permdock 0.0.0 → 0.1.0

package/dist/map-DowSO96j.js

@@ -0,0 +1,158 @@
+import { t as compact } from "./compact-y6vfu2_f.js";
+import { g as listPermissions, i as findPermission } from "./permissions-DC7GROPA.js";
+//#region src/authzen/map.ts
+const UNKNOWN = {
+	outcome: "denied",
+	denials: [{
+		role: null,
+		reason: "no-grant",
+		detail: "unknown-permission"
+	}],
+	alternatives: []
+};
+const UNAVAILABLE = {
+	outcome: "denied",
+	denials: [{
+		role: null,
+		reason: "no-grant",
+		detail: "resource-unavailable"
+	}],
+	alternatives: []
+};
+function isRecord(value) {
+	return value !== null && typeof value === "object" && !Array.isArray(value);
+}
+function actionNameOf(item) {
+	if (typeof item.action?.name === "string") return item.action.name;
+	if (!isRecord(item.action?.properties)) return;
+	const scope = item.action.properties["scope"];
+	return typeof scope === "string" ? scope : void 0;
+}
+function permissionOf(tree, item) {
+	const actionName = actionNameOf(item);
+	if (actionName === void 0) return;
+	const byKey = findPermission(tree, actionName);
+	if (byKey !== void 0) return byKey;
+	const resource = typeof item.resource?.type === "string" ? item.resource.type : void 0;
+	if (resource === void 0) return;
+	const dotted = findPermission(tree, `${resource}.${actionName}`);
+	if (dotted !== void 0) return dotted;
+	return listPermissions(tree).find((leaf) => leaf.resource === resource && leaf.action === actionName);
+}
+function resourceData(item) {
+	const properties = item.resource?.properties;
+	if (properties !== null && typeof properties === "object") return properties;
+	const id = item.resource?.id;
+	if (typeof id === "string" || typeof id === "number") return { id: String(id) };
+}
+function resourceIdOf(item) {
+	const id = item.resource?.id;
+	if (typeof id === "string" || typeof id === "number") return String(id);
+}
+function userFromEntity(entity) {
+	if (entity === void 0) return null;
+	const result = {};
+	if (typeof entity.id === "string" || typeof entity.id === "number") result["id"] = String(entity.id);
+	if (isRecord(entity.properties)) for (const [key, value] of Object.entries(entity.properties)) {
+		if (key === "actor" || key === "delegation") continue;
+		result[key] = value;
+	}
+	return Object.keys(result).length === 0 ? null : result;
+}
+function actorOf(item) {
+	const context = isRecord(item.context) ? item.context : {};
+	const fromSubject = isRecord(item.subject?.properties) ? item.subject.properties["actor"] : void 0;
+	const raw = context["actor"] ?? fromSubject;
+	if (!isRecord(raw) || typeof raw["id"] !== "string") return;
+	const kind = typeof raw["kind"] === "string" ? raw["kind"] : "oauth-client";
+	return {
+		id: raw["id"],
+		kind
+	};
+}
+function delegationOf(item) {
+	const context = isRecord(item.context) ? item.context : {};
+	const fromSubject = isRecord(item.subject?.properties) ? item.subject.properties["delegation"] : void 0;
+	const raw = context["delegation"] ?? fromSubject;
+	if (!isRecord(raw)) return;
+	const scopes = raw["scopes"];
+	const authorizationDetails = raw["authorizationDetails"];
+	return compact({
+		scopes: Array.isArray(scopes) ? scopes.filter((scope) => typeof scope === "string") : void 0,
+		authorizationDetails: Array.isArray(authorizationDetails) ? authorizationDetails : void 0
+	});
+}
+function tenantOf(item) {
+	if (!isRecord(item.context) || typeof item.context["tenant"] !== "string") return;
+	return item.context["tenant"];
+}
+function permdockContext(decision) {
+	switch (decision.outcome) {
+		case "granted": return { outcome: "granted" };
+		case "denied": {
+			const unknown = decision.denials.some((denial) => denial.detail === "unknown-permission");
+			return compact({
+				outcome: "denied",
+				denials: decision.denials.map((denial) => ({
+					role: denial.role,
+					reason: denial.reason
+				})),
+				reason: unknown ? "unknown-permission" : void 0
+			});
+		}
+		case "approval-required": return {
+			outcome: "approval-required",
+			token: decision.token
+		};
+		default: return decision;
+	}
+}
+function evaluationContext(decision) {
+	return { permdock: permdockContext(decision) };
+}
+function evaluationRow(decision) {
+	return {
+		decision: decision.outcome === "granted",
+		context: evaluationContext(decision)
+	};
+}
+function pathnameOf(request) {
+	return new URL(request.url).pathname;
+}
+function endsWithPath(pathname, suffix) {
+	return pathname === suffix || pathname.endsWith(suffix);
+}
+function mergeItem(shared, item) {
+	if (!isRecord(item)) return shared;
+	return compact({
+		subject: isRecord(item["subject"]) ? item["subject"] : shared.subject,
+		action: isRecord(item["action"]) ? item["action"] : shared.action,
+		resource: isRecord(item["resource"]) ? item["resource"] : shared.resource,
+		context: item["context"] ?? shared.context
+	});
+}
+function pageOf(body) {
+	const page = isRecord(body["page"]) ? body["page"] : {};
+	const raw = typeof page["token"] === "string" ? page["token"] : typeof page["next_token"] === "string" ? page["next_token"] : "0";
+	const parsed = Math.trunc(Number(raw));
+	const sizeRaw = page["limit"] ?? page["size"];
+	const size = typeof sizeRaw === "number" && sizeRaw > 0 ? Math.min(sizeRaw, 200) : 50;
+	return {
+		offset: Number.isFinite(parsed) && parsed > 0 ? parsed : 0,
+		size
+	};
+}
+function paged(items, offset, size) {
+	const slice = items.slice(offset, offset + size);
+	const next = offset + slice.length;
+	return {
+		results: slice,
+		page: {
+			next_token: next < items.length ? String(next) : "",
+			count: slice.length,
+			total: items.length
+		}
+	};
+}
+//#endregion
+export { endsWithPath as a, mergeItem as c, pathnameOf as d, permissionOf as f, userFromEntity as g, tenantOf as h, delegationOf as i, pageOf as l, resourceIdOf as m, UNKNOWN as n, evaluationRow as o, resourceData as p, actorOf as r, isRecord as s, UNAVAILABLE as t, paged as u };

package/dist/map-claims-B_6I1Rn-.js

@@ -0,0 +1,360 @@
+import { t as compact } from "./compact-y6vfu2_f.js";
+import { n as freezeDeep } from "./freeze-y1_jQL4v.js";
+import { S as isForbiddenKey, T as readPath } from "./permissions-DC7GROPA.js";
+import { t as ignoreRejection } from "./thenable-okc2xDsj.js";
+import { t as anonymousSubject } from "./subject-C6dLxqHU.js";
+//#region src/jwt/map-claims.ts
+/** OpenID Connect Core section 5.1: profile data the provider owns. */
+const PROFILE_CLAIMS = [
+	"name",
+	"given_name",
+	"family_name",
+	"middle_name",
+	"nickname",
+	"preferred_username",
+	"profile",
+	"picture",
+	"website",
+	"email",
+	"email_verified",
+	"gender",
+	"birthdate",
+	"zoneinfo",
+	"locale",
+	"phone_number",
+	"phone_number_verified",
+	"address",
+	"updated_at"
+];
+const DEFAULT_CLAIMS = {
+	id: "sub",
+	roles: "roles",
+	groups: "groups",
+	entitlements: "entitlements",
+	session: "sid"
+};
+function asStringArray(value) {
+	if (typeof value === "string") return value.length === 0 ? [] : value.split(/[,\s]+/u).filter(Boolean);
+	if (!Array.isArray(value)) return [];
+	const out = [];
+	for (const item of value) {
+		if (typeof item === "string") {
+			out.push(item);
+			continue;
+		}
+		if (item !== null && typeof item === "object" && "value" in item && typeof item.value === "string") out.push(item.value);
+	}
+	return out;
+}
+function kindOf(claims, paths) {
+	const kind = paths?.kind;
+	if (kind === "workload" || kind === "user" || kind === "service") return kind;
+	if (kind !== void 0) {
+		const value = readPath(claims, kind);
+		if (value === "workload" || value === "user" || value === "service") return value;
+	}
+}
+function assuranceOf(claims, paths) {
+	const configured = paths?.assurance;
+	const acrPath = typeof configured === "string" ? configured : configured?.acr ?? "acr";
+	const amrPath = typeof configured === "string" ? "amr" : configured?.amr ?? "amr";
+	const authTimePath = typeof configured === "string" ? "auth_time" : configured?.authTime ?? "auth_time";
+	const verifiedPath = typeof configured === "string" ? "verified_claims" : configured?.verified ?? "verified_claims";
+	const acr = readPath(claims, acrPath);
+	const amr = readPath(claims, amrPath);
+	const authTime = readPath(claims, authTimePath);
+	const assurance = compact({
+		acr: typeof acr === "string" ? acr : void 0,
+		amr: Array.isArray(amr) ? amr.filter((item) => typeof item === "string") : void 0,
+		authTime: typeof authTime === "number" ? authTime : void 0,
+		verified: verifiedClaimsOf(readPath(claims, verifiedPath))
+	});
+	return Object.keys(assurance).length === 0 ? void 0 : assurance;
+}
+function isPlainRecord(value) {
+	return value !== null && typeof value === "object" && !Array.isArray(value);
+}
+function hasForbiddenKey(value, depth = 0) {
+	if (depth > 16) return true;
+	if (Array.isArray(value)) return value.some((item) => hasForbiddenKey(item, depth + 1));
+	if (!isPlainRecord(value)) return false;
+	return Object.keys(value).some((key) => isForbiddenKey(key) || hasForbiddenKey(value[key], depth + 1));
+}
+/**
+* `verified_claims` is one object or an array (OIDC4IDA section 5); an entry
+* without `verification.trust_framework` and a `claims` object is dropped.
+*/
+function verifiedClaimsOf(value) {
+	const verified = (Array.isArray(value) ? value : [value]).filter((entry) => isPlainRecord(entry) && isPlainRecord(entry["verification"]) && typeof entry["verification"]["trust_framework"] === "string" && isPlainRecord(entry["claims"]) && !hasForbiddenKey(entry));
+	return verified.length === 0 ? void 0 : freezeDeep(verified.map((entry) => ({
+		verification: entry.verification,
+		claims: entry.claims
+	})));
+}
+function bindingOf(claims) {
+	const cnf = claims["cnf"];
+	if (cnf === null || typeof cnf !== "object" || Array.isArray(cnf)) return;
+	const record = cnf;
+	const binding = compact({
+		jkt: typeof record["jkt"] === "string" ? record["jkt"] : void 0,
+		"x5t#S256": typeof record["x5t#S256"] === "string" ? record["x5t#S256"] : void 0,
+		jwk: record["jwk"] !== null && typeof record["jwk"] === "object" ? record["jwk"] : void 0,
+		kid: typeof record["kid"] === "string" ? record["kid"] : void 0
+	});
+	return Object.keys(binding).length === 0 ? void 0 : binding;
+}
+/** Group roles hold in the active tenant; the group itself is only the `via`. */
+function membershipsFromGroups(groups, groupRoles, tenant) {
+	if (tenant === void 0) return [];
+	return groups.map((group) => compact({
+		tenant,
+		roles: groupRoles?.[group] ?? [],
+		via: `group:${group}`
+	}));
+}
+function stringRecord(value) {
+	if (value === null || typeof value !== "object" || Array.isArray(value)) return;
+	const out = {};
+	for (const [key, item] of Object.entries(value)) if (typeof item === "string") out[key] = item;
+	return out;
+}
+function claimExtras(record) {
+	return compact({
+		via: typeof record["via"] === "string" ? record["via"] : void 0,
+		expiresAt: typeof record["expiresAt"] === "number" ? record["expiresAt"] : void 0
+	});
+}
+function membershipsFromClaim(value) {
+	if (Array.isArray(value)) return value.flatMap((item) => membershipsFromClaim(item));
+	if (value === null || typeof value !== "object") return [];
+	const record = value;
+	if (typeof record["scope"] === "string" && typeof record["id"] === "string") return [compact({
+		scope: record["scope"],
+		id: record["id"],
+		within: stringRecord(record["within"]),
+		roles: asStringArray(record["roles"]),
+		...claimExtras(record)
+	})];
+	if (typeof record["tenant"] === "string" || typeof record["org_id"] === "string") return [compact({
+		tenant: typeof record["tenant"] === "string" ? record["tenant"] : String(record["org_id"]),
+		roles: asStringArray(record["roles"]),
+		team: typeof record["team"] === "string" ? record["team"] : void 0,
+		...claimExtras(record)
+	})];
+	const out = [];
+	const byOrganisation = /* @__PURE__ */ new Map();
+	for (const [tenant, entry] of Object.entries(record)) {
+		if (Array.isArray(entry)) {
+			out.push(compact({
+				tenant,
+				roles: asStringArray(entry)
+			}));
+			continue;
+		}
+		if (entry !== null && typeof entry === "object") {
+			const nested = entry;
+			if (isRoleToOrganisations(nested)) {
+				for (const organisation of Object.keys(nested)) {
+					const roles = byOrganisation.get(organisation) ?? [];
+					roles.push(tenant);
+					byOrganisation.set(organisation, roles);
+				}
+				continue;
+			}
+			out.push(compact({
+				tenant,
+				roles: asStringArray(nested["roles"] ?? nested)
+			}));
+		}
+	}
+	for (const [tenant, roles] of byOrganisation) out.push({
+		tenant,
+		roles
+	});
+	return out;
+}
+/** Zitadel's `role -> { orgId: orgDomain }` form: string values and no `roles` key. */
+function isRoleToOrganisations(value) {
+	const entries = Object.entries(value);
+	return entries.length > 0 && !("roles" in value) && entries.every(([key, item]) => typeof item === "string" && !isForbiddenKey(key));
+}
+function isActObject(value) {
+	return value !== null && typeof value === "object" && !Array.isArray(value);
+}
+function actorFromAct(claims, options) {
+	const configured = options.actor;
+	if (typeof configured === "function") {
+		const actor = configured(claims);
+		return actor === void 0 ? { status: "absent" } : {
+			status: "ok",
+			actor,
+			chain: claims["act"]
+		};
+	}
+	if (!Object.hasOwn(claims, "act") || claims["act"] === void 0) return { status: "absent" };
+	const act = claims["act"];
+	if (!isActObject(act)) return { status: "invalid" };
+	let current = act;
+	while (current !== void 0) {
+		if (!isActObject(current) || typeof current.sub !== "string" || current.sub.length === 0) return { status: "invalid" };
+		current = Object.hasOwn(current, "act") ? current.act : void 0;
+	}
+	if (typeof act.sub !== "string") return { status: "invalid" };
+	return {
+		status: "ok",
+		actor: compact({
+			id: act.sub,
+			kind: configured?.kind ?? "oauth-client"
+		}),
+		chain: act
+	};
+}
+function delegationOf(claims, options, chain) {
+	const paths = options.delegation;
+	const scopes = asStringArray(readPath(claims, paths?.scopes ?? "scope"));
+	const details = readPath(claims, paths?.authorizationDetails ?? "authorization_details");
+	const access = readPath(claims, paths?.access ?? "access");
+	const authorizationDetails = Array.isArray(details) ? details : void 0;
+	const accessList = Array.isArray(access) ? access : void 0;
+	const delegation = compact({
+		scopes: scopes.length > 0 ? scopes : void 0,
+		authorizationDetails,
+		access: accessList,
+		chain
+	});
+	return Object.keys(delegation).length === 0 ? void 0 : delegation;
+}
+function customClaims(claims, reserved) {
+	const out = {};
+	for (const [key, value] of Object.entries(claims)) {
+		if (reserved.includes(key)) continue;
+		out[key] = value;
+	}
+	return out;
+}
+function validateCustomClaims(claims, schema) {
+	const result = schema["~standard"].validate(claims);
+	if (result instanceof Promise) {
+		ignoreRejection(result);
+		return { ok: false };
+	}
+	if ("issues" in result && result.issues !== void 0) return { ok: false };
+	return {
+		ok: true,
+		value: result.value
+	};
+}
+function mapClaimsToSubject(claims, options) {
+	const paths = options.claims;
+	const idPath = paths?.id ?? DEFAULT_CLAIMS.id;
+	const id = readPath(claims, idPath);
+	if (typeof id !== "string" || id.length === 0) return {
+		subject: anonymousSubject(),
+		invalidClaims: false,
+		invalidChain: false
+	};
+	const tenantPath = paths?.tenant;
+	const tenant = tenantPath === void 0 ? void 0 : readPath(claims, tenantPath);
+	const activeTenant = typeof tenant === "string" ? tenant : void 0;
+	const roles = asStringArray(readPath(claims, paths?.roles ?? DEFAULT_CLAIMS.roles));
+	const plans = asStringArray(readPath(claims, paths?.plans ?? paths?.entitlements ?? DEFAULT_CLAIMS.entitlements));
+	const groups = asStringArray(readPath(claims, paths?.groups ?? DEFAULT_CLAIMS.groups));
+	const memberships = [...membershipsFromClaim(paths?.memberships === void 0 ? void 0 : readPath(claims, paths.memberships)), ...membershipsFromGroups(groups, options.groupRoles, activeTenant)];
+	let extra = customClaims(claims, [
+		"iss",
+		"sub",
+		"aud",
+		"exp",
+		"nbf",
+		"iat",
+		"jti",
+		"client_id",
+		"scope",
+		"cnf",
+		"act",
+		"sid",
+		"acr",
+		"amr",
+		"auth_time",
+		"roles",
+		"groups",
+		"entitlements",
+		"authorization_details",
+		"access",
+		"nonce",
+		"azp",
+		...PROFILE_CLAIMS
+	]);
+	let invalidClaims = false;
+	if (options.schema !== void 0) {
+		const validated = validateCustomClaims(extra, options.schema);
+		if (validated.ok) extra = validated.value;
+		else {
+			extra = {};
+			invalidClaims = true;
+		}
+	}
+	const binding = bindingOf(claims);
+	const act = actorFromAct(claims, options);
+	if (act.status === "invalid") return {
+		subject: anonymousSubject(),
+		invalidClaims: false,
+		invalidChain: true
+	};
+	const principal = freezeDeep(compact({
+		id,
+		issuer: typeof claims.iss === "string" ? claims.iss : void 0,
+		kind: kindOf(claims, paths),
+		roles: roles.length > 0 ? roles : void 0,
+		plans: plans.length > 0 ? plans : void 0,
+		memberships: memberships.length > 0 ? memberships : void 0,
+		tenant: activeTenant,
+		assurance: assuranceOf(claims, paths),
+		binding: act.status === "absent" ? binding : void 0,
+		claims: Object.keys(extra).length === 0 ? void 0 : extra
+	}));
+	const actor = act.status === "absent" ? void 0 : freezeDeep(compact({
+		...act.actor,
+		binding
+	}));
+	const sessionPath = paths?.session ?? DEFAULT_CLAIMS.session;
+	const sessionValue = readPath(claims, sessionPath);
+	const sessionExpiry = claims["session_expiry"];
+	const exp = typeof claims.exp === "number" ? claims.exp : void 0;
+	const expiresAt = typeof sessionExpiry === "number" && exp !== void 0 ? Math.min(exp, sessionExpiry) : exp;
+	return {
+		subject: freezeDeep(compact({
+			principal,
+			actor,
+			delegation: options.accept === "id-token" ? void 0 : delegationOf(claims, options, act.status === "ok" ? act.chain : void 0),
+			context: {},
+			session: typeof sessionValue === "string" ? sessionValue : void 0,
+			expiresAt
+		})),
+		invalidClaims,
+		invalidChain: false
+	};
+}
+function acceptMismatch(claims, headerTyp, options, audience) {
+	const accept = options.accept ?? "access-token";
+	const typ = headerTyp?.toLowerCase();
+	if (accept === "id-token") {
+		if (typ !== void 0 && typ !== "jwt" && typ !== "application/jwt") return true;
+		if (typeof claims.iat !== "number") return true;
+		const aud = claims.aud;
+		const audiences = Array.isArray(aud) ? aud : aud === void 0 ? [] : [aud];
+		const clients = audience === void 0 ? [] : typeof audience === "string" ? [audience] : audience;
+		const azp = claims["azp"];
+		if (azp === void 0) return audiences.length > 1;
+		return typeof azp !== "string" || !clients.includes(azp);
+	}
+	if (options.profile === "fapi2" && typ !== "at+jwt") return true;
+	if (typeof claims["nonce"] === "string") return true;
+	if (audience !== void 0 && typeof claims.aud === "string") {
+		const expected = typeof audience === "string" ? audience : audience[0];
+		if (claims.aud !== expected && typ !== "at+jwt") return true;
+	}
+	return false;
+}
+//#endregion
+export { mapClaimsToSubject as n, validateCustomClaims as r, acceptMismatch as t };

package/dist/map-error-RJ3ZsUyA.js

@@ -0,0 +1,16 @@
+import { i as PermDockValidationError, n as PermDockDeniedError, r as PermDockRevokedError, t as PermDockApprovalRequiredError } from "./errors-Iy71s7Oj.js";
+import { o as problemResponse } from "./problem-Cgp9-KZA.js";
+import { r as InvalidSignatureError } from "./evaluations-DsAU9ppl.js";
+//#region src/server/map-error.ts
+/**
+* Turns a thrown PermDock error into its Problem Details response. Returns
+* `undefined` for anything else so the framework's own error path takes over.
+*/
+function problemFromError(error) {
+	if (error instanceof InvalidSignatureError) return error.response;
+	if (error instanceof PermDockDeniedError || error instanceof PermDockApprovalRequiredError) return problemResponse(error.toProblemDetails(), void 0, error.decision);
+	if (error instanceof PermDockRevokedError) return problemResponse(error.toProblemDetails(), void 0, error.decision);
+	if (error instanceof PermDockValidationError) return problemResponse(error.toProblemDetails());
+}
+//#endregion
+export { problemFromError as t };

package/dist/markers-B0hYLvMD.js

@@ -0,0 +1,60 @@
+//#region src/cli/markers.ts
+const HOOK_MARKER = "-- permdock:hook v1";
+/** The first line of a `--grants-out` file. */
+const GRANTS_MARKER = "-- permdock:grants v1";
+/** The first line of the `seeds` part: the `role_permissions` rows, a versioned migration. */
+const SEEDS_MARKER = "-- permdock:seeds v1";
+/** The first line of the `indexes` part: the indexes the policies and helpers read through. */
+const INDEXES_MARKER = "-- permdock:indexes v1";
+const HOOK_LINE = /^-- permdock:hook v(?<version>[1-9]\d*)(?: (?<rest>.*))?$/u;
+const GRANTS_LINE = /^-- permdock:grants v(?<version>[1-9]\d*)(?: (?<rest>.*))?$/u;
+function firstLine(sql) {
+	return (sql.split("\n", 1)[0] ?? "").replace(/\r$/u, "");
+}
+/** The `key=value` pairs after the marker, in a prototype-less object. */
+function pairs(rest) {
+	const fields = Object.create(null);
+	for (const pair of (rest ?? "").split(" ")) {
+		const eq = pair.indexOf("=");
+		if (eq > 0) fields[pair.slice(0, eq)] = pair.slice(eq + 1);
+	}
+	return fields;
+}
+/** The fields of a hook marker line, or undefined when `sql` does not start with one. */
+function hookMarkerFields(sql) {
+	const line = firstLine(sql);
+	return line.startsWith(`-- permdock:hook v1 `) ? pairs(line.slice(20)) : void 0;
+}
+/**
+* Reads the `-- permdock:hook v<N>` line that starts a generated hook
+* migration. Undefined when the first line is not a hook marker.
+*/
+function parseHookMarker(sql) {
+	const match = HOOK_LINE.exec(firstLine(sql));
+	if (match?.groups === void 0) return;
+	const fields = pairs(match.groups["rest"]);
+	const budget = Number(fields["budget"]);
+	const claims = fields["claims"];
+	return Object.freeze({
+		version: Number(match.groups["version"]),
+		...fields["schema"] === void 0 ? {} : { schema: fields["schema"] },
+		...fields["tenant"] === void 0 ? {} : { tenantClaim: fields["tenant"] },
+		...Number.isSafeInteger(budget) && budget > 0 ? { budget } : {},
+		claims: Object.freeze(claims === void 0 || claims === "" ? [] : claims.split(",").filter((name) => name !== ""))
+	});
+}
+/**
+* Reads the `-- permdock:grants v<N>` line that starts a `--grants-out`
+* migration. Undefined when the first line is not a grants marker.
+*/
+function parseGrantsMarker(sql) {
+	const match = GRANTS_LINE.exec(firstLine(sql));
+	if (match?.groups === void 0) return;
+	const fields = pairs(match.groups["rest"]);
+	return Object.freeze({
+		version: Number(match.groups["version"]),
+		...fields["schema"] === void 0 ? {} : { schema: fields["schema"] }
+	});
+}
+//#endregion
+export { hookMarkerFields as a, SEEDS_MARKER as i, HOOK_MARKER as n, parseGrantsMarker as o, INDEXES_MARKER as r, parseHookMarker as s, GRANTS_MARKER as t };

package/dist/may-use-CnFEjVEp.js

@@ -0,0 +1,37 @@
+import { f as tenantOf, u as scopeList } from "./scopes-cKVp_WTw.js";
+import { u as coveredByDelegation } from "./snapshot-DE8dE_hz.js";
+//#region src/core/may-use.ts
+function delegationMayCover(permission, delegation, hasActor) {
+	return [void 0, ...[...delegation?.access ?? [], ...delegation?.authorizationDetails ?? []].flatMap((entry) => typeof entry === "object" && entry !== null && typeof entry["identifier"] === "string" ? [entry["identifier"]] : [])].some((id) => coveredByDelegation(permission, delegation, id, hasActor) === void 0);
+}
+function blocksEveryRow(grant) {
+	return grant.effect === "deny" && grant.where === void 0 && grant.check === void 0 && grant.portable !== false && grant.fields === void 0 && (grant.scope === void 0 || grant.scope === "tenant");
+}
+/**
+* Whether `permission` could be granted to this instance's subject for some
+* row: the grants its snapshot carries for the active tenant, minus an
+* unconditional deny, within its delegation. A listing hint for tools and
+* skills, never a decision; the call itself is decided in full.
+*/
+function mayUse(permdock, permission) {
+	try {
+		const snapshot = permdock.snapshot();
+		if (!("grants" in snapshot)) return false;
+		const ceiling = snapshot.delegated;
+		if (ceiling !== void 0 && !ceiling.includes(permission.key)) return false;
+		if (!delegationMayCover(permission, permdock.subject.delegation, permdock.subject.actor !== void 0 && ceiling === void 0)) return false;
+		const tenant = permdock.subject.principal?.tenant;
+		const scopes = scopeList(snapshot.scopes);
+		const grants = snapshot.grants.filter((grant) => {
+			if (grant.permission !== permission.key) return false;
+			const owner = grant.membership === void 0 ? void 0 : tenantOf(grant.membership, scopes);
+			return owner === void 0 || owner === tenant;
+		});
+		if (grants.some(blocksEveryRow)) return false;
+		return grants.some((grant) => grant.effect === "allow");
+	} catch {
+		return false;
+	}
+}
+//#endregion
+export { mayUse as t };