permdock 0.0.0 → 0.2.0

package/dist/fixtures-ht28Cplr.js

@@ -0,0 +1,67 @@
+import { a as loadModule, o as pickNamed } from "./load-DhWEB9P1.js";
+import { existsSync, readFileSync } from "node:fs";
+import { resolve } from "node:path";
+//#region src/cli/fixtures.ts
+function isRecord(value) {
+	return value !== null && typeof value === "object" && !Array.isArray(value);
+}
+function asFixtures(value) {
+	const list = Array.isArray(value) ? value : isRecord(value) && Array.isArray(value["fixtures"]) ? value["fixtures"] : void 0;
+	if (list === void 0) throw new Error("PermDock CLI: fixtures must be an array or { fixtures }");
+	return list.map((item, index) => {
+		if (!isRecord(item) || !isRecord(item["subject"]) || item["row"] === void 0) throw new Error(`PermDock CLI: fixture ${index} needs subject and row`);
+		if (typeof item["action"] !== "string") throw new TypeError(`PermDock CLI: fixture ${index} needs action`);
+		if (typeof item["subject"]["id"] !== "string") throw new TypeError(`PermDock CLI: fixture ${index} subject needs id`);
+		const memberships = item["subject"]["memberships"];
+		if (memberships !== void 0 && !Array.isArray(memberships)) throw new Error(`PermDock CLI: fixture ${index} subject.memberships must be an array`);
+		const tenant = item["subject"]["tenant"];
+		if (tenant !== void 0 && typeof tenant !== "string") throw new Error(`PermDock CLI: fixture ${index} subject.tenant must be a string`);
+		const claims = item["subject"]["claims"];
+		if (claims !== void 0 && !isRecord(claims)) throw new Error(`PermDock CLI: fixture ${index} subject.claims must be an object`);
+		return item;
+	});
+}
+function asCustomRoles(value) {
+	if (!isRecord(value) || value["customRoles"] === void 0) return [];
+	if (!Array.isArray(value["customRoles"])) throw new TypeError("PermDock CLI: fixtures customRoles must be an array");
+	return value["customRoles"];
+}
+/** A `.json` file or a module exporting `fixtures` (or default) and optionally `customRoles`. */
+async function loadFixtures(cwd, path) {
+	const abs = resolve(cwd, path);
+	if (!existsSync(abs)) throw new Error(`PermDock CLI: fixtures not found: ${path}`);
+	if (abs.endsWith(".json")) {
+		const parsed = JSON.parse(readFileSync(abs, "utf8"));
+		return {
+			fixtures: asFixtures(parsed),
+			customRoles: asCustomRoles(parsed)
+		};
+	}
+	const mod = await loadModule(abs);
+	return {
+		fixtures: asFixtures(pickNamed(mod, ["fixtures", "default"])),
+		customRoles: asCustomRoles(mod)
+	};
+}
+/** The fixture subject as a `Subject`: a principal with no actor and an empty context. */
+function fixtureSubject(fixture) {
+	return {
+		principal: {
+			id: fixture.id,
+			roles: fixture.roles ?? [],
+			...fixture.tenant === void 0 ? {} : { tenant: fixture.tenant },
+			memberships: fixture.memberships ?? [],
+			...fixture.claims === void 0 ? {} : { claims: fixture.claims }
+		},
+		context: {}
+	};
+}
+/** The row `can` receives: `{ current, next }` for an instance action with a `newRow`. */
+function fixtureRow(fixture, kind) {
+	return fixture.newRow === void 0 || kind === "collection" ? fixture.row : {
+		current: fixture.row,
+		next: fixture.newRow
+	};
+}
+//#endregion
+export { fixtureSubject as n, loadFixtures as r, fixtureRow as t };

package/dist/freeze-CrU8nQeX.js

@@ -0,0 +1,60 @@
+//#region src/core/freeze.ts
+function refuse() {
+	throw new TypeError("PermDock: this collection is frozen");
+}
+const LOCKED = {
+	value: refuse,
+	writable: false,
+	enumerable: false
+};
+/**
+* `Object.freeze` leaves a `Map` or `Set` writable through `set`, `add`,
+* `delete` and `clear`, so those are shadowed on the instance with a method
+* that throws. Identity and `instanceof` stay as they were.
+*/
+function freezeCollection(value) {
+	Object.defineProperties(value, value instanceof Map ? {
+		set: LOCKED,
+		delete: LOCKED,
+		clear: LOCKED
+	} : {
+		add: LOCKED,
+		delete: LOCKED,
+		clear: LOCKED
+	});
+	Object.freeze(value);
+	for (const [key, item] of value.entries()) {
+		freezeDeep(key);
+		freezeDeep(item);
+	}
+}
+function freezeDeep(value) {
+	if (value === null || typeof value !== "object") return value;
+	if (Object.isFrozen(value)) return value;
+	if (value instanceof Map || value instanceof Set) {
+		freezeCollection(value);
+		return value;
+	}
+	Object.freeze(value);
+	if (Array.isArray(value)) {
+		for (const item of value) freezeDeep(item);
+		return value;
+	}
+	for (const key of Object.getOwnPropertyNames(value)) freezeDeep(value[key]);
+	return value;
+}
+function isPlain(value) {
+	const proto = Object.getPrototypeOf(value);
+	return proto === Object.prototype || proto === null;
+}
+/** A deeply frozen copy of the plain objects and arrays in `value`; the caller's own objects stay writable. */
+function freezeCopy(value) {
+	if (value === null || typeof value !== "object") return value;
+	if (Array.isArray(value)) return Object.freeze(value.map((item) => freezeCopy(item)));
+	if (!isPlain(value)) return value;
+	const copy = {};
+	for (const key of Object.keys(value)) copy[key] = freezeCopy(value[key]);
+	return Object.freeze(copy);
+}
+//#endregion
+export { freezeDeep as n, freezeCopy as t };

package/dist/from-snapshot-C3sHpZNS.js

@@ -0,0 +1,569 @@
+import { t as compact } from "./compact-y6vfu2_f.js";
+import { n as freezeDeep } from "./freeze-CrU8nQeX.js";
+import { _ as listPermissions } from "./permissions-DVoF6dMt.js";
+import { a as deniedMessage, i as approvalMessage, n as PermDockDeniedError, t as PermDockApprovalRequiredError } from "./errors-Cz5zn0mW.js";
+import { n as sameId } from "./ids-DC4V4CFu.js";
+import { a as normalizeMemberships, d as scopeList, m as tenantOf, o as resolveScope, t as activeFor } from "./scopes-CVdPrWN-.js";
+import { a as whereFromGrants, c as rowIdOf, d as isArazzoSimulateInput, f as simulateArazzo, i as signSnapshot, l as rowValues, p as evaluateCondition } from "./snapshot-Enxd0n-s.js";
+import { D as synthesiseRole, E as listRoles, S as findRole, d as matchGrantee } from "./grantee-Cv5Sogfv.js";
+import { n as pickVisible, t as grantCoversField } from "./fields-BMl1RxoX.js";
+import { a as isMembershipExpired, i as inTeam, l as nestedAppliesWithoutRow, m as rowInScope, p as resolveActiveTenant, t as isActive, u as nowSeconds } from "./validity-uOp8UpYn.js";
+import { t as requiresApproval } from "./approval-required-TzNB9oQA.js";
+import { t as coveredByDelegation } from "./delegation-D8pUEuce.js";
+import { t as resourceIdOf } from "./resource-ref-CaS9yVPi.js";
+import { n as payloadDigest, t as decisionToken } from "./token-CIWxJOCh.js";
+//#region src/core/snapshot-evaluate.ts
+function coveredByInclude(snapshot, permission) {
+	const include = snapshot.include;
+	if (include === void 0 || include.length === 0) return true;
+	return include.some((prefix) => permission.key === prefix || permission.key.startsWith(`${prefix}.`) || permission.resource === prefix);
+}
+/** The field of `resource` that holds scope `name`'s id in a snapshot: its `fields` entry, else the scope's key. */
+function snapshotField(snapshot, name, resource) {
+	const entry = snapshot.scopes?.find((item) => item.name === name);
+	return entry?.fields?.[resource] ?? entry?.key;
+}
+function scopeOk(snapshot, grant, permission, subject, data, team, now, only) {
+	const scope = grant.scope;
+	if (scope === void 0) return { ok: true };
+	if (only !== void 0 && scope !== only) return {
+		ok: false,
+		reason: "scope"
+	};
+	const principal = subject.principal;
+	const membership = grant.membership;
+	if (principal === null || membership === void 0) return {
+		ok: false,
+		reason: "no-membership"
+	};
+	if (isMembershipExpired(membership, now)) return {
+		ok: false,
+		reason: "expired-membership"
+	};
+	if (typeof scope === "string") {
+		const scopes = scopeList(snapshot.scopes);
+		if (membership.scope !== scope || !scopes.some((entry) => entry.name === scope)) return {
+			ok: false,
+			reason: "scope"
+		};
+		if (!activeFor(membership, scopes, principal.tenant)) return {
+			ok: false,
+			reason: principal.tenant === void 0 ? "no-membership" : "tenant-mismatch"
+		};
+		if (!inTeam(membership, scopes, team)) return {
+			ok: false,
+			reason: "scope"
+		};
+		if (data === null || typeof data !== "object") return permission.kind !== "instance" || nestedAppliesWithoutRow(membership, scopes, data, team) ? { ok: true } : {
+			ok: false,
+			reason: "scope"
+		};
+		const partitioned = (name) => snapshot.scopes?.find((entry) => entry.name === name)?.resources?.includes(permission.resource) === true;
+		return rowInScope(membership, scopes, data, partitioned, (name) => snapshotField(snapshot, name, permission.resource));
+	}
+	const on = membership.on;
+	if (on === void 0 || on.resource !== scope.resource || on.resource !== permission.resource) return {
+		ok: false,
+		reason: "scope"
+	};
+	if (on.id !== rowIdOf(data, snapshot.ids?.[permission.resource])) return {
+		ok: false,
+		reason: "scope"
+	};
+	return { ok: true };
+}
+function conditionOk(grant, permission, current, next, subject, now, scopes) {
+	let opaqueReached = false;
+	const onOpaque = () => {
+		opaqueReached = true;
+	};
+	if (grant.portable === false) return {
+		matched: false,
+		reason: "opaque-condition"
+	};
+	if (grant.where !== void 0) {
+		if (permission.kind === "collection" || current === void 0) return {
+			matched: false,
+			reason: "condition"
+		};
+		if (grant.where.op === "opaque" || grant.check?.op === "opaque") return {
+			matched: false,
+			reason: "opaque-condition"
+		};
+		const matched = evaluateCondition(grant.where, current, subject, now, scopes, void 0, onOpaque);
+		if (opaqueReached) return {
+			matched: false,
+			reason: "opaque-condition"
+		};
+		if (!matched) return {
+			matched: false,
+			reason: "condition"
+		};
+	}
+	const check = grant.check;
+	if (check !== void 0) {
+		if (check.op === "opaque") return {
+			matched: false,
+			reason: "opaque-condition"
+		};
+		if (next === void 0) return {
+			matched: false,
+			reason: "condition"
+		};
+		const matched = evaluateCondition(check, next, subject, now, scopes, void 0, onOpaque);
+		if (opaqueReached) return {
+			matched: false,
+			reason: "opaque-condition"
+		};
+		if (!matched) return {
+			matched: false,
+			reason: "condition"
+		};
+	}
+	return { matched: true };
+}
+function matchedOf(grant) {
+	return compact({
+		role: grant.role,
+		permission: grant.permission,
+		to: grant.to,
+		where: grant.where,
+		check: grant.check,
+		approval: grant.approval
+	});
+}
+function evaluateSnapshot(snapshot, subject, permission, data, team, options, outcomeOnly = false) {
+	let clock = options.now;
+	const now = () => clock ??= nowSeconds();
+	const tracer = options.explain === true ? {
+		evaluated: 0,
+		allows: [],
+		denies: [],
+		skipped: []
+	} : void 0;
+	const done = (decision) => outcomeOnly ? decision : freezeDeep(tracer === void 0 ? decision : {
+		...decision,
+		trace: {
+			evaluated: tracer.evaluated,
+			allows: tracer.allows,
+			denies: tracer.denies,
+			skipped: tracer.skipped
+		}
+	});
+	const skip = (grant, why) => {
+		tracer?.skipped.push({
+			role: grant.role,
+			permission: grant.permission,
+			effect: grant.effect,
+			why
+		});
+	};
+	if (!coveredByInclude(snapshot, permission)) return done({
+		outcome: "denied",
+		denials: [{
+			role: null,
+			reason: "opaque-condition"
+		}],
+		alternatives: []
+	});
+	const { current, next } = rowValues(permission, data);
+	const scopes = scopeList(snapshot.scopes);
+	const denials = [];
+	const allows = [];
+	for (const grant of snapshot.grants) {
+		if (grant.permission !== permission.key) continue;
+		if (tracer !== void 0) tracer.evaluated += 1;
+		const match = matchGrantee(grant.to, subject, now(), void 0, scopes, void 0, grant.effect === "deny");
+		if (!match.matched) {
+			denials.push(compact({
+				role: grant.role,
+				reason: match.reason ?? "no-grant",
+				to: grant.to
+			}));
+			continue;
+		}
+		let scoped = scopeOk(snapshot, grant, permission, subject, permission.kind === "instance" ? current : next, team, now(), options.scope);
+		if (scoped.ok && permission.kind === "instance" && next !== current) scoped = scopeOk(snapshot, grant, permission, subject, next, team, now(), options.scope);
+		if (!scoped.ok) {
+			denials.push(compact({
+				role: grant.role,
+				reason: scoped.reason,
+				to: grant.to
+			}));
+			continue;
+		}
+		if (!isActive(grant.validity, now())) {
+			if (grant.effect === "allow") denials.push({
+				role: grant.role,
+				reason: "inactive-grant",
+				detail: grant.validity
+			});
+			else skip(grant, "validity");
+			continue;
+		}
+		if (grant.effect === "deny" && grant.portable === false) {
+			if (!grantCoversField(grant.fields, options.field, grant.effect)) {
+				skip(grant, "field");
+				continue;
+			}
+			tracer?.denies.push(matchedOf(grant));
+			return done({
+				outcome: "denied",
+				denials: [{
+					role: grant.role,
+					reason: "opaque-condition"
+				}],
+				alternatives: []
+			});
+		}
+		const condition = conditionOk(grant, permission, current, next, subject, now(), scopes);
+		if (!condition.matched && grant.effect === "deny" && condition.reason === "opaque-condition" && grantCoversField(grant.fields, options.field, grant.effect)) {
+			tracer?.denies.push(matchedOf(grant));
+			return done({
+				outcome: "denied",
+				denials: [{
+					role: grant.role,
+					reason: "opaque-condition"
+				}],
+				alternatives: []
+			});
+		}
+		if (!condition.matched) {
+			denials.push({
+				role: grant.role,
+				reason: condition.reason ?? "condition"
+			});
+			continue;
+		}
+		if (!grantCoversField(grant.fields, options.field, grant.effect)) {
+			skip(grant, "field");
+			continue;
+		}
+		if (grant.effect === "deny") {
+			tracer?.denies.push(matchedOf(grant));
+			return done({
+				outcome: "denied",
+				denials: [{
+					role: grant.role,
+					reason: "deny"
+				}],
+				alternatives: []
+			});
+		}
+		tracer?.allows.push(matchedOf(grant));
+		allows.push(grant);
+	}
+	const [matched] = allows;
+	if (matched === void 0) {
+		for (const entry of snapshot.notEntitled ?? []) if (entry.permission === permission.key) denials.push({
+			role: entry.role,
+			reason: "not-entitled",
+			to: entry.to
+		});
+		return done({
+			outcome: "denied",
+			denials: denials.length > 0 ? denials : [{
+				role: null,
+				reason: subject.principal === null ? "anonymous" : "no-grant"
+			}],
+			alternatives: []
+		});
+	}
+	if (snapshot.delegated !== void 0 && !snapshot.delegated.includes(permission.key)) return done({
+		outcome: "denied",
+		denials: [{
+			role: null,
+			reason: "not-delegated"
+		}],
+		alternatives: []
+	});
+	const miss = coveredByDelegation(permission, subject.delegation, resourceIdOf(current), subject.actor !== void 0 && snapshot.delegated === void 0);
+	if (miss !== void 0) return done({
+		outcome: "denied",
+		denials: [{
+			role: null,
+			reason: miss
+		}],
+		alternatives: []
+	});
+	const resourceId = permission.kind === "collection" ? "*" : rowIdOf(current, snapshot.ids?.[permission.resource]);
+	const token = outcomeOnly ? "" : decisionToken({
+		key: permission.key,
+		resourceId,
+		principal: subject.principal,
+		actor: subject.actor,
+		fingerprint: `snapshot:${String(snapshot.issuedAt)}`,
+		payload: resourceId === "*" && (next ?? current) !== void 0 ? payloadDigest(next ?? current) : void 0
+	});
+	const grant = matchedOf(matched);
+	if (requiresApproval(matched.approval)) return done({
+		outcome: "approval-required",
+		grant,
+		reason: "human",
+		token
+	});
+	return done({
+		outcome: "granted",
+		subject,
+		matched: grant,
+		token
+	});
+}
+function whereFromSnapshot(snapshot, subject, permission, team) {
+	return whereFromGrants(snapshot.grants.filter((grant) => grant.permission === permission.key), {
+		resource: permission.resource,
+		scopes: scopeList(snapshot.scopes),
+		partitioned: (name) => snapshot.scopes?.find((entry) => entry.name === name)?.resources?.includes(permission.resource) === true,
+		fieldOf: (name) => snapshotField(snapshot, name, permission.resource),
+		tenant: subject.principal?.tenant,
+		team,
+		now: nowSeconds(),
+		subject
+	});
+}
+//#endregion
+//#region src/core/snapshot-subject.ts
+function subjectFromSnapshot(snapshot, tenant) {
+	const principal = snapshot.subject.principal;
+	const nextTenant = principal === null ? void 0 : tenant === void 0 ? principal.tenant : resolveActiveTenant(compact({
+		...principal,
+		memberships: principal.memberships ?? []
+	}), tenant, scopeList(snapshot.scopes));
+	return freezeDeep(compact({
+		principal: principal === null ? null : compact({
+			...principal,
+			tenant: nextTenant
+		}),
+		delegation: snapshot.subject.delegation,
+		context: snapshot.subject.context,
+		expiresAt: snapshot.expiresAt
+	}));
+}
+/**
+* Role names held in `tenant`, or only on memberships of one `scope` (and
+* instance `id`), ordered like `rank` (the snapshot's ranked `roles`).
+*/
+function heldRoleNames(subject, tenant, scopes, only, now) {
+	const scope = only?.scope === void 0 ? void 0 : resolveScope(scopes, only.scope);
+	if (only?.scope !== void 0 && scope === void 0) return [];
+	const names = new Set(scope === void 0 ? subject.principal?.roles ?? [] : []);
+	for (const membership of subject.principal?.memberships ?? []) {
+		if (isMembershipExpired(membership, now)) continue;
+		if (!(scope === void 0 ? tenantOf(membership, scopes) === tenant : membership.scope === scope && (only?.id === void 0 || sameId(membership.id, only.id)))) continue;
+		for (const role of membership.roles) names.add(role);
+	}
+	const rank = only?.rank ?? [];
+	const position = (name) => {
+		const index = rank.indexOf(name);
+		return index === -1 ? rank.length : index;
+	};
+	return [...names].toSorted((a, b) => position(a) - position(b));
+}
+//#endregion
+//#region src/core/from-snapshot.ts
+function resourceRef(snapshot, permission, data) {
+	const id = permission.kind === "collection" ? void 0 : rowIdOf(data, snapshot.ids?.[permission.resource]);
+	return id === void 0 || id === "*" ? { type: permission.resource } : {
+		type: permission.resource,
+		id
+	};
+}
+function assignableEntry(snapshot, tenant) {
+	if (tenant === void 0) return;
+	return snapshot.assignable?.find((entry) => entry.tenant === tenant);
+}
+function fromSnapshot(snapshot, options = {}) {
+	const subject = subjectFromSnapshot(snapshot, options.tenant);
+	const team = options.team;
+	const run = (permission, data, decideOptions = {}) => evaluateSnapshot(snapshot, subject, permission, data, team, decideOptions);
+	const decide = ((permission, data, decideOptions = {}) => run(permission, data, decideOptions));
+	const can = ((permission, data, decideOptions) => {
+		try {
+			return evaluateSnapshot(snapshot, subject, permission, data, team, decideOptions ?? {}, true).outcome === "granted";
+		} catch {
+			return false;
+		}
+	});
+	const assert = ((permission, data, decideOptions) => {
+		const decision = run(permission, data, decideOptions);
+		if (decision.outcome === "granted") return decision;
+		if (decision.outcome === "approval-required") throw new PermDockApprovalRequiredError({
+			decision,
+			permission: permission.key,
+			scope: permission.scope,
+			resource: resourceRef(snapshot, permission, data),
+			message: approvalMessage(permission.key, decision.reason, decision.token)
+		});
+		throw new PermDockDeniedError({
+			decision,
+			permission: permission.key,
+			scope: permission.scope,
+			resource: resourceRef(snapshot, permission, data),
+			subject,
+			message: deniedMessage(permission.key, subject.principal?.id, decision.denials, [])
+		});
+	});
+	const explain = ((permission, data, decideOptions) => run(permission, data, {
+		...decideOptions,
+		source: decideOptions?.source ?? "explain",
+		explain: true
+	}));
+	const instance = {
+		can,
+		decide,
+		assert,
+		explain,
+		permissions: {},
+		roles: snapshot.vocabulary?.roles ?? {},
+		plans: snapshot.vocabulary?.plans ?? {},
+		filter(permission, rows, decideOptions) {
+			return rows.filter((row) => can(permission, row, decideOptions) === true);
+		},
+		pick(permission, row, decideOptions) {
+			if (row === null || typeof row !== "object") return {};
+			if (can(permission, row, decideOptions) !== true) return {};
+			return pickVisible(row, (field) => {
+				const next = compact({
+					...decideOptions,
+					field
+				});
+				return can(permission, row, next) === true;
+			});
+		},
+		where(permission) {
+			return whereFromSnapshot(snapshot, subject, permission, team);
+		},
+		actions(resource, data, decideOptions) {
+			return listPermissions(resource).filter((item) => run(item, data, decideOptions).outcome === "granted");
+		},
+		simulate: ((input, simulateOptions) => {
+			if (Array.isArray(input)) return input.map(([permission, data]) => run(permission, data, compact({ now: simulateOptions?.now })));
+			if (isArazzoSimulateInput(input)) return simulateArazzo(input, input.permissions, (permission, data) => run(permission, data));
+			const preview = input;
+			const previewRoles = preview.roles?.map((item) => typeof item === "string" ? item : item.key);
+			return fromSnapshot(freezeDeep({
+				...snapshot,
+				simulated: true,
+				subject: {
+					...snapshot.subject,
+					principal: snapshot.subject.principal === null ? null : compact({
+						...snapshot.subject.principal,
+						roles: previewRoles ?? snapshot.subject.principal.roles,
+						memberships: preview.memberships === void 0 ? snapshot.subject.principal.memberships : normalizeMemberships(preview.memberships, scopeList(snapshot.scopes)),
+						tenant: preview.tenant ?? snapshot.subject.principal.tenant
+					})
+				}
+			}), options);
+		}),
+		snapshot: ((signing) => signing?.signer === void 0 ? snapshot : signSnapshot(snapshot, signing.signer, signing.audience)),
+		on() {
+			return () => void 0;
+		},
+		tenant(id) {
+			return fromSnapshot(snapshot, compact({
+				tenant: id,
+				team
+			}));
+		},
+		team(id) {
+			return fromSnapshot(snapshot, compact({
+				tenant: options.tenant,
+				team: id
+			}));
+		},
+		memberships() {
+			return subject.principal?.memberships ?? [];
+		},
+		tenants() {
+			return snapshot.tenants;
+		},
+		heldRoles(query) {
+			const names = heldRoleNames(subject, query?.tenant ?? subject.principal?.tenant, scopeList(snapshot.scopes), compact({
+				scope: query?.scope,
+				id: query?.id,
+				rank: snapshot.roles
+			}));
+			const tree = snapshot.vocabulary?.roles;
+			return names.map((name) => findRole(tree, name) ?? synthesiseRole(name));
+		},
+		audiences() {
+			const tenant = subject.principal?.tenant;
+			if (tenant === snapshot.subject.principal?.tenant) return snapshot.audiences ?? [];
+			const tree = snapshot.vocabulary?.roles;
+			const out = [];
+			for (const name of heldRoleNames(subject, tenant, scopeList(snapshot.scopes), { rank: snapshot.roles })) {
+				const audience = findRole(tree, name)?.meta.audience;
+				if (typeof audience === "string" && !out.includes(audience)) out.push(audience);
+			}
+			return out;
+		},
+		loadRelations() {
+			return Promise.resolve();
+		},
+		whoCan(permission) {
+			return Promise.resolve(freezeDeep({
+				permission: permission.key,
+				holders: [],
+				complete: false
+			}));
+		},
+		decideRoleChange(change) {
+			return freezeDeep({
+				outcome: "denied",
+				change,
+				denials: [{
+					role: null,
+					reason: "unsupported"
+				}]
+			});
+		},
+		derive() {
+			return instance;
+		},
+		activate() {
+			return freezeDeep({
+				outcome: "denied",
+				denials: [{
+					role: null,
+					reason: "unsupported"
+				}],
+				alternatives: []
+			});
+		},
+		assignableRoles(query) {
+			const tenant = query?.tenant ?? subject.principal?.tenant;
+			const tree = snapshot.vocabulary?.roles;
+			if (snapshot.assignable !== void 0) return (assignableEntry(snapshot, tenant)?.roles ?? []).map((name) => findRole(tree, name) ?? synthesiseRole(name, { assignable: true }));
+			const names = new Set(heldRoleNames(subject, tenant, scopeList(snapshot.scopes)));
+			return listRoles(tree).filter((leaf) => leaf.assignable && names.has(leaf.key));
+		},
+		assignablePermissions(query) {
+			if (query?.scope === "global") return [];
+			return assignableEntry(snapshot, query?.tenant ?? subject.principal?.tenant)?.permissions ?? [];
+		},
+		assignableLevels(permission, query) {
+			if (query?.scope === "global") return [];
+			const levels = assignableEntry(snapshot, query?.tenant ?? subject.principal?.tenant)?.levels;
+			if (levels === void 0 || !Object.hasOwn(levels, permission.key)) return [];
+			const names = levels[permission.key];
+			return Array.isArray(names) ? names.filter((name) => typeof name === "string") : [];
+		},
+		subject
+	};
+	return Object.freeze(instance);
+}
+function emptySnapshot() {
+	return freezeDeep({
+		v: 1,
+		issuedAt: 0,
+		subject: {
+			principal: null,
+			context: {}
+		},
+		roles: [],
+		grants: [],
+		tenants: []
+	});
+}
+//#endregion
+export { fromSnapshot as n, heldRoleNames as r, emptySnapshot as t };