permdock 0.0.0 → 0.1.0

package/dist/generate-CH7ThJ14.js

@@ -0,0 +1,173 @@
+import { t as byCodePoint } from "./compare-pfyVnBjE.js";
+//#region src/cli/generate.ts
+const IDENTIFIER = /^[A-Za-z_$][A-Za-z0-9_$]*$/u;
+const MAX_DEPTH = 6;
+function isSchemaKind(value) {
+	return value === "zod" || value === "valibot" || value === "arktype";
+}
+function schemaImport(kind) {
+	switch (kind) {
+		case "zod": return "import { z } from 'zod'";
+		case "valibot": return "import * as v from 'valibot'";
+		case "arktype": return "import { type } from 'arktype'";
+		default: return kind;
+	}
+}
+function emptySchema(kind) {
+	return schemaExpression(kind, { type: "object" });
+}
+function propertyKey(name) {
+	return IDENTIFIER.test(name) ? name : JSON.stringify(name);
+}
+function isRecord(value) {
+	return value !== null && typeof value === "object" && !Array.isArray(value);
+}
+function literalEnum(schema) {
+	const values = schema["enum"];
+	if (!Array.isArray(values) || values.length === 0 || !values.every((value) => typeof value === "string")) return;
+	return values;
+}
+function schemaType(schema) {
+	const type = schema["type"];
+	if (typeof type === "string") return type;
+	if (Array.isArray(type)) {
+		const named = type.filter((item) => item !== "null");
+		return named.length === 1 && typeof named[0] === "string" ? named[0] : void 0;
+	}
+	return isRecord(schema["properties"]) ? "object" : void 0;
+}
+function zodOf(schema, resolve, depth) {
+	const node = resolve(schema);
+	const values = literalEnum(node);
+	if (values !== void 0) return `z.enum(${JSON.stringify(values)})`;
+	const type = depth > MAX_DEPTH ? void 0 : schemaType(node);
+	if (type === void 0) return "z.unknown()";
+	switch (type) {
+		case "string": return "z.string()";
+		case "number": return "z.number()";
+		case "integer": return "z.number().int()";
+		case "boolean": return "z.boolean()";
+		case "array": return `z.array(${isRecord(node["items"]) ? zodOf(node["items"], resolve, depth + 1) : "z.unknown()"})`;
+		case "object": {
+			const required = new Set(Array.isArray(node["required"]) ? node["required"] : []);
+			const properties = isRecord(node["properties"]) ? node["properties"] : {};
+			const fields = Object.entries(properties).filter((entry) => isRecord(entry[1])).map(([name, child]) => {
+				const expression = zodOf(child, resolve, depth + 1);
+				return `${propertyKey(name)}: ${required.has(name) ? expression : `${expression}.optional()`}`;
+			});
+			return `z.object({${fields.length === 0 ? "" : ` ${fields.join(", ")} `}})`;
+		}
+		default: return "z.unknown()";
+	}
+}
+function valibotOf(schema, resolve, depth) {
+	const node = resolve(schema);
+	const values = literalEnum(node);
+	if (values !== void 0) return `v.picklist(${JSON.stringify(values)})`;
+	const type = depth > MAX_DEPTH ? void 0 : schemaType(node);
+	if (type === void 0) return "v.unknown()";
+	switch (type) {
+		case "string": return "v.string()";
+		case "number": return "v.number()";
+		case "integer": return "v.pipe(v.number(), v.integer())";
+		case "boolean": return "v.boolean()";
+		case "array": return `v.array(${isRecord(node["items"]) ? valibotOf(node["items"], resolve, depth + 1) : "v.unknown()"})`;
+		case "object": {
+			const required = new Set(Array.isArray(node["required"]) ? node["required"] : []);
+			const properties = isRecord(node["properties"]) ? node["properties"] : {};
+			const fields = Object.entries(properties).filter((entry) => isRecord(entry[1])).map(([name, child]) => {
+				const expression = valibotOf(child, resolve, depth + 1);
+				return `${propertyKey(name)}: ${required.has(name) ? expression : `v.optional(${expression})`}`;
+			});
+			return `v.object({${fields.length === 0 ? "" : ` ${fields.join(", ")} `}})`;
+		}
+		default: return "v.unknown()";
+	}
+}
+/** An arktype definition: a string keyword or an object literal. */
+function arktypeOf(schema, resolve, depth) {
+	const node = resolve(schema);
+	const values = literalEnum(node);
+	if (values !== void 0) return JSON.stringify(values.map((value) => `'${value.replaceAll("'", "\\'")}'`).join(" | "));
+	const type = depth > MAX_DEPTH ? void 0 : schemaType(node);
+	if (type === void 0) return "'unknown'";
+	switch (type) {
+		case "string": return "'string'";
+		case "number": return "'number'";
+		case "integer": return "'number.integer'";
+		case "boolean": return "'boolean'";
+		case "array": {
+			if (!isRecord(node["items"])) return "'unknown[]'";
+			const item = arktypeOf(node["items"], resolve, depth + 1);
+			return item.startsWith("'") && !item.includes("|") ? `'${item.slice(1, -1)}[]'` : `[${item}, '[]']`;
+		}
+		case "object": {
+			const required = new Set(Array.isArray(node["required"]) ? node["required"] : []);
+			const properties = isRecord(node["properties"]) ? node["properties"] : {};
+			const fields = Object.entries(properties).filter((entry) => isRecord(entry[1])).map(([name, child]) => `${JSON.stringify(required.has(name) ? name : `${name}?`)}: ${arktypeOf(child, resolve, depth + 1)}`);
+			return `{${fields.length === 0 ? "" : ` ${fields.join(", ")} `}}`;
+		}
+		default: return "'unknown'";
+	}
+}
+/**
+* A validator expression for a JSON Schema object. Only the portable core
+* (primitives, enums of strings, arrays, objects with `required`) is
+* translated; anything else becomes the validator's `unknown`.
+*/
+function schemaExpression(kind, schema, resolve = (node) => node) {
+	switch (kind) {
+		case "zod": return zodOf(schema, resolve, 0);
+		case "valibot": return valibotOf(schema, resolve, 0);
+		case "arktype": return `type(${arktypeOf(schema, resolve, 0)})`;
+		default: return kind;
+	}
+}
+function renderList(value, indent) {
+	if (Array.isArray(value)) return JSON.stringify(value);
+	return JSON.stringify(value, null, 2).replaceAll("\n", `\n${indent}`);
+}
+function renderResource(resource, indent) {
+	const inner = `${indent}  `;
+	const options = [
+		`${inner}id: '${(resource.id ?? "id").replaceAll("\\", "\\\\").replaceAll("'", "\\'")}',`,
+		`${inner}actions: ${renderList(resource.actions, inner)},`,
+		`${inner}collection: ${renderList(resource.collection, inner)},`
+	].join("\n");
+	return `${resource.schema === void 0 ? "resource({" : `resource(${resource.schema}, {`}\n${options}\n${indent}})`;
+}
+function insert(trie, resource) {
+	let node = trie;
+	for (const [index, segment] of resource.path.entries()) {
+		if (index === resource.path.length - 1) {
+			node.set(segment, resource);
+			return;
+		}
+		const next = node.get(segment);
+		if (next instanceof Map) node = next;
+		else {
+			const created = /* @__PURE__ */ new Map();
+			node.set(segment, created);
+			node = created;
+		}
+	}
+}
+function renderTrie(trie, indent) {
+	return [...trie.entries()].toSorted(([a], [b]) => byCodePoint(a, b)).map(([segment, value]) => value instanceof Map ? `${indent}${propertyKey(segment)}: {\n${renderTrie(value, `${indent}  `)}\n${indent}},` : `${indent}${propertyKey(segment)}: ${renderResource(value, indent)},`).join("\n");
+}
+/** A deterministic `definePermissions()` module with a `// @generated` header. */
+function emitPermissionsModule(input) {
+	const trie = /* @__PURE__ */ new Map();
+	for (const resource of input.resources) insert(trie, resource);
+	const imports = ["import { definePermissions, resource } from 'permdock'", ...input.schema === void 0 ? [] : [schemaImport(input.schema)]];
+	const extras = Object.entries(input.exports ?? {}).map(([name, value]) => `export const ${name} = ${JSON.stringify(value, null, 2)} as const\n\n`);
+	return `// @generated by permdock ${input.generator}
+${imports.join("\n")}
+
+${extras.join("")}export const permissions = definePermissions({
+${renderTrie(trie, "  ")}
+})
+`;
+}
+//#endregion
+export { schemaExpression as i, emptySchema as n, isSchemaKind as r, emitPermissionsModule as t };

package/dist/grantee-Bv04_Vzf.js

@@ -0,0 +1,521 @@
+import { r as sole, t as compact } from "./compact-y6vfu2_f.js";
+import { n as freezeDeep } from "./freeze-y1_jQL4v.js";
+import { S as isForbiddenKey, d as isFieldRelation, g as listPermissions, h as isSelfParented, l as isComputedRelation, p as isPrincipalRelation, r as expandRelation, u as isEdgeRelation, w as ownKeys, x as assertSafeKey } from "./permissions-DC7GROPA.js";
+import { a as resolveScope, s as rootScope, t as activeFor, u as scopeList } from "./scopes-cKVp_WTw.js";
+//#region src/core/vocabulary.ts
+const ROLE_KIND = "role";
+const PLAN_KIND = "plan";
+function makeRole(key, init) {
+	assertSafeKey(key, "role");
+	const on = init.on;
+	const leaf = {
+		key,
+		assignable: init.assignable ?? on !== void 0,
+		meta: freezeDeep({ ...init.meta })
+	};
+	if (on !== void 0) Object.assign(leaf, { on });
+	Object.defineProperty(leaf, "kind", {
+		value: ROLE_KIND,
+		enumerable: false,
+		writable: false,
+		configurable: false
+	});
+	return Object.freeze(leaf);
+}
+function makePlan(key, init) {
+	assertSafeKey(key, "plan");
+	const leaf = {
+		key,
+		meta: freezeDeep({ ...init.meta })
+	};
+	Object.defineProperty(leaf, "kind", {
+		value: PLAN_KIND,
+		enumerable: false,
+		writable: false,
+		configurable: false
+	});
+	return Object.freeze(leaf);
+}
+function isRole(value) {
+	return value !== null && typeof value === "object" && "key" in value && typeof value.key === "string" && value.kind === "role";
+}
+function isPlan(value) {
+	return value !== null && typeof value === "object" && "key" in value && typeof value.key === "string" && value.kind === "plan";
+}
+function defineRoles(input) {
+	const tree = {};
+	for (const key of Object.keys(input)) {
+		if (isForbiddenKey(key)) throw new Error(`PermDock: forbidden role key '${key}'`);
+		tree[key] = makeRole(key, input[key] ?? {});
+	}
+	return freezeDeep(tree);
+}
+function definePlans(input) {
+	const tree = {};
+	for (const key of Object.keys(input)) {
+		if (isForbiddenKey(key)) throw new Error(`PermDock: forbidden plan key '${key}'`);
+		tree[key] = makePlan(key, input[key] ?? {});
+	}
+	return freezeDeep(tree);
+}
+function listRoles(tree) {
+	if (tree === void 0) return [];
+	return ownKeys(tree).flatMap((key) => {
+		const leaf = tree[key];
+		return leaf === void 0 ? [] : [leaf];
+	});
+}
+function listPlans(tree) {
+	if (tree === void 0) return [];
+	return ownKeys(tree).flatMap((key) => {
+		const leaf = tree[key];
+		return leaf === void 0 ? [] : [leaf];
+	});
+}
+function findRole(tree, key) {
+	if (tree === void 0 || isForbiddenKey(key)) return;
+	return tree[key];
+}
+function synthesiseRole(key, options) {
+	const on = options?.on;
+	const assignable = options?.assignable ?? false;
+	const meta = options?.meta;
+	if (on === void 0) return makeRole(key, meta === void 0 ? { assignable } : {
+		assignable,
+		meta
+	});
+	return makeRole(key, meta === void 0 ? {
+		on,
+		assignable
+	} : {
+		on,
+		assignable,
+		meta
+	});
+}
+//#endregion
+//#region src/core/grantee.ts
+const DEFAULT_RELATION_DEPTH = 16;
+function isGrantee(value) {
+	return value !== null && typeof value === "object" && "kind" in value && typeof value.kind === "string";
+}
+function anyone() {
+	return freezeDeep({ kind: "anyone" });
+}
+function authenticated() {
+	return freezeDeep({ kind: "authenticated" });
+}
+function relation(resource, name, options) {
+	const resourceName = listPermissions(resource)[0]?.resource;
+	if (resourceName === void 0) throw new Error("PermDock: relation() requires a resource tree");
+	const through = options?.through;
+	if (Array.isArray(through)) {
+		if (through.length === 0) throw new Error("PermDock: relation() through needs at least one link");
+		for (const link of through) if (typeof link !== "string" || link === "" || link === "parent") throw new Error("PermDock: relation() through lists link names; walk parents with through: 'parent' or depth");
+	} else if (through !== void 0 && through !== "parent") throw new Error(`PermDock: relation() through must be 'parent' or a list of link names (got '${String(through)}')`);
+	const depth = options?.depth;
+	if (depth !== void 0) {
+		if (through === void 0) throw new Error("PermDock: relation() depth needs through: 'parent' or a link list");
+		const hops = Array.isArray(through) ? through.length : 0;
+		if (!Number.isInteger(depth) || depth < 0 || depth + hops > 32) throw new Error(`PermDock: relation() depth must be an integer from 0 to 32, counting each link`);
+	}
+	return freezeDeep(compact({
+		kind: "relation",
+		resource: resourceName,
+		relation: name,
+		through: through === void 0 || through === "parent" ? through : [...through],
+		depth
+	}));
+}
+function plan(name) {
+	return freezeDeep({
+		kind: "plan",
+		plan: typeof name === "string" ? name : name.key
+	});
+}
+function actor(kind) {
+	return freezeDeep({
+		kind: "actor",
+		actor: kind
+	});
+}
+function assurance(options) {
+	const acr = options.acr === void 0 ? void 0 : typeof options.acr === "string" ? [options.acr] : options.acr;
+	const amr = options.amr === void 0 ? void 0 : typeof options.amr === "string" ? [options.amr] : options.amr;
+	return freezeDeep(compact({
+		kind: "assurance",
+		acr,
+		amr,
+		maxAge: options.maxAge
+	}));
+}
+function resolveRoleScope(on) {
+	return typeof on === "string" ? on : "global";
+}
+function asGrantee(input) {
+	if (Array.isArray(input)) {
+		const items = [];
+		for (const item of input) items.push(...flattenGrantee(asGrantee(item)));
+		return items;
+	}
+	if (typeof input === "string") return freezeDeep({
+		kind: "role",
+		role: input,
+		scope: "global"
+	});
+	if (isRole(input)) return freezeDeep({
+		kind: "role",
+		role: input.key,
+		scope: resolveRoleScope(input.on)
+	});
+	if (isPlan(input)) return freezeDeep({
+		kind: "plan",
+		plan: input.key
+	});
+	if (isGrantee(input)) return input;
+	throw new Error("PermDock: invalid grantee");
+}
+function flattenGrantee(input) {
+	if (input === void 0) return [];
+	if (Array.isArray(input)) return input;
+	return [input];
+}
+function roleNameOf(to) {
+	for (const item of flattenGrantee(to)) if (item.kind === "role") return item.role;
+	return null;
+}
+function roleScopeOf(to, fallback = "global") {
+	for (const item of flattenGrantee(to)) if (item.kind === "role") return item.scope;
+	return fallback;
+}
+/**
+* Where a graph relation starts on the row: its own id when the relation is
+* on the row's resource, the parent field when it is on the parent resource.
+* `undefined` when `through` cannot reach the relation's resource.
+*/
+function relationStart(grantee, resource, target) {
+	if (resource === void 0 || target === void 0 || Array.isArray(grantee.through)) return;
+	const walks = grantee.through === "parent" && isSelfParented(target);
+	const requested = grantee.depth ?? DEFAULT_RELATION_DEPTH;
+	const depth = walks ? Number.isInteger(requested) ? Math.min(Math.max(requested, 0), 32) : 0 : 0;
+	if (target.name === resource.name) return {
+		field: resource.id,
+		parent: false,
+		depth
+	};
+	if (grantee.through === "parent" && resource.parent?.resource === target.name) return {
+		field: resource.parent.field,
+		parent: true,
+		depth
+	};
+}
+/**
+* A resource role held on self-parented `membershipResource` instances
+* (`ids`) reaches rows below them: the row itself when it is of that
+* resource, its parent field when its parent is, walked up to the default
+* depth. `undefined` when the row is not on such a chain.
+*/
+function resourceRoleCondition(resource, membershipResource, ids, resources) {
+	if (resource === void 0 || !isSelfParented(resources.get(membershipResource))) return;
+	const start = resource.name === membershipResource ? {
+		field: resource.id,
+		parent: false
+	} : resource.parent?.resource === membershipResource ? {
+		field: resource.parent.field,
+		parent: true
+	} : void 0;
+	if (start === void 0) return;
+	return compact({
+		op: "related",
+		resource: membershipResource,
+		relation: "",
+		ids: [...new Set(ids)].toSorted(),
+		field: start.field,
+		depth: DEFAULT_RELATION_DEPTH,
+		parent: start.parent ? true : void 0,
+		restricted: resource.restricted
+	});
+}
+/**
+* The link path from the row to the grantee's resource: the row field of
+* the first link and each hop. `undefined` when a link is not declared or
+* the path ends on another resource.
+*/
+function relationHops(grantee, resource, resources) {
+	const through = grantee.through;
+	if (!Array.isArray(through) || resource === void 0) return;
+	const hops = [];
+	let current = resource;
+	let field;
+	for (const link of through) {
+		const spec = current !== void 0 && Object.hasOwn(current.links, link) ? current.links[link] : void 0;
+		if (spec === void 0) return;
+		field ??= spec.field;
+		hops.push({
+			link,
+			resource: spec.resource
+		});
+		current = resources?.get(spec.resource);
+	}
+	if (field === void 0 || current === void 0 || current.name !== grantee.resource) return;
+	const depth = grantee.depth ?? 0;
+	if (depth > 0 && !isSelfParented(current)) return;
+	return {
+		field,
+		hops,
+		depth
+	};
+}
+/**
+* Whether the grantee needs the relation graph: a `through` walk, an edge
+* table, or an `includes` that reaches one.
+*/
+function isGraphRelation(grantee, resources) {
+	if (grantee.through !== void 0) return true;
+	const node = resources?.get(grantee.resource);
+	return expandRelation(node, grantee.relation).some((name) => isEdgeRelation(node?.relations[name]));
+}
+function periodConditions(spec, now) {
+	const out = [];
+	const startsAt = spec.period?.startsAt;
+	if (startsAt !== void 0) out.push({
+		op: "or",
+		conditions: [{
+			op: "isNull",
+			field: startsAt,
+			value: true
+		}, {
+			op: "lte",
+			field: startsAt,
+			value: now
+		}]
+	});
+	const expiresAt = spec.period?.expiresAt;
+	if (expiresAt !== void 0) out.push({
+		op: "or",
+		conditions: [{
+			op: "isNull",
+			field: expiresAt,
+			value: true
+		}, {
+			op: "gt",
+			field: expiresAt,
+			value: now
+		}]
+	});
+	return out;
+}
+function relationCondition(grantee, resource, scopes = scopeList(void 0), options = {}) {
+	const target = grantee.resource === resource?.name ? resource : options.resources?.get(grantee.resource);
+	if (isGraphRelation(grantee, options.resources ?? targetMap(target))) {
+		const spec = target?.relations[grantee.relation];
+		if (spec === void 0 || isFieldRelation(spec) && spec.memberOf !== void 0) return;
+		if (Array.isArray(grantee.through)) {
+			const path = relationHops(grantee, resource, options.resources);
+			if (path === void 0 || target === void 0) return;
+			return compact({
+				op: "related",
+				resource: target.name,
+				relation: grantee.relation,
+				field: path.field,
+				depth: path.depth,
+				hops: path.hops,
+				restricted: resource?.restricted
+			});
+		}
+		const start = relationStart(grantee, resource, target);
+		if (start === void 0 || target === void 0) return;
+		return compact({
+			op: "related",
+			resource: target.name,
+			relation: grantee.relation,
+			field: start.field,
+			depth: start.depth,
+			parent: start.parent ? true : void 0,
+			restricted: start.parent || start.depth > 0 ? resource?.restricted : void 0
+		});
+	}
+	const spec = resource?.relations?.[grantee.relation];
+	if (spec === void 0 || isEdgeRelation(spec)) return;
+	if (spec.includes !== void 0 && options.includes !== false) {
+		const parts = expandRelation(resource, grantee.relation).flatMap((name) => {
+			const part = relationCondition({
+				...grantee,
+				relation: name
+			}, resource, scopes, {
+				...options,
+				includes: false
+			});
+			return part === void 0 ? [] : [part];
+		});
+		return sole(parts) ?? {
+			op: "or",
+			conditions: parts
+		};
+	}
+	if (isComputedRelation(spec)) return;
+	if (isPrincipalRelation(spec)) {
+		const owner = {
+			op: "eq",
+			field: spec.principal,
+			value: { ref: "principal.id" }
+		};
+		const period = periodConditions(spec, options.now ?? { date: (/* @__PURE__ */ new Date()).toISOString() });
+		return period.length === 0 ? owner : {
+			op: "and",
+			conditions: [owner, ...period]
+		};
+	}
+	if (spec.memberOf !== void 0) {
+		const scope = resolveScope(scopes, spec.memberOf);
+		if (scope === void 0) return {
+			op: "or",
+			conditions: []
+		};
+		if (scope === rootScope(scopes)) return {
+			op: "eq",
+			field: spec.field,
+			value: { ref: "principal.tenant" }
+		};
+		return {
+			op: "memberOf",
+			scope,
+			field: spec.field,
+			roles: []
+		};
+	}
+	return {
+		op: "eq",
+		field: spec.field,
+		value: { ref: "principal.id" }
+	};
+}
+function targetMap(target) {
+	return target === void 0 ? void 0 : /* @__PURE__ */ new Map([[target.name, target]]);
+}
+function combineWhere(left, right) {
+	if (left === void 0) return right;
+	if (right === void 0) return left;
+	return {
+		op: "and",
+		conditions: [left, right]
+	};
+}
+/** Seats (`Membership.entitlements`) held through memberships that apply under the active tenant. */
+function seatsInTenant(subject, scopes) {
+	const principal = subject.principal;
+	if (principal === null) return [];
+	const list = scopeList(scopes);
+	return (principal.memberships ?? []).flatMap((membership) => membership.entitlements !== void 0 && activeFor(membership, list, principal.tenant) ? membership.entitlements : []);
+}
+function matchOne(grantee, subject, now, resource, scopes, resources) {
+	switch (grantee.kind) {
+		case "anyone": return { matched: true };
+		case "authenticated": return subject.principal === null ? {
+			matched: false,
+			reason: "anonymous"
+		} : { matched: true };
+		case "plan":
+			if (subject.principal === null) return {
+				matched: false,
+				reason: "anonymous"
+			};
+			return (subject.principal.plans ?? []).includes(grantee.plan) || seatsInTenant(subject, scopes).includes(grantee.plan) ? { matched: true } : {
+				matched: false,
+				reason: "not-entitled"
+			};
+		case "actor":
+			if (subject.actor === void 0) return {
+				matched: false,
+				reason: "no-grant"
+			};
+			return subject.actor.kind === grantee.actor ? { matched: true } : {
+				matched: false,
+				reason: "no-grant"
+			};
+		case "assurance": {
+			if (subject.principal === null) return {
+				matched: false,
+				reason: "anonymous"
+			};
+			const principalAssurance = subject.principal.assurance;
+			if (grantee.acr !== void 0 && grantee.acr.length > 0) {
+				const acr = principalAssurance?.acr;
+				if (acr === void 0 || !grantee.acr.includes(acr)) return {
+					matched: false,
+					reason: "insufficient-user-authentication"
+				};
+			}
+			if (grantee.amr !== void 0 && grantee.amr.length > 0) {
+				const amr = principalAssurance?.amr ?? [];
+				if (!grantee.amr.every((method) => amr.includes(method))) return {
+					matched: false,
+					reason: "insufficient-user-authentication"
+				};
+			}
+			if (grantee.maxAge !== void 0) {
+				const authTime = principalAssurance?.authTime;
+				if (authTime === void 0 || now - authTime > grantee.maxAge) return {
+					matched: false,
+					reason: "insufficient-user-authentication"
+				};
+			}
+			return { matched: true };
+		}
+		case "relation": {
+			if (subject.principal === null) return {
+				matched: false,
+				reason: "anonymous"
+			};
+			const where = relationCondition(grantee, resource, scopes, {
+				resources,
+				now: { date: (/* @__PURE__ */ new Date(now * 1e3)).toISOString() }
+			});
+			if (where === void 0 && resource !== void 0) return {
+				matched: false,
+				reason: "condition"
+			};
+			return compact({
+				matched: true,
+				where
+			});
+		}
+		case "role":
+			if (subject.principal === null) return {
+				matched: false,
+				reason: "anonymous"
+			};
+			return { matched: true };
+		default: return unknownGrantee(grantee);
+	}
+}
+/** A kind this build does not know, from a forged snapshot or a newer document, never matches. */
+function unknownGrantee(_grantee) {
+	return {
+		matched: false,
+		reason: "no-grant",
+		unknown: true
+	};
+}
+function matchGrantee(to, subject, now, resource, scopes, resources, unknownMatches = false) {
+	const items = flattenGrantee(to);
+	if (items.length === 0) return {
+		matched: false,
+		reason: "no-grant"
+	};
+	let where;
+	for (const item of items) {
+		const result = matchOne(item, subject, now, resource, scopes, resources);
+		if (!result.matched) {
+			if (unknownMatches && result.unknown === true) continue;
+			return result;
+		}
+		where = combineWhere(where, result.where);
+	}
+	return compact({
+		matched: true,
+		where
+	});
+}
+//#endregion
+export { listPlans as C, isRole as S, synthesiseRole as T, roleScopeOf as _, authenticated as a, findRole as b, isGraphRelation as c, relation as d, relationCondition as f, roleNameOf as g, resourceRoleCondition as h, assurance as i, matchGrantee as l, relationStart as m, anyone as n, combineWhere as o, relationHops as p, asGrantee as r, flattenGrantee as s, actor as t, plan as u, definePlans as v, listRoles as w, isPlan as x, defineRoles as y };

package/dist/headers-B5RRv3Xm.js

@@ -0,0 +1,6 @@
+//#region src/react/headers.ts
+function approvalHeaders(token) {
+	return { "PermDock-Approval": token };
+}
+//#endregion
+export { approvalHeaders as t };