			{ value: node.name },
+			text(`) b union select ${col(n, object)}::text, ${g}.level + 1 from ${edge} ${n} join ${g} on ${subject}::text = ${g}.id where `),
+			...selfGroupWhere(spec, node, subject, n),
 			text(` and ${g}.level < ${String(16)}`),
 			...edgeRowFilter(spec, n),
 			text(`) select ${g}.id from ${g}) ${g}`)
@@ -132,6 +148,11 @@ function relationArmSql(resource, relation, options) {
 	return relationArm(build, nodeOf(build, resource), relation);
 }
 function heldIds(build, condition) {
+	if (condition.permission !== void 0) {
+		const permitted = build.options.permitted;
+		if (permitted === void 0) throw new Error(`PermDock: inherit(${condition.permission}) has no query form outside generated RLS`);
+		return permitted(condition.resource, condition.permission);
+	}
 	if (condition.ids === void 0) return groupHolders(build, condition.resource, condition.relation);
 	if (condition.ids.length === 0) return [text("select null::text as id where false")];
 	const parts = [text("select v.id from (values ")];
@@ -160,7 +181,8 @@ function reached(build, condition) {
 	}
 	const d = nextAlias(build, "d");
 	const t = nextAlias(build, "t");
-	const restricted = node.restricted === void 0 ? "" : ` and ${col(t, node.restricted)} is not true`;
+	const stop = restrictedFor(node, "parent");
+	const restricted = stop === void 0 ? "" : ` and ${col(t, stop)} is not true`;
 	return [
 		text(`select ${d}.id from (with recursive ${d}(id, level) as (select h.id, 0 from (`),
 		...held,
@@ -201,6 +223,38 @@ function relatedTargetsSql(condition, options) {
 		alias: 0
 	}, condition);
 }
+function closedRows(build, above) {
+	const custom = build.options.restrictedRows?.(above.resource);
+	if (custom !== void 0) return custom;
+	const table = tableOf(build, nodeOf(build, above.resource).name);
+	const span = above.depth - 1;
+	const { closure, closureDepths } = build.options;
+	const cap = closureDepths?.[above.resource];
+	if (closure !== void 0 && (closureDepths === void 0 || cap !== void 0 && cap >= span)) {
+		const c = nextAlias(build, "c");
+		const a = nextAlias(build, "a");
+		const q = nextAlias(build, "q");
+		return [
+			text(`select ${c}.descendant as id from ${quoteSqlName(closure)} ${c} join ${table} ${a} on ${col(a, above.id)}::text = ${c}.ancestor where ${c}.resource = `),
+			{ value: above.resource },
+			text(` and ${c}.depth <= ${String(span)} and (${col(a, above.field)} is true or (${c}.depth = ${String(span)} and exists (select 1 from ${table} ${q} where ${col(q, above.id)} = ${col(a, above.parent)})))`)
+		];
+	}
+	const d = nextAlias(build, "d");
+	const r = nextAlias(build, "r");
+	const t = nextAlias(build, "t");
+	const u = nextAlias(build, "t");
+	const v = nextAlias(build, "t");
+	const w = nextAlias(build, "t");
+	const q = nextAlias(build, "q");
+	return [text(`select ${d}.id from (with recursive ${d}(id, level) as (select ${col(t, above.id)}::text, 0 from ${table} ${t} where ${col(t, above.field)} is true union select ${col(u, above.id)}::text, ${d}.level + 1 from ${table} ${u} join ${d} on ${col(u, above.parent)}::text = ${d}.id where ${d}.level < ${String(span)}) select ${d}.id from ${d}) ${d} union select ${col(w, above.id)}::text from ${table} ${w} where ${col(w, above.id)}::text not in (select ${r}.id from (with recursive ${r}(id, level) as (select ${col(v, above.id)}::text, 0 from ${table} ${v} where ${col(v, above.parent)} is null or not exists (select 1 from ${table} ${q} where ${col(q, above.id)} = ${col(v, above.parent)}) union select ${col(t, above.id)}::text, ${r}.level + 1 from ${table} ${t} join ${r} on ${col(t, above.parent)}::text = ${r}.id where ${r}.level < ${String(span)}) select ${r}.id from ${r}) ${r})`)];
+}
+function restrictedRowsSql(above, options) {
+	return closedRows({
+		options,
+		alias: 0
+	}, above);
+}
 /** Whether the row's restricted column keeps it out of `condition` whatever the graph says. */
 function relatedRowGuard(condition) {
 	const hopped = condition.hops !== void 0 && condition.hops.length > 0;
@@ -212,22 +266,25 @@ function relatedRowGuard(condition) {
 * is not restricted.
 */
 function relatedSql(condition, options) {
+	const build = {
+		options,
+		alias: 0
+	};
 	const parts = [
 		text("coalesce("),
 		{ column: condition.field },
 		text("::text in ("),
-		...relatedTargetsSql(condition, options),
+		...targets(build, condition),
 		text("), false)")
 	];
 	const guard = relatedRowGuard(condition);
-	if (guard === void 0) return parts;
-	return [
-		text("("),
-		...parts,
-		text(" and "),
-		{ column: guard },
-		text(" is not true)")
-	];
+	const above = condition.restrictedAncestors;
+	if (guard === void 0 && above === void 0) return parts;
+	const out = [text("("), ...parts];
+	if (guard !== void 0) out.push(text(" and "), { column: guard }, text(" is not true"));
+	if (above !== void 0) out.push(text(" and ("), { column: above.parent }, text(" is null or "), { column: above.parent }, text("::text not in ("), ...closedRows(build, above), text("))"));
+	out.push(text(")"));
+	return out;
 }
 /**
 * Renders parts to one SQL string: `placeholder(n)` names the n-th bound
@@ -266,9 +323,6 @@ function scopeColumn(table, scopes, name) {
 }
 const NEVER = { kind: "never" };
 const ALWAYS = { kind: "always" };
-function isExpired(membership, now) {
-	return membership.expiresAt !== void 0 && membership.expiresAt <= now;
-}
 function isScalar(value) {
 	return typeof value === "string" || typeof value === "number" || typeof value === "boolean" || value instanceof Date;
 }
@@ -363,7 +417,7 @@ function matchingMemberships(condition, subject, now, scopes) {
 	const memberships = subjectMemberships(subject?.principal?.memberships, scopes);
 	const wanted = new Set(condition.roles);
 	return memberships.filter((membership) => {
-		if (isExpired(membership, now)) return false;
+		if (expiredAt(membership, now)) return false;
 		if (wanted.size === 0) return true;
 		return membership.roles.some((role) => wanted.has(role));
 	});
@@ -521,6 +575,7 @@ function compileNode(condition, options) {
 		case "sqlFunction": return compileNode(condition.twin, options);
 		case "memberOf": return compileMemberOf(condition, options);
 		case "related": return compileRelated(condition, options);
+		case "liveSession": return options.subject?.liveSession === true ? ALWAYS : NEVER;
 		case "eq":
 		case "ne":
 		case "gt":
@@ -555,4 +610,4 @@ function compileWhere(input, options = {}) {
 	}));
 }
 //#endregion
-export { relatedRowGuard as a, relationArmSql as c, scopeMembershipTable as i, renderGraphSql as l, escapeLike as n, relatedSql as o, scopeColumn as r, relatedTargetsSql as s, compileWhere as t };
+export { relatedRowGuard as a, relationArmSql as c, scopeMembershipTable as i, renderGraphSql as l, escapeLike as n, relatedSql as o, scopeColumn as r, relatedTargetsSql as s, compileWhere as t, restrictedRowsSql as u };

package/dist/compile-BkRyBDBw.d.ts

@@ -0,0 +1,94 @@
+import { Ir as Condition, Pr as Subject, br as Scope, mn as WhereResult } from "./policy-IB6yxpC3.js";
+import { y as ResourceNode } from "./permissions-DttnqqxC.js";
+import { r as RelationsMapping, t as GraphSql } from "./graph-sql-B-dsAT6j.js";
+//#region src/conditions/compile.d.ts
+type MembershipTable = {
+  readonly table: string;
+  readonly user: string;
+  readonly role: string;
+  /** Per scope name, the column holding that scope's id (the row's own scope and its ancestors). */
+  readonly columns?: Readonly<Record<string, string>>;
+  /** Column of the first scope's id; shorthand for `columns[<first scope>]`. */
+  readonly tenant?: string;
+  /** Column of the second scope's id; shorthand for `columns[<second scope>]`. */
+  readonly team?: string;
+  readonly id?: string;
+  /** Column naming the membership's resource, when one table holds several kinds. */
+  readonly resource?: string;
+  /** Column holding the membership kind (`Membership.via`); roles with `for` need it. */
+  readonly via?: string;
+  /** Unix seconds, like `Membership.expiresAt`; `null` never expires. */
+  readonly expiresAt?: string;
+};
+type MembershipsMapping = {
+  /** The membership table of each named scope. */
+  readonly scopes?: Readonly<Record<string, MembershipTable>>;
+  /** The first scope's table; shorthand for `scopes[<first scope>]`. */
+  readonly tenant?: MembershipTable;
+  /** The second scope's table; shorthand for `scopes[<second scope>]`. */
+  readonly team?: MembershipTable;
+  readonly resource?: Readonly<Record<string, MembershipTable>>;
+};
+type CompileWhereOptions = {
+  readonly subject?: Subject;
+  readonly memberships?: MembershipsMapping;
+  readonly now?: number;
+  /** The policy's scopes; `where()` results carry them. Defaults to the implicit `tenant` / `team` pair. */
+  readonly scopes?: readonly Scope[];
+  /** Where the relation graph lives; without it a `related` node is refused. */
+  readonly relations?: RelationsMapping;
+  /** The policy's resource graph; `where()` results carry it. */
+  readonly resources?: ReadonlyMap<string, ResourceNode>;
+};
+type CompiledCompare = {
+  readonly kind: "compare";
+  readonly op: "eq" | "ne" | "gt" | "gte" | "lt" | "lte" | "contains" | "in" | "notIn";
+  readonly field: string;
+  readonly value: unknown;
+};
+type CompiledExists = {
+  readonly kind: "exists";
+  readonly table: string;
+  readonly user: string;
+  readonly userValue: string;
+  readonly role: string;
+  /** Empty means any role. */
+  readonly roles: readonly string[];
+  readonly rowColumn: string;
+  readonly rowField: string;
+  readonly expiresAt?: string;
+  /** Unix seconds the `expiresAt` column is compared against. */
+  readonly now: number;
+  /** A membership row matches when this column is `null` or equals `tenantValue`. */
+  readonly tenantColumn?: string;
+  readonly tenantValue?: string;
+  readonly resourceColumn?: string;
+  readonly resourceValue?: string;
+};
+type CompiledWhere = {
+  readonly kind: "never";
+} | {
+  readonly kind: "always";
+} | CompiledCompare | {
+  readonly kind: "isNull";
+  readonly field: string;
+  readonly negated: boolean;
+} | {
+  readonly kind: "and" | "or";
+  readonly items: readonly CompiledWhere[];
+} | {
+  readonly kind: "not";
+  readonly item: CompiledWhere;
+} | CompiledExists | CompiledSql;
+/** A Postgres boolean over the row that is never NULL: a `related` node's subquery. */
+type CompiledSql = {
+  readonly kind: "sql";
+  readonly parts: GraphSql;
+  /** What a `{ subject: true }` part binds. */
+  readonly subject: string;
+};
+/** A `contains` pattern for `LIKE`: `%`, `_` and the escape itself match literally. */
+declare function escapeLike(value: string): string;
+declare function compileWhere(input: Condition | WhereResult, options?: CompileWhereOptions): CompiledWhere;
+//#endregion
+export { CompiledWhere as a, compileWhere as c, CompiledSql as i, escapeLike as l, CompiledCompare as n, MembershipTable as o, CompiledExists as r, MembershipsMapping as s, CompileWhereOptions as t };

package/dist/config-BJiM-xAm.js

@@ -0,0 +1,157 @@
+import { t as CliError } from "./errors-CWfoNg9N.js";
+import { existsSync } from "node:fs";
+import { relative, resolve } from "node:path";
+//#region src/cli/config-schema.ts
+const SECTIONS = {
+	collect: {
+		srcPath: true,
+		out: true,
+		barrel: true
+	},
+	catalog: { out: true },
+	openapi: { doc: true },
+	rls: {
+		tables: true,
+		dialect: true,
+		memberships: true,
+		membershipSources: true,
+		suspension: true,
+		functions: true,
+		inlineFunctions: true,
+		force: true,
+		fixtures: true,
+		tenantClaim: true,
+		tenantType: true,
+		teamType: true,
+		scopeTypes: true,
+		roleClaim: true,
+		gucPrefix: true,
+		out: true,
+		drizzle: true,
+		prisma: true,
+		schema: true,
+		authorize: true,
+		policyPerRole: true,
+		customRoles: true,
+		capabilities: true,
+		anonymousSignIns: true,
+		fields: true,
+		revokeColumns: true,
+		policyName: true,
+		rbac: true,
+		roles: true,
+		actions: true,
+		helpersOnly: true,
+		rowHelpers: true,
+		treeValues: true,
+		trustedReaders: true,
+		migrate: true,
+		shims: true,
+		tenants: true,
+		customRoleWrites: true,
+		anonExecute: true,
+		assignments: true,
+		approvals: true,
+		jsonSchema: true,
+		ownershipTriggers: true,
+		readOnlyActors: true,
+		apiKeys: true,
+		realtime: true,
+		storage: true
+	},
+	supabase: { hook: true },
+	powersync: {
+		out: true,
+		resources: true,
+		action: true,
+		manifest: true
+	},
+	doctor: {
+		sensitiveActions: true,
+		memberships: true,
+		credentials: true,
+		clientEntries: true,
+		migrations: true,
+		claims: true,
+		srcPath: true
+	}
+};
+const TOP_LEVEL = /* @__PURE__ */ new Set([
+	"permissions",
+	"policy",
+	...Object.keys(SECTIONS)
+]);
+function isRecord(value) {
+	return value !== null && typeof value === "object" && !Array.isArray(value);
+}
+function isSection(key) {
+	return Object.hasOwn(SECTIONS, key);
+}
+/**
+* Checks the shape a command relies on before it reads the config: module
+* paths are strings and each section is an object. A key PermDock does not
+* read is a warning, so a config written for a newer version still loads.
+*/
+function parseConfig(value, file) {
+	if (value === void 0) return {
+		config: {},
+		warnings: []
+	};
+	if (!isRecord(value)) throw new CliError("usage", `PermDock CLI: ${file} must export a config object as default (use defineConfig)`);
+	const warnings = [];
+	const unknown = (path, known) => `${file}: unknown key ${path}; PermDock reads ${[...known].join(", ")}`;
+	for (const [key, entry] of Object.entries(value)) {
+		if (key === "permissions" || key === "policy") {
+			if (entry !== void 0 && typeof entry !== "string") throw new CliError("usage", `PermDock CLI: ${file}: ${key} must be a module path string`);
+			continue;
+		}
+		if (!isSection(key)) {
+			warnings.push(unknown(key, TOP_LEVEL));
+			continue;
+		}
+		if (entry === void 0) continue;
+		if (!isRecord(entry)) throw new CliError("usage", `PermDock CLI: ${file}: ${key} must be an object`);
+		const known = SECTIONS[key];
+		for (const child of Object.keys(entry)) if (!Object.hasOwn(known, child)) warnings.push(unknown(`${key}.${child}`, Object.keys(known)));
+	}
+	return {
+		config: value,
+		warnings
+	};
+}
+//#endregion
+//#region src/cli/config.ts
+const CONFIG_FILES = [
+	"permdock.config.ts",
+	"permdock.config.mts",
+	"permdock.config.js",
+	"permdock.config.mjs"
+];
+function defineConfig(config) {
+	return config;
+}
+function isConfigFile(name) {
+	return CONFIG_FILES.some((file) => file === name);
+}
+async function readConfig(cwd, fromFlag, options) {
+	const path = fromFlag ? resolve(cwd, fromFlag) : CONFIG_FILES.map((name) => resolve(cwd, name)).find((file) => existsSync(file));
+	if (path === void 0) return {
+		config: {},
+		warnings: [],
+		file: void 0
+	};
+	if (!existsSync(path)) throw new Error(`PermDock CLI: config file not found: ${path}`);
+	const { loadModule, pickNamed } = await import("./load-DwJUafYN.js");
+	return {
+		...parseConfig(pickNamed(await loadModule(path, options), ["default"]), relative(cwd, path).replaceAll("\\", "/")),
+		file: path
+	};
+}
+async function loadConfig(cwd, fromFlag, options) {
+	return (await readConfig(cwd, fromFlag, options)).config;
+}
+function resolveCwd(cwd, fallback) {
+	return cwd === void 0 ? fallback : resolve(fallback, cwd);
+}
+//#endregion
+export { resolveCwd as a, readConfig as i, isConfigFile as n, loadConfig as r, defineConfig as t };

package/dist/config-Dnszbv-6.js

@@ -0,0 +1,36 @@
+import { i as globalArgs, t as COMMAND_DESCRIPTIONS } from "./commands-DSxCqG9A.js";
+import { defineCommand } from "citty";
+//#region src/cli/commands/config.ts
+function config(ctx) {
+	return defineCommand({
+		meta: {
+			name: "config",
+			description: COMMAND_DESCRIPTIONS.config
+		},
+		args: {
+			...globalArgs,
+			print: {
+				type: "boolean",
+				description: "Print the effective config as JSON: the file, as written, and each default"
+			},
+			strict: {
+				type: "boolean",
+				description: "Exit 1 on warnings"
+			}
+		},
+		async run({ args: parsed }) {
+			const { runConfig } = await import("./config-report-DMvWKUxL.js");
+			ctx.report(runConfig({
+				cwd: ctx.cwd,
+				config: ctx.config,
+				file: ctx.configPath,
+				warnings: ctx.configWarnings,
+				print: parsed.print === true,
+				json: ctx.json,
+				strict: parsed.strict === true
+			}));
+		}
+	});
+}
+//#endregion
+export { config };

package/dist/config-report-DMvWKUxL.js

@@ -0,0 +1,44 @@
+import { n as CONFIG_REPORT_SCHEMA } from "./version-BvacVTZR.js";
+import { t as catalogPath } from "./catalog-path-CnI0XTFK.js";
+import { i as rel, t as defaultSrcPath } from "./files-DWUN9PzI.js";
+import { n as guessPermissions, t as barrelFile } from "./collect-DSTE3ml9.js";
+import "./sources-4p0-4xQm.js";
+import { r as MIGRATION_DIRS } from "./supabase-config-BpPXt3x1.js";
+import { t as DEFAULT_SENSITIVE_ACTIONS } from "./doctor-collect-CHk6XWOA.js";
+//#region src/cli/config-report.ts
+function configReport(input) {
+	const { cwd, config } = input;
+	const srcPath = config.collect?.srcPath ?? defaultSrcPath();
+	const barrel = config.collect?.barrel;
+	return {
+		$schema: CONFIG_REPORT_SCHEMA,
+		file: input.file === void 0 ? null : rel(cwd, input.file),
+		config,
+		resolved: {
+			permissions: config.permissions ?? guessPermissions(cwd, srcPath) ?? null,
+			policy: config.policy ?? null,
+			srcPath,
+			catalog: rel(cwd, catalogPath(config, cwd)),
+			barrel: barrel === void 0 || barrel === false ? false : barrelFile(barrel),
+			migrations: config.doctor?.migrations ?? MIGRATION_DIRS,
+			sensitiveActions: config.doctor?.sensitiveActions ?? DEFAULT_SENSITIVE_ACTIONS,
+			rlsSchema: config.rls?.schema ?? config.rls?.rbac?.schema ?? "permdock"
+		},
+		warnings: input.warnings
+	};
+}
+/** `permdock config`: the config's warnings, or with `--print` or `--json` the effective config. */
+function runConfig(input) {
+	const report = configReport(input);
+	const code = input.strict && report.warnings.length > 0 ? 1 : 0;
+	if (input.print || input.json) return {
+		code,
+		output: `${JSON.stringify(report, null, 2)}\n`
+	};
+	return {
+		code,
+		output: `${[report.file === null ? "no permdock.config file; every option takes its default" : `${report.file}: ${report.warnings.length === 0 ? "ok" : `${String(report.warnings.length)} warning${report.warnings.length === 1 ? "" : "s"}`}`, ...report.warnings.map((warning) => `  warn ${warning}`)].join("\n")}\n`
+	};
+}
+//#endregion
+export { runConfig };

package/dist/{connection-JvqwHODC.js → connection-CU8MQxRi.js}

@@ -1,5 +1,5 @@
 import { t as compact } from "./compact-y6vfu2_f.js";
-import { r as PermDockRevokedError } from "./errors-Iy71s7Oj.js";
+import { r as PermDockRevokedError } from "./errors-Cz5zn0mW.js";
 //#region src/server/connection.ts
 /** `setTimeout` stores delays in a signed 32-bit integer. */
 const MAX_DELAY = 2147483647;

package/dist/{context-CKEAabd7.js → context-Bcy85rGi.js}

@@ -1,7 +1,6 @@
 import { t as compact } from "./compact-y6vfu2_f.js";
-import { t as emptySnapshot } from "./from-snapshot-BMGnhmgv.js";
-import { t as createClientStore } from "./store-C6hFW6ta.js";
-import { t as isPromiseLike } from "./source-DoBBYJi2.js";
+import { i as isPromiseLike } from "./store-options-ByhZq1jV.js";
+import { n as switchTenant, t as providerStore } from "./provider-store-Cfbvo4DE.js";
 import { getContext, onDestroy, setContext } from "svelte";
 import { toStore } from "svelte/store";
 //#region src/svelte/context.ts
@@ -21,46 +20,56 @@ function connectSvelteStore(options) {
 	const source = options.snapshot;
 	const promised = isPromiseLike(source);
 	const reactive = promised ? void 0 : reactiveSource(source);
-	let initial = emptySnapshot();
+	let initial;
 	if (reactive !== void 0) reactive.subscribe((value) => {
 		initial = value;
 	})();
 	else if (!promised) initial = source;
-	const store = createClientStore(compact({
-		snapshot: initial,
+	const tenant = options.tenant;
+	const headers = options.headers;
+	const store = providerStore(compact({
 		endpoint: options.endpoint,
+		snapshotUrl: options.snapshotUrl,
 		approvals: options.approvals,
-		tenant: options.tenant,
+		tenant: typeof tenant === "function" ? tenant() : tenant,
+		maxAge: options.maxAge
+	}), () => ({
+		headers: typeof headers === "function" ? headers() : headers,
 		fetch: options.fetch,
-		headers: options.headers,
-		maxAge: options.maxAge,
 		verifier: options.verifier
-	}));
-	if (promised) {
-		store.follow(source);
-		return {
-			store,
-			stop: () => void 0
-		};
-	}
-	if (reactive === void 0) return {
-		store,
-		stop: () => void 0
-	};
-	let current = initial;
-	return {
-		store,
-		stop: reactive.subscribe((value) => {
+	}), promised ? source : initial);
+	const stops = [];
+	if (reactive !== void 0) {
+		let current = initial;
+		stops.push(reactive.subscribe((value) => {
 			if (value !== current) {
 				current = value;
 				store.replace(value);
 			}
-		})
+		}));
+	}
+	if (typeof tenant === "function") {
+		let active = tenant();
+		stops.push(toStore(tenant).subscribe((next) => {
+			if (next !== void 0 && next !== active) {
+				active = next;
+				switchTenant(store, next);
+			}
+		}));
+	}
+	return {
+		store,
+		stop: () => {
+			for (const stop of stops) stop();
+		}
 	};
 }
 function providePermDock(options) {
 	const { store, stop } = connectSvelteStore(options);
-	onDestroy(stop);
+	onDestroy(() => {
+		stop();
+		store.dispose();
+	});
 	setContext(permDockKey, store);
 	return store;
 }

package/dist/convex/index.d.ts

@@ -1,6 +1,7 @@
-import { C as Policy, E as PolicyVocabulary, Zt as PermDock, mr as Principal } from "../policy-CInmNGkM.js";
-import { d as Permission } from "../permissions-B4apnahQ.js";
-import { o as ProblemDetails, r as PermDockDeniedError } from "../errors-DbZ1YOnb.js";
+import { C as Policy, D as PolicyVocabulary, Nr as Principal, ln as PermDock } from "../policy-IB6yxpC3.js";
+import { f as Permission } from "../permissions-DttnqqxC.js";
+import { a as ProblemDetails, r as PermDockDeniedError } from "../errors-DPdqI50v.js";
+import { t as InstanceOptions } from "../instance-options-jARdwfPN.js";
 //#region src/convex/types.d.ts
 type ConvexCtxLike = {
   readonly auth?: {
@@ -16,8 +17,12 @@ type ConvexQueryBuilder = (definition: {
   readonly args: Record<string, never>;
   readonly handler: (ctx: ConvexCtxLike, args: Record<string, never>) => unknown;
 }) => unknown;
-type ConvexPermDockOptions<TCtx, TUser = unknown> = {
+type ConvexPermDockOptions<TCtx, TUser = unknown> = InstanceOptions & {
   readonly subject: ConvexSubject<TCtx, TUser>;
+  /** The active tenant: a fixed id or a function of the Convex context; a throw is no tenant. */
+  readonly tenant?: string | ((ctx: TCtx) => string | undefined | Promise<string | undefined>);
+  /** The agent or service acting for the subject; anything but an `Actor` is ignored. */
+  readonly actor?: (ctx: TCtx) => unknown;
   readonly query?: ConvexQueryBuilder;
 };
 type ConvexHandler<TCtx, TArgs, TResult, V extends PolicyVocabulary = PolicyVocabulary> = (ctx: ConvexPermDockCtx<TCtx, V>, args: TArgs) => TResult | Promise<TResult>;