@powerhousedao/powerhouse-vetra-packages 6.2.2-dev.80 → 6.2.2-dev.82

package/dist/node/{document-drive-CRYbvD0-.mjs → document-drive-lf_0SP-H.mjs}

@@ -4274,35 +4274,32 @@ const AUTH_ADMINISTRATION_REQUEST = {
 	operation: "SET_GRANT"
 };
 /**
-* Whether some subject can still administer the auth scope under this grant list.
+* Whether some subject can still administer the auth scope under this grant
+* list.
 *
-* Asks the evaluator rather than pattern-matching a single grant: evaluation is
-* last-applicable-grant-wins, so an allow that some later deny shadows keeps
-* nothing reachable even though it is still present in the list. Only anyone and
-* address principals are candidates, because those are the ones v1 can match at
-* all; a `where` condition or a group or match principal never applies.
+* Answers exactly what asking {@link evaluateGrantStack} per candidate grant
+* answered, in one reverse pass instead of one full stack scan per candidate.
+* Evaluation is last-applicable-grant-wins, so scanning from the end meets each
+* subject's deciding grant first: an anyone grant decides every subject not
+* already decided, and an allow reached that way is itself a grant that carries
+* administration. Only anyone and address principals are candidates, because
+* those are the ones v1 can match with no groups and no condition context; a
+* `where` condition or a group or match principal never applies.
 */
 function administrationReachable(grants) {
-	return grants.some((grant) => {
-		const subject = administrationCandidate(grant);
-		if (subject === void 0) return false;
-		return evaluateGrantStack(grants, subject, AUTH_ADMINISTRATION_REQUEST).decision === "allow";
-	});
-}
-/**
-* The subject to test this grant with, or undefined when the grant could never
-* carry administration for anyone.
-*/
-function administrationCandidate(grant) {
-	if (grant.effect !== "allow" || grant.where !== void 0 || !capabilityCovers(grant.capability, AUTH_ADMINISTRATION_REQUEST)) return;
-	if ("address" in grant.principal) return {
-		address: grant.principal.address,
-		key: void 0
-	};
-	if ("anyone" in grant.principal) return {
-		address: void 0,
-		key: void 0
-	};
+	const shadowedAddresses = /* @__PURE__ */ new Set();
+	for (let index = grants.length - 1; index >= 0; index -= 1) {
+		const grant = grants[index];
+		if (grant.where !== void 0 || !grantAnswers(grant, AUTH_ADMINISTRATION_REQUEST)) continue;
+		const allows = grant.effect === "allow";
+		if ("anyone" in grant.principal) return allows;
+		if (!("address" in grant.principal)) continue;
+		const address = grant.principal.address.toLowerCase();
+		if (shadowedAddresses.has(address)) continue;
+		if (allows) return true;
+		shadowedAddresses.add(address);
+	}
+	return false;
 }
 /**
 * A creator-less policy must always retain a grant permitting execute on the
@@ -4314,158 +4311,6 @@ function assertAuthAdministrationRetained(creator, previous, next, grantId) {
 	if (creator !== void 0) return;
 	if (administrationReachable(previous) && !administrationReachable(next)) throw new AuthAdministrationLockoutError(grantId);
 }
-/**
-* An operand whose shape validation would have rejected. Distinguished from
-* an unresolved path so a structurally malformed operand poisons its whole
-* condition to false rather than reading as "absent", which `not` would
-* otherwise widen to true.
-*/
-const INVALID_OPERAND = Symbol("invalid-operand");
-/**
-* Narrows to the values conditions compare. An object, array, or non-finite
-* number resolves to undefined, and every comparison involving undefined is
-* false.
-*/
-function asConditionValue(value) {
-	if (value === null || typeof value === "string" || typeof value === "boolean") return value;
-	if (typeof value === "number" && Number.isFinite(value)) return value;
-}
-/**
-* Resolves one operand. Attr roots: `subject.*`, `doc.<scope>.*` where the
-* scope must be the executing scope (validation already rejects any other,
-* but resolution stays total), and `action.input.*`. Path steps read own
-* properties only, so prototype members can never influence a verdict.
-*/
-function resolveOperand(operand, subject, request, conditions) {
-	if (!isPlainValue(operand)) return INVALID_OPERAND;
-	const keys = Object.keys(operand);
-	if (keys.length !== 1) return INVALID_OPERAND;
-	if (keys[0] === "lit") {
-		const value = asConditionValue(operand.lit);
-		return value === void 0 ? INVALID_OPERAND : value;
-	}
-	if (keys[0] !== "attr") return INVALID_OPERAND;
-	const attr = operand.attr;
-	if (typeof attr !== "string" || attr.length === 0) return INVALID_OPERAND;
-	const path = attr.split(".");
-	let value;
-	let rest;
-	if (path[0] === "subject") {
-		value = subject;
-		rest = path.slice(1);
-	} else if (path[0] === "doc") {
-		if (path[1] !== request.scope) return;
-		value = conditions.scopeState;
-		rest = path.slice(2);
-	} else if (path[0] === "action" && path[1] === "input") {
-		value = conditions.actionInput;
-		rest = path.slice(2);
-	} else return;
-	for (const segment of rest) {
-		if (!isPlainValue(value) || !Object.hasOwn(value, segment)) return;
-		value = value[segment];
-	}
-	return asConditionValue(value);
-}
-/**
-* Total order within one type: numbers numerically, strings by code point.
-* Everything else, including mixed types, does not order.
-*/
-function compareValues(left, right) {
-	if (typeof left === "number" && typeof right === "number") return left < right ? -1 : left > right ? 1 : 0;
-	if (typeof left === "string" && typeof right === "string") {
-		const leftPoints = Array.from(left);
-		const rightPoints = Array.from(right);
-		const shared = Math.min(leftPoints.length, rightPoints.length);
-		for (let i = 0; i < shared; i++) {
-			const a = leftPoints[i].codePointAt(0) ?? 0;
-			const b = rightPoints[i].codePointAt(0) ?? 0;
-			if (a !== b) return a < b ? -1 : 1;
-		}
-		return leftPoints.length === rightPoints.length ? 0 : leftPoints.length < rightPoints.length ? -1 : 1;
-	}
-}
-/**
-* Tri-state evaluation: undefined marks a structurally invalid node, which
-* poisons the whole tree to false at the top — and a structurally malformed
-* operand poisons its condition the same way. Both are distinct from an
-* operand whose path fails to resolve, which is a valid comparison that is
-* false. The distinction keeps `not` from widening over malformed input.
-*/
-function evaluateNode(node, subject, request, conditions) {
-	if (!isPlainValue(node)) return;
-	const keys = Object.keys(node);
-	if (keys.length !== 1) return;
-	const kind = keys[0];
-	const body = node[kind];
-	switch (kind) {
-		case "eq":
-		case "ne":
-		case "lt":
-		case "lte":
-		case "gt":
-		case "gte": {
-			if (!Array.isArray(body) || body.length !== 2) return;
-			const left = resolveOperand(body[0], subject, request, conditions);
-			const right = resolveOperand(body[1], subject, request, conditions);
-			if (left === INVALID_OPERAND || right === INVALID_OPERAND) return;
-			if (left === void 0 || right === void 0) return false;
-			if (kind === "eq") return left === right;
-			if (kind === "ne") return left !== right;
-			const order = compareValues(left, right);
-			if (order === void 0) return false;
-			switch (kind) {
-				case "lt": return order < 0;
-				case "lte": return order <= 0;
-				case "gt": return order > 0;
-				case "gte": return order >= 0;
-			}
-			return;
-		}
-		case "in":
-		case "notIn": {
-			if (!Array.isArray(body) || body.length !== 2 || !Array.isArray(body[1])) return;
-			const left = resolveOperand(body[0], subject, request, conditions);
-			if (left === INVALID_OPERAND) return;
-			const elements = body[1].map((element) => resolveOperand(element, subject, request, conditions));
-			if (elements.some((value) => value === INVALID_OPERAND)) return;
-			if (left === void 0) return false;
-			const found = elements.some((value) => value !== void 0 && value === left);
-			return kind === "in" ? found : !found;
-		}
-		case "exists": {
-			const value = resolveOperand(body, subject, request, conditions);
-			if (value === INVALID_OPERAND) return;
-			return value !== void 0;
-		}
-		case "and":
-		case "or": {
-			if (!Array.isArray(body)) return;
-			let result = kind === "and";
-			for (const child of body) {
-				const value = evaluateNode(child, subject, request, conditions);
-				if (value === void 0) return;
-				if (kind === "and") result = result && value;
-				else result = result || value;
-			}
-			return result;
-		}
-		case "not": {
-			const value = evaluateNode(body, subject, request, conditions);
-			return value === void 0 ? void 0 : !value;
-		}
-		default: return;
-	}
-}
-/**
-* Evaluates a version-1 condition. Deterministic, total, and pure: any input
-* shape yields a boolean and never throws, and a malformed condition is
-* false. These are consensus semantics, versioned by `PHAuthState.version`;
-* changing them requires a new version.
-*/
-function evaluateCondition(condition, subject, request, conditions) {
-	return evaluateNode(condition, subject, request, conditions) === true;
-}
 /** Whether a capability's scope reaches the requested one. */
 function scopeCovers(scope, requested) {
 	return scope === void 0 || scope === "*" || scope === requested;
@@ -4501,49 +4346,6 @@ function capabilityCovers(capability, request) {
 	}
 	return true;
 }
-function principalMatches(principal, subject, request, groups, conditions) {
-	if ("anyone" in principal) return true;
-	if ("address" in principal) return subject.address !== void 0 && subject.address.toLowerCase() === principal.address.toLowerCase();
-	if ("group" in principal) {
-		if (groups === void 0 || subject.address === void 0) return false;
-		const group = groups[principal.group];
-		if (group === void 0 || !Array.isArray(group.members)) return false;
-		const address = subject.address.toLowerCase();
-		return group.members.some((member) => member.toLowerCase() === address);
-	}
-	if ("match" in principal) {
-		if (conditions === void 0) return false;
-		return evaluateCondition(principal.match, subject, request, conditions);
-	}
-	return false;
-}
-/**
-* Evaluates a v1 grant stack: default deny, last applicable grant wins, and
-* reports which grant decided it. Group principals match only against a
-* supplied groups map, and `where` clauses and { match } principals evaluate
-* only against a supplied condition context; a grant that uses an unsupplied
-* feature never applies.
-*/
-function evaluateGrantStack(grants, subject, request, groups, conditions) {
-	let applicable;
-	for (const grant of grants) {
-		if (grant.where !== void 0) {
-			if (conditions === void 0) continue;
-			if (!evaluateCondition(grant.where, subject, request, conditions)) continue;
-		}
-		if (grantAnswers(grant, request) && principalMatches(grant.principal, subject, request, groups, conditions)) applicable = grant;
-	}
-	if (applicable === void 0) return {
-		decision: "deny",
-		refusal: "no-applicable-grant"
-	};
-	if (applicable.effect === "deny") return {
-		decision: "deny",
-		refusal: "denied-by-grant",
-		grantId: applicable.id
-	};
-	return { decision: "allow" };
-}
 const documentModelFileExtension = "phdm";
 const documentModelInitialLocalState = {};
 const documentModelInitialGlobalState = {
@@ -8442,4 +8244,4 @@ const driveDocumentModelModule = {
 //#endregion
 export { setOperationDescription as $, createState as A, normalizeDocumentModelVersion as B, baseLoadFromInputVersioned as C, createBaseState as D, createAction as E, deleteOperationError as F, setAuthorWebsite as G, releaseNewVersion as H, deserializeSignature as I, setModelExtension as J, setInitialState as K, documentModelDocumentType as L, defaultBaseState as M, deleteModule as N, createPresignedHeader as O, deleteOperation as P, setName as Q, hashDocumentStateForScope as R, baseLoadFromInput as S, buildSignedAction as T, replayDocumentVersioned as U, redo as V, setAuthorName as W, setModelName as X, setModelId as Y, setModuleName as Z, addOperation as _, handleTargetNameCollisions as a, undo as at, baseActions as b, isValidName as c, validateStateSchemaName as ct, documentModelDocumentModelModule as d, setOperationErrorName as et, logger as f, addModule as g, UnsupportedDocumentModelVersionError as h, generateNodesCopy as i, toTransportAction as it, createZip as j, createReducer as k, moveNode as l, generateId as lt, BaseDocumentStateSchema as m, copyNode as n, setOperationSchema as nt, isFileNode as o, validateInitialState as ot, BaseDocumentHeaderSchema as p, setModelDescription as q, driveDocumentModelModule as r, setStateSchema as rt, isFolderNode as s, validateModules as st, addFolder as t, setOperationName as tt, updateNode as u, addOperationError as v, baseSaveToFileHandle as w, baseCreateDocument as x, assertAuthPreservedOnDuplicate as y, isDocumentAction as z };
 
-//# sourceMappingURL=document-drive-CRYbvD0-.mjs.map
+//# sourceMappingURL=document-drive-lf_0SP-H.mjs.map