permdock 0.0.0 → 0.1.0

package/dist/react-native/index.js

@@ -0,0 +1,174 @@
+"use client";
+import { t as compact } from "../compact-y6vfu2_f.js";
+import { n as requiredPlans, t as describe } from "../describe-Bt1YD5uS.js";
+import { n as parseSnapshot } from "../snapshot-DE8dE_hz.js";
+import { t as emptySnapshot } from "../from-snapshot-BMGnhmgv.js";
+import { t as approvalHeaders } from "../headers-B5RRv3Xm.js";
+import { n as PermDockStoreContext } from "../context-gtAwAILx.js";
+import { a as useFilter, c as usePermission, d as useSubject, f as useTenant, i as useAssignableRoles, l as usePermissions, n as useApproval, o as useMemberships, r as useAssignablePermissions, s as usePermDock, t as Protected, u as useRoles } from "../protected-B4K3BKoX.js";
+import { t as createClientStore } from "../store-C6hFW6ta.js";
+import { useEffect, useMemo } from "react";
+import { jsx } from "react/jsx-runtime";
+//#region src/react-native/storage.ts
+const SNAPSHOT_KEY = "permdock.snapshot";
+const TENANT_KEY = "permdock.tenant";
+function memoryStorage(initial = {}) {
+	const map = new Map(Object.entries(initial));
+	return {
+		getItem(key) {
+			return map.get(key) ?? null;
+		},
+		setItem(key, value) {
+			map.set(key, value);
+		},
+		removeItem(key) {
+			map.delete(key);
+		}
+	};
+}
+function isThenable(value) {
+	return typeof value === "object" && value !== null && "then" in value && typeof value.then === "function";
+}
+function acceptSnapshot(raw, subjectId) {
+	if (raw === null || raw.length === 0) return;
+	try {
+		const parsed = JSON.parse(raw);
+		const snapshot = parseSnapshot(parsed);
+		const id = snapshot.subject.principal?.id;
+		if (subjectId !== void 0 && id !== subjectId) return;
+		return snapshot;
+	} catch {
+		return;
+	}
+}
+async function readStored(storage, subjectId) {
+	const raw = await Promise.resolve(storage.getItem(SNAPSHOT_KEY));
+	const tenantRaw = await Promise.resolve(storage.getItem(TENANT_KEY));
+	return {
+		snapshot: acceptSnapshot(raw, subjectId),
+		tenant: tenantRaw === null || tenantRaw.length === 0 ? void 0 : tenantRaw
+	};
+}
+function readStoredSync(storage, subjectId) {
+	const raw = storage.getItem(SNAPSHOT_KEY);
+	const tenantRaw = storage.getItem(TENANT_KEY);
+	if (isThenable(raw) || isThenable(tenantRaw)) return;
+	return {
+		snapshot: acceptSnapshot(raw, subjectId),
+		tenant: tenantRaw === null || tenantRaw.length === 0 ? void 0 : tenantRaw
+	};
+}
+function persistSnapshot(storage, snapshot, tenant) {
+	const write = storage.setItem(SNAPSHOT_KEY, JSON.stringify(snapshot));
+	if (isThenable(write)) write.catch(() => void 0);
+	if (tenant === void 0) return;
+	const next = storage.setItem(TENANT_KEY, tenant);
+	if (isThenable(next)) next.catch(() => void 0);
+}
+function clearStorage(storage) {
+	const snap = storage.removeItem(SNAPSHOT_KEY);
+	if (isThenable(snap)) snap.catch(() => void 0);
+	const tenant = storage.removeItem(TENANT_KEY);
+	if (isThenable(tenant)) tenant.catch(() => void 0);
+}
+//#endregion
+//#region src/react-native/store.ts
+function isJws(value) {
+	const parts = value.split(".");
+	return parts.length === 3 && parts.every((part) => part.length > 0);
+}
+function createNativeStore(options) {
+	const signed = typeof options.snapshot === "string" && isJws(options.snapshot) ? options.snapshot : void 0;
+	const seeded = options.snapshot === void 0 || signed !== void 0 ? void 0 : typeof options.snapshot === "string" ? acceptSnapshot(options.snapshot, options.subjectId) : acceptSnapshot(JSON.stringify(options.snapshot), options.subjectId);
+	const sync = signed === void 0 ? readStoredSync(options.storage, options.subjectId) : void 0;
+	const snapshot = signed ?? seeded ?? sync?.snapshot ?? emptySnapshot();
+	const tenant = options.tenant ?? sync?.tenant;
+	let booted = false;
+	let touched = false;
+	const store = createClientStore(compact({
+		snapshot,
+		endpoint: options.endpoint,
+		snapshotUrl: options.snapshotUrl,
+		approvals: options.approvals,
+		tenant,
+		fetch: options.fetch,
+		headers: options.headers,
+		maxAge: options.maxAge,
+		verifier: options.verifier,
+		server: false,
+		onSnapshot: (next, nextTenant) => {
+			if (!booted) return;
+			touched = true;
+			persistSnapshot(options.storage, next, nextTenant);
+		},
+		onClear: () => {
+			touched = true;
+			clearStorage(options.storage);
+		}
+	}));
+	booted = true;
+	if (seeded !== void 0) persistSnapshot(options.storage, seeded, tenant);
+	if (sync === void 0 && seeded === void 0 && signed === void 0) readStored(options.storage, options.subjectId).then((stored) => {
+		if (!touched && stored.snapshot !== void 0) store.replace(stored.snapshot);
+	});
+	return store;
+}
+//#endregion
+//#region src/react-native/provider.tsx
+function PermDockProvider(props) {
+	const store = useMemo(() => createNativeStore(compact({
+		storage: props.storage,
+		snapshot: props.snapshot,
+		snapshotUrl: props.snapshotUrl,
+		endpoint: props.endpoint,
+		approvals: props.approvals,
+		tenant: props.tenant,
+		subjectId: props.subjectId,
+		revalidate: props.revalidate,
+		subscribeForeground: props.subscribeForeground,
+		fetch: props.fetch,
+		headers: props.headers,
+		maxAge: props.maxAge,
+		verifier: props.verifier
+	})), [
+		props.storage,
+		props.snapshot,
+		props.snapshotUrl,
+		props.endpoint,
+		props.approvals,
+		props.tenant,
+		props.subjectId,
+		props.revalidate,
+		props.subscribeForeground,
+		props.fetch,
+		props.headers,
+		props.maxAge,
+		props.verifier
+	]);
+	useEffect(() => {
+		const mode = props.revalidate ?? "launch";
+		const refresh = () => {
+			if (props.snapshotUrl === void 0) return;
+			store.get().refresh().catch(() => void 0);
+		};
+		if (mode === "launch" || mode === "focus" || typeof mode === "number") refresh();
+		if (typeof mode === "number") {
+			const timer = setInterval(refresh, mode * 1e3);
+			return () => {
+				clearInterval(timer);
+			};
+		}
+		if (mode === "focus" && props.subscribeForeground !== void 0) return props.subscribeForeground(refresh);
+	}, [
+		store,
+		props.revalidate,
+		props.snapshotUrl,
+		props.subscribeForeground
+	]);
+	return /* @__PURE__ */ jsx(PermDockStoreContext, {
+		value: store,
+		children: props.children
+	});
+}
+//#endregion
+export { PermDockProvider, Protected, approvalHeaders, createNativeStore, describe, memoryStorage, requiredPlans, useApproval, useAssignablePermissions, useAssignableRoles, useFilter, useMemberships, usePermDock, usePermission, usePermissions, useRoles, useSubject, useTenant };

package/dist/refs-ChLSxbST.js

@@ -0,0 +1,90 @@
+import { n as freezeDeep } from "./freeze-y1_jQL4v.js";
+import { E as splitPath, T as readPath, x as assertSafeKey } from "./permissions-DC7GROPA.js";
+//#region src/conditions/ast.ts
+function parentHop(parent) {
+	return typeof parent === "string" ? { field: parent } : parent;
+}
+function isConditionRef(value) {
+	return value !== null && typeof value === "object" && "ref" in value && typeof value.ref === "string";
+}
+function isConditionDate(value) {
+	return value !== null && typeof value === "object" && "date" in value && typeof value.date === "string" && !("ref" in value);
+}
+function isCondition(value) {
+	return value !== null && typeof value === "object" && "op" in value && typeof value.op === "string";
+}
+function isSqlFunctionField(value) {
+	return value !== null && typeof value === "object" && "field" in value && typeof value.field === "string" && !("ref" in value) && !("date" in value) && !("op" in value);
+}
+function hasConditionOp(condition, op) {
+	if (condition === void 0) return false;
+	if (condition.op === op) return true;
+	switch (condition.op) {
+		case "and":
+		case "or": return condition.conditions.some((child) => hasConditionOp(child, op));
+		case "not": return hasConditionOp(condition.condition, op);
+		case "sqlFunction": return hasConditionOp(condition.twin, op);
+		case "eq":
+		case "ne":
+		case "gt":
+		case "gte":
+		case "lt":
+		case "lte":
+		case "contains":
+		case "in":
+		case "notIn":
+		case "isNull":
+		case "memberOf":
+		case "related":
+		case "opaque": return false;
+		default:
+ /* v8 ignore next */
+		return condition;
+	}
+}
+//#endregion
+//#region src/conditions/refs.ts
+const REF_BRAND = Symbol.for("permdock.ref");
+function createRef(path) {
+	const segments = splitPath(path);
+	for (const segment of segments) assertSafeKey(segment, "subject path");
+	const target = freezeDeep({ ref: path });
+	return new Proxy(target, {
+		get(object, property, receiver) {
+			if (property === "ref" || property === REF_BRAND) return Reflect.get(object, property === REF_BRAND ? "ref" : property, receiver);
+			if (property === "toJSON" || property === "valueOf" || property === Symbol.toStringTag) return;
+			if (typeof property !== "string") return;
+			assertSafeKey(property, "subject path");
+			return createRef(`${path}.${property}`);
+		},
+		getOwnPropertyDescriptor(object, property) {
+			if (property === "ref") return Reflect.getOwnPropertyDescriptor(object, property);
+		},
+		ownKeys() {
+			return ["ref"];
+		}
+	});
+}
+const principal = createRef("principal");
+const context = createRef("context");
+function isSubjectRef(value) {
+	if (value === null || typeof value !== "object" || !("ref" in value) || typeof value.ref !== "string") return false;
+	const ref = value.ref;
+	return ref === "principal" || ref.startsWith("principal.") || ref === "context" || ref.startsWith("context.");
+}
+function resolveConditionRef(ref, resolved) {
+	if (resolved === void 0) return;
+	if (ref === "principal" || ref.startsWith("principal.")) {
+		const path = ref === "principal" ? "" : ref.slice(10);
+		if (path === "") return resolved.principal;
+		if (resolved.principal === null) return;
+		return readPath(resolved.principal, path);
+	}
+	if (ref === "context" || ref.startsWith("context.")) {
+		const path = ref === "context" ? "" : ref.slice(8);
+		if (path === "") return resolved.context;
+		return readPath(resolved.context, path);
+	}
+}
+//#endregion
+export { hasConditionOp as a, isConditionRef as c, resolveConditionRef as i, isSqlFunctionField as l, isSubjectRef as n, isCondition as o, principal as r, isConditionDate as s, context as t, parentHop as u };

package/dist/relations-r4soIFZB.js

@@ -0,0 +1,426 @@
+import { C as ownGet, l as isComputedRelation, p as isPrincipalRelation, r as expandRelation, s as getRegistry, u as isEdgeRelation } from "./permissions-DC7GROPA.js";
+import { n as isThenable } from "./thenable-okc2xDsj.js";
+function isRecord(value) {
+	return value !== null && typeof value === "object" && !Array.isArray(value);
+}
+function isInstant(value) {
+	return value === void 0 || typeof value === "number" && Number.isFinite(value);
+}
+function asChain(value) {
+	if (!isRecord(value) || !Array.isArray(value["ancestors"])) return;
+	const ancestors = [];
+	for (const item of value["ancestors"]) {
+		if (!isRecord(item) || typeof item["id"] !== "string" || item["id"] === "") return;
+		ancestors.push(item["restricted"] === true ? {
+			id: item["id"],
+			restricted: true
+		} : { id: item["id"] });
+	}
+	return {
+		ancestors,
+		...value["restricted"] === true ? { restricted: true } : {},
+		...value["truncated"] === true ? { truncated: true } : {}
+	};
+}
+function asGroup(value) {
+	if (!isRecord(value) || typeof value["resource"] !== "string" || typeof value["id"] !== "string" || typeof value["relation"] !== "string" || value["id"] === "") return;
+	return {
+		resource: value["resource"],
+		id: value["id"],
+		relation: value["relation"]
+	};
+}
+function asHolders(value) {
+	if (!Array.isArray(value)) return;
+	const holders = [];
+	for (const item of value) {
+		if (!isRecord(item) || !isInstant(item["startsAt"]) || !isInstant(item["expiresAt"])) return;
+		const period = {
+			...item["startsAt"] === void 0 ? {} : { startsAt: item["startsAt"] },
+			...item["expiresAt"] === void 0 ? {} : { expiresAt: item["expiresAt"] }
+		};
+		if (isRecord(item["principal"]) && typeof item["principal"]["id"] === "string") {
+			holders.push({
+				principal: { id: item["principal"]["id"] },
+				...period
+			});
+			continue;
+		}
+		const group = asGroup(item["group"]);
+		if (group === void 0) return;
+		holders.push({
+			group,
+			...period
+		});
+	}
+	return holders;
+}
+function read(cache, key, call, validate) {
+	const entry = cache.get(key);
+	if (entry !== void 0) return entry.state === "ready" ? entry.value : entry.state;
+	if (call === void 0) return "failed";
+	const settle = (value) => {
+		const valid = validate(value);
+		cache.set(key, valid === void 0 ? { state: "failed" } : {
+			state: "ready",
+			value: valid
+		});
+	};
+	let result;
+	try {
+		result = call();
+	} catch {
+		cache.set(key, { state: "failed" });
+		return "failed";
+	}
+	if (isThenable(result)) {
+		const promise = Promise.resolve(result).then(settle, () => {
+			cache.set(key, { state: "failed" });
+		});
+		cache.set(key, {
+			state: "pending",
+			promise
+		});
+		return "pending";
+	}
+	settle(result);
+	const settled = cache.get(key);
+	return settled?.state === "ready" ? settled.value : "failed";
+}
+function relationReader(source, cache, resources) {
+	const concrete = (resource, id, relation) => read(cache, JSON.stringify([
+		"holders",
+		resource,
+		id,
+		relation
+	]), source === void 0 ? void 0 : () => source.related({
+		resource,
+		id,
+		relation
+	}), asHolders);
+	return {
+		available: source !== void 0,
+		chain(query) {
+			const through = query.through ?? "parent";
+			return read(cache, JSON.stringify([
+				"chain",
+				query.resource,
+				query.id,
+				query.depth,
+				through
+			]), source === void 0 ? void 0 : () => source.ancestors({
+				resource: query.resource,
+				id: query.id,
+				depth: query.depth,
+				through
+			}), asChain);
+		},
+		holders(query) {
+			const node = resources?.get(query.resource);
+			const names = node === void 0 ? [query.relation] : expandRelation(node, query.relation);
+			const out = [];
+			let unread;
+			for (const name of names) {
+				const answer = concrete(query.resource, query.id, name);
+				if (answer === "pending" || answer === "failed") {
+					unread = answer === "failed" || unread === "failed" ? "failed" : "pending";
+					continue;
+				}
+				for (const holder of answer) out.push({
+					...holder,
+					relation: name
+				});
+			}
+			return unread ?? out;
+		}
+	};
+}
+/** The loads still in flight, for an instance that awaits them before deciding. */
+function pendingRelations(cache) {
+	const out = [];
+	for (const entry of cache.values()) if (entry.state === "pending") out.push(entry.promise);
+	return out;
+}
+function relationId(value) {
+	if (typeof value === "string") return value === "" ? void 0 : value;
+	if (typeof value === "number" && Number.isFinite(value)) return String(value);
+	if (typeof value === "bigint") return String(value);
+}
+/** Whether the holder's period covers `now`. */
+function activeNow(holder, now) {
+	return (holder.startsAt === void 0 || holder.startsAt <= now) && (holder.expiresAt === void 0 || holder.expiresAt > now);
+}
+function holdsNow(holder, principalId, now) {
+	return "principal" in holder && holder.principal.id === principalId && activeNow(holder, now);
+}
+/** Where the walk starts after following `hops`, or why it cannot. */
+function followHops(condition, first, reader) {
+	const hops = condition.hops ?? [];
+	let id = first;
+	for (let index = 1; index < hops.length; index += 1) {
+		const from = hops[index - 1];
+		const hop = hops[index];
+		if (from === void 0 || hop === void 0)
+ /* v8 ignore next */
+		return;
+		const chain = reader.chain({
+			resource: from.resource,
+			id,
+			depth: 1,
+			through: hop.link
+		});
+		if (chain === "pending" || chain === "failed") return "relation-unavailable";
+		const next = chain.ancestors[0]?.id;
+		if (next === void 0) return;
+		id = next;
+	}
+	return { id };
+}
+/** The instances a graph relation reads: the start, then ancestors until a restricted one or `depth`. */
+function relationWalk(condition, row, reader) {
+	if (!isRecord(row)) return;
+	const first = relationId(ownGet(row, condition.field));
+	if (first === void 0) return;
+	const rowRestricted = condition.restricted !== void 0 && ownGet(row, condition.restricted) === true;
+	const hopped = condition.hops !== void 0 && condition.hops.length > 0;
+	if ((condition.parent === true || hopped) && rowRestricted) return;
+	const start = hopped ? followHops(condition, first, reader) : { id: first };
+	if (start === void 0 || start === "relation-unavailable") return start;
+	const id = start.id;
+	if (condition.depth === 0 || rowRestricted) return {
+		ids: [id],
+		truncated: false
+	};
+	const chain = reader.chain({
+		resource: condition.resource,
+		id,
+		depth: condition.depth
+	});
+	if (chain === "pending" || chain === "failed") return "relation-unavailable";
+	const ids = [id];
+	let stopped = chain.restricted === true;
+	if (!stopped) for (const ancestor of chain.ancestors.slice(0, condition.depth)) {
+		ids.push(ancestor.id);
+		if (ancestor.restricted === true) {
+			stopped = true;
+			break;
+		}
+	}
+	if (new Set(ids).size !== ids.length) return "relation-depth";
+	return {
+		ids,
+		truncated: !stopped && (chain.ancestors.length > condition.depth || chain.truncated === true)
+	};
+}
+/**
+* Whether the subject holds the relation on the row's instance or an
+* ancestor within `depth`. A cycle is `relation-depth`; so is a chain that
+* goes on past `depth` with no holder below it. Any read the instance could
+* not answer is `relation-unavailable` unless a holder was found elsewhere.
+*/
+function resolveRelated(condition, row, subject, now, reader) {
+	const principal = subject.principal;
+	if (principal === null) return false;
+	const walk = relationWalk(condition, row, reader);
+	if (walk === void 0) return false;
+	if (walk === "relation-depth" || walk === "relation-unavailable") return walk;
+	if (condition.ids !== void 0) {
+		const held = new Set(condition.ids);
+		if (walk.ids.some((id) => held.has(id))) return true;
+		return walk.truncated ? "relation-depth" : false;
+	}
+	let unavailable = false;
+	let deep = false;
+	const explored = /* @__PURE__ */ new Map();
+	for (const id of walk.ids) {
+		const verdict = holdsRelation({
+			resource: condition.resource,
+			id,
+			relation: condition.relation
+		}, principal.id, now, reader, 16, /* @__PURE__ */ new Set(), explored);
+		if (verdict === true) return true;
+		if (verdict === "relation-unavailable") unavailable = true;
+		else if (verdict === "relation-depth") deep = true;
+	}
+	if (unavailable) return "relation-unavailable";
+	return walk.truncated || deep ? "relation-depth" : false;
+}
+function groupKey(group) {
+	return JSON.stringify([
+		group.resource,
+		group.id,
+		group.relation
+	]);
+}
+/**
+* Whether the principal holds `at.relation` on one instance, directly or
+* through a group whose members hold it. Groups of `at`'s own resource nest
+* at most `budget` deep; a group of another resource gets a fresh budget
+* (declarations rule out cycles across resources). A group met twice on one
+* path, or one past the budget, is `relation-depth`. `explored` holds the
+* budget each group was walked with across the whole walk: a group already
+* walked with as much budget adds nothing, since its verdict already reached
+* the caller, so shared sub-groups cost one walk rather than one per path.
+*/
+function holdsRelation(at, principalId, now, reader, budget, seen, explored) {
+	const key = groupKey(at);
+	const walked = explored.get(key);
+	if (walked !== void 0 && walked >= budget) return false;
+	explored.set(key, budget);
+	const holders = reader.holders(at);
+	if (holders === "pending" || holders === "failed") return "relation-unavailable";
+	if (holders.some((holder) => holdsNow(holder, principalId, now))) return true;
+	const path = new Set(seen).add(key);
+	let unavailable = false;
+	let deep = false;
+	for (const holder of holders) {
+		if (!("group" in holder) || !activeNow(holder, now)) continue;
+		const nested = holder.group.resource === at.resource;
+		if (nested && budget <= 0 || path.has(groupKey(holder.group))) {
+			deep = true;
+			continue;
+		}
+		const verdict = holdsRelation(holder.group, principalId, now, reader, nested ? budget - 1 : 16, path, explored);
+		if (verdict === true) return true;
+		if (verdict === "relation-unavailable") unavailable = true;
+		else if (verdict === "relation-depth") deep = true;
+	}
+	if (unavailable) return "relation-unavailable";
+	return deep ? "relation-depth" : false;
+}
+/** The holder one edge-table row names for `spec`, or `undefined` when the row does not belong to it. */
+function tableHolder(resourceName, spec, row, id) {
+	if (relationId(ownGet(row, spec.object ?? `${resourceName}_id`)) !== id) return;
+	for (const [column, value] of Object.entries(spec.match ?? {})) if (ownGet(row, column) !== value) return;
+	const subject = relationId(ownGet(row, spec.subject ?? "user_id"));
+	if (subject === void 0) return;
+	const expiresAt = spec.expiresAt === void 0 ? void 0 : seconds(ownGet(row, spec.expiresAt));
+	const period = expiresAt === void 0 ? {} : { expiresAt };
+	const groups = spec.groups;
+	const kind = groups === void 0 ? null : ownGet(row, groups.column);
+	if (groups === void 0 || kind === null || kind === void 0 || kind === groups.direct) return {
+		principal: { id: subject },
+		...period
+	};
+	const relation = typeof kind === "string" && Object.hasOwn(groups.resources, kind) ? groups.resources[kind] : void 0;
+	return relation === void 0 ? void 0 : {
+		group: {
+			resource: kind,
+			id: subject,
+			relation
+		},
+		...period
+	};
+}
+function seconds(value) {
+	if (value instanceof Date) {
+		const time = value.getTime();
+		return Number.isNaN(time) ? void 0 : time / 1e3;
+	}
+	if (typeof value === "number" && Number.isFinite(value)) return value;
+	if (typeof value === "string") {
+		const parsed = Date.parse(value);
+		return Number.isNaN(parsed) ? void 0 : parsed / 1e3;
+	}
+}
+function restrictedOf(node, row) {
+	return node.restricted !== void 0 && row !== void 0 && ownGet(row, node.restricted) === true;
+}
+function edgeHolder(edge) {
+	const holder = { principal: { id: edge.principal } };
+	if (edge.startsAt !== void 0) holder.startsAt = edge.startsAt;
+	if (edge.expiresAt !== void 0) holder.expiresAt = edge.expiresAt;
+	return holder;
+}
+/**
+* An in-process `RelationSource` over plain rows and edges, read against the
+* resource definitions in `permissions`. For tests, fixtures and small apps.
+*/
+function memoryRelations(permissions, data = {}) {
+	const registry = getRegistry(permissions);
+	const byId = /* @__PURE__ */ new Map();
+	for (const [name, rows] of Object.entries(data.rows ?? {})) {
+		const node = registry.get(name);
+		const index = /* @__PURE__ */ new Map();
+		for (const row of rows) {
+			const id = relationId(ownGet(row, node?.id ?? "id"));
+			if (id !== void 0) index.set(id, row);
+		}
+		byId.set(name, index);
+	}
+	const rowOf = (resource, id) => byId.get(resource)?.get(id);
+	return {
+		ancestors({ resource, id, depth, through }) {
+			const node = registry.get(resource);
+			const start = rowOf(resource, id);
+			if (node === void 0 || start === void 0) return { ancestors: [] };
+			if (through !== "parent") {
+				const link = Object.hasOwn(node.links, through) ? node.links[through] : void 0;
+				const next = link === void 0 ? void 0 : relationId(ownGet(start, link.field));
+				if (next === void 0 || depth < 1) return { ancestors: [] };
+				return { ancestors: [{ id: next }] };
+			}
+			const restricted = restrictedOf(node, start);
+			if (restricted || node.parent === void 0 || node.parent.resource !== resource) return restricted ? {
+				restricted: true,
+				ancestors: []
+			} : { ancestors: [] };
+			const field = node.parent.field;
+			const seen = /* @__PURE__ */ new Set([id]);
+			const ancestors = [];
+			let next = relationId(ownGet(start, field));
+			while (next !== void 0 && ancestors.length < depth) {
+				const row = rowOf(resource, next);
+				if (row === void 0) {
+					next = void 0;
+					break;
+				}
+				const hidden = restrictedOf(node, row);
+				ancestors.push(hidden ? {
+					id: next,
+					restricted: true
+				} : { id: next });
+				if (seen.has(next) || hidden) {
+					next = void 0;
+					break;
+				}
+				seen.add(next);
+				next = relationId(ownGet(row, field));
+			}
+			return next === void 0 ? { ancestors } : {
+				ancestors,
+				truncated: true
+			};
+		},
+		related({ resource, id, relation }) {
+			const spec = registry.get(resource)?.relations[relation];
+			if (spec === void 0 || isComputedRelation(spec)) return [];
+			if (isEdgeRelation(spec)) {
+				const table = data.tables?.[spec.edge];
+				if (table !== void 0) return table.flatMap((row) => {
+					const holder = tableHolder(resource, spec, row, id);
+					return holder === void 0 ? [] : [holder];
+				});
+				return (data.edges?.[resource]?.[relation] ?? []).filter((edge) => edge.id === id).map(edgeHolder);
+			}
+			const row = rowOf(resource, id);
+			if (row === void 0) return [];
+			if (isPrincipalRelation(spec)) {
+				const holder = relationId(ownGet(row, spec.principal));
+				if (holder === void 0) return [];
+				const startsAt = spec.period?.startsAt === void 0 ? void 0 : seconds(ownGet(row, spec.period.startsAt));
+				const expiresAt = spec.period?.expiresAt === void 0 ? void 0 : seconds(ownGet(row, spec.period.expiresAt));
+				return [{
+					principal: { id: holder },
+					...startsAt === void 0 ? {} : { startsAt },
+					...expiresAt === void 0 ? {} : { expiresAt }
+				}];
+			}
+			if (spec.memberOf !== void 0) return [];
+			const holder = relationId(ownGet(row, spec.field));
+			return holder === void 0 ? [] : [{ principal: { id: holder } }];
+		}
+	};
+}
+//#endregion
+export { relationWalk as a, relationReader as i, pendingRelations as n, resolveRelated as o, relationId as r, memoryRelations as t };