permdock 0.0.0 → 0.2.0

package/dist/snapshot-Enxd0n-s.js

@@ -0,0 +1,975 @@
+import { n as isReadonlyArray, r as sole, t as compact } from "./compact-y6vfu2_f.js";
+import { n as freezeDeep } from "./freeze-CrU8nQeX.js";
+import { E as ownGet, T as isForbiddenKey, i as findPermission } from "./permissions-DVoF6dMt.js";
+import { c as isConditionRef, i as resolveConditionRef, s as isConditionDate, u as parentHop } from "./refs-KYb4ntaz.js";
+import { t as expiredAt } from "./expiry-BoBJ8Tvc.js";
+import { n as sameId } from "./ids-DC4V4CFu.js";
+import { d as scopeList, l as scopeChain, m as tenantOf, o as resolveScope, p as subjectMemberships, r as findScope, t as activeFor, u as scopeIdOf } from "./scopes-CVdPrWN-.js";
+import { E as listRoles, T as listPlans, _ as resourceRoleCondition } from "./grantee-Cv5Sogfv.js";
+import { a as isMembershipExpired, c as membershipField, g as tenantsOf, i as inTeam, t as isActive } from "./validity-uOp8UpYn.js";
+//#region src/conditions/evaluate.ts
+function resolveRef(ref, subject) {
+	return resolveConditionRef(ref, subject);
+}
+function unwrap(value, subject) {
+	if (isConditionRef(value)) return resolveRef(value.ref, subject);
+	if (isConditionDate(value)) return new Date(isoInstant(value.date) ?? NaN);
+	if (isReadonlyArray(value)) return value.map((item) => unwrap(item, subject));
+	return value;
+}
+const ISO_INSTANT = /^(\d{4}-\d{2}-\d{2})(?:[T ](\d{2}:\d{2}(?::\d{2}(?:\.\d{1,9})?)?)(Z|[+-]\d{2}(?::?\d{2})?)?)?$/u;
+function isoInstant(value) {
+	const match = ISO_INSTANT.exec(value);
+	if (match === null) return;
+	const [, day, time, zone] = match;
+	let offset = zone ?? (time === void 0 ? "" : "Z");
+	if (/^[+-]\d{2}$/u.test(offset)) offset = `${offset}:00`;
+	else if (/^[+-]\d{4}$/u.test(offset)) offset = `${offset.slice(0, 3)}:${offset.slice(3)}`;
+	const parsed = Date.parse(time === void 0 ? `${day}` : `${day}T${time}${offset}`);
+	return Number.isNaN(parsed) ? void 0 : parsed;
+}
+function instantOf(value) {
+	if (value instanceof Date) {
+		const time = value.getTime();
+		return Number.isNaN(time) ? void 0 : time;
+	}
+	if (typeof value === "number") return Number.isFinite(value) ? value : void 0;
+	if (typeof value === "string") return isoInstant(value);
+}
+function comparablePair(left, right) {
+	if (left instanceof Date || right instanceof Date) {
+		const a = instantOf(left);
+		const b = instantOf(right);
+		return a === void 0 || b === void 0 ? void 0 : [a, b];
+	}
+	const kind = typeof left;
+	if (kind === typeof right && (kind === "string" || kind === "number" || kind === "boolean")) return [left, right];
+}
+function compare(op, left, right) {
+	if (left === void 0 || left === null || right === void 0 || right === null) return false;
+	const comparable = comparablePair(left, right);
+	if (comparable === void 0) return false;
+	const [a, b] = comparable;
+	switch (op) {
+		case "eq": return a === b;
+		case "ne": return a !== b;
+		case "gt": return a > b;
+		case "gte": return a >= b;
+		case "lt": return a < b;
+		case "lte": return a <= b;
+		default:
+ /* v8 ignore next */
+		return false;
+	}
+}
+function contains(left, right) {
+	if (left === void 0 || left === null || right === void 0 || right === null) return false;
+	if (typeof left === "string" && typeof right === "string") return left.includes(right);
+	if (Array.isArray(left)) return left.includes(right);
+	return false;
+}
+function inList(left, right) {
+	if (left === void 0 || left === null || !Array.isArray(right)) return false;
+	return right.includes(left);
+}
+function matchesParentHop(data, parents, on) {
+	for (const parent of parents ?? []) {
+		const hop = parentHop(parent);
+		if (hop.resource !== void 0 && hop.resource !== on.resource) continue;
+		if (sameId(ownGet(data, hop.field), on.id)) return true;
+	}
+	return false;
+}
+function evaluateMemberOf(condition, data, subject, now, scopes) {
+	if (data === null || typeof data !== "object") return false;
+	const rowValue = ownGet(data, condition.field);
+	if (rowValue === void 0 || rowValue === null) return false;
+	const memberships = subjectMemberships(subject.principal?.memberships, scopes);
+	const wanted = new Set(condition.roles);
+	const active = subject.principal?.tenant === "" ? void 0 : subject.principal?.tenant;
+	const scope = condition.scope === "resource" ? void 0 : resolveScope(scopes, condition.scope);
+	if (condition.scope !== "resource" && scope === void 0) return false;
+	for (const membership of memberships) {
+		if (expiredAt(membership, now)) continue;
+		if (wanted.size > 0 && !membership.roles.some((role) => wanted.has(role))) continue;
+		if (scope !== void 0) {
+			if (membership.scope !== scope || !sameId(membership.id, rowValue)) continue;
+			const tenant = tenantOf(membership, scopes);
+			if (active !== void 0 && tenant !== void 0 && tenant !== active) continue;
+			return true;
+		}
+		if (membership.on === void 0) continue;
+		if (condition.resource !== void 0 && membership.on.resource !== condition.resource) {
+			if (matchesParentHop(data, condition.parents, membership.on)) return true;
+			continue;
+		}
+		if (sameId(membership.on.id, rowValue)) return true;
+		if (matchesParentHop(data, condition.parents, membership.on)) return true;
+	}
+	return false;
+}
+function evaluateCondition(condition, data, subject, now = Date.now() / 1e3, scopes = scopeList(void 0), related, onOpaque) {
+	switch (condition.op) {
+		case "and": return condition.conditions.every((child) => evaluateCondition(child, data, subject, now, scopes, related, onOpaque));
+		case "or": return condition.conditions.some((child) => evaluateCondition(child, data, subject, now, scopes, related, onOpaque));
+		case "not": return !evaluateCondition(condition.condition, data, subject, now, scopes, related, onOpaque);
+		case "isNull": {
+			if (data === null || typeof data !== "object") return false;
+			const value = ownGet(data, condition.field);
+			const isNull = value === null || value === void 0;
+			return condition.value ? isNull : !isNull;
+		}
+		case "in":
+		case "notIn": {
+			if (data === null || typeof data !== "object") return false;
+			const left = ownGet(data, condition.field);
+			const matched = inList(left, unwrap(condition.value, subject));
+			return condition.op === "in" ? matched : !matched && left !== void 0 && left !== null;
+		}
+		case "contains":
+			if (data === null || typeof data !== "object") return false;
+			return contains(ownGet(data, condition.field), unwrap(condition.value, subject));
+		case "eq":
+		case "ne":
+		case "gt":
+		case "gte":
+		case "lt":
+		case "lte":
+			if (condition.field === "_" && condition.op === "eq") return condition.value === true;
+			if (data === null || typeof data !== "object") return false;
+			return compare(condition.op, ownGet(data, condition.field), unwrap(condition.value, subject));
+		case "memberOf": return evaluateMemberOf(condition, data, subject, now, scopes);
+		case "related": return related?.(condition, data) === true;
+		case "sqlFunction": return evaluateCondition(condition.twin, data, subject, now, scopes, related, onOpaque);
+		case "opaque":
+			onOpaque?.();
+			return false;
+		case "liveSession": return subject.liveSession === true;
+		default:
+ /* v8 ignore next */
+		return condition;
+	}
+}
+//#endregion
+//#region src/core/arazzo.ts
+const VERSION = /^1\.[01]\.\d+(?:-.+)?$/u;
+const STEP_TARGETS = [
+	"operationId",
+	"operationPath",
+	"workflowId",
+	"channelPath"
+];
+const denied = (reason) => freezeDeep({
+	outcome: "denied",
+	denials: [{
+		role: null,
+		reason
+	}],
+	alternatives: []
+});
+function isRecord(value) {
+	return value !== null && typeof value === "object" && !Array.isArray(value);
+}
+function asString(value) {
+	return typeof value === "string" && value.length > 0 ? value : void 0;
+}
+function parseParameters(raw, components, where) {
+	if (raw === void 0) return [];
+	if (!Array.isArray(raw)) return `${where}: parameters must be an array`;
+	const out = [];
+	for (const item of raw) {
+		if (!isRecord(item)) return `${where}: a parameter is not an object`;
+		const reference = asString(item["reference"]);
+		if (reference !== void 0) {
+			const match = /^\$components\.parameters\.(.+)$/u.exec(reference);
+			const target = match?.[1] === void 0 ? void 0 : components[match[1]];
+			const name = isRecord(target) ? asString(target["name"]) : void 0;
+			if (!isRecord(target) || name === void 0 || !("value" in target)) return `${where}: unresolved parameter reference ${reference}`;
+			out.push({
+				name,
+				value: "value" in item ? item["value"] : target["value"]
+			});
+			continue;
+		}
+		const name = asString(item["name"]);
+		if (name === void 0 || !("value" in item)) return `${where}: a parameter needs a name and a value`;
+		out.push({
+			name,
+			value: item["value"]
+		});
+	}
+	return out;
+}
+function parseDocument(arazzo) {
+	if (!isRecord(arazzo)) return "Arazzo document is not an object";
+	const version = arazzo["arazzo"];
+	if (typeof version !== "string" || !VERSION.test(version)) return "arazzo must be a 1.0.x or 1.1.x version";
+	if (!isRecord(arazzo["info"])) return "info is required";
+	const rawSources = arazzo["sourceDescriptions"];
+	if (!Array.isArray(rawSources) || rawSources.length === 0) return "sourceDescriptions needs at least one entry";
+	const sources = [];
+	for (const source of rawSources) {
+		const name = isRecord(source) ? asString(source["name"]) : void 0;
+		if (!isRecord(source) || name === void 0 || asString(source["url"]) === void 0) return "a sourceDescription needs a name and a url";
+		if (sources.some((item) => item.name === name)) return `duplicate sourceDescription ${name}`;
+		sources.push({
+			name,
+			type: asString(source["type"]) ?? "openapi"
+		});
+	}
+	const components = isRecord(arazzo["components"]) && isRecord(arazzo["components"]["parameters"]) ? arazzo["components"]["parameters"] : {};
+	const rawWorkflows = arazzo["workflows"];
+	if (!Array.isArray(rawWorkflows) || rawWorkflows.length === 0) return "workflows needs at least one entry";
+	const workflows = [];
+	for (const item of rawWorkflows) {
+		const workflowId = isRecord(item) ? asString(item["workflowId"]) : void 0;
+		if (!isRecord(item) || workflowId === void 0) return "a workflow needs a workflowId";
+		if (workflows.some((workflow) => workflow.workflowId === workflowId)) return `duplicate workflowId ${workflowId}`;
+		const parameters = parseParameters(item["parameters"], components, workflowId);
+		if (typeof parameters === "string") return parameters;
+		const rawSteps = item["steps"];
+		if (!Array.isArray(rawSteps) || rawSteps.length === 0) return `${workflowId}: steps needs at least one entry`;
+		const steps = [];
+		for (const step of rawSteps) {
+			const stepId = isRecord(step) ? asString(step["stepId"]) : void 0;
+			if (!isRecord(step) || stepId === void 0) return `${workflowId}: a step needs a stepId`;
+			if (steps.some((other) => other.stepId === stepId)) return `${workflowId}: duplicate stepId ${stepId}`;
+			const targets = STEP_TARGETS.filter((field) => asString(step[field]) !== void 0);
+			if (targets.length !== 1 && !(targets.length === 2 && targets.includes("operationId") && targets.includes("channelPath"))) return `${workflowId}.${stepId}: a step needs exactly one of operationId, operationPath or workflowId`;
+			const stepParameters = parseParameters(step["parameters"], components, `${workflowId}.${stepId}`);
+			if (typeof stepParameters === "string") return stepParameters;
+			steps.push(compact({
+				stepId,
+				operationId: asString(step["operationId"]),
+				operationPath: asString(step["operationPath"]),
+				workflowId: asString(step["workflowId"]),
+				channelPath: asString(step["channelPath"]),
+				parameters: stepParameters
+			}));
+		}
+		workflows.push({
+			workflowId,
+			parameters,
+			steps
+		});
+	}
+	return {
+		sources,
+		workflows
+	};
+}
+function unescapePointer(token) {
+	return token.replaceAll("~1", "/").replaceAll("~0", "~");
+}
+function readPointer(doc, pointer) {
+	if (!pointer.startsWith("#/")) return;
+	let current = doc;
+	for (const raw of pointer.slice(2).split("/")) {
+		if (!isRecord(current)) return;
+		let token;
+		try {
+			token = unescapePointer(decodeURIComponent(raw));
+		} catch {
+			return;
+		}
+		if (!Object.hasOwn(current, token)) return;
+		current = current[token];
+	}
+	return current;
+}
+function findOperation(openapi, operationId) {
+	if (!isRecord(openapi) || !isRecord(openapi["paths"])) return;
+	for (const pathItem of Object.values(openapi["paths"])) {
+		if (!isRecord(pathItem)) continue;
+		for (const [method, operation] of Object.entries(pathItem)) if (!method.startsWith("x-") && isRecord(operation) && operation["operationId"] === operationId) return operation;
+	}
+}
+/** One description, or a map of descriptions keyed by source `name`. */
+function descriptionFor(openapi, name) {
+	if (isRecord(openapi) && !("openapi" in openapi) && !("paths" in openapi) && isRecord(openapi[name])) return openapi[name];
+	return openapi;
+}
+function permissionKeysOf(node) {
+	if (!isRecord(node)) return [];
+	const raw = node["x-permdock-permissions"];
+	if (!Array.isArray(raw)) return [];
+	return raw.filter((item) => typeof item === "string");
+}
+/** `$inputs.a.b` against the frame's inputs; anything else that is a runtime expression is unknown. */
+function valueOf(value, inputs) {
+	if (typeof value !== "string" || !value.includes("$")) return {
+		known: true,
+		value
+	};
+	const match = /^\$inputs\.([^#{}]+)$/u.exec(value);
+	if (match?.[1] === void 0) return value.startsWith("$") || value.includes("{$") ? { known: false } : {
+		known: true,
+		value
+	};
+	let current = inputs;
+	for (const part of match[1].split(".")) {
+		if (!isRecord(current) || !Object.hasOwn(current, part)) return { known: false };
+		current = current[part];
+	}
+	return {
+		known: true,
+		value: current
+	};
+}
+function bind(parameters, inputs) {
+	const record = {};
+	let provisional = false;
+	for (const parameter of parameters) {
+		const bound = valueOf(parameter.value, inputs);
+		if (!bound.known) {
+			provisional = true;
+			continue;
+		}
+		Object.defineProperty(record, parameter.name, {
+			value: bound.value,
+			enumerable: true,
+			writable: true,
+			configurable: true
+		});
+	}
+	return {
+		record,
+		provisional
+	};
+}
+function flatten(doc, workflowId, inputs, seen, out) {
+	if (seen.has(workflowId)) return "workflowId cycle";
+	const workflow = doc.workflows.find((item) => item.workflowId === workflowId);
+	if (workflow === void 0) return `unknown workflowId ${workflowId}`;
+	seen.add(workflowId);
+	for (const step of workflow.steps) {
+		if (step.workflowId === void 0 || step.workflowId.startsWith("$sourceDescriptions.")) {
+			out.push({
+				step,
+				workflow,
+				inputs
+			});
+			continue;
+		}
+		const nested = flatten(doc, step.workflowId, bind(step.parameters, inputs).record, seen, out);
+		if (nested !== void 0) return nested;
+	}
+	seen.delete(workflowId);
+}
+function locate(doc, openapi, step) {
+	if (step.workflowId !== void 0) return {
+		reason: "unsupported",
+		detail: "workflows in another Arazzo document are not resolved"
+	};
+	let sourceName;
+	let operationId = step.operationId;
+	let pointer;
+	if (step.operationPath !== void 0) {
+		const match = /^\{?\$sourceDescriptions\.([^.}#]+)(?:\.url)?\}?(#.*)?$/u.exec(step.operationPath);
+		if (match?.[1] === void 0) return {
+			reason: "undocumented",
+			detail: "operationPath is not a $sourceDescriptions reference"
+		};
+		sourceName = match[1];
+		pointer = match[2] ?? "";
+	} else if (operationId !== void 0) {
+		const match = /^\$sourceDescriptions\.([^.]+)\.(.+)$/u.exec(operationId);
+		if (match?.[1] !== void 0 && match[2] !== void 0) {
+			sourceName = match[1];
+			operationId = match[2];
+		}
+	}
+	const candidates = sourceName === void 0 ? doc.sources.filter((source) => source.type !== "arazzo") : doc.sources.filter((source) => source.name === sourceName);
+	if (candidates.length === 0) return {
+		reason: "undocumented",
+		detail: sourceName === void 0 ? "no API sourceDescription" : `unknown sourceDescription ${sourceName}`
+	};
+	if (step.channelPath !== void 0) return {
+		reason: "unsupported",
+		detail: "AsyncAPI steps are not evaluated"
+	};
+	const found = [];
+	for (const source of candidates) {
+		const description = descriptionFor(openapi, source.name);
+		const node = pointer === void 0 ? operationId === void 0 ? void 0 : findOperation(description, operationId) : readPointer(description, pointer);
+		if (node !== void 0 || candidates.length === 1) found.push({
+			source,
+			node
+		});
+	}
+	if (found.length > 1) return {
+		reason: "undocumented",
+		detail: "operationId matches several sources; qualify it with $sourceDescriptions"
+	};
+	const [hit] = found;
+	if (hit?.source.type === "asyncapi") return {
+		reason: "unsupported",
+		detail: "AsyncAPI steps are not evaluated"
+	};
+	if (hit === void 0 || hit.source.type === "arazzo" || !isRecord(hit.node)) return {
+		reason: "undocumented",
+		detail: "operation not found"
+	};
+	return compact({
+		node: hit.node,
+		operationId: asString(hit.node["operationId"]) ?? operationId
+	});
+}
+function resolve(doc, openapi, tree, flat) {
+	const { step, workflow, inputs } = flat;
+	const base = {
+		stepId: step.stepId,
+		workflowId: workflow.workflowId
+	};
+	const located = locate(doc, openapi, step);
+	const { record, provisional } = bind([...workflow.parameters.filter((parameter) => !step.parameters.some((own) => own.name === parameter.name)), ...step.parameters], inputs);
+	const data = Object.keys(inputs).length + Object.keys(record).length === 0 ? void 0 : {
+		...inputs,
+		...record
+	};
+	if ("reason" in located) return {
+		...base,
+		...compact({ operationId: step.operationId }),
+		keys: [],
+		finding: located,
+		data,
+		provisional
+	};
+	const keys = permissionKeysOf(located.node);
+	const unknown = tree === void 0 ? void 0 : keys.find((key) => findPermission(tree, key) === void 0);
+	return {
+		...base,
+		...compact({ operationId: located.operationId }),
+		keys,
+		...keys.length === 0 ? { finding: {
+			reason: "undocumented",
+			detail: "operation has no x-permdock-permissions"
+		} } : unknown === void 0 ? {} : { finding: {
+			reason: "unknown-key",
+			detail: unknown
+		} },
+		data,
+		provisional
+	};
+}
+function resolveAll(input, tree) {
+	const doc = parseDocument(input.arazzo);
+	if (typeof doc === "string") return {
+		workflowId: input.workflowId ?? "",
+		error: doc
+	};
+	const workflowId = input.workflowId ?? doc.workflows[0]?.workflowId ?? "";
+	const flat = [];
+	const error = flatten(doc, workflowId, input.inputs ?? {}, /* @__PURE__ */ new Set(), flat);
+	if (error !== void 0) return {
+		workflowId,
+		error
+	};
+	return {
+		workflowId,
+		steps: flat.map((item) => resolve(doc, input.openapi, tree, item))
+	};
+}
+function arazzoFindings(input, tree) {
+	const resolved = resolveAll(input, tree);
+	if ("error" in resolved) return [{
+		stepId: "document",
+		workflowId: resolved.workflowId,
+		reason: "validation",
+		detail: resolved.error
+	}];
+	return resolved.steps.flatMap((step) => step.finding === void 0 ? [] : [{
+		stepId: step.stepId,
+		workflowId: step.workflowId,
+		reason: step.finding.reason,
+		detail: step.finding.detail
+	}]);
+}
+function worst(outcomes) {
+	if (outcomes.includes("denied")) return "denied";
+	if (outcomes.includes("approval-required")) return "approval-required";
+	return "granted";
+}
+function combine(decisions) {
+	const outcome = worst(decisions.map((item) => item.outcome));
+	return decisions.find((item) => item.outcome === outcome) ?? denied("undocumented");
+}
+function simulateArazzo(input, tree, decide) {
+	const resolved = resolveAll(input, tree);
+	if ("error" in resolved) return freezeDeep({
+		workflowId: resolved.workflowId === "" ? "unknown" : resolved.workflowId,
+		outcome: "denied",
+		steps: [{
+			stepId: "document",
+			permissions: [],
+			decision: denied("validation")
+		}]
+	});
+	const steps = resolved.steps.map((step) => {
+		const owner = step.workflowId === resolved.workflowId ? void 0 : step.workflowId;
+		if (step.finding !== void 0) return compact({
+			stepId: step.stepId,
+			workflowId: owner,
+			operationId: step.operationId,
+			permissions: [],
+			decision: denied(step.finding.reason === "unsupported" ? "unsupported" : "undocumented")
+		});
+		const permissions = step.keys.flatMap((key) => {
+			const leaf = tree === void 0 ? void 0 : findPermission(tree, key);
+			return leaf === void 0 ? [] : [leaf];
+		});
+		return compact({
+			stepId: step.stepId,
+			workflowId: owner,
+			operationId: step.operationId,
+			permissions,
+			decision: combine(permissions.map((permission) => decide(permission, step.data))),
+			provisional: step.provisional ? true : void 0
+		});
+	});
+	return freezeDeep({
+		workflowId: resolved.workflowId,
+		outcome: worst(steps.map((step) => step.decision.outcome)),
+		steps
+	});
+}
+function isArazzoSimulateInput(value) {
+	return isRecord(value) && "arazzo" in value;
+}
+//#endregion
+//#region src/core/row-pair.ts
+function isRowPair(value) {
+	return value !== null && typeof value === "object" && "current" in value && "next" in value;
+}
+/**
+* The row a `where` reads and the row a `check` reads. An instance check
+* takes a `{ current, next }` pair or one row for both; a collection check
+* has no current row, only the input it creates.
+*/
+function rowValues(permission, data) {
+	if (permission.kind === "collection") return {
+		current: void 0,
+		next: data
+	};
+	if (permission.kind === "instance" && isRowPair(data)) return {
+		current: data.current,
+		next: data.next
+	};
+	return {
+		current: data,
+		next: data
+	};
+}
+/** The row's id under `field` as a string, or `*` when the row has no string or number there. */
+function rowIdOf(row, field = "id") {
+	if (row === null || typeof row !== "object" || !Object.hasOwn(row, field)) return "*";
+	const id = Reflect.get(row, field);
+	return typeof id === "string" || typeof id === "number" ? String(id) : "*";
+}
+//#endregion
+//#region src/conditions/bind.ts
+function isPrimitive(value) {
+	return typeof value === "string" || typeof value === "number" || typeof value === "boolean";
+}
+const ALWAYS$1 = {
+	op: "eq",
+	field: "_",
+	value: true
+};
+const NEVER = {
+	op: "or",
+	conditions: []
+};
+function bindValue(value, subject, only) {
+	if (isConditionRef(value) && only !== void 0 && !only(value.ref)) return value;
+	if (isConditionRef(value)) {
+		const resolved = resolveConditionRef(value.ref, subject);
+		if (Array.isArray(resolved)) return resolved.filter((item) => isPrimitive(item));
+		return isPrimitive(resolved) ? resolved : null;
+	}
+	if (Array.isArray(value)) return value.map((item) => bindValue(item, subject, only));
+	return value;
+}
+function bindArg(arg, subject, only) {
+	return arg !== null && typeof arg === "object" && "field" in arg && !isConditionRef(arg) ? arg : bindValue(arg, subject, only);
+}
+/**
+* Replaces every `principal.*` / `context.*` ref with the subject's value, and
+* a `liveSession` node with a constant, so a `where()` result compiles the
+* same without the subject. A ref the subject
+* does not hold binds to `null` (or `[]` in a list), which never matches, as
+* in `evaluateCondition`. With `only`, refs it rejects stay refs.
+*/
+function bindConditionRefs(condition, subject, only) {
+	switch (condition.op) {
+		case "and":
+		case "or": return {
+			op: condition.op,
+			conditions: condition.conditions.map((child) => bindConditionRefs(child, subject, only))
+		};
+		case "not": return {
+			op: "not",
+			condition: bindConditionRefs(condition.condition, subject, only)
+		};
+		case "in":
+		case "notIn": {
+			const value = condition.value;
+			if (isConditionRef(value) && only !== void 0 && !only(value.ref)) return condition;
+			const bound = bindValue(value, subject, only);
+			return {
+				...condition,
+				value: Array.isArray(bound) ? bound : []
+			};
+		}
+		case "eq":
+		case "ne":
+		case "gt":
+		case "gte":
+		case "lt":
+		case "lte":
+		case "contains": return {
+			...condition,
+			value: bindValue(condition.value, subject, only)
+		};
+		case "sqlFunction": return {
+			...condition,
+			args: condition.args.map((arg) => bindArg(arg, subject, only)),
+			twin: bindConditionRefs(condition.twin, subject, only)
+		};
+		case "liveSession": return subject.liveSession === true ? ALWAYS$1 : NEVER;
+		case "isNull":
+		case "memberOf":
+		case "related":
+		case "opaque": return condition;
+		default: return condition;
+	}
+}
+//#endregion
+//#region src/core/where-scope.ts
+const ALWAYS = {
+	op: "eq",
+	field: "_",
+	value: true
+};
+function eq(field, value) {
+	return value === void 0 ? {
+		op: "or",
+		conditions: []
+	} : {
+		op: "eq",
+		field,
+		value
+	};
+}
+/** One equality per partitioning scope key on the membership's chain, outermost first. */
+function namedFilters(membership, scope) {
+	if (findScope(scope.scopes, membership.scope ?? "") === void 0 || !inTeam(membership, scope.scopes, scope.team) || !activeFor(membership, scope.scopes, scope.tenant) || membership.scope === void 0) return null;
+	const filters = [];
+	for (const name of scopeChain(scope.scopes, membership.scope).toReversed()) {
+		const key = scope.fieldOf?.(name) ?? findScope(scope.scopes, name)?.key;
+		if (key !== void 0 && scope.partitioned(name, key)) filters.push(eq(key, scopeIdOf(membership, name)));
+	}
+	return filters;
+}
+/**
+* The row filters a grant's membership implies, or `null` when the grant
+* reaches no row in this scope (another tenant, no active tenant, expired).
+*/
+function scopeFilters(grant, scope) {
+	if (grant.scope === void 0) return [];
+	const membership = grant.membership;
+	if (membership === void 0 || isMembershipExpired(membership, scope.now)) return null;
+	if (typeof grant.scope === "string") return membership.scope === grant.scope ? namedFilters(membership, scope) : null;
+	const on = membership.on;
+	if (on === void 0) return null;
+	if (scope.resources === void 0) return on.resource === grant.scope.resource && on.resource === scope.resource ? [eq("id", on.id)] : null;
+	const roleResource = scope.resources.get(grant.scope.resource);
+	if (on.resource !== grant.scope.resource && membershipField(roleResource, on.resource, scope.resources) === void 0) return null;
+	const walked = scope.graph === true ? resourceRoleCondition(scope.resources.get(scope.resource), on.resource, [on.id], scope.resources) : void 0;
+	if (walked !== void 0) return [walked];
+	const field = membershipField(scope.resources.get(scope.resource), on.resource, scope.resources);
+	return field === void 0 ? null : [eq(field, on.id)];
+}
+function all(conditions) {
+	if (conditions.length === 0) return ALWAYS;
+	return sole(conditions) ?? {
+		op: "and",
+		conditions: [...conditions]
+	};
+}
+function scopedCondition(grant, scope) {
+	const filters = scopeFilters(grant, scope);
+	if (filters === null) return null;
+	const parts = grant.where === void 0 ? filters : [...filters, grant.where];
+	return parts.length === 0 ? "always" : all(parts);
+}
+/** Whether an unconditional `deny` removes every row `allow` could reach. */
+function covers(deny, allow, scopes) {
+	if (deny.where !== void 0) return false;
+	const denied = deny.membership;
+	if (deny.scope === void 0 || denied === void 0) return deny.scope === void 0;
+	const allowed = allow.membership;
+	if (allowed === void 0) return false;
+	if (typeof deny.scope === "object") return typeof allow.scope === "object" && denied.on?.resource === allowed.on?.resource && denied.on?.id === allowed.on?.id;
+	if (typeof allow.scope !== "string" || allowed.scope === void 0) return false;
+	const chain = scopeChain(scopes, deny.scope);
+	return scopeChain(scopes, allowed.scope).includes(deny.scope) && chain.every((name) => scopeIdOf(allowed, name) === scopeIdOf(denied, name));
+}
+/**
+* The portable filter for one permission's grants: allows OR together, each
+* narrowed to its membership's tenant, team or resource; any applicable
+* portable deny is subtracted, and an unconditional one empties the result.
+*/
+function collect(grants, scope) {
+	const none = {
+		op: "or",
+		conditions: []
+	};
+	const partial = grants.some((grant) => grant.portable === false);
+	const denies = [];
+	for (const grant of grants) {
+		if (grant.effect !== "deny" || grant.portable === false || !isActive(grant.validity, scope.now)) continue;
+		const condition = scopedCondition(grant, scope);
+		if (condition === "always") return {
+			condition: none,
+			partial
+		};
+		if (condition !== null) denies.push({
+			grant,
+			condition
+		});
+	}
+	const parts = [];
+	for (const grant of grants) {
+		if (grant.effect !== "allow" || grant.portable === false || !isActive(grant.validity, scope.now)) continue;
+		const condition = scopedCondition(grant, scope);
+		if (condition === null || denies.some((deny) => covers(deny.grant, grant, scope.scopes))) continue;
+		parts.push(all([...condition === "always" ? [] : [condition], ...denies.map((deny) => ({
+			op: "not",
+			condition: deny.condition
+		}))]));
+	}
+	if (parts.length === 0) return {
+		condition: none,
+		partial
+	};
+	return {
+		condition: sole(parts) ?? {
+			op: "or",
+			conditions: parts
+		},
+		partial
+	};
+}
+/**
+* `collect`, with every subject ref bound to `scope.subject` and the subject
+* attached (not enumerable) for `memberOf`, which needs its memberships.
+*/
+function whereFromGrants(grants, scope) {
+	const { condition, partial } = collect(grants, scope);
+	const result = {
+		condition: bindConditionRefs(condition, scope.subject),
+		partial
+	};
+	Object.defineProperty(result, "subject", {
+		value: scope.subject,
+		enumerable: false
+	});
+	Object.defineProperty(result, "scopes", {
+		value: scope.scopes,
+		enumerable: false
+	});
+	if (scope.resources !== void 0) Object.defineProperty(result, "resources", {
+		value: scope.resources,
+		enumerable: false
+	});
+	return freezeDeep(result);
+}
+//#endregion
+//#region src/core/snapshot-sign.ts
+async function signSnapshot(snapshot, signer, audience) {
+	const payload = { snapshot };
+	if (snapshot.subject.principal !== null) payload["sub"] = snapshot.subject.principal.id;
+	return await signer.sign(payload, compact({
+		typ: "permdock-snapshot+jwt",
+		audience,
+		expiresAt: snapshot.expiresAt
+	}));
+}
+//#endregion
+//#region src/core/snapshot.ts
+function plainPermission(leaf) {
+	return {
+		key: leaf.key,
+		scope: leaf.scope,
+		resource: leaf.resource,
+		action: leaf.action,
+		meta: leaf.meta,
+		kind: leaf.kind
+	};
+}
+function plainRole(leaf) {
+	return compact({
+		key: leaf.key,
+		on: leaf.on,
+		assignable: leaf.assignable,
+		meta: leaf.meta,
+		kind: leaf.kind
+	});
+}
+function plainPlan(leaf) {
+	return {
+		key: leaf.key,
+		meta: leaf.meta,
+		kind: leaf.kind
+	};
+}
+function snapshotGrant(grant, membership) {
+	const scope = grant.scope === "global" ? void 0 : typeof grant.scope === "string" ? grant.scope : { resource: grant.scope.resource };
+	const entry = compact({
+		permission: grant.permission.key,
+		effect: grant.effect,
+		role: grant.role,
+		to: grant.to,
+		where: grant.portable ? grant.where : void 0,
+		check: grant.portable ? grant.check : void 0,
+		approval: grant.approval,
+		scope,
+		membership,
+		portable: grant.portable ? void 0 : false,
+		fields: grant.fields,
+		validity: grant.validity
+	});
+	return freezeDeep(entry);
+}
+const CARRIED = /* @__PURE__ */ new Set([
+	"id",
+	"roles",
+	"plans",
+	"tenant",
+	"memberships"
+]);
+/** Principal refs the snapshot principal does not carry (`claims`, `teamIds`, …) are bound to the subject's values. */
+function isClaimRef(ref) {
+	const [root, head] = ref.split(".", 2);
+	return root === "principal" && !CARRIED.has(String(head));
+}
+function bindClaims(grant, subject) {
+	if (grant.where === void 0 && grant.check === void 0) return grant;
+	return freezeDeep(compact({
+		...grant,
+		where: grant.where === void 0 ? void 0 : bindConditionRefs(grant.where, subject, isClaimRef),
+		check: grant.check === void 0 ? void 0 : bindConditionRefs(grant.check, subject, isClaimRef)
+	}));
+}
+function notEntitledOf(items) {
+	const seen = /* @__PURE__ */ new Map();
+	for (const { grant } of items) {
+		const key = `${grant.permission.key}\u0000${grant.role ?? ""}`;
+		if (!seen.has(key)) seen.set(key, {
+			permission: grant.permission.key,
+			role: grant.role,
+			to: grant.to
+		});
+	}
+	return seen.size === 0 ? void 0 : [...seen.values()];
+}
+function buildSnapshot(input) {
+	const now = input.now ?? Math.floor(Date.now() / 1e3);
+	const principal = input.subject.principal;
+	const allTenants = tenantsOf(principal, scopeList(input.scopes));
+	const tenants = input.tenants === "all" ? allTenants : principal?.tenant === void 0 ? [] : [principal.tenant];
+	const include = input.include;
+	const included = (permission) => include === void 0 || include.length === 0 || include.some((prefix) => permission.key === prefix || permission.key.startsWith(`${prefix}.`) || permission.resource === prefix);
+	const grants = input.grants.filter((item) => included(item.grant.permission)).map((item) => bindClaims(snapshotGrant(item.grant, item.membership), input.subject));
+	const ids = {};
+	for (const item of input.grants) {
+		const name = item.grant.permission.resource;
+		const field = input.idOf?.(name);
+		if (field !== void 0 && field !== "id" && included(item.grant.permission)) ids[name] = field;
+	}
+	const assignableFor = input.assignable;
+	const assignable = assignableFor === void 0 ? [] : tenants.map((tenant) => {
+		const entry = assignableFor(tenant);
+		const permissions = entry.permissions.filter(included).map(plainPermission);
+		if (entry.levels === void 0) return {
+			...entry,
+			permissions
+		};
+		const keys = new Set(permissions.map((leaf) => leaf.key));
+		const levels = Object.fromEntries(Object.entries(entry.levels).filter(([key]) => keys.has(key)));
+		return compact({
+			...entry,
+			permissions,
+			levels: Object.keys(levels).length === 0 ? void 0 : levels
+		});
+	});
+	return freezeDeep(compact({
+		v: 1,
+		issuedAt: now,
+		subject: compact({
+			principal: principal === null ? null : compact({
+				id: principal.id,
+				roles: principal.roles ?? [],
+				plans: principal.plans,
+				tenant: principal.tenant,
+				memberships: principal.memberships
+			}),
+			delegation: snapshotDelegation(input.subject, input.delegated !== void 0),
+			context: input.subject.context
+		}),
+		roles: input.roles,
+		audiences: input.audiences,
+		grants,
+		tenants,
+		include,
+		simulated: input.simulated === true ? true : void 0,
+		expiresAt: input.subject.expiresAt,
+		scopes: input.scopes,
+		ids: Object.keys(ids).length === 0 ? void 0 : ids,
+		assignable: assignable.length > 0 ? assignable : void 0,
+		delegated: input.delegated === void 0 ? void 0 : [...input.delegated].toSorted(),
+		notEntitled: notEntitledOf((input.notEntitled ?? []).filter((item) => included(item.grant.permission))),
+		vocabulary: input.vocabulary === void 0 ? void 0 : compact({
+			roles: listRoles(input.vocabulary.roles).length === 0 ? void 0 : Object.fromEntries(listRoles(input.vocabulary.roles).map((leaf) => [leaf.key, plainRole(leaf)])),
+			plans: listPlans(input.vocabulary.plans).length === 0 ? void 0 : Object.fromEntries(listPlans(input.vocabulary.plans).map((leaf) => [leaf.key, plainPlan(leaf)]))
+		})
+	}));
+}
+/**
+* The token delegation as the client sees it. An actor with no token
+* delegation gets an empty `scopes` list so the client ceiling agrees with
+* `no-delegation`, unless a policy delegation applies (`delegated`), which
+* then is the ceiling.
+*/
+function snapshotDelegation(subject, delegated) {
+	const delegation = subject.delegation;
+	if (subject.actor === void 0 || delegated) return delegation;
+	if (delegation?.scopes === void 0 && delegation?.authorizationDetails === void 0 && delegation?.access === void 0) return {
+		...delegation,
+		scopes: []
+	};
+	return delegation;
+}
+function rejectUnsafe(value, path) {
+	if (value === null || typeof value !== "object") return;
+	if (Array.isArray(value)) {
+		for (const [index, item] of value.entries()) rejectUnsafe(item, `${path}[${index}]`);
+		return;
+	}
+	for (const key of Object.keys(value)) {
+		if (isForbiddenKey(key)) throw new Error(`PermDock: unsafe snapshot key '${key}' at ${path}`);
+		rejectUnsafe(value[key], `${path}.${key}`);
+	}
+}
+function parseSnapshot(json) {
+	const input = typeof json === "string" ? JSON.parse(json) : json;
+	if (input === null || typeof input !== "object" || Array.isArray(input)) throw new Error("PermDock: snapshot must be an object");
+	const value = typeof json === "string" || Object.isFrozen(input) ? input : JSON.parse(JSON.stringify(input));
+	rejectUnsafe(value, "$");
+	const version = value["v"];
+	if (version !== 1) throw new Error(`PermDock: unsupported snapshot version '${String(version)}'`);
+	return freezeDeep(value);
+}
+//#endregion
+export { whereFromGrants as a, rowIdOf as c, isArazzoSimulateInput as d, simulateArazzo as f, signSnapshot as i, rowValues as l, parseSnapshot as n, bindConditionRefs as o, evaluateCondition as p, snapshotGrant as r, isRowPair as s, buildSnapshot as t, arazzoFindings as u };