permdock 0.0.0 → 0.2.0

package/dist/permdock-CzqXjCpU.js

@@ -0,0 +1,3471 @@
+import { n as isReadonlyArray, r as sole, t as compact } from "./compact-y6vfu2_f.js";
+import { n as freezeDeep, t as freezeCopy } from "./freeze-CrU8nQeX.js";
+import { E as ownGet, T as isForbiddenKey, _ as listPermissions, a as formerKeys, c as getResource, d as isEdgeRelation, f as isFieldRelation, i as findPermission, m as isPrincipalRelation, o as formerScopes, r as expandRelation } from "./permissions-DVoF6dMt.js";
+import { a as hasConditionOp } from "./refs-KYb4ntaz.js";
+import { d as normalizeApproval, f as normalizeAssurance, g as applyQuota, i as declaredRoleNames$1, l as levelCondition, m as role, n as assertApprovalRelations, s as grantList, u as levelNames, v as normalizeWhere } from "./policy-xyWg7QdR.js";
+import { n as PermDockValidationError } from "./validation-error-CnjZ4t92.js";
+import { a as wireDenials } from "./problem-details-_AMOYz-w.js";
+import { a as deniedMessage, i as approvalMessage, n as PermDockDeniedError, t as PermDockApprovalRequiredError } from "./errors-Cz5zn0mW.js";
+import { n as sameId } from "./ids-DC4V4CFu.js";
+import { a as normalizeMemberships, c as rootScope, d as scopeList, f as subjectForPermission, i as keepsPermission, l as scopeChain, m as tenantOf, o as resolveScope, s as rootMembershipId, u as scopeIdOf } from "./scopes-CVdPrWN-.js";
+import { a as whereFromGrants, c as rowIdOf, d as isArazzoSimulateInput, f as simulateArazzo, i as signSnapshot, l as rowValues, p as evaluateCondition, r as snapshotGrant, s as isRowPair, t as buildSnapshot } from "./snapshot-Enxd0n-s.js";
+import { t as parseDuration } from "./duration-xK2jGFVc.js";
+import { D as synthesiseRole, E as listRoles, S as findRole, _ as resourceRoleCondition, a as authenticated, d as matchGrantee, i as assurance, m as relationCondition, o as combineWhere, r as asGrantee, s as flattenGrantee, w as isRole } from "./grantee-Cv5Sogfv.js";
+import { t as canonicalJson } from "./canonical-json-DemiK4Vp.js";
+import { n as pickVisible, r as sanitizeContext, t as grantCoversField } from "./fields-BMl1RxoX.js";
+import { a as isMembershipExpired, d as partitionsOf, f as relatesTo, g as tenantsOf, h as scopeField, i as inTeam, o as matchScopedMembership, p as resolveActiveTenant, r as heldRoleNamesIn, t as isActive, u as nowSeconds } from "./validity-uOp8UpYn.js";
+import { t as requiresApproval } from "./approval-required-TzNB9oQA.js";
+import { r as mergeHostedGrants, t as isPortableCondition } from "./hosted-DJQw46hn.js";
+import { n as isThenable, t as ignoreRejection } from "./thenable-okc2xDsj.js";
+import { t as byCodePoint } from "./compare-pfyVnBjE.js";
+import { a as relationWalk, i as relationReader, n as pendingRelations, o as resolveRelated, r as relationId } from "./relations-cjOL01hZ.js";
+import { i as requiresStandIn, n as coversRequirements, r as delegatedPermissions, t as coveredByDelegation } from "./delegation-D8pUEuce.js";
+import { t as resourceIdOf } from "./resource-ref-CaS9yVPi.js";
+import { n as payloadDigest, r as versionOf, t as decisionToken } from "./token-CIWxJOCh.js";
+import { i as isSubject, r as isPrincipal, t as anonymousSubject } from "./subject-C6dLxqHU.js";
+//#region src/core/approval-policies.ts
+/** The denial detail when an `ApprovalPolicySource` fails: every call an allow would grant denies with reason `approval`. */
+const APPROVAL_POLICY_UNAVAILABLE = "approval-policy-unavailable";
+function memoryApprovalPolicies(policies) {
+	const entries = [...policies];
+	return Object.freeze({ approvalPoliciesFor(query) {
+		return entries.filter((entry) => entry.tenant === void 0 || query.tenants.includes(entry.tenant));
+	} });
+}
+function isRecord(value) {
+	return value !== null && typeof value === "object" && !Array.isArray(value);
+}
+function isStringList(value) {
+	return Array.isArray(value) && value.every((item) => typeof item === "string");
+}
+function checkOne(policy, raw) {
+	if (!isRecord(raw) || typeof raw["permission"] !== "string") return { problem: "invalid" };
+	const permission = findPermission(policy.permissions, raw["permission"]);
+	if (permission === void 0) return { problem: "unknown-permission" };
+	const { tenant, actors, where, check, approval } = raw;
+	if (tenant !== void 0 && typeof tenant !== "string" || actors !== void 0 && !isStringList(actors) || where !== void 0 && !isPortableCondition(where) || check !== void 0 && !isPortableCondition(check) || approval !== "human" && !isRecord(approval)) return { problem: "invalid" };
+	if (where !== void 0 && permission.kind !== "instance") return { problem: "where-on-collection" };
+	let normalized;
+	try {
+		normalized = normalizeApproval(approval, permission.key);
+		if (normalized !== void 0) assertApprovalRelations([{
+			permission,
+			approval: normalized
+		}], policy.resources);
+	} catch {
+		return { problem: "invalid" };
+	}
+	if (normalized === void 0) return { problem: "invalid" };
+	if (normalized !== "human" && normalized.staleOn !== void 0 && (permission.kind !== "instance" || policy.resources.get(permission.resource)?.version === void 0)) return { problem: "stale-on-without-version" };
+	return { entry: compact({
+		permission: permission.key,
+		tenant,
+		actors: actors === void 0 ? void 0 : new Set(actors),
+		where: where === void 0 ? void 0 : normalizeWhere(where),
+		check: check === void 0 ? void 0 : normalizeWhere(check),
+		approval: normalized
+	}) };
+}
+/**
+* Checks one entry against the policy the way `approvalPoliciesFor` loads
+* it, for an application to refuse a bad entry when it is saved instead of
+* finding every call denied. Never throws.
+*/
+function validateApprovalPolicy(policy, entry) {
+	try {
+		const checked = checkOne(policy, entry);
+		return "problem" in checked ? {
+			ok: false,
+			problem: checked.problem
+		} : { ok: true };
+	} catch {
+		return {
+			ok: false,
+			problem: "invalid"
+		};
+	}
+}
+/**
+* One raw entry checked against the policy: `null` when it names no
+* permission the policy declares (it applies to nothing), `undefined` when
+* it does not load.
+*/
+function loadOne(policy, raw) {
+	const checked = checkOne(policy, raw);
+	if ("entry" in checked) return checked.entry;
+	return checked.problem === "unknown-permission" ? null : void 0;
+}
+function loadAll(policy, raw) {
+	if (!Array.isArray(raw)) return "failed";
+	const out = [];
+	for (const item of raw) {
+		const loaded = loadOne(policy, item);
+		if (loaded === void 0) return "failed";
+		if (loaded !== null) out.push(loaded);
+	}
+	return out;
+}
+/** Reads the source once for `tenants`; a throw or an invalid entry loads as `"failed"`. */
+function approvalPoliciesFor(policy, source, tenants, auth) {
+	if (source === void 0) return;
+	const threw = () => {
+		auth.push({
+			reason: "source-threw",
+			source: "approvalPolicies"
+		});
+		return "failed";
+	};
+	let raw;
+	try {
+		raw = source.approvalPoliciesFor({ tenants });
+	} catch {
+		return threw();
+	}
+	if (isThenable(raw)) return Promise.resolve(raw).then((value) => loadAll(policy, value), threw);
+	return loadAll(policy, raw);
+}
+function matches(entry, tenant, subject, current, next, now, scopes) {
+	if (entry.tenant !== void 0 && entry.tenant !== tenant) return false;
+	if (entry.actors !== void 0 && (subject.actor === void 0 || !entry.actors.has(subject.actor.kind))) return false;
+	if (entry.where !== void 0 && !evaluateCondition(entry.where, current, subject, now, scopes)) return false;
+	return entry.check === void 0 || evaluateCondition(entry.check, next ?? current, subject, now, scopes);
+}
+function asStages(approval) {
+	if (approval === "human") return [{ by: authenticated() }];
+	if (approval.stages !== void 0) return approval.stages;
+	return [compact({
+		by: approval.by ?? authenticated(),
+		quorum: approval.quorum
+	})];
+}
+/** An entry's stages, each carrying the entry's escalation unless it has its own. */
+function entryStages(approval) {
+	const stages = asStages(approval);
+	if (approval === "human" || approval.escalation === void 0) return stages;
+	const escalation = approval.escalation;
+	return stages.map((stage) => stage.escalation === void 0 ? compact({
+		by: stage.by,
+		quorum: stage.quorum,
+		escalation
+	}) : stage);
+}
+function shorter(a, b) {
+	if (a === void 0) return b;
+	if (b === void 0) return a;
+	return (parseDuration(b) ?? Infinity) < (parseDuration(a) ?? Infinity) ? b : a;
+}
+/**
+* `code` with every matching entry added as further stages: the result
+* needs all of them (`'sequential'` when any part is ordered), keeps the
+* code's escalation, the shortest `ttl`, and `distinct` unless every part
+* opts out. Without a matching entry, `code` unchanged.
+*/
+function tightenApproval(code, entries, input) {
+	const extra = entries.filter((entry) => entry.permission === input.permission && matches(entry, input.tenant, input.subject, input.current, input.next, input.now, input.scopes));
+	if (extra.length === 0) return code;
+	const parts = [...code === void 0 ? [] : [code], ...extra.map((entry) => entry.approval)];
+	const stages = [];
+	const seen = /* @__PURE__ */ new Set();
+	let sequential = false;
+	let distinct = false;
+	let staleOn;
+	let ttl;
+	for (const [index, part] of parts.entries()) {
+		const fromCode = code !== void 0 && index === 0;
+		for (const stage of fromCode ? asStages(part) : entryStages(part)) {
+			const key = JSON.stringify(stage);
+			if (!seen.has(key)) {
+				seen.add(key);
+				stages.push(stage);
+			}
+		}
+		if (part === "human") {
+			distinct = true;
+			continue;
+		}
+		sequential ||= part.mode === "sequential";
+		distinct ||= part.distinct !== false;
+		staleOn ??= part.staleOn;
+		ttl = shorter(ttl, part.ttl);
+	}
+	return compact({
+		mode: sequential ? "sequential" : "all",
+		stages,
+		distinct: distinct ? void 0 : false,
+		staleOn,
+		ttl,
+		escalation: code === void 0 || code === "human" ? void 0 : code.escalation
+	});
+}
+/** The tenant a matched allow applies in: its membership's root scope, else the active tenant. */
+function decisionTenant(subject, membership) {
+	return (membership === void 0 ? void 0 : rootMembershipId(membership)) ?? subject.principal?.tenant;
+}
+//#endregion
+//#region src/core/memberships.ts
+/** Two memberships are the same row when everything but `roles` matches. */
+function identity(membership) {
+	const within = Object.entries(membership.within ?? {}).toSorted(([a], [b]) => byCodePoint(a, b));
+	return JSON.stringify([
+		membership.scope ?? null,
+		membership.id ?? null,
+		within,
+		membership.on ?? null,
+		membership.tenant ?? null,
+		membership.team ?? null,
+		membership.via ?? null,
+		membership.expiresAt ?? null,
+		membership.grantedBy ?? null,
+		membership.reason ?? null,
+		membership.member?.group ?? null,
+		[...membership.eligible ?? []].toSorted(),
+		membership.managedBy ?? null,
+		[...membership.entitlements ?? []].toSorted(),
+		membership.keep === void 0 ? null : [...membership.keep].toSorted()
+	]);
+}
+/**
+* Merges memberships from several sources: entries naming the same instance
+* with the same `via`, expiry, owner and seats become one entry with the union
+* of their roles. Entries that differ in any of those stay separate, so a
+* staff role and a contact role in one instance keep their own `via`.
+*/
+function mergeMemberships(lists) {
+	const merged = /* @__PURE__ */ new Map();
+	for (const list of lists) for (const membership of list) {
+		const key = identity(membership);
+		const found = merged.get(key);
+		merged.set(key, found === void 0 ? membership : {
+			...found,
+			roles: [.../* @__PURE__ */ new Set([...found.roles, ...membership.roles])]
+		});
+	}
+	return [...merged.values()];
+}
+function all(values) {
+	return values.some((value) => isThenable(value)) ? Promise.all(values) : values;
+}
+function then(value, next) {
+	return isThenable(value) ? Promise.resolve(value).then(next) : next(value);
+}
+/**
+* One `MembershipSource` over several: memberships are merged and
+* de-duplicated, `list` concatenates the sources that can list, and `version`
+* is the highest version any source reports. A source that throws makes the
+* whole lookup throw, which the subject resolver turns into no memberships.
+*/
+function composeMemberships(sources) {
+	const listing = sources.filter((source) => source.list !== void 0);
+	const versioned = sources.filter((source) => source.version !== void 0);
+	return {
+		membershipsFor(principal, options) {
+			return then(all(sources.map((source) => source.membershipsFor(principal, options))), (lists) => mergeMemberships(lists));
+		},
+		...listing.length === 0 ? {} : { list(query) {
+			return then(all(listing.map((source) => source.list?.(query) ?? [])), (lists) => {
+				const seen = /* @__PURE__ */ new Map();
+				for (const entry of lists.flat()) {
+					const key = `${entry.principal.id}\u0000${identity(entry.membership)}`;
+					const found = seen.get(key);
+					seen.set(key, found === void 0 ? entry : {
+						principal: entry.principal,
+						membership: {
+							...found.membership,
+							roles: [.../* @__PURE__ */ new Set([...found.membership.roles, ...entry.membership.roles])]
+						}
+					});
+				}
+				return [...seen.values()];
+			});
+		} },
+		...versioned.length === 0 ? {} : { version(principal) {
+			return then(all(versioned.map((source) => source.version?.(principal))), (versions) => {
+				const known = versions.filter((value) => typeof value === "number" && Number.isFinite(value));
+				return known.length === 0 ? void 0 : Math.max(...known);
+			});
+		} }
+	};
+}
+/** A single source, or several composed. */
+function asMembershipSource(input) {
+	return Array.isArray(input) ? composeMemberships(input) : input;
+}
+/**
+* Trust the memberships the verified token carries, and read `source` only
+* when the token marks them truncated. With `version`, a token minted before
+* the latest membership change is stale for the policy's `fresh` permissions,
+* or with `onStale: 'reread'` has its memberships read from `source` instead.
+*/
+function claimsFirst(source, options = {}) {
+	const inner = asMembershipSource(source);
+	const version = options.version ?? (inner.version === void 0 ? void 0 : (principal) => inner.version?.(principal));
+	return {
+		membershipsFor: (principal, query) => inner.membershipsFor(principal, query),
+		...inner.list === void 0 ? {} : { list: (query) => inner.list?.(query) ?? [] },
+		...version === void 0 ? {} : { version },
+		...options.onStale === "reread" ? { onStale: "reread" } : {},
+		claimsFirst: true
+	};
+}
+/** Whether the identity provider owns `membership`: the application must not add, change or remove it. */
+function isExternallyManaged(membership) {
+	return membership.managedBy === "idp";
+}
+/**
+* How many principals hold `role` in one scope instance now, from the
+* source's member list (`MembershipSource.list`): live memberships of exactly
+* that scope and instance, each principal counted once. The `holders` a
+* `decideRoleChange` with `min`, `max` or `transferOnly` needs. `undefined`
+* when the source cannot list or the read fails, which that check denies.
+*/
+async function countHolders(source, query) {
+	const composed = asMembershipSource(source);
+	if (composed.list === void 0) return;
+	const role = typeof query.role === "string" ? query.role : query.role.key;
+	try {
+		const entries = await composed.list({
+			scope: query.scope,
+			id: query.id
+		});
+		const now = Math.floor(Date.now() / 1e3);
+		const holders = /* @__PURE__ */ new Set();
+		for (const entry of entries) {
+			const membership = entry.membership;
+			if (membership.scope === query.scope && membership.id === query.id && membership.roles.includes(role) && (membership.expiresAt === void 0 || membership.expiresAt > now)) holders.add(entry.principal.id);
+		}
+		return holders.size;
+	} catch {
+		return;
+	}
+}
+//#endregion
+//#region src/core/custom-roles.ts
+/** The current key for a stored key, current or former; `undefined` when neither. */
+function currentKey(policy, raw) {
+	const leaf = findPermission(policy.permissions, raw);
+	if (leaf === void 0) return;
+	return leaf.key === raw || formerKeys(leaf).includes(raw) ? leaf.key : void 0;
+}
+const GRANT_KEYS = /* @__PURE__ */ new Set([
+	"permission",
+	"effect",
+	"level"
+]);
+/** `where` narrowed by a level; the empty level (`{}`) leaves it as is. */
+function andWhere(where, level) {
+	if (level.op === "and" && level.conditions.length === 0) return where;
+	return where === void 0 ? level : {
+		op: "and",
+		conditions: [where, level]
+	};
+}
+/** A ceiling grant narrowed by a level's condition and marked with the level. */
+function leveled(grant, level, condition) {
+	const where = andWhere(grant.where, condition);
+	const check = grant.check === void 0 ? void 0 : andWhere(grant.check, condition);
+	return freezeDeep({
+		...grant,
+		level,
+		...where === void 0 ? {} : { where },
+		...check === void 0 ? {} : { check }
+	});
+}
+/**
+* The scope a custom role is held at: `scope` (a name or alias), the second
+* scope for the `team` input shape, else the first scope. `undefined` when
+* the policy does not declare it; such a role resolves to nothing.
+*/
+function customRoleScope(role, scopes) {
+	if (role.scope === "global") return "global";
+	if (role.scope !== void 0) return resolveScope(scopes, role.scope);
+	return resolveScope(scopes, role.team === void 0 ? "tenant" : "team");
+}
+/** The instance of its scope a custom role is pinned to, if any. */
+function customRoleId(role) {
+	return role.scope === void 0 ? role.team : role.id;
+}
+/** A platform custom role: held through `principal.roles`, capped by the assignable global roles. */
+function isGlobalCustomRole(role) {
+	return role.scope === "global";
+}
+function isCeilingScope(scope) {
+	return typeof scope === "string";
+}
+function soleRole(grant) {
+	const roles = flattenGrantee(grant.to).filter((item) => item.kind === "role");
+	const first = roles[0];
+	return roles.length === 1 && first?.kind === "role" ? first.role : void 0;
+}
+/** Permission keys a declared role's allows reach, hosted grants included. */
+function roleAllowKeys(policy, name) {
+	return new Set(grantList(policy).filter((grant) => grant.effect === "allow" && soleRole(grant) === name).map((grant) => grant.permission.key));
+}
+function isAssignableRole(policy, name) {
+	const binding = policy.rolesByName.get(name);
+	if (binding !== void 0) return binding.assignable;
+	return findRole(policy.vocabulary?.roles, name)?.assignable === true;
+}
+/**
+* Every scope's ceiling, keyed by scope name (`global` for platform custom
+* roles): the code allows of declared `assignable` roles in that scope,
+* everything a custom role of the scope may ever reach. Hosted grants never
+* widen it. `assignable` narrows it to those role names (`RoleSource.assignable`).
+*/
+function ceilings(policy, assignable) {
+	const allowed = assignable === void 0 ? void 0 : new Set(assignable);
+	const byScope = /* @__PURE__ */ new Map();
+	for (const grant of grantList(policy)) {
+		const name = soleRole(grant);
+		if (grant.effect !== "allow" || grant.hosted !== void 0 || !isCeilingScope(grant.scope) || name === void 0 || !isAssignableRole(policy, name) || allowed !== void 0 && !allowed.has(name)) continue;
+		const list = byScope.get(grant.scope) ?? [];
+		list.push(grant);
+		byScope.set(grant.scope, list);
+	}
+	return byScope;
+}
+function ceilingGrants(policy, scope, assignable) {
+	return ceilings(policy, assignable).get(scope) ?? [];
+}
+function retarget(grant, role, scope) {
+	const grantee = {
+		kind: "role",
+		role: role.name,
+		scope
+	};
+	const others = flattenGrantee(grant.to).filter((item) => item.kind !== "role");
+	return freezeDeep({
+		...grant,
+		to: others.length === 0 ? grantee : [grantee, ...others],
+		role: role.name,
+		scope
+	});
+}
+/**
+* The one resolver behind evaluation, snapshots and `validateCustomRole`.
+* Included roles' grants plus the role's own allows, minus its denies, all
+* intersected with the ceiling. An allow inherits the condition, approval and
+* limit of the declared grant it comes from: an included assignable role's
+* grant when there is one, otherwise every ceiling grant of that permission,
+* together with the denies of the roles those grants belong to.
+*/
+function resolveCustomRole(policy, role) {
+	const scope = customRoleScope(role, scopeList(policy.scopes));
+	if (scope === void 0) return freezeDeep({
+		grants: [],
+		dropped: [],
+		renamed: []
+	});
+	const ceiling = ceilingGrants(policy, scope);
+	const ceilingSet = new Set(ceiling);
+	const ceilingKeys = new Set(ceiling.map((grant) => grant.permission.key));
+	const declared = declaredRoleNames$1(policy);
+	const all = grantList(policy).filter((grant) => grant.hosted === void 0);
+	const dropped = [];
+	const renamed = [];
+	const seen = /* @__PURE__ */ new Set();
+	const drop = (entry) => {
+		const id = "role" in entry ? `role:${entry.role}` : `${entry.reason}:${entry.permission}`;
+		if (!seen.has(id)) {
+			seen.add(id);
+			dropped.push(entry);
+		}
+	};
+	const included = [];
+	const includedKeys = /* @__PURE__ */ new Set();
+	const allowKeys = /* @__PURE__ */ new Map();
+	const denyKeys = /* @__PURE__ */ new Set();
+	const allowAll = (key) => {
+		allowKeys.set(key, "all");
+	};
+	for (const name of Array.isArray(role.includes) ? role.includes : []) {
+		if (typeof name !== "string" || !declared.has(name)) {
+			drop({
+				role: String(name),
+				reason: "unknown-role"
+			});
+			continue;
+		}
+		for (const grant of all) {
+			if (soleRole(grant) !== name) continue;
+			const key = grant.permission.key;
+			if (grant.effect === "deny") {
+				if (grant.scope === scope) included.push(grant);
+			} else if (ceilingSet.has(grant)) {
+				included.push(grant);
+				includedKeys.add(key);
+			} else if (ceilingKeys.has(key)) allowAll(key);
+			else drop({
+				permission: key,
+				reason: "outside-ceiling"
+			});
+		}
+	}
+	const entries = Array.isArray(role.grants) ? role.grants : [];
+	for (const item of entries) {
+		if (item === null || typeof item !== "object") {
+			drop({
+				permission: String(item),
+				reason: "unknown-permission"
+			});
+			continue;
+		}
+		const entry = item;
+		const raw = entry.permission;
+		const key = typeof raw === "string" ? currentKey(policy, raw) : void 0;
+		if (key === void 0) {
+			drop({
+				permission: String(raw),
+				reason: "unknown-permission"
+			});
+			continue;
+		}
+		if (key !== raw) renamed.push({
+			from: String(raw),
+			to: key
+		});
+		const effect = entry.effect ?? "allow";
+		const extra = Object.keys(entry).some((name) => !GRANT_KEYS.has(name));
+		const level = entry.level;
+		if (extra || effect !== "allow" && effect !== "deny" || effect === "deny" && level !== void 0) {
+			drop({
+				permission: key,
+				reason: "condition-not-allowed"
+			});
+			denyKeys.add(key);
+			continue;
+		}
+		if (effect === "deny") {
+			denyKeys.add(key);
+			continue;
+		}
+		let narrowing;
+		if (level !== void 0) {
+			const leaf = findPermission(policy.permissions, key);
+			const condition = typeof level === "string" && leaf?.kind === "instance" ? levelCondition(policy, leaf.resource, level) : void 0;
+			if (condition === void 0) {
+				drop({
+					permission: key,
+					reason: "unknown-level",
+					level: String(level)
+				});
+				denyKeys.add(key);
+				continue;
+			}
+			narrowing = [String(level), condition];
+		}
+		if (!ceilingKeys.has(key)) {
+			drop({
+				permission: key,
+				reason: "outside-ceiling"
+			});
+			continue;
+		}
+		const held = allowKeys.get(key);
+		if (narrowing === void 0) allowAll(key);
+		else if (held === void 0) allowKeys.set(key, new Map([narrowing]));
+		else if (held !== "all") held.set(...narrowing);
+	}
+	const out = [];
+	const push = (grant) => {
+		if (!out.includes(grant)) out.push(grant);
+	};
+	for (const grant of included) if (grant.effect === "deny" || !denyKeys.has(grant.permission.key)) push(grant);
+	for (const [key, levels] of allowKeys) {
+		if (denyKeys.has(key) || includedKeys.has(key)) continue;
+		const sources = /* @__PURE__ */ new Set();
+		for (const grant of ceiling) {
+			if (grant.permission.key !== key) continue;
+			sources.add(soleRole(grant) ?? "");
+			if (levels === "all") {
+				push(grant);
+				continue;
+			}
+			for (const [level, condition] of levels) push(leveled(grant, level, condition));
+		}
+		for (const grant of all) if (grant.effect === "deny" && grant.permission.key === key && sources.has(soleRole(grant) ?? "")) push(grant);
+	}
+	return freezeDeep({
+		grants: out.map((grant) => retarget(grant, role, scope)),
+		dropped,
+		renamed
+	});
+}
+function validateCustomRole(policy, role) {
+	const resolved = resolveCustomRole(policy, role);
+	const permissions = [...new Set(resolved.grants.filter((grant) => grant.effect === "allow").map((grant) => grant.permission.key))].toSorted();
+	return freezeDeep({
+		ok: resolved.dropped.length === 0,
+		permissions,
+		dropped: resolved.dropped,
+		renamed: resolved.renamed
+	});
+}
+function wellFormed(role) {
+	if (role === null || typeof role !== "object" || typeof role.name !== "string") return false;
+	if (role.scope === "global") return role.tenant === void 0 && role.team === void 0 && role.id === void 0;
+	return typeof role.tenant === "string" && (role.team === void 0 || typeof role.team === "string") && (role.scope === void 0 || typeof role.scope === "string") && (role.id === void 0 || typeof role.id === "string");
+}
+/** Every custom role's resolved grants, once per instance. Malformed roles resolve to nothing. */
+function customGrantsFor(policy, roles) {
+	const declared = declaredRoleNames$1(policy);
+	const out = [];
+	for (const role of roles) {
+		if (!wellFormed(role) || declared.has(role.name)) continue;
+		for (const grant of resolveCustomRole(policy, role).grants) out.push({
+			grant,
+			role
+		});
+	}
+	return out;
+}
+/** The well-formed tenant (not platform) custom roles; a declared role name is never one. */
+function tenantCustomRoles(policy, roles) {
+	const declared = declaredRoleNames$1(policy);
+	return roles.filter((role) => wellFormed(role) && !isGlobalCustomRole(role) && !declared.has(role.name));
+}
+/** A membership at the role's scope, inside its tenant (and instance, when pinned), naming it. */
+function holdsCustomRole(membership, role, scopes) {
+	if (isGlobalCustomRole(role)) return false;
+	const scope = customRoleScope(role, scopes);
+	const id = customRoleId(role);
+	return scope !== void 0 && membership.scope === scope && sameId(tenantOf(membership, scopes), role.tenant) && (id === void 0 || sameId(membership.id, id)) && membership.roles.includes(role.name);
+}
+/** Whether `principal.roles` names the platform custom role. */
+function holdsGlobalCustomRole(roles, role) {
+	return isGlobalCustomRole(role) && (roles ?? []).includes(role.name);
+}
+/** A tenant's custom role inside that tenant, or a platform custom role anywhere. */
+function isCustomRoleName(name, roles, tenant) {
+	return roles.some((item) => wellFormed(item) && item.name === name && (isGlobalCustomRole(item) || tenant !== void 0 && sameId(item.tenant, tenant)));
+}
+/**
+* The compact JWT form of custom roles for the `memberships[].grants` claim
+* RLS reads in `jwt` mode: role name to entries, where `key` allows, `-key`
+* denies and `@role` includes. Put a team custom role on its team membership.
+* Pass `policy` to write keys stored under a former name as the current key.
+*/
+function customRoleClaim(roles, policy) {
+	const keyOf = (raw) => policy === void 0 ? raw : currentKey(policy, raw) ?? raw;
+	const claim = {};
+	for (const role of roles) {
+		if (!wellFormed(role) || isForbiddenKey(role.name)) continue;
+		const entries = claim[role.name] ?? [];
+		const includes = Array.isArray(role.includes) ? role.includes : [];
+		const grants = Array.isArray(role.grants) ? role.grants : [];
+		for (const name of includes) entries.push(`@${name}`);
+		for (const grant of grants) {
+			if (grant.effect === "deny") {
+				entries.push(`-${keyOf(grant.permission)}`);
+				continue;
+			}
+			const level = grant.level;
+			entries.push(typeof level === "string" && level !== "" ? `${keyOf(grant.permission)}@${level}` : keyOf(grant.permission));
+		}
+		claim[role.name] = entries;
+	}
+	return freezeDeep(claim);
+}
+/**
+* The `memberships` claim RLS reads in `jwt` mode: each membership canonical,
+* with the custom roles it holds as the compact `grants` map.
+*/
+function membershipsClaim(memberships, customRoles, scopes) {
+	const claim = [];
+	for (const membership of normalizeMemberships(memberships, scopes)) {
+		const held = customRoles.filter((role) => wellFormed(role) && holdsCustomRole(membership, role, scopes));
+		claim.push(held.length === 0 ? membership : Object.assign({}, membership, { grants: customRoleClaim(held) }));
+	}
+	return claim;
+}
+//#endregion
+//#region src/core/elevated.ts
+function flattenPermissions(input) {
+	if (input !== null && typeof input === "object" && "key" in input && "action" in input) return [input];
+	if (isReadonlyArray(input)) return input.flatMap((item) => flattenPermissions(item));
+	return [...listPermissions(input)];
+}
+/**
+* The only deny override: a break-glass grant overrides deny grants whose
+* `name` it lists, and nothing else. It is an allow that stays non-portable
+* (RLS never compiles it) and grants only once its `requires` are met.
+*/
+function breakGlass(permission, options = {}) {
+	const purpose = options.requires?.purpose === void 0 || options.requires.purpose.length === 0 ? void 0 : Object.freeze([...new Set(options.requires.purpose)]);
+	const spec = compact({
+		overrides: Object.freeze([...new Set(options.overrides ?? [])]),
+		purpose,
+		reason: options.requires?.reason === true,
+		assurance: normalizeAssurance(options.requires?.assurance),
+		maxDuration: options.maxDuration,
+		obligations: Object.freeze([...new Set(options.obligations ?? [])])
+	});
+	const grants = flattenPermissions(permission).map((leaf) => freezeDeep(compact({
+		permission: leaf,
+		effect: "allow",
+		to: authenticated(),
+		portable: false,
+		breakGlass: spec
+	})));
+	return sole(grants) ?? grants;
+}
+function supportAccess(options) {
+	const via = options.role;
+	const forbidden = (options.forbid ?? []).flatMap((item) => flattenPermissions(item));
+	const binding = role(options.role, [], {
+		on: options.on ?? "tenant",
+		for: [via]
+	});
+	const denies = forbidden.map((leaf) => freezeDeep(compact({
+		permission: leaf,
+		effect: "deny",
+		to: authenticated(),
+		role: options.role,
+		scope: "global",
+		viaOnly: via,
+		portable: false
+	})));
+	const support = freezeDeep(compact({
+		role: options.role,
+		actorRequired: options.actorRequired === true,
+		consent: {
+			by: asGrantee(options.consent.by),
+			durations: Object.freeze([...new Set(options.consent.durations)])
+		},
+		group: options.group ?? "vendor-support"
+	}));
+	return freezeDeep({
+		...binding,
+		grants: [...binding.grants, ...denies],
+		support
+	});
+}
+/** Whether the subject's authentication is fresh enough for an elevated grant. */
+function assuranceMet(requirement, subject, now) {
+	if (requirement === void 0) return true;
+	const held = subject.principal?.assurance;
+	if (requirement.acr !== void 0 && requirement.acr.length > 0) {
+		const acr = held?.acr;
+		if (acr === void 0 || !requirement.acr.includes(acr)) return false;
+	}
+	if (requirement.amr !== void 0 && requirement.amr.length > 0) {
+		const amr = held?.amr ?? [];
+		if (!requirement.amr.every((method) => amr.includes(method))) return false;
+	}
+	if (requirement.maxAge !== void 0) {
+		const authTime = held?.authTime;
+		if (authTime === void 0 || now - authTime > requirement.maxAge) return false;
+	}
+	return true;
+}
+/** `context.purpose` as a list of strings; fail-closed to empty. */
+function purposesOf(subject) {
+	const value = subject.context["purpose"];
+	return Array.isArray(value) ? value.filter((item) => typeof item === "string") : typeof value === "string" && value !== "" ? [value] : [];
+}
+/**
+* Whether a break-glass grant fires for this subject. It engages when the
+* caller asserts a purpose (`context.purpose`); once engaged, an unlisted
+* purpose, a missing reason or stale authentication denies with the matching
+* reason, and everything met grants with the declared obligations.
+*/
+function evaluateBreakGlass(spec, subject, now) {
+	const purposes = purposesOf(subject);
+	if (purposes.length === 0) return { kind: "inactive" };
+	const required = spec.purpose;
+	if (required !== void 0 && !purposes.some((purpose) => required.includes(purpose))) return {
+		kind: "denied",
+		reason: "purpose"
+	};
+	const reason = subject.context["reason"];
+	if (spec.reason && (typeof reason !== "string" || reason === "")) return {
+		kind: "denied",
+		reason: "reason-required"
+	};
+	if (spec.assurance !== void 0 && !assuranceMet(spec.assurance, subject, now)) return {
+		kind: "denied",
+		reason: "insufficient-user-authentication",
+		to: assurance(spec.assurance)
+	};
+	return {
+		kind: "granted",
+		obligations: [...spec.obligations.map((kind) => ({ kind })), ...typeof reason === "string" && reason !== "" ? [{
+			kind: "justify",
+			reason
+		}] : []]
+	};
+}
+/** Support memberships (`via: 'support'`) the subject holds that demand an actor. */
+function actorRequiredVias(supports) {
+	return new Set(supports.filter((spec) => spec.actorRequired).map((spec) => spec.role));
+}
+/** Whether a membership is a support membership of one of the given kinds. */
+function isSupportMembership(membership, vias) {
+	return membership.via !== void 0 && vias.has(membership.via);
+}
+/**
+* Whether the caller's `within` names the same ancestors as the eligible
+* membership. Omitted means "whatever the membership holds"; any entry that
+* disagrees, or names an ancestor the membership lacks, refuses.
+*/
+function withinAgrees(scopes, held, requested) {
+	if (requested === void 0) return true;
+	return Object.entries(requested).every(([key, id]) => {
+		const name = resolveScope(scopes, key) ?? key;
+		return held !== void 0 && Object.hasOwn(held, name) && held[name] === id;
+	});
+}
+function activationDenied(reason, to) {
+	return freezeDeep({
+		outcome: "denied",
+		denials: [to === void 0 ? {
+			role: null,
+			reason
+		} : {
+			role: null,
+			reason,
+			to
+		}],
+		alternatives: []
+	});
+}
+/**
+* Requests a just-in-time role activation. It never writes: a granted
+* decision carries the elevated membership under `elevation` for the app to
+* write. `approval-required` comes back first when the role's `activation`
+* sets `approval`. Fail-closed: an unknown role, an ineligible subject, a
+* missing justification or stale authentication all deny.
+*/
+function activate(policy, subject, input, now = nowSeconds()) {
+	const roleName = isRole(input.role) ? input.role.key : input.role;
+	const binding = policy.rolesByName.get(roleName);
+	const activation = binding?.activation;
+	const principal = subject.principal;
+	if (principal === null) return activationDenied("anonymous");
+	if (binding === void 0 || activation === void 0) return activationDenied("unknown-role");
+	const scopes = scopeList(policy.scopes);
+	const scope = resolveScope(scopes, input.scope) ?? input.scope;
+	const eligible = (principal.memberships ?? []).find((membership) => membership.scope === scope && sameId(membership.id, input.id) && !isMembershipExpired(membership, now) && (membership.eligible ?? []).includes(roleName) && withinAgrees(scopes, membership.within, input.within));
+	if (eligible === void 0) return activationDenied("no-membership");
+	const within = eligible.within;
+	if (activation.justification === "required") {
+		const reason = input.reason;
+		if (typeof reason !== "string" || reason === "") return activationDenied("reason-required");
+	}
+	if (activation.assurance !== void 0 && !assuranceMet(activation.assurance, subject, now)) return activationDenied("insufficient-user-authentication", assurance(activation.assurance));
+	const requested = parseDuration(input.duration);
+	const cap = parseDuration(activation.maxDuration);
+	const seconds = cap === void 0 ? requested : Math.min(requested ?? cap, cap);
+	const membership = freezeDeep(compact({
+		scope,
+		id: input.id,
+		within,
+		roles: [roleName],
+		via: "elevated",
+		expiresAt: seconds === void 0 ? void 0 : Math.floor(now) + seconds,
+		grantedBy: principal.id,
+		reason: input.reason
+	}));
+	const token = decisionToken({
+		key: `activate:${roleName}`,
+		resourceId: within === void 0 ? `${scope}:${input.id}` : `${scope}:${input.id}@${canonicalJson(within)}`,
+		principal,
+		actor: subject.actor,
+		fingerprint: policy.fingerprint
+	});
+	if (activation.approval !== void 0) return freezeDeep({
+		outcome: "approval-required",
+		grant: {
+			role: roleName,
+			permission: `activate:${roleName}`
+		},
+		reason: "human",
+		token
+	});
+	return freezeDeep({
+		outcome: "granted",
+		subject,
+		matched: {
+			role: roleName,
+			permission: `activate:${roleName}`
+		},
+		token,
+		elevation: membership
+	});
+}
+//#endregion
+//#region src/core/events.ts
+function emitSafe(listeners, payload, errors) {
+	for (const listener of listeners) try {
+		listener(payload);
+	} catch (error) {
+		for (const handler of errors.error) try {
+			handler(error);
+		} catch {}
+	}
+}
+function emptyListeners() {
+	return {
+		decision: /* @__PURE__ */ new Set(),
+		denied: /* @__PURE__ */ new Set(),
+		approval: /* @__PURE__ */ new Set(),
+		auth: /* @__PURE__ */ new Set(),
+		error: /* @__PURE__ */ new Set()
+	};
+}
+function credentialRef(subject) {
+	const value = subject.principal?.["credential"];
+	if (value === null || typeof value !== "object") return;
+	const { id, kind } = value;
+	return typeof id === "string" && (kind === "user" || kind === "service") ? {
+		id,
+		kind
+	} : void 0;
+}
+function finish(policy, subject, permission, data, decision, options, env, trusted, membership, counts) {
+	const heard = env.sink !== void 0 || env.listeners.decision.size > 0 || decision.outcome === "denied" && env.listeners.denied.size > 0 || decision.outcome === "approval-required" && env.listeners.approval.size > 0;
+	if (!env.emit || !heard) return;
+	const resource = getResource(policy.permissions, permission.resource);
+	const resourceId = data !== null && typeof data === "object" ? data[resource?.id ?? "id"] : void 0;
+	const event = freezeDeep(compact({
+		type: "decision",
+		at: (/* @__PURE__ */ new Date()).toISOString(),
+		outcome: decision.outcome,
+		permission: permission.key,
+		scope: permission.scope,
+		resource: compact({
+			type: permission.resource,
+			id: resourceId === void 0 ? void 0 : String(resourceId)
+		}),
+		subject: compact({
+			principal: subject.principal === null ? null : compact({
+				id: subject.principal.id,
+				roles: subject.principal.roles ?? [],
+				tenant: subject.principal.tenant
+			}),
+			actor: subject.actor === void 0 ? void 0 : {
+				id: subject.actor.id,
+				kind: subject.actor.kind
+			},
+			delegation: subject.delegation === void 0 ? void 0 : compact({
+				scopes: subject.delegation.scopes,
+				authorizationDetails: subject.delegation.authorizationDetails
+			}),
+			credential: credentialRef(subject)
+		}),
+		tenant: subject.principal?.tenant,
+		membership,
+		via: membership?.via ?? null,
+		matched: decision.outcome === "granted" ? compact({
+			role: decision.matched.role,
+			permission: decision.matched.permission,
+			to: decision.matched.to,
+			hosted: decision.matched.hosted,
+			breakGlass: decision.matched.breakGlass
+		}) : decision.outcome === "approval-required" ? compact({
+			role: decision.grant.role,
+			permission: decision.grant.permission,
+			to: decision.grant.to,
+			hosted: decision.grant.hosted
+		}) : void 0,
+		purpose: Array.isArray(subject.context["purpose"]) && subject.context["purpose"].length > 0 ? subject.context["purpose"] : void 0,
+		reason: typeof subject.context["reason"] === "string" && subject.context["reason"] !== "" ? subject.context["reason"] : void 0,
+		denials: decision.outcome === "denied" ? wireDenials(decision.denials) : void 0,
+		alternatives: decision.outcome === "denied" ? decision.alternatives.map((leaf) => leaf.key) : void 0,
+		token: decision.outcome === "granted" || decision.outcome === "approval-required" ? decision.token : void 0,
+		trusted,
+		source: options.source ?? "decide",
+		adapter: options.adapter,
+		counts
+	}));
+	emitSafe(env.listeners.decision, event, env.listeners);
+	if (decision.outcome === "denied") emitSafe(env.listeners.denied, event, env.listeners);
+	if (decision.outcome === "approval-required") emitSafe(env.listeners.approval, event, env.listeners);
+	if (env.sink !== void 0) try {
+		const written = env.sink.write([event]);
+		if (isThenable(written)) written.catch((error) => {
+			emitSafe(env.listeners.error, error, env.listeners);
+		});
+	} catch (error) {
+		emitSafe(env.listeners.error, error, env.listeners);
+	}
+}
+//#endregion
+//#region src/core/validation.ts
+function validateBoundary(permission, resource, data, mode, trusted, boundary = "manual") {
+	if (!(mode === "always" || mode === "boundary" && !trusted)) return data;
+	if (resource?.schema === void 0) {
+		if (mode === "always") throw new PermDockValidationError({
+			code: "no-schema",
+			permission: permission.key,
+			resource: permission.resource,
+			boundary,
+			message: `${permission.key}: no schema for resource ${permission.resource}.`
+		});
+		return data;
+	}
+	const result = resource.schema["~standard"].validate(data);
+	if (isThenable(result)) {
+		ignoreRejection(result);
+		throw new PermDockValidationError({
+			code: "async-schema",
+			permission: permission.key,
+			resource: permission.resource,
+			boundary,
+			message: `${permission.key}: schema for ${permission.resource} is async.`
+		});
+	}
+	if ("issues" in result && result.issues !== void 0) throw new PermDockValidationError({
+		code: "invalid-data",
+		permission: permission.key,
+		resource: permission.resource,
+		issues: result.issues,
+		boundary,
+		message: validationMessage(permission, resource, result.issues)
+	});
+	return result.value;
+}
+function validationMessage(permission, resource, issues) {
+	const parts = issues.map((issue) => {
+		const path = issue.path?.map((item) => typeof item === "object" && "key" in item ? String(item.key) : String(item)).join(".") ?? "/";
+		return `invalid ${resource.name} data at ${path}: ${issue.message}`;
+	});
+	return `${permission.key}: ${parts.join("; ")}.`;
+}
+//#endregion
+//#region src/core/evaluate.ts
+/**
+* A collection write proposes `next`; an update pair may move `next` out of
+* the scope `current` is in. Both must stay in scope.
+*/
+function matchWriteScope(match, instance, current, next) {
+	const first = match(instance ? current : next);
+	if (!first.ok || !instance || next === current) return first;
+	const moved = match(next);
+	return moved.ok ? first : moved;
+}
+function isGlobalRole(value) {
+	return value !== null && typeof value === "object" && Reflect.get(value, "scope") === "global";
+}
+function onlyGlobal(roles) {
+	return Array.isArray(roles) ? roles.filter(isGlobalRole) : [];
+}
+/** The `customRoles` option as a source: a factory is called with the resolved subject, and a throw reads none. */
+function roleSourceFor(option, subject, auth) {
+	if (typeof option !== "function") return option;
+	try {
+		return option(subject);
+	} catch {
+		auth.push({
+			reason: "source-threw",
+			source: "customRoles"
+		});
+		return;
+	}
+}
+function customRolesFor(source, tenants, auth, globalHeld, heldIn) {
+	if (source === void 0) return [];
+	const loaded = [];
+	for (const tenant of tenants) try {
+		loaded.push(source.rolesFor(tenant, { held: heldIn(tenant) }));
+	} catch {
+		auth.push({
+			reason: "source-threw",
+			source: "customRoles"
+		});
+		loaded.push([]);
+	}
+	if (globalHeld !== void 0 && source.globalRoles !== void 0) try {
+		const roles = source.globalRoles({ held: globalHeld });
+		loaded.push(isThenable(roles) ? roles.then(onlyGlobal) : onlyGlobal(roles));
+	} catch {
+		auth.push({
+			reason: "source-threw",
+			source: "customRoles"
+		});
+		loaded.push([]);
+	}
+	if (loaded.some((item) => isThenable(item))) return Promise.all(loaded.map((item) => Promise.resolve(item).catch(() => {
+		auth.push({
+			reason: "source-threw",
+			source: "customRoles"
+		});
+		return [];
+	}))).then((lists) => lists.flat());
+	return loaded.flat();
+}
+function stringList(value) {
+	return Array.isArray(value) ? value.filter((item) => typeof item === "string") : [];
+}
+/**
+* `RoleSource.assignable` per tenant; `undefined` when the source has no
+* `assignable`. A tenant whose call throws or answers junk assigns nothing.
+*/
+function assignableNamesFor(source, tenants, auth) {
+	if (source?.assignable === void 0) return;
+	const failed = () => {
+		auth.push({
+			reason: "source-threw",
+			source: "customRoles"
+		});
+		return [];
+	};
+	const loaded = tenants.map((tenant) => {
+		try {
+			return source.assignable?.(tenant) ?? [];
+		} catch {
+			return failed();
+		}
+	});
+	const toMap = (lists) => new Map(tenants.map((tenant, index) => [tenant, stringList(lists[index])]));
+	if (loaded.some((item) => isThenable(item))) return Promise.all(loaded.map((item) => Promise.resolve(item).catch(failed))).then(toMap);
+	return toMap(loaded);
+}
+/**
+* The declared role names among `names`. A custom role of `tenant` is known
+* but contributes no declared name: its grants are resolved separately
+* (`customGrantsFor`), bounded by the ceiling. A tenant's custom role is
+* unknown inside another tenant and for a membership without one.
+*/
+function expandRoleNames(names, declared, custom, tenant) {
+	const resolved = /* @__PURE__ */ new Set();
+	const unknown = [];
+	for (const name of names) if (declared.has(name)) resolved.add(name);
+	else if (!isCustomRoleName(name, custom, tenant)) unknown.push(name);
+	return {
+		roles: [...resolved],
+		unknown
+	};
+}
+function declaredRoleNames(policy) {
+	return policy.index.declaredRoles;
+}
+const NEVER = {
+	op: "or",
+	conditions: []
+};
+function isUnconditionedAllow(grant, now) {
+	return grant.where === void 0 && grant.check === void 0 && grant.closure === void 0 && grant.portable && grant.purpose === void 0 && grant.viaOnly === void 0 && grant.requires === void 0 && isActive(grant.validity, now);
+}
+/**
+* The row condition a grant's `requires` adds: the row's instance of some
+* scope is one where the subject holds `key` through a role grant without a
+* row condition, minus the instances a deny of `key` reaches at that scope.
+* `undefined` when the subject holds `key` globally that way, so every row
+* passes. The in-process mirror of the SQL `permdock_has_permission` and
+* `permitted_<scope>_ids_by_permission`.
+*/
+function requirementCondition(policy, subject, keys, resource, now, customRoles, customGrants) {
+	let where;
+	for (const key of keys) where = combineWhere(where, keyRequirement(policy, subject, key, resource, now, customRoles, customGrants));
+	return where;
+}
+function keyRequirement(policy, subject, key, resource, now, customRoles, customGrants) {
+	const principal = subject.principal;
+	if (principal === null) return NEVER;
+	const scopes = scopeList(policy.scopes);
+	const declared = declaredRoleNames(policy);
+	const global = new Set(expandRoleNames(principal.roles ?? [], declared, customRoles, principal.tenant).roles);
+	const held = (principal.memberships ?? []).filter((membership) => !isMembershipExpired(membership, now) && keepsPermission(membership, key)).map((membership) => ({
+		membership,
+		roles: new Set(expandRoleNames(membership.roles, declared, customRoles, tenantOf(membership, scopes)).roles)
+	}));
+	const allowed = /* @__PURE__ */ new Map();
+	const denied = /* @__PURE__ */ new Map();
+	let globalAllow = false;
+	let globalDeny = false;
+	const note = (effect, membership) => {
+		if (membership === void 0) {
+			if (effect === "allow") globalAllow = true;
+			else globalDeny = true;
+			return;
+		}
+		if (membership.scope === void 0 || membership.id === void 0) return;
+		const target = effect === "allow" ? allowed : denied;
+		const ids = target.get(membership.scope) ?? /* @__PURE__ */ new Set();
+		ids.add(membership.id);
+		target.set(membership.scope, ids);
+	};
+	const applies = (grant) => grant.effect === "allow" ? isUnconditionedAllow(grant, now) : isActive(grant.validity, now);
+	for (const grant of policy.index.grantsByKey.get(key) ?? []) {
+		const items = flattenGrantee(grant.to);
+		if (grant.breakGlass !== void 0 || !applies(grant) || items.length === 0 || !items.every((item) => item.kind === "role")) continue;
+		const roles = items.flatMap((item) => item.kind === "role" ? [item] : []);
+		if (!roles.every((item) => item.scope !== "global" || global.has(item.role))) continue;
+		const scoped = roles.filter((item) => item.scope !== "global");
+		if (scoped.length === 0) {
+			note(grant.effect);
+			continue;
+		}
+		for (const entry of held) if (scoped.every((item) => typeof item.scope === "string" && entry.membership.scope === item.scope && entry.roles.has(item.role))) note(grant.effect, entry.membership);
+	}
+	for (const { grant, role } of customGrants) {
+		if (grant.permission.key !== key || !applies(grant)) continue;
+		if (holdsGlobalCustomRole(principal.roles, role)) note(grant.effect);
+		for (const entry of held) if (holdsCustomRole(entry.membership, role, scopes)) note(grant.effect, entry.membership);
+	}
+	if (globalAllow && !globalDeny) return;
+	const parts = [];
+	for (const name of resource === void 0 ? [] : partitionsOf(resource, scopes)) {
+		const field = scopeField(resource, name, scopes);
+		const deniedIds = denied.get(name);
+		const ids = [...allowed.get(name) ?? []].filter((id) => deniedIds?.has(id) !== true).toSorted();
+		if (field !== void 0 && ids.length > 0) parts.push({
+			op: "in",
+			field,
+			value: ids
+		});
+	}
+	return sole(parts) ?? {
+		op: "or",
+		conditions: parts
+	};
+}
+function alternativesFor(policy, permission, subject, now, env) {
+	return listPermissions(policy.permissions).filter((leaf) => leaf.resource === permission.resource && leaf.key !== permission.key).filter((leaf) => {
+		return evaluate(policy, subject, leaf, void 0, {
+			trusted: true,
+			source: "simulate",
+			now
+		}, {
+			...env,
+			emit: false,
+			skipAlternatives: true,
+			outcomeOnly: true
+		}).outcome === "granted";
+	});
+}
+function inheritedVerdict(policy, subject, resource, id, key, now, env) {
+	const leaf = findPermission(policy.permissions, key);
+	const loaded = env.relations?.row({
+		resource,
+		id
+	});
+	if (leaf === void 0 || loaded === void 0) return "relation-unavailable";
+	if (loaded === "pending" || loaded === "failed") return "relation-unavailable";
+	if (loaded.row === null) return false;
+	const decision = evaluate(policy, subject, leaf, loaded.row, {
+		trusted: true,
+		source: "simulate",
+		now
+	}, {
+		...env,
+		emit: false,
+		skipAlternatives: true,
+		outcomeOnly: true
+	});
+	if (decision.outcome === "granted") return true;
+	const reasons = decision.outcome === "denied" ? decision.denials.map((denial) => denial.reason) : [];
+	return reasons.includes("relation-unavailable") ? "relation-unavailable" : reasons.includes("relation-depth") ? "relation-depth" : false;
+}
+function evaluateGrantCondition(grant, permission, current, next, subject, now, scopes, relations, permitted) {
+	let unknown;
+	const onOpaque = () => {
+		unknown ??= "opaque-condition";
+	};
+	const related = (condition, row) => {
+		if (relations === void 0) {
+			unknown ??= "relation-unavailable";
+			return false;
+		}
+		const verdict = resolveRelated(condition, row, subject, now, relations, permitted);
+		if (verdict === "relation-depth" || verdict === "relation-unavailable") {
+			unknown ??= verdict;
+			return false;
+		}
+		return verdict;
+	};
+	if (!grant.portable && grant.closure !== void 0) try {
+		const result = grant.closure(next ?? current, {
+			subject,
+			actor: subject.actor,
+			delegation: subject.delegation,
+			context: subject.context
+		});
+		if (isThenable(result)) return {
+			matched: false,
+			reason: "closure-error",
+			cause: result
+		};
+		return { matched: result === true };
+	} catch (error) {
+		return {
+			matched: false,
+			reason: "closure-error",
+			cause: error
+		};
+	}
+	if (grant.where !== void 0) {
+		if (permission.kind === "collection") return {
+			matched: false,
+			reason: "condition"
+		};
+		if (current === void 0) return {
+			matched: false,
+			reason: "condition"
+		};
+		if (grant.where.op === "opaque" || grant.check?.op === "opaque") return {
+			matched: false,
+			reason: "opaque-condition"
+		};
+		const matched = evaluateCondition(grant.where, current, subject, now, scopes, related, onOpaque);
+		if (unknown !== void 0) return {
+			matched: false,
+			reason: unknown
+		};
+		if (!matched) return {
+			matched: false,
+			reason: "condition"
+		};
+	}
+	const checkCondition = grant.check ?? (permission.action === "update" ? grant.where : void 0);
+	if (checkCondition !== void 0) {
+		if (checkCondition.op === "opaque") return {
+			matched: false,
+			reason: "opaque-condition"
+		};
+		if (next === void 0) return {
+			matched: false,
+			reason: "condition"
+		};
+		const matched = evaluateCondition(checkCondition, next, subject, now, scopes, related, onOpaque);
+		if (unknown !== void 0) return {
+			matched: false,
+			reason: unknown
+		};
+		if (!matched) return {
+			matched: false,
+			reason: "condition"
+		};
+	}
+	return { matched: true };
+}
+/** A grant whose condition could not be answered; a deny with one denies. */
+function isUnevaluable(reason) {
+	return reason === "relation-depth" || reason === "relation-unavailable" || reason === "closure-error" || reason === "opaque-condition";
+}
+function shouldConsumeQuota(source, simulated) {
+	if (simulated) return false;
+	switch (source) {
+		case "can":
+		case "filter":
+		case "simulate":
+		case "explain": return false;
+		case "decide":
+		case "assert":
+		case "endpoint":
+		case "adapter":
+		case "approval":
+		case void 0: return true;
+		default: return source;
+	}
+}
+function isDelegatedPermission(policy, permission) {
+	const providers = policy.providers;
+	if (providers === void 0 || providers.length === 0) return false;
+	for (const provider of providers) if (provider.handles(permission)) return true;
+	return false;
+}
+/** The `MatchedGrant` view of a grant, shared by `matched` and the trace. */
+function matchedOf(grant, permissionKey, breakGlass) {
+	return compact({
+		role: grant.role,
+		permission: permissionKey,
+		name: grant.name,
+		to: grant.to,
+		where: grant.where,
+		check: grant.check,
+		approval: grant.approval,
+		hosted: grant.hosted,
+		breakGlass
+	});
+}
+function skip(tracer, grant, permissionKey, why) {
+	tracer?.skipped.push({
+		role: grant.role,
+		permission: permissionKey,
+		effect: grant.effect,
+		why
+	});
+}
+function traceOf(tracer) {
+	return {
+		evaluated: tracer.evaluated,
+		allows: tracer.allows,
+		denies: tracer.denies,
+		skipped: tracer.skipped
+	};
+}
+function evaluate(policy, given, permission, data, options, env) {
+	const subject = subjectForPermission(given, permission.key);
+	const now = options.now ?? nowSeconds();
+	const trusted = options.trusted === true;
+	const resource = getResource(policy.permissions, permission.resource);
+	let { current, next } = rowValues(permission, data);
+	const tracer = options.explain === true ? {
+		evaluated: 0,
+		allows: [],
+		denies: [],
+		skipped: []
+	} : void 0;
+	const complete = (decision, membership) => {
+		const final = env.outcomeOnly === true ? decision : freezeDeep(tracer === void 0 ? decision : {
+			...decision,
+			trace: traceOf(tracer)
+		});
+		finish(policy, given, permission, current, final, options, env, trusted, membership);
+		return final;
+	};
+	try {
+		if (data !== void 0 || permission.kind === "instance" && policy.validate === "always") {
+			const validated = validateBoundary(permission, resource, permission.kind === "instance" && isRowPair(data) ? data.current : data, policy.validate, trusted, options.boundary ?? "manual");
+			if (permission.kind === "instance" && isRowPair(data)) {
+				current = validated;
+				next = validateBoundary(permission, resource, data.next, policy.validate, trusted, options.boundary ?? "manual");
+			} else if (permission.kind === "instance") {
+				current = validated;
+				next = validated;
+			} else next = validated;
+		}
+	} catch (error) {
+		if (error instanceof PermDockValidationError && error.code === "invalid-data") return complete({
+			outcome: "denied",
+			denials: [{
+				role: null,
+				reason: "validation",
+				detail: error
+			}],
+			alternatives: []
+		});
+		throw error;
+	}
+	if (isDelegatedPermission(policy, permission)) return complete({
+		outcome: "denied",
+		denials: [{
+			role: null,
+			reason: "pdp-unavailable",
+			detail: "use permdock/pdp createPermDock"
+		}],
+		alternatives: []
+	});
+	const scopes = scopeList(policy.scopes);
+	const declared = declaredRoleNames(policy);
+	const principalRoles = subject.principal?.roles ?? [];
+	const globalNames = expandRoleNames(principalRoles, declared, env.customRoles, subject.principal?.tenant);
+	if (subject.principal !== null && globalNames.unknown.length > 0) emitSafe(env.listeners.auth, {
+		reason: "unknown-role",
+		source: "roles"
+	}, env.listeners);
+	const denials = [];
+	const allows = [];
+	const matchingRoles = new Set(globalNames.roles);
+	for (const membership of subject.principal?.memberships ?? []) {
+		if (!inTeam(membership, scopes, env.team)) continue;
+		const expanded = expandRoleNames(membership.roles, declared, env.customRoles, tenantOf(membership, scopes));
+		for (const name of expanded.roles) matchingRoles.add(name);
+		for (const name of expanded.unknown) denials.push({
+			role: name,
+			reason: "unknown-role"
+		});
+	}
+	const actorVias = actorRequiredVias(policy.index.supports);
+	if (actorVias.size > 0 && subject.actor === void 0 && (subject.principal?.memberships ?? []).some((membership) => isSupportMembership(membership, actorVias) && !isMembershipExpired(membership, now) && inTeam(membership, scopes, env.team))) return complete({
+		outcome: "denied",
+		denials: [{
+			role: null,
+			reason: "actor-required"
+		}],
+		alternatives: []
+	});
+	const purposes = purposesOf(subject);
+	const forPermission = policy.index.grantsByKey.get(permission.key) ?? [];
+	const candidates = forPermission.filter((grant) => grant.breakGlass === void 0).map((grant) => ({ grant }));
+	for (const item of env.customGrants) if (item.grant.permission.key === permission.key) candidates.push({
+		grant: item.grant,
+		custom: item.role
+	});
+	let breakGlassGrant;
+	let breakGlassObligations = [];
+	const breakGlassOverrides = /* @__PURE__ */ new Set();
+	let breakGlassDenial;
+	for (const grant of forPermission) {
+		if (grant.breakGlass === void 0) continue;
+		if (tracer !== void 0) tracer.evaluated += 1;
+		if (!matchGrantee(grant.to, subject, now, resource, scopes).matched) {
+			skip(tracer, grant, permission.key, "grantee");
+			continue;
+		}
+		const result = evaluateBreakGlass(grant.breakGlass, subject, now);
+		if (result.kind === "inactive") {
+			skip(tracer, grant, permission.key, "break-glass-inactive");
+			continue;
+		}
+		for (const name of grant.breakGlass.overrides) breakGlassOverrides.add(name);
+		if (result.kind === "granted") {
+			breakGlassGrant = grant;
+			breakGlassObligations = result.obligations;
+			break;
+		}
+		breakGlassDenial ??= result.reason === "insufficient-user-authentication" ? {
+			role: null,
+			reason: result.reason,
+			to: result.to
+		} : {
+			role: null,
+			reason: result.reason
+		};
+	}
+	const holdsCustom = (custom) => isGlobalCustomRole(custom) ? holdsGlobalCustomRole(principalRoles, custom) : (subject.principal?.memberships ?? []).some((membership) => inTeam(membership, scopes, env.team) && holdsCustomRole(membership, custom, scopes));
+	const walkRole = env.relations?.available === true ? (membership, row) => {
+		const on = membership.on;
+		const condition = on === void 0 ? void 0 : resourceRoleCondition(resource, on.resource, [on.id], policy.resources);
+		return condition === void 0 || env.relations === void 0 ? false : resolveRelated(condition, row, subject, now, env.relations);
+	} : void 0;
+	for (const { grant, custom } of candidates) {
+		const displayRole = grant.role;
+		if (tracer !== void 0) tracer.evaluated += 1;
+		if (grant.viaOnly !== void 0 && !(subject.principal?.memberships ?? []).some((membership) => membership.via === grant.viaOnly && !isMembershipExpired(membership, now) && inTeam(membership, scopes, env.team))) {
+			skip(tracer, grant, permission.key, "via-only");
+			continue;
+		}
+		const required = grant.purpose;
+		if (required !== void 0 && !purposes.some((purpose) => required.includes(purpose))) {
+			skip(tracer, grant, permission.key, "purpose");
+			continue;
+		}
+		const granteeMatch = matchGrantee(grant.to, subject, now, resource, scopes, policy.resources, grant.effect === "deny");
+		if (!granteeMatch.matched) {
+			const reason = granteeMatch.reason ?? "no-grant";
+			if (reason === "not-entitled" && !flattenGrantee(grant.to).every((item) => item.kind !== "role" || (custom === void 0 ? item.scope === "global" ? globalNames.roles.includes(item.role) : matchingRoles.has(item.role) : holdsCustom(custom)))) {
+				skip(tracer, grant, permission.key, "grantee");
+				continue;
+			}
+			denials.push((reason === "insufficient-user-authentication" || reason === "not-entitled") && grant.to !== void 0 ? {
+				role: displayRole,
+				reason,
+				to: grant.to
+			} : {
+				role: displayRole,
+				reason
+			});
+			continue;
+		}
+		const roleItems = flattenGrantee(grant.to).filter((item) => item.kind === "role");
+		let scopeMembership;
+		let roleOk = roleItems.length === 0;
+		if (roleItems.length > 0) {
+			if (subject.principal === null) {
+				denials.push({
+					role: displayRole,
+					reason: "anonymous"
+				});
+				continue;
+			}
+			let allHeld = true;
+			for (const roleItem of roleItems) {
+				if (!(custom === void 0 ? roleItem.scope === "global" ? globalNames.roles.includes(roleItem.role) : matchingRoles.has(roleItem.role) : holdsCustom(custom))) {
+					skip(tracer, grant, permission.key, "role");
+					allHeld = false;
+					break;
+				}
+				const matchRow = (row) => matchScopedMembership(subject, roleItem.scope, roleItem.role, row, scopes, resource, policy.resources, now, (membership) => {
+					if (custom === void 0) return expandRoleNames(membership.roles, declared, env.customRoles, tenantOf(membership, scopes)).roles;
+					return holdsCustomRole(membership, custom, scopes) ? [custom.name] : [];
+				}, env.team, walkRole, permission.kind === "instance", options.scope);
+				const scopeMatch = matchWriteScope(matchRow, permission.kind === "instance", current, next);
+				if (!scopeMatch.ok) {
+					denials.push({
+						role: roleItem.role,
+						reason: scopeMatch.reason
+					});
+					allHeld = false;
+					break;
+				}
+				scopeMembership = scopeMatch.membership ?? scopeMembership;
+			}
+			roleOk = allHeld;
+		}
+		if (!roleOk) continue;
+		if (!isActive(grant.validity, now)) {
+			if (grant.effect === "allow") denials.push({
+				role: displayRole,
+				reason: "inactive-grant",
+				detail: grant.validity
+			});
+			else skip(tracer, grant, permission.key, "validity");
+			continue;
+		}
+		const requirement = grant.requires === void 0 || grant.effect !== "allow" ? void 0 : requirementCondition(policy, subject, grant.requires, resource, now, env.customRoles, env.customGrants);
+		const merged = freezeDeep(compact({
+			...grant,
+			where: combineWhere(combineWhere(grant.where, granteeMatch.where), requirement)
+		}));
+		const condition = evaluateGrantCondition(merged, permission, current, next, subject, now, scopes, env.relations, (target, id, key) => inheritedVerdict(policy, given, target, id, key, now, env));
+		if (!condition.matched && grant.effect === "deny" && isUnevaluable(condition.reason) && grantCoversField(grant.fields, options.field, grant.effect)) {
+			if (condition.reason === "closure-error") emitSafe(env.listeners.error, condition.cause ?? /* @__PURE__ */ new Error("closure-error"), env.listeners);
+			tracer?.denies.push(matchedOf(merged, permission.key));
+			return complete({
+				outcome: "denied",
+				denials: [{
+					role: displayRole,
+					reason: condition.reason ?? "relation-unavailable"
+				}],
+				alternatives: []
+			});
+		}
+		if (!condition.matched) {
+			if (condition.reason === "closure-error") emitSafe(env.listeners.error, condition.cause ?? /* @__PURE__ */ new Error("closure-error"), env.listeners);
+			denials.push({
+				role: displayRole,
+				reason: condition.reason ?? "condition",
+				detail: condition.cause
+			});
+			continue;
+		}
+		if (!grantCoversField(grant.fields, options.field, grant.effect)) {
+			skip(tracer, grant, permission.key, "field");
+			continue;
+		}
+		if (grant.effect === "deny") {
+			tracer?.denies.push(matchedOf(merged, permission.key));
+			if (grant.name !== void 0 && breakGlassOverrides.has(grant.name)) {
+				if (breakGlassGrant !== void 0) continue;
+				if (breakGlassDenial !== void 0) return complete({
+					outcome: "denied",
+					denials: [breakGlassDenial],
+					alternatives: env.skipAlternatives ? [] : alternativesFor(policy, permission, subject, now, env)
+				});
+			}
+			return complete({
+				outcome: "denied",
+				denials: [grant.name === void 0 ? {
+					role: displayRole,
+					reason: "deny"
+				} : {
+					role: displayRole,
+					reason: "deny",
+					detail: { name: grant.name }
+				}],
+				alternatives: env.skipAlternatives ? [] : alternativesFor(policy, permission, subject, now, env)
+			});
+		}
+		tracer?.allows.push(matchedOf(merged, permission.key));
+		allows.push(scopeMembership === void 0 ? { grant: merged } : {
+			grant: merged,
+			membership: scopeMembership
+		});
+	}
+	if (breakGlassGrant !== void 0) {
+		tracer?.allows.push(matchedOf(breakGlassGrant, permission.key, true));
+		allows.push({
+			grant: breakGlassGrant,
+			obligations: breakGlassObligations,
+			breakGlass: true
+		});
+	} else if (breakGlassDenial !== void 0) denials.unshift(breakGlassDenial);
+	if (allows.length === 0) {
+		const reason = denials[0]?.reason ?? (subject.principal === null ? "anonymous" : globalNames.unknown.length > 0 && globalNames.roles.length === 0 ? "unknown-role" : "no-grant");
+		return complete({
+			outcome: "denied",
+			denials: denials.length > 0 ? denials : [{
+				role: null,
+				reason
+			}],
+			alternatives: env.skipAlternatives ? [] : alternativesFor(policy, permission, subject, now, env)
+		});
+	}
+	if (subject.stale === true && (policy.fresh ?? []).includes(permission.key)) return complete({
+		outcome: "denied",
+		denials: [{
+			role: null,
+			reason: "stale-credentials"
+		}],
+		alternatives: []
+	});
+	const ceiling = delegatedPermissions(policy.delegations, subject, matchingRoles, now);
+	if (ceiling !== void 0 && !ceiling.has(permission.key)) return complete({
+		outcome: "denied",
+		denials: [{
+			role: null,
+			reason: "not-delegated"
+		}],
+		alternatives: env.skipAlternatives ? [] : alternativesFor(policy, permission, subject, now, env)
+	});
+	const unscoped = subject.actor !== void 0 && ceiling === void 0;
+	let delegationMiss = coveredByDelegation(permission, subject.delegation, resourceIdOf(current), unscoped);
+	const requirementsCovered = allows.filter((candidate) => coversRequirements(policy.permissions, candidate.grant.requires, subject.delegation, resourceIdOf(current), unscoped));
+	let usable = delegationMiss === void 0 ? requirementsCovered : requirementsCovered.filter((candidate) => requiresStandIn(candidate.grant));
+	if (delegationMiss === "not-delegated" && usable.length > 0) delegationMiss = void 0;
+	if (delegationMiss === void 0 && usable.length === 0) delegationMiss = "not-delegated";
+	if (delegationMiss !== void 0) return complete({
+		outcome: "denied",
+		denials: [{
+			role: null,
+			reason: delegationMiss
+		}],
+		alternatives: env.skipAlternatives ? [] : alternativesFor(policy, permission, subject, now, env)
+	});
+	const approvalPolicies = env.approvalPolicies;
+	if (approvalPolicies === "failed" && usable.length > 0) return complete({
+		outcome: "denied",
+		denials: [{
+			role: null,
+			reason: "approval",
+			detail: APPROVAL_POLICY_UNAVAILABLE
+		}],
+		alternatives: []
+	});
+	const approvalOf = (candidate) => approvalPolicies === void 0 || approvalPolicies === "failed" ? candidate.grant.approval : tightenApproval(candidate.grant.approval, approvalPolicies, {
+		permission: permission.key,
+		tenant: decisionTenant(subject, candidate.membership),
+		subject,
+		current,
+		next,
+		now,
+		scopes: scopeList(policy.scopes)
+	});
+	const quotaDenials = [];
+	let matchedAllow;
+	let approval;
+	let quotaState = {};
+	for (const candidate of usable) {
+		approval = approvalOf(candidate);
+		const consume = !requiresApproval(approval) && shouldConsumeQuota(options.source, env.simulated);
+		const quota = applyQuota({
+			store: env.limits,
+			cache: env.limitCache,
+			grant: candidate.grant,
+			permissionKey: permission.key,
+			subjectId: subject.principal?.id ?? "",
+			tenant: subject.principal?.tenant,
+			now,
+			consume
+		});
+		if (quota.ok) {
+			matchedAllow = candidate;
+			quotaState = compact({
+				quota: quota.quota,
+				obligations: quota.obligations
+			});
+			break;
+		}
+		quotaDenials.push(quota.reason === "limit" ? {
+			role: candidate.grant.role,
+			reason: "limit",
+			detail: quota.detail
+		} : {
+			role: candidate.grant.role,
+			reason: quota.reason
+		});
+	}
+	if (matchedAllow === void 0) return complete({
+		outcome: "denied",
+		denials: quotaDenials.length > 0 ? quotaDenials : denials,
+		alternatives: env.skipAlternatives ? [] : alternativesFor(policy, permission, subject, now, env)
+	});
+	const resourceId = permission.kind === "collection" ? "*" : rowIdOf(current, resource?.id);
+	const version = approval !== void 0 && approval !== "human" && approval.staleOn === "resource-change" && resource?.version !== void 0 ? versionOf(current, resource.version) : void 0;
+	const token = env.simulated ? "pd1.simulated" : env.outcomeOnly === true ? "pd1.outcome" : decisionToken({
+		key: permission.key,
+		resourceId,
+		principal: subject.principal,
+		actor: subject.actor,
+		fingerprint: policy.fingerprint,
+		version,
+		payload: resourceId === "*" && (next ?? current) !== void 0 ? payloadDigest(next ?? current) : void 0
+	});
+	const matched = compact({
+		...matchedOf(matchedAllow.grant, permission.key, matchedAllow.breakGlass),
+		approval
+	});
+	const obligations = [...quotaState.obligations ?? [], ...matchedAllow.obligations ?? []];
+	return complete(requiresApproval(approval) ? {
+		outcome: "approval-required",
+		grant: matched,
+		reason: "human",
+		token
+	} : {
+		outcome: "granted",
+		subject,
+		matched,
+		token,
+		...quotaState,
+		...obligations.length === 0 ? {} : { obligations }
+	}, matchedAllow.membership);
+}
+//#endregion
+//#region src/core/ownership.ts
+function bindingOf(policy, name) {
+	return policy.rolesByName.get(name);
+}
+function roleMeta(policy, name) {
+	return bindingOf(policy, name)?.meta ?? findRole(policy.vocabulary?.roles, name)?.meta;
+}
+/** A role with `for` is held only through a membership of one of those kinds. */
+function mayHoldVia(policy, role, via) {
+	const kinds = bindingOf(policy, role)?.for;
+	return kinds === void 0 || via !== void 0 && kinds.includes(via);
+}
+function sameList(a, b) {
+	return a.length === b.length && a.every((item, index) => item === b[index]);
+}
+/**
+* The identity provider may only hand out what the application could: a
+* declared role with `assignable: false` (an owner, a platform role) never
+* rides in on a `managedBy: 'idp'` membership. A name the policy does not
+* declare stays, because only a tenant's custom role can give it meaning.
+*/
+function mayHoldManaged(policy, role, membership) {
+	return !isExternallyManaged(membership) || bindingOf(policy, role)?.assignable !== false;
+}
+/**
+* Drops every role a membership's kind may not hold (fail-closed: a missing
+* `via` is no kind) and every non-assignable role on an identity-provider
+* membership. Global roles have no kind, so a role with `for` held globally
+* is dropped too.
+*/
+function applyRoleKinds(policy, roles, memberships) {
+	const kinds = policy.roles.some((binding) => binding.for !== void 0);
+	if (!kinds && !memberships.some(isExternallyManaged)) return {
+		roles,
+		memberships
+	};
+	return {
+		roles: kinds ? roles?.filter((name) => mayHoldVia(policy, name, void 0)) ?? roles : roles,
+		memberships: memberships.map((membership) => {
+			const allowed = membership.roles.filter((name) => mayHoldVia(policy, name, membership.via) && mayHoldManaged(policy, name, membership));
+			return sameList(allowed, membership.roles) ? membership : freezeDeep({
+				...membership,
+				roles: allowed
+			});
+		})
+	};
+}
+function usesAssigns(policy) {
+	return policy.roles.some((binding) => binding.assigns !== void 0);
+}
+/** Declared role names in declaration order: bindings first, then vocabulary-only leaves. */
+function declarationOrder(policy) {
+	const names = policy.roles.map((binding) => binding.name);
+	const seen = new Set(names);
+	for (const leaf of listRoles(policy.vocabulary?.roles)) if (!seen.has(leaf.key)) {
+		names.push(leaf.key);
+		seen.add(leaf.key);
+	}
+	return names;
+}
+/**
+* Each role's depth in the `assigns` graph: a role nobody else assigns is 0,
+* a role another assigns sits one below its deepest assigner. Cycles stop
+* after one pass per role.
+*/
+function assignDepths(policy) {
+	const names = declarationOrder(policy);
+	const depth = new Map(names.map((name) => [name, 0]));
+	for (let pass = 0; pass < names.length; pass += 1) {
+		let changed = false;
+		for (const binding of policy.roles) {
+			const from = depth.get(binding.name) ?? 0;
+			for (const target of binding.assigns ?? []) if (target !== binding.name && (depth.get(target) ?? 0) < from + 1) {
+				depth.set(target, from + 1);
+				changed = true;
+			}
+		}
+		if (!changed) break;
+	}
+	return depth;
+}
+/**
+* `names` ordered by rank: assigners before the roles they assign, then
+* declaration order. Without an `assigns` graph the order is kept.
+*/
+function rankRoles(policy, names) {
+	if (!usesAssigns(policy)) return names;
+	const order = declarationOrder(policy);
+	const depth = assignDepths(policy);
+	const index = (name) => {
+		const found = order.indexOf(name);
+		return found === -1 ? order.length : found;
+	};
+	return [...names].toSorted((a, b) => (depth.get(a) ?? Number.MAX_SAFE_INTEGER) - (depth.get(b) ?? Number.MAX_SAFE_INTEGER) || index(a) - index(b));
+}
+/** The distinct `meta.audience` values of `names`, in rank order. */
+function audiencesOf(policy, names) {
+	const out = [];
+	for (const name of rankRoles(policy, names)) {
+		const audience = roleMeta(policy, name)?.audience;
+		if (typeof audience === "string" && !out.includes(audience)) out.push(audience);
+	}
+	return out;
+}
+/** Whether `membership` is the instance itself or one of its ancestors named in `within`. */
+function coversInstance(membership, scopes, scope, id, within) {
+	if (membership.scope === void 0 || membership.id === void 0) return false;
+	if (membership.scope === scope) return sameId(membership.id, id);
+	if (!scopeChain(scopes, scope).slice(1).includes(membership.scope)) return false;
+	const wanted = within === void 0 ? void 0 : Object.entries(within).find(([key]) => resolveScope(scopes, key) === membership.scope)?.[1] ?? void 0;
+	return wanted !== void 0 && scopeIdOf(membership, membership.scope) === wanted;
+}
+/** Roles the principal holds at the instance, at an ancestor named in `within`, or globally. */
+function rolesAtInstance(policy, principal, scopes, scope, id, within, now) {
+	const declared = declaredRoleNames$1(policy);
+	const names = new Set((principal.roles ?? []).filter((name) => declared.has(name)));
+	for (const membership of principal.memberships ?? []) if (!isMembershipExpired(membership, now) && coversInstance(membership, scopes, scope, id, within)) for (const name of membership.roles) names.add(name);
+	return rankRoles(policy, [...names]);
+}
+/** Whether the principal holds `role` on a live membership of exactly this instance. */
+function holdsAt(principal, role, scope, id, now) {
+	return (principal.memberships ?? []).some((membership) => membership.scope === scope && sameId(membership.id, id) && !isMembershipExpired(membership, now) && membership.roles.includes(role));
+}
+function includedRoles(role) {
+	return isReadonlyArray(role.includes) ? role.includes.filter((name) => typeof name === "string") : [];
+}
+/**
+* The membership kinds a custom role may be held through: those every
+* included declared role with `for` allows. `undefined` when none restricts.
+*/
+function customForKinds(policy, role) {
+	let kinds;
+	for (const name of includedRoles(role)) {
+		const listed = bindingOf(policy, name)?.for;
+		if (listed !== void 0) kinds = kinds === void 0 ? listed : kinds.filter((kind) => listed.includes(kind));
+	}
+	return kinds;
+}
+function conflictsWith(policy, role) {
+	const out = new Set(bindingOf(policy, role)?.exclusiveWith ?? []);
+	for (const binding of policy.roles) if (binding.exclusiveWith?.includes(role) === true) out.add(binding.name);
+	return out;
+}
+/** What the change does to the instance's holder count. */
+function countRules(binding, role, holders, delta, deny) {
+	if (binding === void 0 || delta === 0) return;
+	const min = binding.min ?? 0;
+	if (!(min > 0 || binding.max !== void 0 || binding.transferOnly === true)) return;
+	if (!(holders !== void 0 && Number.isInteger(holders) && holders >= 0)) {
+		deny(delta < 0 && min > 0 ? "last-holder" : delta > 0 && binding.max !== void 0 ? "max-holders" : "transfer-only", {
+			role,
+			holders: null
+		});
+		return;
+	}
+	const after = holders + delta;
+	if (delta < 0 && min > 0 && after < min) deny("last-holder", {
+		role,
+		min,
+		holders
+	});
+	if (delta > 0 && binding.max !== void 0 && after > binding.max) deny("max-holders", {
+		role,
+		max: binding.max,
+		holders
+	});
+	if (binding.transferOnly === true && holders > 0 && after > 0) deny("transfer-only", {
+		role,
+		holders
+	});
+}
+/**
+* A live membership of the principal on the instance or on an instance under
+* it: the one in-band fact that ties a nested instance to a tenant.
+*/
+function heldAnchor(principal, scopes, scope, id, now) {
+	return (principal.memberships ?? []).find((membership) => !isMembershipExpired(membership, now) && membership.scope !== void 0 && scopeChain(scopes, membership.scope).includes(scope) && scopeIdOf(membership, scope) === id && tenantOf(membership, scopes) !== void 0);
+}
+/**
+* The one rule check behind `permdock.decideRoleChange`. The actor is always
+* the instance's own principal; nothing in `change` can stand in for it.
+*/
+function decideRoleChange(policy, principal, scopes, change, customRoles, authority, now, options = {}) {
+	const name = typeof change?.role === "string" ? change.role : change?.role?.key;
+	const denials = [];
+	const deny = (reason, detail) => {
+		denials.push(compact({
+			role: name ?? null,
+			reason,
+			detail
+		}));
+	};
+	const done = (role) => freezeDeep(denials.length === 0 ? {
+		outcome: "granted",
+		change,
+		role
+	} : {
+		outcome: "denied",
+		change,
+		denials
+	});
+	if (principal === null) {
+		deny("anonymous");
+		return done(null);
+	}
+	const kind = change?.kind;
+	const target = change?.target;
+	if (typeof name !== "string" || kind !== "assign" && kind !== "revoke" && kind !== "transfer" || typeof change.id !== "string" || change.id === "" || target === null || typeof target !== "object" || typeof target.id !== "string" || target.id === "") {
+		deny("validation");
+		return done(null);
+	}
+	const binding = bindingOf(policy, name);
+	const declared = declaredRoleNames$1(policy).has(name);
+	const named = declared ? [] : tenantCustomRoles(policy, customRoles).filter((role) => role.name === name);
+	if (!declared && named.length === 0) {
+		deny("unknown-role");
+		return done(null);
+	}
+	const scope = resolveScope(scopes, change.scope);
+	const customAt = named.map((role) => customRoleScope(role, scopes));
+	const on = declared ? binding?.on ?? findRole(policy.vocabulary?.roles, name)?.on : customAt.includes(scope) ? scope : customAt[0];
+	const heldAt = typeof on === "string" ? resolveScope(scopes, on) : void 0;
+	if (scope === void 0 || heldAt === void 0 || heldAt !== scope) {
+		deny("scope", { expected: heldAt ?? null });
+		return done(null);
+	}
+	const root = scopes[0]?.name;
+	const supplied = change.within === void 0 ? void 0 : Object.entries(change.within).find(([key]) => resolveScope(scopes, key) === root)?.[1];
+	let tenant;
+	let within = change.within;
+	if (scope === root) tenant = change.id;
+	else {
+		const anchor = heldAnchor(principal, scopes, scope, change.id, now);
+		const held = anchor === void 0 ? void 0 : tenantOf(anchor, scopes);
+		if (held !== void 0) {
+			tenant = supplied === void 0 || supplied === held ? held : void 0;
+			within = anchor?.within;
+		} else if (options.trusted === true) tenant = supplied;
+	}
+	if (tenant === void 0) {
+		deny("no-membership", {
+			scope,
+			id: change.id
+		});
+		return done(null);
+	}
+	const custom = named.find((role) => sameId(role.tenant, tenant) && customRoleScope(role, scopes) === scope && sameId(customRoleId(role) ?? change.id, change.id));
+	if (!declared && custom === void 0) {
+		deny("unknown-role");
+		return done(null);
+	}
+	if (target.managedBy === "idp") {
+		deny("externally-managed");
+		return done(null);
+	}
+	const self = target.id === principal.id;
+	const targetRoles = isReadonlyArray(target.roles) ? target.roles : [];
+	const already = targetRoles.includes(name);
+	let by = null;
+	if (kind === "transfer") {
+		if (self) deny("self-demotion");
+		if (holdsAt(principal, name, scope, change.id, now)) by = name;
+		else deny("not-assignable-by", { holds: false });
+	} else {
+		if (self) deny(kind === "revoke" ? "self-demotion" : "not-assignable-by", { self: true });
+		const allowed = authority(tenant);
+		const revocable = kind === "revoke" && custom !== void 0 && allowed.inert?.has(name);
+		if (!allowed.assignable.has(name) && revocable !== true) deny("not-assignable-by");
+		else if (custom === void 0 && usesAssigns(policy) && !allowed.manage) {
+			const held = rolesAtInstance(policy, principal, scopes, scope, change.id, within, now);
+			by = held.find((role) => bindingOf(policy, role)?.assigns?.includes(name) === true) ?? null;
+			if (by === null) deny("not-assignable-by", { held });
+		}
+	}
+	if (kind !== "revoke" && !already) {
+		const kinds = custom === void 0 ? binding?.for : customForKinds(policy, custom);
+		if (kinds !== void 0 && (target.via === void 0 || !kinds.includes(target.via))) deny("not-allowed-for-membership", {
+			via: target.via ?? null,
+			for: kinds
+		});
+		const conflicts = custom === void 0 ? conflictsWith(policy, name) : new Set(includedRoles(custom).flatMap((include) => Array.from(conflictsWith(policy, include))));
+		const clash = targetRoles.filter((role) => conflicts.has(role));
+		if (clash.length > 0) deny("conflicting-role", { with: clash });
+	}
+	const delta = kind === "assign" ? already ? 0 : 1 : kind === "revoke" ? targetRoles.length > 0 && !already ? 0 : -1 : already ? -1 : 0;
+	countRules(binding, name, change.holders, delta, deny);
+	return done(by);
+}
+//#endregion
+//#region src/core/who-can.ts
+const MAX_ROUNDS = 48;
+async function settle$1(cache) {
+	for (let round = 0; round < MAX_ROUNDS; round += 1) {
+		const pending = pendingRelations(cache);
+		if (pending.length === 0) return;
+		await Promise.all(pending);
+	}
+}
+/** The holders on each instance a graph relation reads, or `undefined` when the graph cannot say. */
+async function walkHolders(condition, row, reader, cache) {
+	let walk = relationWalk(condition, row, reader);
+	if (walk === "relation-unavailable") {
+		await settle$1(cache);
+		walk = relationWalk(condition, row, reader);
+	}
+	if (walk === void 0) return [];
+	if (walk === "relation-depth" || walk === "relation-unavailable") return;
+	const { ids } = walk;
+	const read = () => ids.map((id) => reader.holders({
+		resource: condition.resource,
+		id,
+		relation: condition.relation
+	}));
+	let answers = read();
+	if (answers.includes("pending")) {
+		await settle$1(cache);
+		answers = read();
+	}
+	const out = [];
+	for (const [index, answer] of answers.entries()) {
+		const id = ids[index];
+		if (answer === "pending" || answer === "failed" || id === void 0) return;
+		out.push({
+			id,
+			holders: answer
+		});
+	}
+	return out;
+}
+async function discoverRole(item, allow, ctx) {
+	if (typeof item.scope !== "string" || item.scope === "global") {
+		ctx.incomplete();
+		return;
+	}
+	const key = scopeField(ctx.resource, item.scope, ctx.scopes);
+	const id = key === void 0 ? void 0 : relationId(ownGet(ctx.row, key));
+	if (id === void 0) return;
+	const members = await ctx.list(item.scope, id);
+	if (members === null) {
+		ctx.incomplete();
+		return;
+	}
+	for (const member of members.filter((entry) => entry.membership.roles.includes(item.role))) ctx.add(member.id, allow ? {
+		kind: "role",
+		role: item.role,
+		membership: member.membership
+	} : void 0, member.membership);
+}
+function holderVia(holder, at, share, group) {
+	if (!share) return {
+		kind: "relation",
+		...at
+	};
+	return compact({
+		kind: "share",
+		...at,
+		expiresAt: holder.expiresAt,
+		group
+	});
+}
+/**
+* Principals holding `group`'s relation, through at most `budget` more groups
+* of its resource; `undefined` when a read failed. `memo` keeps each group's
+* members per budget across one discovery, so a group shared by many paths is
+* read once; a result cut short by a cycle is path-specific and not kept.
+*/
+async function groupMembers(group, ctx, budget, seen, memo) {
+	const key = JSON.stringify([
+		group.resource,
+		group.id,
+		group.relation
+	]);
+	const memoKey = `${budget}:${key}`;
+	const known = memo.get(memoKey);
+	if (known !== void 0) return {
+		members: known,
+		cut: false
+	};
+	let holders = ctx.reader.holders(group);
+	if (holders === "pending") {
+		await settle$1(ctx.cache);
+		holders = ctx.reader.holders(group);
+	}
+	if (holders === "pending" || holders === "failed") return;
+	const path = new Set(seen).add(key);
+	const out = /* @__PURE__ */ new Set();
+	let cut = false;
+	for (const holder of holders) {
+		if ("principal" in holder) {
+			out.add(holder.principal.id);
+			continue;
+		}
+		const nested = JSON.stringify([
+			holder.group.resource,
+			holder.group.id,
+			holder.group.relation
+		]);
+		const same = holder.group.resource === group.resource;
+		if (path.has(nested)) {
+			cut = true;
+			continue;
+		}
+		if (same && budget <= 0) continue;
+		const walk = await groupMembers(holder.group, ctx, same ? budget - 1 : 16, path, memo);
+		if (walk === void 0) return;
+		cut ||= walk.cut;
+		for (const member of walk.members) out.add(member);
+	}
+	const members = [...out];
+	if (!cut) memo.set(memoKey, members);
+	return {
+		members,
+		cut
+	};
+}
+async function discoverGraph(condition, allow, ctx) {
+	const nodes = await walkHolders(condition, ctx.row, ctx.reader, ctx.cache);
+	if (nodes === void 0) {
+		ctx.incomplete();
+		return;
+	}
+	const node = ctx.policy.resources.get(condition.resource);
+	const memo = /* @__PURE__ */ new Map();
+	for (const entry of nodes) for (const holder of entry.holders) {
+		const at = {
+			resource: condition.resource,
+			relation: holder.relation,
+			id: entry.id
+		};
+		const share = isEdgeRelation(node?.relations[holder.relation]);
+		if ("principal" in holder) {
+			ctx.add(holder.principal.id, allow ? holderVia(holder, at, share) : void 0);
+			continue;
+		}
+		const walk = await groupMembers(holder.group, ctx, holder.group.resource === condition.resource ? 15 : 16, /* @__PURE__ */ new Set(), memo);
+		if (walk === void 0) {
+			ctx.incomplete();
+			continue;
+		}
+		for (const member of walk.members) ctx.add(member, allow ? holderVia(holder, at, share, holder.group) : void 0);
+	}
+}
+async function discoverRelation(item, allow, ctx, expanded = false) {
+	const condition = relationCondition(item, ctx.resource, ctx.scopes, { resources: ctx.policy.resources });
+	if (condition?.op === "related") {
+		await discoverGraph(condition, allow, ctx);
+		return;
+	}
+	const spec = ctx.resource?.relations[item.relation];
+	if (spec?.includes !== void 0 && !expanded) {
+		for (const name of expandRelation(ctx.resource, item.relation)) await discoverRelation({
+			...item,
+			relation: name
+		}, allow, ctx, true);
+		return;
+	}
+	const via = allow ? {
+		kind: "relation",
+		resource: ctx.permission.resource,
+		relation: item.relation,
+		id: relationId(ownGet(ctx.row, ctx.resource?.id ?? "id")) ?? ""
+	} : void 0;
+	if (isFieldRelation(spec) && spec.memberOf !== void 0) {
+		const scope = resolveScope(ctx.scopes, spec.memberOf);
+		const id = relationId(ownGet(ctx.row, spec.field));
+		const members = scope === void 0 || id === void 0 ? [] : await ctx.list(scope, id);
+		if (members === null) {
+			ctx.incomplete();
+			return;
+		}
+		for (const member of members) ctx.add(member.id, via, member.membership);
+		return;
+	}
+	const column = isFieldRelation(spec) ? spec.field : isPrincipalRelation(spec) ? spec.principal : void 0;
+	const holder = column === void 0 ? void 0 : relationId(ownGet(ctx.row, column));
+	if (holder !== void 0) ctx.add(holder, via);
+}
+function discover(grant, item, ctx) {
+	const allow = grant.effect === "allow";
+	switch (item.kind) {
+		case "role": return discoverRole(item, allow, ctx);
+		case "relation": return discoverRelation(item, allow, ctx);
+		case "anyone":
+		case "authenticated":
+		case "plan":
+		case "actor":
+		case "assurance":
+		case "inherit":
+			ctx.incomplete();
+			return Promise.resolve();
+		default: return unknownKind(item, ctx);
+	}
+}
+/** Holders of a grantee kind this build does not know cannot be listed. */
+function unknownKind(_item, ctx) {
+	ctx.incomplete();
+	return Promise.resolve();
+}
+function memberLister(source, scopes) {
+	const listed = /* @__PURE__ */ new Map();
+	const load = async (scope, id) => {
+		if (source?.list === void 0) return null;
+		try {
+			return (await source.list({
+				scope,
+				id
+			})).flatMap((entry) => typeof entry.principal?.id === "string" ? normalizeMemberships([entry.membership], scopes).map((membership) => ({
+				id: entry.principal.id,
+				membership
+			})) : []);
+		} catch {
+			return null;
+		}
+	};
+	return (scope, id) => {
+		const key = JSON.stringify([scope, id]);
+		const known = listed.get(key) ?? load(scope, id);
+		listed.set(key, known);
+		return known;
+	};
+}
+async function whoCan(input) {
+	const { policy, permission, row } = input;
+	if (permission.kind !== "instance" || row === null || typeof row !== "object") return freezeDeep({
+		permission: permission.key,
+		holders: [],
+		complete: false
+	});
+	const scopes = scopeList(policy.scopes);
+	let complete = !input.customGrants.some((item) => item.grant.permission.key === permission.key);
+	const found = /* @__PURE__ */ new Map();
+	const ctx = {
+		policy,
+		scopes,
+		resource: getResource(policy.permissions, permission.resource),
+		permission,
+		row,
+		reader: input.reader,
+		cache: input.cache,
+		list: memberLister(input.memberships, scopes),
+		add(id, via, membership) {
+			const entry = found.get(id) ?? {
+				memberships: [],
+				via: []
+			};
+			found.set(id, entry);
+			if (via !== void 0) entry.via.push(via);
+			if (membership !== void 0) entry.memberships.push(membership);
+		},
+		incomplete() {
+			complete = false;
+		}
+	};
+	await Promise.all((policy.index.grantsByKey.get(permission.key) ?? []).flatMap((grant) => flattenGrantee(grant.to).map((item) => discover(grant, item, ctx))));
+	const root = rootScope(scopes);
+	const tenantKey = root === void 0 ? void 0 : scopeField(getResource(policy.permissions, permission.resource), root, scopes);
+	const tenant = tenantKey === void 0 ? void 0 : relationId(ownGet(row, tenantKey));
+	const env = {
+		emit: false,
+		simulated: true,
+		skipAlternatives: true,
+		customRoles: [],
+		customGrants: [],
+		listeners: emptyListeners(),
+		sink: void 0,
+		limits: void 0,
+		limitCache: /* @__PURE__ */ new Map(),
+		team: input.team,
+		relations: input.reader
+	};
+	const now = nowSeconds();
+	const ordered = [...found.entries()].toSorted(([a], [b]) => byCodePoint(a, b));
+	const decideAll = () => ordered.map(([id, entry]) => {
+		const subject = freezeDeep({
+			principal: {
+				id,
+				roles: [],
+				memberships: entry.memberships,
+				...tenant === void 0 ? {} : { tenant }
+			},
+			context: {}
+		});
+		return evaluate(policy, subject, permission, row, {
+			source: "simulate",
+			trusted: true,
+			now
+		}, env);
+	});
+	let decisions = decideAll();
+	if (pendingRelations(input.cache).length > 0) {
+		await settle$1(input.cache);
+		decisions = decideAll();
+	}
+	const holders = [];
+	for (const [index, [id, entry]] of ordered.entries()) {
+		const decision = decisions[index];
+		if (decision === void 0 || decision.outcome === "denied") {
+			if (decision?.outcome === "denied" && decision.denials.some((denial) => denial.reason === "relation-unavailable" || denial.reason === "relation-depth")) complete = false;
+			continue;
+		}
+		holders.push({
+			principal: { id },
+			via: entry.via
+		});
+	}
+	return freezeDeep({
+		permission: permission.key,
+		holders,
+		complete
+	});
+}
+//#endregion
+//#region src/core/instance.ts
+/** Each round reads one more layer: link hops, then the chain, then nested groups. */
+const LOAD_ROUNDS = 48;
+/** A grant on a relation with a `period` is decided on the server, where the clock is. */
+function periodBound(policy, grant) {
+	const relations = policy.resources.get(grant.permission.resource)?.relations;
+	return flattenGrantee(grant.to).some((item) => {
+		if (item.kind !== "relation") return false;
+		const spec = relations?.[item.relation];
+		return isPrincipalRelation(spec) && spec.period !== void 0;
+	});
+}
+function includePrefixes(include) {
+	if (include === void 0) return;
+	return include.map((item) => {
+		if ("key" in item && typeof item.key === "string") return item.key;
+		const first = listPermissions(item)[0];
+		if (first === void 0) return "";
+		const parts = first.key.split(".");
+		parts.pop();
+		return parts.join(".");
+	});
+}
+/**
+* Role names held in `tenant` on live memberships, global roles included, in
+* rank order. With `scope`, only the roles of that scope's memberships (and
+* instance `id`).
+*/
+function heldRoleNames(policy, subject, tenant, only, now) {
+	if (subject.principal === null) return [];
+	const scopes = scopeList(policy.scopes);
+	const scope = only?.scope === void 0 ? void 0 : resolveScope(scopes, only.scope);
+	if (only?.scope !== void 0 && scope === void 0) return [];
+	const names = new Set(scope === void 0 ? subject.principal.roles ?? [] : []);
+	for (const membership of subject.principal.memberships ?? []) {
+		if (isMembershipExpired(membership, now) || membership.keep !== void 0) continue;
+		if (!(scope === void 0 ? tenantOf(membership, scopes) === tenant : membership.scope === scope && (only?.id === void 0 || sameId(membership.id, only.id)))) continue;
+		for (const role of membership.roles) names.add(role);
+	}
+	return rankRoles(policy, [...names]);
+}
+function roleLeaf(policy, name) {
+	const binding = policy.rolesByName.get(name);
+	return findRole(policy.vocabulary?.roles, name) ?? synthesiseRole(name, compact({
+		on: typeof binding?.on === "string" ? binding.on : void 0,
+		assignable: binding?.assignable,
+		meta: binding?.meta
+	}));
+}
+/**
+* The grant with its grantee's row condition. A graph relation needs the
+* `RelationSource`, which snapshots and `where()` do not carry, so the grant
+* becomes server-only (`portable: false`) there.
+*/
+function graphAware(grant, where) {
+	const combined = combineWhere(grant.where, where);
+	const graph = hasConditionOp(combined, "related");
+	const inherits = flattenGrantee(grant.to).some((item) => item.kind === "inherit");
+	return freezeDeep(compact({
+		...grant,
+		where: combined,
+		portable: graph ? false : grant.portable,
+		graph: graph && grant.portable && !inherits ? true : void 0
+	}));
+}
+/**
+* `where()` keeps a grant that is server-only because it reads the graph:
+* its `related` nodes compile to subqueries given relation mappings.
+*/
+function whereGrant(grant) {
+	return grant.graph === true ? freezeDeep({
+		...grant,
+		portable: true
+	}) : grant;
+}
+/**
+* Every grant the subject may reach, once per membership that holds all of
+* its scoped roles, so a client can check that membership's tenant, team or
+* resource. A scoped role held only globally reaches nothing.
+*/
+function collectSnapshotGrants(policy, subject, customRoles, now = nowSeconds(), customGrants = customGrantsFor(policy, customRoles), mode = "held") {
+	const skip = (grant, match) => mode === "held" ? !match.matched : match.matched || match.reason !== "not-entitled" || grant.effect !== "allow";
+	const scopes = scopeList(policy.scopes);
+	const declared = declaredRoleNames(policy);
+	const global = expandRoleNames(subject.principal?.roles ?? [], declared, customRoles, subject.principal?.tenant);
+	const held = (subject.principal?.memberships ?? []).map((membership) => ({
+		membership,
+		roles: new Set(expandRoleNames(membership.roles, declared, customRoles, tenantOf(membership, scopes)).roles)
+	}));
+	const holds = (entry, item) => entry.roles.has(item.role) && (typeof item.scope === "string" ? entry.membership.scope === item.scope : entry.membership.on !== void 0);
+	const requirementOf = (grant, resource) => grant.requires === void 0 || grant.effect !== "allow" ? void 0 : requirementCondition(policy, subject, grant.requires, resource, now, customRoles, customGrants);
+	const out = [];
+	for (const grant of grantList(policy)) {
+		if (mode === "held" && !coversRequirements(policy.permissions, grant.requires, subject.delegation)) continue;
+		const resource = getResource(policy.permissions, grant.permission.resource);
+		const match = matchGrantee(grant.to, subject, now, resource, scopes, policy.resources);
+		if (skip(grant, match)) continue;
+		const roleItems = flattenGrantee(grant.to).filter((item) => item.kind === "role");
+		if (roleItems.length > 0 && subject.principal === null) continue;
+		if (!roleItems.every((item) => item.scope !== "global" || global.roles.includes(item.role))) continue;
+		const merged = graphAware(grant, combineWhere(match.where, requirementOf(grant, resource)));
+		const scoped = roleItems.filter((item) => item.scope !== "global");
+		if (scoped.length === 0) {
+			out.push({ grant: merged });
+			continue;
+		}
+		for (const entry of held) if (keepsPermission(entry.membership, grant.permission.key) && scoped.every((item) => item.kind === "role" && holds(entry, item))) out.push({
+			grant: merged,
+			membership: entry.membership
+		});
+	}
+	for (const { grant, role } of customGrants) {
+		const globalHeld = holdsGlobalCustomRole(subject.principal?.roles, role);
+		const holders = held.filter((entry) => keepsPermission(entry.membership, grant.permission.key) && holdsCustomRole(entry.membership, role, scopes));
+		if (holders.length === 0 && !globalHeld) continue;
+		const resource = getResource(policy.permissions, grant.permission.resource);
+		const match = matchGrantee(grant.to, subject, now, resource, scopes, policy.resources);
+		if (skip(grant, match)) continue;
+		const merged = graphAware(grant, combineWhere(match.where, requirementOf(grant, resource)));
+		if (globalHeld) out.push({ grant: merged });
+		for (const entry of holders) out.push({
+			grant: merged,
+			membership: entry.membership
+		});
+	}
+	const fresh = policy.fresh ?? [];
+	if (mode === "held" && subject.stale === true && fresh.length > 0) return out.filter(({ grant }) => grant.effect === "deny" || !fresh.includes(grant.permission.key));
+	return out;
+}
+/**
+* Declared roles a tenant admin may hand out or compose, before any
+* intersection: `assignable` roles, plus every role some `assigns` lists.
+*/
+function assignableCandidates(policy) {
+	const listed = new Set(policy.roles.flatMap((binding) => binding.assigns ?? []));
+	const names = [...listRoles(policy.vocabulary?.roles).filter((leaf) => leaf.assignable || listed.has(leaf.key)).map((leaf) => leaf.key), ...policy.roles.filter((binding) => binding.assignable || listed.has(binding.name)).map((binding) => binding.name)];
+	return rankRoles(policy, [...new Set(names)]).map((name) => roleLeaf(policy, name));
+}
+/**
+* The levels a held allow of a permission covers: its own `level`, every
+* level when it has no row condition, or the levels whose condition equals
+* its condition.
+*/
+function heldLevels(policy, grant, names) {
+	if (grant.level !== void 0) return [grant.level];
+	if (grant.where === void 0) return names;
+	const held = canonicalJson(grant.where);
+	return names.filter((name) => {
+		const condition = levelCondition(policy, grant.permission.resource, name);
+		return condition !== void 0 && canonicalJson(condition) === held;
+	});
+}
+/**
+* What the subject may hand out in `tenant`: declared assignable roles and the
+* tenant custom-role ceiling, narrowed by `allowed` (`RoleSource.assignable`),
+* then intersected with the permissions the subject holds there. Holding a
+* role or a granted permission with `meta.manageRoles` lifts the intersection.
+*/
+function assignableIn(policy, subject, customRoles, customGrants, tenant, allowed, now = nowSeconds(), global = false) {
+	const principal = subject.principal;
+	if (principal === null) return {
+		roles: [],
+		permissions: [],
+		levels: {},
+		manage: false,
+		inert: []
+	};
+	const scopes = scopeList(policy.scopes);
+	const scoped = tenant === void 0 ? subject : freezeDeep(compact({
+		...subject,
+		principal: compact({
+			...principal,
+			tenant: resolveActiveTenant(principal, tenant, scopes, now)
+		})
+	}));
+	const heldGrants = collectSnapshotGrants(policy, scoped, customRoles, now, customGrants).filter((item) => item.grant.effect === "allow" && (item.membership === void 0 || !global && tenantOf(item.membership, scopes) === tenant && !isMembershipExpired(item.membership, now))).map((item) => item.grant);
+	const heldKeys = new Set(heldGrants.map((grant) => grant.permission.key));
+	const heldNames = heldRoleNames(policy, subject, tenant, void 0, now);
+	const quiet = {
+		emit: false,
+		simulated: true,
+		skipAlternatives: true,
+		customRoles,
+		customGrants,
+		listeners: emptyListeners(),
+		sink: void 0,
+		limits: void 0,
+		limitCache: /* @__PURE__ */ new Map(),
+		team: void 0
+	};
+	const manage = heldNames.some((name) => roleMeta(policy, name)?.manageRoles === true) || listPermissions(policy.permissions).some((leaf) => leaf.meta.manageRoles === true && evaluate(policy, scoped, leaf, void 0, {
+		source: "simulate",
+		trusted: true,
+		now
+	}, quiet).outcome === "granted");
+	const narrowed = allowed === void 0 ? void 0 : new Set(allowed);
+	const candidates = assignableCandidates(policy).filter((leaf) => narrowed === void 0 || narrowed.has(leaf.key));
+	const held = new Set(heldNames);
+	const listed = usesAssigns(policy) ? new Set(heldNames.flatMap((name) => policy.rolesByName.get(name)?.assigns ?? [])) : void 0;
+	const roles = manage ? candidates : candidates.filter((leaf) => {
+		if (listed !== void 0) return listed.has(leaf.key);
+		if (held.has(leaf.key)) return true;
+		const keys = [...roleAllowKeys(policy, leaf.key)];
+		return keys.length > 0 && keys.every((key) => heldKeys.has(key));
+	});
+	const root = global ? "global" : rootScope(scopes);
+	const ceiling = new Set((root === void 0 ? [] : ceilingGrants(policy, root, allowed)).map((grant) => grant.permission.key));
+	const permissions = listPermissions(policy.permissions).filter((leaf) => ceiling.has(leaf.key) && (manage || heldKeys.has(leaf.key)));
+	const offeredLevels = (key, names) => {
+		if (manage) return names;
+		const reached = new Set(heldGrants.filter((grant) => grant.permission.key === key).flatMap((grant) => heldLevels(policy, grant, names)));
+		return names.filter((name) => reached.has(name));
+	};
+	const levels = {};
+	for (const leaf of permissions) {
+		const names = leaf.kind === "instance" ? levelNames(policy, leaf.resource) : [];
+		if (names.length > 0) levels[leaf.key] = offeredLevels(leaf.key, names);
+	}
+	const ceilingKeys = /* @__PURE__ */ new Map();
+	const mayHandOut = (scope, grant) => {
+		const key = grant.permission.key;
+		let keys = ceilingKeys.get(scope);
+		if (keys === void 0) {
+			keys = new Set(ceilingGrants(policy, scope, allowed).map((item) => item.permission.key));
+			ceilingKeys.set(scope, keys);
+		}
+		if (!keys.has(key) || !(manage || heldKeys.has(key))) return false;
+		const names = grant.permission.kind === "instance" ? levelNames(policy, grant.permission.resource) : [];
+		if (names.length === 0) return true;
+		const offered = offeredLevels(key, names);
+		return heldLevels(policy, grant, names).every((name) => offered.includes(name));
+	};
+	const custom = global || tenant === void 0 ? {
+		roles: [],
+		inert: []
+	} : assignableCustomRoles(policy, customRoles, tenant, manage ? void 0 : roles, mayHandOut);
+	return {
+		roles: [...roles, ...custom.roles],
+		permissions,
+		levels,
+		manage,
+		inert: custom.inert
+	};
+}
+/**
+* The tenant's custom roles the subject may hand out: held at a scope it may
+* assign declared roles at (any scope with `meta.manageRoles`), allowing at
+* least one permission after the ceiling, and only permissions and levels it
+* may hand out at that scope. A role that allows nothing is `inert`.
+*/
+function assignableCustomRoles(policy, customRoles, tenant, declared, mayHandOut) {
+	const scopes = scopeList(policy.scopes);
+	const root = rootScope(scopes);
+	const assignsAt = declared === void 0 ? void 0 : new Set(declared.map((leaf) => leaf.on === void 0 ? root : resolveScope(scopes, leaf.on)));
+	const out = /* @__PURE__ */ new Map();
+	const inert = /* @__PURE__ */ new Set();
+	for (const role of tenantCustomRoles(policy, customRoles)) {
+		if (role.tenant !== tenant || out.has(role.name)) continue;
+		const at = customRoleScope(role, scopes);
+		if (at === void 0 || assignsAt !== void 0 && !assignsAt.has(at)) continue;
+		const { grants } = resolveCustomRole(policy, role);
+		if (!grants.some((grant) => grant.effect === "allow")) {
+			inert.add(role.name);
+			continue;
+		}
+		if (grants.every((grant) => grant.effect === "deny" || mayHandOut(at, grant))) out.set(role.name, synthesiseRole(role.name, {
+			on: at,
+			assignable: true
+		}));
+	}
+	return {
+		roles: [...out.values()].toSorted((a, b) => a.key.localeCompare(b.key)),
+		inert: [...inert].filter((name) => !out.has(name)).toSorted()
+	};
+}
+/** The one path from a resolved subject to a `Snapshot`; pure apart from the default clock. */
+function snapshotOf(policy, subject, options) {
+	const now = options.now ?? nowSeconds();
+	const customGrants = options.customGrants ?? customGrantsFor(policy, options.customRoles);
+	const roles = heldRoleNames(policy, subject, subject.principal?.tenant, void 0, now);
+	const audiences = audiencesOf(policy, roles);
+	return buildSnapshot(compact({
+		subject,
+		roles,
+		audiences: audiences.length === 0 ? void 0 : audiences,
+		notEntitled: collectSnapshotGrants(policy, subject, options.customRoles, now, customGrants, "not-entitled"),
+		grants: collectSnapshotGrants(policy, subject, options.customRoles, now, customGrants).map((item) => periodBound(policy, item.grant) ? Object.assign({}, item, { grant: freezeDeep({
+			...item.grant,
+			portable: false
+		}) }) : item),
+		include: includePrefixes(options.include),
+		tenants: options.tenants,
+		simulated: options.simulated,
+		now: Math.floor(now),
+		vocabulary: policy.vocabulary,
+		scopes: snapshotScopes(policy),
+		idOf: (name) => getResource(policy.permissions, name)?.id,
+		delegated: delegatedPermissions(policy.delegations, subject, new Set(roles), now),
+		assignable: (tenant) => {
+			const found = assignableIn(policy, subject, options.customRoles, customGrants, tenant, options.assignable?.get(tenant), now);
+			return compact({
+				tenant,
+				roles: found.roles.map((leaf) => leaf.key),
+				permissions: found.permissions,
+				levels: Object.keys(found.levels).length === 0 ? void 0 : found.levels
+			});
+		}
+	}));
+}
+/** The policy's scopes as snapshots and `permdock cloud push` carry them, with the resources each partitions. */
+function snapshotScopes(policy) {
+	if (policy.scopes.length === 0) return;
+	const resources = [...policy.resources.values()];
+	return policy.scopes.map((scope) => {
+		const nodes = resources.filter((node) => partitionsOf(node, policy.scopes).includes(scope.name));
+		const partitioned = nodes.map((node) => node.name);
+		const fields = Object.fromEntries(nodes.flatMap((node) => {
+			const field = scopeField(node, scope.name, policy.scopes);
+			return field === void 0 || field === scope.key ? [] : [[node.name, field]];
+		}));
+		return compact({
+			name: scope.name,
+			key: scope.key ?? "",
+			within: scope.within,
+			resources: partitioned.length === 0 ? void 0 : partitioned,
+			fields: Object.keys(fields).length === 0 ? void 0 : fields
+		});
+	});
+}
+function buildInstance(policy, subject, envBase, team) {
+	const listeners = emptyListeners();
+	const queuedAuth = [...envBase.queuedAuth];
+	const queuedErrors = [...envBase.queuedErrors ?? []];
+	const customGrants = customGrantsFor(policy, envBase.customRoles);
+	const relationCache = envBase.relationCache ?? /* @__PURE__ */ new Map();
+	const relations = relationReader(envBase.relations, relationCache, policy.resources);
+	const assignableAt = (tenant) => assignableIn(policy, subject, envBase.customRoles, customGrants, tenant, tenant === void 0 ? void 0 : envBase.assignable?.get(tenant));
+	const envFor = (emit, skipAlternatives = false) => ({
+		emit,
+		simulated: envBase.simulated,
+		skipAlternatives,
+		customRoles: envBase.customRoles,
+		customGrants,
+		listeners,
+		sink: envBase.sink,
+		limits: envBase.limits,
+		limitCache: envBase.limitCache,
+		team,
+		relations,
+		...envBase.approvalPolicies === void 0 ? {} : { approvalPolicies: envBase.approvalPolicies }
+	});
+	/** The one `simulate` event for a batch: the worst decision, with the counts. */
+	const simulateEvent = (evaluated) => {
+		const counts = {
+			granted: 0,
+			denied: 0,
+			approvalRequired: 0
+		};
+		for (const [, , decision] of evaluated) if (decision.outcome === "granted") counts.granted += 1;
+		else if (decision.outcome === "approval-required") counts.approvalRequired += 1;
+		else counts.denied += 1;
+		const worst = evaluated.find(([, , decision]) => decision.outcome === "denied") ?? evaluated.find(([, , decision]) => decision.outcome === "approval-required") ?? evaluated[0];
+		if (worst === void 0) return;
+		const [permission, data, decision] = worst;
+		finish(policy, subject, permission, data, decision, {
+			source: "simulate",
+			trusted: true
+		}, {
+			...envFor(false),
+			emit: true
+		}, true, void 0, counts);
+	};
+	const decideImpl = (permission, data, options) => evaluate(policy, subject, permission, data, options ?? {}, envFor(options?.source !== "simulate", options?.source === "can"));
+	const explainImpl = (permission, data, options) => {
+		return decideImpl(permission, data, {
+			...options,
+			source: options?.source ?? "explain",
+			explain: true
+		});
+	};
+	const canImpl = (permission, data, options) => {
+		try {
+			return decideImpl(permission, data, {
+				...options,
+				source: options?.source ?? "can"
+			}).outcome === "granted";
+		} catch {
+			return false;
+		}
+	};
+	const assertImpl = (permission, data, options) => {
+		const decision = decideImpl(permission, data, {
+			...options,
+			source: options?.source ?? "assert"
+		});
+		if (decision.outcome === "granted") return decision;
+		const onDenied = options?.onDenied ?? policy.onDenied;
+		if (onDenied !== void 0) onDenied(decision);
+		const resource = getResource(policy.permissions, permission.resource);
+		const resourceId = data !== null && typeof data === "object" ? data[resource?.id ?? "id"] : void 0;
+		const resourceRef = compact({
+			type: permission.resource,
+			id: resourceId === void 0 ? void 0 : String(resourceId)
+		});
+		if (decision.outcome === "approval-required") throw new PermDockApprovalRequiredError({
+			decision,
+			permission: permission.key,
+			scope: permission.scope,
+			resource: resourceRef,
+			message: approvalMessage(permission.key, decision.reason, decision.token)
+		});
+		if (decision.denials.some((denial) => denial.reason === "validation")) {
+			const detail = decision.denials[0]?.detail;
+			if (detail instanceof PermDockValidationError) throw detail;
+		}
+		throw new PermDockDeniedError({
+			decision,
+			permission: permission.key,
+			scope: permission.scope,
+			resource: resourceRef,
+			subject,
+			message: deniedMessage(permission.key, subject.principal?.id, decision.denials, decision.alternatives.map((leaf) => leaf.key)),
+			...data === void 0 || resource === void 0 ? {} : { disclosure: resource.disclosure }
+		});
+	};
+	const instance = {
+		can: canImpl,
+		decide: decideImpl,
+		assert: assertImpl,
+		explain: explainImpl,
+		permissions: policy.permissions,
+		roles: policy.vocabulary?.roles ?? {},
+		plans: policy.vocabulary?.plans ?? {},
+		filter(permission, rows, options) {
+			const allowed = [];
+			let granted = 0;
+			let denied = 0;
+			let approvalRequired = 0;
+			const quiet = {
+				...envFor(false, true),
+				outcomeOnly: true
+			};
+			const trusted = options?.trusted ?? true;
+			const decideOptions = {
+				...options,
+				source: "filter",
+				trusted
+			};
+			for (const row of rows) {
+				const decision = evaluate(policy, subject, permission, row, decideOptions, quiet);
+				if (decision.outcome === "granted") {
+					allowed.push(row);
+					granted += 1;
+				} else if (decision.outcome === "approval-required") approvalRequired += 1;
+				else denied += 1;
+			}
+			const summary = granted > 0 ? freezeDeep({
+				outcome: "granted",
+				subject,
+				matched: {
+					role: "*",
+					permission: permission.key
+				},
+				token: "pd1.filter"
+			}) : freezeDeep({
+				outcome: "denied",
+				denials: [{
+					role: null,
+					reason: "no-grant"
+				}],
+				alternatives: []
+			});
+			finish(policy, subject, permission, rows[0], summary, decideOptions, {
+				...quiet,
+				emit: true
+			}, trusted, void 0, {
+				granted,
+				denied,
+				approvalRequired
+			});
+			return allowed;
+		},
+		pick(permission, row, options) {
+			if (row === null || typeof row !== "object") return {};
+			if (canImpl(permission, row, options) !== true) return {};
+			return pickVisible(row, (field) => {
+				const next = compact({
+					...options,
+					field
+				});
+				return canImpl(permission, row, next) === true;
+			});
+		},
+		where(permission) {
+			const grants = collectSnapshotGrants(policy, subject, envBase.customRoles, nowSeconds(), customGrants).filter((item) => item.grant.permission.key === permission.key).map((item) => snapshotGrant(whereGrant(item.grant), item.membership));
+			return whereFromGrants(grants, compact({
+				resource: permission.resource,
+				resources: policy.resources,
+				graph: envBase.relations !== void 0,
+				scopes: scopeList(policy.scopes),
+				partitioned: (name, key) => relatesTo(getResource(policy.permissions, permission.resource), key, name, scopeList(policy.scopes)),
+				fieldOf: (name) => scopeField(getResource(policy.permissions, permission.resource), name, scopeList(policy.scopes)),
+				tenant: subject.principal?.tenant,
+				team,
+				now: nowSeconds(),
+				subject
+			}));
+		},
+		actions(resource, data, options) {
+			const fromTree = listPermissions(resource);
+			return (fromTree.length > 0 ? fromTree : "resource" in resource && typeof resource.resource === "string" ? listPermissions(policy.permissions).filter((item) => item.resource === resource.resource) : []).filter((item) => canImpl(item, data, options) === true);
+		},
+		async loadRelations(permission, rows) {
+			if (envBase.relations === void 0) return;
+			const quiet = {
+				...envFor(false),
+				simulated: true,
+				skipAlternatives: true
+			};
+			for (let round = 0; round < LOAD_ROUNDS; round += 1) {
+				for (const row of rows) evaluate(policy, subject, permission, row, {
+					source: "simulate",
+					trusted: true
+				}, quiet);
+				const pending = pendingRelations(relationCache);
+				if (pending.length === 0) return;
+				await Promise.all(pending);
+			}
+		},
+		whoCan(permission, row) {
+			return whoCan({
+				policy,
+				permission,
+				row,
+				memberships: envBase.memberships,
+				reader: relations,
+				cache: relationCache,
+				customGrants,
+				team
+			});
+		},
+		simulate: ((input, options) => {
+			const evaluated = [];
+			const quietly = (permission, data) => {
+				const decision = evaluate(policy, subject, permission, data, compact({
+					source: "simulate",
+					trusted: true,
+					now: options?.now
+				}), envFor(false));
+				evaluated.push([
+					permission,
+					data,
+					decision
+				]);
+				return decision;
+			};
+			if (isReadonlyArray(input)) {
+				const decisions = input.map(([permission, data]) => quietly(permission, data));
+				simulateEvent(evaluated);
+				return decisions;
+			}
+			if (isArazzoSimulateInput(input)) {
+				const plan = simulateArazzo(input, input.permissions ?? policy.permissions, quietly);
+				simulateEvent(evaluated);
+				return plan;
+			}
+			const preview = input;
+			const previewRoles = preview.roles?.map((item) => typeof item === "string" ? item : item.key);
+			const kinds = subject.principal === null ? void 0 : applyRoleKinds(policy, previewRoles ?? subject.principal.roles, preview.memberships === void 0 ? subject.principal.memberships ?? [] : normalizeMemberships(preview.memberships, scopeList(policy.scopes)));
+			const previewPrincipal = subject.principal === null || kinds === void 0 ? null : freezeDeep(compact({
+				...subject.principal,
+				roles: kinds.roles,
+				memberships: preview.memberships === void 0 && subject.principal.memberships === void 0 ? void 0 : kinds.memberships,
+				tenant: preview.tenant ?? subject.principal.tenant
+			}));
+			return buildInstance(policy, freezeDeep({
+				...subject,
+				principal: previewPrincipal
+			}), {
+				...envBase,
+				simulated: true,
+				relationCache
+			}, team);
+		}),
+		snapshot: ((options) => {
+			const snapshot = snapshotOf(policy, subject, compact({
+				customRoles: envBase.customRoles,
+				customGrants,
+				assignable: envBase.assignable,
+				include: options?.include,
+				tenants: options?.tenants,
+				simulated: envBase.simulated
+			}));
+			if (options?.signer !== void 0) return signSnapshot(snapshot, options.signer, options.audience);
+			return snapshot;
+		}),
+		on(event, handler) {
+			const set = listeners[event];
+			set.add(handler);
+			if (event === "auth") for (const queued of queuedAuth) try {
+				handler(queued);
+			} catch (error) {
+				emitSafe(listeners.error, error, listeners);
+			}
+			if (event === "error") for (const queued of queuedErrors) try {
+				handler(queued);
+			} catch {}
+			return () => {
+				set.delete(handler);
+			};
+		},
+		tenant(id) {
+			if (subject.principal === null) return buildInstance(policy, subject, {
+				...envBase,
+				relationCache
+			}, team);
+			return buildInstance(policy, freezeDeep(compact({
+				...subject,
+				principal: compact({
+					...subject.principal,
+					tenant: resolveActiveTenant(subject.principal, id, scopeList(policy.scopes))
+				})
+			})), {
+				...envBase,
+				relationCache
+			}, team);
+		},
+		team(id) {
+			return buildInstance(policy, subject, {
+				...envBase,
+				relationCache
+			}, id);
+		},
+		memberships() {
+			return subject.principal?.memberships ?? [];
+		},
+		tenants() {
+			return tenantsOf(subject.principal, scopeList(policy.scopes));
+		},
+		heldRoles(options) {
+			return heldRoleNames(policy, subject, options?.tenant ?? subject.principal?.tenant, options?.scope === void 0 ? void 0 : compact({
+				scope: options.scope,
+				id: options.id
+			})).map((name) => roleLeaf(policy, name));
+		},
+		audiences() {
+			return audiencesOf(policy, heldRoleNames(policy, subject, subject.principal?.tenant));
+		},
+		assignableRoles(options) {
+			return assignableAt(options?.tenant ?? subject.principal?.tenant).roles;
+		},
+		assignablePermissions(options) {
+			if (options?.scope === "global") return assignableIn(policy, subject, envBase.customRoles, customGrants, void 0, void 0, nowSeconds(), true).permissions;
+			const tenant = options?.tenant ?? subject.principal?.tenant;
+			return tenant === void 0 ? [] : assignableAt(tenant).permissions;
+		},
+		assignableLevels(permission, options) {
+			const of = (found) => (Object.hasOwn(found.levels, permission.key) ? found.levels[permission.key] : void 0) ?? [];
+			if (options?.scope === "global") return of(assignableIn(policy, subject, envBase.customRoles, customGrants, void 0, void 0, nowSeconds(), true));
+			const tenant = options?.tenant ?? subject.principal?.tenant;
+			return tenant === void 0 ? [] : of(assignableAt(tenant));
+		},
+		decideRoleChange(change, options) {
+			return decideRoleChange(policy, subject.principal, scopeList(policy.scopes), change, envBase.customRoles, (tenant) => {
+				const found = assignableAt(tenant);
+				return {
+					assignable: new Set(found.roles.map((leaf) => leaf.key)),
+					manage: found.manage,
+					inert: new Set(found.inert)
+				};
+			}, nowSeconds(), options);
+		},
+		activate(input) {
+			return activate(policy, subject, input, nowSeconds());
+		},
+		derive(options) {
+			const scopes = scopeList(policy.scopes);
+			const tenants = tenantsOf(subject.principal, scopes);
+			const auth = [];
+			const named = options.customRoles === void 0 ? void 0 : roleSourceFor(options.customRoles, subject, auth);
+			const roleSource = options.customRoles === void 0 ? envBase.roleSource : named;
+			const roles = options.customRoles === void 0 ? envBase.customRoles : customRolesFor(named, tenants, auth, subject.principal === null ? void 0 : subject.principal.roles ?? [], (tenant) => heldRoleNamesIn(subject.principal, scopes, tenant));
+			const names = options.customRoles === void 0 ? envBase.assignable : assignableNamesFor(named, tenants, auth);
+			const approvals = options.approvalPolicies === void 0 ? envBase.approvalPolicies : approvalPoliciesFor(policy, options.approvalPolicies, tenants, auth);
+			const relationSource = options.relations ?? envBase.relations;
+			const build = (loadedRoles, loadedNames, loadedApprovals) => buildInstance(policy, subject, compact({
+				...envBase,
+				customRoles: loadedRoles,
+				roleSource,
+				assignable: loadedNames,
+				approvalPolicies: loadedApprovals,
+				relations: relationSource,
+				relationCache: options.relations === void 0 ? relationCache : void 0,
+				queuedAuth: auth,
+				queuedErrors: []
+			}), team);
+			if (isThenable(roles) || isThenable(names) || isThenable(approvals)) return Promise.all([
+				roles,
+				names,
+				approvals
+			]).then(([loadedRoles, loadedNames, loadedApprovals]) => build(loadedRoles, loadedNames, loadedApprovals));
+			return build(roles, names, approvals);
+		},
+		subject
+	};
+	return Object.freeze(instance);
+}
+//#endregion
+//#region src/core/oauth-scopes.ts
+/**
+* `delegation` with every coarse OAuth scope the policy declares in
+* `oauthScopes` followed by the scopes of the permissions it covers, so the
+* delegation checks downstream match them. The token's scopes stay first and
+* unchanged; an undeclared scope expands to nothing.
+*/
+function expandOAuthScopes(policy, delegation) {
+	const declared = policy.oauthScopes;
+	const scopes = delegation?.scopes;
+	if (declared === void 0 || delegation === void 0 || scopes === void 0) return delegation;
+	const out = new Set(scopes);
+	for (const entry of declared) if (scopes.includes(entry.scope)) for (const scope of entry.scopes) out.add(scope);
+	return out.size === scopes.length ? delegation : {
+		...delegation,
+		scopes: [...out]
+	};
+}
+/** The coarse scopes the policy declares that cover `permission`, in declaration order. */
+function coarseScopesFor(policy, permission) {
+	return (policy.oauthScopes ?? []).filter((entry) => entry.permissions.includes(permission.key)).map((entry) => entry.scope);
+}
+/** Every token scope that reaches `permission`: its own, any it was renamed from, and the coarse scopes covering it. */
+function scopesReaching(policy, permission) {
+	return [
+		permission.scope,
+		...formerScopes(permission),
+		...coarseScopesFor(policy, permission)
+	];
+}
+/**
+* The scope an `insufficient_scope` challenge names for `permission`: the
+* first coarse scope that covers it, which the authorization server issues,
+* else the permission's own scope.
+*/
+function challengeScope(policy, permission) {
+	return coarseScopesFor(policy, permission)[0] ?? permission.scope;
+}
+//#endregion
+//#region src/core/resolve-subject.ts
+/**
+* The tenant a user API key holds its owner to (`Credential.tenant`): only
+* the memberships inside it count, and no global role.
+*/
+function heldTenantOf(principal) {
+	const credential = principal["credential"];
+	if (credential === null || typeof credential !== "object" || !Object.hasOwn(credential, "tenant") || !Object.hasOwn(credential, "kind")) return;
+	const record = credential;
+	return record.kind === "user" && typeof record.tenant === "string" && record.tenant !== "" ? record.tenant : void 0;
+}
+function outsideHeld(held, options) {
+	return held !== void 0 && options.tenant !== void 0 && options.tenant !== held;
+}
+function assemblePrincipal(policy, user, options, auth) {
+	let principal;
+	let context = {};
+	let actor = options.actor;
+	let delegation = options.delegation;
+	let session = options.session;
+	let expiresAt = options.expiresAt;
+	let liveSession;
+	try {
+		if (user === null || user === void 0) principal = policy.subject(user);
+		else if (isSubject(user)) {
+			principal = user.principal;
+			context = user.context;
+			actor = user.actor ?? actor;
+			delegation = user.delegation ?? delegation;
+			session = user.session ?? session;
+			expiresAt = user.expiresAt ?? expiresAt;
+			liveSession = user.liveSession === true ? true : void 0;
+		} else if (isPrincipal(user)) principal = user;
+		else principal = policy.subject(user);
+	} catch {
+		principal = null;
+	}
+	const contextResult = resolveContext(policy, user, context, auth);
+	let memberships = principal?.memberships ?? [];
+	let live = false;
+	const source = options.memberships === void 0 ? void 0 : asMembershipSource(options.memberships);
+	const fromClaims = source?.claimsFirst === true && principal?.memberships !== void 0 && principal.membershipsTruncated !== true;
+	const read = (from, of) => {
+		try {
+			return from.membershipsFor(compact({
+				id: of.id,
+				kind: of.kind
+			}), compact({ tenant: options.tenant }));
+		} catch {
+			auth.push({
+				reason: "source-threw",
+				source: "memberships"
+			});
+			return [];
+		}
+	};
+	let stale;
+	if (principal !== null && source !== void 0 && !fromClaims) {
+		live = true;
+		memberships = read(source, principal);
+	} else if (principal?.memberships !== void 0 && fromClaims && source.onStale === "reread" && source.version !== void 0) {
+		const reread = rereadStale(source, principal, principal.memberships, () => read(source, principal), auth);
+		memberships = reread.memberships;
+		stale = reread.stale;
+	}
+	return compact({
+		principal,
+		context: contextResult,
+		actor,
+		delegation: expandOAuthScopes(policy, delegation),
+		session,
+		expiresAt,
+		memberships,
+		live,
+		stale,
+		liveSession: principal === null ? void 0 : liveSession
+	});
+}
+function versionQuery(principal) {
+	return compact({
+		id: principal.id,
+		roles: principal.roles,
+		memberships: principal.memberships
+	});
+}
+function rereadStale(source, principal, claims, read, auth) {
+	const claimed = principal.authzVersion;
+	const judge = (current) => typeof claimed === "number" && current !== void 0 && claimed >= current ? "fresh" : "reread";
+	const unknown = () => {
+		auth.push({
+			reason: "source-threw",
+			source: "memberships"
+		});
+		return "unknown";
+	};
+	let freshness;
+	try {
+		const current = source.version?.(versionQuery(principal));
+		freshness = isThenable(current) ? Promise.resolve(current).then(judge, unknown) : judge(current);
+	} catch {
+		freshness = unknown();
+	}
+	if (isThenable(freshness)) return {
+		memberships: freshness.then((found) => found === "reread" ? read() : claims),
+		stale: freshness.then((found) => found === "unknown")
+	};
+	return {
+		memberships: freshness === "reread" ? read() : claims,
+		stale: freshness === "unknown"
+	};
+}
+function finishSubject(policy, assembled, context, input, options, extra) {
+	if (assembled.principal === null) return freezeCopy(compact({
+		...anonymousSubject(context),
+		actor: assembled.actor,
+		delegation: assembled.delegation,
+		session: assembled.session,
+		expiresAt: assembled.expiresAt
+	}));
+	const scopes = scopeList(policy.scopes);
+	const held = heldTenantOf(assembled.principal);
+	const kinds = applyRoleKinds(policy, assembled.principal.roles, normalizeMemberships(input, scopes));
+	const roles = held === void 0 ? kinds.roles : [];
+	const memberships = held === void 0 ? kinds.memberships : outsideHeld(held, options) ? [] : kinds.memberships.filter((membership) => tenantOf(membership, scopes) === held);
+	const plans = [.../* @__PURE__ */ new Set([...assembled.principal.plans ?? [], ...extra.plans])];
+	const withMemberships = freezeCopy(compact({
+		...assembled.principal,
+		roles,
+		memberships,
+		plans: plans.length === 0 ? assembled.principal.plans : plans,
+		tenant: activeTenantOf(policy, assembled, memberships, options)
+	}));
+	return freezeCopy(compact({
+		principal: withMemberships,
+		actor: assembled.actor,
+		delegation: assembled.delegation,
+		context: freezeCopy(context),
+		session: assembled.session,
+		expiresAt: assembled.expiresAt,
+		stale: extra.stale ? true : void 0,
+		liveSession: assembled.liveSession
+	}));
+}
+function activeTenantOf(policy, assembled, memberships, options) {
+	if (assembled.principal === null) return;
+	const held = heldTenantOf(assembled.principal);
+	if (held !== void 0) return outsideHeld(held, options) ? void 0 : held;
+	return resolveActiveTenant({
+		...assembled.principal,
+		memberships
+	}, options.tenant ?? assembled.principal.tenant, scopeList(policy.scopes));
+}
+function settle(value, fallback, onError) {
+	if (isThenable(value)) return Promise.resolve(value).catch(() => {
+		onError();
+		return fallback;
+	});
+	return value;
+}
+/**
+* Whether the token's memberships are behind the source for `fresh`
+* permissions. Live memberships are never stale; token memberships are stale
+* unless a source reports a version the token's `authzVersion` has reached.
+*/
+function staleness(policy, assembled, options, auth) {
+	const principal = assembled.principal;
+	if ((policy.fresh ?? []).length === 0 || principal === null || assembled.live) return false;
+	if (assembled.stale !== void 0) return assembled.stale;
+	const source = options.memberships === void 0 ? void 0 : asMembershipSource(options.memberships);
+	const claimed = principal.authzVersion;
+	if (source?.version === void 0 || typeof claimed !== "number") return true;
+	const compare = (current) => current === void 0 || claimed < current;
+	try {
+		const current = source.version(versionQuery(principal));
+		return isThenable(current) ? settle(Promise.resolve(current).then(compare), true, () => {
+			auth.push({
+				reason: "source-threw",
+				source: "memberships"
+			});
+		}) : compare(current);
+	} catch {
+		auth.push({
+			reason: "source-threw",
+			source: "memberships"
+		});
+		return true;
+	}
+}
+function cleanNames(list) {
+	return Array.isArray(list) ? list.filter((item) => typeof item === "string" && item !== "") : [];
+}
+function entitlementsOf(assembled, tenant, options, auth) {
+	const source = options.entitlements;
+	if (source === void 0 || assembled.principal === null || outsideHeld(heldTenantOf(assembled.principal), options)) return [];
+	try {
+		const found = source.entitlementsFor({ id: assembled.principal.id }, compact({ tenant }));
+		return isThenable(found) ? settle(Promise.resolve(found).then(cleanNames), [], () => {
+			auth.push({
+				reason: "source-threw",
+				source: "entitlements"
+			});
+		}) : cleanNames(found);
+	} catch {
+		auth.push({
+			reason: "source-threw",
+			source: "entitlements"
+		});
+		return [];
+	}
+}
+function resolveContext(policy, user, fallback, auth) {
+	if (policy.context === void 0) return sanitizeContext(fallback);
+	try {
+		const loaded = policy.context(user);
+		if (isThenable(loaded)) return loaded.then((value) => sanitizeContext(value), () => {
+			auth.push({
+				reason: "source-threw",
+				source: "context"
+			});
+			return {};
+		});
+		return sanitizeContext(loaded);
+	} catch {
+		auth.push({
+			reason: "source-threw",
+			source: "context"
+		});
+		return {};
+	}
+}
+function resolveSubject(policy, user, options, auth) {
+	const assembled = assemblePrincipal(policy, user, options, auth);
+	const memberships = settle(assembled.memberships, [], () => {
+		auth.push({
+			reason: "source-threw",
+			source: "memberships"
+		});
+	});
+	const stale = staleness(policy, assembled, options, auth);
+	const withPlans = (resolved) => entitlementsOf(assembled, activeTenantOf(policy, assembled, applyRoleKinds(policy, assembled.principal?.roles, normalizeMemberships(resolved, scopeList(policy.scopes))).memberships, options), options, auth);
+	if (isThenable(assembled.context) || isThenable(memberships) || isThenable(stale)) return Promise.all([
+		Promise.resolve(assembled.context),
+		Promise.resolve(memberships),
+		Promise.resolve(stale)
+	]).then(async ([context, resolved, isStale]) => finishSubject(policy, assembled, context, resolved, options, {
+		stale: isStale,
+		plans: await withPlans(resolved)
+	}));
+	const plans = withPlans(memberships);
+	if (isThenable(plans)) return Promise.resolve(plans).then((resolved) => finishSubject(policy, assembled, assembled.context, memberships, options, {
+		stale,
+		plans: resolved
+	}));
+	return finishSubject(policy, assembled, assembled.context, memberships, options, {
+		stale,
+		plans
+	});
+}
+//#endregion
+//#region src/core/permdock.ts
+function hostedPolicy(policy, source) {
+	if (source === void 0 || policy.hostable.length === 0) return {
+		policy,
+		errors: []
+	};
+	let document;
+	try {
+		document = source.current();
+	} catch (error) {
+		return {
+			policy,
+			errors: [error]
+		};
+	}
+	const merged = mergeHostedGrants(policy, document);
+	return {
+		policy: merged.policy,
+		errors: merged.dropped
+	};
+}
+function instantiate(codePolicy, subject, options, auth) {
+	const { policy, errors } = hostedPolicy(codePolicy, options.policies);
+	const scopes = scopeList(policy.scopes);
+	const tenants = tenantsOf(subject.principal, scopes);
+	const roleSource = roleSourceFor(options.customRoles, subject, auth);
+	const customRoles = customRolesFor(roleSource, tenants, auth, subject.principal === null ? void 0 : subject.principal.roles ?? [], (tenant) => heldRoleNamesIn(subject.principal, scopes, tenant));
+	const assignable = assignableNamesFor(roleSource, tenants, auth);
+	const approvals = approvalPoliciesFor(policy, options.approvalPolicies, tenants, auth);
+	const build = (roles, names, approvalPolicies) => buildInstance(policy, subject, compact({
+		customRoles: roles,
+		sink: options.sink,
+		limits: options.limits,
+		limitCache: /* @__PURE__ */ new Map(),
+		simulated: false,
+		roleSource,
+		assignable: names,
+		queuedAuth: auth,
+		queuedErrors: errors,
+		relations: options.relations,
+		approvalPolicies,
+		memberships: options.memberships === void 0 ? void 0 : asMembershipSource(options.memberships)
+	}));
+	if (isThenable(customRoles) || isThenable(assignable) || isThenable(approvals)) return Promise.all([
+		customRoles,
+		assignable,
+		approvals
+	]).then(([roles, names, loaded]) => build(roles, names, loaded));
+	return build(customRoles, assignable, approvals);
+}
+function createPermDock(policy, user, options = {}) {
+	const auth = [];
+	const subject = resolveSubject(policy, user, options, auth);
+	if (isThenable(subject)) return subject.then((resolved) => instantiate(policy, resolved, options, auth));
+	return instantiate(policy, subject, options, auth);
+}
+//#endregion
+export { countHolders as C, memoryApprovalPolicies as D, approvalPoliciesFor as E, validateApprovalPolicy as O, composeMemberships as S, APPROVAL_POLICY_UNAVAILABLE as T, leveled as _, collectSnapshotGrants as a, validateCustomRole as b, rankRoles as c, breakGlass as d, supportAccess as f, customRoleScope as g, customRoleClaim as h, scopesReaching as i, usesAssigns as l, ceilingGrants as m, resolveSubject as n, snapshotOf as o, andWhere as p, challengeScope as r, snapshotScopes as s, createPermDock as t, declaredRoleNames as u, membershipsClaim as v, isExternallyManaged as w, claimsFirst as x, resolveCustomRole as y };