permdock 0.3.0 → 0.4.0

package/dist/permission-registry-BsblpB-z.js

@@ -0,0 +1,385 @@
+import { n as isReadonlyArray, t as compact } from "./compact-CAf557ZB.js";
+import { n as freezeDeep } from "./freeze-CrU8nQeX.js";
+import { a as assertSafeKey, c as ownKeys, o as isForbiddenKey } from "./thenable-QSmvt-vZ.js";
+import { r as parseAppData, t as assertAppData } from "./app-data-CV8pqqMi.js";
+import { f as normaliseRelation, h as restrictedStopsOf, i as assertIncludes, n as RESOURCE_NAME, r as assertGraphTargets, t as LEVEL_NAME } from "./resource-relations-D1Un3pcz.js";
+//#region src/core/brands.ts
+const RESOURCE_BRAND = Symbol.for("permdock.resource");
+const TREE_REGISTRY = Symbol.for("permdock.registry");
+const NODE_RESOURCE = Symbol.for("permdock.resource");
+const TREE_LEAVES = Symbol.for("permdock.leaves");
+const LEAF_FORMER = Symbol.for("permdock.former");
+//#endregion
+//#region src/core/permission-leaf.ts
+function isStandardSchema(value) {
+	return value !== null && typeof value === "object" && "~standard" in value && typeof value["~standard"]?.version === "number";
+}
+function isResourceInit(value) {
+	return value !== null && typeof value === "object" && RESOURCE_BRAND in value && value[RESOURCE_BRAND] === true;
+}
+function isResourceOptions(value) {
+	return value !== null && typeof value === "object" && !Array.isArray(value) && !isStandardSchema(value);
+}
+function metaFor(list, action, schema) {
+	if (list === void 0 || Array.isArray(list)) return freezeDeep({});
+	const meta = list[action];
+	if (meta?.x === void 0) return freezeDeep({ ...meta });
+	return freezeDeep({
+		...meta,
+		x: parseAppData(schema, meta.x, `meta.x of action '${action}'`)
+	});
+}
+function resourceMetaFor(name, meta, schema) {
+	if (meta === void 0) return;
+	assertAppData(meta, `meta of resource '${name}'`);
+	for (const field of ["title", "description"]) if (meta[field] !== void 0 && typeof meta[field] !== "string") throw new TypeError(`PermDock: meta.${field} of resource '${name}' must be a string`);
+	return freezeDeep(compact({
+		title: meta.title,
+		description: meta.description,
+		x: meta.x === void 0 ? void 0 : parseAppData(schema, meta.x, `meta.x of resource '${name}'`)
+	}));
+}
+/**
+* MCP and WebMCP tool hints from a permission's `meta`. Hints only inform the
+* client; every call is still decided on the server.
+*/
+function annotationsFor(permission) {
+	const { meta } = permission;
+	const readOnlyHint = meta.readOnly ?? (permission.action === "read" || permission.action === "list");
+	return compact({
+		readOnlyHint,
+		destructiveHint: readOnlyHint ? void 0 : meta.destructive,
+		idempotentHint: meta.idempotent
+	});
+}
+function actionNames(list) {
+	if (list === void 0) return [];
+	if (isReadonlyArray(list)) return list;
+	return Object.keys(list);
+}
+function keyToScope(key) {
+	return key.replaceAll(".", ":");
+}
+function makeLeaf(key, resourceName, action, meta, kind, former) {
+	const leaf = {
+		key,
+		scope: keyToScope(key),
+		resource: resourceName,
+		action,
+		meta
+	};
+	Object.defineProperty(leaf, "kind", {
+		value: kind,
+		enumerable: false,
+		writable: false,
+		configurable: false
+	});
+	if (former !== void 0 && former.length > 0) Object.defineProperty(leaf, LEAF_FORMER, {
+		value: Object.freeze([...former].toSorted()),
+		enumerable: false,
+		writable: false,
+		configurable: false
+	});
+	return Object.freeze(leaf);
+}
+/**
+* The keys `permission` was renamed from, sorted. Empty for a leaf without
+* renames and for one that crossed a serialisation boundary.
+*/
+function formerKeys(permission) {
+	if (!Object.hasOwn(permission, LEAF_FORMER)) return [];
+	const value = Reflect.get(permission, LEAF_FORMER);
+	return isReadonlyArray(value) ? value.filter((item) => typeof item === "string") : [];
+}
+/** The OAuth scope strings `permission` used to have: each former key with `.` as `:`. */
+function formerScopes(permission) {
+	return formerKeys(permission).map(keyToScope);
+}
+function resource(schemaOrOptions, options) {
+	if (schemaOrOptions === void 0 && options === void 0) throw new Error("PermDock: resource() requires a schema or options");
+	if (isStandardSchema(schemaOrOptions)) return {
+		[RESOURCE_BRAND]: true,
+		schema: schemaOrOptions,
+		options: options ?? {}
+	};
+	if (isResourceOptions(schemaOrOptions) && options === void 0) return {
+		[RESOURCE_BRAND]: true,
+		schema: void 0,
+		options: schemaOrOptions
+	};
+	throw new Error("PermDock: resource() first argument must be a schema or options");
+}
+//#endregion
+//#region src/core/materialise-resource.ts
+function materialiseResource(init, path, registry, leaves, build) {
+	const { former } = build;
+	const segment = path.at(-1);
+	if (segment === void 0) throw new Error("PermDock: resource() cannot be the root of definePermissions");
+	const name = init.options.name ?? segment;
+	assertSafeKey(name, "resource");
+	if (init.options.name !== void 0 && !RESOURCE_NAME.test(name)) throw new Error(`PermDock: resource name '${name}' must start with a letter and hold only letters, digits, '_' and '-'`);
+	if (registry.has(name)) throw new Error(`PermDock: duplicate resource name '${name}'`);
+	const prefix = path.join(".");
+	const instanceNames = actionNames(init.options.actions);
+	const collectionNames = actionNames(init.options.collection);
+	if (instanceNames.length === 0 && collectionNames.length === 0) throw new Error(`PermDock: resource '${name}' has no actions or collection`);
+	const instanceSet = /* @__PURE__ */ new Set();
+	const collectionSet = /* @__PURE__ */ new Set();
+	const node = {};
+	for (const action of instanceNames) {
+		assertSafeKey(action, "action");
+		if (instanceSet.has(action)) throw new Error(`PermDock: duplicate action '${action}' on '${name}'`);
+		instanceSet.add(action);
+		const key = `${prefix}.${action}`;
+		const leaf = makeLeaf(key, name, action, metaFor(init.options.actions, action, build.x?.permission), "instance", former.get(key));
+		node[action] = leaf;
+		leaves.push(leaf);
+	}
+	for (const action of collectionNames) {
+		assertSafeKey(action, "action");
+		if (instanceSet.has(action) || collectionSet.has(action)) throw new Error(`PermDock: duplicate action '${action}' on '${name}'`);
+		collectionSet.add(action);
+		const key = `${prefix}.${action}`;
+		const leaf = makeLeaf(key, name, action, metaFor(init.options.collection, action, build.x?.permission), "collection", former.get(key));
+		node[action] = leaf;
+		leaves.push(leaf);
+	}
+	const parent = init.options.parent;
+	if (parent !== void 0) {
+		assertSafeKey(parent.field, "parent field");
+		assertSafeKey(parent.resource, "parent resource");
+	}
+	const version = init.options.version;
+	if (version !== void 0) assertSafeKey(version, "version field");
+	const restrictedOption = init.options.restricted;
+	const restricted = typeof restrictedOption === "string" ? restrictedOption : restrictedOption?.field;
+	if (restrictedOption !== void 0) {
+		if (typeof restricted !== "string") throw new TypeError(`PermDock: resource "${name}" restricted must name a field`);
+		assertSafeKey(restricted, "restricted field");
+	}
+	const disclosure = init.options.disclosure ?? "reveal";
+	if (disclosure !== "hide" && disclosure !== "reveal") throw new Error(`PermDock: resource "${name}" disclosure must be 'hide' or 'reveal'`);
+	const relations = {};
+	for (const [relationName, spec] of Object.entries(init.options.relations ?? {})) {
+		assertSafeKey(relationName, "relation");
+		relations[relationName] = freezeDeep(normaliseRelation(name, relationName, spec));
+	}
+	const links = {};
+	for (const [linkName, link] of Object.entries(init.options.links ?? {})) {
+		assertSafeKey(linkName, "link");
+		if (linkName === "parent") throw new Error(`PermDock: link 'parent' on '${name}' is reserved; declare it as parent`);
+		assertSafeKey(link.field, "link field");
+		assertSafeKey(link.resource, "link resource");
+		links[linkName] = freezeDeep({
+			field: link.field,
+			resource: link.resource
+		});
+	}
+	const restrictedStopList = typeof restrictedOption === "object" ? restrictedStopsOf(name, restrictedOption, parent, links) : void 0;
+	const levels = {};
+	for (const [levelName, condition] of Object.entries(init.options.levels ?? {})) {
+		if (!LEVEL_NAME.test(levelName)) throw new Error(`PermDock: level '${levelName}' on '${name}' must match ^[a-z][a-z0-9_]*$`);
+		if (condition === null || typeof condition !== "object" || Array.isArray(condition)) throw new Error(`PermDock: level '${levelName}' on '${name}' must be a condition object`);
+		levels[levelName] = freezeDeep({ ...condition });
+	}
+	if (Object.keys(levels).length > 0 && instanceSet.size === 0) throw new Error(`PermDock: resource '${name}' declares levels but no instance actions`);
+	const meta = resourceMetaFor(name, init.options.meta, build.x?.resource);
+	const resourceNode = Object.freeze({
+		...meta === void 0 ? {} : { meta },
+		name,
+		path: prefix,
+		schema: init.schema,
+		id: init.options.id ?? "id",
+		parent: parent === void 0 ? void 0 : freezeDeep({ ...parent }),
+		links: freezeDeep(links),
+		relations: freezeDeep(relations),
+		version,
+		restricted,
+		...restrictedStopList === void 0 ? {} : { restrictedStops: restrictedStopList },
+		disclosure,
+		instanceActions: instanceSet,
+		collectionActions: collectionSet,
+		levels: Object.freeze(levels)
+	});
+	assertIncludes(resourceNode);
+	registry.set(name, resourceNode);
+	Object.defineProperty(node, NODE_RESOURCE, {
+		value: resourceNode,
+		enumerable: false,
+		writable: false,
+		configurable: false
+	});
+	return freezeDeep(node);
+}
+/** The resource a `definePermissions` resource node was built from, read from the node itself. */
+function resourceOfNode(node) {
+	if (!Object.hasOwn(node, NODE_RESOURCE)) return;
+	const value = Reflect.get(node, NODE_RESOURCE);
+	return isResourceNode(value) ? value : void 0;
+}
+function isResourceNode(value) {
+	return value !== null && typeof value === "object" && "name" in value && "instanceActions" in value;
+}
+function walk(input, path, registry, leaves, depth, build) {
+	if (depth > 10) throw new Error(`PermDock: permission group nesting exceeds 10`);
+	if (isResourceInit(input)) return materialiseResource(input, path, registry, leaves, build);
+	if (input === null || typeof input !== "object" || Array.isArray(input)) throw new Error(`PermDock: definePermissions expected a group or resource at '${path.join(".")}'`);
+	const group = {};
+	for (const key of Object.keys(input)) {
+		assertSafeKey(key, "group");
+		group[key] = walk(input[key], [...path, key], registry, leaves, depth + 1, build);
+	}
+	return group;
+}
+function attachRegistry(tree, registry, leaves) {
+	const attached = tree;
+	Object.defineProperty(attached, TREE_REGISTRY, {
+		value: registry,
+		enumerable: false,
+		writable: false,
+		configurable: false
+	});
+	Object.defineProperty(attached, TREE_LEAVES, {
+		value: Object.freeze([...leaves]),
+		enumerable: false,
+		writable: false,
+		configurable: false
+	});
+	return attached;
+}
+//#endregion
+//#region src/core/permission-registry.ts
+function isRegistryTree(tree) {
+	return TREE_REGISTRY in tree;
+}
+function getRegistry(tree) {
+	if (!isRegistryTree(tree)) throw new Error("PermDock: permission tree is missing its registry");
+	return tree[TREE_REGISTRY];
+}
+function getResource(tree, name) {
+	if (isForbiddenKey(name)) return;
+	return getRegistry(tree).get(name);
+}
+const RENAMED_KEY = /^\S+$/u;
+/** Current key to its former keys, from the `renamed` option; targets are checked once leaves exist. */
+function formerByKey(renamed) {
+	const former = /* @__PURE__ */ new Map();
+	if (renamed === void 0) return former;
+	if (renamed === null || typeof renamed !== "object") throw new TypeError("PermDock: renamed must map old keys to current keys");
+	for (const [old, current] of Object.entries(renamed)) {
+		if (!RENAMED_KEY.test(old) || old.split(".").some(isForbiddenKey)) throw new Error(`PermDock: renamed key '${old}' is not a valid key`);
+		if (typeof current !== "string") throw new TypeError(`PermDock: renamed key '${old}' must map to a current key`);
+		former.set(current, [...former.get(current) ?? [], old]);
+	}
+	return former;
+}
+/**
+* Every current key is unique, every former key names exactly one leaf, and
+* no former key is also a current key, so a string resolves to one leaf.
+*/
+function assertKeys(leaves, former) {
+	const current = /* @__PURE__ */ new Set();
+	for (const leaf of leaves) {
+		if (current.has(leaf.key))
+ /* v8 ignore next */
+		throw new Error(`PermDock: duplicate permission key '${leaf.key}'`);
+		current.add(leaf.key);
+	}
+	for (const target of former?.keys() ?? []) if (!current.has(target)) throw new Error(`PermDock: renamed target '${target}' is not a permission key`);
+	const olds = /* @__PURE__ */ new Map();
+	for (const leaf of leaves) for (const old of formerKeys(leaf)) {
+		if (current.has(old)) throw new Error(`PermDock: renamed key '${old}' is still a permission key`);
+		const other = olds.get(old);
+		if (other !== void 0 && other !== leaf.key) throw new Error(`PermDock: renamed key '${old}' maps to both '${other}' and '${leaf.key}'`);
+		olds.set(old, leaf.key);
+	}
+}
+function collectLeaves(node) {
+	if ("key" in node && "scope" in node && "action" in node) return [node];
+	const out = [];
+	for (const key of ownKeys(node)) {
+		const child = node[key];
+		if (child !== void 0) out.push(...collectLeaves(child));
+	}
+	return out;
+}
+function listPermissions(tree) {
+	if (isRegistryTree(tree)) return tree[TREE_LEAVES];
+	return collectLeaves(tree);
+}
+function findPermission(tree, keyOrScope) {
+	if (isForbiddenKey(keyOrScope)) return;
+	const leaves = listPermissions(tree);
+	for (const leaf of leaves) if (leaf.key === keyOrScope || leaf.scope === keyOrScope) return leaf;
+	for (const leaf of leaves) if (formerKeys(leaf).includes(keyOrScope) || formerScopes(leaf).includes(keyOrScope)) return leaf;
+}
+/**
+* A permission leaf: string `key`, `scope`, `resource` and `action` plus an
+* object `meta`. `kind` is non-enumerable and does not survive
+* `JSON.stringify`, so a leaf that crossed a serialisation boundary passes
+* without it; when present it must be `instance` or `collection`.
+*/
+function isPermission(value) {
+	if (value === null || typeof value !== "object" || Array.isArray(value)) return false;
+	for (const field of [
+		"key",
+		"scope",
+		"resource",
+		"action"
+	]) if (!Object.hasOwn(value, field) || typeof Reflect.get(value, field) !== "string") return false;
+	const meta = Object.hasOwn(value, "meta") ? Reflect.get(value, "meta") : void 0;
+	if (meta === null || typeof meta !== "object" || Array.isArray(meta)) return false;
+	if (!Object.hasOwn(value, "kind")) return true;
+	const kind = Reflect.get(value, "kind");
+	return kind === "instance" || kind === "collection";
+}
+function mergeNodes(target, source, keys, registry, sourceRegistry) {
+	for (const key of ownKeys(source)) {
+		assertSafeKey(key, "group");
+		const incoming = source[key];
+		if (incoming === void 0)
+ /* v8 ignore next */
+		continue;
+		const existing = target[key];
+		if (existing === void 0) {
+			target[key] = incoming;
+			if (isPermission(incoming)) {
+				if (keys.has(incoming.key))
+ /* v8 ignore next */
+				throw new Error(`PermDock: duplicate permission key '${incoming.key}'`);
+				keys.add(incoming.key);
+			}
+			continue;
+		}
+		if (isPermission(existing) || isPermission(incoming)) {
+			const keyName = isPermission(incoming) ? incoming.key : isPermission(existing) ? existing.key : key;
+			throw new Error(`PermDock: duplicate permission key '${keyName}'`);
+		}
+		const nested = { ...existing };
+		mergeNodes(nested, incoming, keys, registry, sourceRegistry);
+		target[key] = freezeDeep(nested);
+	}
+	if (sourceRegistry !== void 0) for (const [name, node] of sourceRegistry) {
+		if (registry.has(name) && registry.get(name) !== node) throw new Error(`PermDock: duplicate resource name '${name}'`);
+		registry.set(name, node);
+	}
+}
+function mergePermissions(...trees) {
+	if (trees.length === 0) throw new Error("PermDock: mergePermissions() requires at least one tree");
+	const merged = {};
+	const keys = /* @__PURE__ */ new Set();
+	const registry = /* @__PURE__ */ new Map();
+	for (const tree of trees) mergeNodes(merged, tree, keys, registry, isRegistryTree(tree) ? tree[TREE_REGISTRY] : void 0);
+	assertGraphTargets(registry);
+	const leaves = collectLeaves(merged);
+	assertKeys(leaves);
+	return freezeDeep(attachRegistry(merged, registry, leaves));
+}
+/** Former key to current key, for every leaf of `tree`. */
+function renamedKeys(tree) {
+	const map = /* @__PURE__ */ new Map();
+	for (const leaf of listPermissions(tree)) for (const old of formerKeys(leaf)) map.set(old, leaf.key);
+	return map;
+}
+//#endregion
+export { resource as _, getResource as a, listPermissions as c, attachRegistry as d, resourceOfNode as f, formerScopes as g, formerKeys as h, getRegistry as i, mergePermissions as l, annotationsFor as m, findPermission as n, isPermission as o, walk as p, formerByKey as r, isRegistryTree as s, assertKeys as t, renamedKeys as u };

package/dist/{permissions-DttnqqxC.d.ts → permission-types-Dg39z9Kv.d.ts}

@@ -1,8 +1,34 @@
 import { StandardSchemaV1 } from "@standard-schema/spec";
-//#region src/core/permissions.d.ts
+//#region src/core/app-data.d.ts
+/** A JSON value in an app `x` field. */
+type MetaValue = string | number | boolean | null | readonly MetaValue[] | {
+  readonly [key: string]: MetaValue;
+};
+/** The default shape of an app `x` field: a plain JSON object. */
+type AppData = Readonly<Record<string, MetaValue>>;
+/**
+ * A Standard Schema for one kind of app data. It must validate synchronously;
+ * its output is the type PermDock gives the `x` field it checks.
+ */
+type AppDataSchema<X = AppData> = StandardSchemaV1<unknown, X>;
+/** A leaf whose `meta.x` is typed by a schema; intersected so it stays assignable to the untyped leaf. */
+type WithX<L, X> = [X] extends [never] ? L : L & {
+  readonly meta: {
+    readonly x?: Readonly<X>;
+  };
+};
+//#endregion
+//#region src/core/brands.d.ts
 declare const RESOURCE_BRAND: unique symbol;
+/**
+ * Phantom key carrying a tree's resource `x` type for `getResource`. Exported
+ * as a type only, so a consumer's declaration emit can name it; it has no value.
+ */
+declare const RESOURCE_X: unique symbol;
+//#endregion
+//#region src/core/permission-types.d.ts
 /** `definePermissions` options. */
-type DefinePermissionsOptions = {
+type DefinePermissionsOptions<PX = never, RX = never> = {
   /**
    * Keys a permission used to have, mapped to its current key. Old keys are
    * accepted wherever a key arrives as a string (stored custom roles, OAuth
@@ -10,6 +36,27 @@ type DefinePermissionsOptions = {
    * the current leaf; code, decisions and audit only ever see the current key.
    */
   readonly renamed?: Readonly<Record<string, string>>;
+  /**
+   * Standard Schemas for app data. `permission` checks every action's
+   * `meta.x` and types it on the leaves; `resource` checks every resource's
+   * `meta.x` and types it on `getResource`. Both validate synchronously at
+   * definition time and throw on invalid data.
+   */
+  readonly x?: {
+    readonly permission?: AppDataSchema<PX>;
+    readonly resource?: AppDataSchema<RX>;
+  };
+};
+/** A resource's metadata. PermDock carries it to the catalog and never reads `x`. */
+type ResourceMeta<X = AppData> = {
+  readonly title?: string;
+  readonly description?: string;
+  /** Data the application owns. Plain JSON, typed by `definePermissions(…, { x: { resource } })`. */
+  readonly x?: X;
+};
+/** A tree whose resources carry `meta.x` of type `X`, read through `getResource`. */
+type ResourceXTree<X> = {
+  readonly [RESOURCE_X]?: X;
 };
 type ActionMeta = {
   readonly title?: string;
@@ -30,13 +77,9 @@ type ActionMeta = {
   /**
    * Data the application owns, such as a risk level or an undo window. Plain
    * JSON; PermDock carries it on the leaf, the catalog and snapshots and
-   * never reads it.
+   * never reads it. `definePermissions(…, { x: { permission } })` types it.
    */
-  readonly x?: Readonly<Record<string, MetaValue>>;
-};
-/** A JSON value in `ActionMeta.x`. */
-type MetaValue = string | number | boolean | null | readonly MetaValue[] | {
-  readonly [key: string]: MetaValue;
+  readonly x?: AppData;
 };
 type PermissionKind = "instance" | "collection";
 type Permission<K extends string = string, T = unknown, Kind extends PermissionKind = PermissionKind> = {
@@ -159,6 +202,8 @@ type ResourceOptions<A extends ActionList | undefined = ActionList | undefined,
    * it; it reaches only instance actions. Names match `^[a-z][a-z0-9_]*$`.
    */
   readonly levels?: Readonly<Record<string, ResourceLevel>>;
+  /** Display text and app data for the resource; carried to the catalog, never read in evaluation. */
+  readonly meta?: ResourceMeta;
 };
 /** A level's row condition: `where` shorthand or a normalised `Condition`, checked by `definePolicy`. */
 type ResourceLevel = Readonly<Record<string, unknown>>;
@@ -183,32 +228,15 @@ type ResourceNode<T = unknown> = {
   readonly collectionActions: ReadonlySet<string>;
   /** Declared level names to their raw condition; `definePolicy` normalises them. */
   readonly levels?: Readonly<Record<string, ResourceLevel>>;
+  /** The resource's `meta`, when it declares one. */
+  readonly meta?: ResourceMeta;
 };
 type PermissionTree = {
   readonly [key: string]: PermissionTree | Permission;
 };
 type ActionNames<A extends ActionList | undefined> = A extends readonly string[] ? A[number] : A extends Record<string, ActionMeta> ? keyof A & string : never;
-type LeavesFrom<Prefix extends string, Names extends string, T, Kind extends PermissionKind> = [Names] extends [never] ? object : { readonly [K in Names]: Permission<Prefix extends "" ? K : `${Prefix}.${K}`, T, Kind>; };
-type InferResourceLeaves<R extends ResourceInit, Prefix extends string> = R extends ResourceInit<infer T, infer A, infer C> ? LeavesFrom<Prefix, ActionNames<A>, T, "instance"> & LeavesFrom<Prefix, ActionNames<C>, T, "collection"> : object;
-type InferPermissionTree<Input, Prefix extends string = ""> = Input extends ResourceInit ? InferResourceLeaves<Input, Prefix> : Input extends Record<string, unknown> ? { readonly [K in keyof Input & string]: InferPermissionTree<Input[K], Prefix extends "" ? K : `${Prefix}.${K}`>; } : never;
-/**
- * The keys `permission` was renamed from, sorted. Empty for a leaf without
- * renames and for one that crossed a serialisation boundary.
- */
-declare function formerKeys(permission: object): readonly string[];
-declare function resource<T, const A extends ActionList = readonly [], const C extends ActionList = readonly []>(schema: StandardSchemaV1<unknown, T>, options?: ResourceOptions<A, C>): ResourceInit<T, A, C>;
-declare function resource<const A extends ActionList = readonly [], const C extends ActionList = readonly []>(options: ResourceOptions<A, C>): ResourceInit<unknown, A, C>;
-declare function getResource(tree: PermissionTree, name: string): ResourceNode | undefined;
-declare function definePermissions<const Input>(input: Input, options?: DefinePermissionsOptions): InferPermissionTree<Input>;
-declare function listPermissions(tree: PermissionTree | Permission): readonly Permission[];
-declare function findPermission(tree: PermissionTree, keyOrScope: string): Permission | undefined;
-/**
- * A permission leaf: string `key`, `scope`, `resource` and `action` plus an
- * object `meta`. `kind` is non-enumerable and does not survive
- * `JSON.stringify`, so a leaf that crossed a serialisation boundary passes
- * without it; when present it must be `instance` or `collection`.
- */
-declare function isPermission(value: unknown): value is Permission;
-declare function mergePermissions<const Trees extends readonly PermissionTree[]>(...trees: Trees): PermissionTree;
+type LeavesFrom<Prefix extends string, Names extends string, T, Kind extends PermissionKind, X = never> = [Names] extends [never] ? object : { readonly [K in Names]: WithX<Permission<Prefix extends "" ? K : `${Prefix}.${K}`, T, Kind>, X>; };
+type InferResourceLeaves<R extends ResourceInit, Prefix extends string, X = never> = R extends ResourceInit<infer T, infer A, infer C> ? LeavesFrom<Prefix, ActionNames<A>, T, "instance", X> & LeavesFrom<Prefix, ActionNames<C>, T, "collection", X> : object;
+type InferPermissionTree<Input, Prefix extends string = "", X = never> = Input extends ResourceInit ? InferResourceLeaves<Input, Prefix, X> : Input extends Record<string, unknown> ? { readonly [K in keyof Input & string]: InferPermissionTree<Input[K], Prefix extends "" ? K : `${Prefix}.${K}`, X>; } : never;
 //#endregion
-export { listPermissions as A, ResourceRelationInput as C, formerKeys as D, findPermission as E, resource as M, getResource as O, ResourceRelation as S, definePermissions as T, ResourceLevel as _, EdgeGroup as a, ResourceOptions as b, EdgeRelation as c, MetaValue as d, Permission as f, ResourceInit as g, PrincipalRelation as h, DefinePermissionsOptions as i, mergePermissions as j, isPermission as k, FieldRelation as l, PermissionTree as m, ActionMeta as n, EdgeGroups as o, PermissionKind as p, ComputedRelation as r, EdgeMatch as s, ActionList as t, InferPermissionTree as u, ResourceLink as v, ResourceRestricted as w, ResourceParent as x, ResourceNode as y };
+export { WithX as A, ResourceRelationInput as C, AppData as D, RESOURCE_X as E, AppDataSchema as O, ResourceRelation as S, ResourceXTree as T, ResourceLink as _, EdgeGroup as a, ResourceOptions as b, EdgeRelation as c, Permission as d, PermissionKind as f, ResourceLevel as g, ResourceInit as h, DefinePermissionsOptions as i, MetaValue as k, FieldRelation as l, PrincipalRelation as m, ActionMeta as n, EdgeGroups as o, PermissionTree as p, ComputedRelation as r, EdgeMatch as s, ActionList as t, InferPermissionTree as u, ResourceMeta as v, ResourceRestricted as w, ResourceParent as x, ResourceNode as y };

package/dist/{permissions-RJrovw98.js → permissions-CCJ6lmxB.js}

@@ -1,6 +1,6 @@
-import { b as resource, n as definePermissions } from "./permissions-DVoF6dMt.js";
-import { s as crud } from "./src-BDwEZWrZ.js";
-import { b as definePlans, x as defineRoles } from "./grantee-Cv5Sogfv.js";
+import { i as crud, s as definePermissions } from "./src-Bb7no-hS.js";
+import { _ as resource } from "./permission-registry-BsblpB-z.js";
+import { f as definePlans, p as defineRoles } from "./grantee-CXY-0C87.js";
 //#region src/testing/saas/schema.ts
 function accepts(kind, value) {
 	switch (kind) {

package/dist/{permissions-CDgvKG5L.d.ts → permissions-COH-KRgT.d.ts}

@@ -1,5 +1,5 @@
-import { g as ResourceInit, u as InferPermissionTree } from "./permissions-DttnqqxC.js";
-import { r as Role, t as Plan } from "./vocabulary-DA8a8zif.js";
+import { h as ResourceInit, u as InferPermissionTree } from "./permission-types-Dg39z9Kv.js";
+import { r as Role, t as Plan } from "./vocabulary-hhEFLFoL.js";
 import { StandardSchemaV1 } from "@standard-schema/spec";
 //#region src/testing/saas/permissions.d.ts
 declare const SaasProjectSchema: StandardSchemaV1<SaasProject>;