permdock 0.7.0 → 0.9.0

package/dist/config-BwPBfN0t.js

@@ -0,0 +1,108 @@
+import { r as isRecord } from "./compact-CAf557ZB.js";
+import { i as configError, n as CliError } from "./errors-Vpu6rKHl.js";
+import { a as isSection, i as isModuleKey, n as MODULE_KEYS, o as kindOf, r as describeKinds, t as CONFIG_SHAPE } from "./config-shape-ykV0Vm2n.js";
+import { existsSync } from "node:fs";
+import { relative, resolve } from "node:path";
+//#region src/cli/project/config-schema.ts
+const TOP_LEVEL = /* @__PURE__ */ new Set([...Object.keys(MODULE_KEYS), ...Object.keys(CONFIG_SHAPE)]);
+function invalid(file, message) {
+	return new CliError("usage", `PermDock CLI: ${file}: ${message}`);
+}
+/**
+* Checks the shape a command relies on before it reads the config: module paths
+* are strings, each section is an object, and each key PermDock reads holds a
+* value of a kind it accepts. A key PermDock does not read is a warning, so a
+* config written for a newer version still loads.
+*/
+function parseConfig(value, file) {
+	if (value === void 0) return {
+		config: {},
+		warnings: []
+	};
+	if (!isRecord(value)) throw new CliError("usage", `PermDock CLI: ${file} must export a config object as default (use defineConfig)`);
+	const warnings = [];
+	const unknown = (path, known) => `${file}: unknown key ${path}; PermDock reads ${[...known].join(", ")}`;
+	for (const [key, entry] of Object.entries(value)) {
+		if (isModuleKey(key)) {
+			if (entry !== void 0 && typeof entry !== "string") throw invalid(file, `${key} must be a module path string or the value imported from it`);
+			continue;
+		}
+		if (!isSection(key)) {
+			warnings.push(unknown(key, TOP_LEVEL));
+			continue;
+		}
+		if (entry === void 0) continue;
+		if (!isRecord(entry)) throw invalid(file, `${key} must be an object`);
+		const known = CONFIG_SHAPE[key];
+		for (const [child, childValue] of Object.entries(entry)) {
+			const kinds = Object.hasOwn(known, child) ? known[child] : void 0;
+			if (kinds === void 0) {
+				warnings.push(unknown(`${key}.${child}`, Object.keys(known)));
+				continue;
+			}
+			const kind = kindOf(childValue);
+			if (childValue !== void 0 && (kind === void 0 || !kinds.includes(kind))) throw configError(`PermDock CLI: ${file}: ${key}.${child} must be ${describeKinds(kinds)}, not ${kind === void 0 ? "null" : describeKinds([kind])}`);
+		}
+	}
+	return {
+		config: value,
+		warnings
+	};
+}
+//#endregion
+//#region src/cli/project/config.ts
+const CONFIG_FILES = [
+	"permdock.config.ts",
+	"permdock.config.mts",
+	"permdock.config.js",
+	"permdock.config.mjs"
+];
+/**
+* Types a `permdock.config.ts`. Pass the `policy` value rather than its path,
+* and resource, scope, action and permission names in the config are checked
+* against it.
+*/
+function defineConfig(config) {
+	return config;
+}
+function isConfigFile(name) {
+	return CONFIG_FILES.some((file) => file === name);
+}
+async function readConfig(cwd, fromFlag, options) {
+	const path = fromFlag !== void 0 && fromFlag !== "" ? resolve(cwd, fromFlag) : CONFIG_FILES.map((name) => resolve(cwd, name)).find((file) => existsSync(file));
+	if (path === void 0) return {
+		config: {},
+		warnings: [],
+		file: void 0
+	};
+	if (!existsSync(path)) throw new CliError("usage", `PermDock CLI: config file not found: ${path}`, { code: "config_not_found" });
+	const { loadModule, pickNamed } = await import("./load-Dm0pSYH3.js");
+	const mod = await loadModule(path, options);
+	const display = relative(cwd, path).replaceAll("\\", "/");
+	const raw = pickNamed(mod, ["default"]);
+	return {
+		...parseConfig(hasModuleValue(raw) ? await traceValues(cwd, path, display, raw, options) : raw, display),
+		file: path
+	};
+}
+function hasModuleValue(raw) {
+	return isRecord(raw) && Object.keys(MODULE_KEYS).some((key) => isRecord(raw[key]));
+}
+async function traceValues(cwd, file, display, config, options) {
+	const { traceModuleValues } = await import("./module-values-BJTBdo6y.js");
+	return traceModuleValues({
+		cwd,
+		file,
+		display,
+		config,
+		...options === void 0 ? {} : { options }
+	});
+}
+async function loadConfig(cwd, fromFlag, options) {
+	return (await readConfig(cwd, fromFlag, options)).config;
+}
+function resolveCwd(cwd, fallback) {
+	return cwd === void 0 ? fallback : resolve(fallback, cwd);
+}
+//#endregion
+export { resolveCwd as a, readConfig as i, isConfigFile as n, loadConfig as r, defineConfig as t };

package/dist/{config-DGZzMV1B.js → config-D5XrLWpk.js}

@@ -1,5 +1,5 @@
 import { t as defineLeaf } from "./command-L8EstFNm.js";
-import { a as failOnFlag } from "./flags-aaeRAdiD.js";
+import { a as failOnFlag } from "./flags-DXjoTVbS.js";
 //#region src/cli/commands/config.ts
 const config = defineLeaf({
 	flags: {
@@ -10,7 +10,7 @@ const config = defineLeaf({
 		...failOnFlag
 	},
 	async run(ctx, { flags }) {
-		const { runConfig } = await import("./config-report-Cm7UITNA.js");
+		const { runConfig } = await import("./config-report-BmWIskD7.js");
 		return runConfig({
 			cwd: ctx.cwd,
 			config: ctx.config,

package/dist/{config-report-Cm7UITNA.js → config-report-BmWIskD7.js}

@@ -1,9 +1,9 @@
-import { a as rel, t as defaultSrcPath } from "./files-D_JIzUrP.js";
-import { r as CONFIG_REPORT_SCHEMA } from "./version-CEbQ5UeM.js";
-import { n as guessPermissions, t as barrelFile } from "./collect-BaWeMjwV.js";
+import { a as rel, t as defaultSrcPath } from "./files-BSjrtIHw.js";
+import { r as CONFIG_REPORT_SCHEMA } from "./version-DMQ0dnN5.js";
 import { t as catalogPath } from "./catalog-path-CnI0XTFK.js";
-import "./sources-B-zYB4GS.js";
-import { t as DOCS_BASE } from "./manifest-Dv6q4i5s.js";
+import { n as guessPermissions, t as barrelFile } from "./collect-WCl8cJQV.js";
+import "./sources-CMAM-2A3.js";
+import { t as DOCS_BASE } from "./manifest-B2QPh19C.js";
 import { n as MIGRATION_DIRS, t as DEFAULT_SENSITIVE_ACTIONS } from "./constants-DcJABbLW.js";
 //#region src/cli/config-report.ts
 function configReport(input) {
@@ -27,7 +27,10 @@ function configReport(input) {
 		warnings: input.warnings
 	};
 }
-/** `permdock config`: the config's warnings, or with `--print` or `--json` the effective config. */
+/**
+* `permdock config`: the config's warnings, or with `--print` or `--json` the
+* effective config.
+*/
 function runConfig(input) {
 	const report = configReport(input);
 	const code = input.strict && report.warnings.length > 0 ? 1 : 0;

package/dist/config-shape-ykV0Vm2n.js

@@ -0,0 +1,134 @@
+//#region src/cli/project/config-shape.ts
+const STRING = ["string"];
+const BOOLEAN = ["boolean"];
+const ARRAY = ["array"];
+const OBJECT = ["object"];
+const BOOLEAN_OR_OBJECT = ["boolean", "object"];
+const BOOLEAN_OR_ARRAY = ["boolean", "array"];
+const BOOLEAN_OR_STRING = ["boolean", "string"];
+const MODULE = ["string", "object"];
+/**
+* Every key PermDock reads, per section, with the kinds its value may take.
+* `satisfies` ties each list to `keyof` its section type, so a new option
+* cannot ship without the validator knowing it.
+*/
+const CONFIG_SHAPE = {
+	collect: {
+		srcPath: ARRAY,
+		out: STRING,
+		barrel: BOOLEAN_OR_STRING
+	},
+	catalog: { out: STRING },
+	openapi: { doc: ARRAY },
+	rls: {
+		tables: OBJECT,
+		dialect: STRING,
+		memberships: OBJECT,
+		membershipSources: ARRAY,
+		suspension: OBJECT,
+		functions: OBJECT,
+		inlineFunctions: BOOLEAN,
+		force: BOOLEAN,
+		fixtures: STRING,
+		verify: OBJECT,
+		tenantClaim: STRING,
+		scopeTypes: OBJECT,
+		roleClaim: STRING,
+		roleValues: OBJECT,
+		gucPrefix: STRING,
+		out: STRING,
+		drizzle: OBJECT,
+		prisma: OBJECT,
+		schema: STRING,
+		authorize: STRING,
+		policyPerRole: BOOLEAN,
+		customRoles: BOOLEAN_OR_OBJECT,
+		triggers: OBJECT,
+		audit: OBJECT,
+		capabilities: BOOLEAN,
+		anonymousSignIns: STRING,
+		fields: STRING,
+		revokeColumns: BOOLEAN,
+		policyName: STRING,
+		rbac: OBJECT,
+		roles: OBJECT,
+		actions: OBJECT,
+		helpersOnly: BOOLEAN,
+		rowHelpers: BOOLEAN_OR_ARRAY,
+		seeds: STRING,
+		treeValues: OBJECT,
+		trustedReaders: ARRAY,
+		migrate: OBJECT,
+		shims: BOOLEAN_OR_OBJECT,
+		tenants: STRING,
+		customRoleWrites: OBJECT,
+		anonExecute: BOOLEAN,
+		assignments: BOOLEAN_OR_OBJECT,
+		approvals: BOOLEAN_OR_OBJECT,
+		jsonSchema: BOOLEAN_OR_STRING,
+		ownershipTriggers: BOOLEAN_OR_OBJECT,
+		readOnlyActors: BOOLEAN_OR_ARRAY,
+		apiKeys: BOOLEAN_OR_OBJECT,
+		tokenScopes: BOOLEAN,
+		realtime: OBJECT,
+		storage: OBJECT
+	},
+	supabase: {
+		hook: OBJECT,
+		schemas: STRING
+	},
+	powersync: {
+		out: STRING,
+		resources: ARRAY,
+		action: STRING,
+		manifest: STRING
+	},
+	doctor: {
+		sensitiveActions: ARRAY,
+		memberships: STRING,
+		credentials: STRING,
+		clientEntries: ARRAY,
+		migrations: ARRAY,
+		claims: STRING,
+		srcPath: ARRAY,
+		sharedTables: ARRAY
+	},
+	gen: {
+		out: STRING,
+		kinds: ARRAY,
+		fieldMeta: BOOLEAN
+	}
+};
+const MODULE_KEYS = {
+	permissions: MODULE,
+	policy: MODULE,
+	operations: MODULE
+};
+function isSection(key) {
+	return Object.hasOwn(CONFIG_SHAPE, key);
+}
+function isModuleKey(key) {
+	return Object.hasOwn(MODULE_KEYS, key);
+}
+function kindOf(value) {
+	if (Array.isArray(value)) return "array";
+	const type = typeof value;
+	switch (type) {
+		case "string": return "string";
+		case "boolean": return "boolean";
+		case "number": return "number";
+		case "function": return "function";
+		case "object": return value === null ? void 0 : "object";
+		case "bigint":
+		case "symbol":
+		case "undefined": return;
+		default: return type;
+	}
+}
+function describeKinds(kinds) {
+	const names = kinds.map((kind) => kind === "array" ? "an array" : kind === "object" ? "an object" : `a ${kind}`);
+	const last = names.splice(-1, 1).join("");
+	return names.length === 0 ? last : `${names.join(", ")} or ${last}`;
+}
+//#endregion
+export { isSection as a, isModuleKey as i, MODULE_KEYS as n, kindOf as o, describeKinds as r, CONFIG_SHAPE as t };

package/dist/{connection-DjhIJSs2.js → connection-B72dg5Q2.js}

@@ -1,6 +1,6 @@
 import { t as compact } from "./compact-CAf557ZB.js";
-import { r as PermDockRevokedError } from "./errors-BKy0EfhN.js";
-import { a as durationOf, o as epochSeconds } from "./time-DkWjdL98.js";
+import { r as PermDockRevokedError } from "./errors-B6R_lg2a.js";
+import { a as durationOf, o as epochSeconds } from "./time-nR1JesoH.js";
 //#region src/server/connection.ts
 /** `setTimeout` stores delays in a signed 32-bit integer. */
 const MAX_DELAY = 2147483647;
@@ -99,27 +99,28 @@ async function openConnection(input) {
 		return true;
 	};
 	let schedule;
+	const step = async () => {
+		if (controller.signal.aborted || closed) return;
+		let rebuilt;
+		try {
+			rebuilt = await input.rebuild();
+		} catch {
+			abort("subject-changed");
+			return;
+		}
+		const id = principalId(rebuilt);
+		if (id === void 0 || current === void 0 || id !== principalId(current)) {
+			abort("subject-changed");
+			return;
+		}
+		if (!await admits(rebuilt)) return;
+		current = rebuilt;
+		for (const timer of timers) clearTimeout(timer);
+		timers.clear();
+		schedule?.(rebuilt);
+	};
 	const revalidate = () => {
-		chain = chain.then(async () => {
-			if (controller.signal.aborted || closed) return;
-			let next;
-			try {
-				next = await input.rebuild();
-			} catch {
-				abort("subject-changed");
-				return;
-			}
-			const id = principalId(next);
-			if (id === void 0 || current === void 0 || id !== principalId(current)) {
-				abort("subject-changed");
-				return;
-			}
-			if (!await admits(next)) return;
-			current = next;
-			for (const timer of timers) clearTimeout(timer);
-			timers.clear();
-			schedule?.(next);
-		}).catch(() => {
+		chain = chain.then(step).catch(() => {
 			abort("subject-changed");
 		});
 	};

package/dist/{connector-schema-_VCSsdtD.js → connector-schema-CYLQNMYq.js}

@@ -1,9 +1,10 @@
-import { n as freezeDeep } from "./freeze-CrU8nQeX.js";
+import { n as freezeDeep } from "./freeze-jjan0lCv.js";
 //#region src/delivery/connector-schema.ts
 /**
 * `schemas/connector-v1.json`: the body of a PermDock Cloud connector, one
 * `oneOf` branch per kind with a closed `config`. Only the `otlp` and `siem`
-* `headers` maps hold a secret; a store seals their values and lists names only.
+* `headers` maps hold a secret; a store seals their values and lists names
+* only.
 */
 const CONNECTOR_SCHEMA = freezeDeep({
 	$schema: "https://json-schema.org/draft/2020-12/schema",

package/dist/{context--uM9V3Ui.js → context-BnIzxTNE.js}

@@ -1,6 +1,6 @@
 import { t as compact } from "./compact-CAf557ZB.js";
-import { i as isPromiseLike } from "./store-options-B_poyYvg.js";
-import { n as switchTenant, t as providerStore } from "./provider-store-IgqQipCO.js";
+import { a as isPromiseLike } from "./store-options-Dil3lraY.js";
+import { n as switchTenant, t as providerStore } from "./provider-store-CaTv00tr.js";
 import { getContext, onDestroy, setContext } from "svelte";
 import { toStore } from "svelte/store";
 //#region src/svelte/context.ts
@@ -36,7 +36,8 @@ function connectSvelteStore(options) {
 		maxAge: options.maxAge,
 		onSnapshot: options.onSnapshot,
 		onClear: options.onClear,
-		approvalInterval: options.approvalInterval
+		approvalInterval: options.approvalInterval,
+		refreshOn: options.refreshOn
 	}), () => ({
 		headers: typeof headers === "function" ? headers() : headers,
 		fetch: options.fetch,

package/dist/convex/index.d.ts

@@ -1,8 +1,8 @@
-import { T as Policy, j as PolicyVocabulary, sr as Principal } from "../policy-types-B-F-qAZk.js";
-import { u as Permission } from "../permission-types-DhNEmoRG.js";
-import { a as PermDock } from "../permdock-Dco6dyCK.js";
-import { a as ProblemDetails, r as PermDockDeniedError } from "../errors-B_Qg9D3e.js";
-import { t as InstanceOptions } from "../instance-options-CU0YQCLH.js";
+import { T as Policy, j as PolicyVocabulary, pr as Principal } from "../policy-types-DGIO_gxq.js";
+import { u as Permission } from "../permission-types-CAY-GU7e.js";
+import { a as PermDock } from "../permdock-CprAPN3w.js";
+import { a as ProblemDetails, r as PermDockDeniedError } from "../errors-BIM4MFsJ.js";
+import { t as InstanceOptions } from "../instance-options-CoHn-0e8.js";
 //#region src/convex/types.d.ts
 type ConvexContextLike = {
   readonly auth?: {
@@ -20,9 +20,15 @@ type ConvexQueryBuilder = (definition: {
 }) => unknown;
 type ConvexPermDockOptions<TCtx, TUser = unknown> = InstanceOptions & {
   readonly subject: ConvexSubject<TCtx, TUser>;
-  /** The active tenant: a fixed id or a function of the Convex context; a throw is no tenant. */
+  /**
+   * The active tenant: a fixed id or a function of the Convex context; a throw
+   * is no tenant.
+   */
   readonly tenant?: string | ((ctx: TCtx) => string | undefined | Promise<string | undefined>);
-  /** The agent or service acting for the subject; anything but an `Actor` is ignored. */
+  /**
+   * The agent or service acting for the subject; anything but an `Actor` is
+   * ignored.
+   */
   readonly actor?: (ctx: TCtx) => unknown;
   readonly query?: ConvexQueryBuilder;
 };

package/dist/convex/index.js

@@ -1,11 +1,14 @@
 import { t as compact } from "../compact-CAf557ZB.js";
-import { n as PermDockValidationError } from "../validation-error-ZfUHbKvf.js";
-import { n as PermDockDeniedError, t as PermDockApprovalRequiredError } from "../errors-BKy0EfhN.js";
-import { l as withApp } from "../permdock-BfWEeMqk.js";
-import { n as resolveOrNull, t as buildInstance } from "../build-instance-DxE7czo9.js";
-import { n as tenantScope, t as actorFrom } from "../adapter-context-CRhqyzCk.js";
+import { n as PermDockValidationError } from "../validation-error-CYg2kJEw.js";
+import { n as PermDockDeniedError, t as PermDockApprovalRequiredError } from "../errors-B6R_lg2a.js";
+import { l as withApp } from "../permdock-BvjivVb9.js";
+import { n as resolveOrNull, t as buildInstance } from "../build-instance-BWXqwQYU.js";
+import { n as tenantScope, t as actorFrom } from "../adapter-context-CIQpQxbE.js";
 //#region src/convex/create.ts
-/** Convex's runtime sends `data` to the client only for an error carrying this symbol. */
+/**
+* Convex's runtime sends `data` to the client only for an error carrying this
+* symbol.
+*/
 const CONVEX_ERROR = Symbol.for("ConvexError");
 var ConvexError = class extends Error {
 	name = "ConvexError";

package/dist/{core-CQkE8Esr.d.ts → core-CFepFiDP.d.ts}

@@ -1,6 +1,6 @@
-import { Ln as Decision, T as Policy, or as Membership, tr as CustomRole } from "./policy-types-B-F-qAZk.js";
-import { u as Permission } from "./permission-types-DhNEmoRG.js";
-import { o as PermDockOptions, u as WhereResult } from "./permdock-Dco6dyCK.js";
+import { T as Policy, Un as Decision, fr as Membership, sr as CustomRole } from "./policy-types-DGIO_gxq.js";
+import { u as Permission } from "./permission-types-CAY-GU7e.js";
+import { f as WhereResult, o as PermDockOptions } from "./permdock-CprAPN3w.js";
 //#region src/testing/policy-matrix.d.ts
 type MatrixOutcome = "granted" | "denied" | "approval-required";
 type MatrixCell = MatrixOutcome | {
@@ -10,7 +10,10 @@ type MatrixCell = MatrixOutcome | {
     readonly reason: string;
   }[];
   readonly alternatives?: readonly string[];
-  /** Obligation kinds a granted decision carries, in order; `[]` asserts none. */
+  /**
+   * Obligation kinds a granted decision carries, in order; `[]` asserts
+   * none.
+   */
   readonly obligations?: readonly string[];
   /** The `name` of the deny grant `explain` reports as the one that won. */
   readonly deniedBy?: string;
@@ -22,14 +25,18 @@ type DescribePolicyConfig<TSubject> = {
   readonly exhaustive?: boolean;
   readonly options?: PermDockOptions;
   /**
-   * Also assert every granted or denied cell against `fromSnapshot(permdock.snapshot())`,
-   * the client a Server Component hands down. Closures cannot cross a snapshot and deny on the client.
+   * Also assert every granted or denied cell against
+   * `fromSnapshot(permdock.snapshot())`, the client a Server Component hands
+   * down. Closures cannot cross a snapshot and deny on the client.
    */
   readonly snapshot?: boolean;
 };
 /** One cell of the matrix, decided. */
 type PolicyMatrixCell = {
-  /** `<permission> / <subject>`, or `<permission> / <fixture> / <subject>` for a nested row. */
+  /**
+   * `<permission> / <subject>`, or `<permission> / <fixture> / <subject>` for a
+   * nested row.
+   */
   readonly name: string;
   readonly permission: string;
   readonly subject: string;
@@ -84,21 +91,29 @@ type RlsParityOptions = {
   readonly fixtures: readonly RlsParityFixture[];
   /**
    * `supabase` and `neon` set `request.jwt.claims`; a test database stubs
-   * `auth.jwt()` / `auth.uid()` or `auth.session()` / `auth.user_id()` over it.
+   * `auth.jwt()` / `auth.uid()` or `auth.session()` / `auth.user_id()` over
+   * it.
    */
   readonly dialect?: "supabase" | "neon" | "guc";
   readonly gucPrefix?: string;
   readonly tenantClaim?: string;
-  /** Claim (or `guc` setting) the RLS helpers read global roles from. Default `user_role`. */
+  /**
+   * Claim (or `guc` setting) the RLS helpers read global roles from. Default
+   * `user_role`.
+   */
   readonly roleClaim?: string;
   readonly role?: "authenticated" | "anon";
   /**
-   * Tenant-defined roles the subjects' memberships may hold. `decide` resolves them through a
-   * `CustomRoleSource`; each membership's claim carries them as the compact `grants` map, which the
-   * helpers read in `jwt` mode. Seeding the `database`-mode tables is the caller's job.
+   * Tenant-defined roles the subjects' memberships may hold. `decide` resolves
+   * them through a `CustomRoleSource`; each membership's claim carries them as
+   * the compact `grants` map, which the helpers read in `jwt` mode. Seeding the
+   * `database`-mode tables is the caller's job.
    */
   readonly customRoles?: readonly CustomRole[];
-  /** Also decide each case from the subject's serialized snapshot (`fromSnapshot`); it must agree. */
+  /**
+   * Also decide each case from the subject's serialized snapshot
+   * (`fromSnapshot`); it must agree.
+   */
   readonly snapshot?: boolean;
   /**
    * With `rls generate --fields views`: for each instance read, the row of
@@ -118,7 +133,10 @@ type RlsParityCase = {
   readonly database: RlsDbOutcome;
   /** The snapshot's decision, with `snapshot: true`. */
   readonly snapshot?: boolean;
-  /** The field view check, with `fieldViews: true`; `database` is an error code when the read failed. */
+  /**
+   * The field view check, with `fieldViews: true`; `database` is an error code
+   * when the read failed.
+   */
   readonly fields?: RlsFieldsOutcome;
   readonly ok: boolean;
 };
@@ -131,9 +149,15 @@ declare function testRlsParity<TUser>(policy: Policy<TUser>, options: RlsParityO
 //#region src/testing/orm-parity.d.ts
 type OrmParityScenario<TUser = unknown> = {
   readonly name: string;
-  /** What the policy's `subject` mapper receives, as in `createPermDock(policy, user)`. */
+  /**
+   * What the policy's `subject` mapper receives, as in `createPermDock(policy,
+   * user)`.
+   */
   readonly user: TUser;
-  /** The active tenant and role sources, as in `createPermDock(policy, user, options)`. */
+  /**
+   * The active tenant and role sources, as in `createPermDock(policy, user,
+   * options)`.
+   */
   readonly options?: PermDockOptions;
   /** An instance permission; its `where()` filters the table. */
   readonly permission: Permission<string, unknown, "instance">;
@@ -145,7 +169,10 @@ type OrmParityRunInput<TUser = unknown> = {
   readonly where: WhereResult;
 };
 type OrmParityOptions<TUser = unknown> = {
-  /** Runs `toWhere(where)` against the database and returns the matching row ids. */
+  /**
+   * Runs `toWhere(where)` against the database and returns the matching row
+   * ids.
+   */
   readonly run: (input: OrmParityRunInput<TUser>) => Promise<readonly unknown[]>;
   /** The row id field; default `id`. */
   readonly id?: string;
@@ -168,11 +195,11 @@ type OrmParityReport = {
 };
 /**
  * ORM parity: for each scenario, the rows `permdock.filter()` keeps in memory
- * must be exactly the rows the database returns for `toWhere(permdock.where())`.
- * With a `relations` option, the graph is loaded for the rows first, so the
- * in-memory side walks the same graph the database query does.
- * A partial `where()` (a closure grant it cannot compile) may be refused or
- * return fewer rows, never more.
+ * must be exactly the rows the database returns for
+ * `toWhere(permdock.where())`. With a `relations` option, the graph is loaded
+ * for the rows first, so the in-memory side walks the same graph the database
+ * query does. A partial `where()` (a closure grant it cannot compile) may be
+ * refused or return fewer rows, never more.
  */
 declare function testOrmParity<TUser>(policy: Policy<TUser>, scenarios: readonly OrmParityScenario<TUser>[], options: OrmParityOptions<TUser>): Promise<OrmParityReport>;
 //#endregion

package/dist/{core-B5-w6Kw9.js → core-DzVINFbU.js}

@@ -1,12 +1,12 @@
-import { A as memoryCustomRoleSource } from "./src-DLFrtrrC.js";
-import { c as listPermissions } from "./permission-registry-DpPtSKNZ.js";
-import { f as scopeList } from "./scopes-BHsc-wp-.js";
-import { y as membershipsClaim } from "./evaluate-B_oqFbWC.js";
-import { n as parseSnapshot } from "./snapshot-CbGmYiJx.js";
-import { n as fromSnapshot } from "./from-snapshot-Bz469dIh.js";
-import { t as getPermDock } from "./permdock-BfWEeMqk.js";
-import { c as quoteSqlTable, n as defaultSqlCommand, o as quoteSqlIdent, t as SQL_IDENT } from "./sql-B96movIM.js";
-import "./budget-NbEtbJC_.js";
+import { j as memoryCustomRoleSource } from "./src-C_pi2Rnh.js";
+import { c as listPermissions } from "./permission-registry-B8tYxPIt.js";
+import { f as scopeList } from "./scopes-0Up_UA2t.js";
+import { y as membershipsClaim } from "./evaluate-BAmf_AQd.js";
+import { n as parseSnapshot } from "./snapshot-CXlzi69u.js";
+import { n as fromSnapshot } from "./from-snapshot-DCakWRsr.js";
+import { t as getPermDock } from "./permdock-BvjivVb9.js";
+import { c as quoteSqlTable, n as defaultSqlCommand, o as quoteSqlIdent, t as SQL_IDENT } from "./sql-0WjxIp9g.js";
+import "./budget-BELja5A9.js";
 //#region src/testing/policy-matrix.ts
 function isOutcomeCell(value) {
 	return value === "granted" || value === "denied" || value === "approval-required" || value !== null && typeof value === "object" && ("denials" in value || "outcome" in value || "alternatives" in value || "obligations" in value || "deniedBy" in value);
@@ -38,7 +38,10 @@ function decisionFailures(decision, cell) {
 	}
 	return failures;
 }
-/** `deniedBy`, against the trace of a fresh `explain` call for the same arguments. */
+/**
+* `deniedBy`, against the trace of a fresh `explain` call for the same
+* arguments.
+*/
 function deniedByFailures(instance, permission, data, cell) {
 	if (typeof cell !== "object" || cell.deniedBy === void 0) return [];
 	const explained = instance.explain(permission, data);
@@ -82,7 +85,10 @@ function pendingCells(policy, config) {
 	}
 	return cells;
 }
-/** Where each cell sits, without deciding it: a test runner registers one test per cell. */
+/**
+* Where each cell sits, without deciding it: a test runner registers one test
+* per cell.
+*/
 function policyMatrixLayout(policy, config) {
 	return pendingCells(policy, config).map((cell) => cell.fixture === void 0 ? {
 		name: cell.name,
@@ -152,8 +158,8 @@ function setting(name, value) {
 	};
 }
 /**
-* The session state the generated helpers read: JWT claims for `supabase`,
-* GUCs for `guc` (roles as a comma list, memberships as JSON).
+* The session state the generated helpers read: JWT claims for `supabase`, GUCs
+* for `guc` (roles as a comma list, memberships as JSON).
 */
 function subjectSettings(dialect, subject, gucPrefix, tenantClaim, roleClaim, customRoles, scopes) {
 	const roles = subject.roles ?? [];
@@ -181,8 +187,8 @@ function subjectSettings(dialect, subject, gucPrefix, tenantClaim, roleClaim, cu
 	return subject.tenant === void 0 ? settings : [...settings, setting(`${gucPrefix}.${tenantClaim}`, subject.tenant)];
 }
 /**
-* The statement a case runs. With field views it reads back only the key, so
-* a base table whose restricted columns are revoked does not reject it.
+* The statement a case runs. With field views it reads back only the key, so a
+* base table whose restricted columns are revoked does not reject it.
 */
 function statementSql(action, table, keyOnly) {
 	const quoted = quoteSqlTable(table);
@@ -287,11 +293,11 @@ function subsetOf(small, large) {
 }
 /**
 * ORM parity: for each scenario, the rows `permdock.filter()` keeps in memory
-* must be exactly the rows the database returns for `toWhere(permdock.where())`.
-* With a `relations` option, the graph is loaded for the rows first, so the
-* in-memory side walks the same graph the database query does.
-* A partial `where()` (a closure grant it cannot compile) may be refused or
-* return fewer rows, never more.
+* must be exactly the rows the database returns for
+* `toWhere(permdock.where())`. With a `relations` option, the graph is loaded
+* for the rows first, so the in-memory side walks the same graph the database
+* query does. A partial `where()` (a closure grant it cannot compile) may be
+* refused or return fewer rows, never more.
 */
 async function testOrmParity(policy, scenarios, options) {
 	const idField = options.id ?? "id";