endpoint-permissions-kit 0.1.0 → 0.2.0

package/dist/cjs/index.cjs

@@ -39,11 +39,11 @@ var __export = (target, all) => {
 // src/index.ts
 var exports_src = {};
 __export(exports_src, {
-  METHODS: () => METHODS,
-  context: () => context,
+  METHODS: () => METHODS2,
+  context: () => context_default,
   default: () => src_default,
   module: () => defineModule,
-  permissions: () => permissions,
+  permissions: () => permissions_default,
   pkit: () => pkit,
   seal: () => seal,
   validate: () => validate
@@ -51,426 +51,567 @@ __export(exports_src, {
 module.exports = __toCommonJS(exports_src);
 
 // src/constants.ts
-var METHODS = ["find", "update", "create", "remove"];
-var GENERAL_ROLE = "general";
-var GLOBAL_HOOK_OWNER = "*";
-var ALL_FIELDS = "*";
-var MODULE_SEPARATOR = ".";
-var PERMISSION_ID_SEPARATOR = "::";
+var constants = {
+  METHODS: Object.freeze(["find", "update", "create", "remove"]),
+  GENERAL_ROLE: "general",
+  GLOBAL_HOOK_OWNER: "*",
+  ALL_FIELDS: "*",
+  MODULE_SEPARATOR: ".",
+  PERMISSION_ID_SEPARATOR: "::"
+};
+var constants_default = constants;
 
-// src/state.ts
-function getOrCreateState() {
-  const stateKey = Symbol.for("endpoint-permissions-kit");
-  const stateHost = globalThis;
-  if (stateHost[stateKey] === undefined) {
-    stateHost[stateKey] = { roles: new Set([GENERAL_ROLE]), modules: new Map, snapshot: null };
+// src/errors.ts
+var errors = {
+  create(code, message) {
+    return Object.assign(new Error(message), { name: "PkitError", code });
+  },
+  describe(value) {
+    try {
+      return String(value);
+    } catch {
+      return typeof value;
+    }
   }
-  return stateHost[stateKey];
+};
+var errors_default = errors;
+
+// src/identifiers.ts
+var identifiers = {
+  build(role, action, name) {
+    return `${role}${constants_default.PERMISSION_ID_SEPARATOR}${action}${constants_default.PERMISSION_ID_SEPARATOR}${name}`;
+  },
+  parse(value, code, subject) {
+    if (typeof value !== "string")
+      throw invalidIdentifier(value, code, subject);
+    const parts = value.split(constants_default.PERMISSION_ID_SEPARATOR);
+    const [role, action, name] = parts;
+    if (parts.length !== 3 || role === undefined || action === undefined || name === undefined) {
+      throw invalidIdentifier(value, code, subject);
+    }
+    const isValidRole = isCleanSegment(role) && role !== constants_default.GLOBAL_HOOK_OWNER;
+    const isValidName = isCleanSegment(name) && name !== constants_default.GLOBAL_HOOK_OWNER;
+    const isValidAction = action.split(constants_default.MODULE_SEPARATOR).every(isCleanSegment);
+    if (!isValidRole || !isValidName || !isValidAction)
+      throw invalidIdentifier(value, code, subject);
+    return { role, action, name };
+  },
+  checkRole(role) {
+    if (typeof role === "string" && isCleanSegment(role) && role !== constants_default.GLOBAL_HOOK_OWNER)
+      return;
+    throw errors_default.create("INVALID_DEFINITION", `invalid role: "${errors_default.describe(role)}" (non-empty string, no ":" or surrounding whitespace; "${constants_default.GLOBAL_HOOK_OWNER}" is reserved for global hooks)`);
+  },
+  checkModuleSegment(segment) {
+    if (typeof segment === "string" && isCleanSegment(segment) && !segment.includes(constants_default.MODULE_SEPARATOR))
+      return;
+    throw errors_default.create("INVALID_DEFINITION", `invalid module name: "${errors_default.describe(segment)}" (non-empty string, no dots, no ":" or surrounding whitespace)`);
+  },
+  checkName(name) {
+    if (typeof name === "string" && isCleanSegment(name) && name !== constants_default.GLOBAL_HOOK_OWNER)
+      return;
+    throw errors_default.create("INVALID_DEFINITION", `invalid permission name: "${errors_default.describe(name)}" (non-empty string, no ":" or surrounding whitespace; "*" is reserved)`);
+  }
+};
+function isCleanSegment(value) {
+  return value.length > 0 && value.trim() === value && !value.includes(":");
+}
+function invalidIdentifier(value, code, subject) {
+  return errors_default.create(code, `${subject}: "${errors_default.describe(value)}" (format role::module::name)`);
 }
+var identifiers_default = identifiers;
 
-// src/errors.ts
-function pkitError(code, message) {
-  return Object.assign(new Error(message), { name: "PkitError", code });
+// src/state.ts
+var STATE_KEY = Symbol.for("endpoint-permissions-kit");
+var state = {
+  getOrCreate() {
+    const stateHost = globalThis;
+    if (stateHost[STATE_KEY] === undefined) {
+      stateHost[STATE_KEY] = { roles: new Set([constants_default.GENERAL_ROLE]), cropper: false, modules: new Map, snapshot: null };
+    }
+    return stateHost[STATE_KEY];
+  },
+  requireOpen(currentState) {
+    if (currentState.snapshot)
+      throw errors_default.create("SEALED", "pkit.seal() was already called: no more registrations allowed");
+  },
+  requireSnapshot(currentState) {
+    if (currentState.snapshot === null) {
+      throw errors_default.create("NOT_SEALED", "pkit.seal() has not been called: call it after importing every permission file");
+    }
+    return currentState.snapshot;
+  }
+};
+var state_default = state;
+
+// src/context.ts
+var context = Object.freeze({
+  set(key, value) {
+    const contextKey = checkKey(key);
+    const currentState = state_default.getOrCreate();
+    state_default.requireOpen(currentState);
+    if (contextKey === "cropper") {
+      if (typeof value !== "boolean")
+        throw errors_default.create("INVALID_DEFINITION", "cropper must be a boolean");
+      currentState.cropper = value;
+      return;
+    }
+    currentState.roles = new Set(readRoleCatalog(value, currentState.modules.size));
+  },
+  get(key) {
+    const contextKey = checkKey(key);
+    const currentState = state_default.getOrCreate();
+    return contextKey === "cropper" ? currentState.cropper : [...currentState.roles];
+  }
+});
+function checkKey(key) {
+  if (key === "roles" || key === "cropper")
+    return key;
+  throw errors_default.create("INVALID_DEFINITION", `unknown context key: "${errors_default.describe(key)}"`);
+}
+function readRoleCatalog(value, registeredModuleCount) {
+  if (registeredModuleCount > 0) {
+    throw errors_default.create("INVALID_DEFINITION", "roles must be declared before registering permissions: import pkit.config.js first");
+  }
+  if (!Array.isArray(value))
+    throw errors_default.create("INVALID_DEFINITION", "roles must be an array of non-empty strings");
+  for (const role of value) {
+    if (typeof role !== "string" || role.length === 0) {
+      throw errors_default.create("INVALID_DEFINITION", "roles must be an array of non-empty strings");
+    }
+  }
+  const catalog = value;
+  if (catalog.length === 0)
+    throw errors_default.create("INVALID_DEFINITION", "roles must declare at least one role");
+  for (const role of catalog)
+    identifiers_default.checkRole(role);
+  return catalog;
 }
+var context_default = context;
 
 // src/resolve.ts
-var DIRECT_AUTHORIZATION = Object.freeze({ direct: true, grantedBy: Object.freeze([]) });
 var DISABLED_ACCESS = Object.freeze({ status: "disabled" });
 var UNASSIGNED_ACCESS = Object.freeze({ status: "unassigned" });
-function permissionIdOf(role, action, name) {
-  return [role, action, name].join(PERMISSION_ID_SEPARATOR);
-}
-function resolveAccess(nameEntry, permissionId, role, method, assigned) {
-  if (assigned.has(permissionId))
-    return resolveDirectAccess(nameEntry, role, method);
-  return resolveGrantedAccess(nameEntry, method, assigned);
-}
-function resolveDirectAccess(nameEntry, role, method) {
-  const definition = nameEntry.actions.get(role)?.[method];
-  if (!definition?.enabled)
-    return DISABLED_ACCESS;
-  return { status: "granted", properties: definition.properties, authorization: DIRECT_AUTHORIZATION };
-}
-function resolveGrantedAccess(nameEntry, method, assigned) {
-  const grantedBy = [];
-  const properties = new Set;
-  let reachable = false;
+var resolve = {
+  identity(assignments, snapshot, roles) {
+    if (assignments === null || typeof assignments !== "object")
+      throw errors_default.create("INVALID_INPUT", "assignments must be an object");
+    const { role, permissions } = assignments;
+    if (typeof role !== "string")
+      throw errors_default.create("INVALID_INPUT", "role is required");
+    if (!roles.has(role))
+      throw errors_default.create("UNKNOWN_ROLE", `role "${role}" is not declared`);
+    if (!Array.isArray(permissions))
+      throw errors_default.create("INVALID_INPUT", "permissions must be an array of strings");
+    const assigned = new Set;
+    const names = new Map;
+    for (const permissionId of permissions) {
+      const reference = identifiers_default.parse(permissionId, "INVALID_INPUT", "invalid permission identifier");
+      if (reference.role !== role) {
+        throw errors_default.create("PERMISSION_ROLE_MISMATCH", `"${permissionId}" belongs to role "${reference.role}", not the authenticated role "${role}"`);
+      }
+      if (!snapshot.assignable.has(permissionId)) {
+        throw errors_default.create("UNKNOWN_PERMISSION", `"${permissionId}" is not an assignable permission`);
+      }
+      const assignedName = names.get(reference.action);
+      if (assignedName !== undefined && assignedName !== reference.name) {
+        throw errors_default.create("AMBIGUOUS_PERMISSION", `"${permissionId}" and "${identifiers_default.build(role, reference.action, assignedName)}" are both assigned: a request names no permission name, so module "${reference.action}" cannot be resolved`);
+      }
+      assigned.add(permissionId);
+      names.set(reference.action, reference.name);
+    }
+    return { role, assigned, names };
+  },
+  permission(registeredModule, action, identity) {
+    const assignedName = identity.names.get(action);
+    if (assignedName !== undefined) {
+      const assignedEntry = registeredModule.names.get(assignedName);
+      if (assignedEntry === undefined)
+        return;
+      return { permissionId: identifiers_default.build(identity.role, action, assignedName), entry: assignedEntry };
+    }
+    let chosen;
+    for (const [name, nameEntry] of registeredModule.names) {
+      const permissionId = identifiers_default.build(identity.role, action, name);
+      if (resolve.methodAccess(nameEntry, permissionId, identity.role, identity.assigned) === undefined)
+        continue;
+      if (chosen !== undefined) {
+        throw errors_default.create("AMBIGUOUS_PERMISSION", `grants reach "${chosen.permissionId}" and "${permissionId}": a request names no permission name, so module "${action}" cannot be resolved`);
+      }
+      chosen = { permissionId, entry: nameEntry };
+    }
+    return chosen;
+  },
+  access(nameEntry, permissionId, role, method, assigned) {
+    if (!assigned.has(permissionId))
+      return grantedAccess(nameEntry, method, assigned);
+    const definition = nameEntry.actions.get(role)?.[method];
+    if (!definition?.enabled)
+      return DISABLED_ACCESS;
+    return { status: "granted", properties: definition.properties };
+  },
+  methodAccess(nameEntry, permissionId, role, assigned) {
+    const methodAccess = Object.create(null);
+    if (assigned.has(permissionId)) {
+      const actions = nameEntry.actions.get(role);
+      for (const method of constants_default.METHODS)
+        methodAccess[method] = actions?.[method]?.enabled === true;
+      return Object.freeze(methodAccess);
+    }
+    const grantedMethods = new Set;
+    let isReachable = false;
+    for (const [enablingId, grant] of nameEntry.grants) {
+      if (!assigned.has(enablingId))
+        continue;
+      isReachable = true;
+      for (const method of Object.keys(grant.actions))
+        grantedMethods.add(method);
+    }
+    if (!isReachable)
+      return;
+    for (const method of constants_default.METHODS)
+      methodAccess[method] = grantedMethods.has(method);
+    return Object.freeze(methodAccess);
+  }
+};
+function grantedAccess(nameEntry, method, assigned) {
+  const fields = new Set;
+  let isGranted = false;
+  let isReachable = false;
   for (const [enablingId, grant] of nameEntry.grants) {
     if (!assigned.has(enablingId))
       continue;
-    reachable = true;
+    isReachable = true;
     const definition = grant.actions[method];
     if (!definition)
       continue;
-    grantedBy.push(enablingId);
+    isGranted = true;
     for (const field of definition.properties)
-      properties.add(field);
+      fields.add(field);
   }
-  if (grantedBy.length === 0)
-    return reachable ? DISABLED_ACCESS : UNASSIGNED_ACCESS;
-  const authorization = Object.freeze({ direct: false, grantedBy: Object.freeze(grantedBy.sort()) });
-  return { status: "granted", properties: Object.freeze([...properties]), authorization };
+  if (!isGranted)
+    return isReachable ? DISABLED_ACCESS : UNASSIGNED_ACCESS;
+  return { status: "granted", properties: Object.freeze([...fields]) };
 }
+var resolve_default = resolve;
 
-// src/validators.ts
-function validateObject(value, failure) {
-  if (value === null || typeof value !== "object" || Array.isArray(value)) {
-    throw pkitError(failure.code, failure.message);
-  }
-}
-function validateStrings(value, rules) {
-  if (!Array.isArray(value))
-    throw pkitError(rules.code, rules.message);
-  for (const field of value) {
-    if (typeof field !== "string" || field.length < rules.minimumLength) {
-      throw pkitError(rules.code, rules.message);
+// src/permissions.ts
+var permissions = Object.freeze({
+  forUser(assignments) {
+    const currentState = state_default.getOrCreate();
+    const snapshot = state_default.requireSnapshot(currentState);
+    const identity = resolve_default.identity(assignments, snapshot, currentState.roles);
+    const access = Object.create(null);
+    for (const [action, registeredModule] of currentState.modules) {
+      const chosen = resolve_default.permission(registeredModule, action, identity);
+      if (!chosen)
+        continue;
+      const methodAccess = resolve_default.methodAccess(chosen.entry, chosen.permissionId, identity.role, identity.assigned);
+      if (methodAccess)
+        access[chosen.permissionId] = methodAccess;
     }
+    return Object.freeze(access);
+  },
+  get named() {
+    return state_default.requireSnapshot(state_default.getOrCreate()).named;
   }
-}
-function validateContextKey(key) {
-  if (key !== "roles")
-    throw pkitError("INVALID_DEFINITION", `unknown context key: "${String(key)}"`);
-}
-function validateOpenRegistry(state) {
-  if (state.snapshot)
-    throw pkitError("SEALED", "pkit.seal() was already called: no more registrations allowed");
-}
-function validateSnapshot(snapshot) {
-  if (snapshot === null) {
-    throw pkitError("NOT_SEALED", "pkit.seal() has not been called: call it after importing every permission file");
+});
+var permissions_default = permissions;
+
+// src/properties.ts
+var PRUNED = Symbol("pruned");
+var MAX_DEPTH = 1000;
+var properties = {
+  checkDeclaredPath(property, permissionPath) {
+    if (property.includes("[") || property.includes("]")) {
+      throw errors_default.create("INVALID_DEFINITION", `${permissionPath}: array indexes are not allowed in properties: "${property}"`);
+    }
+    const segments = segmentsOf(property);
+    for (const segment of segments) {
+      if (segment.length === 0)
+        throw errors_default.create("INVALID_DEFINITION", `${permissionPath}: empty segment in property path: "${property}"`);
+    }
+    if (segments[0] === constants_default.ALL_FIELDS) {
+      throw errors_default.create("INVALID_DEFINITION", `${permissionPath}: a property path cannot start with "${constants_default.ALL_FIELDS}": "${property}"`);
+    }
+  },
+  resolve(data, allowed, cropper) {
+    if (allowed === constants_default.ALL_FIELDS)
+      return data;
+    const patterns = [];
+    for (const pattern of allowed)
+      patterns.push(segmentsOf(pattern));
+    const walk = { patterns, segments: [], ancestors: new Set([data]) };
+    if (cropper)
+      return cropData(data, walk);
+    rejectForbiddenPaths(data, walk);
+    return data;
   }
-}
-function validateRole(role, roles, code) {
-  if (typeof role === "string" && roles.has(role))
-    return;
-  if (code === "ROLE_NOT_DECLARED") {
-    throw pkitError(code, `role "${String(role)}" is not declared. Available roles: ${[...roles].join(", ")}.
-` + "Is pkit.context.set('roles', [...]) missing from pkit.config.js, or was it imported after this file?");
+};
+function segmentsOf(path) {
+  const segments = [];
+  let segment = "";
+  let index = 0;
+  while (index < path.length) {
+    const character = path[index];
+    if (character === "\\") {
+      segment += path[index + 1] ?? "";
+      index += 2;
+      continue;
+    }
+    if (character === ".") {
+      segments.push(segment);
+      segment = "";
+      index += 1;
+      continue;
+    }
+    segment += character;
+    index += 1;
   }
-  throw pkitError(code, `role "${String(role)}" is not declared`);
+  segments.push(segment);
+  return segments;
 }
-function validateRoleCatalog(roles, state) {
-  validateOpenRegistry(state);
-  if (state.modules.size) {
-    throw pkitError("INVALID_DEFINITION", "roles must be declared before registering permissions: import pkit.config.js first");
+function isAllowedPath(segments, patterns) {
+  for (const pattern of patterns) {
+    if (pattern.length !== segments.length)
+      continue;
+    let isMatch = true;
+    for (let index = 0;index < segments.length; index += 1) {
+      const patternSegment = pattern[index];
+      if (patternSegment === constants_default.ALL_FIELDS)
+        continue;
+      if (patternSegment === segments[index])
+        continue;
+      isMatch = false;
+      break;
+    }
+    if (isMatch)
+      return true;
   }
-  validateStrings(roles, {
-    code: "INVALID_DEFINITION",
-    message: "roles must be an array of non-empty strings",
-    minimumLength: 1
-  });
-  if (roles.length === 0)
-    throw pkitError("INVALID_DEFINITION", "roles must declare at least one role");
-  for (const role of roles)
-    validateRoleSegment(role);
-}
-function isCleanSegment(value) {
-  return value.length > 0 && value.trim() === value && !value.includes(":");
+  return false;
 }
-function validateRoleSegment(role) {
-  if (typeof role === "string" && isCleanSegment(role) && role !== GLOBAL_HOOK_OWNER)
-    return;
-  throw pkitError("INVALID_DEFINITION", `invalid role: "${String(role)}" (non-empty string, no ":" or surrounding whitespace; "${GLOBAL_HOOK_OWNER}" is reserved for global hooks)`);
+function isPlainObject(value) {
+  if (value === null || typeof value !== "object" || Array.isArray(value))
+    return false;
+  const prototype = Object.getPrototypeOf(value);
+  return prototype === Object.prototype || prototype === null;
 }
-function validateModuleName(moduleName) {
-  if (typeof moduleName === "string" && isCleanSegment(moduleName) && !moduleName.includes(MODULE_SEPARATOR))
+function requireDepth(walk) {
+  if (walk.ancestors.size < MAX_DEPTH)
     return;
-  throw pkitError("INVALID_DEFINITION", `invalid module name: "${String(moduleName)}" (non-empty string, no dots, no ":" or surrounding whitespace)`);
+  throw new RangeError(`data is nested deeper than ${MAX_DEPTH} levels`);
 }
-function validatePermissionName(name) {
-  if (typeof name === "string" && isCleanSegment(name) && name !== GLOBAL_HOOK_OWNER)
-    return;
-  throw pkitError("INVALID_DEFINITION", `invalid permission name: "${String(name)}" (non-empty string, no ":" or surrounding whitespace; "*" is reserved)`);
-}
-function parsePermissionId(value, failure) {
-  if (typeof value !== "string")
-    throw pkitError(failure.code, failure.message);
-  const parts = value.split(PERMISSION_ID_SEPARATOR);
-  const [role, action, name] = parts;
-  if (parts.length !== 3 || role === undefined || action === undefined || name === undefined) {
-    throw pkitError(failure.code, failure.message);
-  }
-  const isValidRole = isCleanSegment(role) && role !== GLOBAL_HOOK_OWNER;
-  const isValidName = isCleanSegment(name) && name !== GLOBAL_HOOK_OWNER;
-  const isValidAction = action.split(MODULE_SEPARATOR).every(isCleanSegment);
-  if (!isValidRole || !isValidName || !isValidAction)
-    throw pkitError(failure.code, failure.message);
-  return { role, action, name };
-}
-function validateMethod(method, failure) {
-  if (METHODS.includes(method))
+function setField(target, key, value) {
+  if (key === "__proto__") {
+    Object.defineProperty(target, key, { value, writable: true, enumerable: true, configurable: true });
     return;
-  throw pkitError(failure.code, `${failure.message}: method "${String(method)}" does not exist. Methods: ${METHODS.join(", ")}`);
-}
-function readActionDefinition(definition, permissionPath) {
-  validateObject(definition, { code: "INVALID_DEFINITION", message: `${permissionPath}: must be an object` });
-  if (typeof definition.enabled !== "boolean") {
-    throw pkitError("INVALID_DEFINITION", `${permissionPath}: enabled must be a boolean`);
-  }
-  const { properties } = definition;
-  if (properties === ALL_FIELDS)
-    return Object.freeze({ enabled: definition.enabled, properties });
-  validateStrings(properties, {
-    code: "INVALID_DEFINITION",
-    message: `${permissionPath}: properties must be string[] or '*'`,
-    minimumLength: 1
-  });
-  if (properties.includes(ALL_FIELDS)) {
-    throw pkitError("INVALID_DEFINITION", `${permissionPath}: '${ALL_FIELDS}' is only allowed as the whole properties value`);
-  }
-  if (new Set(properties).size !== properties.length) {
-    throw pkitError("INVALID_DEFINITION", `${permissionPath}: properties contains duplicate fields`);
-  }
-  return Object.freeze({ enabled: definition.enabled, properties: Object.freeze([...properties]) });
-}
-function readActionDefinitions(actions, permissionPath) {
-  validateObject(actions, { code: "INVALID_DEFINITION", message: `${permissionPath}: registerActions expects an object` });
-  const registeredActions = Object.create(null);
-  for (const [method, definition] of Object.entries(actions)) {
-    validateMethod(method, { code: "INVALID_DEFINITION", message: permissionPath });
-    registeredActions[method] = readActionDefinition(definition, `${permissionPath}.${method}`);
-  }
-  return Object.freeze(registeredActions);
-}
-function validateActions(actions, registration, state) {
-  const { action, name, role } = registration;
-  validateOpenRegistry(state);
-  validateRole(role, state.roles, "ROLE_NOT_DECLARED");
-  if (state.modules.get(action)?.names.get(name)?.actions.has(role)) {
-    throw pkitError("DUPLICATE_REGISTRATION", `"${action}::${name}" already has actions registered for role "${role}"`);
-  }
-  return readActionDefinitions(actions, `${action}::${name} [${role}]`);
-}
-function validateGrantActions(actions, registration, state) {
-  const { action, name, permissionId } = registration;
-  validateOpenRegistry(state);
-  const source = parsePermissionId(permissionId, {
-    code: "INVALID_DEFINITION",
-    message: `"${action}::${name}": invalid grantTo identifier: "${String(permissionId)}" (format role::module::name)`
-  });
-  validateRole(source.role, state.roles, "ROLE_NOT_DECLARED");
-  if (source.action === action && source.name === name) {
-    throw pkitError("INVALID_DEFINITION", `"${permissionId}" cannot grant to itself`);
   }
-  if (state.modules.get(action)?.names.get(name)?.grants.has(permissionId)) {
-    throw pkitError("DUPLICATE_REGISTRATION", `"${action}::${name}" already has a grant for "${permissionId}"`);
-  }
-  const permissionPath = `${action}::${name} [grantTo ${permissionId}]`;
-  const registeredActions = readActionDefinitions(actions, permissionPath);
-  for (const [method, definition] of Object.entries(registeredActions)) {
-    if (definition.enabled !== true) {
-      throw pkitError("INVALID_DEFINITION", `${permissionPath}.${method}: a grant does not allow enabled: false`);
+  target[key] = value;
+}
+function cropValue(value, walk) {
+  if (Array.isArray(value)) {
+    if (value.length === 0)
+      return isAllowedPath(walk.segments, walk.patterns) ? [] : PRUNED;
+    if (walk.ancestors.has(value))
+      throw new RangeError("data contains a circular reference");
+    requireDepth(walk);
+    walk.ancestors.add(value);
+    const items = [];
+    for (const item of value) {
+      const croppedItem = cropValue(item, walk);
+      if (croppedItem === PRUNED)
+        continue;
+      items.push(croppedItem);
     }
-    if (definition.properties === ALL_FIELDS) {
-      throw pkitError("INVALID_DEFINITION", `${permissionPath}.${method}: a grant requires an explicit properties list`);
+    walk.ancestors.delete(value);
+    return items.length === 0 ? PRUNED : items;
+  }
+  if (isPlainObject(value)) {
+    const container = value;
+    const keys = Object.keys(container);
+    if (keys.length === 0)
+      return isAllowedPath(walk.segments, walk.patterns) ? {} : PRUNED;
+    if (walk.ancestors.has(container))
+      throw new RangeError("data contains a circular reference");
+    requireDepth(walk);
+    walk.ancestors.add(container);
+    const cropped = {};
+    let keptCount = 0;
+    for (const key of keys) {
+      walk.segments.push(key);
+      const croppedValue = cropValue(container[key], walk);
+      walk.segments.pop();
+      if (croppedValue === PRUNED)
+        continue;
+      setField(cropped, key, croppedValue);
+      keptCount += 1;
     }
+    walk.ancestors.delete(container);
+    return keptCount === 0 ? PRUNED : cropped;
+  }
+  return isAllowedPath(walk.segments, walk.patterns) ? value : PRUNED;
+}
+function cropData(data, walk) {
+  const cropped = {};
+  for (const key of Object.keys(data)) {
+    walk.segments.push(key);
+    const croppedValue = cropValue(data[key], walk);
+    walk.segments.pop();
+    if (croppedValue === PRUNED)
+      continue;
+    setField(cropped, key, croppedValue);
   }
-  return { source, actions: registeredActions };
-}
-function validateHook(hook, registration, state) {
-  const { action, name, role, method } = registration;
-  validateOpenRegistry(state);
-  if (role !== undefined && role !== GLOBAL_HOOK_OWNER)
-    validateRole(role, state.roles, "ROLE_NOT_DECLARED");
-  const permissionPath = name === undefined ? action : `${action}::${name}`;
-  validateMethod(method, { code: "INVALID_DEFINITION", message: permissionPath });
-  if (typeof hook !== "function")
-    throw pkitError("INVALID_DEFINITION", `${permissionPath}: hook("${method}") expects a function`);
-}
-function declaresMethod(nameEntry, method) {
-  for (const actions of nameEntry.actions.values()) {
-    if (Object.hasOwn(actions, method))
-      return true;
-  }
-  return false;
+  return cropped;
 }
-function hasAccessPath(nameEntry, role, method) {
-  if (nameEntry.actions.get(role)?.[method])
-    return true;
-  for (const grant of nameEntry.grants.values()) {
-    if (grant.source.role === role && grant.actions[method])
-      return true;
+function collectForbiddenPaths(value, walk, forbidden) {
+  if (Array.isArray(value)) {
+    if (value.length === 0 || walk.ancestors.has(value)) {
+      reportPath(walk, forbidden);
+      return;
+    }
+    requireDepth(walk);
+    walk.ancestors.add(value);
+    for (const item of value)
+      collectForbiddenPaths(item, walk, forbidden);
+    walk.ancestors.delete(value);
+    return;
   }
-  return false;
-}
-function validateGrantReferences(permissionPath, nameEntry, modules) {
-  for (const [permissionId, grant] of nameEntry.grants) {
-    const sourceEntry = modules.get(grant.source.action)?.names.get(grant.source.name);
-    if (!sourceEntry?.actions.has(grant.source.role)) {
-      throw pkitError("INVALID_DEFINITION", `"${permissionPath}": grantTo "${permissionId}" references a permission with no registered actions`);
+  if (isPlainObject(value)) {
+    const container = value;
+    const keys = Object.keys(container);
+    if (keys.length === 0 || walk.ancestors.has(container)) {
+      reportPath(walk, forbidden);
+      return;
     }
-    for (const method of Object.keys(grant.actions)) {
-      if (declaresMethod(nameEntry, method))
-        continue;
-      throw pkitError("INVALID_DEFINITION", `"${permissionPath}": grantTo "${permissionId}" grants "${method}", which no role declares on that permission`);
+    requireDepth(walk);
+    walk.ancestors.add(container);
+    for (const key of keys) {
+      walk.segments.push(key);
+      collectForbiddenPaths(container[key], walk, forbidden);
+      walk.segments.pop();
     }
+    walk.ancestors.delete(container);
+    return;
   }
+  reportPath(walk, forbidden);
 }
-function validateRoleHooks(permissionPath, nameEntry) {
-  for (const [hookRole, methodHooks] of nameEntry.hooks) {
-    if (hookRole === GLOBAL_HOOK_OWNER)
-      continue;
-    for (const method of methodHooks.keys()) {
-      if (hasAccessPath(nameEntry, hookRole, method))
-        continue;
-      throw pkitError("INVALID_DEFINITION", `"${permissionPath}": hook for "${hookRole}" on "${method}" has no registered actions or grant for that role`);
-    }
+function reportPath(walk, forbidden) {
+  if (isAllowedPath(walk.segments, walk.patterns))
+    return;
+  forbidden.add(walk.segments.join("."));
+}
+function rejectForbiddenPaths(data, walk) {
+  const forbidden = new Set;
+  for (const key of Object.keys(data)) {
+    walk.segments.push(key);
+    collectForbiddenPaths(data[key], walk, forbidden);
+    walk.segments.pop();
   }
+  if (forbidden.size === 0)
+    return;
+  const fields = [...forbidden];
+  throw Object.assign(errors_default.create("PROPERTIES_NOT_ALLOWED", `fields not allowed: ${fields.join(", ")}`), { fields });
 }
-function validateSealedRegistry(modules) {
-  for (const [action, registeredModule] of modules) {
-    if (registeredModule.names.size === 0) {
-      throw pkitError("INVALID_DEFINITION", `"${action}" has hooks but no name with registered actions`);
+var properties_default = properties;
+
+// src/definitions.ts
+var METHODS = new Set(constants_default.METHODS);
+var definitions = {
+  checkMethod(method, code, subject) {
+    if (typeof method === "string" && METHODS.has(method))
+      return method;
+    throw errors_default.create(code, `${subject}: method "${errors_default.describe(method)}" does not exist. Methods: ${constants_default.METHODS.join(", ")}`);
+  },
+  readActions(actions, permissionPath) {
+    const declared = requireObject(actions, `${permissionPath}: registerActions expects an object`);
+    const registeredActions = Object.create(null);
+    for (const [method, definition] of Object.entries(declared)) {
+      definitions.checkMethod(method, "INVALID_DEFINITION", permissionPath);
+      registeredActions[method] = readActionDefinition(definition, `${permissionPath}.${method}`);
     }
-    for (const [name, nameEntry] of registeredModule.names) {
-      const permissionPath = `${action}::${name}`;
-      if (nameEntry.actions.size === 0) {
-        throw pkitError("INVALID_DEFINITION", `"${permissionPath}" has no registered actions for any role`);
+    return Object.freeze(registeredActions);
+  },
+  readGrant(actions, permissionPath) {
+    const registeredActions = definitions.readActions(actions, permissionPath);
+    for (const [method, definition] of Object.entries(registeredActions)) {
+      if (definition.enabled !== true) {
+        throw errors_default.create("INVALID_DEFINITION", `${permissionPath}.${method}: a grant does not allow enabled: false`);
+      }
+      if (definition.properties === constants_default.ALL_FIELDS) {
+        throw errors_default.create("INVALID_DEFINITION", `${permissionPath}.${method}: a grant requires an explicit properties list`);
       }
-      validateGrantReferences(permissionPath, nameEntry, modules);
-      validateRoleHooks(permissionPath, nameEntry);
     }
+    return registeredActions;
   }
+};
+function requireObject(value, message) {
+  if (value === null || typeof value !== "object" || Array.isArray(value))
+    throw errors_default.create("INVALID_DEFINITION", message);
+  return value;
 }
-function validateAssignments(permissions, role, assignable) {
-  validateStrings(permissions, { code: "INVALID_INPUT", message: "permissions must be an array of strings", minimumLength: 1 });
-  const assigned = new Set;
-  for (const permissionId of permissions) {
-    const reference = parsePermissionId(permissionId, {
-      code: "INVALID_INPUT",
-      message: `invalid permission identifier: "${permissionId}" (format role::module::name)`
-    });
-    if (reference.role !== role) {
-      throw pkitError("PERMISSION_ROLE_MISMATCH", `"${permissionId}" belongs to role "${reference.role}", not the authenticated role "${role}"`);
-    }
-    if (!assignable.has(permissionId)) {
-      throw pkitError("UNKNOWN_PERMISSION", `"${permissionId}" is not an assignable permission`);
-    }
-    assigned.add(permissionId);
+function readActionDefinition(definition, permissionPath) {
+  const action = requireObject(definition, `${permissionPath}: must be an object`);
+  if (typeof action.enabled !== "boolean") {
+    throw errors_default.create("INVALID_DEFINITION", `${permissionPath}: enabled must be a boolean`);
   }
-  return assigned;
-}
-function validateIdentity(assignments, state) {
-  validateSnapshot(state.snapshot);
-  const { role, permissions } = assignments;
-  if (typeof role !== "string")
-    throw pkitError("INVALID_INPUT", "role is required");
-  validateRole(role, state.roles, "UNKNOWN_ROLE");
-  return { role, assigned: validateAssignments(permissions, role, state.snapshot.assignable) };
-}
-function trimSelection(select, properties) {
-  validateStrings(select, { code: "INVALID_INPUT", message: "select must be an array of strings", minimumLength: 0 });
-  const selectedFields = [];
-  for (const field of select) {
-    if (properties.includes(field))
-      selectedFields.push(field);
+  if (action.properties === constants_default.ALL_FIELDS) {
+    return Object.freeze({ enabled: action.enabled, properties: constants_default.ALL_FIELDS });
   }
-  return selectedFields;
+  return Object.freeze({ enabled: action.enabled, properties: readDeclaredProperties(action.properties, permissionPath) });
 }
-function rejectForbiddenFields(data, properties, permissionPath) {
-  const forbiddenFields = [];
-  for (const field of Object.keys(data)) {
-    if (!properties.includes(field))
-      forbiddenFields.push(field);
+function readDeclaredProperties(value, permissionPath) {
+  if (!Array.isArray(value)) {
+    throw errors_default.create("INVALID_DEFINITION", `${permissionPath}: properties must be string[] or '${constants_default.ALL_FIELDS}'`);
   }
-  if (forbiddenFields.length === 0)
-    return;
-  throw Object.assign(pkitError("PROPERTIES_NOT_ALLOWED", `fields not allowed in "${permissionPath}": ${forbiddenFields.join(", ")}`), { fields: forbiddenFields });
-}
-function validateRequest(input, state) {
-  validateSnapshot(state.snapshot);
-  const { action, name, method } = input;
-  validateMethod(method, { code: "INVALID_INPUT", message: "method is required" });
-  if (method !== "find" && Object.hasOwn(input, "select"))
-    throw pkitError("INVALID_INPUT", "select only applies to find");
-  if (typeof action !== "string" || typeof name !== "string")
-    throw pkitError("INVALID_INPUT", "action and name are required");
-  const { role, assigned } = validateIdentity(input, state);
-  const registeredModule = state.modules.get(action);
-  if (!registeredModule)
-    throw pkitError("UNKNOWN_ACTION", `module "${action}" is not registered`);
-  const nameEntry = registeredModule.names.get(name);
-  if (!nameEntry)
-    throw pkitError("UNKNOWN_PERMISSION", `permission "${action}::${name}" is not registered`);
-  const permissionId = permissionIdOf(role, action, name);
-  const access = resolveAccess(nameEntry, permissionId, role, method, assigned);
-  if (access.status === "unassigned") {
-    throw pkitError("PERMISSION_NOT_ASSIGNED", `"${permissionId}" is not assigned or granted by the user permissions`);
+  for (const property of value) {
+    if (typeof property !== "string" || property.length === 0) {
+      throw errors_default.create("INVALID_DEFINITION", `${permissionPath}: properties must be string[] or '${constants_default.ALL_FIELDS}'`);
+    }
   }
-  if (access.status === "disabled")
-    throw pkitError("METHOD_DISABLED", `"${permissionId}.${method}" is not enabled`);
-  const { data, context } = input;
-  if (context !== undefined)
-    validateObject(context, { code: "INVALID_INPUT", message: "context must be an object" });
-  const { properties, authorization } = access;
-  const permission = Object.freeze({ role, action, name, permissionId, method, enabled: true, properties, authorization });
-  const request = { registeredModule, nameEntry, permission, data, context };
-  if (method === "find") {
-    if (data !== undefined)
-      validateObject(data, { code: "INVALID_INPUT", message: "data must be an object" });
-    const { select } = input;
-    if (select === undefined)
-      return { ...request, result: properties };
-    if (properties === ALL_FIELDS) {
-      validateStrings(select, { code: "INVALID_INPUT", message: "select must be an array of strings", minimumLength: 0 });
-      return { ...request, result: select };
-    }
-    return { ...request, result: trimSelection(select, properties) };
-  }
-  validateObject(data, { code: "INVALID_INPUT", message: "data must be an object" });
-  if (properties !== ALL_FIELDS)
-    rejectForbiddenFields(data, properties, `${permissionId}.${method}`);
-  return { ...request, result: data };
-}
-
-// src/context.ts
-function setRoles(key, roles) {
-  validateContextKey(key);
-  const state = getOrCreateState();
-  validateRoleCatalog(roles, state);
-  state.roles = new Set(roles);
-}
-function getRoles(key) {
-  validateContextKey(key);
-  return [...getOrCreateState().roles];
+  const declared = value;
+  if (declared.includes(constants_default.ALL_FIELDS)) {
+    throw errors_default.create("INVALID_DEFINITION", `${permissionPath}: '${constants_default.ALL_FIELDS}' is only allowed as the whole properties value`);
+  }
+  if (new Set(declared).size !== declared.length) {
+    throw errors_default.create("INVALID_DEFINITION", `${permissionPath}: properties contains duplicate fields`);
+  }
+  for (const property of declared)
+    properties_default.checkDeclaredPath(property, permissionPath);
+  return Object.freeze([...declared]);
 }
-var context = Object.freeze({ set: setRoles, get: getRoles });
+var definitions_default = definitions;
 
 // src/registry.ts
-function appendHook(methodHooks, method, hook) {
-  const hooks = methodHooks.get(method) ?? [];
-  methodHooks.set(method, hooks);
-  hooks.push(hook);
-}
-function registerActions(scope, actions) {
-  const state = getOrCreateState();
-  const registeredActions = validateActions(actions, scope, state);
-  ensureName(state, scope.action, scope.name).actions.set(scope.role, registeredActions);
-  return scope.builder;
-}
-function registerGrant(scope, actions) {
-  const state = getOrCreateState();
-  const grant = validateGrantActions(actions, scope, state);
-  ensureName(state, scope.action, scope.name).grants.set(scope.permissionId, grant);
-  return scope.builder;
+var registry = {
+  defineModule(segment) {
+    identifiers_default.checkModuleSegment(segment);
+    return createModuleBuilder(segment);
+  }
+};
+function createModuleBuilder(action) {
+  const builder = {};
+  const scope = { action, builder };
+  return Object.assign(builder, {
+    module: appendModule.bind(null, action),
+    name: createNameBuilder.bind(null, action),
+    hook: registerModuleHook.bind(null, scope)
+  });
 }
-function registerModuleHook(scope, method, hook) {
-  const state = getOrCreateState();
-  validateHook(hook, { action: scope.action, method }, state);
-  appendHook(ensureModule(state, scope.action).hooks, method, hook);
-  return scope.builder;
+function appendModule(parentAction, segment) {
+  identifiers_default.checkModuleSegment(segment);
+  return createModuleBuilder(`${parentAction}${constants_default.MODULE_SEPARATOR}${segment}`);
 }
-function registerNameHook(scope, method, hook) {
-  const state = getOrCreateState();
-  validateHook(hook, { ...scope, method }, state);
-  const nameEntry = ensureName(state, scope.action, scope.name);
-  const roleHooks = nameEntry.hooks.get(scope.role) ?? new Map;
-  nameEntry.hooks.set(scope.role, roleHooks);
-  appendHook(roleHooks, method, hook);
-  return scope.builder;
+function createNameBuilder(action, name) {
+  identifiers_default.checkName(name);
+  const builder = {};
+  const scope = { action, name, role: constants_default.GLOBAL_HOOK_OWNER, builder };
+  return Object.assign(builder, {
+    role: createRoleBuilder.bind(null, action, name),
+    grantTo: createGrantBuilder.bind(null, action, name),
+    hook: registerNameHook.bind(null, scope)
+  });
 }
 function createRoleBuilder(action, name, role) {
-  validateRoleSegment(role);
+  identifiers_default.checkRole(role);
   const builder = {};
   const scope = { action, name, role, builder };
   return Object.assign(builder, {
@@ -483,43 +624,72 @@ function createGrantBuilder(action, name, permissionId) {
   const scope = { action, name, permissionId, builder };
   return Object.assign(builder, { registerActions: registerGrant.bind(null, scope) });
 }
-function createNameBuilder(action, name) {
-  validatePermissionName(name);
-  const builder = {};
-  const scope = { action, name, role: GLOBAL_HOOK_OWNER, builder };
-  return Object.assign(builder, {
-    role: createRoleBuilder.bind(null, action, name),
-    grantTo: createGrantBuilder.bind(null, action, name),
-    hook: registerNameHook.bind(null, scope)
-  });
+function registerActions(scope, actions) {
+  const currentState = state_default.getOrCreate();
+  state_default.requireOpen(currentState);
+  requireDeclaredRole(scope.role, currentState.roles);
+  if (currentState.modules.get(scope.action)?.names.get(scope.name)?.actions.has(scope.role)) {
+    throw errors_default.create("DUPLICATE_REGISTRATION", `"${scope.action}::${scope.name}" already has actions registered for role "${scope.role}"`);
+  }
+  const registeredActions = definitions_default.readActions(actions, `${scope.action}::${scope.name} [${scope.role}]`);
+  ensureName(currentState, scope.action, scope.name).actions.set(scope.role, registeredActions);
+  return scope.builder;
 }
-function createModuleBuilder(action) {
-  const builder = {};
-  const scope = { action, builder };
-  return Object.assign(builder, {
-    module: appendModule.bind(null, action),
-    name: createNameBuilder.bind(null, action),
-    hook: registerModuleHook.bind(null, scope)
-  });
+function registerGrant(scope, actions) {
+  const currentState = state_default.getOrCreate();
+  state_default.requireOpen(currentState);
+  const source = identifiers_default.parse(scope.permissionId, "INVALID_DEFINITION", `"${scope.action}::${scope.name}": invalid grantTo identifier`);
+  requireDeclaredRole(source.role, currentState.roles);
+  if (source.action === scope.action && source.name === scope.name) {
+    throw errors_default.create("INVALID_DEFINITION", `"${scope.permissionId}" cannot grant to itself`);
+  }
+  if (currentState.modules.get(scope.action)?.names.get(scope.name)?.grants.has(scope.permissionId)) {
+    throw errors_default.create("DUPLICATE_REGISTRATION", `"${scope.action}::${scope.name}" already has a grant for "${scope.permissionId}"`);
+  }
+  const grantActions = definitions_default.readGrant(actions, `${scope.action}::${scope.name} [grantTo ${scope.permissionId}]`);
+  ensureName(currentState, scope.action, scope.name).grants.set(scope.permissionId, { source, actions: grantActions });
+  return scope.builder;
 }
-function appendModule(parentAction, segment) {
-  validateModuleName(segment);
-  return createModuleBuilder(`${parentAction}${MODULE_SEPARATOR}${segment}`);
+function registerModuleHook(scope, method, hook) {
+  const currentState = state_default.getOrCreate();
+  state_default.requireOpen(currentState);
+  checkHook(hook, method, scope.action);
+  appendHook(ensureModule(currentState, scope.action).hooks, method, hook);
+  return scope.builder;
 }
-function defineModule(segment) {
-  validateModuleName(segment);
-  return createModuleBuilder(segment);
+function registerNameHook(scope, method, hook) {
+  const currentState = state_default.getOrCreate();
+  state_default.requireOpen(currentState);
+  if (scope.role !== constants_default.GLOBAL_HOOK_OWNER)
+    requireDeclaredRole(scope.role, currentState.roles);
+  checkHook(hook, method, `${scope.action}::${scope.name}`);
+  const nameEntry = ensureName(currentState, scope.action, scope.name);
+  const roleHooks = nameEntry.hooks.get(scope.role) ?? new Map;
+  nameEntry.hooks.set(scope.role, roleHooks);
+  appendHook(roleHooks, method, hook);
+  return scope.builder;
+}
+function checkHook(hook, method, permissionPath) {
+  definitions_default.checkMethod(method, "INVALID_DEFINITION", permissionPath);
+  if (typeof hook !== "function")
+    throw errors_default.create("INVALID_DEFINITION", `${permissionPath}: hook("${method}") expects a function`);
+}
+function requireDeclaredRole(role, roles) {
+  if (roles.has(role))
+    return;
+  throw errors_default.create("ROLE_NOT_DECLARED", `role "${role}" is not declared. Available roles: ${[...roles].join(", ")}.
+` + "Is pkit.context.set('roles', [...]) missing from pkit.config.js, or was it imported after this file?");
 }
-function ensureModule(state, action) {
-  const registeredModule = state.modules.get(action);
+function ensureModule(currentState, action) {
+  const registeredModule = currentState.modules.get(action);
   if (registeredModule)
     return registeredModule;
   const newModule = { names: new Map, hooks: new Map };
-  state.modules.set(action, newModule);
+  currentState.modules.set(action, newModule);
   return newModule;
 }
-function ensureName(state, action, name) {
-  const registeredModule = ensureModule(state, action);
+function ensureName(currentState, action, name) {
+  const registeredModule = ensureModule(currentState, action);
   const registeredName = registeredModule.names.get(name);
   if (registeredName)
     return registeredName;
@@ -527,60 +697,157 @@ function ensureName(state, action, name) {
   registeredModule.names.set(name, newName);
   return newName;
 }
+function appendHook(methodHooks, method, hook) {
+  const hooks = methodHooks.get(method) ?? [];
+  methodHooks.set(method, hooks);
+  hooks.push(hook);
+}
+var registry_default = registry;
 
 // src/seal.ts
-function seal() {
-  const state = getOrCreateState();
-  if (state.snapshot)
-    return;
-  validateSealedRegistry(state.modules);
-  const named = Object.create(null);
-  for (const [action, registeredModule] of state.modules) {
+var sealer = {
+  seal() {
+    const currentState = state_default.getOrCreate();
+    if (currentState.snapshot)
+      return;
+    checkRegistry(currentState.modules);
+    const named = Object.create(null);
+    for (const [action, registeredModule] of currentState.modules) {
+      for (const [name, nameEntry] of registeredModule.names) {
+        for (const [role, actions] of nameEntry.actions) {
+          named[identifiers_default.build(role, action, name)] = actions;
+        }
+      }
+    }
+    currentState.snapshot = { named: Object.freeze(named), assignable: new Set(Object.keys(named)) };
+  }
+};
+function checkRegistry(modules) {
+  for (const [action, registeredModule] of modules) {
+    if (registeredModule.names.size === 0) {
+      throw errors_default.create("INVALID_DEFINITION", `"${action}" has hooks but no name with registered actions`);
+    }
     for (const [name, nameEntry] of registeredModule.names) {
-      for (const [role, actions] of nameEntry.actions) {
-        named[permissionIdOf(role, action, name)] = actions;
+      const permissionPath = `${action}::${name}`;
+      if (nameEntry.actions.size === 0) {
+        throw errors_default.create("INVALID_DEFINITION", `"${permissionPath}" has no registered actions for any role`);
       }
+      checkGrantReferences(permissionPath, nameEntry, modules);
+      checkRoleHooks(permissionPath, nameEntry);
     }
   }
-  state.snapshot = { named: Object.freeze(named), assignable: new Set(Object.keys(named)) };
 }
-
-// src/permissions.ts
-function getNamedCatalog() {
-  const { snapshot } = getOrCreateState();
-  validateSnapshot(snapshot);
-  return snapshot.named;
-}
-function resolveMethodAccess(nameEntry, permissionId, role, assigned) {
-  const methodAccess = Object.create(null);
-  let reachable = false;
-  for (const method of METHODS) {
-    const access = resolveAccess(nameEntry, permissionId, role, method, assigned);
-    methodAccess[method] = access.status === "granted";
-    if (access.status !== "unassigned")
-      reachable = true;
-  }
-  return reachable ? Object.freeze(methodAccess) : undefined;
-}
-function forUser(assignments) {
-  const state = getOrCreateState();
-  const { role, assigned } = validateIdentity(assignments, state);
-  const access = Object.create(null);
-  for (const [action, registeredModule] of state.modules) {
-    for (const [name, nameEntry] of registeredModule.names) {
-      const permissionId = permissionIdOf(role, action, name);
-      const methodAccess = resolveMethodAccess(nameEntry, permissionId, role, assigned);
-      if (methodAccess)
-        access[permissionId] = methodAccess;
+function checkGrantReferences(permissionPath, nameEntry, modules) {
+  for (const [permissionId, grant] of nameEntry.grants) {
+    const sourceEntry = modules.get(grant.source.action)?.names.get(grant.source.name);
+    if (!sourceEntry?.actions.has(grant.source.role)) {
+      throw errors_default.create("INVALID_DEFINITION", `"${permissionPath}": grantTo "${permissionId}" references a permission with no registered actions`);
+    }
+    for (const method of Object.keys(grant.actions)) {
+      if (declaresMethod(nameEntry, method))
+        continue;
+      throw errors_default.create("INVALID_DEFINITION", `"${permissionPath}": grantTo "${permissionId}" grants "${method}", which no role declares on that permission`);
+    }
+  }
+}
+function declaresMethod(nameEntry, method) {
+  for (const actions of nameEntry.actions.values()) {
+    if (Object.hasOwn(actions, method))
+      return true;
+  }
+  return false;
+}
+function checkRoleHooks(permissionPath, nameEntry) {
+  for (const [hookRole, methodHooks] of nameEntry.hooks) {
+    if (hookRole === constants_default.GLOBAL_HOOK_OWNER)
+      continue;
+    for (const method of methodHooks.keys()) {
+      if (hasAccessPath(nameEntry, hookRole, method))
+        continue;
+      throw errors_default.create("INVALID_DEFINITION", `"${permissionPath}": hook for "${hookRole}" on "${method}" has no registered actions or grant for that role`);
     }
   }
-  return Object.freeze(access);
 }
-var permissions = Object.freeze(Object.defineProperty({ forUser }, "named", { get: getNamedCatalog, enumerable: true, configurable: false }));
+function hasAccessPath(nameEntry, role, method) {
+  if (nameEntry.actions.get(role)?.[method])
+    return true;
+  for (const grant of nameEntry.grants.values()) {
+    if (grant.source.role === role && grant.actions[method])
+      return true;
+  }
+  return false;
+}
+var seal_default = sealer;
 
 // src/validate.ts
+var validator = {
+  async validate(input) {
+    try {
+      const request = prepareRequest(input, state_default.getOrCreate());
+      const hookCalls = [];
+      for (const hook of request.hooks)
+        hookCalls.push(invokeHook(hook, request));
+      const hookResults = await Promise.allSettled(hookCalls);
+      const hookErrors = [];
+      for (const hookResult of hookResults) {
+        if (hookResult.status === "fulfilled")
+          continue;
+        const hookCause = hookResult.reason;
+        hookErrors.push({ code: "HOOK_ERROR", message: describeHookFailure(hookCause), cause: hookCause });
+      }
+      if (hookErrors.length)
+        return { result: null, errors: Object.freeze(hookErrors) };
+      return { result: { data: request.data }, errors: Object.freeze([]) };
+    } catch (cause) {
+      return { result: null, errors: Object.freeze([translateFailure(cause)]) };
+    }
+  }
+};
+function prepareRequest(input, currentState) {
+  const snapshot = state_default.requireSnapshot(currentState);
+  const method = definitions_default.checkMethod(input.method, "INVALID_INPUT", "method is required");
+  const { action, permissions } = input;
+  if (typeof action !== "string")
+    throw errors_default.create("INVALID_INPUT", "action is required");
+  const data = readOptionalObject(input.data, "data must be an object");
+  const context = readOptionalObject(input.context, "context must be an object");
+  const identity = resolve_default.identity(input, snapshot, currentState.roles);
+  const { role, assigned } = identity;
+  const registeredModule = currentState.modules.get(action);
+  if (!registeredModule)
+    throw errors_default.create("UNKNOWN_ACTION", `module "${action}" is not registered`);
+  const chosen = resolve_default.permission(registeredModule, action, identity);
+  if (!chosen) {
+    throw errors_default.create("PERMISSION_NOT_ASSIGNED", `no name of module "${action}" is assigned or granted to role "${role}" by the user permissions`);
+  }
+  const { permissionId, entry: nameEntry } = chosen;
+  const access = resolve_default.access(nameEntry, permissionId, role, method, assigned);
+  if (access.status === "unassigned") {
+    throw errors_default.create("PERMISSION_NOT_ASSIGNED", `"${permissionId}" is not assigned or granted by the user permissions`);
+  }
+  if (access.status === "disabled")
+    throw errors_default.create("METHOD_DISABLED", `"${permissionId}.${method}" is not enabled`);
+  const hookGroups = [
+    registeredModule.hooks.get(method),
+    nameEntry.hooks.get(constants_default.GLOBAL_HOOK_OWNER)?.get(method),
+    nameEntry.hooks.get(role)?.get(method)
+  ];
+  const hooks = [];
+  for (const group of hookGroups) {
+    if (group)
+      hooks.push(...group);
+  }
+  return { hooks, context, permissions, data: properties_default.resolve(data, access.properties, currentState.cropper) };
+}
+function readOptionalObject(value, message) {
+  if (value === undefined)
+    return {};
+  if (value === null || typeof value !== "object" || Array.isArray(value))
+    throw errors_default.create("INVALID_INPUT", message);
+  return value;
+}
 async function invokeHook(hook, request) {
-  return hook(request.data, request.context, request.permission);
+  return hook(request.data, request.context, request.permissions);
 }
 function describeHookFailure(reason) {
   try {
@@ -589,48 +856,24 @@ function describeHookFailure(reason) {
     return "the hook threw a value that cannot be described";
   }
 }
-async function validate(input) {
-  try {
-    const request = validateRequest(input, getOrCreateState());
-    const { registeredModule, nameEntry, permission, result } = request;
-    const { method, role } = permission;
-    const hookGroups = [
-      registeredModule.hooks.get(method),
-      nameEntry.hooks.get(GLOBAL_HOOK_OWNER)?.get(method),
-      nameEntry.hooks.get(role)?.get(method)
-    ];
-    const hookCalls = [];
-    for (const hooks of hookGroups) {
-      if (!hooks)
-        continue;
-      for (const hook of hooks)
-        hookCalls.push(invokeHook(hook, request));
-    }
-    const hookResults = await Promise.allSettled(hookCalls);
-    const errors = [];
-    for (const hookResult of hookResults) {
-      if (hookResult.status === "fulfilled")
-        continue;
-      const hookCause = hookResult.reason;
-      errors.push({ code: "HOOK_ERROR", message: describeHookFailure(hookCause), cause: hookCause });
-    }
-    if (errors.length)
-      return { result: null, errors: Object.freeze(errors) };
-    return { result, errors: Object.freeze([]) };
-  } catch (cause) {
-    if (cause instanceof Error && cause.name === "PkitError") {
-      const permissionError = cause;
-      const error = permissionError.code === "PROPERTIES_NOT_ALLOWED" ? { code: permissionError.code, message: permissionError.message, fields: permissionError.fields } : { code: permissionError.code, message: permissionError.message };
-      return { result: null, errors: Object.freeze([error]) };
-    }
-    return {
-      result: null,
-      errors: Object.freeze([{ code: "VALIDATION_ERROR", message: "permission could not be validated", cause }])
-    };
+function translateFailure(cause) {
+  if (!(cause instanceof Error) || cause.name !== "PkitError") {
+    return { code: "VALIDATION_ERROR", message: "permission could not be validated", cause };
   }
+  const permissionError = cause;
+  if (permissionError.code === "PROPERTIES_NOT_ALLOWED") {
+    return { code: permissionError.code, message: permissionError.message, fields: permissionError.fields };
+  }
+  return { code: permissionError.code, message: permissionError.message };
 }
+var validate_default = validator;
+
 // src/index.ts
-var pkit = Object.freeze({ context, module: defineModule, seal, permissions, validate });
+var METHODS2 = constants_default.METHODS;
+var seal = seal_default.seal;
+var validate = validate_default.validate;
+var defineModule = registry_default.defineModule;
+var pkit = Object.freeze({ context: context_default, module: defineModule, seal, permissions: permissions_default, validate });
 var src_default = pkit;
 
-//# debugId=B57D4832B42402DE64756E2164756E21
+//# debugId=1BE6B3EEE711E91164756E2164756E21