permdock 0.3.0 → 0.4.0

package/dist/{files-DWUN9PzI.js → files-D_JIzUrP.js}

@@ -1,5 +1,5 @@
-import { existsSync, globSync, readdirSync, realpathSync, statSync } from "node:fs";
-import { basename, extname, join, relative, resolve } from "node:path";
+import { existsSync, globSync, mkdirSync, readFileSync, readdirSync, realpathSync, statSync, writeFileSync } from "node:fs";
+import { basename, dirname, extname, join, relative, resolve } from "node:path";
 //#region src/cli/files.ts
 const SOURCE_EXT = /* @__PURE__ */ new Set([
 	".ts",
@@ -121,5 +121,14 @@ function defaultSrcPath() {
 function doctorSrcPath(config) {
 	return config.doctor?.srcPath ?? config.collect?.srcPath ?? defaultSrcPath();
 }
+/** The parsed JSON at `path`; throws when it is unreadable or not JSON. */
+function readJsonFile(path) {
+	return JSON.parse(readFileSync(path, "utf8"));
+}
+/** Writes `text` to `path`, creating its directory first. */
+function writeFileEnsuringDir(path, text) {
+	mkdirSync(dirname(path), { recursive: true });
+	writeFileSync(path, text);
+}
 //#endregion
-export { sqlFiles as a, rel as i, doctorSrcPath as n, listSourceFiles as r, defaultSrcPath as t };
+export { rel as a, readJsonFile as i, doctorSrcPath as n, sqlFiles as o, listSourceFiles as r, writeFileEnsuringDir as s, defaultSrcPath as t };

package/dist/{fixtures-ht28Cplr.js → fixtures-h2eG2OZV.js}

@@ -1,10 +1,9 @@
-import { a as loadModule, o as pickNamed } from "./load-DhWEB9P1.js";
-import { existsSync, readFileSync } from "node:fs";
+import { r as isRecord } from "./compact-CAf557ZB.js";
+import { i as readJsonFile } from "./files-D_JIzUrP.js";
+import { a as loadModule, s as pickNamed } from "./load-C3_oTHyO.js";
+import { existsSync } from "node:fs";
 import { resolve } from "node:path";
 //#region src/cli/fixtures.ts
-function isRecord(value) {
-	return value !== null && typeof value === "object" && !Array.isArray(value);
-}
 function asFixtures(value) {
 	const list = Array.isArray(value) ? value : isRecord(value) && Array.isArray(value["fixtures"]) ? value["fixtures"] : void 0;
 	if (list === void 0) throw new Error("PermDock CLI: fixtures must be an array or { fixtures }");
@@ -31,7 +30,7 @@ async function loadFixtures(cwd, path) {
 	const abs = resolve(cwd, path);
 	if (!existsSync(abs)) throw new Error(`PermDock CLI: fixtures not found: ${path}`);
 	if (abs.endsWith(".json")) {
-		const parsed = JSON.parse(readFileSync(abs, "utf8"));
+		const parsed = readJsonFile(abs);
 		return {
 			fixtures: asFixtures(parsed),
 			customRoles: asCustomRoles(parsed)

package/dist/{from-snapshot-CTLijvdm.js → from-snapshot-7REQZe0H.js}

@@ -1,17 +1,17 @@
-import { t as compact } from "./compact-y6vfu2_f.js";
+import { t as compact } from "./compact-CAf557ZB.js";
 import { n as freezeDeep } from "./freeze-CrU8nQeX.js";
-import { _ as listPermissions } from "./permissions-DVoF6dMt.js";
-import { a as deniedMessage, i as approvalMessage, n as PermDockDeniedError, t as PermDockApprovalRequiredError } from "./errors-Cz5zn0mW.js";
+import { a as deniedMessage, i as approvalMessage, n as PermDockDeniedError, t as PermDockApprovalRequiredError } from "./errors-drnfxYtm.js";
 import { n as sameId } from "./ids-DC4V4CFu.js";
-import { a as normalizeMemberships, d as scopeList, m as tenantOf, o as resolveScope, t as activeFor } from "./scopes-CVdPrWN-.js";
-import { a as whereFromGrants, c as rowIdOf, d as isArazzoSimulateInput, f as simulateArazzo, i as signSnapshot, l as rowValues, p as evaluateCondition } from "./snapshot-Enxd0n-s.js";
-import { D as synthesiseRole, E as listRoles, S as findRole, d as matchGrantee } from "./grantee-Cv5Sogfv.js";
-import { n as pickVisible, t as grantCoversField } from "./fields-BMl1RxoX.js";
-import { a as isMembershipExpired, i as inTeam, l as nestedAppliesWithoutRow, m as rowInScope, p as resolveActiveTenant, t as isActive, u as nowSeconds } from "./validity-uOp8UpYn.js";
+import { a as normalizeMemberships, d as scopeList, m as tenantOf, o as resolveScope, t as activeFor } from "./scopes-tvpa34ep.js";
+import { _ as evaluateCondition, a as whereFromGrants, f as rowIdOf, g as simulateArazzo, h as isArazzoSimulateInput, i as signSnapshot, p as rowValues, s as coveredByDelegation } from "./snapshot-Dc9CHPME.js";
+import { c as listPermissions } from "./permission-registry-BsblpB-z.js";
+import { b as synthesiseRole, m as findRole, v as listRoles } from "./grantee-CXY-0C87.js";
+import { i as pickVisible, r as grantCoversField, t as isActive } from "./validity-dVrUEPJt.js";
+import { c as nowSeconds, d as resolveActiveTenant, f as rowInScope, n as inTeam, r as isMembershipExpired, s as nestedAppliesWithoutRow } from "./tenancy-DshjqY0n.js";
 import { t as requiresApproval } from "./approval-required-TzNB9oQA.js";
-import { t as coveredByDelegation } from "./delegation-D8pUEuce.js";
+import { n as matchGrantee } from "./grantee-match-fxYp9Nmt.js";
 import { t as resourceIdOf } from "./resource-ref-CaS9yVPi.js";
-import { n as payloadDigest, t as decisionToken } from "./token-CIWxJOCh.js";
+import { n as payloadDigest, t as decisionToken } from "./token-Bx9qy30p.js";
 //#region src/core/snapshot-evaluate.ts
 function coveredByInclude(snapshot, permission) {
 	const include = snapshot.include;
@@ -126,6 +126,8 @@ function matchedOf(grant) {
 	return compact({
 		role: grant.role,
 		permission: grant.permission,
+		name: grant.name,
+		meta: grant.meta,
 		to: grant.to,
 		where: grant.where,
 		check: grant.check,
@@ -141,15 +143,22 @@ function evaluateSnapshot(snapshot, subject, permission, data, team, options, ou
 		denies: [],
 		skipped: []
 	} : void 0;
-	const done = (decision) => outcomeOnly ? decision : freezeDeep(tracer === void 0 ? decision : {
-		...decision,
-		trace: {
-			evaluated: tracer.evaluated,
-			allows: tracer.allows,
-			denies: tracer.denies,
-			skipped: tracer.skipped
-		}
-	});
+	const done = (raw) => {
+		if (outcomeOnly) return raw;
+		const decision = raw.outcome === "denied" ? {
+			...raw,
+			permission: permission.key
+		} : raw;
+		return freezeDeep(tracer === void 0 ? decision : {
+			...decision,
+			trace: {
+				evaluated: tracer.evaluated,
+				allows: tracer.allows,
+				denies: tracer.denies,
+				skipped: tracer.skipped
+			}
+		});
+	};
 	const skip = (grant, why) => {
 		tracer?.skipped.push({
 			role: grant.role,
@@ -302,12 +311,13 @@ function evaluateSnapshot(snapshot, subject, permission, data, team, options, ou
 		reason: "human",
 		token
 	});
-	return done({
+	return done(compact({
 		outcome: "granted",
 		subject,
 		matched: grant,
-		token
-	});
+		token,
+		obligations: matched.obligations
+	}));
 }
 function whereFromSnapshot(snapshot, subject, permission, team) {
 	return whereFromGrants(snapshot.grants.filter((grant) => grant.permission === permission.key), {

package/dist/{generate-CH7ThJ14.js → generate-CNU1pIOo.js}

@@ -1,3 +1,4 @@
+import { r as isRecord } from "./compact-CAf557ZB.js";
 import { t as byCodePoint } from "./compare-pfyVnBjE.js";
 //#region src/cli/generate.ts
 const IDENTIFIER = /^[A-Za-z_$][A-Za-z0-9_$]*$/u;
@@ -19,9 +20,6 @@ function emptySchema(kind) {
 function propertyKey(name) {
 	return IDENTIFIER.test(name) ? name : JSON.stringify(name);
 }
-function isRecord(value) {
-	return value !== null && typeof value === "object" && !Array.isArray(value);
-}
 function literalEnum(schema) {
 	const values = schema["enum"];
 	if (!Array.isArray(values) || values.length === 0 || !values.every((value) => typeof value === "string")) return;

package/dist/grantee-CXY-0C87.js

@@ -0,0 +1,254 @@
+import { t as compact } from "./compact-CAf557ZB.js";
+import { n as freezeDeep, t as freezeCopy } from "./freeze-CrU8nQeX.js";
+import { a as assertSafeKey, c as ownKeys, o as isForbiddenKey } from "./thenable-QSmvt-vZ.js";
+import { i as readAppData, r as parseAppData, t as assertAppData } from "./app-data-CV8pqqMi.js";
+import { c as listPermissions, o as isPermission } from "./permission-registry-BsblpB-z.js";
+//#region src/core/vocabulary.ts
+const ROLE_KIND = "role";
+const PLAN_KIND = "plan";
+const TREE_X_SCHEMA = Symbol.for("permdock.x-schema");
+function leafMeta(kind, key, meta, schema) {
+	if (meta === void 0) return freezeDeep({});
+	assertAppData(meta, `meta of ${kind} '${key}'`);
+	if (meta.x === void 0) return freezeDeep({ ...meta });
+	return freezeDeep({
+		...meta,
+		x: parseAppData(schema, meta.x, `meta.x of ${kind} '${key}'`)
+	});
+}
+function makeRole(key, init, schema) {
+	assertSafeKey(key, "role");
+	const on = init.on;
+	const leaf = {
+		key,
+		assignable: init.assignable ?? on !== void 0,
+		meta: leafMeta("role", key, init.meta, schema)
+	};
+	if (on !== void 0) Object.assign(leaf, { on });
+	Object.defineProperty(leaf, "kind", {
+		value: ROLE_KIND,
+		enumerable: false,
+		writable: false,
+		configurable: false
+	});
+	return Object.freeze(leaf);
+}
+function makePlan(key, init, schema) {
+	assertSafeKey(key, "plan");
+	const leaf = {
+		key,
+		meta: leafMeta("plan", key, init.meta, schema)
+	};
+	Object.defineProperty(leaf, "kind", {
+		value: PLAN_KIND,
+		enumerable: false,
+		writable: false,
+		configurable: false
+	});
+	return Object.freeze(leaf);
+}
+function isRole(value) {
+	return value !== null && typeof value === "object" && "key" in value && typeof value.key === "string" && value.kind === "role";
+}
+function isPlan(value) {
+	return value !== null && typeof value === "object" && "key" in value && typeof value.key === "string" && value.kind === "plan";
+}
+function attachSchema(tree, schema) {
+	if (schema !== void 0) Object.defineProperty(tree, TREE_X_SCHEMA, {
+		value: schema,
+		enumerable: false,
+		writable: false,
+		configurable: false
+	});
+}
+/** The `x` schema a `defineRoles` or `definePlans` tree was built with. */
+function treeXSchema(tree) {
+	if (tree === void 0 || !Object.hasOwn(tree, TREE_X_SCHEMA)) return;
+	return Reflect.get(tree, TREE_X_SCHEMA);
+}
+function defineRoles(input, options) {
+	const tree = {};
+	for (const key of Object.keys(input)) {
+		if (isForbiddenKey(key)) throw new Error(`PermDock: forbidden role key '${key}'`);
+		tree[key] = makeRole(key, input[key] ?? {}, options?.x);
+	}
+	attachSchema(tree, options?.x);
+	return freezeDeep(tree);
+}
+function definePlans(input, options) {
+	const tree = {};
+	for (const key of Object.keys(input)) {
+		if (isForbiddenKey(key)) throw new Error(`PermDock: forbidden plan key '${key}'`);
+		tree[key] = makePlan(key, input[key] ?? {}, options?.x);
+	}
+	attachSchema(tree, options?.x);
+	return freezeDeep(tree);
+}
+function listRoles(tree) {
+	if (tree === void 0) return [];
+	return ownKeys(tree).flatMap((key) => {
+		const leaf = tree[key];
+		return leaf === void 0 ? [] : [leaf];
+	});
+}
+function listPlans(tree) {
+	if (tree === void 0) return [];
+	return ownKeys(tree).flatMap((key) => {
+		const leaf = tree[key];
+		return leaf === void 0 ? [] : [leaf];
+	});
+}
+function findRole(tree, key) {
+	if (tree === void 0 || isForbiddenKey(key)) return;
+	return tree[key];
+}
+/**
+* The meta of a role a source returned (a stored custom role): known string
+* fields kept, `x` checked by the schema. Never throws; anything invalid is
+* left out, and the role itself is never dropped for it.
+*/
+function sourceRoleMeta(meta, schema) {
+	if (meta === null || typeof meta !== "object" || Array.isArray(meta)) return;
+	const text = (field) => {
+		const value = Object.hasOwn(meta, field) ? Reflect.get(meta, field) : void 0;
+		return typeof value === "string" ? value : void 0;
+	};
+	const rawX = Object.hasOwn(meta, "x") ? Reflect.get(meta, "x") : void 0;
+	const out = {};
+	for (const field of [
+		"title",
+		"description",
+		"audience"
+	]) {
+		const value = text(field);
+		if (value !== void 0) out[field] = value;
+	}
+	if (rawX !== void 0) {
+		const x = readAppData(schema, rawX);
+		if (x !== void 0) out.x = x;
+	}
+	return Object.keys(out).length === 0 ? void 0 : freezeCopy(out);
+}
+function synthesiseRole(key, options) {
+	const on = options?.on;
+	const assignable = options?.assignable ?? false;
+	const meta = options?.meta;
+	if (on === void 0) return makeRole(key, meta === void 0 ? { assignable } : {
+		assignable,
+		meta
+	});
+	return makeRole(key, meta === void 0 ? {
+		on,
+		assignable
+	} : {
+		on,
+		assignable,
+		meta
+	});
+}
+function isGrantee(value) {
+	return value !== null && typeof value === "object" && "kind" in value && typeof value.kind === "string";
+}
+function anyone() {
+	return freezeDeep({ kind: "anyone" });
+}
+function authenticated() {
+	return freezeDeep({ kind: "authenticated" });
+}
+function relation(resource, name, options) {
+	const resourceName = listPermissions(resource)[0]?.resource;
+	if (resourceName === void 0) throw new Error("PermDock: relation() requires a resource tree");
+	const through = options?.through;
+	if (Array.isArray(through)) {
+		if (through.length === 0) throw new Error("PermDock: relation() through needs at least one link");
+		for (const link of through) if (typeof link !== "string" || link === "" || link === "parent") throw new Error("PermDock: relation() through lists link names; walk parents with through: 'parent' or depth");
+	} else if (through !== void 0 && through !== "parent") throw new Error(`PermDock: relation() through must be 'parent' or a list of link names (got '${String(through)}')`);
+	const depth = options?.depth;
+	if (depth !== void 0) {
+		if (through === void 0) throw new Error("PermDock: relation() depth needs through: 'parent' or a link list");
+		const hops = Array.isArray(through) ? through.length : 0;
+		if (!Number.isInteger(depth) || depth < 0 || depth + hops > 32) throw new Error(`PermDock: relation() depth must be an integer from 0 to 32, counting each link`);
+	}
+	return freezeDeep(compact({
+		kind: "relation",
+		resource: resourceName,
+		relation: name,
+		through: through === void 0 || through === "parent" ? through : [...through],
+		depth
+	}));
+}
+function inherit(permission, options) {
+	if (!isPermission(permission) || permission.kind === "collection") throw new Error("PermDock: inherit() takes an instance permission leaf");
+	const through = options.through;
+	const links = Array.isArray(through) ? through : void 0;
+	if (through !== "parent" && (links === void 0 || links.length === 0 || !links.every((link) => typeof link === "string" && link !== "" && link !== "parent"))) throw new Error("PermDock: inherit() through must be 'parent' or a non-empty list of link names");
+	return freezeDeep({
+		kind: "inherit",
+		permission: permission.key,
+		resource: permission.resource,
+		through: links === void 0 ? "parent" : links.map(String)
+	});
+}
+function plan(name) {
+	return freezeDeep({
+		kind: "plan",
+		plan: typeof name === "string" ? name : name.key
+	});
+}
+function actor(kind) {
+	return freezeDeep({
+		kind: "actor",
+		actor: kind
+	});
+}
+function assurance(options) {
+	const acr = options.acr === void 0 ? void 0 : typeof options.acr === "string" ? [options.acr] : options.acr;
+	const amr = options.amr === void 0 ? void 0 : typeof options.amr === "string" ? [options.amr] : options.amr;
+	return freezeDeep(compact({
+		kind: "assurance",
+		acr,
+		amr,
+		maxAge: options.maxAge
+	}));
+}
+function resolveRoleScope(on) {
+	return typeof on === "string" ? on : "global";
+}
+function asGrantee(input) {
+	if (Array.isArray(input)) {
+		const items = [];
+		for (const item of input) items.push(...flattenGrantee(asGrantee(item)));
+		return items;
+	}
+	if (typeof input === "string") return freezeDeep({
+		kind: "role",
+		role: input,
+		scope: "global"
+	});
+	if (isRole(input)) return freezeDeep({
+		kind: "role",
+		role: input.key,
+		scope: resolveRoleScope(input.on)
+	});
+	if (isPlan(input)) return freezeDeep({
+		kind: "plan",
+		plan: input.key
+	});
+	if (isGrantee(input)) return input;
+	throw new Error("PermDock: invalid grantee");
+}
+function flattenGrantee(input) {
+	if (input === void 0) return [];
+	if (Array.isArray(input)) return input;
+	return [input];
+}
+function roleNameOf(to) {
+	for (const item of flattenGrantee(to)) if (item.kind === "role") return item.role;
+	return null;
+}
+function roleScopeOf(to, fallback = "global") {
+	for (const item of flattenGrantee(to)) if (item.kind === "role") return item.scope;
+	return fallback;
+}
+//#endregion
+export { listPlans as _, authenticated as a, synthesiseRole as b, plan as c, roleScopeOf as d, definePlans as f, isRole as g, isPlan as h, assurance as i, relation as l, findRole as m, anyone as n, flattenGrantee as o, defineRoles as p, asGrantee as r, inherit as s, actor as t, roleNameOf as u, listRoles as v, treeXSchema as x, sourceRoleMeta as y };

package/dist/grantee-conditions-MQs5NIuX.js

@@ -0,0 +1,270 @@
+import { a as sole, t as compact } from "./compact-CAf557ZB.js";
+import { c as rootScope, d as scopeList, o as resolveScope } from "./scopes-tvpa34ep.js";
+import { a as expandRelation, c as isEdgeRelation, d as isSelfParented, l as isFieldRelation, m as restrictedStops, p as restrictedFor, s as isComputedRelation, u as isPrincipalRelation } from "./resource-relations-D1Un3pcz.js";
+//#region src/core/grantee-conditions.ts
+/**
+* Where a graph relation starts on the row: its own id when the relation is
+* on the row's resource, the parent field when it is on the parent resource.
+* `undefined` when `through` cannot reach the relation's resource.
+*/
+function relationStart(grantee, resource, target) {
+	if (resource === void 0 || target === void 0 || Array.isArray(grantee.through)) return;
+	const walks = grantee.through === "parent" && isSelfParented(target);
+	const requested = grantee.depth ?? 16;
+	const depth = walks ? Number.isInteger(requested) ? Math.min(Math.max(requested, 0), 32) : 0 : 0;
+	if (target.name === resource.name) return {
+		field: resource.id,
+		parent: false,
+		depth
+	};
+	if (grantee.through === "parent" && resource.parent?.resource === target.name) return {
+		field: resource.parent.field,
+		parent: true,
+		depth
+	};
+}
+/**
+* A resource role held on self-parented `membershipResource` instances
+* (`ids`) reaches rows below them: the row itself when it is of that
+* resource, its parent field when its parent is, walked up to the default
+* depth. `undefined` when the row is not on such a chain.
+*/
+function resourceRoleCondition(resource, membershipResource, ids, resources) {
+	if (resource === void 0 || !isSelfParented(resources.get(membershipResource))) return;
+	const start = resource.name === membershipResource ? {
+		field: resource.id,
+		parent: false
+	} : resource.parent?.resource === membershipResource ? {
+		field: resource.parent.field,
+		parent: true
+	} : void 0;
+	if (start === void 0) return;
+	return compact({
+		op: "related",
+		resource: membershipResource,
+		relation: "",
+		ids: [...new Set(ids)].toSorted(),
+		field: start.field,
+		depth: 16,
+		parent: start.parent ? true : void 0,
+		restricted: restrictedFor(resource, "parent"),
+		passRestricted: passesRestricted(resources.get(membershipResource))
+	});
+}
+function passesRestricted(node) {
+	return node?.restricted !== void 0 && !restrictedStops(node, "parent") ? true : void 0;
+}
+function linkStop(resource, link) {
+	const restricted = restrictedFor(resource, link);
+	if (restricted === void 0) return {};
+	const parent = resource.parent;
+	if (parent === void 0 || !isSelfParented(resource)) return { restricted };
+	return {
+		restricted,
+		restrictedAncestors: {
+			resource: resource.name,
+			id: resource.id,
+			parent: parent.field,
+			field: restricted,
+			depth: 32
+		}
+	};
+}
+/**
+* The link path from the row to the grantee's resource: the row field of
+* the first link and each hop. `undefined` when a link is not declared or
+* the path ends on another resource.
+*/
+function relationHops(grantee, resource, resources) {
+	const through = grantee.through;
+	if (!Array.isArray(through) || resource === void 0) return;
+	const hops = [];
+	let current = resource;
+	let field;
+	for (const link of through) {
+		const spec = current !== void 0 && Object.hasOwn(current.links, link) ? current.links[link] : void 0;
+		if (spec === void 0) return;
+		field ??= spec.field;
+		hops.push({
+			link,
+			resource: spec.resource
+		});
+		current = resources?.get(spec.resource);
+	}
+	if (field === void 0 || current === void 0 || current.name !== grantee.resource) return;
+	const depth = grantee.depth ?? 0;
+	if (depth > 0 && !isSelfParented(current)) return;
+	return {
+		field,
+		hops,
+		depth
+	};
+}
+/**
+* Whether the grantee needs the relation graph: a `through` walk, an edge
+* table, or an `includes` that reaches one.
+*/
+function isGraphRelation(grantee, resources) {
+	if (grantee.through !== void 0) return true;
+	const node = resources?.get(grantee.resource);
+	return expandRelation(node, grantee.relation).some((name) => isEdgeRelation(node?.relations[name]));
+}
+function periodConditions(spec, now) {
+	const out = [];
+	const startsAt = spec.period?.startsAt;
+	if (startsAt !== void 0) out.push({
+		op: "or",
+		conditions: [{
+			op: "isNull",
+			field: startsAt,
+			value: true
+		}, {
+			op: "lte",
+			field: startsAt,
+			value: now
+		}]
+	});
+	const expiresAt = spec.period?.expiresAt;
+	if (expiresAt !== void 0) out.push({
+		op: "or",
+		conditions: [{
+			op: "isNull",
+			field: expiresAt,
+			value: true
+		}, {
+			op: "gt",
+			field: expiresAt,
+			value: now
+		}]
+	});
+	return out;
+}
+function relationCondition(grantee, resource, scopes = scopeList(void 0), options = {}) {
+	const target = grantee.resource === resource?.name ? resource : options.resources?.get(grantee.resource);
+	if (isGraphRelation(grantee, options.resources ?? targetMap(target))) {
+		const spec = target?.relations[grantee.relation];
+		if (spec === void 0 || isFieldRelation(spec) && spec.memberOf !== void 0) return;
+		if (Array.isArray(grantee.through)) {
+			const path = relationHops(grantee, resource, options.resources);
+			if (path === void 0 || target === void 0) return;
+			return compact({
+				op: "related",
+				resource: target.name,
+				relation: grantee.relation,
+				field: path.field,
+				depth: path.depth,
+				hops: path.hops,
+				...resource === void 0 ? {} : linkStop(resource, firstLink(path)),
+				passRestricted: path.depth > 0 ? passesRestricted(target) : void 0
+			});
+		}
+		const start = relationStart(grantee, resource, target);
+		if (start === void 0 || target === void 0) return;
+		return compact({
+			op: "related",
+			resource: target.name,
+			relation: grantee.relation,
+			field: start.field,
+			depth: start.depth,
+			parent: start.parent ? true : void 0,
+			restricted: start.parent || start.depth > 0 ? restrictedFor(resource, "parent") : void 0,
+			passRestricted: start.depth > 0 ? passesRestricted(target) : void 0
+		});
+	}
+	const spec = resource?.relations?.[grantee.relation];
+	if (spec === void 0 || isEdgeRelation(spec)) return;
+	if (spec.includes !== void 0 && options.includes !== false) {
+		const parts = expandRelation(resource, grantee.relation).flatMap((name) => {
+			const part = relationCondition({
+				...grantee,
+				relation: name
+			}, resource, scopes, {
+				...options,
+				includes: false
+			});
+			return part === void 0 ? [] : [part];
+		});
+		return sole(parts) ?? {
+			op: "or",
+			conditions: parts
+		};
+	}
+	if (isComputedRelation(spec)) return;
+	if (isPrincipalRelation(spec)) {
+		const owner = {
+			op: "eq",
+			field: spec.principal,
+			value: { ref: "principal.id" }
+		};
+		const period = periodConditions(spec, options.now ?? { date: (/* @__PURE__ */ new Date()).toISOString() });
+		return period.length === 0 ? owner : {
+			op: "and",
+			conditions: [owner, ...period]
+		};
+	}
+	if (spec.memberOf !== void 0) {
+		const scope = resolveScope(scopes, spec.memberOf);
+		if (scope === void 0) return {
+			op: "or",
+			conditions: []
+		};
+		if (scope === rootScope(scopes)) return {
+			op: "eq",
+			field: spec.field,
+			value: { ref: "principal.tenant" }
+		};
+		return {
+			op: "memberOf",
+			scope,
+			field: spec.field,
+			roles: []
+		};
+	}
+	return {
+		op: "eq",
+		field: spec.field,
+		value: { ref: "principal.id" }
+	};
+}
+function inheritCondition(grantee, resource, resources) {
+	if (resource === void 0) return;
+	if (grantee.through === "parent") {
+		const parent = resource.parent;
+		if (parent === void 0 || parent.resource !== grantee.resource) return;
+		return compact({
+			op: "related",
+			resource: grantee.resource,
+			relation: "",
+			permission: grantee.permission,
+			field: parent.field,
+			depth: 0,
+			parent: true,
+			restricted: restrictedFor(resource, "parent")
+		});
+	}
+	const path = relationHops({
+		kind: "relation",
+		resource: grantee.resource,
+		relation: "",
+		through: grantee.through
+	}, resource, resources);
+	if (path === void 0) return;
+	return compact({
+		op: "related",
+		resource: grantee.resource,
+		relation: "",
+		permission: grantee.permission,
+		field: path.field,
+		depth: 0,
+		hops: path.hops,
+		...linkStop(resource, firstLink(path))
+	});
+}
+function firstLink(path) {
+	return path.hops[0]?.link ?? "";
+}
+function targetMap(target) {
+	return target === void 0 ? void 0 : /* @__PURE__ */ new Map([[target.name, target]]);
+}
+//#endregion
+export { relationStart as a, relationHops as i, isGraphRelation as n, resourceRoleCondition as o, relationCondition as r, inheritCondition as t };