permdock 0.0.0 → 0.1.0

package/dist/snapshot-DE8dE_hz.js

@@ -0,0 +1,1051 @@
+import { n as isReadonlyArray, r as sole, t as compact } from "./compact-y6vfu2_f.js";
+import { n as freezeDeep } from "./freeze-y1_jQL4v.js";
+import { C as ownGet, S as isForbiddenKey, i as findPermission, o as formerScopes } from "./permissions-DC7GROPA.js";
+import { c as isConditionRef, i as resolveConditionRef, s as isConditionDate, u as parentHop } from "./refs-ChLSxbST.js";
+import { a as resolveScope, c as scopeChain, d as subjectMemberships, f as tenantOf, l as scopeIdOf, r as findScope, t as activeFor, u as scopeList } from "./scopes-cKVp_WTw.js";
+import { C as listPlans, h as resourceRoleCondition, l as matchGrantee, s as flattenGrantee, w as listRoles } from "./grantee-Bv04_Vzf.js";
+import { f as tenantsOf, i as isMembershipExpired, o as membershipField, r as inTeam, t as isActive } from "./validity-D0uRmJKJ.js";
+import { n as sha256, t as bytesToBase64Url } from "./sha256-BO0swRXL.js";
+//#region src/conditions/evaluate.ts
+function isExpired(membership, now) {
+	return membership.expiresAt !== void 0 && membership.expiresAt <= now;
+}
+function resolveRef(ref, subject) {
+	return resolveConditionRef(ref, subject);
+}
+function unwrap(value, subject) {
+	if (isConditionRef(value)) return resolveRef(value.ref, subject);
+	if (isConditionDate(value)) return new Date(isoInstant(value.date) ?? NaN);
+	if (isReadonlyArray(value)) return value.map((item) => unwrap(item, subject));
+	return value;
+}
+const ISO_INSTANT = /^(\d{4}-\d{2}-\d{2})(?:[T ](\d{2}:\d{2}(?::\d{2}(?:\.\d{1,9})?)?)(Z|[+-]\d{2}(?::?\d{2})?)?)?$/u;
+function isoInstant(value) {
+	const match = ISO_INSTANT.exec(value);
+	if (match === null) return;
+	const [, day, time, zone] = match;
+	let offset = zone ?? (time === void 0 ? "" : "Z");
+	if (/^[+-]\d{2}$/u.test(offset)) offset = `${offset}:00`;
+	else if (/^[+-]\d{4}$/u.test(offset)) offset = `${offset.slice(0, 3)}:${offset.slice(3)}`;
+	const parsed = Date.parse(time === void 0 ? `${day}` : `${day}T${time}${offset}`);
+	return Number.isNaN(parsed) ? void 0 : parsed;
+}
+function instantOf(value) {
+	if (value instanceof Date) {
+		const time = value.getTime();
+		return Number.isNaN(time) ? void 0 : time;
+	}
+	if (typeof value === "number") return Number.isFinite(value) ? value : void 0;
+	if (typeof value === "string") return isoInstant(value);
+}
+function comparablePair(left, right) {
+	if (left instanceof Date || right instanceof Date) {
+		const a = instantOf(left);
+		const b = instantOf(right);
+		return a === void 0 || b === void 0 ? void 0 : [a, b];
+	}
+	const kind = typeof left;
+	if (kind === typeof right && (kind === "string" || kind === "number" || kind === "boolean")) return [left, right];
+}
+function compare(op, left, right) {
+	if (left === void 0 || left === null || right === void 0 || right === null) return false;
+	const comparable = comparablePair(left, right);
+	if (comparable === void 0) return false;
+	const [a, b] = comparable;
+	switch (op) {
+		case "eq": return a === b;
+		case "ne": return a !== b;
+		case "gt": return a > b;
+		case "gte": return a >= b;
+		case "lt": return a < b;
+		case "lte": return a <= b;
+		default:
+ /* v8 ignore next */
+		return false;
+	}
+}
+function contains(left, right) {
+	if (left === void 0 || left === null || right === void 0 || right === null) return false;
+	if (typeof left === "string" && typeof right === "string") return left.includes(right);
+	if (Array.isArray(left)) return left.includes(right);
+	return false;
+}
+function inList(left, right) {
+	if (left === void 0 || left === null || !Array.isArray(right)) return false;
+	return right.includes(left);
+}
+function matchesParentHop(data, parents, on) {
+	for (const parent of parents ?? []) {
+		const hop = parentHop(parent);
+		if (hop.resource !== void 0 && hop.resource !== on.resource) continue;
+		if (ownGet(data, hop.field) === on.id) return true;
+	}
+	return false;
+}
+function evaluateMemberOf(condition, data, subject, now, scopes) {
+	if (data === null || typeof data !== "object") return false;
+	const rowValue = ownGet(data, condition.field);
+	if (rowValue === void 0 || rowValue === null) return false;
+	const memberships = subjectMemberships(subject.principal?.memberships, scopes);
+	const wanted = new Set(condition.roles);
+	const active = subject.principal?.tenant === "" ? void 0 : subject.principal?.tenant;
+	const scope = condition.scope === "resource" ? void 0 : resolveScope(scopes, condition.scope);
+	if (condition.scope !== "resource" && scope === void 0) return false;
+	for (const membership of memberships) {
+		if (isExpired(membership, now)) continue;
+		if (wanted.size > 0 && !membership.roles.some((role) => wanted.has(role))) continue;
+		if (scope !== void 0) {
+			if (membership.scope !== scope || membership.id !== rowValue) continue;
+			const tenant = tenantOf(membership, scopes);
+			if (active !== void 0 && tenant !== void 0 && tenant !== active) continue;
+			return true;
+		}
+		if (membership.on === void 0) continue;
+		if (condition.resource !== void 0 && membership.on.resource !== condition.resource) {
+			if (matchesParentHop(data, condition.parents, membership.on)) return true;
+			continue;
+		}
+		if (membership.on.id === rowValue) return true;
+		if (matchesParentHop(data, condition.parents, membership.on)) return true;
+	}
+	return false;
+}
+function evaluateCondition(condition, data, subject, now = Date.now() / 1e3, scopes = scopeList(void 0), related, onOpaque) {
+	switch (condition.op) {
+		case "and": return condition.conditions.every((child) => evaluateCondition(child, data, subject, now, scopes, related, onOpaque));
+		case "or": return condition.conditions.some((child) => evaluateCondition(child, data, subject, now, scopes, related, onOpaque));
+		case "not": return !evaluateCondition(condition.condition, data, subject, now, scopes, related, onOpaque);
+		case "isNull": {
+			if (data === null || typeof data !== "object") return false;
+			const value = ownGet(data, condition.field);
+			const isNull = value === null || value === void 0;
+			return condition.value ? isNull : !isNull;
+		}
+		case "in":
+		case "notIn": {
+			if (data === null || typeof data !== "object") return false;
+			const left = ownGet(data, condition.field);
+			const matched = inList(left, unwrap(condition.value, subject));
+			return condition.op === "in" ? matched : !matched && left !== void 0 && left !== null;
+		}
+		case "contains":
+			if (data === null || typeof data !== "object") return false;
+			return contains(ownGet(data, condition.field), unwrap(condition.value, subject));
+		case "eq":
+		case "ne":
+		case "gt":
+		case "gte":
+		case "lt":
+		case "lte":
+			if (condition.field === "_" && condition.op === "eq") return condition.value === true;
+			if (data === null || typeof data !== "object") return false;
+			return compare(condition.op, ownGet(data, condition.field), unwrap(condition.value, subject));
+		case "memberOf": return evaluateMemberOf(condition, data, subject, now, scopes);
+		case "related": return related?.(condition, data) === true;
+		case "sqlFunction": return evaluateCondition(condition.twin, data, subject, now, scopes, related, onOpaque);
+		case "opaque":
+			onOpaque?.();
+			return false;
+		default:
+ /* v8 ignore next */
+		return condition;
+	}
+}
+//#endregion
+//#region src/core/arazzo.ts
+const VERSION = /^1\.[01]\.\d+(?:-.+)?$/u;
+const STEP_TARGETS = [
+	"operationId",
+	"operationPath",
+	"workflowId",
+	"channelPath"
+];
+const denied = (reason) => freezeDeep({
+	outcome: "denied",
+	denials: [{
+		role: null,
+		reason
+	}],
+	alternatives: []
+});
+function isRecord$1(value) {
+	return value !== null && typeof value === "object" && !Array.isArray(value);
+}
+function asString(value) {
+	return typeof value === "string" && value.length > 0 ? value : void 0;
+}
+function parseParameters(raw, components, where) {
+	if (raw === void 0) return [];
+	if (!Array.isArray(raw)) return `${where}: parameters must be an array`;
+	const out = [];
+	for (const item of raw) {
+		if (!isRecord$1(item)) return `${where}: a parameter is not an object`;
+		const reference = asString(item["reference"]);
+		if (reference !== void 0) {
+			const match = /^\$components\.parameters\.(.+)$/u.exec(reference);
+			const target = match?.[1] === void 0 ? void 0 : components[match[1]];
+			const name = isRecord$1(target) ? asString(target["name"]) : void 0;
+			if (!isRecord$1(target) || name === void 0 || !("value" in target)) return `${where}: unresolved parameter reference ${reference}`;
+			out.push({
+				name,
+				value: "value" in item ? item["value"] : target["value"]
+			});
+			continue;
+		}
+		const name = asString(item["name"]);
+		if (name === void 0 || !("value" in item)) return `${where}: a parameter needs a name and a value`;
+		out.push({
+			name,
+			value: item["value"]
+		});
+	}
+	return out;
+}
+function parseDocument(arazzo) {
+	if (!isRecord$1(arazzo)) return "Arazzo document is not an object";
+	const version = arazzo["arazzo"];
+	if (typeof version !== "string" || !VERSION.test(version)) return "arazzo must be a 1.0.x or 1.1.x version";
+	if (!isRecord$1(arazzo["info"])) return "info is required";
+	const rawSources = arazzo["sourceDescriptions"];
+	if (!Array.isArray(rawSources) || rawSources.length === 0) return "sourceDescriptions needs at least one entry";
+	const sources = [];
+	for (const source of rawSources) {
+		const name = isRecord$1(source) ? asString(source["name"]) : void 0;
+		if (!isRecord$1(source) || name === void 0 || asString(source["url"]) === void 0) return "a sourceDescription needs a name and a url";
+		if (sources.some((item) => item.name === name)) return `duplicate sourceDescription ${name}`;
+		sources.push({
+			name,
+			type: asString(source["type"]) ?? "openapi"
+		});
+	}
+	const components = isRecord$1(arazzo["components"]) && isRecord$1(arazzo["components"]["parameters"]) ? arazzo["components"]["parameters"] : {};
+	const rawWorkflows = arazzo["workflows"];
+	if (!Array.isArray(rawWorkflows) || rawWorkflows.length === 0) return "workflows needs at least one entry";
+	const workflows = [];
+	for (const item of rawWorkflows) {
+		const workflowId = isRecord$1(item) ? asString(item["workflowId"]) : void 0;
+		if (!isRecord$1(item) || workflowId === void 0) return "a workflow needs a workflowId";
+		if (workflows.some((workflow) => workflow.workflowId === workflowId)) return `duplicate workflowId ${workflowId}`;
+		const parameters = parseParameters(item["parameters"], components, workflowId);
+		if (typeof parameters === "string") return parameters;
+		const rawSteps = item["steps"];
+		if (!Array.isArray(rawSteps) || rawSteps.length === 0) return `${workflowId}: steps needs at least one entry`;
+		const steps = [];
+		for (const step of rawSteps) {
+			const stepId = isRecord$1(step) ? asString(step["stepId"]) : void 0;
+			if (!isRecord$1(step) || stepId === void 0) return `${workflowId}: a step needs a stepId`;
+			if (steps.some((other) => other.stepId === stepId)) return `${workflowId}: duplicate stepId ${stepId}`;
+			const targets = STEP_TARGETS.filter((field) => asString(step[field]) !== void 0);
+			if (targets.length !== 1 && !(targets.length === 2 && targets.includes("operationId") && targets.includes("channelPath"))) return `${workflowId}.${stepId}: a step needs exactly one of operationId, operationPath or workflowId`;
+			const stepParameters = parseParameters(step["parameters"], components, `${workflowId}.${stepId}`);
+			if (typeof stepParameters === "string") return stepParameters;
+			steps.push(compact({
+				stepId,
+				operationId: asString(step["operationId"]),
+				operationPath: asString(step["operationPath"]),
+				workflowId: asString(step["workflowId"]),
+				channelPath: asString(step["channelPath"]),
+				parameters: stepParameters
+			}));
+		}
+		workflows.push({
+			workflowId,
+			parameters,
+			steps
+		});
+	}
+	return {
+		sources,
+		workflows
+	};
+}
+function unescapePointer(token) {
+	return token.replaceAll("~1", "/").replaceAll("~0", "~");
+}
+function readPointer(doc, pointer) {
+	if (!pointer.startsWith("#/")) return;
+	let current = doc;
+	for (const raw of pointer.slice(2).split("/")) {
+		if (!isRecord$1(current)) return;
+		let token;
+		try {
+			token = unescapePointer(decodeURIComponent(raw));
+		} catch {
+			return;
+		}
+		if (!Object.hasOwn(current, token)) return;
+		current = current[token];
+	}
+	return current;
+}
+function findOperation(openapi, operationId) {
+	if (!isRecord$1(openapi) || !isRecord$1(openapi["paths"])) return;
+	for (const pathItem of Object.values(openapi["paths"])) {
+		if (!isRecord$1(pathItem)) continue;
+		for (const [method, operation] of Object.entries(pathItem)) if (!method.startsWith("x-") && isRecord$1(operation) && operation["operationId"] === operationId) return operation;
+	}
+}
+/** One description, or a map of descriptions keyed by source `name`. */
+function descriptionFor(openapi, name) {
+	if (isRecord$1(openapi) && !("openapi" in openapi) && !("paths" in openapi) && isRecord$1(openapi[name])) return openapi[name];
+	return openapi;
+}
+function permissionKeysOf(node) {
+	if (!isRecord$1(node)) return [];
+	const raw = node["x-permdock-permissions"];
+	if (!Array.isArray(raw)) return [];
+	return raw.filter((item) => typeof item === "string");
+}
+/** `$inputs.a.b` against the frame's inputs; anything else that is a runtime expression is unknown. */
+function valueOf(value, inputs) {
+	if (typeof value !== "string" || !value.includes("$")) return {
+		known: true,
+		value
+	};
+	const match = /^\$inputs\.([^#{}]+)$/u.exec(value);
+	if (match?.[1] === void 0) return value.startsWith("$") || value.includes("{$") ? { known: false } : {
+		known: true,
+		value
+	};
+	let current = inputs;
+	for (const part of match[1].split(".")) {
+		if (!isRecord$1(current) || !Object.hasOwn(current, part)) return { known: false };
+		current = current[part];
+	}
+	return {
+		known: true,
+		value: current
+	};
+}
+function bind(parameters, inputs) {
+	const record = {};
+	let provisional = false;
+	for (const parameter of parameters) {
+		const bound = valueOf(parameter.value, inputs);
+		if (!bound.known) {
+			provisional = true;
+			continue;
+		}
+		Object.defineProperty(record, parameter.name, {
+			value: bound.value,
+			enumerable: true,
+			writable: true,
+			configurable: true
+		});
+	}
+	return {
+		record,
+		provisional
+	};
+}
+function flatten(doc, workflowId, inputs, seen, out) {
+	if (seen.has(workflowId)) return "workflowId cycle";
+	const workflow = doc.workflows.find((item) => item.workflowId === workflowId);
+	if (workflow === void 0) return `unknown workflowId ${workflowId}`;
+	seen.add(workflowId);
+	for (const step of workflow.steps) {
+		if (step.workflowId === void 0 || step.workflowId.startsWith("$sourceDescriptions.")) {
+			out.push({
+				step,
+				workflow,
+				inputs
+			});
+			continue;
+		}
+		const nested = flatten(doc, step.workflowId, bind(step.parameters, inputs).record, seen, out);
+		if (nested !== void 0) return nested;
+	}
+	seen.delete(workflowId);
+}
+function locate(doc, openapi, step) {
+	if (step.workflowId !== void 0) return {
+		reason: "unsupported",
+		detail: "workflows in another Arazzo document are not resolved"
+	};
+	let sourceName;
+	let operationId = step.operationId;
+	let pointer;
+	if (step.operationPath !== void 0) {
+		const match = /^\{?\$sourceDescriptions\.([^.}#]+)(?:\.url)?\}?(#.*)?$/u.exec(step.operationPath);
+		if (match?.[1] === void 0) return {
+			reason: "undocumented",
+			detail: "operationPath is not a $sourceDescriptions reference"
+		};
+		sourceName = match[1];
+		pointer = match[2] ?? "";
+	} else if (operationId !== void 0) {
+		const match = /^\$sourceDescriptions\.([^.]+)\.(.+)$/u.exec(operationId);
+		if (match?.[1] !== void 0 && match[2] !== void 0) {
+			sourceName = match[1];
+			operationId = match[2];
+		}
+	}
+	const candidates = sourceName === void 0 ? doc.sources.filter((source) => source.type !== "arazzo") : doc.sources.filter((source) => source.name === sourceName);
+	if (candidates.length === 0) return {
+		reason: "undocumented",
+		detail: sourceName === void 0 ? "no API sourceDescription" : `unknown sourceDescription ${sourceName}`
+	};
+	if (step.channelPath !== void 0) return {
+		reason: "unsupported",
+		detail: "AsyncAPI steps are not evaluated"
+	};
+	const found = [];
+	for (const source of candidates) {
+		const description = descriptionFor(openapi, source.name);
+		const node = pointer === void 0 ? operationId === void 0 ? void 0 : findOperation(description, operationId) : readPointer(description, pointer);
+		if (node !== void 0 || candidates.length === 1) found.push({
+			source,
+			node
+		});
+	}
+	if (found.length > 1) return {
+		reason: "undocumented",
+		detail: "operationId matches several sources; qualify it with $sourceDescriptions"
+	};
+	const [hit] = found;
+	if (hit?.source.type === "asyncapi") return {
+		reason: "unsupported",
+		detail: "AsyncAPI steps are not evaluated"
+	};
+	if (hit === void 0 || hit.source.type === "arazzo" || !isRecord$1(hit.node)) return {
+		reason: "undocumented",
+		detail: "operation not found"
+	};
+	return compact({
+		node: hit.node,
+		operationId: asString(hit.node["operationId"]) ?? operationId
+	});
+}
+function resolve(doc, openapi, tree, flat) {
+	const { step, workflow, inputs } = flat;
+	const base = {
+		stepId: step.stepId,
+		workflowId: workflow.workflowId
+	};
+	const located = locate(doc, openapi, step);
+	const { record, provisional } = bind([...workflow.parameters.filter((parameter) => !step.parameters.some((own) => own.name === parameter.name)), ...step.parameters], inputs);
+	const data = Object.keys(inputs).length + Object.keys(record).length === 0 ? void 0 : {
+		...inputs,
+		...record
+	};
+	if ("reason" in located) return {
+		...base,
+		...compact({ operationId: step.operationId }),
+		keys: [],
+		finding: located,
+		data,
+		provisional
+	};
+	const keys = permissionKeysOf(located.node);
+	const unknown = tree === void 0 ? void 0 : keys.find((key) => findPermission(tree, key) === void 0);
+	return {
+		...base,
+		...compact({ operationId: located.operationId }),
+		keys,
+		...keys.length === 0 ? { finding: {
+			reason: "undocumented",
+			detail: "operation has no x-permdock-permissions"
+		} } : unknown === void 0 ? {} : { finding: {
+			reason: "unknown-key",
+			detail: unknown
+		} },
+		data,
+		provisional
+	};
+}
+function resolveAll(input, tree) {
+	const doc = parseDocument(input.arazzo);
+	if (typeof doc === "string") return {
+		workflowId: input.workflowId ?? "",
+		error: doc
+	};
+	const workflowId = input.workflowId ?? doc.workflows[0]?.workflowId ?? "";
+	const flat = [];
+	const error = flatten(doc, workflowId, input.inputs ?? {}, /* @__PURE__ */ new Set(), flat);
+	if (error !== void 0) return {
+		workflowId,
+		error
+	};
+	return {
+		workflowId,
+		steps: flat.map((item) => resolve(doc, input.openapi, tree, item))
+	};
+}
+function arazzoFindings(input, tree) {
+	const resolved = resolveAll(input, tree);
+	if ("error" in resolved) return [{
+		stepId: "document",
+		workflowId: resolved.workflowId,
+		reason: "validation",
+		detail: resolved.error
+	}];
+	return resolved.steps.flatMap((step) => step.finding === void 0 ? [] : [{
+		stepId: step.stepId,
+		workflowId: step.workflowId,
+		reason: step.finding.reason,
+		detail: step.finding.detail
+	}]);
+}
+function worst(outcomes) {
+	if (outcomes.includes("denied")) return "denied";
+	if (outcomes.includes("approval-required")) return "approval-required";
+	return "granted";
+}
+function combine(decisions) {
+	const outcome = worst(decisions.map((item) => item.outcome));
+	return decisions.find((item) => item.outcome === outcome) ?? denied("undocumented");
+}
+function simulateArazzo(input, tree, decide) {
+	const resolved = resolveAll(input, tree);
+	if ("error" in resolved) return freezeDeep({
+		workflowId: resolved.workflowId === "" ? "unknown" : resolved.workflowId,
+		outcome: "denied",
+		steps: [{
+			stepId: "document",
+			permissions: [],
+			decision: denied("validation")
+		}]
+	});
+	const steps = resolved.steps.map((step) => {
+		const owner = step.workflowId === resolved.workflowId ? void 0 : step.workflowId;
+		if (step.finding !== void 0) return compact({
+			stepId: step.stepId,
+			workflowId: owner,
+			operationId: step.operationId,
+			permissions: [],
+			decision: denied(step.finding.reason === "unsupported" ? "unsupported" : "undocumented")
+		});
+		const permissions = step.keys.flatMap((key) => {
+			const leaf = tree === void 0 ? void 0 : findPermission(tree, key);
+			return leaf === void 0 ? [] : [leaf];
+		});
+		return compact({
+			stepId: step.stepId,
+			workflowId: owner,
+			operationId: step.operationId,
+			permissions,
+			decision: combine(permissions.map((permission) => decide(permission, step.data))),
+			provisional: step.provisional ? true : void 0
+		});
+	});
+	return freezeDeep({
+		workflowId: resolved.workflowId,
+		outcome: worst(steps.map((step) => step.decision.outcome)),
+		steps
+	});
+}
+function isArazzoSimulateInput(value) {
+	return isRecord$1(value) && "arazzo" in value;
+}
+//#endregion
+//#region src/core/delegation.ts
+/** The permission's scope and any scope it was renamed from: tokens issued before a rename keep working. */
+function scopeNames(permission) {
+	return [permission.scope, ...formerScopes(permission)];
+}
+/**
+* Whether a delegated caller may use a permission its principal holds, through
+* OAuth `scopes`, RFC 9396 `authorizationDetails` or GNAP `access`.
+* `undefined` means covered; otherwise the denial reason `decide` would add.
+*/
+function coveredByDelegation(permission, delegation, resourceId, hasActor = false) {
+	const unscoped = hasActor ? "no-delegation" : void 0;
+	if (delegation === void 0) return unscoped;
+	const hasScopes = delegation.scopes !== void 0;
+	const hasDetails = delegation.authorizationDetails !== void 0;
+	const hasAccess = delegation.access !== void 0;
+	if (!hasScopes && !hasDetails && !hasAccess) return unscoped;
+	const emptyScopes = hasScopes && (delegation.scopes?.length ?? 0) === 0;
+	const emptyAccess = hasAccess && (delegation.access?.length ?? 0) === 0;
+	if (emptyScopes && !hasDetails && !hasAccess) return "no-delegation";
+	if (emptyAccess && !hasScopes && !hasDetails) return "no-delegation";
+	if (emptyScopes && emptyAccess && !hasDetails) return "no-delegation";
+	const scopes = scopeNames(permission);
+	const scopeOk = delegation.scopes?.some((scope) => scopes.includes(scope)) ?? false;
+	const detailOk = delegation.authorizationDetails?.some((detail) => {
+		if (detail.type !== permission.resource) return false;
+		const identifier = detail["identifier"];
+		if (identifier !== void 0 && (typeof identifier !== "string" || identifier !== resourceId)) return false;
+		const actions = detail.actions;
+		if (actions === void 0) return true;
+		return Array.isArray(actions) && actions.includes(permission.action);
+	}) ?? false;
+	const accessOk = accessCovers(permission, delegation.access, resourceId);
+	if (scopeOk || detailOk || accessOk) return;
+	return "not-delegated";
+}
+function accessCovers(permission, access, resourceId) {
+	if (access === void 0) return false;
+	return access.some((entry) => {
+		if (typeof entry === "string") return scopeNames(permission).includes(entry);
+		if (entry === null || typeof entry !== "object") return false;
+		const type = entry["type"];
+		if (typeof type !== "string" || !typeMatches(type, permission.resource)) return false;
+		const actions = entry["actions"];
+		if (actions !== void 0 && (!Array.isArray(actions) || !actions.includes(permission.action))) return false;
+		const identifier = entry["identifier"];
+		if (identifier !== void 0 && (typeof identifier !== "string" || identifier !== resourceId)) return false;
+		return true;
+	});
+}
+function typeMatches(type, resource) {
+	if (type === resource) return true;
+	return type.endsWith(`/${resource}`);
+}
+function resourceIdOf(data) {
+	if (data === null || typeof data !== "object" || !("id" in data)) return;
+	const id = data.id;
+	return typeof id === "string" || typeof id === "number" ? String(id) : void 0;
+}
+/**
+* Whether the subject's principal is a `from` of the delegation: every item
+* matches, with roles checked against the roles the principal holds here
+* (`matchGrantee` leaves role holding to the caller) and nothing that needs a
+* row.
+*/
+function handsOver(delegation, subject, heldRoles, now) {
+	const items = flattenGrantee(delegation.from);
+	if (items.length === 0 || subject.principal === null) return false;
+	return items.every((item) => {
+		if (item.kind === "role") return heldRoles.has(item.role);
+		if (item.kind === "relation") return false;
+		const match = matchGrantee(item, subject, now, void 0);
+		return match.matched && match.where === void 0;
+	});
+}
+/**
+* The permission keys the policy's delegations let `subject.actor` use for
+* `subject.principal` right now: the union over every active delegation whose
+* `to` matches the actor and whose `from` the principal holds. `undefined`
+* when none applies, so the call falls back to the token delegation alone.
+* An actor with `readOnly: true` gets only each delegation's read-only keys.
+* Attenuation only: a key here still needs a matching allow and no deny.
+*/
+function delegatedPermissions(delegations, subject, heldRoles, now) {
+	const actor = subject.actor;
+	if (actor === void 0 || delegations === void 0) return;
+	let keys;
+	for (const delegation of delegations) {
+		if (delegation.to.kind !== actor.kind || delegation.to.id !== void 0 && delegation.to.id !== actor.id || !isActive(delegation.validity, now) || !handsOver(delegation, subject, heldRoles, now)) continue;
+		keys ??= /* @__PURE__ */ new Set();
+		for (const key of actor.readOnly === true ? delegation.readOnly : delegation.permissions) keys.add(key);
+	}
+	return keys;
+}
+//#endregion
+//#region src/core/canonical-json.ts
+function isRecord(value) {
+	return value !== null && typeof value === "object" && !Array.isArray(value);
+}
+/**
+* JSON with sorted keys and `undefined` members dropped, so equal values hash
+* equally. Dates become ISO strings, bigints `"<n>n"`, and a repeated object
+* on the current path `"[Circular]"`, so any validated row serialises.
+*/
+function canonicalJson(value, path = /* @__PURE__ */ new Set()) {
+	if (typeof value === "bigint") return JSON.stringify(`${value}n`);
+	if (value instanceof Date) return JSON.stringify(Number.isNaN(value.getTime()) ? null : value.toISOString());
+	if (value !== null && typeof value === "object") {
+		if (path.has(value)) return "\"[Circular]\"";
+		path.add(value);
+		try {
+			if (Array.isArray(value)) return `[${value.map((item) => canonicalJson(item === void 0 ? null : item, path)).join(",")}]`;
+			if (isRecord(value)) return `{${Object.keys(value).toSorted().filter((key) => value[key] !== void 0).map((key) => `${JSON.stringify(key)}:${canonicalJson(value[key], path)}`).join(",")}}`;
+		} finally {
+			path.delete(value);
+		}
+	}
+	return JSON.stringify(value) ?? "null";
+}
+//#endregion
+//#region src/core/token.ts
+/**
+* Only stable identity goes into the token, so refreshing a session (new
+* roles, assurance or claims) does not orphan an outstanding approval.
+*/
+function principalIdentity(principal) {
+	if (principal === null) return null;
+	return {
+		id: principal.id,
+		tenant: principal.tenant ?? null,
+		issuer: principal.issuer ?? null
+	};
+}
+/** A row's `version` field as token input; `null` when it is missing or not a scalar. */
+function versionOf(row, field) {
+	if (row === null || typeof row !== "object" || !Object.hasOwn(row, field)) return null;
+	const value = row[field];
+	if (value instanceof Date) return Number.isNaN(value.getTime()) ? null : value.toISOString();
+	return typeof value === "string" || typeof value === "number" || typeof value === "bigint" || typeof value === "boolean" ? String(value) : null;
+}
+/** The digest that binds a token to the call's data when no row id does. */
+function payloadDigest(data) {
+	return bytesToBase64Url(sha256(canonicalJson(data)));
+}
+/**
+* `version` is set only for an approval that goes stale on a resource
+* change; without it the payload, and so every other token, is unchanged.
+* `payload` is set when `resourceId` is `*` (a collection action or a row
+* without an id), so an approval covers the arguments it was given and no
+* others.
+*/
+function decisionToken(input) {
+	const payload = JSON.stringify({
+		key: input.key,
+		resourceId: input.resourceId,
+		principal: principalIdentity(input.principal),
+		actor: input.actor === void 0 ? null : {
+			id: input.actor.id,
+			kind: input.actor.kind
+		},
+		fingerprint: input.fingerprint,
+		...input.version === void 0 ? {} : { version: input.version },
+		...input.payload === void 0 ? {} : { payload: input.payload }
+	});
+	return `pd1.${bytesToBase64Url(sha256(payload))}`;
+}
+//#endregion
+//#region src/conditions/bind.ts
+function isPrimitive(value) {
+	return typeof value === "string" || typeof value === "number" || typeof value === "boolean";
+}
+function bindValue(value, subject, only) {
+	if (isConditionRef(value) && only !== void 0 && !only(value.ref)) return value;
+	if (isConditionRef(value)) {
+		const resolved = resolveConditionRef(value.ref, subject);
+		if (Array.isArray(resolved)) return resolved.filter((item) => isPrimitive(item));
+		return isPrimitive(resolved) ? resolved : null;
+	}
+	if (Array.isArray(value)) return value.map((item) => bindValue(item, subject, only));
+	return value;
+}
+function bindArg(arg, subject, only) {
+	return arg !== null && typeof arg === "object" && "field" in arg && !isConditionRef(arg) ? arg : bindValue(arg, subject, only);
+}
+/**
+* Replaces every `principal.*` / `context.*` ref with the subject's value, so
+* a `where()` result compiles the same without the subject. A ref the subject
+* does not hold binds to `null` (or `[]` in a list), which never matches, as
+* in `evaluateCondition`. With `only`, refs it rejects stay refs.
+*/
+function bindConditionRefs(condition, subject, only) {
+	switch (condition.op) {
+		case "and":
+		case "or": return {
+			op: condition.op,
+			conditions: condition.conditions.map((child) => bindConditionRefs(child, subject, only))
+		};
+		case "not": return {
+			op: "not",
+			condition: bindConditionRefs(condition.condition, subject, only)
+		};
+		case "in":
+		case "notIn": {
+			const value = condition.value;
+			if (isConditionRef(value) && only !== void 0 && !only(value.ref)) return condition;
+			const bound = bindValue(value, subject, only);
+			return {
+				...condition,
+				value: Array.isArray(bound) ? bound : []
+			};
+		}
+		case "eq":
+		case "ne":
+		case "gt":
+		case "gte":
+		case "lt":
+		case "lte":
+		case "contains": return {
+			...condition,
+			value: bindValue(condition.value, subject, only)
+		};
+		case "sqlFunction": return {
+			...condition,
+			args: condition.args.map((arg) => bindArg(arg, subject, only)),
+			twin: bindConditionRefs(condition.twin, subject, only)
+		};
+		case "isNull":
+		case "memberOf":
+		case "related":
+		case "opaque": return condition;
+		default: return condition;
+	}
+}
+//#endregion
+//#region src/core/where-scope.ts
+const ALWAYS = {
+	op: "eq",
+	field: "_",
+	value: true
+};
+function eq(field, value) {
+	return value === void 0 ? {
+		op: "or",
+		conditions: []
+	} : {
+		op: "eq",
+		field,
+		value
+	};
+}
+/** One equality per partitioning scope key on the membership's chain, outermost first. */
+function namedFilters(membership, scope) {
+	if (findScope(scope.scopes, membership.scope ?? "") === void 0 || !inTeam(membership, scope.scopes, scope.team) || !activeFor(membership, scope.scopes, scope.tenant) || membership.scope === void 0) return null;
+	const filters = [];
+	for (const name of scopeChain(scope.scopes, membership.scope).toReversed()) {
+		const key = findScope(scope.scopes, name)?.key;
+		if (key !== void 0 && scope.partitioned(name, key)) filters.push(eq(key, scopeIdOf(membership, name)));
+	}
+	return filters;
+}
+/**
+* The row filters a grant's membership implies, or `null` when the grant
+* reaches no row in this scope (another tenant, no active tenant, expired).
+*/
+function scopeFilters(grant, scope) {
+	if (grant.scope === void 0) return [];
+	const membership = grant.membership;
+	if (membership === void 0 || isMembershipExpired(membership, scope.now)) return null;
+	if (typeof grant.scope === "string") return membership.scope === grant.scope ? namedFilters(membership, scope) : null;
+	const on = membership.on;
+	if (on === void 0) return null;
+	if (scope.resources === void 0) return on.resource === grant.scope.resource && on.resource === scope.resource ? [eq("id", on.id)] : null;
+	const roleResource = scope.resources.get(grant.scope.resource);
+	if (on.resource !== grant.scope.resource && membershipField(roleResource, on.resource, scope.resources) === void 0) return null;
+	const walked = scope.graph === true ? resourceRoleCondition(scope.resources.get(scope.resource), on.resource, [on.id], scope.resources) : void 0;
+	if (walked !== void 0) return [walked];
+	const field = membershipField(scope.resources.get(scope.resource), on.resource, scope.resources);
+	return field === void 0 ? null : [eq(field, on.id)];
+}
+function all(conditions) {
+	if (conditions.length === 0) return ALWAYS;
+	return sole(conditions) ?? {
+		op: "and",
+		conditions: [...conditions]
+	};
+}
+function scopedCondition(grant, scope) {
+	const filters = scopeFilters(grant, scope);
+	if (filters === null) return null;
+	const parts = grant.where === void 0 ? filters : [...filters, grant.where];
+	return parts.length === 0 ? "always" : all(parts);
+}
+/** Whether an unconditional `deny` removes every row `allow` could reach. */
+function covers(deny, allow, scopes) {
+	if (deny.where !== void 0) return false;
+	const denied = deny.membership;
+	if (deny.scope === void 0 || denied === void 0) return deny.scope === void 0;
+	const allowed = allow.membership;
+	if (allowed === void 0) return false;
+	if (typeof deny.scope === "object") return typeof allow.scope === "object" && denied.on?.resource === allowed.on?.resource && denied.on?.id === allowed.on?.id;
+	if (typeof allow.scope !== "string" || allowed.scope === void 0) return false;
+	const chain = scopeChain(scopes, deny.scope);
+	return scopeChain(scopes, allowed.scope).includes(deny.scope) && chain.every((name) => scopeIdOf(allowed, name) === scopeIdOf(denied, name));
+}
+/**
+* The portable filter for one permission's grants: allows OR together, each
+* narrowed to its membership's tenant, team or resource; any applicable
+* portable deny is subtracted, and an unconditional one empties the result.
+*/
+function collect(grants, scope) {
+	const none = {
+		op: "or",
+		conditions: []
+	};
+	const partial = grants.some((grant) => grant.portable === false);
+	const denies = [];
+	for (const grant of grants) {
+		if (grant.effect !== "deny" || grant.portable === false || !isActive(grant.validity, scope.now)) continue;
+		const condition = scopedCondition(grant, scope);
+		if (condition === "always") return {
+			condition: none,
+			partial
+		};
+		if (condition !== null) denies.push({
+			grant,
+			condition
+		});
+	}
+	const parts = [];
+	for (const grant of grants) {
+		if (grant.effect !== "allow" || grant.portable === false || !isActive(grant.validity, scope.now)) continue;
+		const condition = scopedCondition(grant, scope);
+		if (condition === null || denies.some((deny) => covers(deny.grant, grant, scope.scopes))) continue;
+		parts.push(all([...condition === "always" ? [] : [condition], ...denies.map((deny) => ({
+			op: "not",
+			condition: deny.condition
+		}))]));
+	}
+	if (parts.length === 0) return {
+		condition: none,
+		partial
+	};
+	return {
+		condition: sole(parts) ?? {
+			op: "or",
+			conditions: parts
+		},
+		partial
+	};
+}
+/**
+* `collect`, with every subject ref bound to `scope.subject` and the subject
+* attached (not enumerable) for `memberOf`, which needs its memberships.
+*/
+function whereFromGrants(grants, scope) {
+	const { condition, partial } = collect(grants, scope);
+	const result = {
+		condition: bindConditionRefs(condition, scope.subject),
+		partial
+	};
+	Object.defineProperty(result, "subject", {
+		value: scope.subject,
+		enumerable: false
+	});
+	Object.defineProperty(result, "scopes", {
+		value: scope.scopes,
+		enumerable: false
+	});
+	if (scope.resources !== void 0) Object.defineProperty(result, "resources", {
+		value: scope.resources,
+		enumerable: false
+	});
+	return freezeDeep(result);
+}
+//#endregion
+//#region src/core/snapshot.ts
+function snapshotGrant(grant, membership) {
+	const scope = grant.scope === "global" ? void 0 : typeof grant.scope === "string" ? grant.scope : { resource: grant.scope.resource };
+	const entry = compact({
+		permission: grant.permission.key,
+		effect: grant.effect,
+		role: grant.role,
+		to: grant.to,
+		where: grant.portable ? grant.where : void 0,
+		check: grant.portable ? grant.check : void 0,
+		approval: grant.approval,
+		scope,
+		membership,
+		portable: grant.portable ? void 0 : false,
+		fields: grant.fields,
+		validity: grant.validity
+	});
+	return freezeDeep(entry);
+}
+/** Claim refs: the snapshot principal does not carry `claims`, so they are bound to the subject's values. */
+function isClaimRef(ref) {
+	return ref.startsWith("principal.claim.") || ref.startsWith("principal.claims.");
+}
+function bindClaims(grant, subject) {
+	if (grant.where === void 0 && grant.check === void 0) return grant;
+	return freezeDeep(compact({
+		...grant,
+		where: grant.where === void 0 ? void 0 : bindConditionRefs(grant.where, subject, isClaimRef),
+		check: grant.check === void 0 ? void 0 : bindConditionRefs(grant.check, subject, isClaimRef)
+	}));
+}
+function notEntitledOf(items) {
+	const seen = /* @__PURE__ */ new Map();
+	for (const { grant } of items) {
+		const key = `${grant.permission.key}\u0000${grant.role ?? ""}`;
+		if (!seen.has(key)) seen.set(key, {
+			permission: grant.permission.key,
+			role: grant.role,
+			to: grant.to
+		});
+	}
+	return seen.size === 0 ? void 0 : [...seen.values()];
+}
+function buildSnapshot(input) {
+	const now = input.now ?? Math.floor(Date.now() / 1e3);
+	const principal = input.subject.principal;
+	const allTenants = tenantsOf(principal, scopeList(input.scopes));
+	const tenants = input.tenants === "all" ? allTenants : principal?.tenant === void 0 ? [] : [principal.tenant];
+	const include = input.include;
+	const included = (permission) => include === void 0 || include.length === 0 || include.some((prefix) => permission.key === prefix || permission.key.startsWith(`${prefix}.`) || permission.resource === prefix);
+	const grants = input.grants.filter((item) => included(item.grant.permission)).map((item) => bindClaims(snapshotGrant(item.grant, item.membership), input.subject));
+	const assignableFor = input.assignable;
+	const assignable = assignableFor === void 0 ? [] : tenants.map((tenant) => {
+		const entry = assignableFor(tenant);
+		return {
+			...entry,
+			permissions: entry.permissions.filter(included)
+		};
+	});
+	return freezeDeep(compact({
+		v: 1,
+		issuedAt: now,
+		subject: compact({
+			principal: principal === null ? null : compact({
+				id: principal.id,
+				roles: principal.roles ?? [],
+				plans: principal.plans,
+				tenant: principal.tenant,
+				memberships: principal.memberships
+			}),
+			delegation: snapshotDelegation(input.subject, input.delegated !== void 0),
+			context: input.subject.context
+		}),
+		roles: input.roles,
+		audiences: input.audiences,
+		grants,
+		tenants,
+		include,
+		simulated: input.simulated === true ? true : void 0,
+		expiresAt: input.subject.expiresAt,
+		scopes: input.scopes,
+		assignable: assignable.length > 0 ? assignable : void 0,
+		delegated: input.delegated === void 0 ? void 0 : [...input.delegated].toSorted(),
+		notEntitled: notEntitledOf((input.notEntitled ?? []).filter((item) => included(item.grant.permission))),
+		vocabulary: input.vocabulary === void 0 ? void 0 : compact({
+			roles: listRoles(input.vocabulary.roles).length === 0 ? void 0 : Object.fromEntries(listRoles(input.vocabulary.roles).map((leaf) => [leaf.key, leaf])),
+			plans: listPlans(input.vocabulary.plans).length === 0 ? void 0 : Object.fromEntries(listPlans(input.vocabulary.plans).map((leaf) => [leaf.key, leaf]))
+		})
+	}));
+}
+async function signSnapshot(snapshot, signer, audience) {
+	const payload = { snapshot };
+	if (snapshot.subject.principal !== null) payload["sub"] = snapshot.subject.principal.id;
+	return await signer.sign(payload, compact({
+		typ: "permdock-snapshot+jwt",
+		audience,
+		expiresAt: snapshot.expiresAt
+	}));
+}
+/**
+* The token delegation as the client sees it. An actor with no token
+* delegation gets an empty `scopes` list so the client ceiling agrees with
+* `no-delegation`, unless a policy delegation applies (`delegated`), which
+* then is the ceiling.
+*/
+function snapshotDelegation(subject, delegated) {
+	const delegation = subject.delegation;
+	if (subject.actor === void 0 || delegated) return delegation;
+	if (delegation?.scopes === void 0 && delegation?.authorizationDetails === void 0 && delegation?.access === void 0) return {
+		...delegation,
+		scopes: []
+	};
+	return delegation;
+}
+function rejectUnsafe(value, path) {
+	if (value === null || typeof value !== "object") return;
+	if (Array.isArray(value)) {
+		for (const [index, item] of value.entries()) rejectUnsafe(item, `${path}[${index}]`);
+		return;
+	}
+	for (const key of Object.keys(value)) {
+		if (isForbiddenKey(key)) throw new Error(`PermDock: unsafe snapshot key '${key}' at ${path}`);
+		rejectUnsafe(value[key], `${path}.${key}`);
+	}
+}
+function parseSnapshot(json) {
+	const input = typeof json === "string" ? JSON.parse(json) : json;
+	if (input === null || typeof input !== "object" || Array.isArray(input)) throw new Error("PermDock: snapshot must be an object");
+	const value = typeof json === "string" || Object.isFrozen(input) ? input : JSON.parse(JSON.stringify(input));
+	rejectUnsafe(value, "$");
+	const version = value["v"];
+	if (version !== 1) throw new Error(`PermDock: unsupported snapshot version '${String(version)}'`);
+	return freezeDeep(value);
+}
+//#endregion
+export { whereFromGrants as a, versionOf as c, delegatedPermissions as d, resourceIdOf as f, evaluateCondition as g, simulateArazzo as h, snapshotGrant as i, canonicalJson as l, isArazzoSimulateInput as m, parseSnapshot as n, decisionToken as o, arazzoFindings as p, signSnapshot as r, payloadDigest as s, buildSnapshot as t, coveredByDelegation as u };