permdock 0.3.0 → 0.4.0

package/dist/{http-SO7qGttf.js → http-BBoKefeS.js}

@@ -26,6 +26,39 @@ function parsedBody(body, headers) {
 	if (!headers.has("content-type")) headers.set("content-type", "application/json");
 	return JSON.stringify(body);
 }
+/**
+* A Fetch `Request` for a framework request. A `GET` or `HEAD` carries no
+* body; otherwise the body the framework parsed, or else `stream()`.
+*/
+function fetchRequest(url, method, headers, body, stream) {
+	if (method === "GET" || method === "HEAD") return new Request(url, {
+		method,
+		headers
+	});
+	const parsed = parsedBody(body, headers);
+	if (parsed !== void 0) return new Request(url, {
+		method,
+		headers,
+		body: parsed
+	});
+	if (stream === void 0) return new Request(url, {
+		method,
+		headers
+	});
+	const init = {
+		method,
+		headers,
+		body: stream(),
+		duplex: "half"
+	};
+	return new Request(url, init);
+}
+/** Writes `response` to a Fastify-style reply. */
+async function writeReply(reply, response) {
+	reply.code(response.status);
+	for (const [key, value] of response.headers.entries()) reply.header(key, value);
+	await reply.send(await response.text());
+}
 /** The Fetch `Request` an RPC context carries as `request` or `req`. */
 function requestFromContext(context) {
 	if ("request" in context && context.request instanceof Request) return context.request;
@@ -33,7 +66,7 @@ function requestFromContext(context) {
 }
 /** Whether the caller sent credentials, which turns a `401` into a `WWW-Authenticate` challenge. */
 function hasCredentials(request) {
-	return request.headers.has("authorization");
+	return request instanceof Request ? request.headers.has("authorization") : request.headers.authorization !== void 0;
 }
 /** The Problem Details `detail` of `cause`, or `fallback` when it has none. */
 function problemMessage(cause, fallback) {
@@ -41,4 +74,4 @@ function problemMessage(cause, fallback) {
 	return fallback;
 }
 //#endregion
-export { problemMessage as a, parsedBody as i, hasCredentials as n, requestFromContext as o, headersFrom as r, firstHeader as t };
+export { parsedBody as a, writeReply as c, headersFrom as i, firstHeader as n, problemMessage as o, hasCredentials as r, requestFromContext as s, fetchRequest as t };

package/dist/{http-BIhmLfCc.js → http-BEbdMZ05.js}

@@ -1,31 +1,9 @@
-import { i as parsedBody, r as headersFrom, t as firstHeader } from "./http-SO7qGttf.js";
+import { i as headersFrom, n as firstHeader, t as fetchRequest } from "./http-BBoKefeS.js";
 //#region src/node/http.ts
 function toRequest(req, stream = req) {
 	const host = firstHeader(req.headers.host) ?? "localhost";
 	const url = `${req.protocol ?? "http"}://${host}${req.originalUrl ?? req.url ?? "/"}`;
-	const headers = headersFrom(req.headers);
-	const method = req.method ?? "GET";
-	if (method === "GET" || method === "HEAD") return new Request(url, {
-		method,
-		headers
-	});
-	const parsed = parsedBody(req.body, headers);
-	if (parsed !== void 0) return new Request(url, {
-		method,
-		headers,
-		body: parsed
-	});
-	if (stream === null) return new Request(url, {
-		method,
-		headers
-	});
-	const init = {
-		method,
-		headers,
-		body: incomingBody(stream),
-		duplex: "half"
-	};
-	return new Request(url, init);
+	return fetchRequest(url, req.method ?? "GET", headersFrom(req.headers), req.body, stream === null ? void 0 : () => incomingBody(stream));
 }
 function chunkOf(chunk) {
 	return typeof chunk === "string" ? Buffer.from(chunk) : new Uint8Array(chunk);

package/dist/{rls-import-BTFVk3jH.js → import-BFIlhetD.js}

@@ -1,15 +1,18 @@
+import { r as isRecord } from "./compact-CAf557ZB.js";
 import { o as usageResult } from "./errors-CWfoNg9N.js";
-import { i as quoteSqlLiteral, n as escapeSqlIdent } from "./sql-xdg5f4Fi.js";
-import { V as parseMembershipsFlag, r as HELPERS } from "./rls-shared-Cewd_-zI.js";
-import { t as FIELD_VIEWS, w as connectPg } from "./rls-fields-74oZPXWL.js";
-import { n as emptySchema, r as isSchemaKind, t as emitPermissionsModule } from "./generate-CH7ThJ14.js";
-import { existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
-import { dirname, resolve } from "node:path";
+import { s as writeFileEnsuringDir } from "./files-D_JIzUrP.js";
+import { n as escapeSqlIdent, o as quoteSqlLiteral } from "./sql-t8teWOfo.js";
+import { C as parseMembershipsFlag, r as HELPERS } from "./shared-1uhI-e-b.js";
+import { Z as pgConnector } from "./permission-keys-B26jeyUv.js";
+import { t as FIELD_VIEWS } from "./fields-fwfXN01n.js";
+import { n as emptySchema, r as isSchemaKind, t as emitPermissionsModule } from "./generate-CNU1pIOo.js";
+import { existsSync, readFileSync } from "node:fs";
+import { resolve } from "node:path";
 import { createHash } from "node:crypto";
 import { deparse, parse } from "pgsql-parser";
-//#region src/cli/rls-import-ast.ts
+//#region src/cli/rls/import-nodes.ts
 function asNode$1(value) {
-	if (value !== null && typeof value === "object" && !Array.isArray(value)) return value;
+	return isRecord(value) ? value : void 0;
 }
 function stringVal(value) {
 	const node = asNode$1(value);
@@ -158,6 +161,29 @@ async function fingerprintSql(sql) {
 		return createHash("sha256").update(sql.replaceAll(/\s+/g, " ").trim().toLowerCase()).digest("hex").slice(0, 16);
 	}
 }
+function nodeStmt(first) {
+	const raw = asNode$1(first?.["RawStmt"]);
+	if (raw !== void 0) return raw["stmt"];
+	return first?.["stmt"];
+}
+function jwtClaim(value) {
+	const node = asNode$1(unwrap(value));
+	const expr = asNode$1(node?.["A_Expr"]);
+	if (expr === void 0) return;
+	const name = operatorName(node);
+	if (name !== "->>" && name !== "->" || !isJwtCall(expr["lexpr"])) return;
+	const claim = constValue(expr["rexpr"]);
+	return typeof claim === "string" ? claim : void 0;
+}
+/** `auth.jwt()` / `auth.session()`, bare or as a scalar `(select …)`; a column's `->>` is row data, not a claim. */
+function isJwtCall(value) {
+	const inner = scalarSubselect(value);
+	if (inner !== void 0) return isJwtCall(inner);
+	const name = funcName(value);
+	return name === "auth.jwt" || name === "auth.session";
+}
+//#endregion
+//#region src/cli/rls/import-ast.ts
 async function conditionFromAst(sql, memberships, functions, unmapped, joins = [], seeds = []) {
 	if (sql === void 0 || sql.trim() === "" || sql.trim() === "true") return {
 		op: "eq",
@@ -338,58 +364,6 @@ async function helperGrants(sql, memberships, functions, seeds) {
 	}
 	return grants;
 }
-const SEED_COLUMNS = [
-	"role",
-	"permission",
-	"grant_key",
-	"scope",
-	"effect"
-];
-function asScope(value) {
-	return typeof value === "string" && /^[a-z][a-z0-9_]*$/u.test(value) ? value : void 0;
-}
-function seedFromRow(row) {
-	const scope = asScope(row["scope"]);
-	if (typeof row["role"] !== "string" || typeof row["permission"] !== "string" || typeof row["grant_key"] !== "string" || scope === void 0) return;
-	return {
-		role: row["role"],
-		permission: row["permission"],
-		grantKey: row["grant_key"],
-		scope,
-		effect: row["effect"] === "deny" ? "deny" : "allow"
-	};
-}
-/** `role_permissions` rows from the `insert ... values` statements of a SQL dump. */
-async function seedsFromSql(sql) {
-	let parsed;
-	try {
-		parsed = await parse(sql);
-	} catch {
-		return [];
-	}
-	const seeds = [];
-	for (const item of asStmts(parsed)) {
-		const insert = asNode$1(asNode$1(nodeStmt(asNode$1(item)))?.["InsertStmt"]);
-		if (asNode$1(insert?.["relation"])?.["relname"] !== "role_permissions") continue;
-		const cols = Array.isArray(insert?.["cols"]) ? insert["cols"].map((col) => asNode$1(asNode$1(col)?.["ResTarget"])?.["name"]) : [];
-		const values = asNode$1(asNode$1(insert?.["selectStmt"])?.["SelectStmt"])?.["valuesLists"];
-		if (!Array.isArray(values)) continue;
-		for (const list of values) {
-			const items = asNode$1(asNode$1(list)?.["List"])?.["items"];
-			if (!Array.isArray(items)) continue;
-			const row = {};
-			for (const [index, col] of cols.entries()) if (typeof col === "string" && SEED_COLUMNS.includes(col)) row[col] = constValue(items[index]);
-			const seed = seedFromRow(row);
-			if (seed !== void 0) seeds.push(seed);
-		}
-	}
-	return seeds;
-}
-function nodeStmt(first) {
-	const raw = asNode$1(first?.["RawStmt"]);
-	if (raw !== void 0) return raw["stmt"];
-	return first?.["stmt"];
-}
 function mapNode(value, ctx) {
 	if (value === void 0) return;
 	const node = asNode$1(unwrap(value));
@@ -505,26 +479,59 @@ function mapNode(value, ctx) {
 		};
 	}
 }
-function jwtClaim(value) {
-	const node = asNode$1(unwrap(value));
-	const expr = asNode$1(node?.["A_Expr"]);
-	if (expr === void 0) return;
-	const name = operatorName(node);
-	if (name !== "->>" && name !== "->" || !isJwtCall(expr["lexpr"])) return;
-	const claim = constValue(expr["rexpr"]);
-	return typeof claim === "string" ? claim : void 0;
+//#endregion
+//#region src/cli/rls/import-seeds.ts
+const SEED_COLUMNS = [
+	"role",
+	"permission",
+	"grant_key",
+	"scope",
+	"effect"
+];
+function asScope(value) {
+	return typeof value === "string" && /^[a-z][a-z0-9_]*$/u.test(value) ? value : void 0;
 }
-/** `auth.jwt()` / `auth.session()`, bare or as a scalar `(select …)`; a column's `->>` is row data, not a claim. */
-function isJwtCall(value) {
-	const inner = scalarSubselect(value);
-	if (inner !== void 0) return isJwtCall(inner);
-	const name = funcName(value);
-	return name === "auth.jwt" || name === "auth.session";
+function seedFromRow(row) {
+	const scope = asScope(row["scope"]);
+	if (typeof row["role"] !== "string" || typeof row["permission"] !== "string" || typeof row["grant_key"] !== "string" || scope === void 0) return;
+	return {
+		role: row["role"],
+		permission: row["permission"],
+		grantKey: row["grant_key"],
+		scope,
+		effect: row["effect"] === "deny" ? "deny" : "allow"
+	};
+}
+/** `role_permissions` rows from the `insert ... values` statements of a SQL dump. */
+async function seedsFromSql(sql) {
+	let parsed;
+	try {
+		parsed = await parse(sql);
+	} catch {
+		return [];
+	}
+	const seeds = [];
+	for (const item of asStmts(parsed)) {
+		const insert = asNode$1(asNode$1(nodeStmt(asNode$1(item)))?.["InsertStmt"]);
+		if (asNode$1(insert?.["relation"])?.["relname"] !== "role_permissions") continue;
+		const cols = Array.isArray(insert?.["cols"]) ? insert["cols"].map((col) => asNode$1(asNode$1(col)?.["ResTarget"])?.["name"]) : [];
+		const values = asNode$1(asNode$1(insert?.["selectStmt"])?.["SelectStmt"])?.["valuesLists"];
+		if (!Array.isArray(values)) continue;
+		for (const list of values) {
+			const items = asNode$1(asNode$1(list)?.["List"])?.["items"];
+			if (!Array.isArray(items)) continue;
+			const row = {};
+			for (const [index, col] of cols.entries()) if (typeof col === "string" && SEED_COLUMNS.includes(col)) row[col] = constValue(items[index]);
+			const seed = seedFromRow(row);
+			if (seed !== void 0) seeds.push(seed);
+		}
+	}
+	return seeds;
 }
 //#endregion
-//#region src/cli/rls-import-views.ts
+//#region src/cli/rls/import-views.ts
 function asNode(value) {
-	return value !== null && typeof value === "object" && !Array.isArray(value) ? value : void 0;
+	return isRecord(value) ? value : void 0;
 }
 function list(value) {
 	return Array.isArray(value) ? value : [];
@@ -708,7 +715,7 @@ async function viewsSqlFromDb(query) {
 	}).join("\n");
 }
 //#endregion
-//#region src/cli/rls-import.ts
+//#region src/cli/rls/import.ts
 const POLICY_RE = /create\s+policy\s+"?([A-Za-z0-9_]+)"?\s+on\s+"?([A-Za-z0-9_]+)"?([\s\S]*?);/gi;
 function extractParenClause(sql, keyword) {
 	const match = new RegExp(`\\b${keyword}\\s*\\(`, "i").exec(sql);
@@ -876,7 +883,7 @@ async function runRlsImport(input) {
 		policies = splitPolicies(await canonicalDump(sql) ?? sql);
 		if (policies.length === 0) policies = splitPolicies(sql);
 	} else if (input.db !== void 0) try {
-		const fromDb = await policiesFromDb(input.db, input.connect ?? ((db) => connectPg(db, "permdock rls import --db")));
+		const fromDb = await policiesFromDb(input.db, input.connect ?? pgConnector("permdock rls import --db"));
 		policies = fromDb.policies;
 		bodies = fromDb.bodies;
 		seeds = fromDb.seeds;
@@ -911,8 +918,7 @@ async function runRlsImport(input) {
 	const fieldViews = viewsSql === "" ? [] : await fieldViewsFromSql(viewsSql, memberships, functions, seeds);
 	const outRel = input.out ?? "src/permissions.generated.ts";
 	const outPath = resolve(input.cwd, outRel);
-	mkdirSync(dirname(outPath), { recursive: true });
-	writeFileSync(outPath, emitGenerated(catalog, fieldViews, input.schema));
+	writeFileEnsuringDir(outPath, emitGenerated(catalog, fieldViews, input.schema));
 	const hints = [
 		...uniqueHints([...new Set(unmapped)], bodies),
 		...[...new Set(joins)].map(membershipHint),

package/dist/{openapi-import-cmwetbzw.js → import-UHk1N7vH.js}

@@ -1,6 +1,8 @@
-import { t as validateOpenapi } from "./openapi-schema--ARjyfQr.js";
+import { t as validateOpenapi } from "./schema-Bol6gqXA.js";
+import { r as isRecord } from "./compact-CAf557ZB.js";
 import { t as byCodePoint } from "./compare-pfyVnBjE.js";
-import { i as schemaExpression, t as emitPermissionsModule } from "./generate-CH7ThJ14.js";
+import { i as readJsonFile } from "./files-D_JIzUrP.js";
+import { i as schemaExpression, t as emitPermissionsModule } from "./generate-CNU1pIOo.js";
 import { existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
 import { dirname, resolve } from "node:path";
 //#region ../../node_modules/.pnpm/yaml@2.9.1/node_modules/yaml/browser/dist/nodes/identity.js
@@ -5635,7 +5637,7 @@ function parseDocument(source, options = {}) {
 	return doc;
 }
 //#endregion
-//#region src/cli/openapi-import.ts
+//#region src/cli/openapi/import.ts
 const METHODS = [
 	"get",
 	"put",
@@ -5653,9 +5655,6 @@ const UNSAFE_SEGMENTS = /* @__PURE__ */ new Set([
 	"prototype"
 ]);
 const SEGMENT = /^[A-Za-z_$][A-Za-z0-9_$-]*$/u;
-function isRecord(value) {
-	return value !== null && typeof value === "object" && !Array.isArray(value);
-}
 function operations(document) {
 	const paths = isRecord(document["paths"]) ? document["paths"] : {};
 	const out = [];
@@ -5801,7 +5800,7 @@ function readMap(cwd, file) {
 	if (!existsSync(path)) return `--map file not found: ${file}`;
 	let parsed;
 	try {
-		parsed = JSON.parse(readFileSync(path, "utf8"));
+		parsed = readJsonFile(path);
 	} catch {
 		return "--map must be a JSON object";
 	}

package/dist/{index-C8z4RjQV.d.ts → index-BwMe94Xq.d.ts}

@@ -1,4 +1,4 @@
-import { Ft as TokenVerifier, at as DecisionSink, gt as MembershipSource } from "./policy-IB6yxpC3.js";
+import { W as DecisionSink, Z as MembershipSource, ut as TokenVerifier } from "./policy-types-sp9P1iIV.js";
 import { n as RevocationFeed } from "./revocations-Cy06JNx2.js";
 //#region src/scim/types.d.ts
 declare const SCIM_CONTENT_TYPE = "application/scim+json";

package/dist/{index-0nNqHspG.d.ts → index-DgM7w96K.d.ts}

@@ -1,5 +1,5 @@
-import { C as Policy, Nr as Principal } from "./policy-IB6yxpC3.js";
-import { C as SsfPermDock, w as SsfPermDockOptions } from "./types-Cq_H8N_X.js";
+import { E as Policy, Or as Principal } from "./policy-types-sp9P1iIV.js";
+import { C as SsfPermDock, w as SsfPermDockOptions } from "./types-C0dee0Qf.js";
 //#region src/ssf/create.d.ts
 declare function createPermDock<TUser, TPrincipal extends Principal = Principal>(policy: Policy<TUser, TPrincipal>, options: SsfPermDockOptions): SsfPermDock;
 //#endregion

package/dist/{index-C7Tw7MaW.d.ts → index-Dz7didpC.d.ts}

@@ -1,6 +1,6 @@
-import { Mr as Membership, Pr as Subject, Pt as TokenSigner, Yn as Decision, bt as RelationSource, ln as PermDock } from "./policy-IB6yxpC3.js";
-import { f as Permission, m as PermissionTree } from "./permissions-DttnqqxC.js";
-import { a as ApprovalListFilter, c as ApprovalRequest, f as ApprovalStore, i as ApprovalInspectResult, m as ApprovalVerdict, o as ApprovalListQuery, r as ApprovalCancelMeta, s as ApprovalPage } from "./types-aqOHTHcp.js";
+import { Dr as Membership, ir as Decision, jt as PermDock, kr as Subject, lt as TokenSigner, tt as RelationSource } from "./policy-types-sp9P1iIV.js";
+import { d as Permission, p as PermissionTree } from "./permission-types-Dg39z9Kv.js";
+import { a as ApprovalListFilter, c as ApprovalRequest, f as ApprovalStore, i as ApprovalInspectResult, m as ApprovalVerdict, o as ApprovalListQuery, r as ApprovalCancelMeta, s as ApprovalPage } from "./types-Br9IXUBG.js";
 //#region src/approvals/errors.d.ts
 type ApprovalErrorCode = "approval-not-found" | "approval-not-pending" | "approval-expired" | "approver-unauthenticated" | "approver-is-actor" | "approver-is-principal" | "approver-not-eligible" | "approver-repeated";
 declare class ApprovalError extends Error {

package/dist/{index-BNc7Wer_.d.ts → index-UdVQgq48.d.ts}

@@ -1,5 +1,15 @@
-import { $ as AccessEvent, C as Policy, D as PolicyVocabulary, Dr as CustomRole, Gr as SqlFunctionArg, Kr as SqlFunctionCondition, Lr as ConditionRef, Mr as Membership, Nr as Principal, Pr as Subject, Tt as Snapshot, Vr as OpaqueCondition, Zn as DenialReason, bt as RelationSource, dt as LimitStore, gt as MembershipSource, h as Grant, kr as Delegation, ln as PermDock, pt as LocalSnapshotManifest, rt as DecisionEvent, st as EntitlementSource, w as PolicyDelegation, xt as RoleSource } from "./policy-IB6yxpC3.js";
-import { C as ResourceRelationInput, f as Permission, m as PermissionTree, n as ActionMeta, t as ActionList, w as ResourceRestricted, x as ResourceParent } from "./permissions-DttnqqxC.js";
+import { Br as SqlFunctionArg, Dr as Membership, E as Policy, G as EntitlementSource, I as SeparationConflict, Ir as OpaqueCondition, Mr as ConditionRef, N as RoleBinding, O as PolicyDelegation, Or as Principal, P as RoleOptions, Sr as CustomRole, V as VocabularyFromInput, Vr as SqlFunctionCondition, Y as LimitStore, Z as MembershipSource, _ as GrantCondition, an as Snapshot, at as SnapshotSource, g as Grant, i as ApprovalOption, in as LocalSnapshotManifest, it as SettingsSource, j as PolicyVocabulary, jt as PermDock, kr as Subject, mn as PolicyScopesInput, nt as RoleSource, p as DefinePolicyOptions, s as AssuranceRequirement, sr as DenialReason, st as TenantSettings, tt as RelationSource, vn as AccessEvent, w as MembershipFixture, wr as Delegation, xn as DecisionEvent } from "./policy-types-sp9P1iIV.js";
+import { C as ResourceRelationInput, T as ResourceXTree, b as ResourceOptions, d as Permission, f as PermissionKind, h as ResourceInit, i as DefinePermissionsOptions, n as ActionMeta, p as PermissionTree, t as ActionList, u as InferPermissionTree, v as ResourceMeta, w as ResourceRestricted, x as ResourceParent, y as ResourceNode } from "./permission-types-Dg39z9Kv.js";
+import { r as Role } from "./vocabulary-hhEFLFoL.js";
+import { StandardSchemaV1 } from "@standard-schema/spec";
+//#region src/conditions/refs.d.ts
+type KnownRefField = "id" | "issuer" | "kind" | "tenant" | "team" | "roles" | "plans" | "memberships" | "assurance" | "binding" | "session";
+type SubjectRef = ConditionRef & { readonly [K in KnownRefField]: SubjectRef; } & {
+  readonly [key: string]: SubjectRef;
+};
+declare const principal: SubjectRef;
+declare const context: SubjectRef;
+//#endregion
 //#region src/core/custom-roles.d.ts
 type CustomRoleDropReason = "unknown-permission" | "outside-ceiling" | "condition-not-allowed" | "unknown-level";
 /** Why part of a custom role was left out: a permission, or an undeclared include. */
@@ -50,32 +60,6 @@ declare function validateCustomRole(policy: Policy, role: CustomRole): CustomRol
  */
 declare function customRoleClaim(roles: readonly CustomRole[], policy?: Policy): Readonly<Record<string, readonly string[]>>;
 //#endregion
-//#region src/core/relations.d.ts
-type MemoryEdge = {
-  /** The object's id. */
-  readonly id: string;
-  readonly principal: string;
-  readonly startsAt?: number;
-  readonly expiresAt?: number;
-};
-type MemoryRelationsData = {
-  /** Rows per resource: parent pointers, links, restricted flags and relation columns are read from them. */
-  readonly rows?: Readonly<Record<string, readonly Readonly<Record<string, unknown>>[]>>;
-  /** Edge-table rows per resource and relation. */
-  readonly edges?: Readonly<Record<string, Readonly<Record<string, readonly MemoryEdge[]>>>>;
-  /**
-   * Edge tables as the database holds them, keyed by `edge` name: each row
-   * is read through the relation's `object`, `subject`, `expiresAt`, `match`
-   * and `groups` columns. A relation whose table is here ignores `edges`.
-   */
-  readonly tables?: Readonly<Record<string, readonly Readonly<Record<string, unknown>>[]>>;
-};
-/**
- * An in-process `RelationSource` over plain rows and edges, read against the
- * resource definitions in `permissions`. For tests, fixtures and small apps.
- */
-declare function memoryRelations(permissions: PermissionTree, data?: MemoryRelationsData): RelationSource;
-//#endregion
 //#region src/core/snapshot.d.ts
 declare function parseSnapshot(json: unknown): Snapshot;
 //#endregion
@@ -86,17 +70,13 @@ declare function fromSnapshot(snapshot: Snapshot, options?: {
 }): PermDock;
 declare function emptySnapshot(): Snapshot;
 //#endregion
-//#region src/conditions/refs.d.ts
-type KnownRefField = "id" | "issuer" | "kind" | "tenant" | "team" | "roles" | "plans" | "memberships" | "assurance" | "binding" | "session";
-type SubjectRef = ConditionRef & { readonly [K in KnownRefField]: SubjectRef; } & {
-  readonly [key: string]: SubjectRef;
-};
-declare const principal: SubjectRef;
-declare const context: SubjectRef;
-//#endregion
 //#region src/core/approval-required.d.ts
 declare function requiresApproval(approval: Grant["approval"] | undefined): boolean;
 //#endregion
+//#region src/core/policy.d.ts
+declare function definePolicy<TUser, TPrincipal extends Principal, const Input extends PermissionTree | PolicyVocabulary, const S extends PolicyScopesInput = PolicyScopesInput>(permissions: Input, options: DefinePolicyOptions<TUser, TPrincipal, S>): Policy<TUser, TPrincipal, VocabularyFromInput<Input>>;
+declare function separationConflicts(policy: Policy, memberships: readonly MembershipFixture[]): readonly SeparationConflict[];
+//#endregion
 //#region src/conditions/opaque.d.ts
 declare function opaque(input: {
   readonly sql: string;
@@ -109,6 +89,17 @@ declare function sqlFunction(name: string, options: {
   readonly twin: unknown;
 }): SqlFunctionCondition;
 //#endregion
+//#region src/core/memory-sources.d.ts
+declare function memoryEntitlementSource(entries: Readonly<Record<string, readonly string[]>>): EntitlementSource;
+declare function memorySettings(settings: Readonly<Record<string, TenantSettings>>): SettingsSource;
+/** Memberships keyed by principal id; `tenant` is not a filter, as for a database source. */
+declare function memoryMembershipSource(entries: Readonly<Record<string, readonly Membership[]>>): MembershipSource;
+/** A snapshot held in memory; `set` replaces it and notifies every subscriber. */
+declare function memorySnapshotSource(initial: Snapshot | string): SnapshotSource & {
+  set(snapshot: Snapshot | string): void;
+};
+declare function memoryRoleSource(customRoles: readonly CustomRole[]): RoleSource;
+//#endregion
 //#region src/core/memberships.d.ts
 /**
  * One `MembershipSource` over several: memberships are merged and
@@ -182,6 +173,32 @@ declare function memoryLimitStore(): LimitStore & {
   size(): number;
 };
 //#endregion
+//#region src/core/memory-relations.d.ts
+type MemoryEdge = {
+  /** The object's id. */
+  readonly id: string;
+  readonly principal: string;
+  readonly startsAt?: number;
+  readonly expiresAt?: number;
+};
+type MemoryRelationsData = {
+  /** Rows per resource: parent pointers, links, restricted flags and relation columns are read from them. */
+  readonly rows?: Readonly<Record<string, readonly Readonly<Record<string, unknown>>[]>>;
+  /** Edge-table rows per resource and relation. */
+  readonly edges?: Readonly<Record<string, Readonly<Record<string, readonly MemoryEdge[]>>>>;
+  /**
+   * Edge tables as the database holds them, keyed by `edge` name: each row
+   * is read through the relation's `object`, `subject`, `expiresAt`, `match`
+   * and `groups` columns. A relation whose table is here ignores `edges`.
+   */
+  readonly tables?: Readonly<Record<string, readonly Readonly<Record<string, unknown>>[]>>;
+};
+/**
+ * An in-process `RelationSource` over plain rows and edges, read against the
+ * resource definitions in `permissions`. For tests, fixtures and small apps.
+ */
+declare function memoryRelations(permissions: PermissionTree, data?: MemoryRelationsData): RelationSource;
+//#endregion
 //#region src/core/local-manifest.d.ts
 /**
  * What the policy grants, as JSON a device turns into snapshots from its own
@@ -253,7 +270,7 @@ type CustomRoleSourceOptions = {
  */
 declare function customRoleSource(reader: CustomRoleReader, options?: CustomRoleSourceOptions): RoleSource;
 //#endregion
-//#region src/core/instance.d.ts
+//#region src/core/instance-snapshot.d.ts
 type SnapshotInclude = readonly (Permission | {
   readonly [key: string]: unknown;
 })[];
@@ -283,6 +300,33 @@ type SnapshotForOptions = {
  */
 declare function snapshotFor<TUser, TPrincipal extends Principal = Principal, V extends PolicyVocabulary = PolicyVocabulary>(policy: Policy<TUser, TPrincipal, V>, user: TUser | Subject | null, options?: SnapshotForOptions): Snapshot;
 //#endregion
+//#region src/core/permissions.d.ts
+declare function definePermissions<const Input, PX = never, RX = never>(input: Input, options?: DefinePermissionsOptions<PX, RX>): InferPermissionTree<Input, "", PX> & ResourceXTree<RX>;
+//#endregion
+//#region src/core/permission-registry.d.ts
+declare function getResource<RX = never>(tree: PermissionTree & ResourceXTree<RX>, name: string): ([RX] extends [never] ? ResourceNode : ResourceNode & {
+  readonly meta?: ResourceMeta<Readonly<RX>>;
+}) | undefined;
+declare function listPermissions(tree: PermissionTree | Permission): readonly Permission[];
+declare function findPermission(tree: PermissionTree, keyOrScope: string): Permission | undefined;
+/**
+ * A permission leaf: string `key`, `scope`, `resource` and `action` plus an
+ * object `meta`. `kind` is non-enumerable and does not survive
+ * `JSON.stringify`, so a leaf that crossed a serialisation boundary passes
+ * without it; when present it must be `instance` or `collection`.
+ */
+declare function isPermission(value: unknown): value is Permission;
+declare function mergePermissions<const Trees extends readonly PermissionTree[]>(...trees: Trees): PermissionTree;
+//#endregion
+//#region src/core/permission-leaf.d.ts
+/**
+ * The keys `permission` was renamed from, sorted. Empty for a leaf without
+ * renames and for one that crossed a serialisation boundary.
+ */
+declare function formerKeys(permission: object): readonly string[];
+declare function resource<T, const A extends ActionList = readonly [], const C extends ActionList = readonly []>(schema: StandardSchemaV1<unknown, T>, options?: ResourceOptions<A, C>): ResourceInit<T, A, C>;
+declare function resource<const A extends ActionList = readonly [], const C extends ActionList = readonly []>(options: ResourceOptions<A, C>): ResourceInit<unknown, A, C>;
+//#endregion
 //#region src/core/presets.d.ts
 type ReadOnlyMeta = {
   readonly readOnly: true;
@@ -342,6 +386,25 @@ declare function crud<const A extends ActionList | undefined = undefined, const
 declare function readable<const A extends ActionList | undefined = undefined, const C extends ActionList | undefined = undefined>(options?: PresetOptions<A, C>): PresetResult<typeof READABLE_ACTIONS, typeof READABLE_COLLECTION, A, C>;
 declare function writable<const A extends ActionList | undefined = undefined, const C extends ActionList | undefined = undefined>(options?: PresetOptions<A, C>): PresetResult<typeof WRITABLE_ACTIONS, typeof WRITABLE_COLLECTION, A, C>;
 //#endregion
+//#region src/core/role-builder.d.ts
+type RoleGrants = readonly (Omit<Grant, "role" | "scope"> | readonly Omit<Grant, "role" | "scope">[])[];
+/** A role held at a named scope: `on` is checked against `definePolicy({ scopes })`. */
+declare function role<const S extends string>(name: string | Role, grants: RoleGrants, options: RoleOptions<S> & {
+  readonly on: S;
+}): RoleBinding<S>;
+/** A global role, or one held on a resource. */
+declare function role(name: string | Role, grants: RoleGrants, options?: RoleOptions<never>): RoleBinding<never>;
+/** Options built at runtime: the scope name is only checked by `definePolicy`. */
+declare function role(name: string | Role, grants: RoleGrants, options?: RoleOptions): RoleBinding;
+declare function normalizeAssurance(input: AssuranceRequirement | undefined): AssuranceRequirement | undefined;
+//#endregion
+//#region src/core/grant-builders.d.ts
+declare function allow<T, K extends PermissionKind = PermissionKind>(permission: Permission<string, T, K> | readonly Permission<string, T, K>[], condition?: GrantCondition<T, K>): Omit<Grant, "role" | "scope"> | Omit<Grant, "role" | "scope">[];
+declare function deny<T, K extends PermissionKind = PermissionKind>(permission: Permission<string, T, K> | readonly Permission<string, T, K>[], condition?: GrantCondition<T, K>): Omit<Grant, "role" | "scope"> | Omit<Grant, "role" | "scope">[];
+//#endregion
+//#region src/core/approval-normalize.d.ts
+declare function normalizeApproval(approval: ApprovalOption | undefined, permission?: string): Grant["approval"];
+//#endregion
 //#region src/core/duration.d.ts
 declare function parseDuration(input: unknown): number | undefined;
 //#endregion
@@ -392,6 +455,10 @@ type OcsfAuthorizeSession = {
     readonly source: DecisionEvent["source"];
     readonly phase?: DecisionEvent["phase"];
     readonly role?: string | null;
+    /** The matched grant's declared `name`. */
+    readonly grant?: string;
+    /** The names of the app obligations the decision carries. */
+    readonly obligations?: readonly string[];
     readonly via?: string | null;
     /** Set high-severity break-glass events apart in a SIEM. */
     readonly breakGlass?: true;
@@ -480,4 +547,4 @@ declare function coveredByDelegation(permission: DelegatedPermission, delegation
  */
 declare function delegatedPermissions(delegations: readonly PolicyDelegation[] | undefined, subject: Subject, heldRoles: ReadonlySet<string>, now: number): ReadonlySet<string> | undefined;
 //#endregion
-export { countHolders as A, MemoryEdge as B, mayAccess as C, fromStripeEntitlements as D, StripeEntitlementsClient as E, context as F, CustomRoleRename as G, memoryRelations as H, principal as I, customRoleClaim as J, CustomRoleValidation as K, emptySnapshot as L, sqlFunction as M, opaque as N, claimsFirst as O, requiresApproval as P, fromSnapshot as R, permittedIds as S, memoryLimitStore as T, CustomRoleDrop as U, MemoryRelationsData as V, CustomRoleDropReason as W, validateCustomRole as X, resolveCustomRole as Y, CustomRoleReader as _, toCsvRow as a, PermittedIdsOptions as b, OcsfAuthorizeSession as c, parseDuration as d, crud as f, snapshotFor as g, SnapshotForOptions as h, CSV_COLUMNS as i, isExternallyManaged as j, composeMemberships as k, accessToOcsf as l, writable as m, delegatedPermissions as n, OCSF_VERSION as o, readable as p, ResolvedCustomRole as q, catalogFingerprint as r, OcsfAccountChange as s, coveredByDelegation as t, toOcsf as u, CustomRoleSourceOptions as v, localSnapshotManifest as w, mayUse as x, customRoleSource as y, parseSnapshot as z };
+export { sqlFunction as $, CustomRoleReader as A, memoryRelations as B, getResource as C, definePermissions as D, mergePermissions as E, permittedIds as F, composeMemberships as G, StripeEntitlementsClient as H, mayAccess as I, memoryEntitlementSource as J, countHolders as K, localSnapshotManifest as L, customRoleSource as M, PermittedIdsOptions as N, SnapshotForOptions as O, mayUse as P, memorySnapshotSource as Q, MemoryEdge as R, findPermission as S, listPermissions as T, fromStripeEntitlements as U, memoryLimitStore as V, claimsFirst as W, memoryRoleSource as X, memoryMembershipSource as Y, memorySettings as Z, crud as _, toCsvRow as a, fromSnapshot as at, formerKeys as b, OcsfAuthorizeSession as c, CustomRoleDropReason as ct, parseDuration as d, ResolvedCustomRole as dt, opaque as et, normalizeApproval as f, customRoleClaim as ft, role as g, principal as gt, normalizeAssurance as h, context as ht, CSV_COLUMNS as i, emptySnapshot as it, CustomRoleSourceOptions as j, snapshotFor as k, accessToOcsf as l, CustomRoleRename as lt, deny as m, validateCustomRole as mt, delegatedPermissions as n, separationConflicts as nt, OCSF_VERSION as o, parseSnapshot as ot, allow as p, resolveCustomRole as pt, isExternallyManaged as q, catalogFingerprint as r, requiresApproval as rt, OcsfAccountChange as s, CustomRoleDrop as st, coveredByDelegation as t, definePolicy as tt, toOcsf as u, CustomRoleValidation as ut, readable as v, isPermission as w, resource as x, writable as y, MemoryRelationsData as z };