permdock 0.0.0 → 0.2.0

package/dist/refs-KYb4ntaz.js

@@ -0,0 +1,91 @@
+import { n as freezeDeep } from "./freeze-CrU8nQeX.js";
+import { O as readPath, k as splitPath, w as assertSafeKey } from "./permissions-DVoF6dMt.js";
+//#region src/conditions/ast.ts
+function parentHop(parent) {
+	return typeof parent === "string" ? { field: parent } : parent;
+}
+function isConditionRef(value) {
+	return value !== null && typeof value === "object" && "ref" in value && typeof value.ref === "string";
+}
+function isConditionDate(value) {
+	return value !== null && typeof value === "object" && "date" in value && typeof value.date === "string" && !("ref" in value);
+}
+function isCondition(value) {
+	return value !== null && typeof value === "object" && "op" in value && typeof value.op === "string";
+}
+function isSqlFunctionField(value) {
+	return value !== null && typeof value === "object" && "field" in value && typeof value.field === "string" && !("ref" in value) && !("date" in value) && !("op" in value);
+}
+function hasConditionOp(condition, op) {
+	if (condition === void 0) return false;
+	if (condition.op === op) return true;
+	switch (condition.op) {
+		case "and":
+		case "or": return condition.conditions.some((child) => hasConditionOp(child, op));
+		case "not": return hasConditionOp(condition.condition, op);
+		case "sqlFunction": return hasConditionOp(condition.twin, op);
+		case "eq":
+		case "ne":
+		case "gt":
+		case "gte":
+		case "lt":
+		case "lte":
+		case "contains":
+		case "in":
+		case "notIn":
+		case "isNull":
+		case "memberOf":
+		case "related":
+		case "opaque":
+		case "liveSession": return false;
+		default:
+ /* v8 ignore next */
+		return condition;
+	}
+}
+//#endregion
+//#region src/conditions/refs.ts
+const REF_BRAND = Symbol.for("permdock.ref");
+function createRef(path) {
+	const segments = splitPath(path);
+	for (const segment of segments) assertSafeKey(segment, "subject path");
+	const target = freezeDeep({ ref: path });
+	return new Proxy(target, {
+		get(object, property, receiver) {
+			if (property === "ref" || property === REF_BRAND) return Reflect.get(object, property === REF_BRAND ? "ref" : property, receiver);
+			if (property === "toJSON" || property === "valueOf" || property === Symbol.toStringTag) return;
+			if (typeof property !== "string") return;
+			assertSafeKey(property, "subject path");
+			return createRef(`${path}.${property}`);
+		},
+		getOwnPropertyDescriptor(object, property) {
+			if (property === "ref") return Reflect.getOwnPropertyDescriptor(object, property);
+		},
+		ownKeys() {
+			return ["ref"];
+		}
+	});
+}
+const principal = createRef("principal");
+const context = createRef("context");
+function isSubjectRef(value) {
+	if (value === null || typeof value !== "object" || !("ref" in value) || typeof value.ref !== "string") return false;
+	const ref = value.ref;
+	return ref === "principal" || ref.startsWith("principal.") || ref === "context" || ref.startsWith("context.");
+}
+function resolveConditionRef(ref, resolved) {
+	if (resolved === void 0) return;
+	if (ref === "principal" || ref.startsWith("principal.")) {
+		const path = ref === "principal" ? "" : ref.slice(10);
+		if (path === "") return resolved.principal;
+		if (resolved.principal === null) return;
+		return readPath(resolved.principal, path);
+	}
+	if (ref === "context" || ref.startsWith("context.")) {
+		const path = ref === "context" ? "" : ref.slice(8);
+		if (path === "") return resolved.context;
+		return readPath(resolved.context, path);
+	}
+}
+//#endregion
+export { hasConditionOp as a, isConditionRef as c, resolveConditionRef as i, isSqlFunctionField as l, isSubjectRef as n, isCondition as o, principal as r, isConditionDate as s, context as t, parentHop as u };

package/dist/relations-cjOL01hZ.js

@@ -0,0 +1,505 @@
+import { C as restrictedStops, E as ownGet, d as isEdgeRelation, l as groupEntries, m as isPrincipalRelation, r as expandRelation, s as getRegistry, u as isComputedRelation } from "./permissions-DVoF6dMt.js";
+import { t as idText } from "./ids-DC4V4CFu.js";
+import { n as isThenable } from "./thenable-okc2xDsj.js";
+function isRecord(value) {
+	return value !== null && typeof value === "object" && !Array.isArray(value);
+}
+function isInstant(value) {
+	return value === void 0 || typeof value === "number" && Number.isFinite(value);
+}
+function asChain(value) {
+	if (!isRecord(value) || !Array.isArray(value["ancestors"])) return;
+	const ancestors = [];
+	for (const item of value["ancestors"]) {
+		if (!isRecord(item) || typeof item["id"] !== "string" || item["id"] === "") return;
+		ancestors.push(item["restricted"] === true ? {
+			id: item["id"],
+			restricted: true
+		} : { id: item["id"] });
+	}
+	return {
+		ancestors,
+		...value["restricted"] === true ? { restricted: true } : {},
+		...value["truncated"] === true ? { truncated: true } : {}
+	};
+}
+function asRow(value) {
+	if (value === null || value === void 0) return { row: null };
+	return isRecord(value) ? { row: value } : void 0;
+}
+function asGroup(value) {
+	if (!isRecord(value) || typeof value["resource"] !== "string" || typeof value["id"] !== "string" || typeof value["relation"] !== "string" || value["id"] === "") return;
+	return {
+		resource: value["resource"],
+		id: value["id"],
+		relation: value["relation"]
+	};
+}
+function asHolders(value) {
+	if (!Array.isArray(value)) return;
+	const holders = [];
+	for (const item of value) {
+		if (!isRecord(item) || !isInstant(item["startsAt"]) || !isInstant(item["expiresAt"])) return;
+		const period = {
+			...item["startsAt"] === void 0 ? {} : { startsAt: item["startsAt"] },
+			...item["expiresAt"] === void 0 ? {} : { expiresAt: item["expiresAt"] }
+		};
+		if (isRecord(item["principal"]) && typeof item["principal"]["id"] === "string") {
+			holders.push({
+				principal: { id: item["principal"]["id"] },
+				...period
+			});
+			continue;
+		}
+		const group = asGroup(item["group"]);
+		if (group === void 0) return;
+		holders.push({
+			group,
+			...period
+		});
+	}
+	return holders;
+}
+function read(cache, key, call, validate) {
+	const entry = cache.get(key);
+	if (entry !== void 0) return entry.state === "ready" ? entry.value : entry.state;
+	if (call === void 0) return "failed";
+	const settle = (value) => {
+		const valid = validate(value);
+		cache.set(key, valid === void 0 ? { state: "failed" } : {
+			state: "ready",
+			value: valid
+		});
+	};
+	let result;
+	try {
+		result = call();
+	} catch {
+		cache.set(key, { state: "failed" });
+		return "failed";
+	}
+	if (isThenable(result)) {
+		const promise = Promise.resolve(result).then(settle, () => {
+			cache.set(key, { state: "failed" });
+		});
+		cache.set(key, {
+			state: "pending",
+			promise
+		});
+		return "pending";
+	}
+	settle(result);
+	const settled = cache.get(key);
+	return settled?.state === "ready" ? settled.value : "failed";
+}
+function relationReader(source, cache, resources) {
+	const concrete = (resource, id, relation) => read(cache, JSON.stringify([
+		"holders",
+		resource,
+		id,
+		relation
+	]), source === void 0 ? void 0 : () => source.related({
+		resource,
+		id,
+		relation
+	}), asHolders);
+	return {
+		available: source !== void 0,
+		row(query) {
+			const load = source?.row?.bind(source);
+			return read(cache, JSON.stringify([
+				"row",
+				query.resource,
+				query.id
+			]), load === void 0 ? void 0 : () => load({
+				resource: query.resource,
+				id: query.id
+			}), asRow);
+		},
+		chain(query) {
+			const through = query.through ?? "parent";
+			return read(cache, JSON.stringify([
+				"chain",
+				query.resource,
+				query.id,
+				query.depth,
+				through
+			]), source === void 0 ? void 0 : () => source.ancestors({
+				resource: query.resource,
+				id: query.id,
+				depth: query.depth,
+				through
+			}), asChain);
+		},
+		holders(query) {
+			const node = resources?.get(query.resource);
+			const names = node === void 0 ? [query.relation] : expandRelation(node, query.relation);
+			const out = [];
+			let unread;
+			for (const name of names) {
+				const answer = concrete(query.resource, query.id, name);
+				if (answer === "pending" || answer === "failed") {
+					unread = answer === "failed" || unread === "failed" ? "failed" : "pending";
+					continue;
+				}
+				for (const holder of answer) out.push({
+					...holder,
+					relation: name
+				});
+			}
+			return unread ?? out;
+		}
+	};
+}
+/** The loads still in flight, for an instance that awaits them before deciding. */
+function pendingRelations(cache) {
+	const out = [];
+	for (const entry of cache.values()) if (entry.state === "pending") out.push(entry.promise);
+	return out;
+}
+function relationId(value) {
+	return idText(value);
+}
+/** Whether the holder's period covers `now`. */
+function activeNow(holder, now) {
+	return (holder.startsAt === void 0 || holder.startsAt <= now) && (holder.expiresAt === void 0 || holder.expiresAt > now);
+}
+function holdsNow(holder, principalId, now) {
+	return "principal" in holder && holder.principal.id === principalId && activeNow(holder, now);
+}
+/** Where the walk starts after following `hops`, or why it cannot. */
+function followHops(condition, first, reader) {
+	const hops = condition.hops ?? [];
+	let id = first;
+	for (let index = 1; index < hops.length; index += 1) {
+		const from = hops[index - 1];
+		const hop = hops[index];
+		if (from === void 0 || hop === void 0)
+ /* v8 ignore next */
+		return;
+		const chain = reader.chain({
+			resource: from.resource,
+			id,
+			depth: 1,
+			through: hop.link
+		});
+		if (chain === "pending" || chain === "failed") return "relation-unavailable";
+		const next = chain.ancestors[0]?.id;
+		if (next === void 0) return;
+		id = next;
+	}
+	return { id };
+}
+function restrictedAbove(condition, row, reader) {
+	const above = condition.restrictedAncestors;
+	if (above === void 0) return false;
+	const parent = relationId(ownGet(row, above.parent));
+	if (parent === void 0) return false;
+	const chain = reader.chain({
+		resource: above.resource,
+		id: parent,
+		depth: above.depth - 1
+	});
+	if (chain === "pending" || chain === "failed") return "relation-unavailable";
+	if (chain.restricted === true || chain.ancestors.some((ancestor) => ancestor.restricted === true)) return;
+	const own = relationId(ownGet(row, above.id));
+	const ids = [
+		...own === void 0 ? [] : [own],
+		parent,
+		...chain.ancestors.map((ancestor) => ancestor.id)
+	];
+	if (new Set(ids).size !== ids.length || chain.truncated === true || chain.ancestors.length > above.depth - 1) return "relation-depth";
+	return false;
+}
+/** The instances a graph relation reads: the start, then ancestors until a restricted one or `depth`. */
+function relationWalk(condition, row, reader) {
+	if (!isRecord(row)) return;
+	const first = relationId(ownGet(row, condition.field));
+	if (first === void 0) return;
+	const rowRestricted = condition.restricted !== void 0 && ownGet(row, condition.restricted) === true;
+	const hopped = condition.hops !== void 0 && condition.hops.length > 0;
+	if ((condition.parent === true || hopped) && rowRestricted) return;
+	const above = restrictedAbove(condition, row, reader);
+	if (above !== false) return above;
+	const start = hopped ? followHops(condition, first, reader) : { id: first };
+	if (start === void 0 || start === "relation-unavailable") return start;
+	const id = start.id;
+	if (condition.depth === 0 || rowRestricted) return {
+		ids: [id],
+		truncated: false
+	};
+	const chain = reader.chain({
+		resource: condition.resource,
+		id,
+		depth: condition.depth
+	});
+	if (chain === "pending" || chain === "failed") return "relation-unavailable";
+	const ids = [id];
+	const stops = condition.passRestricted !== true;
+	let stopped = stops && chain.restricted === true;
+	if (!stopped) for (const ancestor of chain.ancestors.slice(0, condition.depth)) {
+		ids.push(ancestor.id);
+		if (stops && ancestor.restricted === true) {
+			stopped = true;
+			break;
+		}
+	}
+	if (new Set(ids).size !== ids.length) return "relation-depth";
+	return {
+		ids,
+		truncated: !stopped && (chain.ancestors.length > condition.depth || chain.truncated === true)
+	};
+}
+/**
+* Whether the subject holds the relation on the row's instance or an
+* ancestor within `depth`. A cycle is `relation-depth`; so is a chain that
+* goes on past `depth` with no holder below it. Any read the instance could
+* not answer is `relation-unavailable` unless a holder was found elsewhere.
+*/
+function resolveRelated(condition, row, subject, now, reader, permitted) {
+	if (condition.permission !== void 0) return resolveInherited(condition, condition.permission, row, reader, permitted);
+	const principal = subject.principal;
+	if (principal === null) return false;
+	const walk = relationWalk(condition, row, reader);
+	if (walk === void 0) return false;
+	if (walk === "relation-depth" || walk === "relation-unavailable") return walk;
+	if (condition.ids !== void 0) {
+		const held = new Set(condition.ids);
+		if (walk.ids.some((id) => held.has(id))) return true;
+		return walk.truncated ? "relation-depth" : false;
+	}
+	let unavailable = false;
+	let deep = false;
+	const explored = /* @__PURE__ */ new Map();
+	for (const id of walk.ids) {
+		const verdict = holdsRelation({
+			resource: condition.resource,
+			id,
+			relation: condition.relation
+		}, principal.id, now, reader, 16, /* @__PURE__ */ new Set(), explored);
+		if (verdict === true) return true;
+		if (verdict === "relation-unavailable") unavailable = true;
+		else if (verdict === "relation-depth") deep = true;
+	}
+	if (unavailable) return "relation-unavailable";
+	return walk.truncated || deep ? "relation-depth" : false;
+}
+function resolveInherited(condition, permission, row, reader, permitted) {
+	const walk = relationWalk(condition, row, reader);
+	if (walk === void 0) return false;
+	if (walk === "relation-depth" || walk === "relation-unavailable") return walk;
+	if (permitted === void 0) return "relation-unavailable";
+	let unknown = false;
+	for (const id of walk.ids) {
+		const verdict = permitted(condition.resource, id, permission);
+		if (verdict === true) return true;
+		if (verdict !== false && unknown === false) unknown = verdict;
+	}
+	return unknown;
+}
+function groupKey(group) {
+	return JSON.stringify([
+		group.resource,
+		group.id,
+		group.relation
+	]);
+}
+/**
+* Whether the principal holds `at.relation` on one instance, directly or
+* through a group whose members hold it. Groups of `at`'s own resource nest
+* at most `budget` deep; a group of another resource gets a fresh budget
+* (declarations rule out cycles across resources). A group met twice on one
+* path, or one past the budget, is `relation-depth`. `explored` holds the
+* budget each group was walked with across the whole walk: a group already
+* walked with as much budget adds nothing, since its verdict already reached
+* the caller, so shared sub-groups cost one walk rather than one per path.
+*/
+function holdsRelation(at, principalId, now, reader, budget, seen, explored) {
+	const key = groupKey(at);
+	const walked = explored.get(key);
+	if (walked !== void 0 && walked >= budget) return false;
+	explored.set(key, budget);
+	const holders = reader.holders(at);
+	if (holders === "pending" || holders === "failed") return "relation-unavailable";
+	if (holders.some((holder) => holdsNow(holder, principalId, now))) return true;
+	const path = new Set(seen).add(key);
+	let unavailable = false;
+	let deep = false;
+	for (const holder of holders) {
+		if (!("group" in holder) || !activeNow(holder, now)) continue;
+		const nested = holder.group.resource === at.resource;
+		if (nested && budget <= 0 || path.has(groupKey(holder.group))) {
+			deep = true;
+			continue;
+		}
+		const verdict = holdsRelation(holder.group, principalId, now, reader, nested ? budget - 1 : 16, path, explored);
+		if (verdict === true) return true;
+		if (verdict === "relation-unavailable") unavailable = true;
+		else if (verdict === "relation-depth") deep = true;
+	}
+	if (unavailable) return "relation-unavailable";
+	return deep ? "relation-depth" : false;
+}
+/** The holders one edge-table row names for `spec`: none when the row does not belong to it. */
+function tableHolders(resourceName, spec, row, id) {
+	if (relationId(ownGet(row, spec.object ?? `${resourceName}_id`)) !== id) return [];
+	for (const [column, value] of Object.entries(spec.match ?? {})) if (ownGet(row, column) !== value) return [];
+	const expiresAt = spec.expiresAt === void 0 ? void 0 : seconds(ownGet(row, spec.expiresAt));
+	const period = expiresAt === void 0 ? {} : { expiresAt };
+	const groups = spec.groups;
+	const direct = relationId(ownGet(row, spec.subject ?? "user_id"));
+	if (groups === void 0) return direct === void 0 ? [] : [{
+		principal: { id: direct },
+		...period
+	}];
+	if (groups.column === void 0) {
+		const out = direct === void 0 ? [] : [{
+			principal: { id: direct },
+			...period
+		}];
+		for (const group of groupEntries(spec)) {
+			const groupId = relationId(ownGet(row, group.subject));
+			if (groupId !== void 0) out.push({
+				group: {
+					resource: group.resource,
+					id: groupId,
+					relation: group.relation
+				},
+				...period
+			});
+		}
+		return out;
+	}
+	const kind = ownGet(row, groups.column);
+	if (kind === null || kind === void 0 || kind === groups.direct) return direct === void 0 ? [] : [{
+		principal: { id: direct },
+		...period
+	}];
+	const group = groupEntries(spec).find((entry) => entry.resource === kind);
+	const groupId = group === void 0 ? void 0 : relationId(ownGet(row, group.subject));
+	return group === void 0 || groupId === void 0 ? [] : [{
+		group: {
+			resource: group.resource,
+			id: groupId,
+			relation: group.relation
+		},
+		...period
+	}];
+}
+function seconds(value) {
+	if (value instanceof Date) {
+		const time = value.getTime();
+		return Number.isNaN(time) ? void 0 : time / 1e3;
+	}
+	if (typeof value === "number" && Number.isFinite(value)) return value;
+	if (typeof value === "string") {
+		const parsed = Date.parse(value);
+		return Number.isNaN(parsed) ? void 0 : parsed / 1e3;
+	}
+}
+function restrictedOf(node, row) {
+	return node.restricted !== void 0 && row !== void 0 && ownGet(row, node.restricted) === true;
+}
+function edgeHolder(edge) {
+	const holder = { principal: { id: edge.principal } };
+	if (edge.startsAt !== void 0) holder.startsAt = edge.startsAt;
+	if (edge.expiresAt !== void 0) holder.expiresAt = edge.expiresAt;
+	return holder;
+}
+/**
+* An in-process `RelationSource` over plain rows and edges, read against the
+* resource definitions in `permissions`. For tests, fixtures and small apps.
+*/
+function memoryRelations(permissions, data = {}) {
+	const registry = getRegistry(permissions);
+	const byId = /* @__PURE__ */ new Map();
+	for (const [name, rows] of Object.entries(data.rows ?? {})) {
+		const node = registry.get(name);
+		const index = /* @__PURE__ */ new Map();
+		for (const row of rows) {
+			const id = relationId(ownGet(row, node?.id ?? "id"));
+			if (id !== void 0) index.set(id, row);
+		}
+		byId.set(name, index);
+	}
+	const rowOf = (resource, id) => byId.get(resource)?.get(id);
+	return {
+		row({ resource, id }) {
+			return rowOf(resource, id) ?? null;
+		},
+		ancestors({ resource, id, depth, through }) {
+			const node = registry.get(resource);
+			const start = rowOf(resource, id);
+			if (node === void 0 || start === void 0) return { ancestors: [] };
+			if (through !== "parent") {
+				const link = Object.hasOwn(node.links, through) ? node.links[through] : void 0;
+				const next = link === void 0 ? void 0 : relationId(ownGet(start, link.field));
+				if (next === void 0 || depth < 1) return { ancestors: [] };
+				return { ancestors: [{ id: next }] };
+			}
+			const restricted = restrictedOf(node, start);
+			const stops = restrictedStops(node, "parent");
+			if (restricted && stops || node.parent === void 0 || node.parent.resource !== resource) return restricted ? {
+				restricted: true,
+				ancestors: []
+			} : { ancestors: [] };
+			const field = node.parent.field;
+			const seen = /* @__PURE__ */ new Set([id]);
+			const ancestors = [];
+			let next = relationId(ownGet(start, field));
+			while (next !== void 0 && ancestors.length < depth) {
+				const row = rowOf(resource, next);
+				if (row === void 0) {
+					next = void 0;
+					break;
+				}
+				const hidden = restrictedOf(node, row);
+				ancestors.push(hidden ? {
+					id: next,
+					restricted: true
+				} : { id: next });
+				if (seen.has(next) || hidden && stops) {
+					next = void 0;
+					break;
+				}
+				seen.add(next);
+				next = relationId(ownGet(row, field));
+			}
+			const chain = restricted ? {
+				restricted: true,
+				ancestors
+			} : { ancestors };
+			return next === void 0 || rowOf(resource, next) === void 0 ? chain : {
+				...chain,
+				truncated: true
+			};
+		},
+		related({ resource, id, relation }) {
+			const spec = registry.get(resource)?.relations[relation];
+			if (spec === void 0 || isComputedRelation(spec)) return [];
+			if (isEdgeRelation(spec)) {
+				const table = data.tables?.[spec.edge];
+				if (table !== void 0) return table.flatMap((row) => tableHolders(resource, spec, row, id));
+				return (data.edges?.[resource]?.[relation] ?? []).filter((edge) => edge.id === id).map(edgeHolder);
+			}
+			const row = rowOf(resource, id);
+			if (row === void 0) return [];
+			if (isPrincipalRelation(spec)) {
+				const holder = relationId(ownGet(row, spec.principal));
+				if (holder === void 0) return [];
+				const startsAt = spec.period?.startsAt === void 0 ? void 0 : seconds(ownGet(row, spec.period.startsAt));
+				const expiresAt = spec.period?.expiresAt === void 0 ? void 0 : seconds(ownGet(row, spec.period.expiresAt));
+				return [{
+					principal: { id: holder },
+					...startsAt === void 0 ? {} : { startsAt },
+					...expiresAt === void 0 ? {} : { expiresAt }
+				}];
+			}
+			if (spec.memberOf !== void 0) return [];
+			const holder = relationId(ownGet(row, spec.field));
+			return holder === void 0 ? [] : [{ principal: { id: holder } }];
+		}
+	};
+}
+//#endregion
+export { relationWalk as a, relationReader as i, pendingRelations as n, resolveRelated as o, relationId as r, memoryRelations as t };

package/dist/replay-BsOyTrdV.js

@@ -0,0 +1,28 @@
+//#region src/ssf/replay.ts
+function memoryReplayStore() {
+	const seen = /* @__PURE__ */ new Map();
+	function evict(now = Date.now() / 1e3) {
+		for (const [jti, expiresAt] of seen) if (expiresAt !== void 0 && expiresAt <= now) seen.delete(jti);
+	}
+	return {
+		seen(jti) {
+			evict();
+			return seen.has(jti);
+		},
+		remember(jti, expiresAt) {
+			evict();
+			seen.set(jti, expiresAt);
+		},
+		claim(key, expiresAt) {
+			evict();
+			if (seen.has(key)) return false;
+			seen.set(key, expiresAt);
+			return true;
+		},
+		release(key) {
+			seen.delete(key);
+		}
+	};
+}
+//#endregion
+export { memoryReplayStore as t };

package/dist/replay-sqBGMnNs.d.ts

@@ -0,0 +1,5 @@
+import { g as ReplayStore } from "./types-9AWO9EGt.js";
+//#region src/ssf/replay.d.ts
+declare function memoryReplayStore(): ReplayStore;
+//#endregion
+export { memoryReplayStore as t };

package/dist/resource-ref-CaS9yVPi.js

@@ -0,0 +1,20 @@
+//#region src/core/resource-ref.ts
+/** The row's `id` as a string, when it is a string or a number. */
+function resourceIdOf(data) {
+	if (data === null || typeof data !== "object" || !("id" in data)) return;
+	const id = data.id;
+	return typeof id === "string" || typeof id === "number" ? String(id) : void 0;
+}
+/**
+* The `resource` of a decision event: the permission's resource type and the
+* row's `id`, or `wireId` (the id the request named) when the row has none.
+*/
+function resourceRef(permission, data, wireId) {
+	const id = resourceIdOf(data) ?? (typeof wireId === "string" || typeof wireId === "number" ? String(wireId) : void 0);
+	return id === void 0 ? { type: permission.resource } : {
+		type: permission.resource,
+		id
+	};
+}
+//#endregion
+export { resourceRef as n, resourceIdOf as t };

package/dist/revocations-Bhr0aMIC.js

@@ -0,0 +1,27 @@
+//#region src/core/revocations.ts
+function isRevocationEvent(value) {
+	if (value === null || typeof value !== "object") return false;
+	const event = value;
+	return typeof event["principal"] === "string" && event["principal"].length > 0 && (event["kind"] === "session-revoked" || event["kind"] === "changed") && (event["session"] === void 0 || typeof event["session"] === "string") && (event["tenant"] === void 0 || typeof event["tenant"] === "string");
+}
+/** In-process feed; a multi-replica app bridges `revoke` to its own pub/sub. */
+function memoryRevocationFeed() {
+	const listeners = /* @__PURE__ */ new Set();
+	return Object.freeze({
+		subscribe(listener) {
+			listeners.add(listener);
+			return () => {
+				listeners.delete(listener);
+			};
+		},
+		revoke(event) {
+			if (!isRevocationEvent(event)) throw new TypeError("PermDock: invalid revocation event.");
+			const frozen = Object.freeze({ ...event });
+			for (const listener of listeners) try {
+				listener(frozen);
+			} catch {}
+		}
+	});
+}
+//#endregion
+export { memoryRevocationFeed as t };