permdock 0.0.0 → 0.1.0

package/dist/permdock-yoZ7EjxX.js

@@ -0,0 +1,2956 @@
+import { n as isReadonlyArray, r as sole, t as compact } from "./compact-y6vfu2_f.js";
+import { n as freezeDeep, t as freezeCopy } from "./freeze-y1_jQL4v.js";
+import { C as ownGet, S as isForbiddenKey, a as formerKeys, c as getResource, d as isFieldRelation, g as listPermissions, i as findPermission, p as isPrincipalRelation, r as expandRelation, u as isEdgeRelation } from "./permissions-DC7GROPA.js";
+import { a as hasConditionOp } from "./refs-ChLSxbST.js";
+import { d as role, h as normalizeWhere, i as declaredRoleNames$1, l as normalizeApproval, n as assertApprovalRelations, p as applyQuota, s as grantList, u as normalizeAssurance } from "./policy-ANp36PnI.js";
+import { a as resolveScope, c as scopeChain, f as tenantOf, i as normalizeMemberships, l as scopeIdOf, o as rootMembershipId, r as findScope, s as rootScope, u as scopeList } from "./scopes-cKVp_WTw.js";
+import { S as isRole, T as synthesiseRole, a as authenticated, b as findRole, f as relationCondition, h as resourceRoleCondition, i as assurance, l as matchGrantee, o as combineWhere, r as asGrantee, s as flattenGrantee, w as listRoles } from "./grantee-Bv04_Vzf.js";
+import { a as approvalMessage, i as PermDockValidationError, n as PermDockDeniedError, o as deniedMessage, s as wireDenials, t as PermDockApprovalRequiredError } from "./errors-Iy71s7Oj.js";
+import { a as whereFromGrants, c as versionOf, d as delegatedPermissions, f as resourceIdOf, g as evaluateCondition, h as simulateArazzo, i as snapshotGrant, l as canonicalJson, m as isArazzoSimulateInput, o as decisionToken, r as signSnapshot, s as payloadDigest, t as buildSnapshot, u as coveredByDelegation } from "./snapshot-DE8dE_hz.js";
+import { t as parseDuration } from "./duration-xK2jGFVc.js";
+import { a as matchScopedMembership, c as partitionsOf, f as tenantsOf, h as sanitizeContext, i as isMembershipExpired, l as relatesTo, m as pickVisible, p as grantCoversField, r as inTeam, s as nowSeconds, t as isActive, u as resolveActiveTenant } from "./validity-D0uRmJKJ.js";
+import { t as requiresApproval } from "./approval-required-TzNB9oQA.js";
+import { r as mergeHostedGrants, t as isPortableCondition } from "./hosted-BwKQ1BTA.js";
+import { n as isThenable, t as ignoreRejection } from "./thenable-okc2xDsj.js";
+import { t as byCodePoint } from "./compare-pfyVnBjE.js";
+import { a as relationWalk, i as relationReader, n as pendingRelations, o as resolveRelated, r as relationId } from "./relations-r4soIFZB.js";
+import { i as isSubject, r as isPrincipal, t as anonymousSubject } from "./subject-C6dLxqHU.js";
+//#region src/core/approval-policies.ts
+function memoryApprovalPolicies(policies) {
+	const entries = [...policies];
+	return Object.freeze({ approvalPoliciesFor(query) {
+		return entries.filter((entry) => entry.tenant === void 0 || query.tenants.includes(entry.tenant));
+	} });
+}
+function isRecord(value) {
+	return value !== null && typeof value === "object" && !Array.isArray(value);
+}
+function isStringList(value) {
+	return Array.isArray(value) && value.every((item) => typeof item === "string");
+}
+/**
+* One raw entry checked against the policy: `null` when it names no
+* permission the policy declares (it applies to nothing), `undefined` when
+* it is invalid.
+*/
+function loadOne(policy, raw) {
+	if (!isRecord(raw) || typeof raw["permission"] !== "string") return;
+	const permission = findPermission(policy.permissions, raw["permission"]);
+	if (permission === void 0) return null;
+	const { tenant, actors, where, check, approval } = raw;
+	if (tenant !== void 0 && typeof tenant !== "string" || actors !== void 0 && !isStringList(actors) || where !== void 0 && !isPortableCondition(where) || check !== void 0 && !isPortableCondition(check) || isRecord(approval) && approval["escalation"] !== void 0 || approval !== "human" && !isRecord(approval)) return;
+	let normalized;
+	try {
+		normalized = normalizeApproval(approval, permission.key);
+		if (normalized !== void 0) assertApprovalRelations([{
+			permission,
+			approval: normalized
+		}], policy.resources);
+	} catch {
+		return;
+	}
+	if (normalized === void 0) return;
+	if (normalized !== "human" && normalized.staleOn !== void 0 && (permission.kind !== "instance" || policy.resources.get(permission.resource)?.version === void 0)) return;
+	return compact({
+		permission: permission.key,
+		tenant,
+		actors: actors === void 0 ? void 0 : new Set(actors),
+		where: where === void 0 ? void 0 : normalizeWhere(where),
+		check: check === void 0 ? void 0 : normalizeWhere(check),
+		approval: normalized
+	});
+}
+function loadAll(policy, raw) {
+	if (!Array.isArray(raw)) return "failed";
+	const out = [];
+	for (const item of raw) {
+		const loaded = loadOne(policy, item);
+		if (loaded === void 0) return "failed";
+		if (loaded !== null) out.push(loaded);
+	}
+	return out;
+}
+/** Reads the source once for `tenants`; a throw or an invalid entry loads as `"failed"`. */
+function approvalPoliciesFor(policy, source, tenants, auth) {
+	if (source === void 0) return;
+	const threw = () => {
+		auth.push({
+			reason: "source-threw",
+			source: "approvalPolicies"
+		});
+		return "failed";
+	};
+	let raw;
+	try {
+		raw = source.approvalPoliciesFor({ tenants });
+	} catch {
+		return threw();
+	}
+	if (isThenable(raw)) return Promise.resolve(raw).then((value) => loadAll(policy, value), threw);
+	return loadAll(policy, raw);
+}
+function matches(entry, tenant, subject, current, next, now, scopes) {
+	if (entry.tenant !== void 0 && entry.tenant !== tenant) return false;
+	if (entry.actors !== void 0 && (subject.actor === void 0 || !entry.actors.has(subject.actor.kind))) return false;
+	if (entry.where !== void 0 && !evaluateCondition(entry.where, current, subject, now, scopes)) return false;
+	return entry.check === void 0 || evaluateCondition(entry.check, next ?? current, subject, now, scopes);
+}
+function asStages(approval) {
+	if (approval === "human") return [{ by: authenticated() }];
+	if (approval.stages !== void 0) return approval.stages;
+	return [compact({
+		by: approval.by ?? authenticated(),
+		quorum: approval.quorum
+	})];
+}
+function shorter(a, b) {
+	if (a === void 0) return b;
+	if (b === void 0) return a;
+	return (parseDuration(b) ?? Infinity) < (parseDuration(a) ?? Infinity) ? b : a;
+}
+/**
+* `code` with every matching entry added as further stages: the result
+* needs all of them (`'sequential'` when any part is ordered), keeps the
+* code's escalation, the shortest `ttl`, and `distinct` unless every part
+* opts out. Without a matching entry, `code` unchanged.
+*/
+function tightenApproval(code, entries, input) {
+	const extra = entries.filter((entry) => entry.permission === input.permission && matches(entry, input.tenant, input.subject, input.current, input.next, input.now, input.scopes));
+	if (extra.length === 0) return code;
+	const parts = [...code === void 0 ? [] : [code], ...extra.map((entry) => entry.approval)];
+	const stages = [];
+	const seen = /* @__PURE__ */ new Set();
+	let sequential = false;
+	let distinct = false;
+	let staleOn;
+	let ttl;
+	for (const part of parts) {
+		for (const stage of asStages(part)) {
+			const key = JSON.stringify(stage);
+			if (!seen.has(key)) {
+				seen.add(key);
+				stages.push(stage);
+			}
+		}
+		if (part === "human") {
+			distinct = true;
+			continue;
+		}
+		sequential ||= part.mode === "sequential";
+		distinct ||= part.distinct !== false;
+		staleOn ??= part.staleOn;
+		ttl = shorter(ttl, part.ttl);
+	}
+	return compact({
+		mode: sequential ? "sequential" : "all",
+		stages,
+		distinct: distinct ? void 0 : false,
+		staleOn,
+		ttl,
+		escalation: code === void 0 || code === "human" ? void 0 : code.escalation
+	});
+}
+/** The tenant a matched allow applies in: its membership's root scope, else the active tenant. */
+function decisionTenant(subject, membership) {
+	return (membership === void 0 ? void 0 : rootMembershipId(membership)) ?? subject.principal?.tenant;
+}
+//#endregion
+//#region src/core/memberships.ts
+/** Two memberships are the same row when everything but `roles` matches. */
+function identity(membership) {
+	const within = Object.entries(membership.within ?? {}).toSorted(([a], [b]) => byCodePoint(a, b));
+	return JSON.stringify([
+		membership.scope ?? null,
+		membership.id ?? null,
+		within,
+		membership.on ?? null,
+		membership.tenant ?? null,
+		membership.team ?? null,
+		membership.via ?? null,
+		membership.expiresAt ?? null,
+		membership.grantedBy ?? null,
+		membership.reason ?? null,
+		membership.member?.group ?? null,
+		[...membership.eligible ?? []].toSorted(),
+		membership.managedBy ?? null,
+		[...membership.entitlements ?? []].toSorted()
+	]);
+}
+/**
+* Merges memberships from several sources: entries naming the same instance
+* with the same `via`, expiry, owner and seats become one entry with the union
+* of their roles. Entries that differ in any of those stay separate, so a
+* staff role and a contact role in one instance keep their own `via`.
+*/
+function mergeMemberships(lists) {
+	const merged = /* @__PURE__ */ new Map();
+	for (const list of lists) for (const membership of list) {
+		const key = identity(membership);
+		const found = merged.get(key);
+		merged.set(key, found === void 0 ? membership : {
+			...found,
+			roles: [.../* @__PURE__ */ new Set([...found.roles, ...membership.roles])]
+		});
+	}
+	return [...merged.values()];
+}
+function all(values) {
+	return values.some((value) => isThenable(value)) ? Promise.all(values) : values;
+}
+function then(value, next) {
+	return isThenable(value) ? Promise.resolve(value).then(next) : next(value);
+}
+/**
+* One `MembershipSource` over several: memberships are merged and
+* de-duplicated, `list` concatenates the sources that can list, and `version`
+* is the highest version any source reports. A source that throws makes the
+* whole lookup throw, which the subject resolver turns into no memberships.
+*/
+function composeMemberships(sources) {
+	const listing = sources.filter((source) => source.list !== void 0);
+	const versioned = sources.filter((source) => source.version !== void 0);
+	return {
+		membershipsFor(principal, options) {
+			return then(all(sources.map((source) => source.membershipsFor(principal, options))), (lists) => mergeMemberships(lists));
+		},
+		...listing.length === 0 ? {} : { list(query) {
+			return then(all(listing.map((source) => source.list?.(query) ?? [])), (lists) => {
+				const seen = /* @__PURE__ */ new Map();
+				for (const entry of lists.flat()) {
+					const key = `${entry.principal.id}\u0000${identity(entry.membership)}`;
+					const found = seen.get(key);
+					seen.set(key, found === void 0 ? entry : {
+						principal: entry.principal,
+						membership: {
+							...found.membership,
+							roles: [.../* @__PURE__ */ new Set([...found.membership.roles, ...entry.membership.roles])]
+						}
+					});
+				}
+				return [...seen.values()];
+			});
+		} },
+		...versioned.length === 0 ? {} : { version(principal) {
+			return then(all(versioned.map((source) => source.version?.(principal))), (versions) => {
+				const known = versions.filter((value) => typeof value === "number" && Number.isFinite(value));
+				return known.length === 0 ? void 0 : Math.max(...known);
+			});
+		} }
+	};
+}
+/** A single source, or several composed. */
+function asMembershipSource(input) {
+	return Array.isArray(input) ? composeMemberships(input) : input;
+}
+/**
+* Trust the memberships the verified token carries, and read `source` only
+* when the token marks them truncated. With `version`, a token minted before
+* the latest membership change is stale for the policy's `fresh` permissions.
+*/
+function claimsFirst(source, options = {}) {
+	const inner = asMembershipSource(source);
+	const version = options.version ?? (inner.version === void 0 ? void 0 : (principal) => inner.version?.(principal));
+	return {
+		membershipsFor: (principal, query) => inner.membershipsFor(principal, query),
+		...inner.list === void 0 ? {} : { list: (query) => inner.list?.(query) ?? [] },
+		...version === void 0 ? {} : { version },
+		claimsFirst: true
+	};
+}
+/** Whether the identity provider owns `membership`: the application must not add, change or remove it. */
+function isExternallyManaged(membership) {
+	return membership.managedBy === "idp";
+}
+//#endregion
+//#region src/core/custom-roles.ts
+/** The current key for a stored key, current or former; `undefined` when neither. */
+function currentKey(policy, raw) {
+	const leaf = findPermission(policy.permissions, raw);
+	if (leaf === void 0) return;
+	return leaf.key === raw || formerKeys(leaf).includes(raw) ? leaf.key : void 0;
+}
+const GRANT_KEYS = /* @__PURE__ */ new Set(["permission", "effect"]);
+/**
+* The scope a custom role is held at: `scope` (a name or alias), the second
+* scope for the `team` input shape, else the first scope. `undefined` when
+* the policy does not declare it; such a role resolves to nothing.
+*/
+function customRoleScope(role, scopes) {
+	if (role.scope === "global") return "global";
+	if (role.scope !== void 0) return resolveScope(scopes, role.scope);
+	return resolveScope(scopes, role.team === void 0 ? "tenant" : "team");
+}
+/** The instance of its scope a custom role is pinned to, if any. */
+function customRoleId(role) {
+	return role.scope === void 0 ? role.team : role.id;
+}
+/** A platform custom role: held through `principal.roles`, capped by the assignable global roles. */
+function isGlobalCustomRole(role) {
+	return role.scope === "global";
+}
+function isCeilingScope(scope) {
+	return typeof scope === "string";
+}
+function soleRole(grant) {
+	const roles = flattenGrantee(grant.to).filter((item) => item.kind === "role");
+	const first = roles[0];
+	return roles.length === 1 && first?.kind === "role" ? first.role : void 0;
+}
+/** Permission keys a declared role's allows reach, hosted grants included. */
+function roleAllowKeys(policy, name) {
+	return new Set(grantList(policy).filter((grant) => grant.effect === "allow" && soleRole(grant) === name).map((grant) => grant.permission.key));
+}
+function isAssignableRole(policy, name) {
+	const binding = policy.rolesByName.get(name);
+	if (binding !== void 0) return binding.assignable;
+	return findRole(policy.vocabulary?.roles, name)?.assignable === true;
+}
+/**
+* Every scope's ceiling, keyed by scope name (`global` for platform custom
+* roles): the code allows of declared `assignable` roles in that scope,
+* everything a custom role of the scope may ever reach. Hosted grants never
+* widen it. `assignable` narrows it to those role names (`RoleSource.assignable`).
+*/
+function ceilings(policy, assignable) {
+	const allowed = assignable === void 0 ? void 0 : new Set(assignable);
+	const byScope = /* @__PURE__ */ new Map();
+	for (const grant of grantList(policy)) {
+		const name = soleRole(grant);
+		if (grant.effect !== "allow" || grant.hosted !== void 0 || !isCeilingScope(grant.scope) || name === void 0 || !isAssignableRole(policy, name) || allowed !== void 0 && !allowed.has(name)) continue;
+		const list = byScope.get(grant.scope) ?? [];
+		list.push(grant);
+		byScope.set(grant.scope, list);
+	}
+	return byScope;
+}
+function ceilingGrants(policy, scope, assignable) {
+	return ceilings(policy, assignable).get(scope) ?? [];
+}
+function retarget(grant, role, scope) {
+	const grantee = {
+		kind: "role",
+		role: role.name,
+		scope
+	};
+	const others = flattenGrantee(grant.to).filter((item) => item.kind !== "role");
+	return freezeDeep({
+		...grant,
+		to: others.length === 0 ? grantee : [grantee, ...others],
+		role: role.name,
+		scope
+	});
+}
+/**
+* The one resolver behind evaluation, snapshots and `validateCustomRole`.
+* Included roles' grants plus the role's own allows, minus its denies, all
+* intersected with the ceiling. An allow inherits the condition, approval and
+* limit of the declared grant it comes from: an included assignable role's
+* grant when there is one, otherwise every ceiling grant of that permission,
+* together with the denies of the roles those grants belong to.
+*/
+function resolveCustomRole(policy, role) {
+	const scope = customRoleScope(role, scopeList(policy.scopes));
+	if (scope === void 0) return freezeDeep({
+		grants: [],
+		dropped: [],
+		renamed: []
+	});
+	const ceiling = ceilingGrants(policy, scope);
+	const ceilingSet = new Set(ceiling);
+	const ceilingKeys = new Set(ceiling.map((grant) => grant.permission.key));
+	const declared = declaredRoleNames$1(policy);
+	const all = grantList(policy).filter((grant) => grant.hosted === void 0);
+	const dropped = [];
+	const renamed = [];
+	const seen = /* @__PURE__ */ new Set();
+	const drop = (entry) => {
+		const id = "role" in entry ? `role:${entry.role}` : `${entry.reason}:${entry.permission}`;
+		if (!seen.has(id)) {
+			seen.add(id);
+			dropped.push(entry);
+		}
+	};
+	const included = [];
+	const includedKeys = /* @__PURE__ */ new Set();
+	const allowKeys = /* @__PURE__ */ new Set();
+	const denyKeys = /* @__PURE__ */ new Set();
+	for (const name of Array.isArray(role.includes) ? role.includes : []) {
+		if (typeof name !== "string" || !declared.has(name)) {
+			drop({
+				role: String(name),
+				reason: "unknown-role"
+			});
+			continue;
+		}
+		for (const grant of all) {
+			if (soleRole(grant) !== name) continue;
+			const key = grant.permission.key;
+			if (grant.effect === "deny") {
+				if (grant.scope === scope) included.push(grant);
+			} else if (ceilingSet.has(grant)) {
+				included.push(grant);
+				includedKeys.add(key);
+			} else if (ceilingKeys.has(key)) allowKeys.add(key);
+			else drop({
+				permission: key,
+				reason: "outside-ceiling"
+			});
+		}
+	}
+	const entries = Array.isArray(role.grants) ? role.grants : [];
+	for (const item of entries) {
+		if (item === null || typeof item !== "object") {
+			drop({
+				permission: String(item),
+				reason: "unknown-permission"
+			});
+			continue;
+		}
+		const entry = item;
+		const raw = entry.permission;
+		const key = typeof raw === "string" ? currentKey(policy, raw) : void 0;
+		if (key === void 0) {
+			drop({
+				permission: String(raw),
+				reason: "unknown-permission"
+			});
+			continue;
+		}
+		if (key !== raw) renamed.push({
+			from: String(raw),
+			to: key
+		});
+		const effect = entry.effect ?? "allow";
+		if (Object.keys(entry).some((name) => !GRANT_KEYS.has(name)) || effect !== "allow" && effect !== "deny") {
+			drop({
+				permission: key,
+				reason: "condition-not-allowed"
+			});
+			denyKeys.add(key);
+			continue;
+		}
+		if (effect === "deny") {
+			denyKeys.add(key);
+			continue;
+		}
+		if (!ceilingKeys.has(key)) {
+			drop({
+				permission: key,
+				reason: "outside-ceiling"
+			});
+			continue;
+		}
+		allowKeys.add(key);
+	}
+	const out = [];
+	const push = (grant) => {
+		if (!out.includes(grant)) out.push(grant);
+	};
+	for (const grant of included) if (grant.effect === "deny" || !denyKeys.has(grant.permission.key)) push(grant);
+	for (const key of allowKeys) {
+		if (denyKeys.has(key) || includedKeys.has(key)) continue;
+		const sources = /* @__PURE__ */ new Set();
+		for (const grant of ceiling) if (grant.permission.key === key) {
+			push(grant);
+			sources.add(soleRole(grant) ?? "");
+		}
+		for (const grant of all) if (grant.effect === "deny" && grant.permission.key === key && sources.has(soleRole(grant) ?? "")) push(grant);
+	}
+	return freezeDeep({
+		grants: out.map((grant) => retarget(grant, role, scope)),
+		dropped,
+		renamed
+	});
+}
+function validateCustomRole(policy, role) {
+	const resolved = resolveCustomRole(policy, role);
+	const permissions = [...new Set(resolved.grants.filter((grant) => grant.effect === "allow").map((grant) => grant.permission.key))].toSorted();
+	return freezeDeep({
+		ok: resolved.dropped.length === 0,
+		permissions,
+		dropped: resolved.dropped,
+		renamed: resolved.renamed
+	});
+}
+function wellFormed(role) {
+	if (role === null || typeof role !== "object" || typeof role.name !== "string") return false;
+	if (role.scope === "global") return role.tenant === void 0 && role.team === void 0 && role.id === void 0;
+	return typeof role.tenant === "string" && (role.team === void 0 || typeof role.team === "string") && (role.scope === void 0 || typeof role.scope === "string") && (role.id === void 0 || typeof role.id === "string");
+}
+/** Every custom role's resolved grants, once per instance. Malformed roles resolve to nothing. */
+function customGrantsFor(policy, roles) {
+	const declared = declaredRoleNames$1(policy);
+	const out = [];
+	for (const role of roles) {
+		if (!wellFormed(role) || declared.has(role.name)) continue;
+		for (const grant of resolveCustomRole(policy, role).grants) out.push({
+			grant,
+			role
+		});
+	}
+	return out;
+}
+/** A membership at the role's scope, inside its tenant (and instance, when pinned), naming it. */
+function holdsCustomRole(membership, role, scopes) {
+	if (isGlobalCustomRole(role)) return false;
+	const scope = customRoleScope(role, scopes);
+	const id = customRoleId(role);
+	return scope !== void 0 && membership.scope === scope && tenantOf(membership, scopes) === role.tenant && (id === void 0 || membership.id === id) && membership.roles.includes(role.name);
+}
+/** Whether `principal.roles` names the platform custom role. */
+function holdsGlobalCustomRole(roles, role) {
+	return isGlobalCustomRole(role) && (roles ?? []).includes(role.name);
+}
+/** A tenant's custom role inside that tenant, or a platform custom role anywhere. */
+function isCustomRoleName(name, roles, tenant) {
+	return roles.some((item) => wellFormed(item) && item.name === name && (isGlobalCustomRole(item) || tenant !== void 0 && item.tenant === tenant));
+}
+/**
+* The compact JWT form of custom roles for the `memberships[].grants` claim
+* RLS reads in `jwt` mode: role name to entries, where `key` allows, `-key`
+* denies and `@role` includes. Put a team custom role on its team membership.
+* Pass `policy` to write keys stored under a former name as the current key.
+*/
+function customRoleClaim(roles, policy) {
+	const keyOf = (raw) => policy === void 0 ? raw : currentKey(policy, raw) ?? raw;
+	const claim = {};
+	for (const role of roles) {
+		if (!wellFormed(role) || isForbiddenKey(role.name)) continue;
+		const entries = claim[role.name] ?? [];
+		const includes = Array.isArray(role.includes) ? role.includes : [];
+		const grants = Array.isArray(role.grants) ? role.grants : [];
+		for (const name of includes) entries.push(`@${name}`);
+		for (const grant of grants) entries.push(grant.effect === "deny" ? `-${keyOf(grant.permission)}` : keyOf(grant.permission));
+		claim[role.name] = entries;
+	}
+	return freezeDeep(claim);
+}
+/**
+* The `memberships` claim RLS reads in `jwt` mode: each membership canonical,
+* with the custom roles it holds as the compact `grants` map.
+*/
+function membershipsClaim(memberships, customRoles, scopes) {
+	const claim = [];
+	for (const membership of normalizeMemberships(memberships, scopes)) {
+		const held = customRoles.filter((role) => wellFormed(role) && holdsCustomRole(membership, role, scopes));
+		claim.push(held.length === 0 ? membership : Object.assign({}, membership, { grants: customRoleClaim(held) }));
+	}
+	return claim;
+}
+//#endregion
+//#region src/core/elevated.ts
+function flattenPermissions(input) {
+	if (input !== null && typeof input === "object" && "key" in input && "action" in input) return [input];
+	if (isReadonlyArray(input)) return input.flatMap((item) => flattenPermissions(item));
+	return [...listPermissions(input)];
+}
+/**
+* The only deny override: a break-glass grant overrides deny grants whose
+* `name` it lists, and nothing else. It is an allow that stays non-portable
+* (RLS never compiles it) and grants only once its `requires` are met.
+*/
+function breakGlass(permission, options = {}) {
+	const purpose = options.requires?.purpose === void 0 || options.requires.purpose.length === 0 ? void 0 : Object.freeze([...new Set(options.requires.purpose)]);
+	const spec = compact({
+		overrides: Object.freeze([...new Set(options.overrides ?? [])]),
+		purpose,
+		reason: options.requires?.reason === true,
+		assurance: normalizeAssurance(options.requires?.assurance),
+		maxDuration: options.maxDuration,
+		obligations: Object.freeze([...new Set(options.obligations ?? [])])
+	});
+	const grants = flattenPermissions(permission).map((leaf) => freezeDeep(compact({
+		permission: leaf,
+		effect: "allow",
+		to: authenticated(),
+		portable: false,
+		breakGlass: spec
+	})));
+	return sole(grants) ?? grants;
+}
+function supportAccess(options) {
+	const via = options.role;
+	const forbidden = (options.forbid ?? []).flatMap((item) => flattenPermissions(item));
+	const binding = role(options.role, [], {
+		on: options.on ?? "tenant",
+		for: [via]
+	});
+	const denies = forbidden.map((leaf) => freezeDeep(compact({
+		permission: leaf,
+		effect: "deny",
+		to: authenticated(),
+		role: options.role,
+		scope: "global",
+		viaOnly: via,
+		portable: false
+	})));
+	const support = freezeDeep(compact({
+		role: options.role,
+		actorRequired: options.actorRequired === true,
+		consent: {
+			by: asGrantee(options.consent.by),
+			durations: Object.freeze([...new Set(options.consent.durations)])
+		},
+		group: options.group ?? "vendor-support"
+	}));
+	return freezeDeep({
+		...binding,
+		grants: [...binding.grants, ...denies],
+		support
+	});
+}
+/** Whether the subject's authentication is fresh enough for an elevated grant. */
+function assuranceMet(requirement, subject, now) {
+	if (requirement === void 0) return true;
+	const held = subject.principal?.assurance;
+	if (requirement.acr !== void 0 && requirement.acr.length > 0) {
+		const acr = held?.acr;
+		if (acr === void 0 || !requirement.acr.includes(acr)) return false;
+	}
+	if (requirement.amr !== void 0 && requirement.amr.length > 0) {
+		const amr = held?.amr ?? [];
+		if (!requirement.amr.every((method) => amr.includes(method))) return false;
+	}
+	if (requirement.maxAge !== void 0) {
+		const authTime = held?.authTime;
+		if (authTime === void 0 || now - authTime > requirement.maxAge) return false;
+	}
+	return true;
+}
+/** `context.purpose` as a list of strings; fail-closed to empty. */
+function purposesOf(subject) {
+	const value = subject.context["purpose"];
+	return Array.isArray(value) ? value.filter((item) => typeof item === "string") : typeof value === "string" && value !== "" ? [value] : [];
+}
+/**
+* Whether a break-glass grant fires for this subject. It engages when the
+* caller asserts a purpose (`context.purpose`); once engaged, an unlisted
+* purpose, a missing reason or stale authentication denies with the matching
+* reason, and everything met grants with the declared obligations.
+*/
+function evaluateBreakGlass(spec, subject, now) {
+	const purposes = purposesOf(subject);
+	if (purposes.length === 0) return { kind: "inactive" };
+	const required = spec.purpose;
+	if (required !== void 0 && !purposes.some((purpose) => required.includes(purpose))) return {
+		kind: "denied",
+		reason: "purpose"
+	};
+	const reason = subject.context["reason"];
+	if (spec.reason && (typeof reason !== "string" || reason === "")) return {
+		kind: "denied",
+		reason: "reason-required"
+	};
+	if (spec.assurance !== void 0 && !assuranceMet(spec.assurance, subject, now)) return {
+		kind: "denied",
+		reason: "insufficient-user-authentication",
+		to: assurance(spec.assurance)
+	};
+	return {
+		kind: "granted",
+		obligations: [...spec.obligations.map((kind) => ({ kind })), ...typeof reason === "string" && reason !== "" ? [{
+			kind: "justify",
+			reason
+		}] : []]
+	};
+}
+/** Support memberships (`via: 'support'`) the subject holds that demand an actor. */
+function actorRequiredVias(supports) {
+	return new Set(supports.filter((spec) => spec.actorRequired).map((spec) => spec.role));
+}
+/** Whether a membership is a support membership of one of the given kinds. */
+function isSupportMembership(membership, vias) {
+	return membership.via !== void 0 && vias.has(membership.via);
+}
+/**
+* Whether the caller's `within` names the same ancestors as the eligible
+* membership. Omitted means "whatever the membership holds"; any entry that
+* disagrees, or names an ancestor the membership lacks, refuses.
+*/
+function withinAgrees(scopes, held, requested) {
+	if (requested === void 0) return true;
+	return Object.entries(requested).every(([key, id]) => {
+		const name = resolveScope(scopes, key) ?? key;
+		return held !== void 0 && Object.hasOwn(held, name) && held[name] === id;
+	});
+}
+function activationDenied(reason, to) {
+	return freezeDeep({
+		outcome: "denied",
+		denials: [to === void 0 ? {
+			role: null,
+			reason
+		} : {
+			role: null,
+			reason,
+			to
+		}],
+		alternatives: []
+	});
+}
+/**
+* Requests a just-in-time role activation. It never writes: a granted
+* decision carries the elevated membership under `elevation` for the app to
+* write. `approval-required` comes back first when the role's `activation`
+* sets `approval`. Fail-closed: an unknown role, an ineligible subject, a
+* missing justification or stale authentication all deny.
+*/
+function activate(policy, subject, input, now = nowSeconds()) {
+	const roleName = isRole(input.role) ? input.role.key : input.role;
+	const binding = policy.rolesByName.get(roleName);
+	const activation = binding?.activation;
+	const principal = subject.principal;
+	if (principal === null) return activationDenied("anonymous");
+	if (binding === void 0 || activation === void 0) return activationDenied("unknown-role");
+	const scopes = scopeList(policy.scopes);
+	const scope = resolveScope(scopes, input.scope) ?? input.scope;
+	const eligible = (principal.memberships ?? []).find((membership) => membership.scope === scope && membership.id === input.id && !isMembershipExpired(membership, now) && (membership.eligible ?? []).includes(roleName) && withinAgrees(scopes, membership.within, input.within));
+	if (eligible === void 0) return activationDenied("no-membership");
+	const within = eligible.within;
+	if (activation.justification === "required") {
+		const reason = input.reason;
+		if (typeof reason !== "string" || reason === "") return activationDenied("reason-required");
+	}
+	if (activation.assurance !== void 0 && !assuranceMet(activation.assurance, subject, now)) return activationDenied("insufficient-user-authentication", assurance(activation.assurance));
+	const requested = parseDuration(input.duration);
+	const cap = parseDuration(activation.maxDuration);
+	const seconds = cap === void 0 ? requested : Math.min(requested ?? cap, cap);
+	const membership = freezeDeep(compact({
+		scope,
+		id: input.id,
+		within,
+		roles: [roleName],
+		via: "elevated",
+		expiresAt: seconds === void 0 ? void 0 : Math.floor(now) + seconds,
+		grantedBy: principal.id,
+		reason: input.reason
+	}));
+	const token = decisionToken({
+		key: `activate:${roleName}`,
+		resourceId: within === void 0 ? `${scope}:${input.id}` : `${scope}:${input.id}@${canonicalJson(within)}`,
+		principal,
+		actor: subject.actor,
+		fingerprint: policy.fingerprint
+	});
+	if (activation.approval !== void 0) return freezeDeep({
+		outcome: "approval-required",
+		grant: {
+			role: roleName,
+			permission: `activate:${roleName}`
+		},
+		reason: "human",
+		token
+	});
+	return freezeDeep({
+		outcome: "granted",
+		subject,
+		matched: {
+			role: roleName,
+			permission: `activate:${roleName}`
+		},
+		token,
+		elevation: membership
+	});
+}
+//#endregion
+//#region src/core/events.ts
+function emitSafe(listeners, payload, errors) {
+	for (const listener of listeners) try {
+		listener(payload);
+	} catch (error) {
+		for (const handler of errors.error) try {
+			handler(error);
+		} catch {}
+	}
+}
+function emptyListeners() {
+	return {
+		decision: /* @__PURE__ */ new Set(),
+		denied: /* @__PURE__ */ new Set(),
+		approval: /* @__PURE__ */ new Set(),
+		auth: /* @__PURE__ */ new Set(),
+		error: /* @__PURE__ */ new Set()
+	};
+}
+function credentialRef(subject) {
+	const value = subject.principal?.["credential"];
+	if (value === null || typeof value !== "object") return;
+	const { id, kind } = value;
+	return typeof id === "string" && (kind === "user" || kind === "service") ? {
+		id,
+		kind
+	} : void 0;
+}
+function finish(policy, subject, permission, data, decision, options, env, trusted, membership, counts) {
+	const heard = env.sink !== void 0 || env.listeners.decision.size > 0 || decision.outcome === "denied" && env.listeners.denied.size > 0 || decision.outcome === "approval-required" && env.listeners.approval.size > 0;
+	if (!env.emit || !heard) return;
+	const resource = getResource(policy.permissions, permission.resource);
+	const resourceId = data !== null && typeof data === "object" ? data[resource?.id ?? "id"] : void 0;
+	const event = freezeDeep(compact({
+		type: "decision",
+		at: (/* @__PURE__ */ new Date()).toISOString(),
+		outcome: decision.outcome,
+		permission: permission.key,
+		scope: permission.scope,
+		resource: compact({
+			type: permission.resource,
+			id: resourceId === void 0 ? void 0 : String(resourceId)
+		}),
+		subject: compact({
+			principal: subject.principal === null ? null : compact({
+				id: subject.principal.id,
+				roles: subject.principal.roles ?? [],
+				tenant: subject.principal.tenant
+			}),
+			actor: subject.actor === void 0 ? void 0 : {
+				id: subject.actor.id,
+				kind: subject.actor.kind
+			},
+			delegation: subject.delegation === void 0 ? void 0 : compact({
+				scopes: subject.delegation.scopes,
+				authorizationDetails: subject.delegation.authorizationDetails
+			}),
+			credential: credentialRef(subject)
+		}),
+		tenant: subject.principal?.tenant,
+		membership,
+		via: membership?.via ?? null,
+		matched: decision.outcome === "granted" ? compact({
+			role: decision.matched.role,
+			permission: decision.matched.permission,
+			to: decision.matched.to,
+			hosted: decision.matched.hosted,
+			breakGlass: decision.matched.breakGlass
+		}) : decision.outcome === "approval-required" ? compact({
+			role: decision.grant.role,
+			permission: decision.grant.permission,
+			to: decision.grant.to,
+			hosted: decision.grant.hosted
+		}) : void 0,
+		purpose: Array.isArray(subject.context["purpose"]) && subject.context["purpose"].length > 0 ? subject.context["purpose"] : void 0,
+		reason: typeof subject.context["reason"] === "string" && subject.context["reason"] !== "" ? subject.context["reason"] : void 0,
+		denials: decision.outcome === "denied" ? wireDenials(decision.denials) : void 0,
+		alternatives: decision.outcome === "denied" ? decision.alternatives.map((leaf) => leaf.key) : void 0,
+		token: decision.outcome === "granted" || decision.outcome === "approval-required" ? decision.token : void 0,
+		trusted,
+		source: options.source ?? "decide",
+		adapter: options.adapter,
+		counts
+	}));
+	emitSafe(env.listeners.decision, event, env.listeners);
+	if (decision.outcome === "denied") emitSafe(env.listeners.denied, event, env.listeners);
+	if (decision.outcome === "approval-required") emitSafe(env.listeners.approval, event, env.listeners);
+	if (env.sink !== void 0) try {
+		const written = env.sink.write([event]);
+		if (isThenable(written)) written.catch((error) => {
+			emitSafe(env.listeners.error, error, env.listeners);
+		});
+	} catch (error) {
+		emitSafe(env.listeners.error, error, env.listeners);
+	}
+}
+//#endregion
+//#region src/core/validation.ts
+function validateBoundary(permission, resource, data, mode, trusted, boundary = "manual") {
+	if (!(mode === "always" || mode === "boundary" && !trusted)) return data;
+	if (resource?.schema === void 0) {
+		if (mode === "always") throw new PermDockValidationError({
+			code: "no-schema",
+			permission: permission.key,
+			resource: permission.resource,
+			boundary,
+			message: `${permission.key}: no schema for resource ${permission.resource}.`
+		});
+		return data;
+	}
+	const result = resource.schema["~standard"].validate(data);
+	if (isThenable(result)) {
+		ignoreRejection(result);
+		throw new PermDockValidationError({
+			code: "async-schema",
+			permission: permission.key,
+			resource: permission.resource,
+			boundary,
+			message: `${permission.key}: schema for ${permission.resource} is async.`
+		});
+	}
+	if ("issues" in result && result.issues !== void 0) throw new PermDockValidationError({
+		code: "invalid-data",
+		permission: permission.key,
+		resource: permission.resource,
+		issues: result.issues,
+		boundary,
+		message: validationMessage(permission, resource, result.issues)
+	});
+	return result.value;
+}
+function validationMessage(permission, resource, issues) {
+	const parts = issues.map((issue) => {
+		const path = issue.path?.map((item) => typeof item === "object" && "key" in item ? String(item.key) : String(item)).join(".") ?? "/";
+		return `invalid ${resource.name} data at ${path}: ${issue.message}`;
+	});
+	return `${permission.key}: ${parts.join("; ")}.`;
+}
+//#endregion
+//#region src/core/evaluate.ts
+/**
+* A collection write proposes `next`; an update pair may move `next` out of
+* the scope `current` is in. Both must stay in scope.
+*/
+function matchWriteScope(match, instance, current, next) {
+	const first = match(instance ? current : next);
+	if (!first.ok || !instance || next === current) return first;
+	const moved = match(next);
+	return moved.ok ? first : moved;
+}
+function isRowPair(value) {
+	return value !== null && typeof value === "object" && "current" in value && "next" in value;
+}
+function isGlobalRole(value) {
+	return value !== null && typeof value === "object" && Reflect.get(value, "scope") === "global";
+}
+function onlyGlobal(roles) {
+	return Array.isArray(roles) ? roles.filter(isGlobalRole) : [];
+}
+function customRolesFor(source, tenants, auth, signedIn = false) {
+	if (source === void 0) return [];
+	const loaded = [];
+	for (const tenant of tenants) try {
+		loaded.push(source.rolesFor(tenant));
+	} catch {
+		auth.push({
+			reason: "source-threw",
+			source: "customRoles"
+		});
+		loaded.push([]);
+	}
+	if (signedIn && source.globalRoles !== void 0) try {
+		const roles = source.globalRoles();
+		loaded.push(isThenable(roles) ? roles.then(onlyGlobal) : onlyGlobal(roles));
+	} catch {
+		auth.push({
+			reason: "source-threw",
+			source: "customRoles"
+		});
+		loaded.push([]);
+	}
+	if (loaded.some((item) => isThenable(item))) return Promise.all(loaded.map((item) => Promise.resolve(item).catch(() => {
+		auth.push({
+			reason: "source-threw",
+			source: "customRoles"
+		});
+		return [];
+	}))).then((lists) => lists.flat());
+	return loaded.flat();
+}
+function stringList(value) {
+	return Array.isArray(value) ? value.filter((item) => typeof item === "string") : [];
+}
+/**
+* `RoleSource.assignable` per tenant; `undefined` when the source has no
+* `assignable`. A tenant whose call throws or answers junk assigns nothing.
+*/
+function assignableNamesFor(source, tenants, auth) {
+	if (source?.assignable === void 0) return;
+	const failed = () => {
+		auth.push({
+			reason: "source-threw",
+			source: "customRoles"
+		});
+		return [];
+	};
+	const loaded = tenants.map((tenant) => {
+		try {
+			return source.assignable?.(tenant) ?? [];
+		} catch {
+			return failed();
+		}
+	});
+	const toMap = (lists) => new Map(tenants.map((tenant, index) => [tenant, stringList(lists[index])]));
+	if (loaded.some((item) => isThenable(item))) return Promise.all(loaded.map((item) => Promise.resolve(item).catch(failed))).then(toMap);
+	return toMap(loaded);
+}
+/**
+* The declared role names among `names`. A custom role of `tenant` is known
+* but contributes no declared name: its grants are resolved separately
+* (`customGrantsFor`), bounded by the ceiling. A tenant's custom role is
+* unknown inside another tenant and for a membership without one.
+*/
+function expandRoleNames(names, declared, custom, tenant) {
+	const resolved = /* @__PURE__ */ new Set();
+	const unknown = [];
+	for (const name of names) if (declared.has(name)) resolved.add(name);
+	else if (!isCustomRoleName(name, custom, tenant)) unknown.push(name);
+	return {
+		roles: [...resolved],
+		unknown
+	};
+}
+function declaredRoleNames(policy) {
+	return policy.index.declaredRoles;
+}
+function alternativesFor(policy, permission, subject, now, env) {
+	return listPermissions(policy.permissions).filter((leaf) => leaf.resource === permission.resource && leaf.key !== permission.key).filter((leaf) => {
+		return evaluate(policy, subject, leaf, void 0, {
+			trusted: true,
+			source: "simulate",
+			now
+		}, {
+			...env,
+			emit: false,
+			skipAlternatives: true
+		}).outcome === "granted";
+	});
+}
+function evaluateGrantCondition(grant, permission, current, next, subject, now, scopes, relations) {
+	let unknown;
+	const onOpaque = () => {
+		unknown ??= "opaque-condition";
+	};
+	const related = (condition, row) => {
+		if (relations === void 0) {
+			unknown ??= "relation-unavailable";
+			return false;
+		}
+		const verdict = resolveRelated(condition, row, subject, now, relations);
+		if (verdict === "relation-depth" || verdict === "relation-unavailable") {
+			unknown ??= verdict;
+			return false;
+		}
+		return verdict;
+	};
+	if (!grant.portable && grant.closure !== void 0) try {
+		const result = grant.closure(next ?? current, {
+			subject,
+			actor: subject.actor,
+			delegation: subject.delegation,
+			context: subject.context
+		});
+		if (isThenable(result)) return {
+			matched: false,
+			reason: "closure-error",
+			cause: result
+		};
+		return { matched: result === true };
+	} catch (error) {
+		return {
+			matched: false,
+			reason: "closure-error",
+			cause: error
+		};
+	}
+	if (grant.where !== void 0) {
+		if (permission.kind === "collection") return {
+			matched: false,
+			reason: "condition"
+		};
+		if (current === void 0) return {
+			matched: false,
+			reason: "condition"
+		};
+		if (grant.where.op === "opaque" || grant.check?.op === "opaque") return {
+			matched: false,
+			reason: "opaque-condition"
+		};
+		const matched = evaluateCondition(grant.where, current, subject, now, scopes, related, onOpaque);
+		if (unknown !== void 0) return {
+			matched: false,
+			reason: unknown
+		};
+		if (!matched) return {
+			matched: false,
+			reason: "condition"
+		};
+	}
+	const checkCondition = grant.check ?? (permission.action === "update" ? grant.where : void 0);
+	if (checkCondition !== void 0) {
+		if (checkCondition.op === "opaque") return {
+			matched: false,
+			reason: "opaque-condition"
+		};
+		if (next === void 0) return {
+			matched: false,
+			reason: "condition"
+		};
+		const matched = evaluateCondition(checkCondition, next, subject, now, scopes, related, onOpaque);
+		if (unknown !== void 0) return {
+			matched: false,
+			reason: unknown
+		};
+		if (!matched) return {
+			matched: false,
+			reason: "condition"
+		};
+	}
+	return { matched: true };
+}
+/** A grant whose condition could not be answered; a deny with one denies. */
+function isUnevaluable(reason) {
+	return reason === "relation-depth" || reason === "relation-unavailable" || reason === "closure-error" || reason === "opaque-condition";
+}
+function shouldConsumeQuota(source, simulated) {
+	if (simulated) return false;
+	switch (source) {
+		case "can":
+		case "filter":
+		case "simulate":
+		case "explain": return false;
+		case "decide":
+		case "assert":
+		case "endpoint":
+		case "adapter":
+		case "approval":
+		case void 0: return true;
+		default: return source;
+	}
+}
+function isDelegatedPermission(policy, permission) {
+	const providers = policy.providers;
+	if (providers === void 0 || providers.length === 0) return false;
+	for (const provider of providers) if (provider.handles(permission)) return true;
+	return false;
+}
+/** The `MatchedGrant` view of a grant, shared by `matched` and the trace. */
+function matchedOf(grant, permissionKey, breakGlass) {
+	return compact({
+		role: grant.role,
+		permission: permissionKey,
+		name: grant.name,
+		to: grant.to,
+		where: grant.where,
+		check: grant.check,
+		approval: grant.approval,
+		hosted: grant.hosted,
+		breakGlass
+	});
+}
+function skip(tracer, grant, permissionKey, why) {
+	tracer?.skipped.push({
+		role: grant.role,
+		permission: permissionKey,
+		effect: grant.effect,
+		why
+	});
+}
+function traceOf(tracer) {
+	return {
+		evaluated: tracer.evaluated,
+		allows: tracer.allows,
+		denies: tracer.denies,
+		skipped: tracer.skipped
+	};
+}
+function evaluate(policy, subject, permission, data, options, env) {
+	const now = options.now ?? nowSeconds();
+	const trusted = options.trusted === true;
+	const resource = getResource(policy.permissions, permission.resource);
+	let current = data;
+	let next = data;
+	const tracer = options.explain === true ? {
+		evaluated: 0,
+		allows: [],
+		denies: [],
+		skipped: []
+	} : void 0;
+	const complete = (decision, membership) => {
+		const final = freezeDeep(tracer === void 0 ? decision : {
+			...decision,
+			trace: traceOf(tracer)
+		});
+		finish(policy, subject, permission, current, final, options, env, trusted, membership);
+		return final;
+	};
+	if (permission.kind === "instance" && isRowPair(data)) {
+		current = data.current;
+		next = data.next;
+	}
+	if (permission.kind === "collection") {
+		current = void 0;
+		next = data;
+	}
+	try {
+		if (data !== void 0 || permission.kind === "instance" && policy.validate === "always") {
+			const validated = validateBoundary(permission, resource, permission.kind === "instance" && isRowPair(data) ? data.current : data, policy.validate, trusted, options.boundary ?? "manual");
+			if (permission.kind === "instance" && isRowPair(data)) {
+				current = validated;
+				next = validateBoundary(permission, resource, data.next, policy.validate, trusted, options.boundary ?? "manual");
+			} else if (permission.kind === "instance") {
+				current = validated;
+				next = validated;
+			} else next = validated;
+		}
+	} catch (error) {
+		if (error instanceof PermDockValidationError && error.code === "invalid-data") return complete({
+			outcome: "denied",
+			denials: [{
+				role: null,
+				reason: "validation",
+				detail: error
+			}],
+			alternatives: []
+		});
+		throw error;
+	}
+	if (isDelegatedPermission(policy, permission)) return complete({
+		outcome: "denied",
+		denials: [{
+			role: null,
+			reason: "pdp-unavailable",
+			detail: "use permdock/pdp createPermDock"
+		}],
+		alternatives: []
+	});
+	const scopes = scopeList(policy.scopes);
+	const declared = declaredRoleNames(policy);
+	const principalRoles = subject.principal?.roles ?? [];
+	const globalNames = expandRoleNames(principalRoles, declared, env.customRoles, subject.principal?.tenant);
+	if (subject.principal !== null && globalNames.unknown.length > 0) emitSafe(env.listeners.auth, {
+		reason: "unknown-role",
+		source: "roles"
+	}, env.listeners);
+	const denials = [];
+	const allows = [];
+	const matchingRoles = new Set(globalNames.roles);
+	for (const membership of subject.principal?.memberships ?? []) {
+		if (!inTeam(membership, scopes, env.team)) continue;
+		const expanded = expandRoleNames(membership.roles, declared, env.customRoles, tenantOf(membership, scopes));
+		for (const name of expanded.roles) matchingRoles.add(name);
+		for (const name of expanded.unknown) denials.push({
+			role: name,
+			reason: "unknown-role"
+		});
+	}
+	const actorVias = actorRequiredVias(policy.index.supports);
+	if (actorVias.size > 0 && subject.actor === void 0 && (subject.principal?.memberships ?? []).some((membership) => isSupportMembership(membership, actorVias) && !isMembershipExpired(membership, now) && inTeam(membership, scopes, env.team))) return complete({
+		outcome: "denied",
+		denials: [{
+			role: null,
+			reason: "actor-required"
+		}],
+		alternatives: []
+	});
+	const purposes = purposesOf(subject);
+	const forPermission = policy.index.grantsByKey.get(permission.key) ?? [];
+	const candidates = forPermission.filter((grant) => grant.breakGlass === void 0).map((grant) => ({ grant }));
+	for (const item of env.customGrants) if (item.grant.permission.key === permission.key) candidates.push({
+		grant: item.grant,
+		custom: item.role
+	});
+	let breakGlassGrant;
+	let breakGlassObligations = [];
+	const breakGlassOverrides = /* @__PURE__ */ new Set();
+	let breakGlassDenial;
+	for (const grant of forPermission) {
+		if (grant.breakGlass === void 0) continue;
+		if (tracer !== void 0) tracer.evaluated += 1;
+		if (!matchGrantee(grant.to, subject, now, resource, scopes).matched) {
+			skip(tracer, grant, permission.key, "grantee");
+			continue;
+		}
+		const result = evaluateBreakGlass(grant.breakGlass, subject, now);
+		if (result.kind === "inactive") {
+			skip(tracer, grant, permission.key, "break-glass-inactive");
+			continue;
+		}
+		for (const name of grant.breakGlass.overrides) breakGlassOverrides.add(name);
+		if (result.kind === "granted") {
+			breakGlassGrant = grant;
+			breakGlassObligations = result.obligations;
+			break;
+		}
+		breakGlassDenial ??= result.reason === "insufficient-user-authentication" ? {
+			role: null,
+			reason: result.reason,
+			to: result.to
+		} : {
+			role: null,
+			reason: result.reason
+		};
+	}
+	const holdsCustom = (custom) => isGlobalCustomRole(custom) ? holdsGlobalCustomRole(principalRoles, custom) : (subject.principal?.memberships ?? []).some((membership) => inTeam(membership, scopes, env.team) && holdsCustomRole(membership, custom, scopes));
+	const walkRole = env.relations?.available === true ? (membership, row) => {
+		const on = membership.on;
+		const condition = on === void 0 ? void 0 : resourceRoleCondition(resource, on.resource, [on.id], policy.resources);
+		return condition === void 0 || env.relations === void 0 ? false : resolveRelated(condition, row, subject, now, env.relations);
+	} : void 0;
+	for (const { grant, custom } of candidates) {
+		const displayRole = grant.role;
+		if (tracer !== void 0) tracer.evaluated += 1;
+		if (grant.viaOnly !== void 0 && !(subject.principal?.memberships ?? []).some((membership) => membership.via === grant.viaOnly && !isMembershipExpired(membership, now) && inTeam(membership, scopes, env.team))) {
+			skip(tracer, grant, permission.key, "via-only");
+			continue;
+		}
+		const required = grant.purpose;
+		if (required !== void 0 && !purposes.some((purpose) => required.includes(purpose))) {
+			skip(tracer, grant, permission.key, "purpose");
+			continue;
+		}
+		const granteeMatch = matchGrantee(grant.to, subject, now, resource, scopes, policy.resources, grant.effect === "deny");
+		if (!granteeMatch.matched) {
+			const reason = granteeMatch.reason ?? "no-grant";
+			if (reason === "not-entitled" && !flattenGrantee(grant.to).every((item) => item.kind !== "role" || (custom === void 0 ? item.scope === "global" ? globalNames.roles.includes(item.role) : matchingRoles.has(item.role) : holdsCustom(custom)))) {
+				skip(tracer, grant, permission.key, "grantee");
+				continue;
+			}
+			denials.push((reason === "insufficient-user-authentication" || reason === "not-entitled") && grant.to !== void 0 ? {
+				role: displayRole,
+				reason,
+				to: grant.to
+			} : {
+				role: displayRole,
+				reason
+			});
+			continue;
+		}
+		const roleItems = flattenGrantee(grant.to).filter((item) => item.kind === "role");
+		let scopeMembership;
+		let roleOk = roleItems.length === 0;
+		if (roleItems.length > 0) {
+			if (subject.principal === null) {
+				denials.push({
+					role: displayRole,
+					reason: "anonymous"
+				});
+				continue;
+			}
+			let allHeld = true;
+			for (const roleItem of roleItems) {
+				if (!(custom === void 0 ? roleItem.scope === "global" ? globalNames.roles.includes(roleItem.role) : matchingRoles.has(roleItem.role) : holdsCustom(custom))) {
+					skip(tracer, grant, permission.key, "role");
+					allHeld = false;
+					break;
+				}
+				const matchRow = (row) => matchScopedMembership(subject, roleItem.scope, roleItem.role, row, scopes, resource, policy.resources, now, (membership) => {
+					if (custom === void 0) return expandRoleNames(membership.roles, declared, env.customRoles, tenantOf(membership, scopes)).roles;
+					return holdsCustomRole(membership, custom, scopes) ? [custom.name] : [];
+				}, env.team, walkRole);
+				const scopeMatch = matchWriteScope(matchRow, permission.kind === "instance", current, next);
+				if (!scopeMatch.ok) {
+					denials.push({
+						role: roleItem.role,
+						reason: scopeMatch.reason
+					});
+					allHeld = false;
+					break;
+				}
+				scopeMembership = scopeMatch.membership ?? scopeMembership;
+			}
+			roleOk = allHeld;
+		}
+		if (!roleOk) continue;
+		if (!isActive(grant.validity, now)) {
+			if (grant.effect === "allow") denials.push({
+				role: displayRole,
+				reason: "inactive-grant",
+				detail: grant.validity
+			});
+			else skip(tracer, grant, permission.key, "validity");
+			continue;
+		}
+		const merged = freezeDeep(compact({
+			...grant,
+			where: combineWhere(grant.where, granteeMatch.where)
+		}));
+		const condition = evaluateGrantCondition(merged, permission, current, next, subject, now, scopes, env.relations);
+		if (!condition.matched && grant.effect === "deny" && isUnevaluable(condition.reason) && grantCoversField(grant.fields, options.field, grant.effect)) {
+			if (condition.reason === "closure-error") emitSafe(env.listeners.error, condition.cause ?? /* @__PURE__ */ new Error("closure-error"), env.listeners);
+			tracer?.denies.push(matchedOf(merged, permission.key));
+			return complete({
+				outcome: "denied",
+				denials: [{
+					role: displayRole,
+					reason: condition.reason ?? "relation-unavailable"
+				}],
+				alternatives: []
+			});
+		}
+		if (!condition.matched) {
+			if (condition.reason === "closure-error") emitSafe(env.listeners.error, condition.cause ?? /* @__PURE__ */ new Error("closure-error"), env.listeners);
+			denials.push({
+				role: displayRole,
+				reason: condition.reason ?? "condition",
+				detail: condition.cause
+			});
+			continue;
+		}
+		if (!grantCoversField(grant.fields, options.field, grant.effect)) {
+			skip(tracer, grant, permission.key, "field");
+			continue;
+		}
+		if (grant.effect === "deny") {
+			tracer?.denies.push(matchedOf(merged, permission.key));
+			if (grant.name !== void 0 && breakGlassOverrides.has(grant.name)) {
+				if (breakGlassGrant !== void 0) continue;
+				if (breakGlassDenial !== void 0) return complete({
+					outcome: "denied",
+					denials: [breakGlassDenial],
+					alternatives: env.skipAlternatives ? [] : alternativesFor(policy, permission, subject, now, env)
+				});
+			}
+			return complete({
+				outcome: "denied",
+				denials: [grant.name === void 0 ? {
+					role: displayRole,
+					reason: "deny"
+				} : {
+					role: displayRole,
+					reason: "deny",
+					detail: { name: grant.name }
+				}],
+				alternatives: env.skipAlternatives ? [] : alternativesFor(policy, permission, subject, now, env)
+			});
+		}
+		tracer?.allows.push(matchedOf(merged, permission.key));
+		allows.push(scopeMembership === void 0 ? { grant: merged } : {
+			grant: merged,
+			membership: scopeMembership
+		});
+	}
+	if (breakGlassGrant !== void 0) {
+		tracer?.allows.push(matchedOf(breakGlassGrant, permission.key, true));
+		allows.push({
+			grant: breakGlassGrant,
+			obligations: breakGlassObligations,
+			breakGlass: true
+		});
+	} else if (breakGlassDenial !== void 0) denials.unshift(breakGlassDenial);
+	if (allows.length === 0) {
+		const reason = denials[0]?.reason ?? (subject.principal === null ? "anonymous" : globalNames.unknown.length > 0 && globalNames.roles.length === 0 ? "unknown-role" : "no-grant");
+		return complete({
+			outcome: "denied",
+			denials: denials.length > 0 ? denials : [{
+				role: null,
+				reason
+			}],
+			alternatives: env.skipAlternatives ? [] : alternativesFor(policy, permission, subject, now, env)
+		});
+	}
+	if (subject.stale === true && (policy.fresh ?? []).includes(permission.key)) return complete({
+		outcome: "denied",
+		denials: [{
+			role: null,
+			reason: "stale-credentials"
+		}],
+		alternatives: []
+	});
+	const ceiling = delegatedPermissions(policy.delegations, subject, matchingRoles, now);
+	if (ceiling !== void 0 && !ceiling.has(permission.key)) return complete({
+		outcome: "denied",
+		denials: [{
+			role: null,
+			reason: "not-delegated"
+		}],
+		alternatives: env.skipAlternatives ? [] : alternativesFor(policy, permission, subject, now, env)
+	});
+	const delegationMiss = coveredByDelegation(permission, subject.delegation, resourceIdOf(current), subject.actor !== void 0 && ceiling === void 0);
+	if (delegationMiss !== void 0) return complete({
+		outcome: "denied",
+		denials: [{
+			role: null,
+			reason: delegationMiss
+		}],
+		alternatives: env.skipAlternatives ? [] : alternativesFor(policy, permission, subject, now, env)
+	});
+	const approvalPolicies = env.approvalPolicies;
+	if (approvalPolicies === "failed" && allows.length > 0) return complete({
+		outcome: "denied",
+		denials: [{
+			role: null,
+			reason: "approval",
+			detail: "approval-policy-unavailable"
+		}],
+		alternatives: []
+	});
+	const approvalOf = (candidate) => approvalPolicies === void 0 || approvalPolicies === "failed" ? candidate.grant.approval : tightenApproval(candidate.grant.approval, approvalPolicies, {
+		permission: permission.key,
+		tenant: decisionTenant(subject, candidate.membership),
+		subject,
+		current,
+		next,
+		now,
+		scopes: scopeList(policy.scopes)
+	});
+	const quotaDenials = [];
+	let matchedAllow;
+	let approval;
+	let quotaState = {};
+	for (const candidate of allows) {
+		approval = approvalOf(candidate);
+		const consume = !requiresApproval(approval) && shouldConsumeQuota(options.source, env.simulated);
+		const quota = applyQuota({
+			store: env.limits,
+			cache: env.limitCache,
+			grant: candidate.grant,
+			permissionKey: permission.key,
+			subjectId: subject.principal?.id ?? "",
+			tenant: subject.principal?.tenant,
+			now,
+			consume
+		});
+		if (quota.ok) {
+			matchedAllow = candidate;
+			quotaState = compact({
+				quota: quota.quota,
+				obligations: quota.obligations
+			});
+			break;
+		}
+		quotaDenials.push(quota.reason === "limit" ? {
+			role: candidate.grant.role,
+			reason: "limit",
+			detail: quota.detail
+		} : {
+			role: candidate.grant.role,
+			reason: quota.reason
+		});
+	}
+	if (matchedAllow === void 0) return complete({
+		outcome: "denied",
+		denials: quotaDenials.length > 0 ? quotaDenials : denials,
+		alternatives: env.skipAlternatives ? [] : alternativesFor(policy, permission, subject, now, env)
+	});
+	const resourceId = permission.kind === "collection" ? "*" : current !== null && typeof current === "object" ? String(current[resource?.id ?? "id"] ?? "*") : "*";
+	const version = approval !== void 0 && approval !== "human" && approval.staleOn === "resource-change" && resource?.version !== void 0 ? versionOf(current, resource.version) : void 0;
+	const token = env.simulated ? "pd1.simulated" : decisionToken({
+		key: permission.key,
+		resourceId,
+		principal: subject.principal,
+		actor: subject.actor,
+		fingerprint: policy.fingerprint,
+		version,
+		payload: resourceId === "*" && (next ?? current) !== void 0 ? payloadDigest(next ?? current) : void 0
+	});
+	const matched = compact({
+		...matchedOf(matchedAllow.grant, permission.key, matchedAllow.breakGlass),
+		approval
+	});
+	const obligations = [...quotaState.obligations ?? [], ...matchedAllow.obligations ?? []];
+	return complete(requiresApproval(approval) ? {
+		outcome: "approval-required",
+		grant: matched,
+		reason: "human",
+		token
+	} : {
+		outcome: "granted",
+		subject,
+		matched,
+		token,
+		...quotaState,
+		...obligations.length === 0 ? {} : { obligations }
+	}, matchedAllow.membership);
+}
+//#endregion
+//#region src/core/ownership.ts
+function bindingOf(policy, name) {
+	return policy.rolesByName.get(name);
+}
+function roleMeta(policy, name) {
+	return bindingOf(policy, name)?.meta ?? findRole(policy.vocabulary?.roles, name)?.meta;
+}
+/** A role with `for` is held only through a membership of one of those kinds. */
+function mayHoldVia(policy, role, via) {
+	const kinds = bindingOf(policy, role)?.for;
+	return kinds === void 0 || via !== void 0 && kinds.includes(via);
+}
+function sameList(a, b) {
+	return a.length === b.length && a.every((item, index) => item === b[index]);
+}
+/**
+* The identity provider may only hand out what the application could: a
+* declared role with `assignable: false` (an owner, a platform role) never
+* rides in on a `managedBy: 'idp'` membership. A name the policy does not
+* declare stays, because only a tenant's custom role can give it meaning.
+*/
+function mayHoldManaged(policy, role, membership) {
+	return !isExternallyManaged(membership) || bindingOf(policy, role)?.assignable !== false;
+}
+/**
+* Drops every role a membership's kind may not hold (fail-closed: a missing
+* `via` is no kind) and every non-assignable role on an identity-provider
+* membership. Global roles have no kind, so a role with `for` held globally
+* is dropped too.
+*/
+function applyRoleKinds(policy, roles, memberships) {
+	const kinds = policy.roles.some((binding) => binding.for !== void 0);
+	if (!kinds && !memberships.some(isExternallyManaged)) return {
+		roles,
+		memberships
+	};
+	return {
+		roles: kinds ? roles?.filter((name) => mayHoldVia(policy, name, void 0)) ?? roles : roles,
+		memberships: memberships.map((membership) => {
+			const allowed = membership.roles.filter((name) => mayHoldVia(policy, name, membership.via) && mayHoldManaged(policy, name, membership));
+			return sameList(allowed, membership.roles) ? membership : freezeDeep({
+				...membership,
+				roles: allowed
+			});
+		})
+	};
+}
+function usesAssigns(policy) {
+	return policy.roles.some((binding) => binding.assigns !== void 0);
+}
+/** Declared role names in declaration order: bindings first, then vocabulary-only leaves. */
+function declarationOrder(policy) {
+	const names = policy.roles.map((binding) => binding.name);
+	const seen = new Set(names);
+	for (const leaf of listRoles(policy.vocabulary?.roles)) if (!seen.has(leaf.key)) {
+		names.push(leaf.key);
+		seen.add(leaf.key);
+	}
+	return names;
+}
+/**
+* Each role's depth in the `assigns` graph: a role nobody else assigns is 0,
+* a role another assigns sits one below its deepest assigner. Cycles stop
+* after one pass per role.
+*/
+function assignDepths(policy) {
+	const names = declarationOrder(policy);
+	const depth = new Map(names.map((name) => [name, 0]));
+	for (let pass = 0; pass < names.length; pass += 1) {
+		let changed = false;
+		for (const binding of policy.roles) {
+			const from = depth.get(binding.name) ?? 0;
+			for (const target of binding.assigns ?? []) if (target !== binding.name && (depth.get(target) ?? 0) < from + 1) {
+				depth.set(target, from + 1);
+				changed = true;
+			}
+		}
+		if (!changed) break;
+	}
+	return depth;
+}
+/**
+* `names` ordered by rank: assigners before the roles they assign, then
+* declaration order. Without an `assigns` graph the order is kept.
+*/
+function rankRoles(policy, names) {
+	if (!usesAssigns(policy)) return names;
+	const order = declarationOrder(policy);
+	const depth = assignDepths(policy);
+	const index = (name) => {
+		const found = order.indexOf(name);
+		return found === -1 ? order.length : found;
+	};
+	return [...names].toSorted((a, b) => (depth.get(a) ?? Number.MAX_SAFE_INTEGER) - (depth.get(b) ?? Number.MAX_SAFE_INTEGER) || index(a) - index(b));
+}
+/** The distinct `meta.audience` values of `names`, in rank order. */
+function audiencesOf(policy, names) {
+	const out = [];
+	for (const name of rankRoles(policy, names)) {
+		const audience = roleMeta(policy, name)?.audience;
+		if (typeof audience === "string" && !out.includes(audience)) out.push(audience);
+	}
+	return out;
+}
+/** Whether `membership` is the instance itself or one of its ancestors named in `within`. */
+function coversInstance(membership, scopes, scope, id, within) {
+	if (membership.scope === void 0 || membership.id === void 0) return false;
+	if (membership.scope === scope) return membership.id === id;
+	if (!scopeChain(scopes, scope).slice(1).includes(membership.scope)) return false;
+	const wanted = within === void 0 ? void 0 : Object.entries(within).find(([key]) => resolveScope(scopes, key) === membership.scope)?.[1] ?? void 0;
+	return wanted !== void 0 && scopeIdOf(membership, membership.scope) === wanted;
+}
+/** Roles the principal holds at the instance, at an ancestor named in `within`, or globally. */
+function rolesAtInstance(policy, principal, scopes, scope, id, within, now) {
+	const declared = declaredRoleNames$1(policy);
+	const names = new Set((principal.roles ?? []).filter((name) => declared.has(name)));
+	for (const membership of principal.memberships ?? []) if (!isMembershipExpired(membership, now) && coversInstance(membership, scopes, scope, id, within)) for (const name of membership.roles) names.add(name);
+	return rankRoles(policy, [...names]);
+}
+/** Whether the principal holds `role` on a live membership of exactly this instance. */
+function holdsAt(principal, role, scope, id, now) {
+	return (principal.memberships ?? []).some((membership) => membership.scope === scope && membership.id === id && !isMembershipExpired(membership, now) && membership.roles.includes(role));
+}
+function conflictsWith(policy, role) {
+	const out = new Set(bindingOf(policy, role)?.exclusiveWith ?? []);
+	for (const binding of policy.roles) if (binding.exclusiveWith?.includes(role) === true) out.add(binding.name);
+	return out;
+}
+/** What the change does to the instance's holder count. */
+function countRules(binding, role, holders, delta, deny) {
+	if (binding === void 0 || delta === 0) return;
+	const min = binding.min ?? 0;
+	if (!(min > 0 || binding.max !== void 0 || binding.transferOnly === true)) return;
+	if (!(holders !== void 0 && Number.isInteger(holders) && holders >= 0)) {
+		deny(delta < 0 && min > 0 ? "last-holder" : delta > 0 && binding.max !== void 0 ? "max-holders" : "transfer-only", {
+			role,
+			holders: null
+		});
+		return;
+	}
+	const after = holders + delta;
+	if (delta < 0 && min > 0 && after < min) deny("last-holder", {
+		role,
+		min,
+		holders
+	});
+	if (delta > 0 && binding.max !== void 0 && after > binding.max) deny("max-holders", {
+		role,
+		max: binding.max,
+		holders
+	});
+	if (binding.transferOnly === true && holders > 0 && after > 0) deny("transfer-only", {
+		role,
+		holders
+	});
+}
+/**
+* A live membership of the principal on the instance or on an instance under
+* it: the one in-band fact that ties a nested instance to a tenant.
+*/
+function heldAnchor(principal, scopes, scope, id, now) {
+	return (principal.memberships ?? []).find((membership) => !isMembershipExpired(membership, now) && membership.scope !== void 0 && scopeChain(scopes, membership.scope).includes(scope) && scopeIdOf(membership, scope) === id && tenantOf(membership, scopes) !== void 0);
+}
+/**
+* The one rule check behind `permdock.decideRoleChange`. The actor is always
+* the instance's own principal; nothing in `change` can stand in for it.
+*/
+function decideRoleChange(policy, principal, scopes, change, authority, now, options = {}) {
+	const name = typeof change?.role === "string" ? change.role : change?.role?.key;
+	const denials = [];
+	const deny = (reason, detail) => {
+		denials.push(compact({
+			role: name ?? null,
+			reason,
+			detail
+		}));
+	};
+	const done = (role) => freezeDeep(denials.length === 0 ? {
+		outcome: "granted",
+		change,
+		role
+	} : {
+		outcome: "denied",
+		change,
+		denials
+	});
+	if (principal === null) {
+		deny("anonymous");
+		return done(null);
+	}
+	const kind = change?.kind;
+	const target = change?.target;
+	if (typeof name !== "string" || kind !== "assign" && kind !== "revoke" && kind !== "transfer" || typeof change.id !== "string" || change.id === "" || target === null || typeof target !== "object" || typeof target.id !== "string" || target.id === "") {
+		deny("validation");
+		return done(null);
+	}
+	const binding = bindingOf(policy, name);
+	if (!declaredRoleNames$1(policy).has(name)) {
+		deny("unknown-role");
+		return done(null);
+	}
+	const scope = resolveScope(scopes, change.scope);
+	const on = binding?.on ?? findRole(policy.vocabulary?.roles, name)?.on;
+	const heldAt = typeof on === "string" ? resolveScope(scopes, on) : void 0;
+	if (scope === void 0 || heldAt === void 0 || heldAt !== scope) {
+		deny("scope", { expected: heldAt ?? null });
+		return done(null);
+	}
+	const root = scopes[0]?.name;
+	const supplied = change.within === void 0 ? void 0 : Object.entries(change.within).find(([key]) => resolveScope(scopes, key) === root)?.[1];
+	let tenant;
+	let within = change.within;
+	if (scope === root) tenant = change.id;
+	else {
+		const anchor = heldAnchor(principal, scopes, scope, change.id, now);
+		const held = anchor === void 0 ? void 0 : tenantOf(anchor, scopes);
+		if (held !== void 0) {
+			tenant = supplied === void 0 || supplied === held ? held : void 0;
+			within = anchor?.within;
+		} else if (options.trusted === true) tenant = supplied;
+	}
+	if (tenant === void 0) {
+		deny("no-membership", {
+			scope,
+			id: change.id
+		});
+		return done(null);
+	}
+	if (target.managedBy === "idp") {
+		deny("externally-managed");
+		return done(null);
+	}
+	const self = target.id === principal.id;
+	const targetRoles = isReadonlyArray(target.roles) ? target.roles : [];
+	const already = targetRoles.includes(name);
+	let by = null;
+	if (kind === "transfer") {
+		if (self) deny("self-demotion");
+		if (holdsAt(principal, name, scope, change.id, now)) by = name;
+		else deny("not-assignable-by", { holds: false });
+	} else {
+		if (self) deny(kind === "revoke" ? "self-demotion" : "not-assignable-by", { self: true });
+		const allowed = authority(tenant);
+		if (!allowed.assignable.has(name)) deny("not-assignable-by");
+		else if (usesAssigns(policy) && !allowed.manage) {
+			const held = rolesAtInstance(policy, principal, scopes, scope, change.id, within, now);
+			by = held.find((role) => bindingOf(policy, role)?.assigns?.includes(name) === true) ?? null;
+			if (by === null) deny("not-assignable-by", { held });
+		}
+	}
+	if (kind !== "revoke" && !already) {
+		if (!mayHoldVia(policy, name, target.via)) deny("not-allowed-for-membership", {
+			via: target.via ?? null,
+			for: binding?.for
+		});
+		const conflicts = conflictsWith(policy, name);
+		const clash = targetRoles.filter((role) => conflicts.has(role));
+		if (clash.length > 0) deny("conflicting-role", { with: clash });
+	}
+	const delta = kind === "assign" ? already ? 0 : 1 : kind === "revoke" ? targetRoles.length > 0 && !already ? 0 : -1 : already ? -1 : 0;
+	countRules(binding, name, change.holders, delta, deny);
+	return done(by);
+}
+//#endregion
+//#region src/core/who-can.ts
+const MAX_ROUNDS = 48;
+async function settle$1(cache) {
+	for (let round = 0; round < MAX_ROUNDS; round += 1) {
+		const pending = pendingRelations(cache);
+		if (pending.length === 0) return;
+		await Promise.all(pending);
+	}
+}
+/** The holders on each instance a graph relation reads, or `undefined` when the graph cannot say. */
+async function walkHolders(condition, row, reader, cache) {
+	let walk = relationWalk(condition, row, reader);
+	if (walk === "relation-unavailable") {
+		await settle$1(cache);
+		walk = relationWalk(condition, row, reader);
+	}
+	if (walk === void 0) return [];
+	if (walk === "relation-depth" || walk === "relation-unavailable") return;
+	const { ids } = walk;
+	const read = () => ids.map((id) => reader.holders({
+		resource: condition.resource,
+		id,
+		relation: condition.relation
+	}));
+	let answers = read();
+	if (answers.includes("pending")) {
+		await settle$1(cache);
+		answers = read();
+	}
+	const out = [];
+	for (const [index, answer] of answers.entries()) {
+		const id = ids[index];
+		if (answer === "pending" || answer === "failed" || id === void 0) return;
+		out.push({
+			id,
+			holders: answer
+		});
+	}
+	return out;
+}
+async function discoverRole(item, allow, ctx) {
+	if (typeof item.scope !== "string" || item.scope === "global") {
+		ctx.incomplete();
+		return;
+	}
+	const key = findScope(ctx.scopes, item.scope)?.key;
+	const id = key === void 0 ? void 0 : relationId(ownGet(ctx.row, key));
+	if (id === void 0) return;
+	const members = await ctx.list(item.scope, id);
+	if (members === null) {
+		ctx.incomplete();
+		return;
+	}
+	for (const member of members.filter((entry) => entry.membership.roles.includes(item.role))) ctx.add(member.id, allow ? {
+		kind: "role",
+		role: item.role,
+		membership: member.membership
+	} : void 0, member.membership);
+}
+function holderVia(holder, at, share, group) {
+	if (!share) return {
+		kind: "relation",
+		...at
+	};
+	return compact({
+		kind: "share",
+		...at,
+		expiresAt: holder.expiresAt,
+		group
+	});
+}
+/**
+* Principals holding `group`'s relation, through at most `budget` more groups
+* of its resource; `undefined` when a read failed. `memo` keeps each group's
+* members per budget across one discovery, so a group shared by many paths is
+* read once; a result cut short by a cycle is path-specific and not kept.
+*/
+async function groupMembers(group, ctx, budget, seen, memo) {
+	const key = JSON.stringify([
+		group.resource,
+		group.id,
+		group.relation
+	]);
+	const memoKey = `${budget}:${key}`;
+	const known = memo.get(memoKey);
+	if (known !== void 0) return {
+		members: known,
+		cut: false
+	};
+	let holders = ctx.reader.holders(group);
+	if (holders === "pending") {
+		await settle$1(ctx.cache);
+		holders = ctx.reader.holders(group);
+	}
+	if (holders === "pending" || holders === "failed") return;
+	const path = new Set(seen).add(key);
+	const out = /* @__PURE__ */ new Set();
+	let cut = false;
+	for (const holder of holders) {
+		if ("principal" in holder) {
+			out.add(holder.principal.id);
+			continue;
+		}
+		const nested = JSON.stringify([
+			holder.group.resource,
+			holder.group.id,
+			holder.group.relation
+		]);
+		const same = holder.group.resource === group.resource;
+		if (path.has(nested)) {
+			cut = true;
+			continue;
+		}
+		if (same && budget <= 0) continue;
+		const walk = await groupMembers(holder.group, ctx, same ? budget - 1 : 16, path, memo);
+		if (walk === void 0) return;
+		cut ||= walk.cut;
+		for (const member of walk.members) out.add(member);
+	}
+	const members = [...out];
+	if (!cut) memo.set(memoKey, members);
+	return {
+		members,
+		cut
+	};
+}
+async function discoverGraph(condition, allow, ctx) {
+	const nodes = await walkHolders(condition, ctx.row, ctx.reader, ctx.cache);
+	if (nodes === void 0) {
+		ctx.incomplete();
+		return;
+	}
+	const node = ctx.policy.resources.get(condition.resource);
+	const memo = /* @__PURE__ */ new Map();
+	for (const entry of nodes) for (const holder of entry.holders) {
+		const at = {
+			resource: condition.resource,
+			relation: holder.relation,
+			id: entry.id
+		};
+		const share = isEdgeRelation(node?.relations[holder.relation]);
+		if ("principal" in holder) {
+			ctx.add(holder.principal.id, allow ? holderVia(holder, at, share) : void 0);
+			continue;
+		}
+		const walk = await groupMembers(holder.group, ctx, holder.group.resource === condition.resource ? 15 : 16, /* @__PURE__ */ new Set(), memo);
+		if (walk === void 0) {
+			ctx.incomplete();
+			continue;
+		}
+		for (const member of walk.members) ctx.add(member, allow ? holderVia(holder, at, share, holder.group) : void 0);
+	}
+}
+async function discoverRelation(item, allow, ctx, expanded = false) {
+	const condition = relationCondition(item, ctx.resource, ctx.scopes, { resources: ctx.policy.resources });
+	if (condition?.op === "related") {
+		await discoverGraph(condition, allow, ctx);
+		return;
+	}
+	const spec = ctx.resource?.relations[item.relation];
+	if (spec?.includes !== void 0 && !expanded) {
+		for (const name of expandRelation(ctx.resource, item.relation)) await discoverRelation({
+			...item,
+			relation: name
+		}, allow, ctx, true);
+		return;
+	}
+	const via = allow ? {
+		kind: "relation",
+		resource: ctx.permission.resource,
+		relation: item.relation,
+		id: relationId(ownGet(ctx.row, ctx.resource?.id ?? "id")) ?? ""
+	} : void 0;
+	if (isFieldRelation(spec) && spec.memberOf !== void 0) {
+		const scope = resolveScope(ctx.scopes, spec.memberOf);
+		const id = relationId(ownGet(ctx.row, spec.field));
+		const members = scope === void 0 || id === void 0 ? [] : await ctx.list(scope, id);
+		if (members === null) {
+			ctx.incomplete();
+			return;
+		}
+		for (const member of members) ctx.add(member.id, via, member.membership);
+		return;
+	}
+	const column = isFieldRelation(spec) ? spec.field : isPrincipalRelation(spec) ? spec.principal : void 0;
+	const holder = column === void 0 ? void 0 : relationId(ownGet(ctx.row, column));
+	if (holder !== void 0) ctx.add(holder, via);
+}
+function discover(grant, item, ctx) {
+	const allow = grant.effect === "allow";
+	switch (item.kind) {
+		case "role": return discoverRole(item, allow, ctx);
+		case "relation": return discoverRelation(item, allow, ctx);
+		case "anyone":
+		case "authenticated":
+		case "plan":
+		case "actor":
+		case "assurance":
+			ctx.incomplete();
+			return Promise.resolve();
+		default: return unknownKind(item, ctx);
+	}
+}
+/** Holders of a grantee kind this build does not know cannot be listed. */
+function unknownKind(_item, ctx) {
+	ctx.incomplete();
+	return Promise.resolve();
+}
+function memberLister(source, scopes) {
+	const listed = /* @__PURE__ */ new Map();
+	const load = async (scope, id) => {
+		if (source?.list === void 0) return null;
+		try {
+			return (await source.list({
+				scope,
+				id
+			})).flatMap((entry) => typeof entry.principal?.id === "string" ? normalizeMemberships([entry.membership], scopes).map((membership) => ({
+				id: entry.principal.id,
+				membership
+			})) : []);
+		} catch {
+			return null;
+		}
+	};
+	return (scope, id) => {
+		const key = JSON.stringify([scope, id]);
+		const known = listed.get(key) ?? load(scope, id);
+		listed.set(key, known);
+		return known;
+	};
+}
+async function whoCan(input) {
+	const { policy, permission, row } = input;
+	if (permission.kind !== "instance" || row === null || typeof row !== "object") return freezeDeep({
+		permission: permission.key,
+		holders: [],
+		complete: false
+	});
+	const scopes = scopeList(policy.scopes);
+	let complete = !input.customGrants.some((item) => item.grant.permission.key === permission.key);
+	const found = /* @__PURE__ */ new Map();
+	const ctx = {
+		policy,
+		scopes,
+		resource: getResource(policy.permissions, permission.resource),
+		permission,
+		row,
+		reader: input.reader,
+		cache: input.cache,
+		list: memberLister(input.memberships, scopes),
+		add(id, via, membership) {
+			const entry = found.get(id) ?? {
+				memberships: [],
+				via: []
+			};
+			found.set(id, entry);
+			if (via !== void 0) entry.via.push(via);
+			if (membership !== void 0) entry.memberships.push(membership);
+		},
+		incomplete() {
+			complete = false;
+		}
+	};
+	await Promise.all((policy.index.grantsByKey.get(permission.key) ?? []).flatMap((grant) => flattenGrantee(grant.to).map((item) => discover(grant, item, ctx))));
+	const root = rootScope(scopes);
+	const tenantKey = root === void 0 ? void 0 : findScope(scopes, root)?.key;
+	const tenant = tenantKey === void 0 ? void 0 : relationId(ownGet(row, tenantKey));
+	const env = {
+		emit: false,
+		simulated: true,
+		skipAlternatives: true,
+		customRoles: [],
+		customGrants: [],
+		listeners: emptyListeners(),
+		sink: void 0,
+		limits: void 0,
+		limitCache: /* @__PURE__ */ new Map(),
+		team: input.team,
+		relations: input.reader
+	};
+	const now = nowSeconds();
+	const ordered = [...found.entries()].toSorted(([a], [b]) => byCodePoint(a, b));
+	const decideAll = () => ordered.map(([id, entry]) => {
+		const subject = freezeDeep({
+			principal: {
+				id,
+				roles: [],
+				memberships: entry.memberships,
+				...tenant === void 0 ? {} : { tenant }
+			},
+			context: {}
+		});
+		return evaluate(policy, subject, permission, row, {
+			source: "simulate",
+			trusted: true,
+			now
+		}, env);
+	});
+	let decisions = decideAll();
+	if (pendingRelations(input.cache).length > 0) {
+		await settle$1(input.cache);
+		decisions = decideAll();
+	}
+	const holders = [];
+	for (const [index, [id, entry]] of ordered.entries()) {
+		const decision = decisions[index];
+		if (decision === void 0 || decision.outcome === "denied") {
+			if (decision?.outcome === "denied" && decision.denials.some((denial) => denial.reason === "relation-unavailable" || denial.reason === "relation-depth")) complete = false;
+			continue;
+		}
+		holders.push({
+			principal: { id },
+			via: entry.via
+		});
+	}
+	return freezeDeep({
+		permission: permission.key,
+		holders,
+		complete
+	});
+}
+//#endregion
+//#region src/core/instance.ts
+/** Each round reads one more layer: link hops, then the chain, then nested groups. */
+const LOAD_ROUNDS = 48;
+/** A grant on a relation with a `period` is decided on the server, where the clock is. */
+function periodBound(policy, grant) {
+	const relations = policy.resources.get(grant.permission.resource)?.relations;
+	return flattenGrantee(grant.to).some((item) => {
+		if (item.kind !== "relation") return false;
+		const spec = relations?.[item.relation];
+		return isPrincipalRelation(spec) && spec.period !== void 0;
+	});
+}
+function includePrefixes(include) {
+	if (include === void 0) return;
+	return include.map((item) => {
+		if ("key" in item && typeof item.key === "string") return item.key;
+		const first = listPermissions(item)[0];
+		if (first === void 0) return "";
+		const parts = first.key.split(".");
+		parts.pop();
+		return parts.join(".");
+	});
+}
+/**
+* Role names held in `tenant` on live memberships, global roles included, in
+* rank order. With `scope`, only the roles of that scope's memberships (and
+* instance `id`).
+*/
+function heldRoleNames(policy, subject, tenant, only, now) {
+	if (subject.principal === null) return [];
+	const scopes = scopeList(policy.scopes);
+	const scope = only?.scope === void 0 ? void 0 : resolveScope(scopes, only.scope);
+	if (only?.scope !== void 0 && scope === void 0) return [];
+	const names = new Set(scope === void 0 ? subject.principal.roles ?? [] : []);
+	for (const membership of subject.principal.memberships ?? []) {
+		if (isMembershipExpired(membership, now)) continue;
+		if (!(scope === void 0 ? tenantOf(membership, scopes) === tenant : membership.scope === scope && (only?.id === void 0 || membership.id === only.id))) continue;
+		for (const role of membership.roles) names.add(role);
+	}
+	return rankRoles(policy, [...names]);
+}
+function roleLeaf(policy, name) {
+	const binding = policy.rolesByName.get(name);
+	return findRole(policy.vocabulary?.roles, name) ?? synthesiseRole(name, compact({
+		on: typeof binding?.on === "string" ? binding.on : void 0,
+		assignable: binding?.assignable,
+		meta: binding?.meta
+	}));
+}
+/**
+* The grant with its grantee's row condition. A graph relation needs the
+* `RelationSource`, which snapshots and `where()` do not carry, so the grant
+* becomes server-only (`portable: false`) there.
+*/
+function graphAware(grant, where) {
+	const combined = combineWhere(grant.where, where);
+	const graph = hasConditionOp(combined, "related");
+	return freezeDeep(compact({
+		...grant,
+		where: combined,
+		portable: graph ? false : grant.portable,
+		graph: graph && grant.portable ? true : void 0
+	}));
+}
+/**
+* `where()` keeps a grant that is server-only because it reads the graph:
+* its `related` nodes compile to subqueries given relation mappings.
+*/
+function whereGrant(grant) {
+	return grant.graph === true ? freezeDeep({
+		...grant,
+		portable: true
+	}) : grant;
+}
+/**
+* Every grant the subject may reach, once per membership that holds all of
+* its scoped roles, so a client can check that membership's tenant, team or
+* resource. A scoped role held only globally reaches nothing.
+*/
+function collectSnapshotGrants(policy, subject, customRoles, now = nowSeconds(), customGrants = customGrantsFor(policy, customRoles), mode = "held") {
+	const skip = (grant, match) => mode === "held" ? !match.matched : match.matched || match.reason !== "not-entitled" || grant.effect !== "allow";
+	const scopes = scopeList(policy.scopes);
+	const declared = declaredRoleNames(policy);
+	const global = expandRoleNames(subject.principal?.roles ?? [], declared, customRoles, subject.principal?.tenant);
+	const held = (subject.principal?.memberships ?? []).map((membership) => ({
+		membership,
+		roles: new Set(expandRoleNames(membership.roles, declared, customRoles, tenantOf(membership, scopes)).roles)
+	}));
+	const holds = (entry, item) => entry.roles.has(item.role) && (typeof item.scope === "string" ? entry.membership.scope === item.scope : entry.membership.on !== void 0);
+	const out = [];
+	for (const grant of grantList(policy)) {
+		const resource = getResource(policy.permissions, grant.permission.resource);
+		const match = matchGrantee(grant.to, subject, now, resource, scopes, policy.resources);
+		if (skip(grant, match)) continue;
+		const roleItems = flattenGrantee(grant.to).filter((item) => item.kind === "role");
+		if (roleItems.length > 0 && subject.principal === null) continue;
+		if (!roleItems.every((item) => item.scope !== "global" || global.roles.includes(item.role))) continue;
+		const merged = graphAware(grant, match.where);
+		const scoped = roleItems.filter((item) => item.scope !== "global");
+		if (scoped.length === 0) {
+			out.push({ grant: merged });
+			continue;
+		}
+		for (const entry of held) if (scoped.every((item) => item.kind === "role" && holds(entry, item))) out.push({
+			grant: merged,
+			membership: entry.membership
+		});
+	}
+	for (const { grant, role } of customGrants) {
+		const globalHeld = holdsGlobalCustomRole(subject.principal?.roles, role);
+		const holders = held.filter((entry) => holdsCustomRole(entry.membership, role, scopes));
+		if (holders.length === 0 && !globalHeld) continue;
+		const resource = getResource(policy.permissions, grant.permission.resource);
+		const match = matchGrantee(grant.to, subject, now, resource, scopes, policy.resources);
+		if (skip(grant, match)) continue;
+		const merged = graphAware(grant, match.where);
+		if (globalHeld) out.push({ grant: merged });
+		for (const entry of holders) out.push({
+			grant: merged,
+			membership: entry.membership
+		});
+	}
+	const fresh = policy.fresh ?? [];
+	if (mode === "held" && subject.stale === true && fresh.length > 0) return out.filter(({ grant }) => grant.effect === "deny" || !fresh.includes(grant.permission.key));
+	return out;
+}
+/**
+* Declared roles a tenant admin may hand out or compose, before any
+* intersection: `assignable` roles, plus every role some `assigns` lists.
+*/
+function assignableCandidates(policy) {
+	const listed = new Set(policy.roles.flatMap((binding) => binding.assigns ?? []));
+	const names = [...listRoles(policy.vocabulary?.roles).filter((leaf) => leaf.assignable || listed.has(leaf.key)).map((leaf) => leaf.key), ...policy.roles.filter((binding) => binding.assignable || listed.has(binding.name)).map((binding) => binding.name)];
+	return rankRoles(policy, [...new Set(names)]).map((name) => roleLeaf(policy, name));
+}
+/**
+* What the subject may hand out in `tenant`: declared assignable roles and the
+* tenant custom-role ceiling, narrowed by `allowed` (`RoleSource.assignable`),
+* then intersected with the permissions the subject holds there. Holding a
+* role or a granted permission with `meta.manageRoles` lifts the intersection.
+*/
+function assignableIn(policy, subject, customRoles, customGrants, tenant, allowed, now = nowSeconds(), global = false) {
+	const principal = subject.principal;
+	if (principal === null) return {
+		roles: [],
+		permissions: [],
+		manage: false
+	};
+	const scopes = scopeList(policy.scopes);
+	const scoped = tenant === void 0 ? subject : freezeDeep(compact({
+		...subject,
+		principal: compact({
+			...principal,
+			tenant: resolveActiveTenant(principal, tenant, scopes, now)
+		})
+	}));
+	const heldKeys = new Set(collectSnapshotGrants(policy, scoped, customRoles, now, customGrants).filter((item) => item.grant.effect === "allow" && (item.membership === void 0 || !global && tenantOf(item.membership, scopes) === tenant && !isMembershipExpired(item.membership, now))).map((item) => item.grant.permission.key));
+	const heldNames = heldRoleNames(policy, subject, tenant, void 0, now);
+	const quiet = {
+		emit: false,
+		simulated: true,
+		skipAlternatives: true,
+		customRoles,
+		customGrants,
+		listeners: emptyListeners(),
+		sink: void 0,
+		limits: void 0,
+		limitCache: /* @__PURE__ */ new Map(),
+		team: void 0
+	};
+	const manage = heldNames.some((name) => roleMeta(policy, name)?.manageRoles === true) || listPermissions(policy.permissions).some((leaf) => leaf.meta.manageRoles === true && evaluate(policy, scoped, leaf, void 0, {
+		source: "simulate",
+		trusted: true,
+		now
+	}, quiet).outcome === "granted");
+	const narrowed = allowed === void 0 ? void 0 : new Set(allowed);
+	const candidates = assignableCandidates(policy).filter((leaf) => narrowed === void 0 || narrowed.has(leaf.key));
+	const held = new Set(heldNames);
+	const listed = usesAssigns(policy) ? new Set(heldNames.flatMap((name) => policy.rolesByName.get(name)?.assigns ?? [])) : void 0;
+	const roles = manage ? candidates : candidates.filter((leaf) => {
+		if (listed !== void 0) return listed.has(leaf.key);
+		if (held.has(leaf.key)) return true;
+		const keys = [...roleAllowKeys(policy, leaf.key)];
+		return keys.length > 0 && keys.every((key) => heldKeys.has(key));
+	});
+	const root = global ? "global" : rootScope(scopes);
+	const ceiling = new Set((root === void 0 ? [] : ceilingGrants(policy, root, allowed)).map((grant) => grant.permission.key));
+	return {
+		roles,
+		permissions: listPermissions(policy.permissions).filter((leaf) => ceiling.has(leaf.key) && (manage || heldKeys.has(leaf.key))),
+		manage
+	};
+}
+/** The one path from a resolved subject to a `Snapshot`; pure apart from the default clock. */
+function snapshotOf(policy, subject, options) {
+	const now = options.now ?? nowSeconds();
+	const customGrants = options.customGrants ?? customGrantsFor(policy, options.customRoles);
+	const roles = heldRoleNames(policy, subject, subject.principal?.tenant, void 0, now);
+	const audiences = audiencesOf(policy, roles);
+	return buildSnapshot(compact({
+		subject,
+		roles,
+		audiences: audiences.length === 0 ? void 0 : audiences,
+		notEntitled: collectSnapshotGrants(policy, subject, options.customRoles, now, customGrants, "not-entitled"),
+		grants: collectSnapshotGrants(policy, subject, options.customRoles, now, customGrants).map((item) => periodBound(policy, item.grant) ? Object.assign({}, item, { grant: freezeDeep({
+			...item.grant,
+			portable: false
+		}) }) : item),
+		include: includePrefixes(options.include),
+		tenants: options.tenants,
+		simulated: options.simulated,
+		now: Math.floor(now),
+		vocabulary: policy.vocabulary,
+		scopes: snapshotScopes(policy),
+		delegated: delegatedPermissions(policy.delegations, subject, new Set(roles), now),
+		assignable: (tenant) => {
+			const found = assignableIn(policy, subject, options.customRoles, customGrants, tenant, options.assignable?.get(tenant), now);
+			return {
+				tenant,
+				roles: found.roles.map((leaf) => leaf.key),
+				permissions: found.permissions
+			};
+		}
+	}));
+}
+/** The policy's scopes as snapshots and `permdock cloud push` carry them, with the resources each partitions. */
+function snapshotScopes(policy) {
+	if (policy.scopes.length === 0) return;
+	const resources = [...policy.resources.values()];
+	return policy.scopes.map((scope) => {
+		const partitioned = resources.filter((node) => partitionsOf(node, policy.scopes).includes(scope.name)).map((node) => node.name);
+		return compact({
+			name: scope.name,
+			key: scope.key ?? "",
+			within: scope.within,
+			resources: partitioned.length === 0 ? void 0 : partitioned
+		});
+	});
+}
+function buildInstance(policy, subject, envBase, team) {
+	const listeners = emptyListeners();
+	const queuedAuth = [...envBase.queuedAuth];
+	const queuedErrors = [...envBase.queuedErrors ?? []];
+	const customGrants = customGrantsFor(policy, envBase.customRoles);
+	const relationCache = envBase.relationCache ?? /* @__PURE__ */ new Map();
+	const relations = relationReader(envBase.relations, relationCache, policy.resources);
+	const assignableAt = (tenant) => assignableIn(policy, subject, envBase.customRoles, customGrants, tenant, tenant === void 0 ? void 0 : envBase.assignable?.get(tenant));
+	const envFor = (emit, skipAlternatives = false) => ({
+		emit,
+		simulated: envBase.simulated,
+		skipAlternatives,
+		customRoles: envBase.customRoles,
+		customGrants,
+		listeners,
+		sink: envBase.sink,
+		limits: envBase.limits,
+		limitCache: envBase.limitCache,
+		team,
+		relations,
+		...envBase.approvalPolicies === void 0 ? {} : { approvalPolicies: envBase.approvalPolicies }
+	});
+	/** The one `simulate` event for a batch: the worst decision, with the counts. */
+	const simulateEvent = (evaluated) => {
+		const counts = {
+			granted: 0,
+			denied: 0,
+			approvalRequired: 0
+		};
+		for (const [, , decision] of evaluated) if (decision.outcome === "granted") counts.granted += 1;
+		else if (decision.outcome === "approval-required") counts.approvalRequired += 1;
+		else counts.denied += 1;
+		const worst = evaluated.find(([, , decision]) => decision.outcome === "denied") ?? evaluated.find(([, , decision]) => decision.outcome === "approval-required") ?? evaluated[0];
+		if (worst === void 0) return;
+		const [permission, data, decision] = worst;
+		finish(policy, subject, permission, data, decision, {
+			source: "simulate",
+			trusted: true
+		}, {
+			...envFor(false),
+			emit: true
+		}, true, void 0, counts);
+	};
+	const decideImpl = (permission, data, options) => evaluate(policy, subject, permission, data, options ?? {}, envFor(options?.source !== "simulate", options?.source === "can"));
+	const explainImpl = (permission, data, options) => {
+		return decideImpl(permission, data, {
+			...options,
+			source: options?.source ?? "explain",
+			explain: true
+		});
+	};
+	const canImpl = (permission, data, options) => {
+		try {
+			return decideImpl(permission, data, {
+				...options,
+				source: options?.source ?? "can"
+			}).outcome === "granted";
+		} catch {
+			return false;
+		}
+	};
+	const assertImpl = (permission, data, options) => {
+		const decision = decideImpl(permission, data, {
+			...options,
+			source: options?.source ?? "assert"
+		});
+		if (decision.outcome === "granted") return decision;
+		const onDenied = options?.onDenied ?? policy.onDenied;
+		if (onDenied !== void 0) onDenied(decision);
+		const resource = getResource(policy.permissions, permission.resource);
+		const resourceId = data !== null && typeof data === "object" ? data[resource?.id ?? "id"] : void 0;
+		const resourceRef = compact({
+			type: permission.resource,
+			id: resourceId === void 0 ? void 0 : String(resourceId)
+		});
+		if (decision.outcome === "approval-required") throw new PermDockApprovalRequiredError({
+			decision,
+			permission: permission.key,
+			scope: permission.scope,
+			resource: resourceRef,
+			message: approvalMessage(permission.key, decision.reason, decision.token)
+		});
+		if (decision.denials.some((denial) => denial.reason === "validation")) {
+			const detail = decision.denials[0]?.detail;
+			if (detail instanceof PermDockValidationError) throw detail;
+		}
+		throw new PermDockDeniedError({
+			decision,
+			permission: permission.key,
+			scope: permission.scope,
+			resource: resourceRef,
+			subject,
+			message: deniedMessage(permission.key, subject.principal?.id, decision.denials, decision.alternatives.map((leaf) => leaf.key))
+		});
+	};
+	const instance = {
+		can: canImpl,
+		decide: decideImpl,
+		assert: assertImpl,
+		explain: explainImpl,
+		permissions: policy.permissions,
+		roles: policy.vocabulary?.roles ?? {},
+		plans: policy.vocabulary?.plans ?? {},
+		filter(permission, rows, options) {
+			const allowed = [];
+			let granted = 0;
+			let denied = 0;
+			let approvalRequired = 0;
+			const quiet = envFor(false);
+			const trusted = options?.trusted ?? true;
+			const decideOptions = {
+				...options,
+				source: "filter",
+				trusted
+			};
+			for (const row of rows) {
+				const decision = evaluate(policy, subject, permission, row, decideOptions, quiet);
+				if (decision.outcome === "granted") {
+					allowed.push(row);
+					granted += 1;
+				} else if (decision.outcome === "approval-required") approvalRequired += 1;
+				else denied += 1;
+			}
+			const summary = granted > 0 ? freezeDeep({
+				outcome: "granted",
+				subject,
+				matched: {
+					role: "*",
+					permission: permission.key
+				},
+				token: "pd1.filter"
+			}) : freezeDeep({
+				outcome: "denied",
+				denials: [{
+					role: null,
+					reason: "no-grant"
+				}],
+				alternatives: []
+			});
+			finish(policy, subject, permission, rows[0], summary, decideOptions, {
+				...quiet,
+				emit: true
+			}, trusted, void 0, {
+				granted,
+				denied,
+				approvalRequired
+			});
+			return allowed;
+		},
+		pick(permission, row, options) {
+			if (row === null || typeof row !== "object") return {};
+			if (canImpl(permission, row, options) !== true) return {};
+			return pickVisible(row, (field) => {
+				const next = compact({
+					...options,
+					field
+				});
+				return canImpl(permission, row, next) === true;
+			});
+		},
+		where(permission) {
+			const grants = collectSnapshotGrants(policy, subject, envBase.customRoles, nowSeconds(), customGrants).filter((item) => item.grant.permission.key === permission.key).map((item) => snapshotGrant(whereGrant(item.grant), item.membership));
+			return whereFromGrants(grants, compact({
+				resource: permission.resource,
+				resources: policy.resources,
+				graph: envBase.relations !== void 0,
+				scopes: scopeList(policy.scopes),
+				partitioned: (name, key) => relatesTo(getResource(policy.permissions, permission.resource), key, name, scopeList(policy.scopes)),
+				tenant: subject.principal?.tenant,
+				team,
+				now: nowSeconds(),
+				subject
+			}));
+		},
+		actions(resource, data, options) {
+			const fromTree = listPermissions(resource);
+			return (fromTree.length > 0 ? fromTree : "resource" in resource && typeof resource.resource === "string" ? listPermissions(policy.permissions).filter((item) => item.resource === resource.resource) : []).filter((item) => canImpl(item, data, options) === true);
+		},
+		async loadRelations(permission, rows) {
+			if (envBase.relations === void 0) return;
+			const quiet = {
+				...envFor(false),
+				simulated: true,
+				skipAlternatives: true
+			};
+			for (let round = 0; round < LOAD_ROUNDS; round += 1) {
+				for (const row of rows) evaluate(policy, subject, permission, row, {
+					source: "simulate",
+					trusted: true
+				}, quiet);
+				const pending = pendingRelations(relationCache);
+				if (pending.length === 0) return;
+				await Promise.all(pending);
+			}
+		},
+		whoCan(permission, row) {
+			return whoCan({
+				policy,
+				permission,
+				row,
+				memberships: envBase.memberships,
+				reader: relations,
+				cache: relationCache,
+				customGrants,
+				team
+			});
+		},
+		simulate: ((input, options) => {
+			const evaluated = [];
+			const quietly = (permission, data) => {
+				const decision = evaluate(policy, subject, permission, data, compact({
+					source: "simulate",
+					trusted: true,
+					now: options?.now
+				}), envFor(false));
+				evaluated.push([
+					permission,
+					data,
+					decision
+				]);
+				return decision;
+			};
+			if (isReadonlyArray(input)) {
+				const decisions = input.map(([permission, data]) => quietly(permission, data));
+				simulateEvent(evaluated);
+				return decisions;
+			}
+			if (isArazzoSimulateInput(input)) {
+				const plan = simulateArazzo(input, input.permissions ?? policy.permissions, quietly);
+				simulateEvent(evaluated);
+				return plan;
+			}
+			const preview = input;
+			const previewRoles = preview.roles?.map((item) => typeof item === "string" ? item : item.key);
+			const kinds = subject.principal === null ? void 0 : applyRoleKinds(policy, previewRoles ?? subject.principal.roles, preview.memberships === void 0 ? subject.principal.memberships ?? [] : normalizeMemberships(preview.memberships, scopeList(policy.scopes)));
+			const previewPrincipal = subject.principal === null || kinds === void 0 ? null : freezeDeep(compact({
+				...subject.principal,
+				roles: kinds.roles,
+				memberships: preview.memberships === void 0 && subject.principal.memberships === void 0 ? void 0 : kinds.memberships,
+				tenant: preview.tenant ?? subject.principal.tenant
+			}));
+			return buildInstance(policy, freezeDeep({
+				...subject,
+				principal: previewPrincipal
+			}), {
+				...envBase,
+				simulated: true,
+				relationCache
+			}, team);
+		}),
+		snapshot(options) {
+			const snapshot = snapshotOf(policy, subject, compact({
+				customRoles: envBase.customRoles,
+				customGrants,
+				assignable: envBase.assignable,
+				include: options?.include,
+				tenants: options?.tenants,
+				simulated: envBase.simulated
+			}));
+			if (options?.signer !== void 0) return signSnapshot(snapshot, options.signer, options.audience);
+			return snapshot;
+		},
+		on(event, handler) {
+			const set = listeners[event];
+			set.add(handler);
+			if (event === "auth") for (const queued of queuedAuth) try {
+				handler(queued);
+			} catch (error) {
+				emitSafe(listeners.error, error, listeners);
+			}
+			if (event === "error") for (const queued of queuedErrors) try {
+				handler(queued);
+			} catch {}
+			return () => {
+				set.delete(handler);
+			};
+		},
+		tenant(id) {
+			if (subject.principal === null) return buildInstance(policy, subject, {
+				...envBase,
+				relationCache
+			}, team);
+			return buildInstance(policy, freezeDeep(compact({
+				...subject,
+				principal: compact({
+					...subject.principal,
+					tenant: resolveActiveTenant(subject.principal, id, scopeList(policy.scopes))
+				})
+			})), {
+				...envBase,
+				relationCache
+			}, team);
+		},
+		team(id) {
+			return buildInstance(policy, subject, {
+				...envBase,
+				relationCache
+			}, id);
+		},
+		memberships() {
+			return subject.principal?.memberships ?? [];
+		},
+		tenants() {
+			return tenantsOf(subject.principal, scopeList(policy.scopes));
+		},
+		heldRoles(options) {
+			return heldRoleNames(policy, subject, options?.tenant ?? subject.principal?.tenant, options?.scope === void 0 ? void 0 : compact({
+				scope: options.scope,
+				id: options.id
+			})).map((name) => roleLeaf(policy, name));
+		},
+		audiences() {
+			return audiencesOf(policy, heldRoleNames(policy, subject, subject.principal?.tenant));
+		},
+		assignableRoles(options) {
+			return assignableAt(options?.tenant ?? subject.principal?.tenant).roles;
+		},
+		assignablePermissions(options) {
+			if (options?.scope === "global") return assignableIn(policy, subject, envBase.customRoles, customGrants, void 0, void 0, nowSeconds(), true).permissions;
+			const tenant = options?.tenant ?? subject.principal?.tenant;
+			return tenant === void 0 ? [] : assignableAt(tenant).permissions;
+		},
+		decideRoleChange(change, options) {
+			return decideRoleChange(policy, subject.principal, scopeList(policy.scopes), change, (tenant) => {
+				const found = assignableAt(tenant);
+				return {
+					assignable: new Set(found.roles.map((leaf) => leaf.key)),
+					manage: found.manage
+				};
+			}, nowSeconds(), options);
+		},
+		activate(input) {
+			return activate(policy, subject, input, nowSeconds());
+		},
+		subject
+	};
+	return Object.freeze(instance);
+}
+//#endregion
+//#region src/core/resolve-subject.ts
+function assemblePrincipal(policy, user, options, auth) {
+	let principal;
+	let context = {};
+	let actor = options.actor;
+	let delegation = options.delegation;
+	let session = options.session;
+	let expiresAt = options.expiresAt;
+	try {
+		if (user === null || user === void 0) principal = policy.subject(user);
+		else if (isSubject(user)) {
+			principal = user.principal;
+			context = user.context;
+			actor = user.actor ?? actor;
+			delegation = user.delegation ?? delegation;
+			session = user.session ?? session;
+			expiresAt = user.expiresAt ?? expiresAt;
+		} else if (isPrincipal(user)) principal = user;
+		else principal = policy.subject(user);
+	} catch {
+		principal = null;
+	}
+	const contextResult = resolveContext(policy, user, context, auth);
+	let memberships = principal?.memberships ?? [];
+	let live = false;
+	const source = options.memberships === void 0 ? void 0 : asMembershipSource(options.memberships);
+	const fromClaims = source?.claimsFirst === true && principal?.memberships !== void 0 && principal.membershipsTruncated !== true;
+	if (principal !== null && source !== void 0 && !fromClaims) {
+		live = true;
+		try {
+			memberships = source.membershipsFor(compact({
+				id: principal.id,
+				kind: principal.kind
+			}), compact({ tenant: options.tenant }));
+		} catch {
+			auth.push({
+				reason: "source-threw",
+				source: "memberships"
+			});
+			memberships = [];
+		}
+	}
+	return {
+		principal,
+		context: contextResult,
+		actor,
+		delegation,
+		session,
+		expiresAt,
+		memberships,
+		live
+	};
+}
+function finishSubject(policy, assembled, context, input, options, extra) {
+	if (assembled.principal === null) return freezeCopy(compact({
+		...anonymousSubject(context),
+		actor: assembled.actor,
+		delegation: assembled.delegation,
+		session: assembled.session,
+		expiresAt: assembled.expiresAt
+	}));
+	const scopes = scopeList(policy.scopes);
+	const { roles, memberships } = applyRoleKinds(policy, assembled.principal.roles, normalizeMemberships(input, scopes));
+	const plans = [.../* @__PURE__ */ new Set([...assembled.principal.plans ?? [], ...extra.plans])];
+	const withMemberships = freezeCopy(compact({
+		...assembled.principal,
+		roles,
+		memberships,
+		plans: plans.length === 0 ? assembled.principal.plans : plans,
+		tenant: activeTenantOf(policy, assembled, memberships, options)
+	}));
+	return freezeCopy(compact({
+		principal: withMemberships,
+		actor: assembled.actor,
+		delegation: assembled.delegation,
+		context: freezeCopy(context),
+		session: assembled.session,
+		expiresAt: assembled.expiresAt,
+		stale: extra.stale ? true : void 0
+	}));
+}
+function activeTenantOf(policy, assembled, memberships, options) {
+	if (assembled.principal === null) return;
+	return resolveActiveTenant({
+		...assembled.principal,
+		memberships
+	}, options.tenant ?? assembled.principal.tenant, scopeList(policy.scopes));
+}
+function settle(value, fallback, onError) {
+	if (isThenable(value)) return Promise.resolve(value).catch(() => {
+		onError();
+		return fallback;
+	});
+	return value;
+}
+/**
+* Whether the token's memberships are behind the source for `fresh`
+* permissions. Live memberships are never stale; token memberships are stale
+* unless a source reports a version the token's `authzVersion` has reached.
+*/
+function staleness(policy, assembled, options, auth) {
+	const principal = assembled.principal;
+	if ((policy.fresh ?? []).length === 0 || principal === null || assembled.live) return false;
+	const source = options.memberships === void 0 ? void 0 : asMembershipSource(options.memberships);
+	const claimed = principal.authzVersion;
+	if (source?.version === void 0 || typeof claimed !== "number") return true;
+	const compare = (current) => current === void 0 || claimed < current;
+	try {
+		const current = source.version({ id: principal.id });
+		return isThenable(current) ? settle(Promise.resolve(current).then(compare), true, () => {
+			auth.push({
+				reason: "source-threw",
+				source: "memberships"
+			});
+		}) : compare(current);
+	} catch {
+		auth.push({
+			reason: "source-threw",
+			source: "memberships"
+		});
+		return true;
+	}
+}
+function cleanNames(list) {
+	return Array.isArray(list) ? list.filter((item) => typeof item === "string" && item !== "") : [];
+}
+function entitlementsOf(assembled, tenant, options, auth) {
+	const source = options.entitlements;
+	if (source === void 0 || assembled.principal === null) return [];
+	try {
+		const found = source.entitlementsFor({ id: assembled.principal.id }, compact({ tenant }));
+		return isThenable(found) ? settle(Promise.resolve(found).then(cleanNames), [], () => {
+			auth.push({
+				reason: "source-threw",
+				source: "entitlements"
+			});
+		}) : cleanNames(found);
+	} catch {
+		auth.push({
+			reason: "source-threw",
+			source: "entitlements"
+		});
+		return [];
+	}
+}
+function resolveContext(policy, user, fallback, auth) {
+	if (policy.context === void 0) return sanitizeContext(fallback);
+	try {
+		const loaded = policy.context(user);
+		if (isThenable(loaded)) return loaded.then((value) => sanitizeContext(value), () => {
+			auth.push({
+				reason: "source-threw",
+				source: "context"
+			});
+			return {};
+		});
+		return sanitizeContext(loaded);
+	} catch {
+		auth.push({
+			reason: "source-threw",
+			source: "context"
+		});
+		return {};
+	}
+}
+function resolveSubject(policy, user, options, auth) {
+	const assembled = assemblePrincipal(policy, user, options, auth);
+	const memberships = settle(assembled.memberships, [], () => {
+		auth.push({
+			reason: "source-threw",
+			source: "memberships"
+		});
+	});
+	const stale = staleness(policy, assembled, options, auth);
+	const withPlans = (resolved) => entitlementsOf(assembled, activeTenantOf(policy, assembled, applyRoleKinds(policy, assembled.principal?.roles, normalizeMemberships(resolved, scopeList(policy.scopes))).memberships, options), options, auth);
+	if (isThenable(assembled.context) || isThenable(memberships) || isThenable(stale)) return Promise.all([
+		Promise.resolve(assembled.context),
+		Promise.resolve(memberships),
+		Promise.resolve(stale)
+	]).then(async ([context, resolved, isStale]) => finishSubject(policy, assembled, context, resolved, options, {
+		stale: isStale,
+		plans: await withPlans(resolved)
+	}));
+	const plans = withPlans(memberships);
+	if (isThenable(plans)) return Promise.resolve(plans).then((resolved) => finishSubject(policy, assembled, assembled.context, memberships, options, {
+		stale,
+		plans: resolved
+	}));
+	return finishSubject(policy, assembled, assembled.context, memberships, options, {
+		stale,
+		plans
+	});
+}
+//#endregion
+//#region src/core/permdock.ts
+function hostedPolicy(policy, source) {
+	if (source === void 0 || policy.hostable.length === 0) return {
+		policy,
+		errors: []
+	};
+	let document;
+	try {
+		document = source.current();
+	} catch (error) {
+		return {
+			policy,
+			errors: [error]
+		};
+	}
+	const merged = mergeHostedGrants(policy, document);
+	return {
+		policy: merged.policy,
+		errors: merged.dropped
+	};
+}
+function instantiate(codePolicy, subject, options, auth) {
+	const { policy, errors } = hostedPolicy(codePolicy, options.policies);
+	const tenants = tenantsOf(subject.principal, scopeList(policy.scopes));
+	const customRoles = customRolesFor(options.customRoles, tenants, auth, subject.principal !== null);
+	const assignable = assignableNamesFor(options.customRoles, tenants, auth);
+	const approvals = approvalPoliciesFor(policy, options.approvalPolicies, tenants, auth);
+	const build = (roles, names, approvalPolicies) => buildInstance(policy, subject, compact({
+		customRoles: roles,
+		sink: options.sink,
+		limits: options.limits,
+		limitCache: /* @__PURE__ */ new Map(),
+		simulated: false,
+		roleSource: options.customRoles,
+		assignable: names,
+		queuedAuth: auth,
+		queuedErrors: errors,
+		relations: options.relations,
+		approvalPolicies,
+		memberships: options.memberships === void 0 ? void 0 : asMembershipSource(options.memberships)
+	}));
+	if (isThenable(customRoles) || isThenable(assignable) || isThenable(approvals)) return Promise.all([
+		customRoles,
+		assignable,
+		approvals
+	]).then(([roles, names, loaded]) => build(roles, names, loaded));
+	return build(customRoles, assignable, approvals);
+}
+function createPermDock(policy, user, options = {}) {
+	const auth = [];
+	const subject = resolveSubject(policy, user, options, auth);
+	if (isThenable(subject)) return subject.then((resolved) => instantiate(policy, resolved, options, auth));
+	return instantiate(policy, subject, options, auth);
+}
+//#endregion
+export { approvalPoliciesFor as _, snapshotScopes as a, supportAccess as c, membershipsClaim as d, resolveCustomRole as f, isExternallyManaged as g, composeMemberships as h, snapshotOf as i, customRoleClaim as l, claimsFirst as m, resolveSubject as n, declaredRoleNames as o, validateCustomRole as p, collectSnapshotGrants as r, breakGlass as s, createPermDock as t, customRoleScope as u, memoryApprovalPolicies as v };