endpoint-permissions-kit 0.1.0 → 0.2.1

package/dist/esm/cli/child.js

@@ -2,407 +2,384 @@
 import { pathToFileURL } from "node:url";
 import { resolve } from "node:path";
 
-// src/constants.ts
-var METHODS = ["find", "update", "create", "remove"];
-var GENERAL_ROLE = "general";
-var GLOBAL_HOOK_OWNER = "*";
-var ALL_FIELDS = "*";
-var MODULE_SEPARATOR = ".";
-var PERMISSION_ID_SEPARATOR = "::";
-
-// src/state.ts
-function getOrCreateState() {
-  const stateKey = Symbol.for("endpoint-permissions-kit");
-  const stateHost = globalThis;
-  if (stateHost[stateKey] === undefined) {
-    stateHost[stateKey] = { roles: new Set([GENERAL_ROLE]), modules: new Map, snapshot: null };
-  }
-  return stateHost[stateKey];
-}
-
 // src/errors.ts
-function pkitError(code, message) {
-  return Object.assign(new Error(message), { name: "PkitError", code });
-}
-
-// src/resolve.ts
-var DIRECT_AUTHORIZATION = Object.freeze({ direct: true, grantedBy: Object.freeze([]) });
-var DISABLED_ACCESS = Object.freeze({ status: "disabled" });
-var UNASSIGNED_ACCESS = Object.freeze({ status: "unassigned" });
-function permissionIdOf(role, action, name) {
-  return [role, action, name].join(PERMISSION_ID_SEPARATOR);
-}
-function resolveAccess(nameEntry, permissionId, role, method, assigned) {
-  if (assigned.has(permissionId))
-    return resolveDirectAccess(nameEntry, role, method);
-  return resolveGrantedAccess(nameEntry, method, assigned);
-}
-function resolveDirectAccess(nameEntry, role, method) {
-  const definition = nameEntry.actions.get(role)?.[method];
-  if (!definition?.enabled)
-    return DISABLED_ACCESS;
-  return { status: "granted", properties: definition.properties, authorization: DIRECT_AUTHORIZATION };
-}
-function resolveGrantedAccess(nameEntry, method, assigned) {
-  const grantedBy = [];
-  const properties = new Set;
-  let reachable = false;
-  for (const [enablingId, grant] of nameEntry.grants) {
-    if (!assigned.has(enablingId))
-      continue;
-    reachable = true;
-    const definition = grant.actions[method];
-    if (!definition)
-      continue;
-    grantedBy.push(enablingId);
-    for (const field of definition.properties)
-      properties.add(field);
+var errors = {
+  create(code, message) {
+    return Object.assign(new Error(message), { name: "PkitError", code });
+  },
+  describe(value) {
+    try {
+      return String(value);
+    } catch {
+      return typeof value;
+    }
   }
-  if (grantedBy.length === 0)
-    return reachable ? DISABLED_ACCESS : UNASSIGNED_ACCESS;
-  const authorization = Object.freeze({ direct: false, grantedBy: Object.freeze(grantedBy.sort()) });
-  return { status: "granted", properties: Object.freeze([...properties]), authorization };
-}
+};
+var errors_default = errors;
 
-// src/validators.ts
-function validateObject(value, failure) {
-  if (value === null || typeof value !== "object" || Array.isArray(value)) {
-    throw pkitError(failure.code, failure.message);
-  }
-}
-function validateStrings(value, rules) {
-  if (!Array.isArray(value))
-    throw pkitError(rules.code, rules.message);
-  for (const field of value) {
-    if (typeof field !== "string" || field.length < rules.minimumLength) {
-      throw pkitError(rules.code, rules.message);
+// src/constants.ts
+var constants = {
+  METHODS: Object.freeze(["find", "update", "create", "remove"]),
+  GENERAL_ROLE: "general",
+  GLOBAL_HOOK_OWNER: "*",
+  ALL_FIELDS: "*",
+  MODULE_SEPARATOR: ".",
+  PERMISSION_ID_SEPARATOR: "::"
+};
+var constants_default = constants;
+
+// src/identifiers.ts
+var identifiers = {
+  build(role, action, name) {
+    return `${role}${constants_default.PERMISSION_ID_SEPARATOR}${action}${constants_default.PERMISSION_ID_SEPARATOR}${name}`;
+  },
+  parse(value, code, subject) {
+    if (typeof value !== "string")
+      throw invalidIdentifier(value, code, subject);
+    const parts = value.split(constants_default.PERMISSION_ID_SEPARATOR);
+    const [role, action, name] = parts;
+    if (parts.length !== 3 || role === undefined || action === undefined || name === undefined) {
+      throw invalidIdentifier(value, code, subject);
     }
+    const isValidRole = isCleanSegment(role) && role !== constants_default.GLOBAL_HOOK_OWNER;
+    const isValidName = isCleanSegment(name) && name !== constants_default.GLOBAL_HOOK_OWNER;
+    const isValidAction = action.split(constants_default.MODULE_SEPARATOR).every(isCleanSegment);
+    if (!isValidRole || !isValidName || !isValidAction)
+      throw invalidIdentifier(value, code, subject);
+    return { role, action, name };
+  },
+  checkRole(role) {
+    if (typeof role === "string" && isCleanSegment(role) && role !== constants_default.GLOBAL_HOOK_OWNER)
+      return;
+    throw errors_default.create("INVALID_DEFINITION", `invalid role: "${errors_default.describe(role)}" (non-empty string, no ":" or surrounding whitespace; "${constants_default.GLOBAL_HOOK_OWNER}" is reserved for global hooks)`);
+  },
+  checkModuleSegment(segment) {
+    if (typeof segment === "string" && isCleanSegment(segment) && !segment.includes(constants_default.MODULE_SEPARATOR))
+      return;
+    throw errors_default.create("INVALID_DEFINITION", `invalid module name: "${errors_default.describe(segment)}" (non-empty string, no dots, no ":" or surrounding whitespace)`);
+  },
+  checkName(name) {
+    if (typeof name === "string" && isCleanSegment(name) && name !== constants_default.GLOBAL_HOOK_OWNER)
+      return;
+    throw errors_default.create("INVALID_DEFINITION", `invalid permission name: "${errors_default.describe(name)}" (non-empty string, no ":" or surrounding whitespace; "*" is reserved)`);
   }
-}
-function validateContextKey(key) {
-  if (key !== "roles")
-    throw pkitError("INVALID_DEFINITION", `unknown context key: "${String(key)}"`);
-}
-function validateOpenRegistry(state) {
-  if (state.snapshot)
-    throw pkitError("SEALED", "pkit.seal() was already called: no more registrations allowed");
-}
-function validateSnapshot(snapshot) {
-  if (snapshot === null) {
-    throw pkitError("NOT_SEALED", "pkit.seal() has not been called: call it after importing every permission file");
-  }
-}
-function validateRole(role, roles, code) {
-  if (typeof role === "string" && roles.has(role))
-    return;
-  if (code === "ROLE_NOT_DECLARED") {
-    throw pkitError(code, `role "${String(role)}" is not declared. Available roles: ${[...roles].join(", ")}.
-` + "Is pkit.context.set('roles', [...]) missing from pkit.config.js, or was it imported after this file?");
-  }
-  throw pkitError(code, `role "${String(role)}" is not declared`);
-}
-function validateRoleCatalog(roles, state) {
-  validateOpenRegistry(state);
-  if (state.modules.size) {
-    throw pkitError("INVALID_DEFINITION", "roles must be declared before registering permissions: import pkit.config.js first");
-  }
-  validateStrings(roles, {
-    code: "INVALID_DEFINITION",
-    message: "roles must be an array of non-empty strings",
-    minimumLength: 1
-  });
-  if (roles.length === 0)
-    throw pkitError("INVALID_DEFINITION", "roles must declare at least one role");
-  for (const role of roles)
-    validateRoleSegment(role);
-}
+};
 function isCleanSegment(value) {
   return value.length > 0 && value.trim() === value && !value.includes(":");
 }
-function validateRoleSegment(role) {
-  if (typeof role === "string" && isCleanSegment(role) && role !== GLOBAL_HOOK_OWNER)
-    return;
-  throw pkitError("INVALID_DEFINITION", `invalid role: "${String(role)}" (non-empty string, no ":" or surrounding whitespace; "${GLOBAL_HOOK_OWNER}" is reserved for global hooks)`);
-}
-function validateModuleName(moduleName) {
-  if (typeof moduleName === "string" && isCleanSegment(moduleName) && !moduleName.includes(MODULE_SEPARATOR))
-    return;
-  throw pkitError("INVALID_DEFINITION", `invalid module name: "${String(moduleName)}" (non-empty string, no dots, no ":" or surrounding whitespace)`);
-}
-function validatePermissionName(name) {
-  if (typeof name === "string" && isCleanSegment(name) && name !== GLOBAL_HOOK_OWNER)
-    return;
-  throw pkitError("INVALID_DEFINITION", `invalid permission name: "${String(name)}" (non-empty string, no ":" or surrounding whitespace; "*" is reserved)`);
-}
-function parsePermissionId(value, failure) {
-  if (typeof value !== "string")
-    throw pkitError(failure.code, failure.message);
-  const parts = value.split(PERMISSION_ID_SEPARATOR);
-  const [role, action, name] = parts;
-  if (parts.length !== 3 || role === undefined || action === undefined || name === undefined) {
-    throw pkitError(failure.code, failure.message);
-  }
-  const isValidRole = isCleanSegment(role) && role !== GLOBAL_HOOK_OWNER;
-  const isValidName = isCleanSegment(name) && name !== GLOBAL_HOOK_OWNER;
-  const isValidAction = action.split(MODULE_SEPARATOR).every(isCleanSegment);
-  if (!isValidRole || !isValidName || !isValidAction)
-    throw pkitError(failure.code, failure.message);
-  return { role, action, name };
-}
-function validateMethod(method, failure) {
-  if (METHODS.includes(method))
-    return;
-  throw pkitError(failure.code, `${failure.message}: method "${String(method)}" does not exist. Methods: ${METHODS.join(", ")}`);
-}
-function readActionDefinition(definition, permissionPath) {
-  validateObject(definition, { code: "INVALID_DEFINITION", message: `${permissionPath}: must be an object` });
-  if (typeof definition.enabled !== "boolean") {
-    throw pkitError("INVALID_DEFINITION", `${permissionPath}: enabled must be a boolean`);
-  }
-  const { properties } = definition;
-  if (properties === ALL_FIELDS)
-    return Object.freeze({ enabled: definition.enabled, properties });
-  validateStrings(properties, {
-    code: "INVALID_DEFINITION",
-    message: `${permissionPath}: properties must be string[] or '*'`,
-    minimumLength: 1
-  });
-  if (properties.includes(ALL_FIELDS)) {
-    throw pkitError("INVALID_DEFINITION", `${permissionPath}: '${ALL_FIELDS}' is only allowed as the whole properties value`);
-  }
-  if (new Set(properties).size !== properties.length) {
-    throw pkitError("INVALID_DEFINITION", `${permissionPath}: properties contains duplicate fields`);
-  }
-  return Object.freeze({ enabled: definition.enabled, properties: Object.freeze([...properties]) });
-}
-function readActionDefinitions(actions, permissionPath) {
-  validateObject(actions, { code: "INVALID_DEFINITION", message: `${permissionPath}: registerActions expects an object` });
-  const registeredActions = Object.create(null);
-  for (const [method, definition] of Object.entries(actions)) {
-    validateMethod(method, { code: "INVALID_DEFINITION", message: permissionPath });
-    registeredActions[method] = readActionDefinition(definition, `${permissionPath}.${method}`);
-  }
-  return Object.freeze(registeredActions);
-}
-function validateActions(actions, registration, state) {
-  const { action, name, role } = registration;
-  validateOpenRegistry(state);
-  validateRole(role, state.roles, "ROLE_NOT_DECLARED");
-  if (state.modules.get(action)?.names.get(name)?.actions.has(role)) {
-    throw pkitError("DUPLICATE_REGISTRATION", `"${action}::${name}" already has actions registered for role "${role}"`);
-  }
-  return readActionDefinitions(actions, `${action}::${name} [${role}]`);
+function invalidIdentifier(value, code, subject) {
+  return errors_default.create(code, `${subject}: "${errors_default.describe(value)}" (format role::module::name)`);
 }
-function validateGrantActions(actions, registration, state) {
-  const { action, name, permissionId } = registration;
-  validateOpenRegistry(state);
-  const source = parsePermissionId(permissionId, {
-    code: "INVALID_DEFINITION",
-    message: `"${action}::${name}": invalid grantTo identifier: "${String(permissionId)}" (format role::module::name)`
-  });
-  validateRole(source.role, state.roles, "ROLE_NOT_DECLARED");
-  if (source.action === action && source.name === name) {
-    throw pkitError("INVALID_DEFINITION", `"${permissionId}" cannot grant to itself`);
-  }
-  if (state.modules.get(action)?.names.get(name)?.grants.has(permissionId)) {
-    throw pkitError("DUPLICATE_REGISTRATION", `"${action}::${name}" already has a grant for "${permissionId}"`);
+var identifiers_default = identifiers;
+
+// src/properties.ts
+var PRUNED = Symbol("pruned");
+var MAX_DEPTH = 1000;
+var properties = {
+  checkDeclaredPath(property, permissionPath) {
+    if (property.includes("[") || property.includes("]")) {
+      throw errors_default.create("INVALID_DEFINITION", `${permissionPath}: array indexes are not allowed in properties: "${property}"`);
+    }
+    const segments = segmentsOf(property);
+    for (const segment of segments) {
+      if (segment.length === 0)
+        throw errors_default.create("INVALID_DEFINITION", `${permissionPath}: empty segment in property path: "${property}"`);
+    }
+    if (segments[0] === constants_default.ALL_FIELDS) {
+      throw errors_default.create("INVALID_DEFINITION", `${permissionPath}: a property path cannot start with "${constants_default.ALL_FIELDS}": "${property}"`);
+    }
+  },
+  resolve(data, allowed, reserved, cropper) {
+    if (allowed === constants_default.ALL_FIELDS)
+      return data;
+    const patterns = [];
+    for (const pattern of allowed.concat(reserved))
+      patterns.push(segmentsOf(pattern));
+    const walk = { patterns, segments: [], ancestors: new Set([data]) };
+    if (cropper)
+      return cropData(data, walk);
+    rejectForbiddenPaths(data, walk);
+    return data;
   }
-  const permissionPath = `${action}::${name} [grantTo ${permissionId}]`;
-  const registeredActions = readActionDefinitions(actions, permissionPath);
-  for (const [method, definition] of Object.entries(registeredActions)) {
-    if (definition.enabled !== true) {
-      throw pkitError("INVALID_DEFINITION", `${permissionPath}.${method}: a grant does not allow enabled: false`);
+};
+function segmentsOf(path) {
+  const segments = [];
+  let segment = "";
+  let index = 0;
+  while (index < path.length) {
+    const character = path[index];
+    if (character === "\\") {
+      segment += path[index + 1] ?? "";
+      index += 2;
+      continue;
     }
-    if (definition.properties === ALL_FIELDS) {
-      throw pkitError("INVALID_DEFINITION", `${permissionPath}.${method}: a grant requires an explicit properties list`);
+    if (character === ".") {
+      segments.push(segment);
+      segment = "";
+      index += 1;
+      continue;
     }
+    segment += character;
+    index += 1;
   }
-  return { source, actions: registeredActions };
-}
-function validateHook(hook, registration, state) {
-  const { action, name, role, method } = registration;
-  validateOpenRegistry(state);
-  if (role !== undefined && role !== GLOBAL_HOOK_OWNER)
-    validateRole(role, state.roles, "ROLE_NOT_DECLARED");
-  const permissionPath = name === undefined ? action : `${action}::${name}`;
-  validateMethod(method, { code: "INVALID_DEFINITION", message: permissionPath });
-  if (typeof hook !== "function")
-    throw pkitError("INVALID_DEFINITION", `${permissionPath}: hook("${method}") expects a function`);
+  segments.push(segment);
+  return segments;
 }
-function declaresMethod(nameEntry, method) {
-  for (const actions of nameEntry.actions.values()) {
-    if (Object.hasOwn(actions, method))
+function isAllowedPath(segments, patterns) {
+  for (const pattern of patterns) {
+    if (pattern.length !== segments.length)
+      continue;
+    let isMatch = true;
+    for (let index = 0;index < segments.length; index += 1) {
+      const patternSegment = pattern[index];
+      if (patternSegment === constants_default.ALL_FIELDS)
+        continue;
+      if (patternSegment === segments[index])
+        continue;
+      isMatch = false;
+      break;
+    }
+    if (isMatch)
       return true;
   }
   return false;
 }
-function hasAccessPath(nameEntry, role, method) {
-  if (nameEntry.actions.get(role)?.[method])
-    return true;
-  for (const grant of nameEntry.grants.values()) {
-    if (grant.source.role === role && grant.actions[method])
-      return true;
-  }
-  return false;
+function isPlainObject(value) {
+  if (value === null || typeof value !== "object" || Array.isArray(value))
+    return false;
+  const prototype = Object.getPrototypeOf(value);
+  return prototype === Object.prototype || prototype === null;
 }
-function validateGrantReferences(permissionPath, nameEntry, modules) {
-  for (const [permissionId, grant] of nameEntry.grants) {
-    const sourceEntry = modules.get(grant.source.action)?.names.get(grant.source.name);
-    if (!sourceEntry?.actions.has(grant.source.role)) {
-      throw pkitError("INVALID_DEFINITION", `"${permissionPath}": grantTo "${permissionId}" references a permission with no registered actions`);
-    }
-    for (const method of Object.keys(grant.actions)) {
-      if (declaresMethod(nameEntry, method))
+function requireDepth(walk) {
+  if (walk.ancestors.size < MAX_DEPTH)
+    return;
+  throw new RangeError(`data is nested deeper than ${MAX_DEPTH} levels`);
+}
+function setField(target, key, value) {
+  if (key === "__proto__") {
+    Object.defineProperty(target, key, { value, writable: true, enumerable: true, configurable: true });
+    return;
+  }
+  target[key] = value;
+}
+function cropValue(value, walk) {
+  if (Array.isArray(value)) {
+    if (value.length === 0)
+      return isAllowedPath(walk.segments, walk.patterns) ? [] : PRUNED;
+    if (walk.ancestors.has(value))
+      throw new RangeError("data contains a circular reference");
+    requireDepth(walk);
+    walk.ancestors.add(value);
+    const items = [];
+    for (const item of value) {
+      const croppedItem = cropValue(item, walk);
+      if (croppedItem === PRUNED)
         continue;
-      throw pkitError("INVALID_DEFINITION", `"${permissionPath}": grantTo "${permissionId}" grants "${method}", which no role declares on that permission`);
+      items.push(croppedItem);
     }
+    walk.ancestors.delete(value);
+    return items.length === 0 ? PRUNED : items;
   }
-}
-function validateRoleHooks(permissionPath, nameEntry) {
-  for (const [hookRole, methodHooks] of nameEntry.hooks) {
-    if (hookRole === GLOBAL_HOOK_OWNER)
-      continue;
-    for (const method of methodHooks.keys()) {
-      if (hasAccessPath(nameEntry, hookRole, method))
+  if (isPlainObject(value)) {
+    const container = value;
+    const keys = Object.keys(container);
+    if (keys.length === 0)
+      return isAllowedPath(walk.segments, walk.patterns) ? {} : PRUNED;
+    if (walk.ancestors.has(container))
+      throw new RangeError("data contains a circular reference");
+    requireDepth(walk);
+    walk.ancestors.add(container);
+    const cropped = {};
+    let keptCount = 0;
+    for (const key of keys) {
+      walk.segments.push(key);
+      const croppedValue = cropValue(container[key], walk);
+      walk.segments.pop();
+      if (croppedValue === PRUNED)
         continue;
-      throw pkitError("INVALID_DEFINITION", `"${permissionPath}": hook for "${hookRole}" on "${method}" has no registered actions or grant for that role`);
+      setField(cropped, key, croppedValue);
+      keptCount += 1;
     }
+    walk.ancestors.delete(container);
+    return keptCount === 0 ? PRUNED : cropped;
+  }
+  return isAllowedPath(walk.segments, walk.patterns) ? value : PRUNED;
+}
+function cropData(data, walk) {
+  const cropped = {};
+  for (const key of Object.keys(data)) {
+    walk.segments.push(key);
+    const croppedValue = cropValue(data[key], walk);
+    walk.segments.pop();
+    if (croppedValue === PRUNED)
+      continue;
+    setField(cropped, key, croppedValue);
   }
+  return cropped;
 }
-function validateSealedRegistry(modules) {
-  for (const [action, registeredModule] of modules) {
-    if (registeredModule.names.size === 0) {
-      throw pkitError("INVALID_DEFINITION", `"${action}" has hooks but no name with registered actions`);
-    }
-    for (const [name, nameEntry] of registeredModule.names) {
-      const permissionPath = `${action}::${name}`;
-      if (nameEntry.actions.size === 0) {
-        throw pkitError("INVALID_DEFINITION", `"${permissionPath}" has no registered actions for any role`);
-      }
-      validateGrantReferences(permissionPath, nameEntry, modules);
-      validateRoleHooks(permissionPath, nameEntry);
+function collectForbiddenPaths(value, walk, forbidden) {
+  if (Array.isArray(value)) {
+    if (value.length === 0 || walk.ancestors.has(value)) {
+      reportPath(walk, forbidden);
+      return;
     }
+    requireDepth(walk);
+    walk.ancestors.add(value);
+    for (const item of value)
+      collectForbiddenPaths(item, walk, forbidden);
+    walk.ancestors.delete(value);
+    return;
   }
-}
-function validateAssignments(permissions, role, assignable) {
-  validateStrings(permissions, { code: "INVALID_INPUT", message: "permissions must be an array of strings", minimumLength: 1 });
-  const assigned = new Set;
-  for (const permissionId of permissions) {
-    const reference = parsePermissionId(permissionId, {
-      code: "INVALID_INPUT",
-      message: `invalid permission identifier: "${permissionId}" (format role::module::name)`
-    });
-    if (reference.role !== role) {
-      throw pkitError("PERMISSION_ROLE_MISMATCH", `"${permissionId}" belongs to role "${reference.role}", not the authenticated role "${role}"`);
+  if (isPlainObject(value)) {
+    const container = value;
+    const keys = Object.keys(container);
+    if (keys.length === 0 || walk.ancestors.has(container)) {
+      reportPath(walk, forbidden);
+      return;
     }
-    if (!assignable.has(permissionId)) {
-      throw pkitError("UNKNOWN_PERMISSION", `"${permissionId}" is not an assignable permission`);
+    requireDepth(walk);
+    walk.ancestors.add(container);
+    for (const key of keys) {
+      walk.segments.push(key);
+      collectForbiddenPaths(container[key], walk, forbidden);
+      walk.segments.pop();
     }
-    assigned.add(permissionId);
-  }
-  return assigned;
-}
-function validateIdentity(assignments, state) {
-  validateSnapshot(state.snapshot);
-  const { role, permissions } = assignments;
-  if (typeof role !== "string")
-    throw pkitError("INVALID_INPUT", "role is required");
-  validateRole(role, state.roles, "UNKNOWN_ROLE");
-  return { role, assigned: validateAssignments(permissions, role, state.snapshot.assignable) };
-}
-function trimSelection(select, properties) {
-  validateStrings(select, { code: "INVALID_INPUT", message: "select must be an array of strings", minimumLength: 0 });
-  const selectedFields = [];
-  for (const field of select) {
-    if (properties.includes(field))
-      selectedFields.push(field);
+    walk.ancestors.delete(container);
+    return;
   }
-  return selectedFields;
+  reportPath(walk, forbidden);
 }
-function rejectForbiddenFields(data, properties, permissionPath) {
-  const forbiddenFields = [];
-  for (const field of Object.keys(data)) {
-    if (!properties.includes(field))
-      forbiddenFields.push(field);
+function reportPath(walk, forbidden) {
+  if (isAllowedPath(walk.segments, walk.patterns))
+    return;
+  forbidden.add(walk.segments.join("."));
+}
+function rejectForbiddenPaths(data, walk) {
+  const forbidden = new Set;
+  for (const key of Object.keys(data)) {
+    walk.segments.push(key);
+    collectForbiddenPaths(data[key], walk, forbidden);
+    walk.segments.pop();
   }
-  if (forbiddenFields.length === 0)
+  if (forbidden.size === 0)
     return;
-  throw Object.assign(pkitError("PROPERTIES_NOT_ALLOWED", `fields not allowed in "${permissionPath}": ${forbiddenFields.join(", ")}`), { fields: forbiddenFields });
+  const fields = [...forbidden];
+  const error = errors_default.create("PROPERTIES_NOT_ALLOWED", `fields not allowed: ${fields.join(", ")}`);
+  throw Object.assign(error, { fields });
 }
-function validateRequest(input, state) {
-  validateSnapshot(state.snapshot);
-  const { action, name, method } = input;
-  validateMethod(method, { code: "INVALID_INPUT", message: "method is required" });
-  if (method !== "find" && Object.hasOwn(input, "select"))
-    throw pkitError("INVALID_INPUT", "select only applies to find");
-  if (typeof action !== "string" || typeof name !== "string")
-    throw pkitError("INVALID_INPUT", "action and name are required");
-  const { role, assigned } = validateIdentity(input, state);
-  const registeredModule = state.modules.get(action);
-  if (!registeredModule)
-    throw pkitError("UNKNOWN_ACTION", `module "${action}" is not registered`);
-  const nameEntry = registeredModule.names.get(name);
-  if (!nameEntry)
-    throw pkitError("UNKNOWN_PERMISSION", `permission "${action}::${name}" is not registered`);
-  const permissionId = permissionIdOf(role, action, name);
-  const access = resolveAccess(nameEntry, permissionId, role, method, assigned);
-  if (access.status === "unassigned") {
-    throw pkitError("PERMISSION_NOT_ASSIGNED", `"${permissionId}" is not assigned or granted by the user permissions`);
-  }
-  if (access.status === "disabled")
-    throw pkitError("METHOD_DISABLED", `"${permissionId}.${method}" is not enabled`);
-  const { data, context } = input;
-  if (context !== undefined)
-    validateObject(context, { code: "INVALID_INPUT", message: "context must be an object" });
-  const { properties, authorization } = access;
-  const permission = Object.freeze({ role, action, name, permissionId, method, enabled: true, properties, authorization });
-  const request = { registeredModule, nameEntry, permission, data, context };
-  if (method === "find") {
-    if (data !== undefined)
-      validateObject(data, { code: "INVALID_INPUT", message: "data must be an object" });
-    const { select } = input;
-    if (select === undefined)
-      return { ...request, result: properties };
-    if (properties === ALL_FIELDS) {
-      validateStrings(select, { code: "INVALID_INPUT", message: "select must be an array of strings", minimumLength: 0 });
-      return { ...request, result: select };
+var properties_default = properties;
+
+// src/state.ts
+var STATE_KEY = Symbol.for("endpoint-permissions-kit");
+var state = {
+  getOrCreate() {
+    const stateHost = globalThis;
+    if (stateHost[STATE_KEY] === undefined) {
+      stateHost[STATE_KEY] = {
+        roles: new Set([constants_default.GENERAL_ROLE]),
+        cropper: false,
+        reservedFields: [],
+        modules: new Map,
+        snapshot: null
+      };
+    }
+    return stateHost[STATE_KEY];
+  },
+  requireOpen(currentState) {
+    if (currentState.snapshot)
+      throw errors_default.create("SEALED", "pkit.seal() was already called: no more registrations allowed");
+  },
+  requireSnapshot(currentState) {
+    if (currentState.snapshot === null) {
+      throw errors_default.create("NOT_SEALED", "pkit.seal() has not been called: call it after importing every permission file");
     }
-    return { ...request, result: trimSelection(select, properties) };
+    return currentState.snapshot;
   }
-  validateObject(data, { code: "INVALID_INPUT", message: "data must be an object" });
-  if (properties !== ALL_FIELDS)
-    rejectForbiddenFields(data, properties, `${permissionId}.${method}`);
-  return { ...request, result: data };
-}
+};
+var state_default = state;
 
 // src/context.ts
-function setRoles(key, roles) {
-  validateContextKey(key);
-  const state = getOrCreateState();
-  validateRoleCatalog(roles, state);
-  state.roles = new Set(roles);
-}
-function getRoles(key) {
-  validateContextKey(key);
-  return [...getOrCreateState().roles];
+var context = Object.freeze({
+  set(key, value) {
+    const contextKey = checkKey(key);
+    const currentState = state_default.getOrCreate();
+    state_default.requireOpen(currentState);
+    if (contextKey === "cropper") {
+      if (typeof value !== "boolean")
+        throw errors_default.create("INVALID_DEFINITION", "cropper must be a boolean");
+      currentState.cropper = value;
+      return;
+    }
+    if (contextKey === "reservedFields") {
+      currentState.reservedFields = Object.freeze(readReservedFields(value));
+      return;
+    }
+    currentState.roles = new Set(readRoleCatalog(value, currentState.modules.size));
+  },
+  get(key) {
+    const contextKey = checkKey(key);
+    const currentState = state_default.getOrCreate();
+    if (contextKey === "cropper")
+      return currentState.cropper;
+    const paths = contextKey === "roles" ? [...currentState.roles] : [...currentState.reservedFields];
+    return paths;
+  }
+});
+function checkKey(key) {
+  if (key === "roles" || key === "cropper" || key === "reservedFields")
+    return key;
+  throw errors_default.create("INVALID_DEFINITION", `unknown context key: "${errors_default.describe(key)}"`);
+}
+function readRoleCatalog(value, registeredModuleCount) {
+  if (registeredModuleCount > 0) {
+    throw errors_default.create("INVALID_DEFINITION", "roles must be declared before registering permissions: import pkit.config.js first");
+  }
+  if (!Array.isArray(value))
+    throw errors_default.create("INVALID_DEFINITION", "roles must be an array of non-empty strings");
+  for (const role of value) {
+    if (typeof role !== "string" || role.length === 0) {
+      throw errors_default.create("INVALID_DEFINITION", "roles must be an array of non-empty strings");
+    }
+  }
+  const catalog = value;
+  if (catalog.length === 0)
+    throw errors_default.create("INVALID_DEFINITION", "roles must declare at least one role");
+  for (const role of catalog)
+    identifiers_default.checkRole(role);
+  return catalog;
+}
+function readReservedFields(value) {
+  if (!Array.isArray(value))
+    throw errors_default.create("INVALID_DEFINITION", "reservedFields must be an array of property paths");
+  const fields = [];
+  for (const field of value) {
+    if (typeof field !== "string")
+      throw errors_default.create("INVALID_DEFINITION", "reservedFields must be an array of property paths");
+    properties_default.checkDeclaredPath(field, "reservedFields");
+    fields.push(field);
+  }
+  return fields;
 }
-var context = Object.freeze({ set: setRoles, get: getRoles });
+var context_default = context;
 
 // src/cli/protocol.ts
-var EXIT_CODE = { success: 0, failure: 1, usage: 2 };
-var CATALOG_MARKER = "__PKIT_CATALOG__";
-var CHILD_TIMEOUT_MS = 30000;
-var CHILD_MAX_BUFFER_BYTES = 1048576;
+var protocol = {
+  EXIT_CODE: { success: 0, failure: 1, usage: 2 },
+  CATALOG_MARKER: "__PKIT_CATALOG__",
+  CHILD_TIMEOUT_MS: 30000,
+  CHILD_MAX_BUFFER_BYTES: 1048576
+};
+var protocol_default = protocol;
 
 // src/cli/child.ts
 var configPath = process.argv[2];
 if (configPath === undefined) {
   console.error("usage: child <pkit.config.js>");
-  process.exit(EXIT_CODE.usage);
+  process.exit(protocol_default.EXIT_CODE.usage);
 }
 await import(pathToFileURL(resolve(configPath)).href);
 process.stdout.write(`
-${CATALOG_MARKER}${JSON.stringify({ roles: context.get("roles") })}
+${protocol_default.CATALOG_MARKER}${JSON.stringify({ roles: context_default.get("roles") })}
 `);
 
-//# debugId=57FFB67C3BA8C0FD64756E2164756E21
+//# debugId=D66DB9FE1DACA1BA64756E2164756E21