permdock 0.3.0 → 0.4.0

package/dist/shared-1uhI-e-b.js

@@ -0,0 +1,294 @@
+import { r as isRecord } from "./compact-CAf557ZB.js";
+import { o as isForbiddenKey } from "./thenable-QSmvt-vZ.js";
+import { t as byCodePoint } from "./compare-pfyVnBjE.js";
+import { a as quoteSqlIdent, i as quoteQualifiedTable, o as quoteSqlLiteral, s as quoteSqlTable, t as SQL_IDENT } from "./sql-t8teWOfo.js";
+import "./sources-B1-b-R0t.js";
+//#region src/cli/sql/quote.ts
+function quoteIdent(name) {
+	return quoteSqlIdent(name, CLI);
+}
+function quoteTable(name) {
+	return quoteSqlTable(name, CLI);
+}
+/** A table name with `public.` added when it names no schema, quoted. */
+function quoteQualified(name) {
+	return quoteQualifiedTable(name, CLI);
+}
+function helperSchema(ctx) {
+	return ctx.schema ?? "permdock";
+}
+function qualified(ctx, name) {
+	return `${quoteIdent(helperSchema(ctx))}.${name}`;
+}
+function quoteLiteral(value) {
+	return quoteSqlLiteral(value);
+}
+const CLI = "PermDock CLI";
+function declaredArray(values) {
+	return values.length === 0 ? `'{}'::text[]` : `array[${values.map(quoteLiteral).join(", ")}]::text[]`;
+}
+//#endregion
+//#region src/cli/sql/columns.ts
+/** The Postgres type a JSON Schema property compares as; `undefined` for text or an unknown shape. */
+function columnTypeOf(property) {
+	if (!isRecord(property)) return;
+	const variants = [property["anyOf"], property["oneOf"]].find(Array.isArray);
+	if (variants !== void 0) {
+		const present = variants.filter((item) => !(isRecord(item) && item["type"] === "null"));
+		return present.length === 1 ? columnTypeOf(present[0]) : void 0;
+	}
+	const types = (Array.isArray(property["type"]) ? property["type"] : [property["type"]]).filter((item) => item !== "null");
+	if (types.length !== 1) return;
+	switch (types[0]) {
+		case "integer":
+		case "number": return "numeric";
+		case "boolean": return "boolean";
+		case "string": switch (property["format"]) {
+			case "date-time": return "timestamptz";
+			case "date": return "date";
+			case "uuid": return "uuid";
+			default: return;
+		}
+		default: return;
+	}
+}
+/**
+* Column types from a resource's JSON Schema (`~standard.jsonSchema`): numbers
+* compare as `numeric`, booleans as `boolean`, and `date-time`, `date` and
+* `uuid` strings as `timestamptz`, `date` and `uuid`. Other columns are left
+* out and compare as text.
+*/
+function columnTypesOf(schema) {
+	const properties = isRecord(schema) ? schema["properties"] : void 0;
+	if (!isRecord(properties)) return {};
+	const types = {};
+	for (const [name, property] of Object.entries(properties)) {
+		const type = isForbiddenKey(name) ? void 0 : columnTypeOf(property);
+		if (type !== void 0) types[name] = type;
+	}
+	return types;
+}
+/**
+* Array columns from a resource's JSON Schema, each with the type its items
+* compare as (`text` when `columnTypesOf` would leave the item out).
+*/
+function arrayColumnsOf(schema) {
+	const properties = isRecord(schema) ? schema["properties"] : void 0;
+	if (!isRecord(properties)) return {};
+	const arrays = {};
+	for (const [name, property] of Object.entries(properties)) {
+		if (isForbiddenKey(name) || !isRecord(property)) continue;
+		const types = (Array.isArray(property["type"]) ? property["type"] : [property["type"]]).filter((item) => item !== "null");
+		if (types.length === 1 && types[0] === "array") arrays[name] = columnTypeOf(property["items"]) ?? "text";
+	}
+	return arrays;
+}
+const SQL_TYPE = /^[A-Za-z_][A-Za-z0-9_]*( [A-Za-z_][A-Za-z0-9_]*)*(\[\])?$/u;
+function sqlType(name) {
+	if (!SQL_TYPE.test(name)) throw new Error(`PermDock CLI: unsafe SQL type '${name}'`);
+	return name;
+}
+function tenantTypeOf(ctx) {
+	return sqlType(ctx.tenantType ?? "uuid");
+}
+function teamTypeOf(ctx) {
+	return sqlType(ctx.teamType ?? ctx.tenantType ?? "uuid");
+}
+/** Postgres type of scope `name`'s id: `scopeTypes`, then the tenant / team type by position. */
+function scopeTypeOf(ctx, name) {
+	const declared = ctx.scopeTypes?.[name];
+	if (declared !== void 0) return sqlType(declared);
+	return name === ctx.scopes[1]?.name ? teamTypeOf(ctx) : tenantTypeOf(ctx);
+}
+//#endregion
+//#region src/cli/sql/context.ts
+const CLAIM = SQL_IDENT;
+function parseMembershipsFlag(raw) {
+	if (raw === void 0 || raw === "") return;
+	const colon = raw.indexOf(":");
+	const table = colon === -1 ? raw : raw.slice(0, colon);
+	const cols = (colon === -1 ? "" : raw.slice(colon + 1)).split(",").map((item) => item.trim()).filter((item) => item !== "");
+	return { tenant: {
+		table,
+		tenant: cols[0] ?? "tenant_id",
+		user: cols[1] ?? "user_id",
+		role: cols[2] ?? "role",
+		...cols[3] === void 0 ? {} : { expiresAt: cols[3] }
+	} };
+}
+//#endregion
+//#region src/cli/sql/subject.ts
+/**
+* A role with `for` counts only on a membership of one of those kinds:
+* `case role when 'admin' then via = any(...) ... else true end`. A missing
+* kind (`viaExpr` null) holds none of them. A constant kind folds into the
+* roles it excludes, or no filter. `undefined` when nothing is filtered.
+*/
+function kindFilterSql(ctx, roleExpr, viaExpr) {
+	const kinds = Object.entries(ctx.ownership?.kinds ?? {}).toSorted(([a], [b]) => byCodePoint(a, b));
+	if (kinds.length === 0) return;
+	if (typeof viaExpr !== "string") {
+		const excluded = kinds.filter(([, allowed]) => !viaAllowed(viaExpr.value, allowed)).map(([role]) => role);
+		return excluded.length === 0 ? void 0 : `not (${roleExpr} = any(array[${excluded.map(quoteLiteral).join(", ")}]::text[]))`;
+	}
+	return `case ${roleExpr} ${kinds.map(([role, allowed]) => `when ${quoteLiteral(role)} then coalesce(${viaExpr}, '') = any(array[${allowed.map(quoteLiteral).join(", ")}]::text[])`).join(" ")} else true end`;
+}
+/** The kind check for one known role; `undefined` when it has no `for` or a constant kind it allows. */
+function roleKindSql(ctx, role, viaExpr) {
+	const allowed = ctx.ownership?.kinds[role];
+	if (allowed === void 0) return;
+	if (typeof viaExpr !== "string") return viaAllowed(viaExpr.value, allowed) ? void 0 : "false";
+	return `coalesce(${viaExpr}, '') = any(array[${allowed.map(quoteLiteral).join(", ")}]::text[])`;
+}
+/** Roles with `for` held globally (no membership, so no kind) grant nothing. */
+function globalKindFilterSql(ctx, roleExpr) {
+	const roles = Object.keys(ctx.ownership?.kinds ?? {}).toSorted();
+	return roles.length === 0 ? void 0 : `not (${roleExpr} = any(array[${roles.map(quoteLiteral).join(", ")}]::text[]))`;
+}
+function keyTenantSql(ctx, tenant) {
+	const keys = ctx.apiKeys;
+	if (keys === void 0) return;
+	const named = `nullif(${subjectClaimJsonSql(ctx, keys.claim)} ->> ${quoteLiteral(keys.tenant)}, '')`;
+	return tenant === void 0 ? `${named} is null` : `(${named} is null or (${tenant})::text = ${named})`;
+}
+/** The active-tenant claim cast to the tenant column's type, so the comparison uses the column's index. */
+function tenantClaimSql(ctx) {
+	return `${subjectClaimSql(ctx, ctx.tenantClaim)}::${tenantTypeOf(ctx)}`;
+}
+const USER_ID_HELPER = "permdock_user_id";
+function userIdHelperSql(ctx) {
+	return qualified(ctx, USER_ID_HELPER);
+}
+const SESSION_LIVE_HELPER = "permdock_session_live";
+/** `{ subject: { session: { live: true } } }` in a policy; only Supabase has `auth.sessions`. */
+function liveSessionSql(ctx) {
+	if (ctx.dialect !== "supabase") throw new Error(`PermDock CLI: { subject: { session: { live: true } } } reads auth.sessions, which only the supabase dialect has (got ${ctx.dialect})`);
+	return `(select ${qualified(ctx, SESSION_LIVE_HELPER)}())`;
+}
+/**
+* `permdock_session_live()`: the token's `session_id` names a session of its
+* user that is still in `auth.sessions`, so a signed-out or revoked session
+* stops passing before the token's `exp`. A token without one, such as a
+* service key's, is never live.
+*/
+function sessionLiveHelperSql(ctx) {
+	const name = qualified(ctx, SESSION_LIVE_HELPER);
+	return `create or replace function ${name}()
+returns boolean
+language plpgsql
+stable
+security definer
+set search_path = ''
+as $$
+declare
+  v_session uuid;
+begin
+  begin
+    v_session := nullif((select auth.jwt()) ->> 'session_id', '')::uuid;
+  exception when invalid_text_representation then
+    return false;
+  end;
+  if v_session is null then
+    return false;
+  end if;
+  return exists (
+    select 1
+    from auth.sessions s
+    where s.id = v_session
+      and s.user_id::text = ${subjectIdSql(ctx)}::text
+      and (s.not_after is null or s.not_after > now())
+  );
+end;
+$$;
+revoke execute on function ${name}() from public, anon;
+grant execute on function ${name}() to authenticated;
+`;
+}
+function subjectIdSql(ctx) {
+	if (ctx.subjectId !== void 0) return ctx.subjectId;
+	switch (ctx.dialect) {
+		case "supabase": return `(select ${userIdHelperSql(ctx)}())`;
+		case "neon": return "(select auth.user_id())";
+		case "guc": return `(select current_setting(${quoteLiteral(`${ctx.gucPrefix}.user_id`)}, true))`;
+		default: return ctx.dialect;
+	}
+}
+function subjectClaimSql(ctx, claim) {
+	if (!CLAIM.test(claim)) throw new Error(`PermDock CLI: unsafe claim name '${claim}'`);
+	switch (ctx.dialect) {
+		case "supabase": return `((select auth.jwt()) ->> ${quoteLiteral(claim)})`;
+		case "neon": return `((select auth.session()) ->> ${quoteLiteral(claim)})`;
+		case "guc": return `(select current_setting(${quoteLiteral(`${ctx.gucPrefix}.${claim}`)}, true))`;
+		default: return ctx.dialect;
+	}
+}
+/** A claim as `jsonb`; the `guc` dialect stores JSON text in `<prefix>.<claim>`. */
+function subjectClaimJsonSql(ctx, claim) {
+	if (!CLAIM.test(claim)) throw new Error(`PermDock CLI: unsafe claim name '${claim}'`);
+	switch (ctx.dialect) {
+		case "supabase": return `((select auth.jwt()) -> ${quoteLiteral(claim)})`;
+		case "neon": return `((select auth.session()) -> ${quoteLiteral(claim)})`;
+		case "guc": return `nullif((select current_setting(${quoteLiteral(`${ctx.gucPrefix}.${claim}`)}, true)), '')::jsonb`;
+		default: return ctx.dialect;
+	}
+}
+function viaAllowed(value, allowed) {
+	return allowed.includes(value ?? "");
+}
+/** The membership kind of a row `m` of `table`: its column as text, or its constant (`null` without one). */
+function memberVia(table) {
+	const via = table.via;
+	if (via === void 0) return { value: null };
+	return typeof via === "string" ? `m.${quoteIdent(via)}::text` : { value: via.value };
+}
+//#endregion
+//#region src/cli/sql/shared.ts
+/** `rls.customRoles` turns custom roles on as `true` or as an object. */
+function customRolesOn(rls) {
+	const custom = rls?.customRoles;
+	return custom === true || typeof custom === "object" && custom !== null;
+}
+/**
+* The per-statement helpers every generated policy calls: `permdock_has` for
+* global roles and one `permitted_<scope>_ids` per scope
+* (`permittedIdsHelper`). Names are part of the SQL contract.
+*/
+const HELPERS = {
+	has: "permdock_has",
+	hasFor: "permdock_has_for"
+};
+/** Objects `--custom-roles` adds next to the helpers. Names are part of the SQL contract. */
+const CUSTOM_ROLES = {
+	permissions: "custom_role_permissions",
+	includes: "custom_role_includes",
+	ceiling: "permdock_ceiling",
+	keys: "permdock_custom_keys",
+	beyond: "permdock_custom_role_beyond",
+	guard: "permdock_custom_role_guard",
+	beyondFor: "permdock_custom_role_beyond_for",
+	guardFor: "permdock_custom_role_guard_for",
+	shape: "permdock_custom_role_shape",
+	entries: "permdock_custom_role_entries",
+	replace: "permdock_replace_custom_role_grants",
+	rename: "permdock_rename_custom_role_grants",
+	remove: "permdock_delete_custom_role_grants",
+	trustedReplace: "permdock_trusted_replace_custom_role_grants",
+	trustedRename: "permdock_trusted_rename_custom_role_grants",
+	trustedRemove: "permdock_trusted_delete_custom_role_grants",
+	cascade: "permdock_cascade_custom_role"
+};
+/** The function `rls.roles` adds. The name is part of the SQL contract. */
+const GLOBAL_ROLES = { replace: "permdock_replace_global_roles" };
+/** `user` is the SQL for the user id: the dialect's (the default) or the `p_user` parameter of a `_for` helper. */
+function signedIn(ctx, user = subjectIdSql(ctx)) {
+	return `coalesce(${user}::text, '') <> ''`;
+}
+function rootName(ctx) {
+	return ctx.scopes[0]?.name ?? "tenant";
+}
+/** The stored allow as `permissions` hands it to `permdock_custom_keys`: `key`, or `key@level` with levels. */
+function allowEntry(ctx) {
+	return ctx.customRoles?.levels === true ? "permission || coalesce('@' || c.level, '')" : "permission";
+}
+//#endregion
+export { declaredArray as A, parseMembershipsFlag as C, sqlType as D, scopeTypeOf as E, quoteQualified as F, quoteTable as I, qualified as M, quoteIdent as N, tenantTypeOf as O, quoteLiteral as P, CLAIM as S, columnTypesOf as T, subjectClaimJsonSql as _, customRolesOn as a, tenantClaimSql as b, SESSION_LIVE_HELPER as c, keyTenantSql as d, kindFilterSql as f, sessionLiveHelperSql as g, roleKindSql as h, allowEntry as i, helperSchema as j, CLI as k, USER_ID_HELPER as l, memberVia as m, GLOBAL_ROLES as n, rootName as o, liveSessionSql as p, HELPERS as r, signedIn as s, CUSTOM_ROLES as t, globalKindFilterSql as u, subjectClaimSql as v, arrayColumnsOf as w, userIdHelperSql as x, subjectIdSql as y };

package/dist/{shared-DRu8VFVM.js → shared-JhMeOsDF.js}

@@ -1,4 +1,4 @@
-import { t as decisionToken } from "./token-CIWxJOCh.js";
+import { t as decisionToken } from "./token-Bx9qy30p.js";
 //#region src/pdp/shared.ts
 const MAX_CACHE_TTL_MS = 3e4;
 const CACHE_MAX = 1e3;

package/dist/{sink-Bd9PSyfq.js → sink-BTtmfPnE.js}

@@ -1,4 +1,4 @@
-import { t as compact } from "./compact-y6vfu2_f.js";
+import { t as compact } from "./compact-CAf557ZB.js";
 //#region src/core/sink.ts
 /** The closed list of CloudEvents `type` values PermDock emits. */
 const CLOUD_EVENT_TYPES = Object.freeze({

package/dist/{sink-B1fZzIMf.d.ts → sink-CPN4zLfs.d.ts}

@@ -1,4 +1,4 @@
-import { $ as AccessEvent, Kt as Credential, Pt as TokenSigner, at as DecisionSink, ht as MembershipEvent, tt as CredentialEvent, wt as SinkEvent } from "./policy-IB6yxpC3.js";
+import { Cn as MembershipEvent, W as DecisionSink, bn as CredentialEvent, lt as TokenSigner, mt as Credential, vn as AccessEvent, wn as SinkEvent } from "./policy-types-sp9P1iIV.js";
 //#region src/core/sink.d.ts
 /** The closed list of CloudEvents `type` values PermDock emits. */
 declare const CLOUD_EVENT_TYPES: {

package/dist/{skills-Biq5uup3.js → skills-BZdRQkxs.js}

@@ -1,5 +1,6 @@
 import { t as byCodePoint } from "./compare-pfyVnBjE.js";
-import { t as packageRoot } from "./package-root-zGkxO3oN.js";
+import { i as readJsonFile } from "./files-D_JIzUrP.js";
+import { t as packageRoot } from "./package-root-DtNnpmUd.js";
 import { cpSync, existsSync, lstatSync, mkdirSync, readFileSync, readdirSync, readlinkSync, realpathSync, writeFileSync } from "node:fs";
 import { basename, dirname, join, relative, resolve } from "node:path";
 import { createRequire } from "node:module";
@@ -154,7 +155,7 @@ function filesOf(root, folder = root) {
 }
 function listSkills(cwd) {
 	const lockPath = join(cwd, ".permdock/skills-lock.json");
-	const lock = existsSync(lockPath) ? JSON.parse(readFileSync(lockPath, "utf8")) : {};
+	const lock = existsSync(lockPath) ? readJsonFile(lockPath) : {};
 	const lines = ["permdock skills", ""];
 	for (const name of SKILL_NAMES) {
 		const places = Object.values(AGENT_FOLDERS).filter((folder) => existsSync(join(cwd, folder, name, "SKILL.md")));
@@ -186,7 +187,7 @@ function resolveSkillsRoot(cwd, bundled) {
 function readPermdockVersion(skillsRoot) {
 	const pkg = join(dirname(skillsRoot), "package.json");
 	if (!existsSync(pkg)) return "0.0.0";
-	return JSON.parse(readFileSync(pkg, "utf8")).version;
+	return readJsonFile(pkg).version;
 }
 //#endregion
 export { runSkillsInstall as i, detectedAgents as n, runSkills as r, SKILL_AGENTS as t };

package/dist/{skills-Bx-U0irG.js → skills-Dle4ZoLF.js}

@@ -1,6 +1,6 @@
-import { a as listArg, i as globalArgs, t as COMMAND_DESCRIPTIONS } from "./commands-DSxCqG9A.js";
+import { a as listArg, i as globalArgs, t as COMMAND_DESCRIPTIONS } from "./commands-Cpip4ULx.js";
 import { r as pick, t as CANCELLED } from "./prompt-CXYhLfsS.js";
-import { n as detectedAgents, r as runSkills, t as SKILL_AGENTS } from "./skills-Biq5uup3.js";
+import { n as detectedAgents, r as runSkills, t as SKILL_AGENTS } from "./skills-BZdRQkxs.js";
 import { defineCommand } from "citty";
 //#region src/cli/commands/skills.ts
 function skills(ctx) {

package/dist/{snapshot-Enxd0n-s.js → snapshot-Dc9CHPME.js}

@@ -1,12 +1,16 @@
-import { n as isReadonlyArray, r as sole, t as compact } from "./compact-y6vfu2_f.js";
+import { a as sole, n as isReadonlyArray, r as isRecord, t as compact } from "./compact-CAf557ZB.js";
 import { n as freezeDeep } from "./freeze-CrU8nQeX.js";
-import { E as ownGet, T as isForbiddenKey, i as findPermission } from "./permissions-DVoF6dMt.js";
-import { c as isConditionRef, i as resolveConditionRef, s as isConditionDate, u as parentHop } from "./refs-KYb4ntaz.js";
+import { o as isForbiddenKey, s as ownGet } from "./thenable-QSmvt-vZ.js";
+import { c as isConditionRef, i as resolveConditionRef, s as isConditionDate, u as parentHop } from "./refs-f3imMjNW.js";
 import { t as expiredAt } from "./expiry-BoBJ8Tvc.js";
 import { n as sameId } from "./ids-DC4V4CFu.js";
-import { d as scopeList, l as scopeChain, m as tenantOf, o as resolveScope, p as subjectMemberships, r as findScope, t as activeFor, u as scopeIdOf } from "./scopes-CVdPrWN-.js";
-import { E as listRoles, T as listPlans, _ as resourceRoleCondition } from "./grantee-Cv5Sogfv.js";
-import { a as isMembershipExpired, c as membershipField, g as tenantsOf, i as inTeam, t as isActive } from "./validity-uOp8UpYn.js";
+import { d as scopeList, l as scopeChain, m as tenantOf, o as resolveScope, p as subjectMemberships, r as findScope, t as activeFor, u as scopeIdOf } from "./scopes-tvpa34ep.js";
+import { g as formerScopes, m as annotationsFor, n as findPermission } from "./permission-registry-BsblpB-z.js";
+import { _ as listPlans, o as flattenGrantee, v as listRoles } from "./grantee-CXY-0C87.js";
+import { t as isActive } from "./validity-dVrUEPJt.js";
+import { o as resourceRoleCondition } from "./grantee-conditions-MQs5NIuX.js";
+import { m as tenantsOf, n as inTeam, o as membershipField, r as isMembershipExpired } from "./tenancy-DshjqY0n.js";
+import { n as matchGrantee } from "./grantee-match-fxYp9Nmt.js";
 //#region src/conditions/evaluate.ts
 function resolveRef(ref, subject) {
 	return resolveConditionRef(ref, subject);
@@ -167,9 +171,6 @@ const denied = (reason) => freezeDeep({
 	}],
 	alternatives: []
 });
-function isRecord(value) {
-	return value !== null && typeof value === "object" && !Array.isArray(value);
-}
 function asString(value) {
 	return typeof value === "string" && value.length > 0 ? value : void 0;
 }
@@ -567,6 +568,105 @@ function rowIdOf(row, field = "id") {
 	return typeof id === "string" || typeof id === "number" ? String(id) : "*";
 }
 //#endregion
+//#region src/core/delegation.ts
+/** The permission's scope and any scope it was renamed from: tokens issued before a rename keep working. */
+function scopeNames(permission) {
+	return [permission.scope, ...formerScopes(permission)];
+}
+/**
+* Whether a delegated caller may use a permission its principal holds, through
+* OAuth `scopes`, RFC 9396 `authorizationDetails` or GNAP `access`.
+* `undefined` means covered; otherwise the denial reason `decide` would add.
+*/
+function coveredByDelegation(permission, delegation, resourceId, hasActor = false) {
+	const unscoped = hasActor ? "no-delegation" : void 0;
+	if (delegation === void 0) return unscoped;
+	const hasScopes = delegation.scopes !== void 0;
+	const hasDetails = delegation.authorizationDetails !== void 0;
+	const hasAccess = delegation.access !== void 0;
+	if (!hasScopes && !hasDetails && !hasAccess) return unscoped;
+	const emptyScopes = hasScopes && (delegation.scopes?.length ?? 0) === 0;
+	const emptyAccess = hasAccess && (delegation.access?.length ?? 0) === 0;
+	if (emptyScopes && !hasDetails && !hasAccess) return "no-delegation";
+	if (emptyAccess && !hasScopes && !hasDetails) return "no-delegation";
+	if (emptyScopes && emptyAccess && !hasDetails) return "no-delegation";
+	const scopes = scopeNames(permission);
+	const scopeOk = delegation.scopes?.some((scope) => scopes.includes(scope)) ?? false;
+	const detailOk = delegation.authorizationDetails?.some((detail) => {
+		if (detail.type !== permission.resource) return false;
+		const identifier = detail["identifier"];
+		if (identifier !== void 0 && (typeof identifier !== "string" || identifier !== resourceId)) return false;
+		const actions = detail.actions;
+		if (actions === void 0) return true;
+		return Array.isArray(actions) && actions.includes(permission.action);
+	}) ?? false;
+	const accessOk = accessCovers(permission, delegation.access, resourceId);
+	if (scopeOk || detailOk || accessOk) return;
+	return "not-delegated";
+}
+function coversRequirements(tree, requires, delegation, resourceId, hasActor = false) {
+	return (requires ?? []).every((key) => {
+		const leaf = findPermission(tree, key);
+		return leaf !== void 0 && coveredByDelegation(leaf, delegation, resourceId, hasActor) === void 0;
+	});
+}
+function requiresStandIn(grant) {
+	return (grant.requires ?? []).length > 0 && annotationsFor(grant.permission).readOnlyHint && !flattenGrantee(grant.to).some((item) => item.kind === "role");
+}
+function accessCovers(permission, access, resourceId) {
+	if (access === void 0) return false;
+	return access.some((entry) => {
+		if (typeof entry === "string") return scopeNames(permission).includes(entry);
+		if (entry === null || typeof entry !== "object") return false;
+		const type = entry["type"];
+		if (typeof type !== "string" || !typeMatches(type, permission.resource)) return false;
+		const actions = entry["actions"];
+		if (actions !== void 0 && (!Array.isArray(actions) || !actions.includes(permission.action))) return false;
+		const identifier = entry["identifier"];
+		if (identifier !== void 0 && (typeof identifier !== "string" || identifier !== resourceId)) return false;
+		return true;
+	});
+}
+function typeMatches(type, resource) {
+	if (type === resource) return true;
+	return type.endsWith(`/${resource}`);
+}
+/**
+* Whether the subject's principal is a `from` of the delegation: every item
+* matches, with roles checked against the roles the principal holds here
+* (`matchGrantee` leaves role holding to the caller) and nothing that needs a
+* row.
+*/
+function handsOver(delegation, subject, heldRoles, now) {
+	const items = flattenGrantee(delegation.from);
+	if (items.length === 0 || subject.principal === null) return false;
+	return items.every((item) => {
+		if (item.kind === "role") return heldRoles.has(item.role);
+		if (item.kind === "relation") return false;
+		const match = matchGrantee(item, subject, now, void 0);
+		return match.matched && match.where === void 0;
+	});
+}
+/**
+* The permission keys the policy's delegations let `subject.actor` use for
+* `subject.principal` right now: the union over every active delegation whose
+* `to` matches the actor and whose `from` the principal holds. `undefined`
+* when none applies, so the call falls back to the token delegation alone.
+* An actor with `readOnly: true` gets only each delegation's read-only keys.
+* Attenuation only: a key here still needs a matching allow and no deny.
+*/
+function delegatedPermissions(delegations, subject, heldRoles, now) {
+	const actor = subject.actor;
+	if (actor === void 0 || delegations === void 0) return;
+	let keys;
+	for (const delegation of delegations) {
+		if (delegation.to.kind !== actor.kind || delegation.to.id !== void 0 && delegation.to.id !== actor.id || delegation.to.client !== void 0 && delegation.to.client !== actor.client || !isActive(delegation.validity, now) || !handsOver(delegation, subject, heldRoles, now)) continue;
+		keys ??= /* @__PURE__ */ new Set();
+		for (const key of actor.readOnly === true ? delegation.readOnly : delegation.permissions) keys.add(key);
+	}
+	return keys;
+}
+//#endregion
 //#region src/conditions/bind.ts
 function isPrimitive(value) {
 	return typeof value === "string" || typeof value === "number" || typeof value === "boolean";
@@ -646,11 +746,11 @@ function bindConditionRefs(condition, subject, only) {
 }
 //#endregion
 //#region src/core/where-scope.ts
-const ALWAYS = {
+const ALWAYS = freezeDeep({
 	op: "eq",
 	field: "_",
 	value: true
-};
+});
 function eq(field, value) {
 	return value === void 0 ? {
 		op: "or",
@@ -838,7 +938,10 @@ function snapshotGrant(grant, membership) {
 		membership,
 		portable: grant.portable ? void 0 : false,
 		fields: grant.fields,
-		validity: grant.validity
+		validity: grant.validity,
+		name: grant.name,
+		meta: grant.meta,
+		obligations: grant.obligations
 	});
 	return freezeDeep(entry);
 }
@@ -972,4 +1075,4 @@ function parseSnapshot(json) {
 	return freezeDeep(value);
 }
 //#endregion
-export { whereFromGrants as a, rowIdOf as c, isArazzoSimulateInput as d, simulateArazzo as f, signSnapshot as i, rowValues as l, parseSnapshot as n, bindConditionRefs as o, evaluateCondition as p, snapshotGrant as r, isRowPair as s, buildSnapshot as t, arazzoFindings as u };
+export { evaluateCondition as _, whereFromGrants as a, coversRequirements as c, isRowPair as d, rowIdOf as f, simulateArazzo as g, isArazzoSimulateInput as h, signSnapshot as i, delegatedPermissions as l, arazzoFindings as m, parseSnapshot as n, bindConditionRefs as o, rowValues as p, snapshotGrant as r, coveredByDelegation as s, buildSnapshot as t, requiresStandIn as u };

package/dist/{snapshot-cache-D6jLelln.js → snapshot-cache-Cod40D-X.js}

@@ -1,4 +1,4 @@
-import { n as payloadDigest } from "./token-CIWxJOCh.js";
+import { n as payloadDigest } from "./token-Bx9qy30p.js";
 //#region src/core/snapshot-cache.ts
 /**
 * `{ stale }` in seconds: `max` when the value never expires, otherwise the seconds left, clamped

package/dist/{snapshot-cache-B-LxUahj.d.ts → snapshot-cache-J5T7t_vD.d.ts}

@@ -1,4 +1,4 @@
-import { Tt as Snapshot } from "./policy-IB6yxpC3.js";
+import { an as Snapshot } from "./policy-types-sp9P1iIV.js";
 //#region src/core/snapshot-cache.d.ts
 type CacheLifeForOptions = {
   /** Lower bound in seconds. Next.js includes a private entry in per-link prefetches from 30. */

package/dist/solid/index.d.ts

@@ -1,41 +1,39 @@
-import { Ft as TokenVerifier, Mr as Membership, Tt as Snapshot, Yn as Decision } from "../policy-IB6yxpC3.js";
-import { f as Permission } from "../permissions-DttnqqxC.js";
-import { r as Role } from "../vocabulary-DA8a8zif.js";
-import { n as requiredPlans } from "../problem-details-DX075l9V.js";
-import { i as describe } from "../describe-DMYiCjJV.js";
+import { Dr as Membership, an as Snapshot, ir as Decision, rr as ApprovalRequiredDecision, ur as GrantedDecision, ut as TokenVerifier } from "../policy-types-sp9P1iIV.js";
+import { d as Permission } from "../permission-types-Dg39z9Kv.js";
+import { r as Role } from "../vocabulary-hhEFLFoL.js";
+import { n as requiredPlans } from "../problem-details-rIIo8B2C.js";
+import { i as describe, r as DescribeOptions, t as DecisionDescription } from "../describe-C3ldA9os.js";
 import { t as PermissionBoundaryState } from "../boundary-BmHxVH1J.js";
 import { t as approvalHeaders } from "../headers-Cf-zWvsO.js";
-import { a as FilterResult, c as SubjectView, i as ClientStatus, l as TenantView, n as ApprovalState, o as PermissionSet, r as ClientPermDock, s as PermissionState, t as ApprovalHandle, u as UseRolesOptions } from "../types-CKNSyIf_.js";
+import { a as ClientPermDock, c as PermissionSet, d as SubjectView, f as TenantView, i as ApprovalState, l as PermissionState, o as ClientStatus, p as UseRolesOptions, r as ApprovalHandle, s as FilterResult, u as ProviderOptionsBase } from "../store-9KO4BlkB.js";
 import { Accessor, Accessor as Accessor$1, JSX } from "solid-js";
 //#region src/solid/types.d.ts
 /** Structural `JSX.Element`: text, a DOM node or a list of children. */
 type SolidChild = string | number | boolean | null | undefined | {
   readonly nodeType: number;
 } | readonly SolidChild[];
-type PermDockProviderProps = {
+type PermDockProviderProps = ProviderOptionsBase & {
   /**
    * An accessor re-hydrates the store when it changes and keeps it `pending`
    * while it returns `undefined` (a loading `createResource`); a promise keeps
    * the store `pending` until it settles.
    */
   readonly snapshot: Snapshot | string | Accessor$1<Snapshot | string | undefined> | PromiseLike<Snapshot | string>;
-  /**
-   * The AuthZEN evaluations endpoint for checks the snapshot cannot answer.
-   * `false` never calls one: such a check is denied with reason `server-only`.
-   */
-  readonly endpoint?: string | false;
-  /** Where `refresh()` fetches a fresh snapshot. Defaults to `endpoint`. */
-  readonly snapshotUrl?: string;
-  readonly approvals?: string;
   /** A change switches the active tenant (`refresh({ tenant })`). */
   readonly tenant?: string;
-  /** `headers`, `fetch` and `verifier` are read on every request, so a rotated token applies without a new store. */
-  readonly fetch?: typeof fetch;
+  /** Read on every request, with `verifier`, so a rotated token applies without a new store. */
   readonly headers?: Readonly<Record<string, string>>;
-  readonly maxAge?: number;
   readonly verifier?: TokenVerifier;
+  /** What every `<Protected>` below renders for a slot it leaves out. */
+  readonly defaults?: PermDockDefaults;
   readonly children: unknown;
 };
+/** Provider-wide content for the `<Protected>` slots a component leaves out. */
+type PermDockDefaults = {
+  readonly pending?: SolidChild;
+  readonly fallback?: SolidChild | ((decision: Decision) => SolidChild);
+  readonly approval?: SolidChild | ((decision: ApprovalRequiredDecision) => SolidChild);
+};
 type PermissionBoundaryProps = {
   /** Rendered in place of the children when one throws `PermDockDeniedError`. */
   readonly denied?: SolidChild | ((state: PermissionBoundaryState) => SolidChild);
@@ -49,9 +47,9 @@ type ProtectedProps = {
   readonly tenant?: string;
   readonly pending?: SolidChild;
   readonly fallback?: SolidChild | ((decision: Decision) => SolidChild);
-  readonly children: SolidChild | ((decision: Extract<Decision, {
-    readonly outcome: "granted";
-  }>) => SolidChild);
+  /** Rendered for an approval-required decision; defaults to `fallback`. */
+  readonly approval?: SolidChild | ((decision: ApprovalRequiredDecision) => SolidChild);
+  readonly children: SolidChild | ((decision: GrantedDecision) => SolidChild);
 };
 //#endregion
 //#region src/solid/hooks.d.ts
@@ -72,6 +70,8 @@ export declare function useAssignablePermissions(options?: {
 }>): Accessor<readonly Permission[]>;
 export declare function useSubject(): Accessor<SubjectView>;
 export declare function useApproval(decision: Accessor<Decision>): Accessor<ApprovalHandle>;
+/** `describe` with the provider's `messages`; a call's own `messages` win. */
+export declare function useDescribe(): (decision: Decision, options?: DescribeOptions) => DecisionDescription;
 //#endregion
 //#region src/solid/boundary.d.ts
 /**
@@ -90,4 +90,4 @@ export declare function Protected(props: ProtectedProps): JSX.Element;
 //#region src/solid/provider.d.ts
 export declare function PermDockProvider(props: PermDockProviderProps): JSX.Element;
 //#endregion
-export { type ApprovalHandle, type ApprovalState, type ClientPermDock, type ClientStatus, type FilterResult, type PermDockProviderProps, type PermissionBoundaryProps, type PermissionBoundaryState, type PermissionSet, type PermissionState, type ProtectedProps, type SolidChild, type SubjectView, type TenantView, type UseRolesOptions, approvalHeaders, describe, requiredPlans };
+export { type ApprovalHandle, type ApprovalState, type ClientPermDock, type ClientStatus, type FilterResult, type PermDockDefaults, type PermDockProviderProps, type PermissionBoundaryProps, type PermissionBoundaryState, type PermissionSet, type PermissionState, type ProtectedProps, type SolidChild, type SubjectView, type TenantView, type UseRolesOptions, approvalHeaders, describe, requiredPlans };