permdock 0.3.0 → 0.4.0

package/dist/{permdock-CbgvLnuo.js → permdock-L26udHSk.js}

@@ -1,27 +1,31 @@
-import { n as isReadonlyArray, r as sole, t as compact } from "./compact-y6vfu2_f.js";
+import { a as sole, n as isReadonlyArray, r as isRecord, t as compact } from "./compact-CAf557ZB.js";
 import { n as freezeDeep, t as freezeCopy } from "./freeze-CrU8nQeX.js";
-import { E as ownGet, T as isForbiddenKey, _ as listPermissions, a as formerKeys, c as getResource, d as isEdgeRelation, f as isFieldRelation, i as findPermission, m as isPrincipalRelation, o as formerScopes, r as expandRelation } from "./permissions-DVoF6dMt.js";
-import { a as hasConditionOp } from "./refs-KYb4ntaz.js";
-import { d as normalizeApproval, f as normalizeAssurance, g as applyQuota, i as declaredRoleNames$1, l as levelCondition, m as role, n as assertApprovalRelations, s as grantList, u as levelNames, v as normalizeWhere } from "./policy-xyWg7QdR.js";
-import { n as PermDockValidationError } from "./validation-error-CnjZ4t92.js";
-import { a as wireDenials } from "./problem-details-_AMOYz-w.js";
-import { a as deniedMessage, i as approvalMessage, n as PermDockDeniedError, t as PermDockApprovalRequiredError } from "./errors-Cz5zn0mW.js";
+import { n as isThenable, o as isForbiddenKey, s as ownGet, t as ignoreRejection } from "./thenable-QSmvt-vZ.js";
+import { a as hasConditionOp } from "./refs-f3imMjNW.js";
+import { d as assertApprovalRelations, l as applyQuota, m as normalizeWhere, n as role, p as normalizeApproval, t as normalizeAssurance } from "./role-builder-B4GbKM-i.js";
+import { n as PermDockValidationError } from "./validation-error-ZfUHbKvf.js";
+import { a as wireDenials } from "./problem-details-DECUnXAn.js";
+import { a as deniedMessage, i as approvalMessage, n as PermDockDeniedError, t as PermDockApprovalRequiredError } from "./errors-drnfxYtm.js";
 import { n as sameId } from "./ids-DC4V4CFu.js";
-import { a as normalizeMemberships, c as rootScope, d as scopeList, f as subjectForPermission, i as keepsPermission, l as scopeChain, m as tenantOf, o as resolveScope, s as rootMembershipId, u as scopeIdOf } from "./scopes-CVdPrWN-.js";
-import { a as whereFromGrants, c as rowIdOf, d as isArazzoSimulateInput, f as simulateArazzo, i as signSnapshot, l as rowValues, p as evaluateCondition, r as snapshotGrant, s as isRowPair, t as buildSnapshot } from "./snapshot-Enxd0n-s.js";
+import { i as readAppData } from "./app-data-CV8pqqMi.js";
+import { a as normalizeMemberships, c as rootScope, d as scopeList, f as subjectForPermission, i as keepsPermission, l as scopeChain, m as tenantOf, o as resolveScope, s as rootMembershipId, u as scopeIdOf } from "./scopes-tvpa34ep.js";
+import { _ as evaluateCondition, a as whereFromGrants, c as coversRequirements, d as isRowPair, f as rowIdOf, g as simulateArazzo, h as isArazzoSimulateInput, i as signSnapshot, l as delegatedPermissions, p as rowValues, r as snapshotGrant, s as coveredByDelegation, t as buildSnapshot, u as requiresStandIn } from "./snapshot-Dc9CHPME.js";
 import { t as parseDuration } from "./duration-xK2jGFVc.js";
-import { D as synthesiseRole, E as listRoles, S as findRole, _ as resourceRoleCondition, a as authenticated, d as matchGrantee, i as assurance, m as relationCondition, o as combineWhere, r as asGrantee, s as flattenGrantee, w as isRole } from "./grantee-Cv5Sogfv.js";
-import { t as canonicalJson } from "./canonical-json-DemiK4Vp.js";
-import { n as pickVisible, r as sanitizeContext, t as grantCoversField } from "./fields-BMl1RxoX.js";
-import { a as isMembershipExpired, d as partitionsOf, f as relatesTo, g as tenantsOf, h as scopeField, i as inTeam, o as matchScopedMembership, p as resolveActiveTenant, r as heldRoleNamesIn, t as isActive, u as nowSeconds } from "./validity-uOp8UpYn.js";
+import { a as getResource, c as listPermissions, g as formerScopes, h as formerKeys, n as findPermission } from "./permission-registry-BsblpB-z.js";
+import { a as expandRelation, c as isEdgeRelation, l as isFieldRelation, u as isPrincipalRelation } from "./resource-relations-D1Un3pcz.js";
+import { a as authenticated, b as synthesiseRole, g as isRole, i as assurance, m as findRole, o as flattenGrantee, r as asGrantee, v as listRoles, x as treeXSchema, y as sourceRoleMeta } from "./grantee-CXY-0C87.js";
+import { a as sanitizeContext, i as pickVisible, r as grantCoversField, t as isActive } from "./validity-dVrUEPJt.js";
+import { t as canonicalJson } from "./canonical-json-CFKyFOke.js";
+import { o as resourceRoleCondition, r as relationCondition } from "./grantee-conditions-MQs5NIuX.js";
+import { c as nowSeconds, d as resolveActiveTenant, i as matchScopedMembership, l as partitionsOf, m as tenantsOf, n as inTeam, p as scopeField, r as isMembershipExpired, t as heldRoleNamesIn, u as relatesTo } from "./tenancy-DshjqY0n.js";
+import { a as declaredRoleNames, c as levelCondition, f as policyX, l as levelNames, r as mergeHostedGrants, s as grantList, t as isPortableCondition } from "./hosted-CBHgkzDl.js";
 import { t as requiresApproval } from "./approval-required-TzNB9oQA.js";
-import { r as mergeHostedGrants, t as isPortableCondition } from "./hosted-DJQw46hn.js";
-import { n as isThenable, t as ignoreRejection } from "./thenable-okc2xDsj.js";
 import { t as byCodePoint } from "./compare-pfyVnBjE.js";
-import { a as relationWalk, i as relationReader, n as pendingRelations, o as resolveRelated, r as relationId } from "./relations-cjOL01hZ.js";
-import { i as requiresStandIn, n as coversRequirements, r as delegatedPermissions, t as coveredByDelegation } from "./delegation-D8pUEuce.js";
+import { n as relationId, r as relationReader, t as pendingRelations } from "./relations-CvmSpG67.js";
+import { n as matchGrantee, t as combineWhere } from "./grantee-match-fxYp9Nmt.js";
 import { t as resourceIdOf } from "./resource-ref-CaS9yVPi.js";
-import { n as payloadDigest, r as versionOf, t as decisionToken } from "./token-CIWxJOCh.js";
+import { n as payloadDigest, r as versionOf, t as decisionToken } from "./token-Bx9qy30p.js";
+import { n as resolveRelated, t as relationWalk } from "./relation-walk-BXnlLtg2.js";
 import { i as isSubject, r as isPrincipal, t as anonymousSubject } from "./subject-C6dLxqHU.js";
 //#region src/core/approval-policies.ts
 /** The denial detail when an `ApprovalPolicySource` fails: every call an allow would grant denies with reason `approval`. */
@@ -32,9 +36,6 @@ function memoryApprovalPolicies(policies) {
 		return entries.filter((entry) => entry.tenant === void 0 || query.tenants.includes(entry.tenant));
 	} });
 }
-function isRecord(value) {
-	return value !== null && typeof value === "object" && !Array.isArray(value);
-}
 function isStringList(value) {
 	return Array.isArray(value) && value.every((item) => typeof item === "string");
 }
@@ -458,7 +459,7 @@ function resolveCustomRole(policy, role) {
 	const ceiling = ceilingGrants(policy, scope);
 	const ceilingSet = new Set(ceiling);
 	const ceilingKeys = new Set(ceiling.map((grant) => grant.permission.key));
-	const declared = declaredRoleNames$1(policy);
+	const declared = declaredRoleNames(policy);
 	const all = grantList(policy).filter((grant) => grant.hosted === void 0);
 	const dropped = [];
 	const renamed = [];
@@ -607,7 +608,7 @@ function wellFormed(role) {
 }
 /** Every custom role's resolved grants, once per instance. Malformed roles resolve to nothing. */
 function customGrantsFor(policy, roles) {
-	const declared = declaredRoleNames$1(policy);
+	const declared = declaredRoleNames(policy);
 	const out = [];
 	for (const role of roles) {
 		if (!wellFormed(role) || declared.has(role.name)) continue;
@@ -620,7 +621,7 @@ function customGrantsFor(policy, roles) {
 }
 /** The well-formed tenant (not platform) custom roles; a declared role name is never one. */
 function tenantCustomRoles(policy, roles) {
-	const declared = declaredRoleNames$1(policy);
+	const declared = declaredRoleNames(policy);
 	return roles.filter((role) => wellFormed(role) && !isGlobalCustomRole(role) && !declared.has(role.name));
 }
 /** A membership at the role's scope, inside its tenant (and instance, when pinned), naming it. */
@@ -893,6 +894,63 @@ function activate(policy, subject, input, now = nowSeconds()) {
 	});
 }
 //#endregion
+//#region src/core/evaluation-alternatives.ts
+function alternativesFor(evaluate, policy, permission, subject, now, env) {
+	return listPermissions(policy.permissions).filter((leaf) => leaf.resource === permission.resource && leaf.key !== permission.key).filter((leaf) => {
+		return evaluate(policy, subject, leaf, void 0, {
+			trusted: true,
+			source: "simulate",
+			now
+		}, {
+			...env,
+			emit: false,
+			skipAlternatives: true,
+			outcomeOnly: true
+		}).outcome === "granted";
+	});
+}
+function inheritedVerdict(evaluate, policy, subject, resource, id, key, now, env) {
+	const leaf = findPermission(policy.permissions, key);
+	const loaded = env.relations?.row({
+		resource,
+		id
+	});
+	if (leaf === void 0 || loaded === void 0) return "relation-unavailable";
+	if (loaded === "pending" || loaded === "failed") return "relation-unavailable";
+	if (loaded.row === null) return false;
+	const decision = evaluate(policy, subject, leaf, loaded.row, {
+		trusted: true,
+		source: "simulate",
+		now
+	}, {
+		...env,
+		emit: false,
+		skipAlternatives: true,
+		outcomeOnly: true
+	});
+	if (decision.outcome === "granted") return true;
+	const reasons = decision.outcome === "denied" ? decision.denials.map((denial) => denial.reason) : [];
+	return reasons.includes("relation-unavailable") ? "relation-unavailable" : reasons.includes("relation-depth") ? "relation-depth" : false;
+}
+//#endregion
+//#region src/core/evaluation-trace.ts
+function skip(tracer, grant, permissionKey, why) {
+	tracer?.skipped.push({
+		role: grant.role,
+		permission: permissionKey,
+		effect: grant.effect,
+		why
+	});
+}
+function traceOf(tracer) {
+	return {
+		evaluated: tracer.evaluated,
+		allows: tracer.allows,
+		denies: tracer.denies,
+		skipped: tracer.skipped
+	};
+}
+//#endregion
 //#region src/core/events.ts
 function emitSafe(listeners, payload, errors) {
 	for (const listener of listeners) try {
@@ -958,15 +1016,20 @@ function finish(policy, subject, permission, data, decision, options, env, trust
 		matched: decision.outcome === "granted" ? compact({
 			role: decision.matched.role,
 			permission: decision.matched.permission,
+			name: decision.matched.name,
+			meta: decision.matched.meta,
 			to: decision.matched.to,
 			hosted: decision.matched.hosted,
 			breakGlass: decision.matched.breakGlass
 		}) : decision.outcome === "approval-required" ? compact({
 			role: decision.grant.role,
 			permission: decision.grant.permission,
+			name: decision.grant.name,
+			meta: decision.grant.meta,
 			to: decision.grant.to,
 			hosted: decision.grant.hosted
 		}) : void 0,
+		obligations: decision.outcome === "granted" && (decision.obligations?.length ?? 0) > 0 ? decision.obligations : void 0,
 		purpose: Array.isArray(subject.context["purpose"]) && subject.context["purpose"].length > 0 ? subject.context["purpose"] : void 0,
 		reason: typeof subject.context["reason"] === "string" && subject.context["reason"] !== "" ? subject.context["reason"] : void 0,
 		denials: decision.outcome === "denied" ? wireDenials(decision.denials) : void 0,
@@ -990,59 +1053,132 @@ function finish(policy, subject, permission, data, decision, options, env, trust
 	}
 }
 //#endregion
-//#region src/core/validation.ts
-function validateBoundary(permission, resource, data, mode, trusted, boundary = "manual") {
-	if (!(mode === "always" || mode === "boundary" && !trusted)) return data;
-	if (resource?.schema === void 0) {
-		if (mode === "always") throw new PermDockValidationError({
-			code: "no-schema",
-			permission: permission.key,
-			resource: permission.resource,
-			boundary,
-			message: `${permission.key}: no schema for resource ${permission.resource}.`
+//#region src/core/grant-conditions.ts
+function evaluateGrantCondition(grant, permission, current, next, subject, now, scopes, relations, permitted) {
+	let unknown;
+	const onOpaque = () => {
+		unknown ??= "opaque-condition";
+	};
+	const related = (condition, row) => {
+		if (relations === void 0) {
+			unknown ??= "relation-unavailable";
+			return false;
+		}
+		const verdict = resolveRelated(condition, row, subject, now, relations, permitted);
+		if (verdict === "relation-depth" || verdict === "relation-unavailable") {
+			unknown ??= verdict;
+			return false;
+		}
+		return verdict;
+	};
+	if (!grant.portable && grant.closure !== void 0) try {
+		const result = grant.closure(next ?? current, {
+			subject,
+			actor: subject.actor,
+			delegation: subject.delegation,
+			context: subject.context
 		});
-		return data;
+		if (isThenable(result)) return {
+			matched: false,
+			reason: "closure-error",
+			cause: result
+		};
+		return { matched: result === true };
+	} catch (error) {
+		return {
+			matched: false,
+			reason: "closure-error",
+			cause: error
+		};
 	}
-	const result = resource.schema["~standard"].validate(data);
-	if (isThenable(result)) {
-		ignoreRejection(result);
-		throw new PermDockValidationError({
-			code: "async-schema",
-			permission: permission.key,
-			resource: permission.resource,
-			boundary,
-			message: `${permission.key}: schema for ${permission.resource} is async.`
-		});
+	if (grant.where !== void 0) {
+		if (permission.kind === "collection") return {
+			matched: false,
+			reason: "condition"
+		};
+		if (current === void 0) return {
+			matched: false,
+			reason: "condition"
+		};
+		if (grant.where.op === "opaque" || grant.check?.op === "opaque") return {
+			matched: false,
+			reason: "opaque-condition"
+		};
+		const matched = evaluateCondition(grant.where, current, subject, now, scopes, related, onOpaque);
+		if (unknown !== void 0) return {
+			matched: false,
+			reason: unknown
+		};
+		if (!matched) return {
+			matched: false,
+			reason: "condition"
+		};
 	}
-	if ("issues" in result && result.issues !== void 0) throw new PermDockValidationError({
-		code: "invalid-data",
-		permission: permission.key,
-		resource: permission.resource,
-		issues: result.issues,
-		boundary,
-		message: validationMessage(permission, resource, result.issues)
-	});
-	return result.value;
+	const checkCondition = grant.check ?? (permission.action === "update" ? grant.where : void 0);
+	if (checkCondition !== void 0) {
+		if (checkCondition.op === "opaque") return {
+			matched: false,
+			reason: "opaque-condition"
+		};
+		if (next === void 0) return {
+			matched: false,
+			reason: "condition"
+		};
+		const matched = evaluateCondition(checkCondition, next, subject, now, scopes, related, onOpaque);
+		if (unknown !== void 0) return {
+			matched: false,
+			reason: unknown
+		};
+		if (!matched) return {
+			matched: false,
+			reason: "condition"
+		};
+	}
+	return { matched: true };
 }
-function validationMessage(permission, resource, issues) {
-	const parts = issues.map((issue) => {
-		const path = issue.path?.map((item) => typeof item === "object" && "key" in item ? String(item.key) : String(item)).join(".") ?? "/";
-		return `invalid ${resource.name} data at ${path}: ${issue.message}`;
+/** A grant whose condition could not be answered; a deny with one denies. */
+function isUnevaluable(reason) {
+	return reason === "relation-depth" || reason === "relation-unavailable" || reason === "closure-error" || reason === "opaque-condition";
+}
+function shouldConsumeQuota(source, simulated) {
+	if (simulated) return false;
+	switch (source) {
+		case "can":
+		case "filter":
+		case "simulate":
+		case "explain": return false;
+		case "decide":
+		case "assert":
+		case "endpoint":
+		case "adapter":
+		case "approval":
+		case void 0: return true;
+		default: return source;
+	}
+}
+function isDelegatedPermission(policy, permission) {
+	const providers = policy.providers;
+	if (providers === void 0 || providers.length === 0) return false;
+	for (const provider of providers) if (provider.handles(permission)) return true;
+	return false;
+}
+/** The `MatchedGrant` view of a grant, shared by `matched` and the trace. */
+function matchedOf(grant, permissionKey, breakGlass) {
+	return compact({
+		role: grant.role,
+		permission: permissionKey,
+		name: grant.name,
+		meta: grant.meta,
+		to: grant.to,
+		where: grant.where,
+		check: grant.check,
+		approval: grant.approval,
+		hosted: grant.hosted,
+		breakGlass
 	});
-	return `${permission.key}: ${parts.join("; ")}.`;
 }
 //#endregion
-//#region src/core/evaluate.ts
-/**
-* A collection write proposes `next`; an update pair may move `next` out of
-* the scope `current` is in. Both must stay in scope.
-*/
-function matchWriteScope(match, instance, current, next) {
-	const first = match(instance ? current : next);
-	if (!first.ok || !instance || next === current) return first;
-	const moved = match(next);
-	return moved.ok ? first : moved;
-}
+//#region src/core/role-loading.ts
 function isGlobalRole(value) {
 	return value !== null && typeof value === "object" && Reflect.get(value, "scope") === "global";
 }
@@ -1136,13 +1272,12 @@ function expandRoleNames(names, declared, custom, tenant) {
 		unknown
 	};
 }
-function declaredRoleNames(policy) {
-	return policy.index.declaredRoles;
-}
-const NEVER = {
+//#endregion
+//#region src/core/requires-conditions.ts
+const NEVER = freezeDeep({
 	op: "or",
 	conditions: []
-};
+});
 function isUnconditionedAllow(grant, now) {
 	return grant.where === void 0 && grant.check === void 0 && grant.closure === void 0 && grant.portable && grant.purpose === void 0 && grant.viaOnly === void 0 && grant.requires === void 0 && isActive(grant.validity, now);
 }
@@ -1220,277 +1355,165 @@ function keyRequirement(policy, subject, key, resource, now, customRoles, custom
 		conditions: parts
 	};
 }
-function alternativesFor(policy, permission, subject, now, env) {
-	return listPermissions(policy.permissions).filter((leaf) => leaf.resource === permission.resource && leaf.key !== permission.key).filter((leaf) => {
-		return evaluate(policy, subject, leaf, void 0, {
-			trusted: true,
-			source: "simulate",
-			now
-		}, {
-			...env,
-			emit: false,
-			skipAlternatives: true,
-			outcomeOnly: true
-		}).outcome === "granted";
-	});
-}
-function inheritedVerdict(policy, subject, resource, id, key, now, env) {
-	const leaf = findPermission(policy.permissions, key);
-	const loaded = env.relations?.row({
-		resource,
-		id
-	});
-	if (leaf === void 0 || loaded === void 0) return "relation-unavailable";
-	if (loaded === "pending" || loaded === "failed") return "relation-unavailable";
-	if (loaded.row === null) return false;
-	const decision = evaluate(policy, subject, leaf, loaded.row, {
-		trusted: true,
-		source: "simulate",
-		now
-	}, {
-		...env,
-		emit: false,
-		skipAlternatives: true,
-		outcomeOnly: true
-	});
-	if (decision.outcome === "granted") return true;
-	const reasons = decision.outcome === "denied" ? decision.denials.map((denial) => denial.reason) : [];
-	return reasons.includes("relation-unavailable") ? "relation-unavailable" : reasons.includes("relation-depth") ? "relation-depth" : false;
-}
-function evaluateGrantCondition(grant, permission, current, next, subject, now, scopes, relations, permitted) {
-	let unknown;
-	const onOpaque = () => {
-		unknown ??= "opaque-condition";
-	};
-	const related = (condition, row) => {
-		if (relations === void 0) {
-			unknown ??= "relation-unavailable";
-			return false;
-		}
-		const verdict = resolveRelated(condition, row, subject, now, relations, permitted);
-		if (verdict === "relation-depth" || verdict === "relation-unavailable") {
-			unknown ??= verdict;
-			return false;
-		}
-		return verdict;
-	};
-	if (!grant.portable && grant.closure !== void 0) try {
-		const result = grant.closure(next ?? current, {
-			subject,
-			actor: subject.actor,
-			delegation: subject.delegation,
-			context: subject.context
+//#endregion
+//#region src/core/validation.ts
+function validateBoundary(permission, resource, data, mode, trusted, boundary = "manual") {
+	if (!(mode === "always" || mode === "boundary" && !trusted)) return data;
+	if (resource?.schema === void 0) {
+		if (mode === "always") throw new PermDockValidationError({
+			code: "no-schema",
+			permission: permission.key,
+			resource: permission.resource,
+			boundary,
+			message: `${permission.key}: no schema for resource ${permission.resource}.`
 		});
-		if (isThenable(result)) return {
-			matched: false,
-			reason: "closure-error",
-			cause: result
-		};
-		return { matched: result === true };
-	} catch (error) {
-		return {
-			matched: false,
-			reason: "closure-error",
-			cause: error
-		};
-	}
-	if (grant.where !== void 0) {
-		if (permission.kind === "collection") return {
-			matched: false,
-			reason: "condition"
-		};
-		if (current === void 0) return {
-			matched: false,
-			reason: "condition"
-		};
-		if (grant.where.op === "opaque" || grant.check?.op === "opaque") return {
-			matched: false,
-			reason: "opaque-condition"
-		};
-		const matched = evaluateCondition(grant.where, current, subject, now, scopes, related, onOpaque);
-		if (unknown !== void 0) return {
-			matched: false,
-			reason: unknown
-		};
-		if (!matched) return {
-			matched: false,
-			reason: "condition"
-		};
+		return data;
 	}
-	const checkCondition = grant.check ?? (permission.action === "update" ? grant.where : void 0);
-	if (checkCondition !== void 0) {
-		if (checkCondition.op === "opaque") return {
-			matched: false,
-			reason: "opaque-condition"
-		};
-		if (next === void 0) return {
-			matched: false,
-			reason: "condition"
-		};
-		const matched = evaluateCondition(checkCondition, next, subject, now, scopes, related, onOpaque);
-		if (unknown !== void 0) return {
-			matched: false,
-			reason: unknown
-		};
-		if (!matched) return {
-			matched: false,
-			reason: "condition"
-		};
+	const result = resource.schema["~standard"].validate(data);
+	if (isThenable(result)) {
+		ignoreRejection(result);
+		throw new PermDockValidationError({
+			code: "async-schema",
+			permission: permission.key,
+			resource: permission.resource,
+			boundary,
+			message: `${permission.key}: schema for ${permission.resource} is async.`
+		});
 	}
-	return { matched: true };
-}
-/** A grant whose condition could not be answered; a deny with one denies. */
-function isUnevaluable(reason) {
-	return reason === "relation-depth" || reason === "relation-unavailable" || reason === "closure-error" || reason === "opaque-condition";
+	if ("issues" in result && result.issues !== void 0) throw new PermDockValidationError({
+		code: "invalid-data",
+		permission: permission.key,
+		resource: permission.resource,
+		issues: result.issues,
+		boundary,
+		message: validationMessage(permission, resource, result.issues)
+	});
+	return result.value;
 }
-function shouldConsumeQuota(source, simulated) {
-	if (simulated) return false;
-	switch (source) {
-		case "can":
-		case "filter":
-		case "simulate":
-		case "explain": return false;
-		case "decide":
-		case "assert":
-		case "endpoint":
-		case "adapter":
-		case "approval":
-		case void 0: return true;
-		default: return source;
-	}
+function validationMessage(permission, resource, issues) {
+	const parts = issues.map((issue) => {
+		const path = issue.path?.map((item) => typeof item === "object" && "key" in item ? String(item.key) : String(item)).join(".") ?? "/";
+		return `invalid ${resource.name} data at ${path}: ${issue.message}`;
+	});
+	return `${permission.key}: ${parts.join("; ")}.`;
 }
-function isDelegatedPermission(policy, permission) {
-	const providers = policy.providers;
-	if (providers === void 0 || providers.length === 0) return false;
-	for (const provider of providers) if (provider.handles(permission)) return true;
-	return false;
+//#endregion
+//#region src/core/evaluate.ts
+/**
+* A collection write proposes `next`; an update pair may move `next` out of
+* the scope `current` is in. Both must stay in scope.
+*/
+function matchWriteScope(match, instance, current, next) {
+	const first = match(instance ? current : next);
+	if (!first.ok || !instance || next === current) return first;
+	const moved = match(next);
+	return moved.ok ? first : moved;
 }
-/** The `MatchedGrant` view of a grant, shared by `matched` and the trace. */
-function matchedOf(grant, permissionKey, breakGlass) {
-	return compact({
-		role: grant.role,
-		permission: permissionKey,
-		name: grant.name,
-		to: grant.to,
-		where: grant.where,
-		check: grant.check,
-		approval: grant.approval,
-		hosted: grant.hosted,
-		breakGlass
+function complete(call, raw, membership) {
+	const { env, permission, tracer } = call;
+	const decision = env.outcomeOnly !== true && raw.outcome === "denied" && raw.permission === void 0 ? {
+		...raw,
+		permission: permission.key
+	} : raw;
+	const final = env.outcomeOnly === true ? decision : freezeDeep(tracer === void 0 ? decision : {
+		...decision,
+		trace: traceOf(tracer)
 	});
+	finish(call.policy, call.given, permission, call.current, final, call.options, env, call.options.trusted === true, membership);
+	return final;
 }
-function skip(tracer, grant, permissionKey, why) {
-	tracer?.skipped.push({
-		role: grant.role,
-		permission: permissionKey,
-		effect: grant.effect,
-		why
+function deniedNow(call, denial) {
+	return complete(call, {
+		outcome: "denied",
+		denials: [denial],
+		alternatives: []
 	});
 }
-function traceOf(tracer) {
-	return {
-		evaluated: tracer.evaluated,
-		allows: tracer.allows,
-		denies: tracer.denies,
-		skipped: tracer.skipped
-	};
+function deniedWithAlternatives(state, denials) {
+	return complete(state, {
+		outcome: "denied",
+		denials,
+		alternatives: state.env.skipAlternatives ? [] : alternativesFor(evaluate, state.policy, state.permission, state.subject, state.now, state.env)
+	});
 }
-function evaluate(policy, given, permission, data, options, env) {
-	const subject = subjectForPermission(given, permission.key);
-	const now = options.now ?? nowSeconds();
-	const trusted = options.trusted === true;
-	const resource = getResource(policy.permissions, permission.resource);
-	let { current, next } = rowValues(permission, data);
-	const tracer = options.explain === true ? {
-		evaluated: 0,
-		allows: [],
-		denies: [],
-		skipped: []
-	} : void 0;
-	const complete = (decision, membership) => {
-		const final = env.outcomeOnly === true ? decision : freezeDeep(tracer === void 0 ? decision : {
-			...decision,
-			trace: traceOf(tracer)
-		});
-		finish(policy, given, permission, current, final, options, env, trusted, membership);
-		return final;
-	};
+/** The rows after boundary validation; on `invalid`, the rows validated before the failure. */
+function validatedRows(call, data, rows) {
+	const { permission, policy, options } = call;
+	if (data === void 0 && !(permission.kind === "instance" && policy.validate === "always")) return rows;
+	const check = (value) => validateBoundary(permission, call.resource, value, policy.validate, options.trusted === true, options.boundary ?? "manual");
+	let current = rows.current;
 	try {
-		if (data !== void 0 || permission.kind === "instance" && policy.validate === "always") {
-			const validated = validateBoundary(permission, resource, permission.kind === "instance" && isRowPair(data) ? data.current : data, policy.validate, trusted, options.boundary ?? "manual");
-			if (permission.kind === "instance" && isRowPair(data)) {
-				current = validated;
-				next = validateBoundary(permission, resource, data.next, policy.validate, trusted, options.boundary ?? "manual");
-			} else if (permission.kind === "instance") {
-				current = validated;
-				next = validated;
-			} else next = validated;
+		if (permission.kind === "instance" && isRowPair(data)) {
+			current = check(data.current);
+			return {
+				current,
+				next: check(data.next)
+			};
 		}
+		const validated = check(data);
+		return permission.kind === "instance" ? {
+			current: validated,
+			next: validated
+		} : {
+			current,
+			next: validated
+		};
 	} catch (error) {
-		if (error instanceof PermDockValidationError && error.code === "invalid-data") return complete({
-			outcome: "denied",
-			denials: [{
-				role: null,
-				reason: "validation",
-				detail: error
-			}],
-			alternatives: []
-		});
+		if (error instanceof PermDockValidationError && error.code === "invalid-data") return {
+			current,
+			next: rows.next,
+			invalid: error
+		};
 		throw error;
 	}
-	if (isDelegatedPermission(policy, permission)) return complete({
-		outcome: "denied",
-		denials: [{
-			role: null,
-			reason: "pdp-unavailable",
-			detail: "use permdock/pdp createPermDock"
-		}],
-		alternatives: []
-	});
-	const scopes = scopeList(policy.scopes);
-	const declared = declaredRoleNames(policy);
-	const principalRoles = subject.principal?.roles ?? [];
-	const globalNames = expandRoleNames(principalRoles, declared, env.customRoles, subject.principal?.tenant);
-	if (subject.principal !== null && globalNames.unknown.length > 0) emitSafe(env.listeners.auth, {
+}
+function heldRoles(call, scopes, declared) {
+	const { subject, env } = call;
+	const global = expandRoleNames(subject.principal?.roles ?? [], declared, env.customRoles, subject.principal?.tenant);
+	if (subject.principal !== null && global.unknown.length > 0) emitSafe(env.listeners.auth, {
 		reason: "unknown-role",
 		source: "roles"
 	}, env.listeners);
+	const matching = new Set(global.roles);
 	const denials = [];
-	const allows = [];
-	const matchingRoles = new Set(globalNames.roles);
 	for (const membership of subject.principal?.memberships ?? []) {
 		if (!inTeam(membership, scopes, env.team)) continue;
 		const expanded = expandRoleNames(membership.roles, declared, env.customRoles, tenantOf(membership, scopes));
-		for (const name of expanded.roles) matchingRoles.add(name);
+		for (const name of expanded.roles) matching.add(name);
 		for (const name of expanded.unknown) denials.push({
 			role: name,
 			reason: "unknown-role"
 		});
 	}
-	const actorVias = actorRequiredVias(policy.index.supports);
-	if (actorVias.size > 0 && subject.actor === void 0 && (subject.principal?.memberships ?? []).some((membership) => isSupportMembership(membership, actorVias) && !isMembershipExpired(membership, now) && inTeam(membership, scopes, env.team))) return complete({
-		outcome: "denied",
-		denials: [{
-			role: null,
-			reason: "actor-required"
-		}],
-		alternatives: []
-	});
-	const purposes = purposesOf(subject);
-	const forPermission = policy.index.grantsByKey.get(permission.key) ?? [];
-	const candidates = forPermission.filter((grant) => grant.breakGlass === void 0).map((grant) => ({ grant }));
-	for (const item of env.customGrants) if (item.grant.permission.key === permission.key) candidates.push({
+	return {
+		global,
+		matching,
+		denials
+	};
+}
+/** A support membership the policy says needs an actor, held without one. */
+function lacksActor(call, scopes) {
+	const { subject, now, env } = call;
+	const actorVias = actorRequiredVias(call.policy.index.supports);
+	return actorVias.size > 0 && subject.actor === void 0 && (subject.principal?.memberships ?? []).some((membership) => isSupportMembership(membership, actorVias) && !isMembershipExpired(membership, now) && inTeam(membership, scopes, env.team));
+}
+function candidatesFor(call) {
+	const { permission } = call;
+	const candidates = (call.policy.index.grantsByKey.get(permission.key) ?? []).filter((grant) => grant.breakGlass === void 0).map((grant) => ({ grant }));
+	for (const item of call.env.customGrants) if (item.grant.permission.key === permission.key) candidates.push({
 		grant: item.grant,
 		custom: item.role
 	});
-	let breakGlassGrant;
-	let breakGlassObligations = [];
-	const breakGlassOverrides = /* @__PURE__ */ new Set();
-	let breakGlassDenial;
-	for (const grant of forPermission) {
+	return candidates;
+}
+function breakGlassFor(call, scopes) {
+	const { permission, subject, now, tracer } = call;
+	const overrides = /* @__PURE__ */ new Set();
+	let denial;
+	for (const grant of call.policy.index.grantsByKey.get(permission.key) ?? []) {
 		if (grant.breakGlass === void 0) continue;
 		if (tracer !== void 0) tracer.evaluated += 1;
-		if (!matchGrantee(grant.to, subject, now, resource, scopes).matched) {
+		if (!matchGrantee(grant.to, subject, now, call.resource, scopes).matched) {
 			skip(tracer, grant, permission.key, "grantee");
 			continue;
 		}
@@ -1499,13 +1522,14 @@ function evaluate(policy, given, permission, data, options, env) {
 			skip(tracer, grant, permission.key, "break-glass-inactive");
 			continue;
 		}
-		for (const name of grant.breakGlass.overrides) breakGlassOverrides.add(name);
-		if (result.kind === "granted") {
-			breakGlassGrant = grant;
-			breakGlassObligations = result.obligations;
-			break;
-		}
-		breakGlassDenial ??= result.reason === "insufficient-user-authentication" ? {
+		for (const name of grant.breakGlass.overrides) overrides.add(name);
+		if (result.kind === "granted") return {
+			grant,
+			obligations: result.obligations,
+			overrides,
+			denial
+		};
+		denial ??= result.reason === "insufficient-user-authentication" ? {
 			role: null,
 			reason: result.reason,
 			to: result.to
@@ -1514,241 +1538,231 @@ function evaluate(policy, given, permission, data, options, env) {
 			reason: result.reason
 		};
 	}
-	const holdsCustom = (custom) => isGlobalCustomRole(custom) ? holdsGlobalCustomRole(principalRoles, custom) : (subject.principal?.memberships ?? []).some((membership) => inTeam(membership, scopes, env.team) && holdsCustomRole(membership, custom, scopes));
-	const walkRole = env.relations?.available === true ? (membership, row) => {
+	return {
+		grant: void 0,
+		obligations: [],
+		overrides,
+		denial
+	};
+}
+function walkRoleFor(call) {
+	const { env } = call;
+	if (env.relations?.available !== true) return;
+	return (membership, row) => {
 		const on = membership.on;
-		const condition = on === void 0 ? void 0 : resourceRoleCondition(resource, on.resource, [on.id], policy.resources);
-		return condition === void 0 || env.relations === void 0 ? false : resolveRelated(condition, row, subject, now, env.relations);
-	} : void 0;
-	for (const { grant, custom } of candidates) {
-		const displayRole = grant.role;
-		if (tracer !== void 0) tracer.evaluated += 1;
-		if (grant.viaOnly !== void 0 && !(subject.principal?.memberships ?? []).some((membership) => membership.via === grant.viaOnly && !isMembershipExpired(membership, now) && inTeam(membership, scopes, env.team))) {
-			skip(tracer, grant, permission.key, "via-only");
-			continue;
-		}
-		const required = grant.purpose;
-		if (required !== void 0 && !purposes.some((purpose) => required.includes(purpose))) {
-			skip(tracer, grant, permission.key, "purpose");
-			continue;
-		}
-		const granteeMatch = matchGrantee(grant.to, subject, now, resource, scopes, policy.resources, grant.effect === "deny");
-		if (!granteeMatch.matched) {
-			const reason = granteeMatch.reason ?? "no-grant";
-			if (reason === "not-entitled" && !flattenGrantee(grant.to).every((item) => item.kind !== "role" || (custom === void 0 ? item.scope === "global" ? globalNames.roles.includes(item.role) : matchingRoles.has(item.role) : holdsCustom(custom)))) {
-				skip(tracer, grant, permission.key, "grantee");
-				continue;
-			}
-			denials.push((reason === "insufficient-user-authentication" || reason === "not-entitled") && grant.to !== void 0 ? {
-				role: displayRole,
-				reason,
-				to: grant.to
-			} : {
-				role: displayRole,
-				reason
-			});
-			continue;
-		}
-		const roleItems = flattenGrantee(grant.to).filter((item) => item.kind === "role");
-		let scopeMembership;
-		let roleOk = roleItems.length === 0;
-		if (roleItems.length > 0) {
-			if (subject.principal === null) {
-				denials.push({
-					role: displayRole,
-					reason: "anonymous"
-				});
-				continue;
-			}
-			let allHeld = true;
-			for (const roleItem of roleItems) {
-				if (!(custom === void 0 ? roleItem.scope === "global" ? globalNames.roles.includes(roleItem.role) : matchingRoles.has(roleItem.role) : holdsCustom(custom))) {
-					skip(tracer, grant, permission.key, "role");
-					allHeld = false;
-					break;
-				}
-				const matchRow = (row) => matchScopedMembership(subject, roleItem.scope, roleItem.role, row, scopes, resource, policy.resources, now, (membership) => {
-					if (custom === void 0) return expandRoleNames(membership.roles, declared, env.customRoles, tenantOf(membership, scopes)).roles;
-					return holdsCustomRole(membership, custom, scopes) ? [custom.name] : [];
-				}, env.team, walkRole, permission.kind === "instance", options.scope);
-				const scopeMatch = matchWriteScope(matchRow, permission.kind === "instance", current, next);
-				if (!scopeMatch.ok) {
-					denials.push({
-						role: roleItem.role,
-						reason: scopeMatch.reason
-					});
-					allHeld = false;
-					break;
-				}
-				scopeMembership = scopeMatch.membership ?? scopeMembership;
-			}
-			roleOk = allHeld;
-		}
-		if (!roleOk) continue;
-		if (!isActive(grant.validity, now)) {
-			if (grant.effect === "allow") denials.push({
-				role: displayRole,
-				reason: "inactive-grant",
-				detail: grant.validity
-			});
-			else skip(tracer, grant, permission.key, "validity");
-			continue;
-		}
-		const requirement = grant.requires === void 0 || grant.effect !== "allow" ? void 0 : requirementCondition(policy, subject, grant.requires, resource, now, env.customRoles, env.customGrants);
-		const merged = freezeDeep(compact({
-			...grant,
-			where: combineWhere(combineWhere(grant.where, granteeMatch.where), requirement)
-		}));
-		const condition = evaluateGrantCondition(merged, permission, current, next, subject, now, scopes, env.relations, (target, id, key) => inheritedVerdict(policy, given, target, id, key, now, env));
-		if (!condition.matched && grant.effect === "deny" && isUnevaluable(condition.reason) && grantCoversField(grant.fields, options.field, grant.effect)) {
-			if (condition.reason === "closure-error") emitSafe(env.listeners.error, condition.cause ?? /* @__PURE__ */ new Error("closure-error"), env.listeners);
-			tracer?.denies.push(matchedOf(merged, permission.key));
-			return complete({
-				outcome: "denied",
-				denials: [{
-					role: displayRole,
-					reason: condition.reason ?? "relation-unavailable"
-				}],
-				alternatives: []
-			});
+		const condition = on === void 0 ? void 0 : resourceRoleCondition(call.resource, on.resource, [on.id], call.policy.resources);
+		return condition === void 0 || env.relations === void 0 ? false : resolveRelated(condition, row, call.subject, call.now, env.relations);
+	};
+}
+function holdsCustom(state, custom) {
+	return isGlobalCustomRole(custom) ? holdsGlobalCustomRole(state.subject.principal?.roles ?? [], custom) : (state.subject.principal?.memberships ?? []).some((membership) => inTeam(membership, state.scopes, state.env.team) && holdsCustomRole(membership, custom, state.scopes));
+}
+function holdsRole(state, item, custom) {
+	if (custom !== void 0) return holdsCustom(state, custom);
+	return item.scope === "global" ? state.roles.global.roles.includes(item.role) : state.roles.matching.has(item.role);
+}
+/**
+* Whether the subject holds every role the grantee names, at a scope the row
+* (and a write's next row) is in. `held: false` when a denial or skip was recorded.
+*/
+function roleScope(state, grant, custom) {
+	const { subject, permission, tracer } = state;
+	const roleItems = flattenGrantee(grant.to).filter((item) => item.kind === "role");
+	if (roleItems.length === 0) return { held: true };
+	if (subject.principal === null) {
+		state.denials.push({
+			role: grant.role,
+			reason: "anonymous"
+		});
+		return { held: false };
+	}
+	let membership;
+	for (const roleItem of roleItems) {
+		if (!holdsRole(state, roleItem, custom)) {
+			skip(tracer, grant, permission.key, "role");
+			return { held: false };
 		}
-		if (!condition.matched) {
-			if (condition.reason === "closure-error") emitSafe(env.listeners.error, condition.cause ?? /* @__PURE__ */ new Error("closure-error"), env.listeners);
-			denials.push({
-				role: displayRole,
-				reason: condition.reason ?? "condition",
-				detail: condition.cause
+		const matchRow = (row) => matchScopedMembership(subject, roleItem.scope, roleItem.role, row, state.scopes, state.resource, state.policy.resources, state.now, (held) => {
+			if (custom === void 0) return expandRoleNames(held.roles, state.declared, state.env.customRoles, tenantOf(held, state.scopes)).roles;
+			return holdsCustomRole(held, custom, state.scopes) ? [custom.name] : [];
+		}, state.env.team, state.walkRole, permission.kind === "instance", state.options.scope);
+		const scopeMatch = matchWriteScope(matchRow, permission.kind === "instance", state.current, state.next);
+		if (!scopeMatch.ok) {
+			state.denials.push({
+				role: roleItem.role,
+				reason: scopeMatch.reason
 			});
-			continue;
-		}
-		if (!grantCoversField(grant.fields, options.field, grant.effect)) {
-			skip(tracer, grant, permission.key, "field");
-			continue;
+			return { held: false };
 		}
-		if (grant.effect === "deny") {
-			tracer?.denies.push(matchedOf(merged, permission.key));
-			if (grant.name !== void 0 && breakGlassOverrides.has(grant.name)) {
-				if (breakGlassGrant !== void 0) continue;
-				if (breakGlassDenial !== void 0) return complete({
-					outcome: "denied",
-					denials: [breakGlassDenial],
-					alternatives: env.skipAlternatives ? [] : alternativesFor(policy, permission, subject, now, env)
-				});
-			}
-			return complete({
-				outcome: "denied",
-				denials: [grant.name === void 0 ? {
-					role: displayRole,
-					reason: "deny"
-				} : {
-					role: displayRole,
-					reason: "deny",
-					detail: { name: grant.name }
-				}],
-				alternatives: env.skipAlternatives ? [] : alternativesFor(policy, permission, subject, now, env)
-			});
-		}
-		tracer?.allows.push(matchedOf(merged, permission.key));
-		allows.push(scopeMembership === void 0 ? { grant: merged } : {
-			grant: merged,
-			membership: scopeMembership
+		membership = scopeMatch.membership ?? membership;
+	}
+	return membership === void 0 ? { held: true } : {
+		held: true,
+		membership
+	};
+}
+/** Whether the grantee matches; records the denial or skip when it does not. */
+function granteeOf(state, grant, custom) {
+	const { subject, now, permission } = state;
+	if (grant.viaOnly !== void 0 && !(subject.principal?.memberships ?? []).some((membership) => membership.via === grant.viaOnly && !isMembershipExpired(membership, now) && inTeam(membership, state.scopes, state.env.team))) {
+		skip(state.tracer, grant, permission.key, "via-only");
+		return;
+	}
+	const required = grant.purpose;
+	if (required !== void 0 && !state.purposes.some((purpose) => required.includes(purpose))) {
+		skip(state.tracer, grant, permission.key, "purpose");
+		return;
+	}
+	const granteeMatch = matchGrantee(grant.to, subject, now, state.resource, state.scopes, state.policy.resources, grant.effect === "deny");
+	if (granteeMatch.matched) return granteeMatch;
+	const reason = granteeMatch.reason ?? "no-grant";
+	if (reason === "not-entitled" && !flattenGrantee(grant.to).every((item) => item.kind !== "role" || holdsRole(state, item, custom))) {
+		skip(state.tracer, grant, permission.key, "grantee");
+		return;
+	}
+	state.denials.push((reason === "insufficient-user-authentication" || reason === "not-entitled") && grant.to !== void 0 ? {
+		role: grant.role,
+		reason,
+		to: grant.to
+	} : {
+		role: grant.role,
+		reason
+	});
+}
+/** One candidate grant: records an allow, a denial or a skip, or returns the decision a deny ends with. */
+function evaluateCandidate(state, { grant, custom }, breakGlass) {
+	const { policy, subject, permission, now, env, tracer } = state;
+	const displayRole = grant.role;
+	if (tracer !== void 0) tracer.evaluated += 1;
+	const granteeMatch = granteeOf(state, grant, custom);
+	if (granteeMatch === void 0) return;
+	const scoped = roleScope(state, grant, custom);
+	if (!scoped.held) return;
+	if (!isActive(grant.validity, now)) {
+		if (grant.effect === "allow") state.denials.push({
+			role: displayRole,
+			reason: "inactive-grant",
+			detail: grant.validity
 		});
+		else skip(tracer, grant, permission.key, "validity");
+		return;
 	}
-	if (breakGlassGrant !== void 0) {
-		tracer?.allows.push(matchedOf(breakGlassGrant, permission.key, true));
-		allows.push({
-			grant: breakGlassGrant,
-			obligations: breakGlassObligations,
-			breakGlass: true
+	const requirement = grant.requires === void 0 || grant.effect !== "allow" ? void 0 : requirementCondition(policy, subject, grant.requires, state.resource, now, env.customRoles, env.customGrants);
+	const merged = freezeDeep(compact({
+		...grant,
+		where: combineWhere(combineWhere(grant.where, granteeMatch.where), requirement)
+	}));
+	const condition = evaluateGrantCondition(merged, permission, state.current, state.next, subject, now, state.scopes, env.relations, (target, id, key) => inheritedVerdict(evaluate, policy, state.given, target, id, key, now, env));
+	if (!condition.matched && condition.reason === "closure-error") emitSafe(env.listeners.error, condition.cause ?? /* @__PURE__ */ new Error("closure-error"), env.listeners);
+	if (!condition.matched && grant.effect === "deny" && isUnevaluable(condition.reason) && grantCoversField(grant.fields, state.options.field, grant.effect)) {
+		tracer?.denies.push(matchedOf(merged, permission.key));
+		return deniedNow(state, {
+			role: displayRole,
+			reason: condition.reason ?? "relation-unavailable"
 		});
-	} else if (breakGlassDenial !== void 0) denials.unshift(breakGlassDenial);
-	if (allows.length === 0) {
-		const reason = denials[0]?.reason ?? (subject.principal === null ? "anonymous" : globalNames.unknown.length > 0 && globalNames.roles.length === 0 ? "unknown-role" : "no-grant");
-		return complete({
-			outcome: "denied",
-			denials: denials.length > 0 ? denials : [{
-				role: null,
-				reason
-			}],
-			alternatives: env.skipAlternatives ? [] : alternativesFor(policy, permission, subject, now, env)
+	}
+	if (!condition.matched) {
+		state.denials.push({
+			role: displayRole,
+			reason: condition.reason ?? "condition",
+			detail: condition.cause
 		});
+		return;
 	}
-	if (subject.stale === true && (policy.fresh ?? []).includes(permission.key)) return complete({
-		outcome: "denied",
-		denials: [{
-			role: null,
-			reason: "stale-credentials"
-		}],
-		alternatives: []
-	});
-	const ceiling = delegatedPermissions(policy.delegations, subject, matchingRoles, now);
-	if (ceiling !== void 0 && !ceiling.has(permission.key)) return complete({
-		outcome: "denied",
-		denials: [{
-			role: null,
-			reason: "not-delegated"
-		}],
-		alternatives: env.skipAlternatives ? [] : alternativesFor(policy, permission, subject, now, env)
+	if (!grantCoversField(grant.fields, state.options.field, grant.effect)) {
+		skip(tracer, grant, permission.key, "field");
+		return;
+	}
+	if (grant.effect === "deny") {
+		tracer?.denies.push(matchedOf(merged, permission.key));
+		if (grant.name !== void 0 && breakGlass.overrides.has(grant.name)) {
+			if (breakGlass.grant !== void 0) return;
+			if (breakGlass.denial !== void 0) return deniedWithAlternatives(state, [breakGlass.denial]);
+		}
+		return deniedWithAlternatives(state, [grant.name === void 0 ? {
+			role: displayRole,
+			reason: "deny"
+		} : {
+			role: displayRole,
+			reason: "deny",
+			detail: { name: grant.name }
+		}]);
+	}
+	tracer?.allows.push(matchedOf(merged, permission.key));
+	state.allows.push(scoped.membership === void 0 ? { grant: merged } : {
+		grant: merged,
+		membership: scoped.membership
 	});
+}
+function noAllowDecision(state) {
+	const { denials, subject, roles } = state;
+	const reason = denials[0]?.reason ?? (subject.principal === null ? "anonymous" : roles.global.unknown.length > 0 && roles.global.roles.length === 0 ? "unknown-role" : "no-grant");
+	return deniedWithAlternatives(state, denials.length > 0 ? denials : [{
+		role: null,
+		reason
+	}]);
+}
+/**
+* The allows a delegation leaves usable. A policy delegation is a ceiling for
+* the actor: outside it, nothing is delegated; inside it, a token delegation
+* on the call must still cover.
+*/
+function delegatedAllows(state) {
+	const { policy, subject, permission, current } = state;
+	const ceiling = delegatedPermissions(policy.delegations, subject, state.roles.matching, state.now);
+	if (ceiling !== void 0 && !ceiling.has(permission.key)) return deniedWithAlternatives(state, [{
+		role: null,
+		reason: "not-delegated"
+	}]);
 	const unscoped = subject.actor !== void 0 && ceiling === void 0;
 	let delegationMiss = coveredByDelegation(permission, subject.delegation, resourceIdOf(current), unscoped);
-	const requirementsCovered = allows.filter((candidate) => coversRequirements(policy.permissions, candidate.grant.requires, subject.delegation, resourceIdOf(current), unscoped));
-	let usable = delegationMiss === void 0 ? requirementsCovered : requirementsCovered.filter((candidate) => requiresStandIn(candidate.grant));
+	const requirementsCovered = state.allows.filter((candidate) => coversRequirements(policy.permissions, candidate.grant.requires, subject.delegation, resourceIdOf(current), unscoped));
+	const usable = delegationMiss === void 0 ? requirementsCovered : requirementsCovered.filter((candidate) => requiresStandIn(candidate.grant));
 	if (delegationMiss === "not-delegated" && usable.length > 0) delegationMiss = void 0;
 	if (delegationMiss === void 0 && usable.length === 0) delegationMiss = "not-delegated";
-	if (delegationMiss !== void 0) return complete({
-		outcome: "denied",
-		denials: [{
-			role: null,
-			reason: delegationMiss
-		}],
-		alternatives: env.skipAlternatives ? [] : alternativesFor(policy, permission, subject, now, env)
-	});
-	const approvalPolicies = env.approvalPolicies;
-	if (approvalPolicies === "failed" && usable.length > 0) return complete({
-		outcome: "denied",
-		denials: [{
-			role: null,
-			reason: "approval",
-			detail: APPROVAL_POLICY_UNAVAILABLE
-		}],
-		alternatives: []
-	});
-	const approvalOf = (candidate) => approvalPolicies === void 0 || approvalPolicies === "failed" ? candidate.grant.approval : tightenApproval(candidate.grant.approval, approvalPolicies, {
-		permission: permission.key,
-		tenant: decisionTenant(subject, candidate.membership),
-		subject,
-		current,
-		next,
-		now,
-		scopes: scopeList(policy.scopes)
+	if (delegationMiss !== void 0) return deniedWithAlternatives(state, [{
+		role: null,
+		reason: delegationMiss
+	}]);
+	return usable;
+}
+function approvalOf(state, candidate) {
+	const approvalPolicies = state.env.approvalPolicies;
+	return approvalPolicies === void 0 || approvalPolicies === "failed" ? candidate.grant.approval : tightenApproval(candidate.grant.approval, approvalPolicies, {
+		permission: state.permission.key,
+		tenant: decisionTenant(state.subject, candidate.membership),
+		subject: state.subject,
+		current: state.current,
+		next: state.next,
+		now: state.now,
+		scopes: state.scopes
 	});
-	const quotaDenials = [];
-	let matchedAllow;
-	let approval;
-	let quotaState = {};
+}
+/** The first usable allow whose quota admits the call, or the quota denials. */
+function quotaAllow(state, usable) {
+	const { subject, env } = state;
+	const denials = [];
 	for (const candidate of usable) {
-		approval = approvalOf(candidate);
-		const consume = !requiresApproval(approval) && shouldConsumeQuota(options.source, env.simulated);
+		const approval = approvalOf(state, candidate);
 		const quota = applyQuota({
 			store: env.limits,
 			cache: env.limitCache,
 			grant: candidate.grant,
-			permissionKey: permission.key,
+			permissionKey: state.permission.key,
 			subjectId: subject.principal?.id ?? "",
 			tenant: subject.principal?.tenant,
-			now,
-			consume
+			now: state.now,
+			consume: !requiresApproval(approval) && shouldConsumeQuota(state.options.source, env.simulated)
 		});
-		if (quota.ok) {
-			matchedAllow = candidate;
-			quotaState = compact({
+		if (quota.ok) return {
+			allow: candidate,
+			approval,
+			quota: compact({
 				quota: quota.quota,
 				obligations: quota.obligations
-			});
-			break;
-		}
-		quotaDenials.push(quota.reason === "limit" ? {
+			})
+		};
+		denials.push(quota.reason === "limit" ? {
 			role: candidate.grant.role,
 			reason: "limit",
 			detail: quota.detail
@@ -1757,11 +1771,10 @@ function evaluate(policy, given, permission, data, options, env) {
 			reason: quota.reason
 		});
 	}
-	if (matchedAllow === void 0) return complete({
-		outcome: "denied",
-		denials: quotaDenials.length > 0 ? quotaDenials : denials,
-		alternatives: env.skipAlternatives ? [] : alternativesFor(policy, permission, subject, now, env)
-	});
+	return { denials };
+}
+function allowedDecision(state, allow, approval, quotaState) {
+	const { policy, subject, permission, resource, env, current, next } = state;
 	const resourceId = permission.kind === "collection" ? "*" : rowIdOf(current, resource?.id);
 	const version = approval !== void 0 && approval !== "human" && approval.staleOn === "resource-change" && resource?.version !== void 0 ? versionOf(current, resource.version) : void 0;
 	const token = env.simulated ? "pd1.simulated" : env.outcomeOnly === true ? "pd1.outcome" : decisionToken({
@@ -1774,11 +1787,15 @@ function evaluate(policy, given, permission, data, options, env) {
 		payload: resourceId === "*" && (next ?? current) !== void 0 ? payloadDigest(next ?? current) : void 0
 	});
 	const matched = compact({
-		...matchedOf(matchedAllow.grant, permission.key, matchedAllow.breakGlass),
+		...matchedOf(allow.grant, permission.key, allow.breakGlass),
 		approval
 	});
-	const obligations = [...quotaState.obligations ?? [], ...matchedAllow.obligations ?? []];
-	return complete(requiresApproval(approval) ? {
+	const obligations = [
+		...quotaState.obligations ?? [],
+		...allow.obligations ?? [],
+		...allow.grant.obligations ?? []
+	];
+	return complete(state, requiresApproval(approval) ? {
 		outcome: "approval-required",
 		grant: matched,
 		reason: "human",
@@ -1790,7 +1807,91 @@ function evaluate(policy, given, permission, data, options, env) {
 		token,
 		...quotaState,
 		...obligations.length === 0 ? {} : { obligations }
-	}, matchedAllow.membership);
+	}, allow.membership);
+}
+function evaluate(policy, given, permission, data, options, env) {
+	const call = {
+		policy,
+		given,
+		subject: subjectForPermission(given, permission.key),
+		permission,
+		options,
+		env,
+		now: options.now ?? nowSeconds(),
+		resource: getResource(policy.permissions, permission.resource),
+		tracer: options.explain === true ? {
+			evaluated: 0,
+			allows: [],
+			denies: [],
+			skipped: []
+		} : void 0
+	};
+	const rows = validatedRows(call, data, rowValues(permission, data));
+	if (rows.invalid !== void 0) return deniedNow({
+		...call,
+		current: rows.current
+	}, {
+		role: null,
+		reason: "validation",
+		detail: rows.invalid
+	});
+	const settled = {
+		...call,
+		current: rows.current
+	};
+	if (isDelegatedPermission(policy, permission)) return deniedNow(settled, {
+		role: null,
+		reason: "pdp-unavailable",
+		detail: "use permdock/pdp createPermDock"
+	});
+	const scopes = scopeList(policy.scopes);
+	const declared = declaredRoleNames(policy);
+	const roles = heldRoles(call, scopes, declared);
+	if (lacksActor(call, scopes)) return deniedNow(settled, {
+		role: null,
+		reason: "actor-required"
+	});
+	const state = {
+		...call,
+		current: rows.current,
+		next: rows.next,
+		scopes,
+		declared,
+		roles,
+		purposes: purposesOf(call.subject),
+		walkRole: walkRoleFor(call),
+		denials: roles.denials,
+		allows: []
+	};
+	const candidates = candidatesFor(call);
+	const breakGlass = breakGlassFor(call, scopes);
+	for (const candidate of candidates) {
+		const decision = evaluateCandidate(state, candidate, breakGlass);
+		if (decision !== void 0) return decision;
+	}
+	if (breakGlass.grant !== void 0) {
+		state.tracer?.allows.push(matchedOf(breakGlass.grant, permission.key, true));
+		state.allows.push({
+			grant: breakGlass.grant,
+			obligations: breakGlass.obligations,
+			breakGlass: true
+		});
+	} else if (breakGlass.denial !== void 0) state.denials.unshift(breakGlass.denial);
+	if (state.allows.length === 0) return noAllowDecision(state);
+	if (state.subject.stale === true && (policy.fresh ?? []).includes(permission.key)) return deniedNow(state, {
+		role: null,
+		reason: "stale-credentials"
+	});
+	const usable = delegatedAllows(state);
+	if (!Array.isArray(usable)) return usable;
+	if (env.approvalPolicies === "failed" && usable.length > 0) return deniedNow(state, {
+		role: null,
+		reason: "approval",
+		detail: APPROVAL_POLICY_UNAVAILABLE
+	});
+	const chosen = quotaAllow(state, usable);
+	if ("denials" in chosen) return deniedWithAlternatives(state, chosen.denials.length > 0 ? chosen.denials : state.denials);
+	return allowedDecision(state, chosen.allow, chosen.approval, chosen.quota);
 }
 //#endregion
 //#region src/core/ownership.ts
@@ -1907,7 +2008,7 @@ function coversInstance(membership, scopes, scope, id, within) {
 }
 /** Roles the principal holds at the instance, at an ancestor named in `within`, or globally. */
 function rolesAtInstance(policy, principal, scopes, scope, id, within, now) {
-	const declared = declaredRoleNames$1(policy);
+	const declared = declaredRoleNames(policy);
 	const names = new Set((principal.roles ?? []).filter((name) => declared.has(name)));
 	for (const membership of principal.memberships ?? []) if (!isMembershipExpired(membership, now) && coversInstance(membership, scopes, scope, id, within)) for (const name of membership.roles) names.add(name);
 	return rankRoles(policy, [...names]);
@@ -2007,7 +2108,7 @@ function decideRoleChange(policy, principal, scopes, change, customRoles, author
 	}
 	const id = change.id ?? "";
 	const binding = bindingOf(policy, name);
-	const declared = declaredRoleNames$1(policy).has(name);
+	const declared = declaredRoleNames(policy).has(name);
 	const named = declared || global ? [] : tenantCustomRoles(policy, customRoles).filter((role) => role.name === name);
 	if (!declared && named.length === 0) {
 		deny("unknown-role");
@@ -2068,7 +2169,7 @@ function decideRoleChange(policy, principal, scopes, change, customRoles, author
 		const revocable = kind === "revoke" && custom !== void 0 && allowed.inert?.has(name);
 		if (!allowed.assignable.has(name) && revocable !== true) deny("not-assignable-by");
 		else if (custom === void 0 && usesAssigns(policy) && !allowed.manage) {
-			const held = global ? rankRoles(policy, (principal.roles ?? []).filter((role) => declaredRoleNames$1(policy).has(role))) : rolesAtInstance(policy, principal, scopes, scope, id, within, now);
+			const held = global ? rankRoles(policy, (principal.roles ?? []).filter((role) => declaredRoleNames(policy).has(role))) : rolesAtInstance(policy, principal, scopes, scope, id, within, now);
 			by = held.find((role) => bindingOf(policy, role)?.assigns?.includes(name) === true) ?? null;
 			if (by === null) deny("not-assignable-by", { held });
 		}
@@ -2088,658 +2189,767 @@ function decideRoleChange(policy, principal, scopes, change, customRoles, author
 	return done(by);
 }
 //#endregion
-//#region src/core/who-can.ts
-const MAX_ROUNDS = 48;
-async function settle$1(cache) {
-	for (let round = 0; round < MAX_ROUNDS; round += 1) {
-		const pending = pendingRelations(cache);
-		if (pending.length === 0) return;
-		await Promise.all(pending);
+//#region src/core/held-roles.ts
+/**
+* Role names held in `tenant` on live memberships, global roles included, in
+* rank order. With `scope`, only the roles of that scope's memberships (and
+* instance `id`).
+*/
+function heldRoleNames(policy, subject, tenant, only, now) {
+	if (subject.principal === null) return [];
+	const scopes = scopeList(policy.scopes);
+	const scope = only?.scope === void 0 ? void 0 : resolveScope(scopes, only.scope);
+	if (only?.scope !== void 0 && scope === void 0) return [];
+	const names = new Set(scope === void 0 ? subject.principal.roles ?? [] : []);
+	for (const membership of subject.principal.memberships ?? []) {
+		if (isMembershipExpired(membership, now) || membership.keep !== void 0) continue;
+		if (!(scope === void 0 ? tenantOf(membership, scopes) === tenant : membership.scope === scope && (only?.id === void 0 || sameId(membership.id, only.id)))) continue;
+		for (const role of membership.roles) names.add(role);
 	}
+	return rankRoles(policy, [...names]);
 }
-/** The holders on each instance a graph relation reads, or `undefined` when the graph cannot say. */
-async function walkHolders(condition, row, reader, cache) {
-	let walk = relationWalk(condition, row, reader);
-	if (walk === "relation-unavailable") {
-		await settle$1(cache);
-		walk = relationWalk(condition, row, reader);
-	}
-	if (walk === void 0) return [];
-	if (walk === "relation-depth" || walk === "relation-unavailable") return;
-	const { ids } = walk;
-	const read = () => ids.map((id) => reader.holders({
-		resource: condition.resource,
-		id,
-		relation: condition.relation
+function roleLeaf(policy, name) {
+	const binding = policy.rolesByName.get(name);
+	return findRole(policy.vocabulary?.roles, name) ?? synthesiseRole(name, compact({
+		on: typeof binding?.on === "string" ? binding.on : void 0,
+		assignable: binding?.assignable,
+		meta: binding?.meta
 	}));
-	let answers = read();
-	if (answers.includes("pending")) {
-		await settle$1(cache);
-		answers = read();
-	}
-	const out = [];
-	for (const [index, answer] of answers.entries()) {
-		const id = ids[index];
-		if (answer === "pending" || answer === "failed" || id === void 0) return;
-		out.push({
-			id,
-			holders: answer
-		});
-	}
-	return out;
 }
-async function discoverRole(item, allow, ctx) {
-	if (typeof item.scope !== "string" || item.scope === "global") {
-		ctx.incomplete();
-		return;
-	}
-	const key = scopeField(ctx.resource, item.scope, ctx.scopes);
-	const id = key === void 0 ? void 0 : relationId(ownGet(ctx.row, key));
-	if (id === void 0) return;
-	const members = await ctx.list(item.scope, id);
-	if (members === null) {
-		ctx.incomplete();
-		return;
-	}
-	for (const member of members.filter((entry) => entry.membership.roles.includes(item.role))) ctx.add(member.id, allow ? {
-		kind: "role",
-		role: item.role,
-		membership: member.membership
-	} : void 0, member.membership);
+//#endregion
+//#region src/core/snapshot-grants.ts
+/** A grant on a relation with a `period` is decided on the server, where the clock is. */
+function periodBound(policy, grant) {
+	const relations = policy.resources.get(grant.permission.resource)?.relations;
+	return flattenGrantee(grant.to).some((item) => {
+		if (item.kind !== "relation") return false;
+		const spec = relations?.[item.relation];
+		return isPrincipalRelation(spec) && spec.period !== void 0;
+	});
 }
-function holderVia(holder, at, share, group) {
-	if (!share) return {
-		kind: "relation",
-		...at
-	};
-	return compact({
-		kind: "share",
-		...at,
-		expiresAt: holder.expiresAt,
-		group
+function includePrefixes(include) {
+	if (include === void 0) return;
+	return include.map((item) => {
+		if ("key" in item && typeof item.key === "string") return item.key;
+		const first = listPermissions(item)[0];
+		if (first === void 0) return "";
+		const parts = first.key.split(".");
+		parts.pop();
+		return parts.join(".");
 	});
 }
 /**
-* Principals holding `group`'s relation, through at most `budget` more groups
-* of its resource; `undefined` when a read failed. `memo` keeps each group's
-* members per budget across one discovery, so a group shared by many paths is
-* read once; a result cut short by a cycle is path-specific and not kept.
+* The grant with its grantee's row condition. A graph relation needs the
+* `RelationSource`, which snapshots and `where()` do not carry, so the grant
+* becomes server-only (`portable: false`) there.
 */
-async function groupMembers(group, ctx, budget, seen, memo) {
-	const key = JSON.stringify([
-		group.resource,
-		group.id,
-		group.relation
-	]);
-	const memoKey = `${budget}:${key}`;
-	const known = memo.get(memoKey);
-	if (known !== void 0) return {
-		members: known,
-		cut: false
-	};
-	let holders = ctx.reader.holders(group);
-	if (holders === "pending") {
-		await settle$1(ctx.cache);
-		holders = ctx.reader.holders(group);
-	}
-	if (holders === "pending" || holders === "failed") return;
-	const path = new Set(seen).add(key);
-	const out = /* @__PURE__ */ new Set();
-	let cut = false;
-	for (const holder of holders) {
-		if ("principal" in holder) {
-			out.add(holder.principal.id);
-			continue;
-		}
-		const nested = JSON.stringify([
-			holder.group.resource,
-			holder.group.id,
-			holder.group.relation
-		]);
-		const same = holder.group.resource === group.resource;
-		if (path.has(nested)) {
-			cut = true;
-			continue;
-		}
-		if (same && budget <= 0) continue;
-		const walk = await groupMembers(holder.group, ctx, same ? budget - 1 : 16, path, memo);
-		if (walk === void 0) return;
-		cut ||= walk.cut;
-		for (const member of walk.members) out.add(member);
-	}
-	const members = [...out];
-	if (!cut) memo.set(memoKey, members);
-	return {
-		members,
-		cut
-	};
+function graphAware(grant, where) {
+	const combined = combineWhere(grant.where, where);
+	const graph = hasConditionOp(combined, "related");
+	const inherits = flattenGrantee(grant.to).some((item) => item.kind === "inherit");
+	return freezeDeep(compact({
+		...grant,
+		where: combined,
+		portable: graph ? false : grant.portable,
+		graph: graph && grant.portable && !inherits ? true : void 0
+	}));
 }
-async function discoverGraph(condition, allow, ctx) {
-	const nodes = await walkHolders(condition, ctx.row, ctx.reader, ctx.cache);
-	if (nodes === void 0) {
-		ctx.incomplete();
-		return;
-	}
-	const node = ctx.policy.resources.get(condition.resource);
-	const memo = /* @__PURE__ */ new Map();
-	for (const entry of nodes) for (const holder of entry.holders) {
-		const at = {
-			resource: condition.resource,
-			relation: holder.relation,
-			id: entry.id
-		};
-		const share = isEdgeRelation(node?.relations[holder.relation]);
-		if ("principal" in holder) {
-			ctx.add(holder.principal.id, allow ? holderVia(holder, at, share) : void 0);
-			continue;
-		}
-		const walk = await groupMembers(holder.group, ctx, holder.group.resource === condition.resource ? 15 : 16, /* @__PURE__ */ new Set(), memo);
-		if (walk === void 0) {
-			ctx.incomplete();
+/**
+* `where()` keeps a grant that is server-only because it reads the graph:
+* its `related` nodes compile to subqueries given relation mappings.
+*/
+function whereGrant(grant) {
+	return grant.graph === true ? freezeDeep({
+		...grant,
+		portable: true
+	}) : grant;
+}
+/**
+* Every grant the subject may reach, once per membership that holds all of
+* its scoped roles, so a client can check that membership's tenant, team or
+* resource. A scoped role held only globally reaches nothing.
+*/
+function collectSnapshotGrants(policy, subject, customRoles, now = nowSeconds(), customGrants = customGrantsFor(policy, customRoles), mode = "held") {
+	const skip = (grant, match) => mode === "held" ? !match.matched : match.matched || match.reason !== "not-entitled" || grant.effect !== "allow";
+	const scopes = scopeList(policy.scopes);
+	const declared = declaredRoleNames(policy);
+	const global = expandRoleNames(subject.principal?.roles ?? [], declared, customRoles, subject.principal?.tenant);
+	const held = (subject.principal?.memberships ?? []).map((membership) => ({
+		membership,
+		roles: new Set(expandRoleNames(membership.roles, declared, customRoles, tenantOf(membership, scopes)).roles)
+	}));
+	const holds = (entry, item) => entry.roles.has(item.role) && (typeof item.scope === "string" ? entry.membership.scope === item.scope : entry.membership.on !== void 0);
+	const requirementOf = (grant, resource) => grant.requires === void 0 || grant.effect !== "allow" ? void 0 : requirementCondition(policy, subject, grant.requires, resource, now, customRoles, customGrants);
+	const out = [];
+	for (const grant of grantList(policy)) {
+		if (mode === "held" && !coversRequirements(policy.permissions, grant.requires, subject.delegation)) continue;
+		const resource = getResource(policy.permissions, grant.permission.resource);
+		const match = matchGrantee(grant.to, subject, now, resource, scopes, policy.resources);
+		if (skip(grant, match)) continue;
+		const roleItems = flattenGrantee(grant.to).filter((item) => item.kind === "role");
+		if (roleItems.length > 0 && subject.principal === null) continue;
+		if (!roleItems.every((item) => item.scope !== "global" || global.roles.includes(item.role))) continue;
+		const merged = graphAware(grant, combineWhere(match.where, requirementOf(grant, resource)));
+		const scoped = roleItems.filter((item) => item.scope !== "global");
+		if (scoped.length === 0) {
+			out.push({ grant: merged });
 			continue;
 		}
-		for (const member of walk.members) ctx.add(member, allow ? holderVia(holder, at, share, holder.group) : void 0);
-	}
-}
-async function discoverRelation(item, allow, ctx, expanded = false) {
-	const condition = relationCondition(item, ctx.resource, ctx.scopes, { resources: ctx.policy.resources });
-	if (condition?.op === "related") {
-		await discoverGraph(condition, allow, ctx);
-		return;
-	}
-	const spec = ctx.resource?.relations[item.relation];
-	if (spec?.includes !== void 0 && !expanded) {
-		for (const name of expandRelation(ctx.resource, item.relation)) await discoverRelation({
-			...item,
-			relation: name
-		}, allow, ctx, true);
-		return;
+		for (const entry of held) if (keepsPermission(entry.membership, grant.permission.key) && scoped.every((item) => item.kind === "role" && holds(entry, item))) out.push({
+			grant: merged,
+			membership: entry.membership
+		});
 	}
-	const via = allow ? {
-		kind: "relation",
-		resource: ctx.permission.resource,
-		relation: item.relation,
-		id: relationId(ownGet(ctx.row, ctx.resource?.id ?? "id")) ?? ""
-	} : void 0;
-	if (isFieldRelation(spec) && spec.memberOf !== void 0) {
-		const scope = resolveScope(ctx.scopes, spec.memberOf);
-		const id = relationId(ownGet(ctx.row, spec.field));
-		const members = scope === void 0 || id === void 0 ? [] : await ctx.list(scope, id);
-		if (members === null) {
-			ctx.incomplete();
-			return;
-		}
-		for (const member of members) ctx.add(member.id, via, member.membership);
-		return;
+	for (const { grant, role } of customGrants) {
+		const globalHeld = holdsGlobalCustomRole(subject.principal?.roles, role);
+		const holders = held.filter((entry) => keepsPermission(entry.membership, grant.permission.key) && holdsCustomRole(entry.membership, role, scopes));
+		if (holders.length === 0 && !globalHeld) continue;
+		const resource = getResource(policy.permissions, grant.permission.resource);
+		const match = matchGrantee(grant.to, subject, now, resource, scopes, policy.resources);
+		if (skip(grant, match)) continue;
+		const merged = graphAware(grant, combineWhere(match.where, requirementOf(grant, resource)));
+		if (globalHeld) out.push({ grant: merged });
+		for (const entry of holders) out.push({
+			grant: merged,
+			membership: entry.membership
+		});
 	}
-	const column = isFieldRelation(spec) ? spec.field : isPrincipalRelation(spec) ? spec.principal : void 0;
-	const holder = column === void 0 ? void 0 : relationId(ownGet(ctx.row, column));
-	if (holder !== void 0) ctx.add(holder, via);
+	const fresh = policy.fresh ?? [];
+	if (mode === "held" && subject.stale === true && fresh.length > 0) return out.filter(({ grant }) => grant.effect === "deny" || !fresh.includes(grant.permission.key));
+	return out;
 }
-function discover(grant, item, ctx) {
-	const allow = grant.effect === "allow";
-	switch (item.kind) {
-		case "role": return discoverRole(item, allow, ctx);
-		case "relation": return discoverRelation(item, allow, ctx);
-		case "anyone":
-		case "authenticated":
-		case "plan":
-		case "actor":
-		case "assurance":
-		case "inherit":
-			ctx.incomplete();
-			return Promise.resolve();
-		default: return unknownKind(item, ctx);
-	}
+//#endregion
+//#region src/core/assignable.ts
+/**
+* Declared roles a tenant admin may hand out or compose, before any
+* intersection: `assignable` roles, plus every role some `assigns` lists.
+*/
+function assignableCandidates(policy) {
+	const listed = new Set(policy.roles.flatMap((binding) => binding.assigns ?? []));
+	const names = [...listRoles(policy.vocabulary?.roles).filter((leaf) => leaf.assignable || listed.has(leaf.key)).map((leaf) => leaf.key), ...policy.roles.filter((binding) => binding.assignable || listed.has(binding.name)).map((binding) => binding.name)];
+	return rankRoles(policy, [...new Set(names)]).map((name) => roleLeaf(policy, name));
 }
-/** Holders of a grantee kind this build does not know cannot be listed. */
-function unknownKind(_item, ctx) {
-	ctx.incomplete();
-	return Promise.resolve();
+/**
+* The levels a held allow of a permission covers: its own `level`, every
+* level when it has no row condition, or the levels whose condition equals
+* its condition.
+*/
+function heldLevels(policy, grant, names) {
+	if (grant.level !== void 0) return [grant.level];
+	if (grant.where === void 0) return names;
+	const held = canonicalJson(grant.where);
+	return names.filter((name) => {
+		const condition = levelCondition(policy, grant.permission.resource, name);
+		return condition !== void 0 && canonicalJson(condition) === held;
+	});
 }
-function memberLister(source, scopes) {
-	const listed = /* @__PURE__ */ new Map();
-	const load = async (scope, id) => {
-		if (source?.list === void 0) return null;
-		try {
-			return (await source.list({
-				scope,
-				id
-			})).flatMap((entry) => typeof entry.principal?.id === "string" ? normalizeMemberships([entry.membership], scopes).map((membership) => ({
-				id: entry.principal.id,
-				membership
-			})) : []);
-		} catch {
-			return null;
-		}
-	};
-	return (scope, id) => {
-		const key = JSON.stringify([scope, id]);
-		const known = listed.get(key) ?? load(scope, id);
-		listed.set(key, known);
-		return known;
+/**
+* What the subject may hand out in `tenant`: declared assignable roles and the
+* tenant custom-role ceiling, narrowed by `allowed` (`RoleSource.assignable`),
+* then intersected with the permissions the subject holds there. Holding a
+* role or a granted permission with `meta.manageRoles` lifts the intersection.
+*/
+function assignableIn(policy, subject, customRoles, customGrants, tenant, allowed, now = nowSeconds(), global = false) {
+	const principal = subject.principal;
+	if (principal === null) return {
+		roles: [],
+		permissions: [],
+		levels: {},
+		manage: false,
+		inert: []
 	};
-}
-async function whoCan(input) {
-	const { policy, permission, row } = input;
-	if (permission.kind !== "instance" || row === null || typeof row !== "object") return freezeDeep({
-		permission: permission.key,
-		holders: [],
-		complete: false
-	});
 	const scopes = scopeList(policy.scopes);
-	let complete = !input.customGrants.some((item) => item.grant.permission.key === permission.key);
-	const found = /* @__PURE__ */ new Map();
-	const ctx = {
-		policy,
-		scopes,
-		resource: getResource(policy.permissions, permission.resource),
-		permission,
-		row,
-		reader: input.reader,
-		cache: input.cache,
-		list: memberLister(input.memberships, scopes),
-		add(id, via, membership) {
-			const entry = found.get(id) ?? {
-				memberships: [],
-				via: []
-			};
-			found.set(id, entry);
-			if (via !== void 0) entry.via.push(via);
-			if (membership !== void 0) entry.memberships.push(membership);
-		},
-		incomplete() {
-			complete = false;
-		}
-	};
-	await Promise.all((policy.index.grantsByKey.get(permission.key) ?? []).flatMap((grant) => flattenGrantee(grant.to).map((item) => discover(grant, item, ctx))));
-	const root = rootScope(scopes);
-	const tenantKey = root === void 0 ? void 0 : scopeField(getResource(policy.permissions, permission.resource), root, scopes);
-	const tenant = tenantKey === void 0 ? void 0 : relationId(ownGet(row, tenantKey));
-	const env = {
+	const scoped = tenant === void 0 ? subject : freezeDeep(compact({
+		...subject,
+		principal: compact({
+			...principal,
+			tenant: resolveActiveTenant(principal, tenant, scopes, now)
+		})
+	}));
+	const heldGrants = collectSnapshotGrants(policy, scoped, customRoles, now, customGrants).filter((item) => item.grant.effect === "allow" && (item.membership === void 0 || !global && tenantOf(item.membership, scopes) === tenant && !isMembershipExpired(item.membership, now))).map((item) => item.grant);
+	const heldKeys = new Set(heldGrants.map((grant) => grant.permission.key));
+	const heldNames = heldRoleNames(policy, subject, tenant, void 0, now);
+	const quiet = {
 		emit: false,
 		simulated: true,
 		skipAlternatives: true,
-		customRoles: [],
-		customGrants: [],
+		customRoles,
+		customGrants,
 		listeners: emptyListeners(),
 		sink: void 0,
 		limits: void 0,
 		limitCache: /* @__PURE__ */ new Map(),
-		team: input.team,
-		relations: input.reader
+		team: void 0
 	};
-	const now = nowSeconds();
-	const ordered = [...found.entries()].toSorted(([a], [b]) => byCodePoint(a, b));
-	const decideAll = () => ordered.map(([id, entry]) => {
-		const subject = freezeDeep({
-			principal: {
-				id,
-				roles: [],
-				memberships: entry.memberships,
-				...tenant === void 0 ? {} : { tenant }
-			},
-			context: {}
-		});
-		return evaluate(policy, subject, permission, row, {
-			source: "simulate",
-			trusted: true,
-			now
-		}, env);
+	const manage = heldNames.some((name) => roleMeta(policy, name)?.manageRoles === true) || listPermissions(policy.permissions).some((leaf) => leaf.meta.manageRoles === true && evaluate(policy, scoped, leaf, void 0, {
+		source: "simulate",
+		trusted: true,
+		now
+	}, quiet).outcome === "granted");
+	const narrowed = allowed === void 0 ? void 0 : new Set(allowed);
+	const candidates = assignableCandidates(policy).filter((leaf) => narrowed === void 0 || narrowed.has(leaf.key));
+	const held = new Set(heldNames);
+	const listed = usesAssigns(policy) ? new Set(heldNames.flatMap((name) => policy.rolesByName.get(name)?.assigns ?? [])) : void 0;
+	const roles = manage ? candidates : candidates.filter((leaf) => {
+		if (listed !== void 0) return listed.has(leaf.key);
+		if (held.has(leaf.key)) return true;
+		const keys = [...roleAllowKeys(policy, leaf.key)];
+		return keys.length > 0 && keys.every((key) => heldKeys.has(key));
 	});
-	let decisions = decideAll();
-	if (pendingRelations(input.cache).length > 0) {
-		await settle$1(input.cache);
-		decisions = decideAll();
+	const root = global ? "global" : rootScope(scopes);
+	const ceiling = new Set((root === void 0 ? [] : ceilingGrants(policy, root, allowed)).map((grant) => grant.permission.key));
+	const permissions = listPermissions(policy.permissions).filter((leaf) => ceiling.has(leaf.key) && (manage || heldKeys.has(leaf.key)));
+	const offeredLevels = (key, names) => {
+		if (manage) return names;
+		const reached = new Set(heldGrants.filter((grant) => grant.permission.key === key).flatMap((grant) => heldLevels(policy, grant, names)));
+		return names.filter((name) => reached.has(name));
+	};
+	const levels = {};
+	for (const leaf of permissions) {
+		const names = leaf.kind === "instance" ? levelNames(policy, leaf.resource) : [];
+		if (names.length > 0) levels[leaf.key] = offeredLevels(leaf.key, names);
 	}
-	const holders = [];
-	for (const [index, [id, entry]] of ordered.entries()) {
-		const decision = decisions[index];
-		if (decision === void 0 || decision.outcome === "denied") {
-			if (decision?.outcome === "denied" && decision.denials.some((denial) => denial.reason === "relation-unavailable" || denial.reason === "relation-depth")) complete = false;
+	const ceilingKeys = /* @__PURE__ */ new Map();
+	const mayHandOut = (scope, grant) => {
+		const key = grant.permission.key;
+		let keys = ceilingKeys.get(scope);
+		if (keys === void 0) {
+			keys = new Set(ceilingGrants(policy, scope, allowed).map((item) => item.permission.key));
+			ceilingKeys.set(scope, keys);
+		}
+		if (!keys.has(key) || !(manage || heldKeys.has(key))) return false;
+		const names = grant.permission.kind === "instance" ? levelNames(policy, grant.permission.resource) : [];
+		if (names.length === 0) return true;
+		const offered = offeredLevels(key, names);
+		return heldLevels(policy, grant, names).every((name) => offered.includes(name));
+	};
+	const custom = global || tenant === void 0 ? {
+		roles: [],
+		inert: []
+	} : assignableCustomRoles(policy, customRoles, tenant, manage ? void 0 : roles, mayHandOut);
+	return {
+		roles: [...roles, ...custom.roles],
+		permissions,
+		levels,
+		manage,
+		inert: custom.inert
+	};
+}
+/**
+* The tenant's custom roles the subject may hand out: held at a scope it may
+* assign declared roles at (any scope with `meta.manageRoles`), allowing at
+* least one permission after the ceiling, and only permissions and levels it
+* may hand out at that scope. A role that allows nothing is `inert`.
+*/
+function assignableCustomRoles(policy, customRoles, tenant, declared, mayHandOut) {
+	const scopes = scopeList(policy.scopes);
+	const root = rootScope(scopes);
+	const assignsAt = declared === void 0 ? void 0 : new Set(declared.map((leaf) => leaf.on === void 0 ? root : resolveScope(scopes, leaf.on)));
+	const out = /* @__PURE__ */ new Map();
+	const inert = /* @__PURE__ */ new Set();
+	for (const role of tenantCustomRoles(policy, customRoles)) {
+		if (role.tenant !== tenant || out.has(role.name)) continue;
+		const at = customRoleScope(role, scopes);
+		if (at === void 0 || assignsAt !== void 0 && !assignsAt.has(at)) continue;
+		const { grants } = resolveCustomRole(policy, role);
+		if (!grants.some((grant) => grant.effect === "allow")) {
+			inert.add(role.name);
 			continue;
 		}
-		holders.push({
-			principal: { id },
-			via: entry.via
+		if (grants.every((grant) => grant.effect === "deny" || mayHandOut(at, grant))) out.set(role.name, synthesiseRole(role.name, compact({
+			on: at,
+			assignable: true,
+			meta: sourceRoleMeta(role.meta, treeXSchema(policy.vocabulary?.roles))
+		})));
+	}
+	return {
+		roles: [...out.values()].toSorted((a, b) => a.key.localeCompare(b.key)),
+		inert: [...inert].filter((name) => !out.has(name)).toSorted()
+	};
+}
+//#endregion
+//#region src/core/instance-snapshot.ts
+/** The one path from a resolved subject to a `Snapshot`; pure apart from the default clock. */
+function snapshotOf(policy, subject, options) {
+	const now = options.now ?? nowSeconds();
+	const customGrants = options.customGrants ?? customGrantsFor(policy, options.customRoles);
+	const roles = heldRoleNames(policy, subject, subject.principal?.tenant, void 0, now);
+	const audiences = audiencesOf(policy, roles);
+	return buildSnapshot(compact({
+		subject,
+		roles,
+		audiences: audiences.length === 0 ? void 0 : audiences,
+		notEntitled: collectSnapshotGrants(policy, subject, options.customRoles, now, customGrants, "not-entitled"),
+		grants: collectSnapshotGrants(policy, subject, options.customRoles, now, customGrants).map((item) => periodBound(policy, item.grant) ? Object.assign({}, item, { grant: freezeDeep({
+			...item.grant,
+			portable: false
+		}) }) : item),
+		include: includePrefixes(options.include),
+		tenants: options.tenants,
+		simulated: options.simulated,
+		now: Math.floor(now),
+		vocabulary: policy.vocabulary,
+		scopes: snapshotScopes(policy),
+		idOf: (name) => getResource(policy.permissions, name)?.id,
+		delegated: delegatedPermissions(policy.delegations, subject, new Set(roles), now),
+		assignable: (tenant) => {
+			const found = assignableIn(policy, subject, options.customRoles, customGrants, tenant, options.assignable?.get(tenant), now);
+			return compact({
+				tenant,
+				roles: found.roles.map((leaf) => leaf.key),
+				permissions: found.permissions,
+				levels: Object.keys(found.levels).length === 0 ? void 0 : found.levels
+			});
+		}
+	}));
+}
+/** The policy's scopes as snapshots and `permdock cloud push` carry them, with the resources each partitions. */
+function snapshotScopes(policy) {
+	if (policy.scopes.length === 0) return;
+	const resources = [...policy.resources.values()];
+	return policy.scopes.map((scope) => {
+		const nodes = resources.filter((node) => partitionsOf(node, policy.scopes).includes(scope.name));
+		const partitioned = nodes.map((node) => node.name);
+		const fields = Object.fromEntries(nodes.flatMap((node) => {
+			const field = scopeField(node, scope.name, policy.scopes);
+			return field === void 0 || field === scope.key ? [] : [[node.name, field]];
+		}));
+		return compact({
+			name: scope.name,
+			key: scope.key ?? "",
+			within: scope.within,
+			resources: partitioned.length === 0 ? void 0 : partitioned,
+			fields: Object.keys(fields).length === 0 ? void 0 : fields
 		});
+	});
+}
+//#endregion
+//#region src/core/assert-decision.ts
+/** `assert`'s outcome: the granted decision, or the error a refusal throws after `onDenied` runs. */
+function assertDecision(policy, subject, permission, data, decision, onDenied) {
+	if (decision.outcome === "granted") return decision;
+	if (onDenied !== void 0) onDenied(decision);
+	const resource = getResource(policy.permissions, permission.resource);
+	const resourceId = data !== null && typeof data === "object" ? data[resource?.id ?? "id"] : void 0;
+	const resourceRef = compact({
+		type: permission.resource,
+		id: resourceId === void 0 ? void 0 : String(resourceId)
+	});
+	if (decision.outcome === "approval-required") throw new PermDockApprovalRequiredError({
+		decision,
+		permission: permission.key,
+		scope: permission.scope,
+		resource: resourceRef,
+		message: approvalMessage(permission.key, decision.reason, decision.token)
+	});
+	if (decision.denials.some((denial) => denial.reason === "validation")) {
+		const detail = decision.denials[0]?.detail;
+		if (detail instanceof PermDockValidationError) throw detail;
 	}
-	return freezeDeep({
+	throw new PermDockDeniedError({
+		decision,
 		permission: permission.key,
-		holders,
-		complete
+		scope: permission.scope,
+		resource: resourceRef,
+		subject,
+		message: deniedMessage(permission.key, subject.principal?.id, decision.denials, decision.alternatives.map((leaf) => leaf.key)),
+		...data === void 0 || resource === void 0 ? {} : { disclosure: resource.disclosure }
 	});
 }
 //#endregion
-//#region src/core/instance.ts
-/** Each round reads one more layer: link hops, then the chain, then nested groups. */
-const LOAD_ROUNDS = 48;
-/** A grant on a relation with a `period` is decided on the server, where the clock is. */
-function periodBound(policy, grant) {
-	const relations = policy.resources.get(grant.permission.resource)?.relations;
-	return flattenGrantee(grant.to).some((item) => {
-		if (item.kind !== "relation") return false;
-		const spec = relations?.[item.relation];
-		return isPrincipalRelation(spec) && spec.period !== void 0;
+//#region src/core/instance-env.ts
+/** The environment `derive(options)` builds on: `base` with the sources `options` replaces loaded again. */
+function deriveEnv(policy, subject, base, relationCache, options) {
+	const scopes = scopeList(policy.scopes);
+	const tenants = tenantsOf(subject.principal, scopes);
+	const auth = [];
+	const named = options.customRoles === void 0 ? void 0 : roleSourceFor(options.customRoles, subject, auth);
+	const roleSource = options.customRoles === void 0 ? base.roleSource : named;
+	const roles = options.customRoles === void 0 ? base.customRoles : customRolesFor(named, tenants, auth, subject.principal === null ? void 0 : subject.principal.roles ?? [], (tenant) => heldRoleNamesIn(subject.principal, scopes, tenant));
+	const names = options.customRoles === void 0 ? base.assignable : assignableNamesFor(named, tenants, auth);
+	const approvals = options.approvalPolicies === void 0 ? base.approvalPolicies : approvalPoliciesFor(policy, options.approvalPolicies, tenants, auth);
+	const envWith = (loadedRoles, loadedNames, loadedApprovals) => compact({
+		...base,
+		customRoles: loadedRoles,
+		roleSource,
+		assignable: loadedNames,
+		approvalPolicies: loadedApprovals,
+		relations: options.relations ?? base.relations,
+		relationCache: options.relations === void 0 ? relationCache : void 0,
+		queuedAuth: auth,
+		queuedErrors: []
 	});
+	if (isThenable(roles) || isThenable(names) || isThenable(approvals)) return Promise.all([
+		roles,
+		names,
+		approvals
+	]).then(([loadedRoles, loadedNames, loadedApprovals]) => envWith(loadedRoles, loadedNames, loadedApprovals));
+	return envWith(roles, names, approvals);
 }
-function includePrefixes(include) {
-	if (include === void 0) return;
-	return include.map((item) => {
-		if ("key" in item && typeof item.key === "string") return item.key;
-		const first = listPermissions(item)[0];
-		if (first === void 0) return "";
-		const parts = first.key.split(".");
-		parts.pop();
-		return parts.join(".");
+//#endregion
+//#region src/core/simulate-preview.ts
+function previewSubject(policy, subject, preview) {
+	const previewRoles = preview.roles?.map((item) => typeof item === "string" ? item : item.key);
+	const kinds = subject.principal === null ? void 0 : applyRoleKinds(policy, previewRoles ?? subject.principal.roles, preview.memberships === void 0 ? subject.principal.memberships ?? [] : normalizeMemberships(preview.memberships, scopeList(policy.scopes)));
+	const principal = subject.principal === null || kinds === void 0 ? null : freezeDeep(compact({
+		...subject.principal,
+		roles: kinds.roles,
+		memberships: preview.memberships === void 0 && subject.principal.memberships === void 0 ? void 0 : kinds.memberships,
+		tenant: preview.tenant ?? subject.principal.tenant
+	}));
+	return freezeDeep({
+		...subject,
+		principal
 	});
 }
-/**
-* Role names held in `tenant` on live memberships, global roles included, in
-* rank order. With `scope`, only the roles of that scope's memberships (and
-* instance `id`).
-*/
-function heldRoleNames(policy, subject, tenant, only, now) {
-	if (subject.principal === null) return [];
-	const scopes = scopeList(policy.scopes);
-	const scope = only?.scope === void 0 ? void 0 : resolveScope(scopes, only.scope);
-	if (only?.scope !== void 0 && scope === void 0) return [];
-	const names = new Set(scope === void 0 ? subject.principal.roles ?? [] : []);
-	for (const membership of subject.principal.memberships ?? []) {
-		if (isMembershipExpired(membership, now) || membership.keep !== void 0) continue;
-		if (!(scope === void 0 ? tenantOf(membership, scopes) === tenant : membership.scope === scope && (only?.id === void 0 || sameId(membership.id, only.id)))) continue;
-		for (const role of membership.roles) names.add(role);
+/** The one `simulate` event for a batch: the worst decision, with the counts. */
+function simulateEvent(policy, subject, env, evaluated) {
+	const counts = {
+		granted: 0,
+		denied: 0,
+		approvalRequired: 0
+	};
+	for (const [, , decision] of evaluated) if (decision.outcome === "granted") counts.granted += 1;
+	else if (decision.outcome === "approval-required") counts.approvalRequired += 1;
+	else counts.denied += 1;
+	const worst = evaluated.find(([, , decision]) => decision.outcome === "denied") ?? evaluated.find(([, , decision]) => decision.outcome === "approval-required") ?? evaluated[0];
+	if (worst === void 0) return;
+	const [permission, data, decision] = worst;
+	finish(policy, subject, permission, data, decision, {
+		source: "simulate",
+		trusted: true
+	}, {
+		...env,
+		emit: true
+	}, true, void 0, counts);
+}
+//#endregion
+//#region src/core/who-can.ts
+const MAX_ROUNDS = 48;
+async function settle$1(cache) {
+	for (let round = 0; round < MAX_ROUNDS; round += 1) {
+		const pending = pendingRelations(cache);
+		if (pending.length === 0) return;
+		await Promise.all(pending);
 	}
-	return rankRoles(policy, [...names]);
 }
-function roleLeaf(policy, name) {
-	const binding = policy.rolesByName.get(name);
-	return findRole(policy.vocabulary?.roles, name) ?? synthesiseRole(name, compact({
-		on: typeof binding?.on === "string" ? binding.on : void 0,
-		assignable: binding?.assignable,
-		meta: binding?.meta
+/** The holders on each instance a graph relation reads, or `undefined` when the graph cannot say. */
+async function walkHolders(condition, row, reader, cache) {
+	let walk = relationWalk(condition, row, reader);
+	if (walk === "relation-unavailable") {
+		await settle$1(cache);
+		walk = relationWalk(condition, row, reader);
+	}
+	if (walk === void 0) return [];
+	if (walk === "relation-depth" || walk === "relation-unavailable") return;
+	const { ids } = walk;
+	const read = () => ids.map((id) => reader.holders({
+		resource: condition.resource,
+		id,
+		relation: condition.relation
 	}));
+	let answers = read();
+	if (answers.includes("pending")) {
+		await settle$1(cache);
+		answers = read();
+	}
+	const out = [];
+	for (const [index, answer] of answers.entries()) {
+		const id = ids[index];
+		if (answer === "pending" || answer === "failed" || id === void 0) return;
+		out.push({
+			id,
+			holders: answer
+		});
+	}
+	return out;
 }
-/**
-* The grant with its grantee's row condition. A graph relation needs the
-* `RelationSource`, which snapshots and `where()` do not carry, so the grant
-* becomes server-only (`portable: false`) there.
-*/
-function graphAware(grant, where) {
-	const combined = combineWhere(grant.where, where);
-	const graph = hasConditionOp(combined, "related");
-	const inherits = flattenGrantee(grant.to).some((item) => item.kind === "inherit");
-	return freezeDeep(compact({
-		...grant,
-		where: combined,
-		portable: graph ? false : grant.portable,
-		graph: graph && grant.portable && !inherits ? true : void 0
-	}));
+async function discoverRole(item, allow, ctx) {
+	if (typeof item.scope !== "string" || item.scope === "global") {
+		ctx.incomplete();
+		return;
+	}
+	const key = scopeField(ctx.resource, item.scope, ctx.scopes);
+	const id = key === void 0 ? void 0 : relationId(ownGet(ctx.row, key));
+	if (id === void 0) return;
+	const members = await ctx.list(item.scope, id);
+	if (members === null) {
+		ctx.incomplete();
+		return;
+	}
+	for (const member of members.filter((entry) => entry.membership.roles.includes(item.role))) ctx.add(member.id, allow ? {
+		kind: "role",
+		role: item.role,
+		membership: member.membership
+	} : void 0, member.membership);
 }
-/**
-* `where()` keeps a grant that is server-only because it reads the graph:
-* its `related` nodes compile to subqueries given relation mappings.
-*/
-function whereGrant(grant) {
-	return grant.graph === true ? freezeDeep({
-		...grant,
-		portable: true
-	}) : grant;
+function holderVia(holder, at, share, group) {
+	if (!share) return {
+		kind: "relation",
+		...at
+	};
+	return compact({
+		kind: "share",
+		...at,
+		expiresAt: holder.expiresAt,
+		group
+	});
 }
 /**
-* Every grant the subject may reach, once per membership that holds all of
-* its scoped roles, so a client can check that membership's tenant, team or
-* resource. A scoped role held only globally reaches nothing.
+* Principals holding `group`'s relation, through at most `budget` more groups
+* of its resource; `undefined` when a read failed. `memo` keeps each group's
+* members per budget across one discovery, so a group shared by many paths is
+* read once; a result cut short by a cycle is path-specific and not kept.
 */
-function collectSnapshotGrants(policy, subject, customRoles, now = nowSeconds(), customGrants = customGrantsFor(policy, customRoles), mode = "held") {
-	const skip = (grant, match) => mode === "held" ? !match.matched : match.matched || match.reason !== "not-entitled" || grant.effect !== "allow";
-	const scopes = scopeList(policy.scopes);
-	const declared = declaredRoleNames(policy);
-	const global = expandRoleNames(subject.principal?.roles ?? [], declared, customRoles, subject.principal?.tenant);
-	const held = (subject.principal?.memberships ?? []).map((membership) => ({
-		membership,
-		roles: new Set(expandRoleNames(membership.roles, declared, customRoles, tenantOf(membership, scopes)).roles)
-	}));
-	const holds = (entry, item) => entry.roles.has(item.role) && (typeof item.scope === "string" ? entry.membership.scope === item.scope : entry.membership.on !== void 0);
-	const requirementOf = (grant, resource) => grant.requires === void 0 || grant.effect !== "allow" ? void 0 : requirementCondition(policy, subject, grant.requires, resource, now, customRoles, customGrants);
-	const out = [];
-	for (const grant of grantList(policy)) {
-		if (mode === "held" && !coversRequirements(policy.permissions, grant.requires, subject.delegation)) continue;
-		const resource = getResource(policy.permissions, grant.permission.resource);
-		const match = matchGrantee(grant.to, subject, now, resource, scopes, policy.resources);
-		if (skip(grant, match)) continue;
-		const roleItems = flattenGrantee(grant.to).filter((item) => item.kind === "role");
-		if (roleItems.length > 0 && subject.principal === null) continue;
-		if (!roleItems.every((item) => item.scope !== "global" || global.roles.includes(item.role))) continue;
-		const merged = graphAware(grant, combineWhere(match.where, requirementOf(grant, resource)));
-		const scoped = roleItems.filter((item) => item.scope !== "global");
-		if (scoped.length === 0) {
-			out.push({ grant: merged });
+async function groupMembers(group, ctx, budget, seen, memo) {
+	const key = JSON.stringify([
+		group.resource,
+		group.id,
+		group.relation
+	]);
+	const memoKey = `${budget}:${key}`;
+	const known = memo.get(memoKey);
+	if (known !== void 0) return {
+		members: known,
+		cut: false
+	};
+	let holders = ctx.reader.holders(group);
+	if (holders === "pending") {
+		await settle$1(ctx.cache);
+		holders = ctx.reader.holders(group);
+	}
+	if (holders === "pending" || holders === "failed") return;
+	const path = new Set(seen).add(key);
+	const out = /* @__PURE__ */ new Set();
+	let cut = false;
+	for (const holder of holders) {
+		if ("principal" in holder) {
+			out.add(holder.principal.id);
 			continue;
 		}
-		for (const entry of held) if (keepsPermission(entry.membership, grant.permission.key) && scoped.every((item) => item.kind === "role" && holds(entry, item))) out.push({
-			grant: merged,
-			membership: entry.membership
-		});
+		const nested = JSON.stringify([
+			holder.group.resource,
+			holder.group.id,
+			holder.group.relation
+		]);
+		const same = holder.group.resource === group.resource;
+		if (path.has(nested)) {
+			cut = true;
+			continue;
+		}
+		if (same && budget <= 0) continue;
+		const walk = await groupMembers(holder.group, ctx, same ? budget - 1 : 16, path, memo);
+		if (walk === void 0) return;
+		cut ||= walk.cut;
+		for (const member of walk.members) out.add(member);
 	}
-	for (const { grant, role } of customGrants) {
-		const globalHeld = holdsGlobalCustomRole(subject.principal?.roles, role);
-		const holders = held.filter((entry) => keepsPermission(entry.membership, grant.permission.key) && holdsCustomRole(entry.membership, role, scopes));
-		if (holders.length === 0 && !globalHeld) continue;
-		const resource = getResource(policy.permissions, grant.permission.resource);
-		const match = matchGrantee(grant.to, subject, now, resource, scopes, policy.resources);
-		if (skip(grant, match)) continue;
-		const merged = graphAware(grant, combineWhere(match.where, requirementOf(grant, resource)));
-		if (globalHeld) out.push({ grant: merged });
-		for (const entry of holders) out.push({
-			grant: merged,
-			membership: entry.membership
-		});
+	const members = [...out];
+	if (!cut) memo.set(memoKey, members);
+	return {
+		members,
+		cut
+	};
+}
+async function discoverGraph(condition, allow, ctx) {
+	const nodes = await walkHolders(condition, ctx.row, ctx.reader, ctx.cache);
+	if (nodes === void 0) {
+		ctx.incomplete();
+		return;
+	}
+	const node = ctx.policy.resources.get(condition.resource);
+	const memo = /* @__PURE__ */ new Map();
+	for (const entry of nodes) for (const holder of entry.holders) {
+		const at = {
+			resource: condition.resource,
+			relation: holder.relation,
+			id: entry.id
+		};
+		const share = isEdgeRelation(node?.relations[holder.relation]);
+		if ("principal" in holder) {
+			ctx.add(holder.principal.id, allow ? holderVia(holder, at, share) : void 0);
+			continue;
+		}
+		const walk = await groupMembers(holder.group, ctx, holder.group.resource === condition.resource ? 15 : 16, /* @__PURE__ */ new Set(), memo);
+		if (walk === void 0) {
+			ctx.incomplete();
+			continue;
+		}
+		for (const member of walk.members) ctx.add(member, allow ? holderVia(holder, at, share, holder.group) : void 0);
 	}
-	const fresh = policy.fresh ?? [];
-	if (mode === "held" && subject.stale === true && fresh.length > 0) return out.filter(({ grant }) => grant.effect === "deny" || !fresh.includes(grant.permission.key));
-	return out;
 }
-/**
-* Declared roles a tenant admin may hand out or compose, before any
-* intersection: `assignable` roles, plus every role some `assigns` lists.
-*/
-function assignableCandidates(policy) {
-	const listed = new Set(policy.roles.flatMap((binding) => binding.assigns ?? []));
-	const names = [...listRoles(policy.vocabulary?.roles).filter((leaf) => leaf.assignable || listed.has(leaf.key)).map((leaf) => leaf.key), ...policy.roles.filter((binding) => binding.assignable || listed.has(binding.name)).map((binding) => binding.name)];
-	return rankRoles(policy, [...new Set(names)]).map((name) => roleLeaf(policy, name));
+async function discoverRelation(item, allow, ctx, expanded = false) {
+	const condition = relationCondition(item, ctx.resource, ctx.scopes, { resources: ctx.policy.resources });
+	if (condition?.op === "related") {
+		await discoverGraph(condition, allow, ctx);
+		return;
+	}
+	const spec = ctx.resource?.relations[item.relation];
+	if (spec?.includes !== void 0 && !expanded) {
+		for (const name of expandRelation(ctx.resource, item.relation)) await discoverRelation({
+			...item,
+			relation: name
+		}, allow, ctx, true);
+		return;
+	}
+	const via = allow ? {
+		kind: "relation",
+		resource: ctx.permission.resource,
+		relation: item.relation,
+		id: relationId(ownGet(ctx.row, ctx.resource?.id ?? "id")) ?? ""
+	} : void 0;
+	if (isFieldRelation(spec) && spec.memberOf !== void 0) {
+		const scope = resolveScope(ctx.scopes, spec.memberOf);
+		const id = relationId(ownGet(ctx.row, spec.field));
+		const members = scope === void 0 || id === void 0 ? [] : await ctx.list(scope, id);
+		if (members === null) {
+			ctx.incomplete();
+			return;
+		}
+		for (const member of members) ctx.add(member.id, via, member.membership);
+		return;
+	}
+	const column = isFieldRelation(spec) ? spec.field : isPrincipalRelation(spec) ? spec.principal : void 0;
+	const holder = column === void 0 ? void 0 : relationId(ownGet(ctx.row, column));
+	if (holder !== void 0) ctx.add(holder, via);
 }
-/**
-* The levels a held allow of a permission covers: its own `level`, every
-* level when it has no row condition, or the levels whose condition equals
-* its condition.
-*/
-function heldLevels(policy, grant, names) {
-	if (grant.level !== void 0) return [grant.level];
-	if (grant.where === void 0) return names;
-	const held = canonicalJson(grant.where);
-	return names.filter((name) => {
-		const condition = levelCondition(policy, grant.permission.resource, name);
-		return condition !== void 0 && canonicalJson(condition) === held;
-	});
+function discover(grant, item, ctx) {
+	const allow = grant.effect === "allow";
+	switch (item.kind) {
+		case "role": return discoverRole(item, allow, ctx);
+		case "relation": return discoverRelation(item, allow, ctx);
+		case "anyone":
+		case "authenticated":
+		case "plan":
+		case "actor":
+		case "assurance":
+		case "inherit":
+			ctx.incomplete();
+			return Promise.resolve();
+		default: return unknownKind(item, ctx);
+	}
 }
-/**
-* What the subject may hand out in `tenant`: declared assignable roles and the
-* tenant custom-role ceiling, narrowed by `allowed` (`RoleSource.assignable`),
-* then intersected with the permissions the subject holds there. Holding a
-* role or a granted permission with `meta.manageRoles` lifts the intersection.
-*/
-function assignableIn(policy, subject, customRoles, customGrants, tenant, allowed, now = nowSeconds(), global = false) {
-	const principal = subject.principal;
-	if (principal === null) return {
-		roles: [],
-		permissions: [],
-		levels: {},
-		manage: false,
-		inert: []
+/** Holders of a grantee kind this build does not know cannot be listed. */
+function unknownKind(_item, ctx) {
+	ctx.incomplete();
+	return Promise.resolve();
+}
+function memberLister(source, scopes) {
+	const listed = /* @__PURE__ */ new Map();
+	const load = async (scope, id) => {
+		if (source?.list === void 0) return null;
+		try {
+			return (await source.list({
+				scope,
+				id
+			})).flatMap((entry) => typeof entry.principal?.id === "string" ? normalizeMemberships([entry.membership], scopes).map((membership) => ({
+				id: entry.principal.id,
+				membership
+			})) : []);
+		} catch {
+			return null;
+		}
+	};
+	return (scope, id) => {
+		const key = JSON.stringify([scope, id]);
+		const known = listed.get(key) ?? load(scope, id);
+		listed.set(key, known);
+		return known;
 	};
+}
+async function whoCan(input) {
+	const { policy, permission, row } = input;
+	if (permission.kind !== "instance" || row === null || typeof row !== "object") return freezeDeep({
+		permission: permission.key,
+		holders: [],
+		complete: false
+	});
 	const scopes = scopeList(policy.scopes);
-	const scoped = tenant === void 0 ? subject : freezeDeep(compact({
-		...subject,
-		principal: compact({
-			...principal,
-			tenant: resolveActiveTenant(principal, tenant, scopes, now)
-		})
-	}));
-	const heldGrants = collectSnapshotGrants(policy, scoped, customRoles, now, customGrants).filter((item) => item.grant.effect === "allow" && (item.membership === void 0 || !global && tenantOf(item.membership, scopes) === tenant && !isMembershipExpired(item.membership, now))).map((item) => item.grant);
-	const heldKeys = new Set(heldGrants.map((grant) => grant.permission.key));
-	const heldNames = heldRoleNames(policy, subject, tenant, void 0, now);
-	const quiet = {
+	let complete = !input.customGrants.some((item) => item.grant.permission.key === permission.key);
+	const found = /* @__PURE__ */ new Map();
+	const ctx = {
+		policy,
+		scopes,
+		resource: getResource(policy.permissions, permission.resource),
+		permission,
+		row,
+		reader: input.reader,
+		cache: input.cache,
+		list: memberLister(input.memberships, scopes),
+		add(id, via, membership) {
+			const entry = found.get(id) ?? {
+				memberships: [],
+				via: []
+			};
+			found.set(id, entry);
+			if (via !== void 0) entry.via.push(via);
+			if (membership !== void 0) entry.memberships.push(membership);
+		},
+		incomplete() {
+			complete = false;
+		}
+	};
+	await Promise.all((policy.index.grantsByKey.get(permission.key) ?? []).flatMap((grant) => flattenGrantee(grant.to).map((item) => discover(grant, item, ctx))));
+	const root = rootScope(scopes);
+	const tenantKey = root === void 0 ? void 0 : scopeField(getResource(policy.permissions, permission.resource), root, scopes);
+	const tenant = tenantKey === void 0 ? void 0 : relationId(ownGet(row, tenantKey));
+	const env = {
 		emit: false,
 		simulated: true,
 		skipAlternatives: true,
-		customRoles,
-		customGrants,
+		customRoles: [],
+		customGrants: [],
 		listeners: emptyListeners(),
 		sink: void 0,
 		limits: void 0,
 		limitCache: /* @__PURE__ */ new Map(),
-		team: void 0
+		team: input.team,
+		relations: input.reader
 	};
-	const manage = heldNames.some((name) => roleMeta(policy, name)?.manageRoles === true) || listPermissions(policy.permissions).some((leaf) => leaf.meta.manageRoles === true && evaluate(policy, scoped, leaf, void 0, {
-		source: "simulate",
-		trusted: true,
-		now
-	}, quiet).outcome === "granted");
-	const narrowed = allowed === void 0 ? void 0 : new Set(allowed);
-	const candidates = assignableCandidates(policy).filter((leaf) => narrowed === void 0 || narrowed.has(leaf.key));
-	const held = new Set(heldNames);
-	const listed = usesAssigns(policy) ? new Set(heldNames.flatMap((name) => policy.rolesByName.get(name)?.assigns ?? [])) : void 0;
-	const roles = manage ? candidates : candidates.filter((leaf) => {
-		if (listed !== void 0) return listed.has(leaf.key);
-		if (held.has(leaf.key)) return true;
-		const keys = [...roleAllowKeys(policy, leaf.key)];
-		return keys.length > 0 && keys.every((key) => heldKeys.has(key));
+	const now = nowSeconds();
+	const ordered = [...found.entries()].toSorted(([a], [b]) => byCodePoint(a, b));
+	const decideAll = () => ordered.map(([id, entry]) => {
+		const subject = freezeDeep({
+			principal: {
+				id,
+				roles: [],
+				memberships: entry.memberships,
+				...tenant === void 0 ? {} : { tenant }
+			},
+			context: {}
+		});
+		return evaluate(policy, subject, permission, row, {
+			source: "simulate",
+			trusted: true,
+			now
+		}, env);
 	});
-	const root = global ? "global" : rootScope(scopes);
-	const ceiling = new Set((root === void 0 ? [] : ceilingGrants(policy, root, allowed)).map((grant) => grant.permission.key));
-	const permissions = listPermissions(policy.permissions).filter((leaf) => ceiling.has(leaf.key) && (manage || heldKeys.has(leaf.key)));
-	const offeredLevels = (key, names) => {
-		if (manage) return names;
-		const reached = new Set(heldGrants.filter((grant) => grant.permission.key === key).flatMap((grant) => heldLevels(policy, grant, names)));
-		return names.filter((name) => reached.has(name));
-	};
-	const levels = {};
-	for (const leaf of permissions) {
-		const names = leaf.kind === "instance" ? levelNames(policy, leaf.resource) : [];
-		if (names.length > 0) levels[leaf.key] = offeredLevels(leaf.key, names);
+	let decisions = decideAll();
+	if (pendingRelations(input.cache).length > 0) {
+		await settle$1(input.cache);
+		decisions = decideAll();
 	}
-	const ceilingKeys = /* @__PURE__ */ new Map();
-	const mayHandOut = (scope, grant) => {
-		const key = grant.permission.key;
-		let keys = ceilingKeys.get(scope);
-		if (keys === void 0) {
-			keys = new Set(ceilingGrants(policy, scope, allowed).map((item) => item.permission.key));
-			ceilingKeys.set(scope, keys);
-		}
-		if (!keys.has(key) || !(manage || heldKeys.has(key))) return false;
-		const names = grant.permission.kind === "instance" ? levelNames(policy, grant.permission.resource) : [];
-		if (names.length === 0) return true;
-		const offered = offeredLevels(key, names);
-		return heldLevels(policy, grant, names).every((name) => offered.includes(name));
-	};
-	const custom = global || tenant === void 0 ? {
-		roles: [],
-		inert: []
-	} : assignableCustomRoles(policy, customRoles, tenant, manage ? void 0 : roles, mayHandOut);
-	return {
-		roles: [...roles, ...custom.roles],
-		permissions,
-		levels,
-		manage,
-		inert: custom.inert
-	};
-}
-/**
-* The tenant's custom roles the subject may hand out: held at a scope it may
-* assign declared roles at (any scope with `meta.manageRoles`), allowing at
-* least one permission after the ceiling, and only permissions and levels it
-* may hand out at that scope. A role that allows nothing is `inert`.
-*/
-function assignableCustomRoles(policy, customRoles, tenant, declared, mayHandOut) {
-	const scopes = scopeList(policy.scopes);
-	const root = rootScope(scopes);
-	const assignsAt = declared === void 0 ? void 0 : new Set(declared.map((leaf) => leaf.on === void 0 ? root : resolveScope(scopes, leaf.on)));
-	const out = /* @__PURE__ */ new Map();
-	const inert = /* @__PURE__ */ new Set();
-	for (const role of tenantCustomRoles(policy, customRoles)) {
-		if (role.tenant !== tenant || out.has(role.name)) continue;
-		const at = customRoleScope(role, scopes);
-		if (at === void 0 || assignsAt !== void 0 && !assignsAt.has(at)) continue;
-		const { grants } = resolveCustomRole(policy, role);
-		if (!grants.some((grant) => grant.effect === "allow")) {
-			inert.add(role.name);
+	const holders = [];
+	for (const [index, [id, entry]] of ordered.entries()) {
+		const decision = decisions[index];
+		if (decision === void 0 || decision.outcome === "denied") {
+			if (decision?.outcome === "denied" && decision.denials.some((denial) => denial.reason === "relation-unavailable" || denial.reason === "relation-depth")) complete = false;
 			continue;
 		}
-		if (grants.every((grant) => grant.effect === "deny" || mayHandOut(at, grant))) out.set(role.name, synthesiseRole(role.name, {
-			on: at,
-			assignable: true
-		}));
-	}
-	return {
-		roles: [...out.values()].toSorted((a, b) => a.key.localeCompare(b.key)),
-		inert: [...inert].filter((name) => !out.has(name)).toSorted()
-	};
-}
-/** The one path from a resolved subject to a `Snapshot`; pure apart from the default clock. */
-function snapshotOf(policy, subject, options) {
-	const now = options.now ?? nowSeconds();
-	const customGrants = options.customGrants ?? customGrantsFor(policy, options.customRoles);
-	const roles = heldRoleNames(policy, subject, subject.principal?.tenant, void 0, now);
-	const audiences = audiencesOf(policy, roles);
-	return buildSnapshot(compact({
-		subject,
-		roles,
-		audiences: audiences.length === 0 ? void 0 : audiences,
-		notEntitled: collectSnapshotGrants(policy, subject, options.customRoles, now, customGrants, "not-entitled"),
-		grants: collectSnapshotGrants(policy, subject, options.customRoles, now, customGrants).map((item) => periodBound(policy, item.grant) ? Object.assign({}, item, { grant: freezeDeep({
-			...item.grant,
-			portable: false
-		}) }) : item),
-		include: includePrefixes(options.include),
-		tenants: options.tenants,
-		simulated: options.simulated,
-		now: Math.floor(now),
-		vocabulary: policy.vocabulary,
-		scopes: snapshotScopes(policy),
-		idOf: (name) => getResource(policy.permissions, name)?.id,
-		delegated: delegatedPermissions(policy.delegations, subject, new Set(roles), now),
-		assignable: (tenant) => {
-			const found = assignableIn(policy, subject, options.customRoles, customGrants, tenant, options.assignable?.get(tenant), now);
-			return compact({
-				tenant,
-				roles: found.roles.map((leaf) => leaf.key),
-				permissions: found.permissions,
-				levels: Object.keys(found.levels).length === 0 ? void 0 : found.levels
-			});
-		}
-	}));
-}
-/** The policy's scopes as snapshots and `permdock cloud push` carry them, with the resources each partitions. */
-function snapshotScopes(policy) {
-	if (policy.scopes.length === 0) return;
-	const resources = [...policy.resources.values()];
-	return policy.scopes.map((scope) => {
-		const nodes = resources.filter((node) => partitionsOf(node, policy.scopes).includes(scope.name));
-		const partitioned = nodes.map((node) => node.name);
-		const fields = Object.fromEntries(nodes.flatMap((node) => {
-			const field = scopeField(node, scope.name, policy.scopes);
-			return field === void 0 || field === scope.key ? [] : [[node.name, field]];
-		}));
-		return compact({
-			name: scope.name,
-			key: scope.key ?? "",
-			within: scope.within,
-			resources: partitioned.length === 0 ? void 0 : partitioned,
-			fields: Object.keys(fields).length === 0 ? void 0 : fields
+		holders.push({
+			principal: { id },
+			via: entry.via
 		});
+	}
+	return freezeDeep({
+		permission: permission.key,
+		holders,
+		complete
 	});
 }
+//#endregion
+//#region src/core/instance.ts
+/** Each round reads one more layer: link hops, then the chain, then nested groups. */
+const LOAD_ROUNDS = 48;
 function buildInstance(policy, subject, envBase, team) {
 	const listeners = emptyListeners();
 	const queuedAuth = [...envBase.queuedAuth];
@@ -2763,27 +2973,6 @@ function buildInstance(policy, subject, envBase, team) {
 		relations,
 		...envBase.approvalPolicies === void 0 ? {} : { approvalPolicies: envBase.approvalPolicies }
 	});
-	/** The one `simulate` event for a batch: the worst decision, with the counts. */
-	const simulateEvent = (evaluated) => {
-		const counts = {
-			granted: 0,
-			denied: 0,
-			approvalRequired: 0
-		};
-		for (const [, , decision] of evaluated) if (decision.outcome === "granted") counts.granted += 1;
-		else if (decision.outcome === "approval-required") counts.approvalRequired += 1;
-		else counts.denied += 1;
-		const worst = evaluated.find(([, , decision]) => decision.outcome === "denied") ?? evaluated.find(([, , decision]) => decision.outcome === "approval-required") ?? evaluated[0];
-		if (worst === void 0) return;
-		const [permission, data, decision] = worst;
-		finish(policy, subject, permission, data, decision, {
-			source: "simulate",
-			trusted: true
-		}, {
-			...envFor(false),
-			emit: true
-		}, true, void 0, counts);
-	};
 	const decideImpl = (permission, data, options) => evaluate(policy, subject, permission, data, options ?? {}, envFor(options?.source !== "simulate", options?.source === "can"));
 	const explainImpl = (permission, data, options) => {
 		return decideImpl(permission, data, {
@@ -2803,39 +2992,10 @@ function buildInstance(policy, subject, envBase, team) {
 		}
 	};
 	const assertImpl = (permission, data, options) => {
-		const decision = decideImpl(permission, data, {
+		return assertDecision(policy, subject, permission, data, decideImpl(permission, data, {
 			...options,
 			source: options?.source ?? "assert"
-		});
-		if (decision.outcome === "granted") return decision;
-		const onDenied = options?.onDenied ?? policy.onDenied;
-		if (onDenied !== void 0) onDenied(decision);
-		const resource = getResource(policy.permissions, permission.resource);
-		const resourceId = data !== null && typeof data === "object" ? data[resource?.id ?? "id"] : void 0;
-		const resourceRef = compact({
-			type: permission.resource,
-			id: resourceId === void 0 ? void 0 : String(resourceId)
-		});
-		if (decision.outcome === "approval-required") throw new PermDockApprovalRequiredError({
-			decision,
-			permission: permission.key,
-			scope: permission.scope,
-			resource: resourceRef,
-			message: approvalMessage(permission.key, decision.reason, decision.token)
-		});
-		if (decision.denials.some((denial) => denial.reason === "validation")) {
-			const detail = decision.denials[0]?.detail;
-			if (detail instanceof PermDockValidationError) throw detail;
-		}
-		throw new PermDockDeniedError({
-			decision,
-			permission: permission.key,
-			scope: permission.scope,
-			resource: resourceRef,
-			subject,
-			message: deniedMessage(permission.key, subject.principal?.id, decision.denials, decision.alternatives.map((leaf) => leaf.key)),
-			...data === void 0 || resource === void 0 ? {} : { disclosure: resource.disclosure }
-		});
+		}), options?.onDenied ?? policy.onDenied);
 	};
 	const instance = {
 		can: canImpl,
@@ -2878,6 +3038,7 @@ function buildInstance(policy, subject, envBase, team) {
 				token: "pd1.filter"
 			}) : freezeDeep({
 				outcome: "denied",
+				permission: permission.key,
 				denials: [{
 					role: null,
 					reason: "no-grant"
@@ -2970,27 +3131,15 @@ function buildInstance(policy, subject, envBase, team) {
 			};
 			if (isReadonlyArray(input)) {
 				const decisions = input.map(([permission, data]) => quietly(permission, data));
-				simulateEvent(evaluated);
+				simulateEvent(policy, subject, envFor(false), evaluated);
 				return decisions;
 			}
 			if (isArazzoSimulateInput(input)) {
 				const plan = simulateArazzo(input, input.permissions ?? policy.permissions, quietly);
-				simulateEvent(evaluated);
+				simulateEvent(policy, subject, envFor(false), evaluated);
 				return plan;
 			}
-			const preview = input;
-			const previewRoles = preview.roles?.map((item) => typeof item === "string" ? item : item.key);
-			const kinds = subject.principal === null ? void 0 : applyRoleKinds(policy, previewRoles ?? subject.principal.roles, preview.memberships === void 0 ? subject.principal.memberships ?? [] : normalizeMemberships(preview.memberships, scopeList(policy.scopes)));
-			const previewPrincipal = subject.principal === null || kinds === void 0 ? null : freezeDeep(compact({
-				...subject.principal,
-				roles: kinds.roles,
-				memberships: preview.memberships === void 0 && subject.principal.memberships === void 0 ? void 0 : kinds.memberships,
-				tenant: preview.tenant ?? subject.principal.tenant
-			}));
-			return buildInstance(policy, freezeDeep({
-				...subject,
-				principal: previewPrincipal
-			}), {
+			return buildInstance(policy, previewSubject(policy, subject, input), {
 				...envBase,
 				simulated: true,
 				relationCache
@@ -3089,32 +3238,8 @@ function buildInstance(policy, subject, envBase, team) {
 			return activate(policy, subject, input, nowSeconds());
 		},
 		derive(options) {
-			const scopes = scopeList(policy.scopes);
-			const tenants = tenantsOf(subject.principal, scopes);
-			const auth = [];
-			const named = options.customRoles === void 0 ? void 0 : roleSourceFor(options.customRoles, subject, auth);
-			const roleSource = options.customRoles === void 0 ? envBase.roleSource : named;
-			const roles = options.customRoles === void 0 ? envBase.customRoles : customRolesFor(named, tenants, auth, subject.principal === null ? void 0 : subject.principal.roles ?? [], (tenant) => heldRoleNamesIn(subject.principal, scopes, tenant));
-			const names = options.customRoles === void 0 ? envBase.assignable : assignableNamesFor(named, tenants, auth);
-			const approvals = options.approvalPolicies === void 0 ? envBase.approvalPolicies : approvalPoliciesFor(policy, options.approvalPolicies, tenants, auth);
-			const relationSource = options.relations ?? envBase.relations;
-			const build = (loadedRoles, loadedNames, loadedApprovals) => buildInstance(policy, subject, compact({
-				...envBase,
-				customRoles: loadedRoles,
-				roleSource,
-				assignable: loadedNames,
-				approvalPolicies: loadedApprovals,
-				relations: relationSource,
-				relationCache: options.relations === void 0 ? relationCache : void 0,
-				queuedAuth: auth,
-				queuedErrors: []
-			}), team);
-			if (isThenable(roles) || isThenable(names) || isThenable(approvals)) return Promise.all([
-				roles,
-				names,
-				approvals
-			]).then(([loadedRoles, loadedNames, loadedApprovals]) => build(loadedRoles, loadedNames, loadedApprovals));
-			return build(roles, names, approvals);
+			const derived = deriveEnv(policy, subject, envBase, relationCache, options);
+			return isThenable(derived) ? Promise.resolve(derived).then((env) => buildInstance(policy, subject, env, team)) : buildInstance(policy, subject, derived, team);
 		},
 		subject
 	};
@@ -3159,6 +3284,10 @@ function scopesReaching(policy, permission) {
 function challengeScope(policy, permission) {
 	return coarseScopesFor(policy, permission)[0] ?? permission.scope;
 }
+/** Whether a token holding `granted` carries any of `scopes`. */
+function hasScope(granted, scopes) {
+	return scopes.some((scope) => granted?.includes(scope) === true);
+}
 //#endregion
 //#region src/core/resolve-subject.ts
 /**
@@ -3197,7 +3326,7 @@ function assemblePrincipal(policy, user, options, auth) {
 	} catch {
 		principal = null;
 	}
-	const contextResult = resolveContext(policy, user, context, auth);
+	const contextResult = withRequestContext(options.context, resolveContext(policy, user, context, auth));
 	let memberships = principal?.memberships ?? [];
 	let live = false;
 	const source = options.memberships === void 0 ? void 0 : asMembershipSource(options.memberships);
@@ -3281,7 +3410,7 @@ function finishSubject(policy, assembled, context, input, options, extra) {
 	}));
 	const scopes = scopeList(policy.scopes);
 	const held = heldTenantOf(assembled.principal);
-	const kinds = applyRoleKinds(policy, assembled.principal.roles, normalizeMemberships(input, scopes));
+	const kinds = applyRoleKinds(policy, assembled.principal.roles, checkMembershipX(normalizeMemberships(input, scopes), policyX(policy)?.membership, extra.auth));
 	const roles = held === void 0 ? kinds.roles : [];
 	const memberships = held === void 0 ? kinds.memberships : outsideHeld(held, options) ? [] : kinds.memberships.filter((membership) => tenantOf(membership, scopes) === held);
 	const plans = [.../* @__PURE__ */ new Set([...assembled.principal.plans ?? [], ...extra.plans])];
@@ -3303,6 +3432,30 @@ function finishSubject(policy, assembled, context, input, options, extra) {
 		liveSession: assembled.liveSession
 	}));
 }
+/** Runs the policy's membership schema over each `x`; an invalid one is dropped and reported, never the membership. */
+function checkMembershipX(memberships, schema, auth) {
+	if (schema === void 0) return memberships;
+	let dropped = false;
+	const checked = memberships.map((membership) => {
+		if (membership.x === void 0) return membership;
+		const x = readAppData(schema, membership.x);
+		if (x === void 0) {
+			dropped = true;
+			const { x: _dropped, ...rest } = membership;
+			return Object.freeze(rest);
+		}
+		return Object.freeze({
+			...membership,
+			x: freezeCopy(x)
+		});
+	});
+	if (dropped) auth.push({
+		reason: "schema",
+		source: "memberships",
+		cause: "x"
+	});
+	return checked;
+}
 function activeTenantOf(policy, assembled, memberships, options) {
 	if (assembled.principal === null) return;
 	const held = heldTenantOf(assembled.principal);
@@ -3390,6 +3543,17 @@ function resolveContext(policy, user, fallback, auth) {
 		return {};
 	}
 }
+function withRequestContext(request, resolved) {
+	if (request === void 0) return resolved;
+	const base = sanitizeContext(request);
+	return isThenable(resolved) ? resolved.then((value) => ({
+		...base,
+		...value
+	})) : {
+		...base,
+		...resolved
+	};
+}
 function resolveSubject(policy, user, options, auth) {
 	const assembled = assemblePrincipal(policy, user, options, auth);
 	const memberships = settle(assembled.memberships, [], () => {
@@ -3406,16 +3570,19 @@ function resolveSubject(policy, user, options, auth) {
 		Promise.resolve(stale)
 	]).then(async ([context, resolved, isStale]) => finishSubject(policy, assembled, context, resolved, options, {
 		stale: isStale,
-		plans: await withPlans(resolved)
+		plans: await withPlans(resolved),
+		auth
 	}));
 	const plans = withPlans(memberships);
 	if (isThenable(plans)) return Promise.resolve(plans).then((resolved) => finishSubject(policy, assembled, assembled.context, memberships, options, {
 		stale,
-		plans: resolved
+		plans: resolved,
+		auth
 	}));
 	return finishSubject(policy, assembled, assembled.context, memberships, options, {
 		stale,
-		plans
+		plans,
+		auth
 	});
 }
 //#endregion
@@ -3476,4 +3643,4 @@ function createPermDock(policy, user, options = {}) {
 	return instantiate(policy, subject, options, auth);
 }
 //#endregion
-export { countHolders as C, memoryApprovalPolicies as D, approvalPoliciesFor as E, validateApprovalPolicy as O, composeMemberships as S, APPROVAL_POLICY_UNAVAILABLE as T, leveled as _, collectSnapshotGrants as a, validateCustomRole as b, rankRoles as c, breakGlass as d, supportAccess as f, customRoleScope as g, customRoleClaim as h, scopesReaching as i, usesAssigns as l, ceilingGrants as m, resolveSubject as n, snapshotOf as o, andWhere as p, challengeScope as r, snapshotScopes as s, createPermDock as t, declaredRoleNames as u, membershipsClaim as v, isExternallyManaged as w, claimsFirst as x, resolveCustomRole as y };
+export { countHolders as C, memoryApprovalPolicies as D, approvalPoliciesFor as E, validateApprovalPolicy as O, composeMemberships as S, APPROVAL_POLICY_UNAVAILABLE as T, leveled as _, scopesReaching as a, validateCustomRole as b, collectSnapshotGrants as c, breakGlass as d, supportAccess as f, customRoleScope as g, customRoleClaim as h, hasScope as i, rankRoles as l, ceilingGrants as m, resolveSubject as n, snapshotOf as o, andWhere as p, challengeScope as r, snapshotScopes as s, createPermDock as t, usesAssigns as u, membershipsClaim as v, isExternallyManaged as w, claimsFirst as x, resolveCustomRole as y };