permdock 0.6.0 → 0.8.0

package/dist/{import-wyqXUyjm.js → import-CST57XLp.js}

@@ -1,11 +1,11 @@
 import { r as isRecord } from "./compact-CAf557ZB.js";
-import { i as configError, u as usageResult } from "./errors-CWTY6uih.js";
-import { s as writeFileEnsuringDir } from "./files-D_JIzUrP.js";
-import { r as escapeSqlIdent, s as quoteSqlLiteral } from "./sql-B5T1IL83.js";
-import { C as parseMembershipsFlag, r as HELPERS } from "./shared-BAK8t4Uo.js";
-import { f as pgConnector } from "./policies-DP2nqRoF.js";
-import { t as FIELD_VIEWS } from "./fields-OYG_JR78.js";
-import { n as emptySchema, r as isSchemaKind, t as emitPermissionsModule } from "./generate-CNU1pIOo.js";
+import { i as configError, u as usageResult } from "./errors-Vpu6rKHl.js";
+import { s as writeFileEnsuringDir } from "./files-BSjrtIHw.js";
+import { r as escapeSqlIdent, s as quoteSqlLiteral } from "./sql-0WjxIp9g.js";
+import { C as parseMembershipsFlag, r as HELPERS } from "./shared-Afctg7B0.js";
+import { n as pgConnector } from "./pg-DQTqRrou.js";
+import { t as FIELD_VIEWS } from "./fields-D0vUI6dq.js";
+import { n as emptySchema, r as isSchemaKind, t as emitPermissionsModule } from "./generate-CezbCaTI.js";
 import { existsSync, readFileSync } from "node:fs";
 import { resolve } from "node:path";
 import { createHash } from "node:crypto";
@@ -42,7 +42,10 @@ function funcName(value) {
 	if (!Array.isArray(names) || names.length === 0) return;
 	return names.map((item) => stringVal(item) ?? "").join(".");
 }
-/** The expression of a scalar `(select <expr>)`, the InitPlan form generate writes. */
+/**
+* The expression of a scalar `(select <expr>)`, the InitPlan form generate
+* writes.
+*/
 function scalarSubselect(value) {
 	const targets = asNode$1(asNode$1(asNode$1(asNode$1(unwrap(value))?.["SubLink"])?.["subselect"])?.["SelectStmt"])?.["targetList"];
 	if (!Array.isArray(targets) || targets[0] === void 0) return;
@@ -175,7 +178,7 @@ async function fingerprintSql(sql) {
 		const deparsed = await deparse(parsed);
 		return createHash("sha256").update(deparsed).digest("hex").slice(0, 16);
 	} catch {
-		return createHash("sha256").update(sql.replaceAll(/\s+/g, " ").trim().toLowerCase()).digest("hex").slice(0, 16);
+		return createHash("sha256").update(sql.replaceAll(/\s+/gu, " ").trim().toLowerCase()).digest("hex").slice(0, 16);
 	}
 }
 function nodeStmt(first) {
@@ -192,7 +195,10 @@ function jwtClaim(value) {
 	const claim = constValue(expr["rexpr"]);
 	return typeof claim === "string" ? claim : void 0;
 }
-/** `auth.jwt()` / `auth.session()`, bare or as a scalar `(select …)`; a column's `->>` is row data, not a claim. */
+/**
+* `auth.jwt()` / `auth.session()`, bare or as a scalar `(select …)`; a column's
+* `->>` is row data, not a claim.
+*/
 function isJwtCall(value) {
 	const inner = scalarSubselect(value);
 	if (inner !== void 0) return isJwtCall(inner);
@@ -203,20 +209,15 @@ function isJwtCall(value) {
 //#region src/cli/rls/import-membership.ts
 /**
 * What the `where` of a membership subquery on `table` says, or `undefined`
-* when any part of it cannot be read as one. A subquery imports as
-* `memberOf` only when it binds the membership row to the signed-in user
-* and to the policy row, and filters roles with string literals at most:
-* a predicate left unread would widen the imported condition.
+* when any part of it cannot be read as one. A subquery imports as `memberOf`
+* only when it binds the membership row to the signed-in user and to the policy
+* row, and filters roles with string literals at most: a predicate left unread
+* would widen the imported condition.
 */
 function membershipRoles(subquery, table) {
 	const where = selectWhere(subquery.select);
 	if (where === void 0) return;
-	const scopeColumns = new Set([
-		...Object.values(table.columns ?? {}),
-		table.tenant,
-		table.team,
-		table.id
-	].filter((column) => column !== void 0));
+	const scopeColumns = new Set([...Object.values(table.columns ?? {}), table.id].filter((column) => column !== void 0));
 	if (subquery.field !== void 0 && !scopeColumns.has(selectTarget(subquery.select) ?? "")) return;
 	const roleColumn = typeof table.role === "string" ? table.role : void 0;
 	const roles = [];
@@ -393,7 +394,10 @@ function helperCall(value) {
 	} : void 0;
 }
 const MEMBER = /^member_([a-z][a-z0-9_]*)_ids$/u;
-/** `col in (select member_<scope>_ids())`: any live membership of the row's instance. */
+/**
+* `col in (select member_<scope>_ids())`: any live membership of the row's
+* instance.
+*/
 function memberCall(value) {
 	const sub = asNode$1(asNode$1(unwrap(value))?.["SubLink"]);
 	const kind = sub?.["subLinkType"];
@@ -442,8 +446,8 @@ function helperCalls(conjunct) {
 /**
 * The role structure of a policy that calls the helpers: each OR branch's
 * helper calls become grants (roles from the `role_permissions` seeds), the
-* branch's other conjuncts become their `where`. Restrictive policies are
-* read through their outer `not`.
+* branch's other conjuncts become their `where`. Restrictive policies are read
+* through their outer `not`.
 */
 async function helperGrants(sql, memberships, functions, seeds) {
 	if (sql === void 0) return [];
@@ -480,10 +484,10 @@ async function helperGrants(sql, memberships, functions, seeds) {
 			else rest.push(mapped);
 		}
 		if (calls.length === 0) continue;
-		const condition = !portable ? unportable : rest.length === 0 ? void 0 : rest.length === 1 ? rest[0] : {
+		const condition = portable ? rest.length === 0 ? void 0 : rest.length === 1 ? rest[0] : {
 			op: "and",
 			conditions: rest
-		};
+		} : unportable;
 		for (const call of calls) {
 			const permission = seeds.find((seed) => seed.grantKey === call.key)?.permission ?? call.key.replace(/#[a-z0-9][a-z0-9_-]*$/u, "");
 			grants.push({
@@ -543,10 +547,7 @@ function mapNode(value, ctx) {
 	const subquery = membershipSubquery(node);
 	if (subquery !== void 0) {
 		const { table } = subquery;
-		const mappedScopes = Object.entries(memberships?.scopes ?? {});
-		if (memberships?.tenant !== void 0) mappedScopes.push(["tenant", memberships.tenant]);
-		if (memberships?.team !== void 0) mappedScopes.push(["team", memberships.team]);
-		const matches = mappedScopes.filter(([, mapped]) => mapped.table === table);
+		const matches = Object.entries(memberships?.scopes ?? {}).filter(([, mapped]) => mapped.table === table);
 		if (matches.length > 0) {
 			for (const [scope, mapped] of matches) {
 				const read = membershipRoles(subquery, mapped);
@@ -631,7 +632,10 @@ function seedFromRow(row) {
 		effect: row["effect"] === "deny" ? "deny" : "allow"
 	};
 }
-/** `role_permissions` rows from the `insert ... values` statements of a SQL dump. */
+/**
+* `role_permissions` rows from the `insert ... values` statements of a SQL
+* dump.
+*/
 async function seedsFromSql(sql) {
 	let parsed;
 	try {
@@ -754,7 +758,10 @@ function sourceOf(select) {
 		companion: right
 	};
 }
-/** A mask is `allow`, `not deny` or `allow and not deny`; the generator puts the deny last. */
+/**
+* A mask is `allow`, `not deny` or `allow and not deny`; the generator puts the
+* deny last.
+*/
 function splitMask(mask) {
 	const bool = asNode(asNode(mask)?.["BoolExpr"]);
 	if (bool?.["boolop"] === "NOT_EXPR") return { deny: list(bool["args"])[0] };
@@ -778,9 +785,9 @@ async function grantsOf(node, memberships, functions, seeds) {
 }
 /**
 * Reads back the field views `rls generate --fields views` writes: a
-* `security_invoker` `<table>_visible` whose restricted columns are
-* `case when <mask> then col end`, either inline or through the
-* `<table>_visible_fields` companion it joins. Other views are ignored.
+* `security_invoker` `<table>_visible` whose restricted columns are `case when
+* <mask> then col end`, either inline or through the `<table>_visible_fields`
+* companion it joins. Other views are ignored.
 */
 async function fieldViewsFromSql(sql, memberships, functions, seeds) {
 	let stmts;
@@ -830,7 +837,10 @@ async function fieldViewsFromSql(sql, memberships, functions, seeds) {
 	return out;
 }
 const quote = escapeSqlIdent;
-/** `create view` statements for every view in the database, from `pg_get_viewdef` and the view's options. */
+/**
+* `create view` statements for every view in the database, from
+* `pg_get_viewdef` and the view's options.
+*/
 async function viewsSqlFromDb(query) {
 	return (await query(`select n.nspname as schema, c.relname as name, c.reloptions as options, pg_get_viewdef(c.oid) as definition
      from pg_class c join pg_namespace n on n.oid = c.relnamespace
@@ -845,9 +855,9 @@ async function viewsSqlFromDb(query) {
 }
 //#endregion
 //#region src/cli/rls/import.ts
-const POLICY_RE = /create\s+policy\s+"?([A-Za-z0-9_]+)"?\s+on\s+"?([A-Za-z0-9_]+)"?([\s\S]*?);/gi;
+const POLICY_RE = /create\s+policy\s+"?([A-Za-z0-9_]+)"?\s+on\s+"?([A-Za-z0-9_]+)"?([\s\S]*?);/giu;
 function extractParenClause(sql, keyword) {
-	const match = new RegExp(`\\b${keyword}\\s*\\(`, "i").exec(sql);
+	const match = new RegExp(`\\b${keyword}\\s*\\(`, "iu").exec(sql);
 	if (match?.index === void 0) return;
 	const start = match.index + match[0].length;
 	let depth = 1;
@@ -866,11 +876,11 @@ function splitPolicies(sql) {
 		const name = match[1] ?? "policy";
 		const table = match[2] ?? "table";
 		const body = match[3] ?? "";
-		const clauses = body.search(/\b(?:using|with\s+check)\s*\(/i);
+		const clauses = body.search(/\b(?:using|with\s+check)\s*\(/iu);
 		const header = clauses === -1 ? body : body.slice(0, clauses);
-		const asRestrictive = /\bas\s+restrictive\b/i.test(header);
-		const cmdMatch = /\bfor\s+(all|select|insert|update|delete)\b/i.exec(header);
-		const toMatch = /\bto\s+([^\n]+)/i.exec(header);
+		const asRestrictive = /\bas\s+restrictive\b/iu.test(header);
+		const cmdMatch = /\bfor\s+(all|select|insert|update|delete)\b/iu.exec(header);
+		const toMatch = /\bto\s+([^\n]+)/iu.exec(header);
 		const using = extractParenClause(body, "using");
 		const check = extractParenClause(body, "with\\s+check");
 		const roles = (toMatch?.[1] ?? "authenticated").split(",").map((item) => item.trim()).filter((item) => item !== "");
@@ -922,7 +932,7 @@ function emitGenerated(catalog, fieldViews, schema) {
 		resources: tables.map((table) => {
 			const { actions, collection } = actionsFor(catalog.filter((item) => item.table === table).map((item) => item.cmd));
 			return {
-				path: [table.replaceAll(/[^A-Za-z0-9_]/g, "_")],
+				path: [table.replaceAll(/[^A-Za-z0-9_]/gu, "_")],
 				schema: emptySchema(kind),
 				actions,
 				collection
@@ -931,7 +941,7 @@ function emitGenerated(catalog, fieldViews, schema) {
 	});
 }
 function assertNoServiceRole(sql) {
-	if (/\bto\s+service_role\b|\bfrom\s+service_role\b/i.test(sql)) throw configError("PermDock CLI: imported SQL must never target service_role");
+	if (/\bto\s+service_role\b|\bfrom\s+service_role\b/iu.test(sql)) throw configError("PermDock CLI: imported SQL must never target service_role");
 }
 async function seedsFromDb(query) {
 	const schema = (await query(`select table_schema from information_schema.tables where table_name = 'role_permissions' order by table_schema = 'permdock' desc, table_schema = 'public' desc, table_schema limit 1`)).rows[0]?.["table_schema"];
@@ -945,10 +955,13 @@ async function seedsFromDb(query) {
 		return [];
 	}
 }
-/** `pg_policies.roles` is a `name[]`, which `pg` returns as an array or, untyped, as `{a,b}`. */
+/**
+* `pg_policies.roles` is a `name[]`, which `pg` returns as an array or,
+* untyped, as `{a,b}`.
+*/
 function policyRoles(value) {
 	if (Array.isArray(value)) return value.map(String);
-	return typeof value === "string" ? value.replaceAll(/[{}]/g, "").split(",").map((item) => item.trim()).filter((item) => item !== "") : [];
+	return typeof value === "string" ? value.replaceAll(/[{}]/gu, "").split(",").map((item) => item.trim()).filter((item) => item !== "") : [];
 }
 async function policiesFromDb(db, connect) {
 	const client = await connect(db);
@@ -1011,7 +1024,11 @@ async function runRlsImport(input) {
 		seeds = await seedsFromSql(sql);
 		policies = splitPolicies(await canonicalDump(sql) ?? sql);
 		if (policies.length === 0) policies = splitPolicies(sql);
-	} else if (input.db !== void 0) try {
+	} else if (input.db === void 0) return {
+		code: 2,
+		output: "PermDock CLI: rls import needs --sql <file> or a database: --db-url-stdin, DATABASE_URL or SUPABASE_DB_URL"
+	};
+	else try {
 		const fromDb = await policiesFromDb(input.db, input.connect ?? pgConnector("permdock rls import --db-url-stdin", input.cwd));
 		policies = fromDb.policies;
 		bodies = fromDb.bodies;
@@ -1020,10 +1037,6 @@ async function runRlsImport(input) {
 	} catch (cause) {
 		return usageResult(cause);
 	}
-	else return {
-		code: 2,
-		output: "PermDock CLI: rls import needs --sql <file> or a database: --db-url-stdin, DATABASE_URL or SUPABASE_DB_URL"
-	};
 	const memberships = parseMembershipsFlag(input.memberships) ?? input.config.rls?.memberships;
 	const roleValues = input.config.rls?.roleValues;
 	if (roleValues !== void 0) seeds = seeds.map((row) => {
@@ -1070,7 +1083,7 @@ function fieldViewHint(view) {
 	return `field view ${view.view} over ${view.table}: ${view.restricted.map((item) => item.column).join(", ")} are field-limited; set fields on the read grants that list them (fieldViews export)`;
 }
 function membershipHint(table) {
-	return [`exists over ${table} stayed opaque; if it holds memberships, map it in permdock.config.ts:`, `// rls: { memberships: { tenant: { table: '${table}', user: 'user_id', tenant: 'tenant_id', role: 'role' } } }`].join("\n");
+	return [`exists over ${table} stayed opaque; if it holds memberships, map it in permdock.config.ts:`, `// rls: { memberships: { scopes: { tenant: { table: '${table}', user: 'user_id', columns: { tenant: 'tenant_id' }, role: 'role' } } } }`].join("\n");
 }
 function uniqueHints(names, bodies) {
 	const lines = [];

package/dist/{import-CNV7I2Dw.js → import-_YqhhwvX.js}

@@ -1,10 +1,10 @@
 import { r as isRecord } from "./compact-CAf557ZB.js";
-import { t as byCodePoint } from "./compare-pfyVnBjE.js";
-import { i as readJsonFile } from "./files-D_JIzUrP.js";
-import { t as applyFiles } from "./files-C5ZI27eV.js";
-import { n as httpRequest } from "./http-DXJ37RDA.js";
-import { i as schemaExpression, t as emitPermissionsModule } from "./generate-CNU1pIOo.js";
-import { t as validateOpenapi } from "./schema-yLuBWWsh.js";
+import { t as byCodePoint } from "./compare-DTfyUunF.js";
+import { i as readJsonFile } from "./files-BSjrtIHw.js";
+import { t as applyFiles } from "./files-B3AA05f1.js";
+import { n as httpRequest } from "./http-DOL33cO0.js";
+import { i as schemaExpression, t as emitPermissionsModule } from "./generate-CezbCaTI.js";
+import { t as validateOpenapi } from "./schema-Dst9I9Gs.js";
 import { existsSync, readFileSync } from "node:fs";
 import { resolve } from "node:path";
 //#region ../../node_modules/.pnpm/yaml@2.9.1/node_modules/yaml/browser/dist/nodes/identity.js

package/dist/{index-B8YjkEZ4.d.ts → index-B8s204GL.d.ts}

@@ -1,9 +1,8 @@
-import { Ct as Credential, Nn as Decision, St as ApiKeyPrincipal, T as Policy, Tt as CredentialKind, U as CredentialVerifier, ar as Subject, at as SettingsSource, dt as TokenVerifier, gt as SupportSession, j as PolicyVocabulary, lt as TokenFailureCause, q as DecisionSink, qt as AuthEvent, rr as Principal, ut as TokenSigner } from "./policy-types-n0uRTsW8.js";
-import { E as PermissionTree, w as Permission } from "./vocabulary-CN8H_9UF.js";
-import { p as PrincipalSource } from "./permdock-SV8ZINYT.js";
-import { t as Disclosure } from "./problem-details-B45V5d2b.js";
-import { a as ProblemDetails, t as ApprovalHint } from "./errors-DH5QEGXh.js";
-import { c as ServerPermDock, l as ServerPermDockOptions } from "./server-types-CKQiCnON.js";
+import { Ct as Credential, Ln as Decision, St as ApiKeyPrincipal, T as Policy, Tt as CredentialKind, U as CredentialVerifier, Zt as AuthEvent, at as SettingsSource, dt as TokenVerifier, gt as SupportSession, j as PolicyVocabulary, lr as Subject, lt as TokenFailureCause, q as DecisionSink, sr as Principal, ut as TokenSigner } from "./policy-types-CCiDRZBH.js";
+import { f as PermissionTree, u as Permission } from "./permission-types-CAY-GU7e.js";
+import { _ as PrincipalSource } from "./permdock-B6Sf4T_S.js";
+import { a as ProblemDetails, s as Disclosure, t as ApprovalHint } from "./errors-zi_4T-rx.js";
+import { c as ServerPermDock, l as ServerPermDockOptions } from "./server-types-CIlpSA2G.js";
 //#region src/server/create.d.ts
 /**
  * The Fetch factory behind every HTTP adapter. The subject and actor are
@@ -21,9 +20,9 @@ type ProblemFromErrorOptions = {
 };
 /**
  * Turns a thrown PermDock error into its Problem Details response, with the
- * status, `WWW-Authenticate` and rate-limit fields `protect` sends for the
- * same decision. Returns `undefined` for anything else so the framework's own
- * error path takes over.
+ * status, `WWW-Authenticate` and rate-limit fields `protect` sends for the same
+ * decision. Returns `undefined` for anything else so the framework's own error
+ * path takes over.
  */
 declare function problemFromError(error: unknown, options?: ProblemFromErrorOptions): Response | undefined;
 //#endregion
@@ -35,7 +34,10 @@ type ApiKeyParts = {
   readonly id: string;
   readonly secret: string;
 };
-/** What an application stores per key: the credential and the key's hash, never the key. */
+/**
+ * What an application stores per key: the credential and the key's hash, never
+ * the key.
+ */
 type StoredCredential = {
   readonly credential: Credential;
   readonly hash: string;
@@ -43,19 +45,19 @@ type StoredCredential = {
 /**
  * Splits `pdk_<id>_<secret><checksum>`: `id` is 1 to 128 of `A-Z a-z 0-9 _ -`,
  * the secret 43 base62 characters and the checksum the 6 base62 characters of
- * the CRC-32 of everything before it. Anything else, including a checksum
- * that does not match, is `undefined`.
+ * the CRC-32 of everything before it. Anything else, including a checksum that
+ * does not match, is `undefined`.
  */
 declare function parseApiKey(key: unknown): ApiKeyParts | undefined;
 /**
- * Splits `pdfeed_<id>_<secret><checksum>`. `id` is `isFeedId`, the secret is
- * 26 lowercase base32 characters and the checksum is 6 more. A checksum that
- * does not match is `undefined`.
+ * Splits `pdfeed_<id>_<secret><checksum>`. `id` is `isFeedId`, the secret is 26
+ * lowercase base32 characters and the checksum is 6 more. A checksum that does
+ * not match is `undefined`.
  */
 declare function parseFeedKey(key: unknown): ApiKeyParts | undefined;
 /**
- * A fresh `pdfeed_<id>_<secret><checksum>`: 26 lowercase base32 characters
- * (130 bits) and a 6-character CRC-32 checksum. The whole key is lowercase.
+ * A fresh `pdfeed_<id>_<secret><checksum>`: 26 lowercase base32 characters (130
+ * bits) and a 6-character CRC-32 checksum. The whole key is lowercase.
  */
 declare function generateFeedKey(id: string): string;
 /**
@@ -67,11 +69,11 @@ declare function generateApiKey(id: string): string;
 /** base64url SHA-256 of the whole key, the value to store and compare. */
 declare function hashApiKey(key: string): Promise<string>;
 /**
- * A `CredentialVerifier` over the application's own table: `find` looks a
- * key up by the id in it, and the key's hash is compared in constant time.
- * A record that is not a valid v1 credential, or whose id is not the key's,
- * verifies to `null`. A throwing `find` propagates, so the resolver denies
- * with `source-threw`.
+ * A `CredentialVerifier` over the application's own table: `find` looks a key
+ * up by the id in it, and the key's hash is compared in constant time. A record
+ * that is not a valid v1 credential, or whose id is not the key's, verifies to
+ * `null`. A throwing `find` propagates, so the resolver denies with
+ * `source-threw`.
  */
 declare function apiKeyVerifier(options: {
   readonly find: (id: string) => StoredCredential | null | undefined | Promise<StoredCredential | null | undefined>;
@@ -80,14 +82,14 @@ declare function apiKeyVerifier(options: {
 }): CredentialVerifier;
 type MemoryCredentialStore = CredentialVerifier & {
   /** Stores `credential` and returns its key; the key is never stored. */
-  issue(credential: Credential): Promise<string>;
+  issue: (credential: Credential) => Promise<string>;
   /** A new secret for the same id; the old key stops verifying at once. */
-  rotate(id: string): Promise<string | undefined>;
+  rotate: (id: string) => Promise<string | undefined>;
   /** `true` when a credential was removed. */
-  revoke(id: string): boolean;
-  list(): readonly Credential[];
+  revoke: (id: string) => boolean;
+  list: () => readonly Credential[];
   /** When `touch` last recorded a use of `id`, as RFC 3339. */
-  lastUsedAt(id: string): string | undefined;
+  lastUsedAt: (id: string) => string | undefined;
 };
 /**
  * In-process credentials for tests and single-replica apps. `issue`, `rotate`
@@ -99,24 +101,30 @@ declare function memoryCredentialStore(options?: {
 }): MemoryCredentialStore;
 type ApiKeySubjectOptions = {
   readonly verifier: CredentialVerifier;
-  /** The definitions, to turn the credential's permission keys into its delegation. */
+  /**
+   * The definitions, to turn the credential's permission keys into its
+   * delegation.
+   */
   readonly permissions: PermissionTree;
   /**
-   * Loads the live owner of a user-bound key: roles and memberships as of
-   * this request, asked with the key's tenant. `null` (a deleted or
-   * suspended user) is anonymous with `owner-unavailable`, and a throw is
-   * `source-threw`. Without it the owner is `{ id, kind: 'user' }` and its
-   * rights come from the `memberships` source passed to `createPermDock`.
+   * Loads the live owner of a user-bound key: roles and memberships as of this
+   * request, asked with the key's tenant. `null` (a deleted or suspended user)
+   * is anonymous with `owner-unavailable`, and a throw is `source-threw`.
+   * Without it the owner is `{ id, kind: 'user' }` and its rights come from the
+   * `memberships` source passed to `createPermDock`.
    */
   readonly principals?: PrincipalSource;
-  /** The tenant the request acts in: a user key is held to its owner's memberships there. */
+  /**
+   * The tenant the request acts in: a user key is held to its owner's
+   * memberships there.
+   */
   readonly tenant?: string;
   /** `true` when the application revoked the credential id; a throw denies. */
   readonly revoked?: (id: string) => boolean | Promise<boolean>;
   /**
-   * The tenant `credentials` policy, checked on every use so a tightened
-   * policy reaches existing keys: a service key's own tenant, a user key's
-   * the `tenant` the resolver is called with. A throw denies.
+   * The tenant `credentials` policy, checked on every use so a tightened policy
+   * reaches existing keys: a service key's own tenant, a user key's the
+   * `tenant` the resolver is called with. A throw denies.
    */
   readonly settings?: SettingsSource;
   /** Receives a `credential` event with operation `used` for sampled uses. */
@@ -132,10 +140,10 @@ type ApiKeySubjectOptions = {
 };
 /**
  * Resolves an opaque API key (`pdk_<id>_<secret>`) into the subject its
- * credential acts as. Every failure (a malformed or unknown key, a record
- * that is not a valid credential, expiry, a tenant policy the key breaks, a
- * revoked id, a missing owner, a throwing verifier, source or callback) is
- * the anonymous subject, never a throw.
+ * credential acts as. Every failure (a malformed or unknown key, a record that
+ * is not a valid credential, expiry, a tenant policy the key breaks, a revoked
+ * id, a missing owner, a throwing verifier, source or callback) is the
+ * anonymous subject, never a throw.
  */
 declare function subjectFromApiKey(key: string | undefined | null, options: ApiKeySubjectOptions): Promise<Subject<ApiKeyPrincipal>>;
 //#endregion
@@ -145,7 +153,7 @@ type SupportSessionFailureCause = TokenFailureCause | "invalid-claims" | "sessio
 /** The live state of each support session, so one can end before it expires. */
 type SupportSessionSource = {
   /** The session as of now, or `null` for an unknown one. A throw ends it. */
-  session(id: string): {
+  session: (id: string) => {
     readonly id: string;
     readonly ended?: boolean;
   } | null | Promise<{
@@ -176,19 +184,19 @@ type SupportSessionContext = {
 };
 /**
  * Signs a granted `SupportSession` as a `vnd.permdock.support-session+jwt`
- * (`sub` the viewed principal, `act` the support actor, `jti` the session
- * id) that expires with the session. Throws a `TypeError` for a record
+ * (`sub` the viewed principal, `act` the support actor, `jti` the session id)
+ * that expires with the session. Throws a `TypeError` for a record
  * `parseSupportSession` refuses.
  */
 declare function signSupportSession(session: SupportSession, signer: TokenSigner, options?: {
   readonly audience?: string | readonly string[];
 }): Promise<string>;
 /**
- * Resolves a `vnd.permdock.support-session+jwt` into the subject each
- * request of the session acts as: the viewed principal loaded live, a
- * `support` actor, the session's permissions as the delegation and
- * `context.supportSession`. The actor must still exist. Every failure is the
- * anonymous subject, never a throw.
+ * Resolves a `vnd.permdock.support-session+jwt` into the subject each request
+ * of the session acts as: the viewed principal loaded live, a `support` actor,
+ * the session's permissions as the delegation and `context.supportSession`. The
+ * actor must still exist. Every failure is the anonymous subject, never a
+ * throw.
  */
 declare function subjectFromSupportSession(token: string | undefined | null, options: SupportSessionSubjectOptions): Promise<Subject>;
 //#endregion
@@ -196,15 +204,19 @@ declare function subjectFromSupportSession(token: string | undefined | null, opt
 declare function wwwAuthenticate(decision: Decision, permission: Permission | undefined, credentials?: boolean): string | undefined;
 declare function problemResponse(details: ProblemDetails, permission?: Permission, decision?: Decision, extra?: Readonly<Record<string, string>>, credentials?: boolean): Response;
 declare function validationProblem(detail: string): Response;
-declare function problemFromDecision(decision: Decision, permission: Permission, subject: Subject | undefined, options?: {
+type DecisionProblemOptions = {
   readonly instance?: string;
   readonly approval?: ApprovalHint;
   /** `'hide'` on a loaded row: a denial answers as `404` `/not-found`. */
   readonly disclosure?: Disclosure;
   /** Whether the request carried credentials, which picks the `401` challenge. */
   readonly credentials?: boolean;
-  /** The scope an `insufficient_scope` challenge names; the permission's own scope when absent. */
+  /**
+   * The scope an `insufficient_scope` challenge names; the permission's own
+   * scope when absent.
+   */
   readonly scope?: string;
-}): Response;
+};
+declare function problemFromDecision(decision: Decision, permission: Permission, subject: Subject | undefined, options?: DecisionProblemOptions): Response;
 //#endregion
 export { subjectFromApiKey as C, createPermDock as E, parseFeedKey as S, problemFromError as T, generateApiKey as _, SupportSessionContext as a, memoryCredentialStore as b, SupportSessionSubjectOptions as c, ApiKeyFailureCause as d, ApiKeyParts as f, apiKeyVerifier as g, StoredCredential as h, wwwAuthenticate as i, signSupportSession as l, MemoryCredentialStore as m, problemResponse as n, SupportSessionFailureCause as o, ApiKeySubjectOptions as p, validationProblem as r, SupportSessionSource as s, problemFromDecision as t, subjectFromSupportSession as u, generateFeedKey as v, ProblemFromErrorOptions as w, parseApiKey as x, hashApiKey as y };