permdock 0.3.0 → 0.4.0

package/dist/{supautils-Cn4R4cJ4.js → supautils-B6HYL9eL.js}

@@ -1,5 +1,5 @@
-import { d as group, p as sqlStatements } from "./supabase-config-BpPXt3x1.js";
-//#region src/cli/supautils.ts
+import { i as group, o as sqlStatements } from "./deciding-columns-Sq12mEA6.js";
+//#region src/cli/sql/supautils.ts
 /** `supautils.reserved_roles` of supabase/postgres 17.11.0.002 (supautils 3.4.4). */
 const RESERVED_ROLES = /* @__PURE__ */ new Set([
 	"supabase_admin",

package/dist/svelte/Protected.svelte

@@ -3,7 +3,9 @@
 
   import {
     getStore,
+    getUi,
     scopedFor,
+    slotContent,
     viewFor,
     type ProtectedProps,
   } from './runtime.js';
@@ -15,9 +17,11 @@
     children,
     pending,
     fallback,
+    approval,
   }: ProtectedProps = $props();
 
   const store = getStore();
+  const { defaults } = getUi();
   let tick = $state(0);
   onDestroy(
     store.subscribe(() => {
@@ -29,12 +33,15 @@
     const generation = tick;
     return viewFor(store, permission, data, scoped, generation);
   });
+  const own = $derived({ pending, fallback, approval });
 </script>
 
 {#if view.slot === 'pending'}
-  {@render pending?.()}
+  {@render slotContent('pending', own, defaults)?.()}
+{:else if view.slot === 'approval'}
+  {@render slotContent('approval', own, defaults)?.(view.decision)}
 {:else if view.slot === 'fallback'}
-  {@render fallback?.(view.decision)}
+  {@render slotContent('fallback', own, defaults)?.(view.decision)}
 {:else}
   {@render children?.(view.decision)}
 {/if}

package/dist/svelte/index.d.ts

@@ -1,13 +1,13 @@
-import { n as requiredPlans } from "../problem-details-DX075l9V.js";
-import { i as describe } from "../describe-DMYiCjJV.js";
+import { n as requiredPlans } from "../problem-details-rIIo8B2C.js";
+import { i as describe } from "../describe-C3ldA9os.js";
 import { t as PermissionBoundaryState } from "../boundary-BmHxVH1J.js";
 import { t as approvalHeaders } from "../headers-Cf-zWvsO.js";
-import { a as FilterResult, c as SubjectView, i as ClientStatus, l as TenantView, n as ApprovalState, o as PermissionSet, r as ClientPermDock, s as PermissionState, t as ApprovalHandle, u as UseRolesOptions } from "../types-CKNSyIf_.js";
-import { i as PermissionBoundaryProps, t as ProtectedProps } from "../protected-xAr24FEC.js";
-import { a as getPermDock, c as permissions, d as subject, f as tenant, i as filtered, l as roles, n as assignable, o as memberships, p as PermDockSvelteOptions, r as assignablePermissions, s as permission, t as approval, u as setPermDock } from "../stores-C0IMQrGI.js";
+import { a as ClientPermDock, c as PermissionSet, d as SubjectView, f as TenantView, i as ApprovalState, l as PermissionState, o as ClientStatus, p as UseRolesOptions, r as ApprovalHandle, s as FilterResult } from "../store-9KO4BlkB.js";
+import { n as PermDockSvelteOptions, r as ProtectedProps, s as PermissionBoundaryProps, t as PermDockDefaults } from "../types-ByUo56un.js";
+import { a as getDescribe, c as permission, d as setPermDock, f as subject, i as filtered, l as permissions, n as assignable, o as getPermDock, p as tenant, r as assignablePermissions, s as memberships, t as approval, u as roles } from "../stores-Cxz_80g-.js";
 import { Component } from "svelte";
 //#region src/svelte/index.d.ts
 export declare const Protected: Component<ProtectedProps>;
 export declare const PermissionBoundary: Component<PermissionBoundaryProps>;
 //#endregion
-export { type ApprovalHandle, type ApprovalState, type ClientPermDock, type ClientStatus, type FilterResult, type PermDockSvelteOptions, type PermissionBoundaryProps, type PermissionBoundaryState, type PermissionSet, type PermissionState, type ProtectedProps, type SubjectView, type TenantView, type UseRolesOptions, approval, approvalHeaders, assignable, assignablePermissions, describe, filtered, getPermDock, memberships, permission, permissions, requiredPlans, roles, setPermDock, subject, tenant };
+export { type ApprovalHandle, type ApprovalState, type ClientPermDock, type ClientStatus, type FilterResult, type PermDockDefaults, type PermDockSvelteOptions, type PermissionBoundaryProps, type PermissionBoundaryState, type PermissionSet, type PermissionState, type ProtectedProps, type SubjectView, type TenantView, type UseRolesOptions, approval, approvalHeaders, assignable, assignablePermissions, describe, filtered, getDescribe, getPermDock, memberships, permission, permissions, requiredPlans, roles, setPermDock, subject, tenant };

package/dist/svelte/index.js

@@ -1,10 +1,11 @@
-import { r as requiredPlans } from "../problem-details-_AMOYz-w.js";
-import { t as describe } from "../describe-B_gVZEVi.js";
+import { r as requiredPlans } from "../problem-details-DECUnXAn.js";
+import { t as describe } from "../describe-Cgkp7eP0.js";
 import { t as approvalHeaders } from "../headers-BZSDieNT.js";
+import { l as slotContent } from "../views-CJsrBS1f.js";
 import { n as boundaryFallback, t as boundaryDigest } from "../boundary-BM8a_P6E.js";
-import { t as getStore } from "../context-Bcy85rGi.js";
-import { n as viewFor, t as scopedFor } from "../runtime-CB8gQFvS.js";
-import { a as getPermDock, c as permissions, d as subject, f as tenant, i as filtered, l as roles, n as assignable, o as memberships, r as assignablePermissions, s as permission, t as approval, u as setPermDock } from "../stores-BT2pSCub.js";
+import { n as getUi, t as getStore } from "../context-DieZVJXu.js";
+import { n as viewFor, t as scopedFor } from "../runtime-D_tMXnsq.js";
+import { a as getDescribe, c as permission, d as setPermDock, f as subject, i as filtered, l as permissions, n as assignable, o as getPermDock, p as tenant, r as assignablePermissions, s as memberships, t as approval, u as roles } from "../stores-BHXdSbw9.js";
 import "svelte/internal/disclose-version";
 import * as $ from "svelte/internal/client";
 import { onDestroy } from "svelte";
@@ -62,6 +63,7 @@ function PermissionBoundary$1($$anchor, $$props) {
 function Protected$1($$anchor, $$props) {
 	$.push($$props, true);
 	const store = getStore();
+	const { defaults } = getUi();
 	let tick = $.state(0);
 	onDestroy(store.subscribe(() => {
 		$.set(tick, $.get(tick) + 1);
@@ -71,29 +73,41 @@ function Protected$1($$anchor, $$props) {
 		const generation = $.get(tick);
 		return viewFor(store, $$props.permission, $$props.data, $.get(scoped), generation);
 	});
+	const own = $.derived(() => ({
+		pending: $$props.pending,
+		fallback: $$props.fallback,
+		approval: $$props.approval
+	}));
 	var fragment = $.comment();
 	var node = $.first_child(fragment);
 	var consequent = ($$anchor) => {
 		var fragment_1 = $.comment();
 		var node_1 = $.first_child(fragment_1);
-		$.snippet(node_1, () => $$props.pending ?? $.noop);
+		$.snippet(node_1, () => slotContent("pending", $.get(own), defaults) ?? $.noop);
 		$.append($$anchor, fragment_1);
 	};
 	var consequent_1 = ($$anchor) => {
 		var fragment_2 = $.comment();
 		var node_2 = $.first_child(fragment_2);
-		$.snippet(node_2, () => $$props.fallback ?? $.noop, () => $.get(view).decision);
+		$.snippet(node_2, () => slotContent("approval", $.get(own), defaults) ?? $.noop, () => $.get(view).decision);
 		$.append($$anchor, fragment_2);
 	};
-	var alternate = ($$anchor) => {
+	var consequent_2 = ($$anchor) => {
 		var fragment_3 = $.comment();
 		var node_3 = $.first_child(fragment_3);
-		$.snippet(node_3, () => $$props.children ?? $.noop, () => $.get(view).decision);
+		$.snippet(node_3, () => slotContent("fallback", $.get(own), defaults) ?? $.noop, () => $.get(view).decision);
 		$.append($$anchor, fragment_3);
 	};
+	var alternate = ($$anchor) => {
+		var fragment_4 = $.comment();
+		var node_4 = $.first_child(fragment_4);
+		$.snippet(node_4, () => $$props.children ?? $.noop, () => $.get(view).decision);
+		$.append($$anchor, fragment_4);
+	};
 	$.if(node, ($$render) => {
 		if ($.get(view).slot === "pending") $$render(consequent);
-		else if ($.get(view).slot === "fallback") $$render(consequent_1, 1);
+		else if ($.get(view).slot === "approval") $$render(consequent_1, 1);
+		else if ($.get(view).slot === "fallback") $$render(consequent_2, 2);
 		else $$render(alternate, -1);
 	});
 	$.append($$anchor, fragment);
@@ -104,4 +118,4 @@ function Protected$1($$anchor, $$props) {
 const Protected = Protected$1;
 const PermissionBoundary = PermissionBoundary$1;
 //#endregion
-export { PermissionBoundary, Protected, approval, approvalHeaders, assignable, assignablePermissions, describe, filtered, getPermDock, memberships, permission, permissions, requiredPlans, roles, setPermDock, subject, tenant };
+export { PermissionBoundary, Protected, approval, approvalHeaders, assignable, assignablePermissions, describe, filtered, getDescribe, getPermDock, memberships, permission, permissions, requiredPlans, roles, setPermDock, subject, tenant };

package/dist/svelte/runtime.d.ts

@@ -1,7 +1,14 @@
+import { n as DescribeMessages } from "../describe-C3ldA9os.js";
 import { n as boundaryDigest, r as boundaryFallback, t as PermissionBoundaryState } from "../boundary-BmHxVH1J.js";
-import { t as ClientStore } from "../store-jOBYpiXC.js";
-import { i as PermissionBoundaryProps, n as scopedFor, r as viewFor, t as ProtectedProps } from "../protected-xAr24FEC.js";
+import { t as ClientStore } from "../store-9KO4BlkB.js";
+import { a as viewFor, i as scopedFor, o as slotContent, r as ProtectedProps, s as PermissionBoundaryProps, t as PermDockDefaults } from "../types-ByUo56un.js";
 //#region src/svelte/context.d.ts
+/** The provider's `defaults` and `messages`. */
+type PermDockUi = {
+  readonly defaults?: PermDockDefaults | undefined;
+  readonly messages?: DescribeMessages | undefined;
+};
+export declare function getUi(): PermDockUi;
 export declare function getStore(): ClientStore;
 //#endregion
-export { type PermissionBoundaryProps, type PermissionBoundaryState, type ProtectedProps, boundaryDigest, boundaryFallback, scopedFor, viewFor };
+export { type PermissionBoundaryProps, type PermissionBoundaryState, type ProtectedProps, boundaryDigest, boundaryFallback, scopedFor, slotContent, viewFor };

package/dist/svelte/runtime.js

@@ -1,4 +1,5 @@
+import { l as slotContent } from "../views-CJsrBS1f.js";
 import { n as boundaryFallback, t as boundaryDigest } from "../boundary-BM8a_P6E.js";
-import { t as getStore } from "../context-Bcy85rGi.js";
-import { n as viewFor, t as scopedFor } from "../runtime-CB8gQFvS.js";
-export { boundaryDigest, boundaryFallback, getStore, scopedFor, viewFor };
+import { n as getUi, t as getStore } from "../context-DieZVJXu.js";
+import { n as viewFor, t as scopedFor } from "../runtime-D_tMXnsq.js";
+export { boundaryDigest, boundaryFallback, getStore, getUi, scopedFor, slotContent, viewFor };

package/dist/svelte/source.d.ts

@@ -1,13 +1,13 @@
-import { n as requiredPlans } from "../problem-details-DX075l9V.js";
-import { i as describe } from "../describe-DMYiCjJV.js";
+import { n as requiredPlans } from "../problem-details-rIIo8B2C.js";
+import { i as describe } from "../describe-C3ldA9os.js";
 import { t as PermissionBoundaryState } from "../boundary-BmHxVH1J.js";
 import { t as approvalHeaders } from "../headers-Cf-zWvsO.js";
-import { a as FilterResult, c as SubjectView, i as ClientStatus, l as TenantView, n as ApprovalState, o as PermissionSet, r as ClientPermDock, s as PermissionState, t as ApprovalHandle, u as UseRolesOptions } from "../types-CKNSyIf_.js";
-import { i as PermissionBoundaryProps, t as ProtectedProps } from "../protected-xAr24FEC.js";
-import { a as getPermDock, c as permissions, d as subject, f as tenant, i as filtered, l as roles, n as assignable, o as memberships, p as PermDockSvelteOptions, r as assignablePermissions, s as permission, t as approval, u as setPermDock } from "../stores-C0IMQrGI.js";
+import { a as ClientPermDock, c as PermissionSet, d as SubjectView, f as TenantView, i as ApprovalState, l as PermissionState, o as ClientStatus, p as UseRolesOptions, r as ApprovalHandle, s as FilterResult } from "../store-9KO4BlkB.js";
+import { n as PermDockSvelteOptions, r as ProtectedProps, s as PermissionBoundaryProps, t as PermDockDefaults } from "../types-ByUo56un.js";
+import { a as getDescribe, c as permission, d as setPermDock, f as subject, i as filtered, l as permissions, n as assignable, o as getPermDock, p as tenant, r as assignablePermissions, s as memberships, t as approval, u as roles } from "../stores-Cxz_80g-.js";
 import { Component } from "svelte";
 //#region src/svelte/source.d.ts
 export declare const Protected: Component<ProtectedProps>;
 export declare const PermissionBoundary: Component<PermissionBoundaryProps>;
 //#endregion
-export { type ApprovalHandle, type ApprovalState, type ClientPermDock, type ClientStatus, type FilterResult, type PermDockSvelteOptions, type PermissionBoundaryProps, type PermissionBoundaryState, type PermissionSet, type PermissionState, type ProtectedProps, type SubjectView, type TenantView, type UseRolesOptions, approval, approvalHeaders, assignable, assignablePermissions, describe, filtered, getPermDock, memberships, permission, permissions, requiredPlans, roles, setPermDock, subject, tenant };
+export { type ApprovalHandle, type ApprovalState, type ClientPermDock, type ClientStatus, type FilterResult, type PermDockDefaults, type PermDockSvelteOptions, type PermissionBoundaryProps, type PermissionBoundaryState, type PermissionSet, type PermissionState, type ProtectedProps, type SubjectView, type TenantView, type UseRolesOptions, approval, approvalHeaders, assignable, assignablePermissions, describe, filtered, getDescribe, getPermDock, memberships, permission, permissions, requiredPlans, roles, setPermDock, subject, tenant };

package/dist/svelte/source.js

@@ -1,11 +1,11 @@
-import { r as requiredPlans } from "../problem-details-_AMOYz-w.js";
-import { t as describe } from "../describe-B_gVZEVi.js";
+import { r as requiredPlans } from "../problem-details-DECUnXAn.js";
+import { t as describe } from "../describe-Cgkp7eP0.js";
 import { t as approvalHeaders } from "../headers-BZSDieNT.js";
-import { a as getPermDock, c as permissions, d as subject, f as tenant, i as filtered, l as roles, n as assignable, o as memberships, r as assignablePermissions, s as permission, t as approval, u as setPermDock } from "../stores-BT2pSCub.js";
+import { a as getDescribe, c as permission, d as setPermDock, f as subject, i as filtered, l as permissions, n as assignable, o as getPermDock, p as tenant, r as assignablePermissions, s as memberships, t as approval, u as roles } from "../stores-BHXdSbw9.js";
 import PermissionBoundaryComponent from "./PermissionBoundary.svelte";
 import ProtectedComponent from "./Protected.svelte";
 //#region src/svelte/source.ts
 const Protected = ProtectedComponent;
 const PermissionBoundary = PermissionBoundaryComponent;
 //#endregion
-export { PermissionBoundary, Protected, approval, approvalHeaders, assignable, assignablePermissions, describe, filtered, getPermDock, memberships, permission, permissions, requiredPlans, roles, setPermDock, subject, tenant };
+export { PermissionBoundary, Protected, approval, approvalHeaders, assignable, assignablePermissions, describe, filtered, getDescribe, getPermDock, memberships, permission, permissions, requiredPlans, roles, setPermDock, subject, tenant };

package/dist/{validity-uOp8UpYn.js → tenancy-DshjqY0n.js}

@@ -1,7 +1,7 @@
-import { f as isFieldRelation } from "./permissions-DVoF6dMt.js";
 import { t as expiredAt } from "./expiry-BoBJ8Tvc.js";
 import { n as sameId } from "./ids-DC4V4CFu.js";
-import { c as rootScope, l as scopeChain, m as tenantOf, o as resolveScope, r as findScope, t as activeFor, u as scopeIdOf } from "./scopes-CVdPrWN-.js";
+import { c as rootScope, l as scopeChain, m as tenantOf, o as resolveScope, r as findScope, t as activeFor, u as scopeIdOf } from "./scopes-tvpa34ep.js";
+import { l as isFieldRelation } from "./resource-relations-D1Un3pcz.js";
 //#region src/core/tenancy.ts
 function nowSeconds(now) {
 	return now ?? Date.now() / 1e3;
@@ -206,40 +206,4 @@ function membershipField(resource, membershipResource, resources) {
 	}
 }
 //#endregion
-//#region src/core/validity.ts
-/**
-* An instant as Unix seconds: a finite number is taken as seconds already, a
-* string must parse as RFC 3339. Anything else is `undefined`, and the caller
-* decides whether that is "absent" or an error.
-*/
-function instantOf(input) {
-	if (typeof input === "number") return Number.isFinite(input) ? Math.floor(input) : void 0;
-	if (typeof input !== "string" || input.trim() === "") return;
-	const millis = Date.parse(input);
-	return Number.isFinite(millis) ? Math.floor(millis / 1e3) : void 0;
-}
-/**
-* The normalised validity of a grant, or `undefined` when neither bound is
-* set. Fail-closed at definition time: a bound that does not parse, or a
-* window that ends before it starts, throws so a typo never widens a grant.
-*/
-function normalizeValidity(options, permissionKey) {
-	const from = options.validFrom === void 0 ? void 0 : instantOf(options.validFrom);
-	const until = options.validUntil === void 0 ? void 0 : instantOf(options.validUntil);
-	if (options.validFrom !== void 0 && from === void 0) throw new Error(`PermDock: validFrom on '${permissionKey}' must be an RFC 3339 string or Unix seconds`);
-	if (options.validUntil !== void 0 && until === void 0) throw new Error(`PermDock: validUntil on '${permissionKey}' must be an RFC 3339 string or Unix seconds`);
-	if (from !== void 0 && until !== void 0 && until <= from) throw new Error(`PermDock: validUntil on '${permissionKey}' must be after validFrom`);
-	if (from === void 0 && until === void 0) return;
-	return Object.freeze({
-		...from === void 0 ? {} : { from },
-		...until === void 0 ? {} : { until }
-	});
-}
-/** Whether a grant with this validity applies at `now` (Unix seconds); no validity always applies. */
-function isActive(validity, now) {
-	if (validity === void 0) return true;
-	if (validity.from !== void 0 && now < validity.from) return false;
-	return validity.until === void 0 || now < validity.until;
-}
-//#endregion
-export { isMembershipExpired as a, membershipField as c, partitionsOf as d, relatesTo as f, tenantsOf as g, scopeField as h, inTeam as i, nestedAppliesWithoutRow as l, rowInScope as m, normalizeValidity as n, matchScopedMembership as o, resolveActiveTenant as p, heldRoleNamesIn as r, memberOfFields as s, isActive as t, nowSeconds as u };
+export { memberOfFields as a, nowSeconds as c, resolveActiveTenant as d, rowInScope as f, matchScopedMembership as i, partitionsOf as l, tenantsOf as m, inTeam as n, membershipField as o, scopeField as p, isMembershipExpired as r, nestedAppliesWithoutRow as s, heldRoleNamesIn as t, relatesTo as u };

package/dist/terminal/index.d.ts

@@ -1,8 +1,8 @@
-import { C as Policy, D as PolicyVocabulary, Nr as Principal, Pr as Subject, Yn as Decision, ln as PermDock } from "../policy-IB6yxpC3.js";
-import { f as Permission } from "../permissions-DttnqqxC.js";
-import { f as ApprovalStore } from "../types-aqOHTHcp.js";
-import { a as ProblemDetails, t as ApprovalHint } from "../errors-DPdqI50v.js";
-import { t as InstanceOptions } from "../instance-options-jARdwfPN.js";
+import { E as Policy, Or as Principal, ir as Decision, j as PolicyVocabulary, jt as PermDock, kr as Subject } from "../policy-types-sp9P1iIV.js";
+import { d as Permission } from "../permission-types-Dg39z9Kv.js";
+import { f as ApprovalStore } from "../types-Br9IXUBG.js";
+import { a as ProblemDetails, t as ApprovalHint } from "../errors-OD_4c__H.js";
+import { t as InstanceOptions } from "../instance-options-plkrsAog.js";
 //#region src/terminal/types.d.ts
 type TokenSourceName = "device" | "keychain" | "env" | "ci-oidc";
 type TokenSource = TokenSourceName | {

package/dist/terminal/index.js

@@ -1,11 +1,10 @@
-import { t as compact } from "../compact-y6vfu2_f.js";
-import { a as deniedMessage, i as approvalMessage, n as PermDockDeniedError, t as PermDockApprovalRequiredError } from "../errors-Cz5zn0mW.js";
-import { t as createPermDock$1 } from "../permdock-CbgvLnuo.js";
+import { r as isRecord, t as compact } from "../compact-CAf557ZB.js";
+import { a as deniedMessage, i as approvalMessage, n as PermDockDeniedError, t as PermDockApprovalRequiredError } from "../errors-drnfxYtm.js";
 import { n as resourceRef } from "../resource-ref-CaS9yVPi.js";
 import { i as isSubject } from "../subject-C6dLxqHU.js";
-import { l as storedApprovalToken, s as resumeDecision } from "../helpers-H_KARDVC.js";
+import { l as storedApprovalToken, s as resumeDecision } from "../helpers-C9YmyBIa.js";
 import { t as timeoutSignal } from "../timeout-D51niuQP.js";
-import { t as instanceOptions } from "../instance-options-Dhhcnm3y.js";
+import { n as resolveOrNull, t as buildInstance } from "../build-instance-DIIV9DbC.js";
 import { mkdirSync, readFileSync, statSync, unlinkSync, writeFileSync } from "node:fs";
 import path from "node:path";
 import { createInterface } from "node:readline";
@@ -13,13 +12,10 @@ import { homedir } from "node:os";
 //#region src/terminal/device.ts
 /** Milliseconds an authorization server request may take. */
 const TERMINAL_TIMEOUT_MS = 1e4;
-function isRecord$1(value) {
-	return value !== null && typeof value === "object" && !Array.isArray(value);
-}
 async function readJson(response) {
 	try {
 		const body = await response.json();
-		return isRecord$1(body) ? body : null;
+		return isRecord(body) ? body : null;
 	} catch {
 		return null;
 	}
@@ -288,9 +284,6 @@ function credentialsPath(service, runtime) {
 	const xdg = env["XDG_CONFIG_HOME"] ?? path.join(home(), ".config");
 	return path.join(xdg, service, "credentials.json");
 }
-function isRecord(value) {
-	return value !== null && typeof value === "object" && !Array.isArray(value);
-}
 function parseCredential(value) {
 	if (!isRecord(value) || typeof value["access_token"] !== "string") return null;
 	return compact({
@@ -606,28 +599,19 @@ function createPermDock(policy, options) {
 			token: tokenFor(profile, resolveOptions.source),
 			profile
 		};
-		let user = null;
-		try {
-			user = await options.subject(context);
-		} catch {
-			user = null;
-		}
-		let actor;
-		let delegation;
-		if (options.actor !== void 0) try {
-			const resolved = actorFromResolved(await options.actor(context));
-			actor = resolved.actor;
-			delegation = resolved.delegation;
-		} catch {
-			actor = void 0;
-			delegation = void 0;
-		}
-		const built = await createPermDock$1(policy, user, compact({
-			tenant: options.tenant,
-			actor,
-			delegation,
-			...instanceOptions(options)
-		}));
+		const user = await resolveOrNull(() => options.subject(context));
+		const resolveActor = options.actor;
+		const resolved = resolveActor === void 0 ? null : await resolveOrNull(async () => actorFromResolved(await resolveActor(context)));
+		const { permdock: built } = await buildInstance({
+			policy,
+			user,
+			sources: options,
+			scope: {
+				tenant: options.tenant,
+				actor: resolved?.actor,
+				delegation: resolved?.delegation
+			}
+		});
 		last = built;
 		return built;
 	};

package/dist/testing/index.d.ts

@@ -1,15 +1,15 @@
-import { At as SnapshotSource, C as Policy, Ct as SettingsSource, Dr as CustomRole, Ft as TokenVerifier, Mr as Membership, Nr as Principal, Pr as Subject, Pt as TokenSigner, Rt as WhereCompiler, Tt as Snapshot, Wn as ApprovalPolicySource, at as DecisionSink, bn as PolicySource, bt as RelationSource, dt as LimitStore, gt as MembershipSource, jt as SubjectResolver, ln as PermDock, mn as WhereResult, nt as CredentialVerifier, st as EntitlementSource, un as PermDockOptions, xt as RoleSource } from "../policy-IB6yxpC3.js";
-import { f as Permission, g as ResourceInit, u as InferPermissionTree } from "../permissions-DttnqqxC.js";
-import { r as Role } from "../vocabulary-DA8a8zif.js";
-import { f as ApprovalStore } from "../types-aqOHTHcp.js";
-import { t as ToolMap } from "../types-Bvc4oWT6.js";
+import { Dr as Membership, E as Policy, G as EntitlementSource, H as CredentialVerifier, Ht as PolicySource, It as WhereResult, Mt as PermDockOptions, Or as Principal, Sr as CustomRole, W as DecisionSink, Xt as ApprovalPolicySource, Y as LimitStore, Z as MembershipSource, an as Snapshot, at as SnapshotSource, it as SettingsSource, jt as PermDock, kr as Subject, lt as TokenSigner, nt as RoleSource, ot as SubjectResolver, pt as WhereCompiler, tt as RelationSource, ut as TokenVerifier } from "../policy-types-sp9P1iIV.js";
+import { d as Permission, h as ResourceInit, u as InferPermissionTree } from "../permission-types-Dg39z9Kv.js";
+import { r as Role } from "../vocabulary-hhEFLFoL.js";
+import { f as ApprovalStore } from "../types-Br9IXUBG.js";
+import { t as ToolMap } from "../types-DvupZE0w.js";
 import { n as SupabaseHookManifest } from "../manifest-uDS9y5de.js";
 import { t as supabaseMembershipsBudget } from "../budget-JqcRqyhK.js";
 import { n as RevocationFeed } from "../revocations-Cy06JNx2.js";
-import { g as ReplayStore } from "../types-Cq_H8N_X.js";
-import { v as DirectoryStore } from "../index-C8z4RjQV.js";
-import { a as SaasProject } from "../permissions-CDgvKG5L.js";
-import { n as saasPolicy } from "../policy-D2W7uv19.js";
+import { g as ReplayStore } from "../types-C0dee0Qf.js";
+import { v as DirectoryStore } from "../index-BwMe94Xq.js";
+import { a as SaasProject } from "../permissions-COH-KRgT.js";
+import { n as saasPolicy } from "../policy-ur0BBK_e.js";
 import { expectTypeOf } from "vitest";
 //#region src/testing/describe-policy.d.ts
 type MatrixOutcome = "granted" | "denied" | "approval-required";
@@ -229,7 +229,7 @@ export declare function snapshotFixture(policy: Policy, subject: unknown, option
   readonly simulated?: boolean;
 }): Promise<Snapshot>;
 //#endregion
-//#region src/testing/http-adapter.d.ts
+//#region src/testing/http-adapter/domain.d.ts
 /**
  * What a mount wires into its framework. Every value is server-side: the
  * subject comes from a verified bearer token, memberships and plans from the
@@ -352,6 +352,8 @@ type HttpAdapterOptions = {
   /** The mount serves the events stream; the `stream-*` scenarios run only then. */
   readonly streams?: boolean;
 };
+//#endregion
+//#region src/testing/http-adapter/scenarios.d.ts
 /**
  * Real-life HTTP scenarios over the shared SaaS domain. `mount` builds the
  * application once with the adapter under test; every expectation below is
@@ -511,21 +513,70 @@ export declare const authzenTodoData: {
  */
 export declare function authzenTodoVectors(): AuthZenVectors;
 //#endregion
-//#region src/testing/conformance.d.ts
-export declare function testSubjectResolver<TInput>(resolver: SubjectResolver<TInput>, options: {
-  readonly invalid: TInput;
+//#region src/testing/conformance/approvals.d.ts
+type ApprovalStoreOptions = {
+  /**
+   * Opens a second store over the same backing storage, as a restarted process
+   * would. Omit it for stores that do not persist (the resume-after-restart
+   * case is then skipped).
+   */
+  readonly reopen?: () => ApprovalStore | Promise<ApprovalStore>;
+};
+export declare function testApprovalStore(store: ApprovalStore, options?: ApprovalStoreOptions): void;
+/**
+ * Checks an `ApprovalPolicySource`: entries are plain JSON, belong to the
+ * queried tenant or to none, and every entry loads against `policy` (an
+ * entry that does not would deny every call).
+ */
+export declare function testApprovalPolicySource(source: ApprovalPolicySource, options: {
+  readonly policy: Policy;
+  readonly tenant: string;
+  readonly unknown?: string;
 }): void;
-export declare function testMembershipSource(source: MembershipSource, options: {
-  readonly principals: readonly {
-    readonly id: string;
-    readonly kind?: string;
-  }[];
-  readonly expect?: Record<string, readonly Membership[]>;
-  /** With the policy, every membership must name one of its scopes and carry its parent ids. */
+//#endregion
+//#region src/testing/conformance/where.d.ts
+type WhereRow = Readonly<Record<string, unknown>>;
+/**
+ * `matches` answers whether the compiled output selects `row`, for example
+ * by running it against a table holding only that row. With it, every case
+ * must select the rows the in-memory evaluator keeps, including rows whose
+ * fields are NULL.
+ */
+export declare function testWhereCompiler<TTarget>(compiler: WhereCompiler<TTarget>, options: {
+  readonly target: TTarget;
+  readonly isFailClosed?: (compiled: unknown) => boolean;
+  readonly matches?: (compiled: unknown, row: WhereRow) => boolean | Promise<boolean>;
+}): void;
+//#endregion
+//#region src/testing/conformance/credentials.d.ts
+export declare function testReplayStore(store: ReplayStore): void;
+export declare function testRevocationFeed(feed: RevocationFeed): void;
+export declare function testTokenVerifier(verifier: TokenVerifier, options?: {
+  readonly audience?: string;
+  readonly issuer?: string;
+}): void;
+/**
+ * `key` is a live key the verifier knows, or a function issuing one (called
+ * once). `revoke`, when given, revokes it; the runner then expects the key
+ * to stop verifying.
+ */
+export declare function testCredentialVerifier(verifier: CredentialVerifier, options: {
+  readonly key: string | (() => string | Promise<string>);
+  readonly revoke?: () => void | Promise<void>;
+}): void;
+export declare function testTokenSigner(signer: TokenSigner, options: {
+  readonly verifier: TokenVerifier;
+}): void;
+//#endregion
+//#region src/testing/conformance/runtime-stores.d.ts
+export declare function testLimitStore(store: LimitStore): void;
+export declare function testDecisionSink(sink: DecisionSink): void;
+export declare function testSnapshotSource(source: SnapshotSource): void;
+export declare function testPolicySource(source: PolicySource, options?: {
   readonly policy?: Policy;
-  /** Passed to every `membershipsFor`; a source keyed by tenant answers nothing without one. */
-  readonly tenant?: string;
 }): void;
+//#endregion
+//#region src/testing/conformance/relations.d.ts
 /**
  * A `RelationSource` answers facts only: well-formed chains nearest first and
  * no longer than `depth`, holders with principal ids or group references and
@@ -548,6 +599,22 @@ export declare function testRelationSource(source: RelationSource, options: {
     readonly links?: Readonly<Record<string, string>>;
   };
 }): void;
+//#endregion
+//#region src/testing/conformance/identity.d.ts
+export declare function testSubjectResolver<TInput>(resolver: SubjectResolver<TInput>, options: {
+  readonly invalid: TInput;
+}): void;
+export declare function testMembershipSource(source: MembershipSource, options: {
+  readonly principals: readonly {
+    readonly id: string;
+    readonly kind?: string;
+  }[];
+  readonly expect?: Record<string, readonly Membership[]>;
+  /** With the policy, every membership must name one of its scopes and carry its parent ids. */
+  readonly policy?: Policy;
+  /** Passed to every `membershipsFor`; a source keyed by tenant answers nothing without one. */
+  readonly tenant?: string;
+}): void;
 export declare function testEntitlementSource(source: EntitlementSource, options: {
   readonly principal: {
     readonly id: string;
@@ -566,69 +633,14 @@ export declare function testRoleSource(source: RoleSource, options: {
    */
   readonly every?: readonly string[];
 }): void;
-export declare function testLimitStore(store: LimitStore): void;
-export declare function testDecisionSink(sink: DecisionSink): void;
-export declare function testSnapshotSource(source: SnapshotSource): void;
-export declare function testPolicySource(source: PolicySource, options?: {
-  readonly policy?: Policy;
-}): void;
-export declare function testReplayStore(store: ReplayStore): void;
-export declare function testRevocationFeed(feed: RevocationFeed): void;
 export declare function testDirectoryStore(store: DirectoryStore, options: {
   readonly tenants: readonly [string, string];
 }): void;
-type ApprovalStoreOptions = {
-  /**
-   * Opens a second store over the same backing storage, as a restarted process
-   * would. Omit it for stores that do not persist (the resume-after-restart
-   * case is then skipped).
-   */
-  readonly reopen?: () => ApprovalStore | Promise<ApprovalStore>;
-};
-export declare function testApprovalStore(store: ApprovalStore, options?: ApprovalStoreOptions): void;
-export declare function testTokenVerifier(verifier: TokenVerifier, options?: {
-  readonly audience?: string;
-  readonly issuer?: string;
-}): void;
 /** Settings for `tenant`, or `undefined`; a thrown source fails the runner. */
 export declare function testSettingsSource(source: SettingsSource, options: {
   readonly tenant: string;
   readonly unknown?: string;
 }): void;
-/**
- * Checks an `ApprovalPolicySource`: entries are plain JSON, belong to the
- * queried tenant or to none, and every entry loads against `policy` (an
- * entry that does not would deny every call).
- */
-export declare function testApprovalPolicySource(source: ApprovalPolicySource, options: {
-  readonly policy: Policy;
-  readonly tenant: string;
-  readonly unknown?: string;
-}): void;
-/**
- * `key` is a live key the verifier knows, or a function issuing one (called
- * once). `revoke`, when given, revokes it; the runner then expects the key
- * to stop verifying.
- */
-export declare function testCredentialVerifier(verifier: CredentialVerifier, options: {
-  readonly key: string | (() => string | Promise<string>);
-  readonly revoke?: () => void | Promise<void>;
-}): void;
-export declare function testTokenSigner(signer: TokenSigner, options: {
-  readonly verifier: TokenVerifier;
-}): void;
-type WhereRow = Readonly<Record<string, unknown>>;
-/**
- * `matches` answers whether the compiled output selects `row`, for example
- * by running it against a table holding only that row. With it, every case
- * must select the rows the in-memory evaluator keeps, including rows whose
- * fields are NULL.
- */
-export declare function testWhereCompiler<TTarget>(compiler: WhereCompiler<TTarget>, options: {
-  readonly target: TTarget;
-  readonly isFailClosed?: (compiled: unknown) => boolean;
-  readonly matches?: (compiled: unknown, row: WhereRow) => boolean | Promise<boolean>;
-}): void;
 //#endregion
 //#region src/testing/jwt-fixtures.d.ts
 export declare const jwtFixtureJwks: {