permdock 0.1.0 → 0.3.0

package/dist/{snapshot-DE8dE_hz.js → snapshot-Enxd0n-s.js}

@@ -1,15 +1,13 @@
 import { n as isReadonlyArray, r as sole, t as compact } from "./compact-y6vfu2_f.js";
-import { n as freezeDeep } from "./freeze-y1_jQL4v.js";
-import { C as ownGet, S as isForbiddenKey, i as findPermission, o as formerScopes } from "./permissions-DC7GROPA.js";
-import { c as isConditionRef, i as resolveConditionRef, s as isConditionDate, u as parentHop } from "./refs-ChLSxbST.js";
-import { a as resolveScope, c as scopeChain, d as subjectMemberships, f as tenantOf, l as scopeIdOf, r as findScope, t as activeFor, u as scopeList } from "./scopes-cKVp_WTw.js";
-import { C as listPlans, h as resourceRoleCondition, l as matchGrantee, s as flattenGrantee, w as listRoles } from "./grantee-Bv04_Vzf.js";
-import { f as tenantsOf, i as isMembershipExpired, o as membershipField, r as inTeam, t as isActive } from "./validity-D0uRmJKJ.js";
-import { n as sha256, t as bytesToBase64Url } from "./sha256-BO0swRXL.js";
+import { n as freezeDeep } from "./freeze-CrU8nQeX.js";
+import { E as ownGet, T as isForbiddenKey, i as findPermission } from "./permissions-DVoF6dMt.js";
+import { c as isConditionRef, i as resolveConditionRef, s as isConditionDate, u as parentHop } from "./refs-KYb4ntaz.js";
+import { t as expiredAt } from "./expiry-BoBJ8Tvc.js";
+import { n as sameId } from "./ids-DC4V4CFu.js";
+import { d as scopeList, l as scopeChain, m as tenantOf, o as resolveScope, p as subjectMemberships, r as findScope, t as activeFor, u as scopeIdOf } from "./scopes-CVdPrWN-.js";
+import { E as listRoles, T as listPlans, _ as resourceRoleCondition } from "./grantee-Cv5Sogfv.js";
+import { a as isMembershipExpired, c as membershipField, g as tenantsOf, i as inTeam, t as isActive } from "./validity-uOp8UpYn.js";
 //#region src/conditions/evaluate.ts
-function isExpired(membership, now) {
-	return membership.expiresAt !== void 0 && membership.expiresAt <= now;
-}
 function resolveRef(ref, subject) {
 	return resolveConditionRef(ref, subject);
 }
@@ -78,7 +76,7 @@ function matchesParentHop(data, parents, on) {
 	for (const parent of parents ?? []) {
 		const hop = parentHop(parent);
 		if (hop.resource !== void 0 && hop.resource !== on.resource) continue;
-		if (ownGet(data, hop.field) === on.id) return true;
+		if (sameId(ownGet(data, hop.field), on.id)) return true;
 	}
 	return false;
 }
@@ -92,10 +90,10 @@ function evaluateMemberOf(condition, data, subject, now, scopes) {
 	const scope = condition.scope === "resource" ? void 0 : resolveScope(scopes, condition.scope);
 	if (condition.scope !== "resource" && scope === void 0) return false;
 	for (const membership of memberships) {
-		if (isExpired(membership, now)) continue;
+		if (expiredAt(membership, now)) continue;
 		if (wanted.size > 0 && !membership.roles.some((role) => wanted.has(role))) continue;
 		if (scope !== void 0) {
-			if (membership.scope !== scope || membership.id !== rowValue) continue;
+			if (membership.scope !== scope || !sameId(membership.id, rowValue)) continue;
 			const tenant = tenantOf(membership, scopes);
 			if (active !== void 0 && tenant !== void 0 && tenant !== active) continue;
 			return true;
@@ -105,7 +103,7 @@ function evaluateMemberOf(condition, data, subject, now, scopes) {
 			if (matchesParentHop(data, condition.parents, membership.on)) return true;
 			continue;
 		}
-		if (membership.on.id === rowValue) return true;
+		if (sameId(membership.on.id, rowValue)) return true;
 		if (matchesParentHop(data, condition.parents, membership.on)) return true;
 	}
 	return false;
@@ -146,6 +144,7 @@ function evaluateCondition(condition, data, subject, now = Date.now() / 1e3, sco
 		case "opaque":
 			onOpaque?.();
 			return false;
+		case "liveSession": return subject.liveSession === true;
 		default:
  /* v8 ignore next */
 		return condition;
@@ -168,7 +167,7 @@ const denied = (reason) => freezeDeep({
 	}],
 	alternatives: []
 });
-function isRecord$1(value) {
+function isRecord(value) {
 	return value !== null && typeof value === "object" && !Array.isArray(value);
 }
 function asString(value) {
@@ -179,13 +178,13 @@ function parseParameters(raw, components, where) {
 	if (!Array.isArray(raw)) return `${where}: parameters must be an array`;
 	const out = [];
 	for (const item of raw) {
-		if (!isRecord$1(item)) return `${where}: a parameter is not an object`;
+		if (!isRecord(item)) return `${where}: a parameter is not an object`;
 		const reference = asString(item["reference"]);
 		if (reference !== void 0) {
 			const match = /^\$components\.parameters\.(.+)$/u.exec(reference);
 			const target = match?.[1] === void 0 ? void 0 : components[match[1]];
-			const name = isRecord$1(target) ? asString(target["name"]) : void 0;
-			if (!isRecord$1(target) || name === void 0 || !("value" in target)) return `${where}: unresolved parameter reference ${reference}`;
+			const name = isRecord(target) ? asString(target["name"]) : void 0;
+			if (!isRecord(target) || name === void 0 || !("value" in target)) return `${where}: unresolved parameter reference ${reference}`;
 			out.push({
 				name,
 				value: "value" in item ? item["value"] : target["value"]
@@ -202,29 +201,29 @@ function parseParameters(raw, components, where) {
 	return out;
 }
 function parseDocument(arazzo) {
-	if (!isRecord$1(arazzo)) return "Arazzo document is not an object";
+	if (!isRecord(arazzo)) return "Arazzo document is not an object";
 	const version = arazzo["arazzo"];
 	if (typeof version !== "string" || !VERSION.test(version)) return "arazzo must be a 1.0.x or 1.1.x version";
-	if (!isRecord$1(arazzo["info"])) return "info is required";
+	if (!isRecord(arazzo["info"])) return "info is required";
 	const rawSources = arazzo["sourceDescriptions"];
 	if (!Array.isArray(rawSources) || rawSources.length === 0) return "sourceDescriptions needs at least one entry";
 	const sources = [];
 	for (const source of rawSources) {
-		const name = isRecord$1(source) ? asString(source["name"]) : void 0;
-		if (!isRecord$1(source) || name === void 0 || asString(source["url"]) === void 0) return "a sourceDescription needs a name and a url";
+		const name = isRecord(source) ? asString(source["name"]) : void 0;
+		if (!isRecord(source) || name === void 0 || asString(source["url"]) === void 0) return "a sourceDescription needs a name and a url";
 		if (sources.some((item) => item.name === name)) return `duplicate sourceDescription ${name}`;
 		sources.push({
 			name,
 			type: asString(source["type"]) ?? "openapi"
 		});
 	}
-	const components = isRecord$1(arazzo["components"]) && isRecord$1(arazzo["components"]["parameters"]) ? arazzo["components"]["parameters"] : {};
+	const components = isRecord(arazzo["components"]) && isRecord(arazzo["components"]["parameters"]) ? arazzo["components"]["parameters"] : {};
 	const rawWorkflows = arazzo["workflows"];
 	if (!Array.isArray(rawWorkflows) || rawWorkflows.length === 0) return "workflows needs at least one entry";
 	const workflows = [];
 	for (const item of rawWorkflows) {
-		const workflowId = isRecord$1(item) ? asString(item["workflowId"]) : void 0;
-		if (!isRecord$1(item) || workflowId === void 0) return "a workflow needs a workflowId";
+		const workflowId = isRecord(item) ? asString(item["workflowId"]) : void 0;
+		if (!isRecord(item) || workflowId === void 0) return "a workflow needs a workflowId";
 		if (workflows.some((workflow) => workflow.workflowId === workflowId)) return `duplicate workflowId ${workflowId}`;
 		const parameters = parseParameters(item["parameters"], components, workflowId);
 		if (typeof parameters === "string") return parameters;
@@ -232,8 +231,8 @@ function parseDocument(arazzo) {
 		if (!Array.isArray(rawSteps) || rawSteps.length === 0) return `${workflowId}: steps needs at least one entry`;
 		const steps = [];
 		for (const step of rawSteps) {
-			const stepId = isRecord$1(step) ? asString(step["stepId"]) : void 0;
-			if (!isRecord$1(step) || stepId === void 0) return `${workflowId}: a step needs a stepId`;
+			const stepId = isRecord(step) ? asString(step["stepId"]) : void 0;
+			if (!isRecord(step) || stepId === void 0) return `${workflowId}: a step needs a stepId`;
 			if (steps.some((other) => other.stepId === stepId)) return `${workflowId}: duplicate stepId ${stepId}`;
 			const targets = STEP_TARGETS.filter((field) => asString(step[field]) !== void 0);
 			if (targets.length !== 1 && !(targets.length === 2 && targets.includes("operationId") && targets.includes("channelPath"))) return `${workflowId}.${stepId}: a step needs exactly one of operationId, operationPath or workflowId`;
@@ -266,7 +265,7 @@ function readPointer(doc, pointer) {
 	if (!pointer.startsWith("#/")) return;
 	let current = doc;
 	for (const raw of pointer.slice(2).split("/")) {
-		if (!isRecord$1(current)) return;
+		if (!isRecord(current)) return;
 		let token;
 		try {
 			token = unescapePointer(decodeURIComponent(raw));
@@ -279,19 +278,19 @@ function readPointer(doc, pointer) {
 	return current;
 }
 function findOperation(openapi, operationId) {
-	if (!isRecord$1(openapi) || !isRecord$1(openapi["paths"])) return;
+	if (!isRecord(openapi) || !isRecord(openapi["paths"])) return;
 	for (const pathItem of Object.values(openapi["paths"])) {
-		if (!isRecord$1(pathItem)) continue;
-		for (const [method, operation] of Object.entries(pathItem)) if (!method.startsWith("x-") && isRecord$1(operation) && operation["operationId"] === operationId) return operation;
+		if (!isRecord(pathItem)) continue;
+		for (const [method, operation] of Object.entries(pathItem)) if (!method.startsWith("x-") && isRecord(operation) && operation["operationId"] === operationId) return operation;
 	}
 }
 /** One description, or a map of descriptions keyed by source `name`. */
 function descriptionFor(openapi, name) {
-	if (isRecord$1(openapi) && !("openapi" in openapi) && !("paths" in openapi) && isRecord$1(openapi[name])) return openapi[name];
+	if (isRecord(openapi) && !("openapi" in openapi) && !("paths" in openapi) && isRecord(openapi[name])) return openapi[name];
 	return openapi;
 }
 function permissionKeysOf(node) {
-	if (!isRecord$1(node)) return [];
+	if (!isRecord(node)) return [];
 	const raw = node["x-permdock-permissions"];
 	if (!Array.isArray(raw)) return [];
 	return raw.filter((item) => typeof item === "string");
@@ -309,7 +308,7 @@ function valueOf(value, inputs) {
 	};
 	let current = inputs;
 	for (const part of match[1].split(".")) {
-		if (!isRecord$1(current) || !Object.hasOwn(current, part)) return { known: false };
+		if (!isRecord(current) || !Object.hasOwn(current, part)) return { known: false };
 		current = current[part];
 	}
 	return {
@@ -407,7 +406,7 @@ function locate(doc, openapi, step) {
 		reason: "unsupported",
 		detail: "AsyncAPI steps are not evaluated"
 	};
-	if (hit === void 0 || hit.source.type === "arazzo" || !isRecord$1(hit.node)) return {
+	if (hit === void 0 || hit.source.type === "arazzo" || !isRecord(hit.node)) return {
 		reason: "undocumented",
 		detail: "operation not found"
 	};
@@ -535,180 +534,52 @@ function simulateArazzo(input, tree, decide) {
 	});
 }
 function isArazzoSimulateInput(value) {
-	return isRecord$1(value) && "arazzo" in value;
+	return isRecord(value) && "arazzo" in value;
 }
 //#endregion
-//#region src/core/delegation.ts
-/** The permission's scope and any scope it was renamed from: tokens issued before a rename keep working. */
-function scopeNames(permission) {
-	return [permission.scope, ...formerScopes(permission)];
-}
-/**
-* Whether a delegated caller may use a permission its principal holds, through
-* OAuth `scopes`, RFC 9396 `authorizationDetails` or GNAP `access`.
-* `undefined` means covered; otherwise the denial reason `decide` would add.
-*/
-function coveredByDelegation(permission, delegation, resourceId, hasActor = false) {
-	const unscoped = hasActor ? "no-delegation" : void 0;
-	if (delegation === void 0) return unscoped;
-	const hasScopes = delegation.scopes !== void 0;
-	const hasDetails = delegation.authorizationDetails !== void 0;
-	const hasAccess = delegation.access !== void 0;
-	if (!hasScopes && !hasDetails && !hasAccess) return unscoped;
-	const emptyScopes = hasScopes && (delegation.scopes?.length ?? 0) === 0;
-	const emptyAccess = hasAccess && (delegation.access?.length ?? 0) === 0;
-	if (emptyScopes && !hasDetails && !hasAccess) return "no-delegation";
-	if (emptyAccess && !hasScopes && !hasDetails) return "no-delegation";
-	if (emptyScopes && emptyAccess && !hasDetails) return "no-delegation";
-	const scopes = scopeNames(permission);
-	const scopeOk = delegation.scopes?.some((scope) => scopes.includes(scope)) ?? false;
-	const detailOk = delegation.authorizationDetails?.some((detail) => {
-		if (detail.type !== permission.resource) return false;
-		const identifier = detail["identifier"];
-		if (identifier !== void 0 && (typeof identifier !== "string" || identifier !== resourceId)) return false;
-		const actions = detail.actions;
-		if (actions === void 0) return true;
-		return Array.isArray(actions) && actions.includes(permission.action);
-	}) ?? false;
-	const accessOk = accessCovers(permission, delegation.access, resourceId);
-	if (scopeOk || detailOk || accessOk) return;
-	return "not-delegated";
-}
-function accessCovers(permission, access, resourceId) {
-	if (access === void 0) return false;
-	return access.some((entry) => {
-		if (typeof entry === "string") return scopeNames(permission).includes(entry);
-		if (entry === null || typeof entry !== "object") return false;
-		const type = entry["type"];
-		if (typeof type !== "string" || !typeMatches(type, permission.resource)) return false;
-		const actions = entry["actions"];
-		if (actions !== void 0 && (!Array.isArray(actions) || !actions.includes(permission.action))) return false;
-		const identifier = entry["identifier"];
-		if (identifier !== void 0 && (typeof identifier !== "string" || identifier !== resourceId)) return false;
-		return true;
-	});
-}
-function typeMatches(type, resource) {
-	if (type === resource) return true;
-	return type.endsWith(`/${resource}`);
-}
-function resourceIdOf(data) {
-	if (data === null || typeof data !== "object" || !("id" in data)) return;
-	const id = data.id;
-	return typeof id === "string" || typeof id === "number" ? String(id) : void 0;
+//#region src/core/row-pair.ts
+function isRowPair(value) {
+	return value !== null && typeof value === "object" && "current" in value && "next" in value;
 }
 /**
-* Whether the subject's principal is a `from` of the delegation: every item
-* matches, with roles checked against the roles the principal holds here
-* (`matchGrantee` leaves role holding to the caller) and nothing that needs a
-* row.
+* The row a `where` reads and the row a `check` reads. An instance check
+* takes a `{ current, next }` pair or one row for both; a collection check
+* has no current row, only the input it creates.
 */
-function handsOver(delegation, subject, heldRoles, now) {
-	const items = flattenGrantee(delegation.from);
-	if (items.length === 0 || subject.principal === null) return false;
-	return items.every((item) => {
-		if (item.kind === "role") return heldRoles.has(item.role);
-		if (item.kind === "relation") return false;
-		const match = matchGrantee(item, subject, now, void 0);
-		return match.matched && match.where === void 0;
-	});
-}
-/**
-* The permission keys the policy's delegations let `subject.actor` use for
-* `subject.principal` right now: the union over every active delegation whose
-* `to` matches the actor and whose `from` the principal holds. `undefined`
-* when none applies, so the call falls back to the token delegation alone.
-* An actor with `readOnly: true` gets only each delegation's read-only keys.
-* Attenuation only: a key here still needs a matching allow and no deny.
-*/
-function delegatedPermissions(delegations, subject, heldRoles, now) {
-	const actor = subject.actor;
-	if (actor === void 0 || delegations === void 0) return;
-	let keys;
-	for (const delegation of delegations) {
-		if (delegation.to.kind !== actor.kind || delegation.to.id !== void 0 && delegation.to.id !== actor.id || !isActive(delegation.validity, now) || !handsOver(delegation, subject, heldRoles, now)) continue;
-		keys ??= /* @__PURE__ */ new Set();
-		for (const key of actor.readOnly === true ? delegation.readOnly : delegation.permissions) keys.add(key);
-	}
-	return keys;
-}
-//#endregion
-//#region src/core/canonical-json.ts
-function isRecord(value) {
-	return value !== null && typeof value === "object" && !Array.isArray(value);
-}
-/**
-* JSON with sorted keys and `undefined` members dropped, so equal values hash
-* equally. Dates become ISO strings, bigints `"<n>n"`, and a repeated object
-* on the current path `"[Circular]"`, so any validated row serialises.
-*/
-function canonicalJson(value, path = /* @__PURE__ */ new Set()) {
-	if (typeof value === "bigint") return JSON.stringify(`${value}n`);
-	if (value instanceof Date) return JSON.stringify(Number.isNaN(value.getTime()) ? null : value.toISOString());
-	if (value !== null && typeof value === "object") {
-		if (path.has(value)) return "\"[Circular]\"";
-		path.add(value);
-		try {
-			if (Array.isArray(value)) return `[${value.map((item) => canonicalJson(item === void 0 ? null : item, path)).join(",")}]`;
-			if (isRecord(value)) return `{${Object.keys(value).toSorted().filter((key) => value[key] !== void 0).map((key) => `${JSON.stringify(key)}:${canonicalJson(value[key], path)}`).join(",")}}`;
-		} finally {
-			path.delete(value);
-		}
-	}
-	return JSON.stringify(value) ?? "null";
-}
-//#endregion
-//#region src/core/token.ts
-/**
-* Only stable identity goes into the token, so refreshing a session (new
-* roles, assurance or claims) does not orphan an outstanding approval.
-*/
-function principalIdentity(principal) {
-	if (principal === null) return null;
+function rowValues(permission, data) {
+	if (permission.kind === "collection") return {
+		current: void 0,
+		next: data
+	};
+	if (permission.kind === "instance" && isRowPair(data)) return {
+		current: data.current,
+		next: data.next
+	};
 	return {
-		id: principal.id,
-		tenant: principal.tenant ?? null,
-		issuer: principal.issuer ?? null
+		current: data,
+		next: data
 	};
 }
-/** A row's `version` field as token input; `null` when it is missing or not a scalar. */
-function versionOf(row, field) {
-	if (row === null || typeof row !== "object" || !Object.hasOwn(row, field)) return null;
-	const value = row[field];
-	if (value instanceof Date) return Number.isNaN(value.getTime()) ? null : value.toISOString();
-	return typeof value === "string" || typeof value === "number" || typeof value === "bigint" || typeof value === "boolean" ? String(value) : null;
-}
-/** The digest that binds a token to the call's data when no row id does. */
-function payloadDigest(data) {
-	return bytesToBase64Url(sha256(canonicalJson(data)));
-}
-/**
-* `version` is set only for an approval that goes stale on a resource
-* change; without it the payload, and so every other token, is unchanged.
-* `payload` is set when `resourceId` is `*` (a collection action or a row
-* without an id), so an approval covers the arguments it was given and no
-* others.
-*/
-function decisionToken(input) {
-	const payload = JSON.stringify({
-		key: input.key,
-		resourceId: input.resourceId,
-		principal: principalIdentity(input.principal),
-		actor: input.actor === void 0 ? null : {
-			id: input.actor.id,
-			kind: input.actor.kind
-		},
-		fingerprint: input.fingerprint,
-		...input.version === void 0 ? {} : { version: input.version },
-		...input.payload === void 0 ? {} : { payload: input.payload }
-	});
-	return `pd1.${bytesToBase64Url(sha256(payload))}`;
+/** The row's id under `field` as a string, or `*` when the row has no string or number there. */
+function rowIdOf(row, field = "id") {
+	if (row === null || typeof row !== "object" || !Object.hasOwn(row, field)) return "*";
+	const id = Reflect.get(row, field);
+	return typeof id === "string" || typeof id === "number" ? String(id) : "*";
 }
 //#endregion
 //#region src/conditions/bind.ts
 function isPrimitive(value) {
 	return typeof value === "string" || typeof value === "number" || typeof value === "boolean";
 }
+const ALWAYS$1 = {
+	op: "eq",
+	field: "_",
+	value: true
+};
+const NEVER = {
+	op: "or",
+	conditions: []
+};
 function bindValue(value, subject, only) {
 	if (isConditionRef(value) && only !== void 0 && !only(value.ref)) return value;
 	if (isConditionRef(value)) {
@@ -723,8 +594,9 @@ function bindArg(arg, subject, only) {
 	return arg !== null && typeof arg === "object" && "field" in arg && !isConditionRef(arg) ? arg : bindValue(arg, subject, only);
 }
 /**
-* Replaces every `principal.*` / `context.*` ref with the subject's value, so
-* a `where()` result compiles the same without the subject. A ref the subject
+* Replaces every `principal.*` / `context.*` ref with the subject's value, and
+* a `liveSession` node with a constant, so a `where()` result compiles the
+* same without the subject. A ref the subject
 * does not hold binds to `null` (or `[]` in a list), which never matches, as
 * in `evaluateCondition`. With `only`, refs it rejects stay refs.
 */
@@ -764,6 +636,7 @@ function bindConditionRefs(condition, subject, only) {
 			args: condition.args.map((arg) => bindArg(arg, subject, only)),
 			twin: bindConditionRefs(condition.twin, subject, only)
 		};
+		case "liveSession": return subject.liveSession === true ? ALWAYS$1 : NEVER;
 		case "isNull":
 		case "memberOf":
 		case "related":
@@ -793,7 +666,7 @@ function namedFilters(membership, scope) {
 	if (findScope(scope.scopes, membership.scope ?? "") === void 0 || !inTeam(membership, scope.scopes, scope.team) || !activeFor(membership, scope.scopes, scope.tenant) || membership.scope === void 0) return null;
 	const filters = [];
 	for (const name of scopeChain(scope.scopes, membership.scope).toReversed()) {
-		const key = findScope(scope.scopes, name)?.key;
+		const key = scope.fieldOf?.(name) ?? findScope(scope.scopes, name)?.key;
 		if (key !== void 0 && scope.partitioned(name, key)) filters.push(eq(key, scopeIdOf(membership, name)));
 	}
 	return filters;
@@ -913,7 +786,44 @@ function whereFromGrants(grants, scope) {
 	return freezeDeep(result);
 }
 //#endregion
+//#region src/core/snapshot-sign.ts
+async function signSnapshot(snapshot, signer, audience) {
+	const payload = { snapshot };
+	if (snapshot.subject.principal !== null) payload["sub"] = snapshot.subject.principal.id;
+	return await signer.sign(payload, compact({
+		typ: "permdock-snapshot+jwt",
+		audience,
+		expiresAt: snapshot.expiresAt
+	}));
+}
+//#endregion
 //#region src/core/snapshot.ts
+function plainPermission(leaf) {
+	return {
+		key: leaf.key,
+		scope: leaf.scope,
+		resource: leaf.resource,
+		action: leaf.action,
+		meta: leaf.meta,
+		kind: leaf.kind
+	};
+}
+function plainRole(leaf) {
+	return compact({
+		key: leaf.key,
+		on: leaf.on,
+		assignable: leaf.assignable,
+		meta: leaf.meta,
+		kind: leaf.kind
+	});
+}
+function plainPlan(leaf) {
+	return {
+		key: leaf.key,
+		meta: leaf.meta,
+		kind: leaf.kind
+	};
+}
 function snapshotGrant(grant, membership) {
 	const scope = grant.scope === "global" ? void 0 : typeof grant.scope === "string" ? grant.scope : { resource: grant.scope.resource };
 	const entry = compact({
@@ -932,9 +842,17 @@ function snapshotGrant(grant, membership) {
 	});
 	return freezeDeep(entry);
 }
-/** Claim refs: the snapshot principal does not carry `claims`, so they are bound to the subject's values. */
+const CARRIED = /* @__PURE__ */ new Set([
+	"id",
+	"roles",
+	"plans",
+	"tenant",
+	"memberships"
+]);
+/** Principal refs the snapshot principal does not carry (`claims`, `teamIds`, …) are bound to the subject's values. */
 function isClaimRef(ref) {
-	return ref.startsWith("principal.claim.") || ref.startsWith("principal.claims.");
+	const [root, head] = ref.split(".", 2);
+	return root === "principal" && !CARRIED.has(String(head));
 }
 function bindClaims(grant, subject) {
 	if (grant.where === void 0 && grant.check === void 0) return grant;
@@ -964,13 +882,27 @@ function buildSnapshot(input) {
 	const include = input.include;
 	const included = (permission) => include === void 0 || include.length === 0 || include.some((prefix) => permission.key === prefix || permission.key.startsWith(`${prefix}.`) || permission.resource === prefix);
 	const grants = input.grants.filter((item) => included(item.grant.permission)).map((item) => bindClaims(snapshotGrant(item.grant, item.membership), input.subject));
+	const ids = {};
+	for (const item of input.grants) {
+		const name = item.grant.permission.resource;
+		const field = input.idOf?.(name);
+		if (field !== void 0 && field !== "id" && included(item.grant.permission)) ids[name] = field;
+	}
 	const assignableFor = input.assignable;
 	const assignable = assignableFor === void 0 ? [] : tenants.map((tenant) => {
 		const entry = assignableFor(tenant);
-		return {
+		const permissions = entry.permissions.filter(included).map(plainPermission);
+		if (entry.levels === void 0) return {
 			...entry,
-			permissions: entry.permissions.filter(included)
+			permissions
 		};
+		const keys = new Set(permissions.map((leaf) => leaf.key));
+		const levels = Object.fromEntries(Object.entries(entry.levels).filter(([key]) => keys.has(key)));
+		return compact({
+			...entry,
+			permissions,
+			levels: Object.keys(levels).length === 0 ? void 0 : levels
+		});
 	});
 	return freezeDeep(compact({
 		v: 1,
@@ -994,24 +926,16 @@ function buildSnapshot(input) {
 		simulated: input.simulated === true ? true : void 0,
 		expiresAt: input.subject.expiresAt,
 		scopes: input.scopes,
+		ids: Object.keys(ids).length === 0 ? void 0 : ids,
 		assignable: assignable.length > 0 ? assignable : void 0,
 		delegated: input.delegated === void 0 ? void 0 : [...input.delegated].toSorted(),
 		notEntitled: notEntitledOf((input.notEntitled ?? []).filter((item) => included(item.grant.permission))),
 		vocabulary: input.vocabulary === void 0 ? void 0 : compact({
-			roles: listRoles(input.vocabulary.roles).length === 0 ? void 0 : Object.fromEntries(listRoles(input.vocabulary.roles).map((leaf) => [leaf.key, leaf])),
-			plans: listPlans(input.vocabulary.plans).length === 0 ? void 0 : Object.fromEntries(listPlans(input.vocabulary.plans).map((leaf) => [leaf.key, leaf]))
+			roles: listRoles(input.vocabulary.roles).length === 0 ? void 0 : Object.fromEntries(listRoles(input.vocabulary.roles).map((leaf) => [leaf.key, plainRole(leaf)])),
+			plans: listPlans(input.vocabulary.plans).length === 0 ? void 0 : Object.fromEntries(listPlans(input.vocabulary.plans).map((leaf) => [leaf.key, plainPlan(leaf)]))
 		})
 	}));
 }
-async function signSnapshot(snapshot, signer, audience) {
-	const payload = { snapshot };
-	if (snapshot.subject.principal !== null) payload["sub"] = snapshot.subject.principal.id;
-	return await signer.sign(payload, compact({
-		typ: "permdock-snapshot+jwt",
-		audience,
-		expiresAt: snapshot.expiresAt
-	}));
-}
 /**
 * The token delegation as the client sees it. An actor with no token
 * delegation gets an empty `scopes` list so the client ceiling agrees with
@@ -1048,4 +972,4 @@ function parseSnapshot(json) {
 	return freezeDeep(value);
 }
 //#endregion
-export { whereFromGrants as a, versionOf as c, delegatedPermissions as d, resourceIdOf as f, evaluateCondition as g, simulateArazzo as h, snapshotGrant as i, canonicalJson as l, isArazzoSimulateInput as m, parseSnapshot as n, decisionToken as o, arazzoFindings as p, signSnapshot as r, payloadDigest as s, buildSnapshot as t, coveredByDelegation as u };
+export { whereFromGrants as a, rowIdOf as c, isArazzoSimulateInput as d, simulateArazzo as f, signSnapshot as i, rowValues as l, parseSnapshot as n, bindConditionRefs as o, evaluateCondition as p, snapshotGrant as r, isRowPair as s, buildSnapshot as t, arazzoFindings as u };

package/dist/snapshot-cache-B-LxUahj.d.ts

@@ -0,0 +1,45 @@
+import { Tt as Snapshot } from "./policy-IB6yxpC3.js";
+//#region src/core/snapshot-cache.d.ts
+type CacheLifeForOptions = {
+  /** Lower bound in seconds. Next.js includes a private entry in per-link prefetches from 30. */
+  readonly min?: number;
+  /** Upper bound in seconds. Next.js keeps a per-session App Shell entry from 300. */
+  readonly max?: number;
+  /** Seconds since the epoch; defaults to the snapshot's `issuedAt`, then the clock. */
+  readonly now?: number;
+};
+/**
+ * `{ stale }` in seconds: `max` when the value never expires, otherwise the seconds left, clamped
+ * to `[min, max]`. A value with less than `min` seconds left gets its real remainder, so Next.js
+ * leaves it out of prefetches and an HTTP cache does not serve it past `expiresAt`.
+ */
+declare function cacheLifeFor(value: {
+  readonly expiresAt?: number | null;
+  readonly issuedAt?: number;
+} | null, options?: CacheLifeForOptions): {
+  readonly stale: number;
+};
+/**
+ * The `cacheTag` for one subject's cached snapshots: `permdock:<sub>`, or `permdock:anon`
+ * without a subject. Tag the private cache with it and pass it to `updateTag` or
+ * `revalidateTag` on every write that changes the subject's snapshot.
+ */
+declare function snapshotTag(sub?: string | null): string;
+type SnapshotHeadersOptions = CacheLifeForOptions & {
+  /** Sent in `Cache-Tag` after `snapshotTag(sub)`, such as the app's own organisation tag. */
+  readonly tags?: readonly string[];
+};
+type SnapshotHeaders = {
+  readonly "Cache-Control": string;
+  readonly Vary: string;
+  readonly ETag: string;
+  readonly "Cache-Tag": string;
+};
+/**
+ * Response headers for a loader or route that returns `snapshot`: `Cache-Control: private` with
+ * `max-age` from `cacheLifeFor`, `Vary: Authorization, Cookie`, an `ETag` over everything but
+ * `issuedAt`, and `Cache-Tag` with `snapshotTag(sub)` and `tags`.
+ */
+declare function snapshotHeaders(snapshot: Snapshot, options?: SnapshotHeadersOptions): SnapshotHeaders;
+//#endregion
+export { snapshotHeaders as a, cacheLifeFor as i, SnapshotHeaders as n, snapshotTag as o, SnapshotHeadersOptions as r, CacheLifeForOptions as t };

package/dist/snapshot-cache-D6jLelln.js

@@ -0,0 +1,44 @@
+import { n as payloadDigest } from "./token-CIWxJOCh.js";
+//#region src/core/snapshot-cache.ts
+/**
+* `{ stale }` in seconds: `max` when the value never expires, otherwise the seconds left, clamped
+* to `[min, max]`. A value with less than `min` seconds left gets its real remainder, so Next.js
+* leaves it out of prefetches and an HTTP cache does not serve it past `expiresAt`.
+*/
+function cacheLifeFor(value, options = {}) {
+	const min = options.min ?? 30;
+	const max = Math.max(options.max ?? 300, min);
+	const expiresAt = value?.expiresAt;
+	if (expiresAt === void 0 || expiresAt === null) return { stale: max };
+	const issuedAt = value?.issuedAt !== void 0 && value.issuedAt > 0 ? value.issuedAt : void 0;
+	const now = options.now ?? issuedAt ?? Math.floor(Date.now() / 1e3);
+	const remaining = Math.floor(expiresAt - now);
+	if (remaining < min) return { stale: Math.max(0, remaining) };
+	return { stale: Math.min(max, remaining) };
+}
+/**
+* The `cacheTag` for one subject's cached snapshots: `permdock:<sub>`, or `permdock:anon`
+* without a subject. Tag the private cache with it and pass it to `updateTag` or
+* `revalidateTag` on every write that changes the subject's snapshot.
+*/
+function snapshotTag(sub) {
+	return `permdock:${sub === void 0 || sub === null || sub === "" ? "anon" : sub}`;
+}
+/**
+* Response headers for a loader or route that returns `snapshot`: `Cache-Control: private` with
+* `max-age` from `cacheLifeFor`, `Vary: Authorization, Cookie`, an `ETag` over everything but
+* `issuedAt`, and `Cache-Tag` with `snapshotTag(sub)` and `tags`.
+*/
+function snapshotHeaders(snapshot, options = {}) {
+	const content = {};
+	for (const [key, value] of Object.entries(snapshot)) if (key !== "issuedAt") content[key] = value;
+	const { tags, ...life } = options;
+	return {
+		"Cache-Control": `private, max-age=${cacheLifeFor(snapshot, life).stale}`,
+		Vary: "Authorization, Cookie",
+		ETag: `"${payloadDigest(content)}"`,
+		"Cache-Tag": [snapshotTag(snapshot.subject.principal?.id), ...tags ?? []].join(",")
+	};
+}
+//#endregion
+export { snapshotHeaders as n, snapshotTag as r, cacheLifeFor as t };