permdock 0.3.1 → 0.4.0

package/dist/hosted-CBHgkzDl.js

@@ -0,0 +1,655 @@
+import { r as isRecord, t as compact } from "./compact-CAf557ZB.js";
+import { n as freezeDeep } from "./freeze-CrU8nQeX.js";
+import { o as isForbiddenKey, u as splitPath } from "./thenable-QSmvt-vZ.js";
+import { a as deny, c as withGrantSchema, d as assertApprovalRelations, f as assertApprovalVersions, i as completeGrant, m as normalizeWhere, n as role, o as flattenGrants, r as allow, s as flattenPermissions } from "./role-builder-B4GbKM-i.js";
+import { n as defineScopes, o as resolveScope } from "./scopes-tvpa34ep.js";
+import { t as parseDuration } from "./duration-xK2jGFVc.js";
+import { a as getResource, c as listPermissions, i as getRegistry, m as annotationsFor, n as findPermission, s as isRegistryTree } from "./permission-registry-BsblpB-z.js";
+import { d as isSelfParented, l as isFieldRelation } from "./resource-relations-D1Un3pcz.js";
+import { _ as listPlans, m as findRole, o as flattenGrantee, r as asGrantee, v as listRoles } from "./grantee-CXY-0C87.js";
+import { n as normalizeValidity } from "./validity-dVrUEPJt.js";
+import { t as canonicalJson } from "./canonical-json-CFKyFOke.js";
+import { a as relationStart, i as relationHops, n as isGraphRelation, t as inheritCondition } from "./grantee-conditions-MQs5NIuX.js";
+import { a as memberOfFields, p as scopeField, u as relatesTo } from "./tenancy-DshjqY0n.js";
+import { n as sha256, t as bytesToBase64Url } from "./sha256-BO0swRXL.js";
+//#region src/core/policy-assertions.ts
+function assertParentGraph(resources) {
+	for (const node of resources.values()) {
+		if (node.parent === void 0) continue;
+		if (!resources.has(node.parent.resource)) throw new Error(`PermDock: resource '${node.name}' parents unknown resource '${node.parent.resource}'`);
+	}
+}
+/**
+* Graph relation grantees must reach their resource: `through: 'parent'` from
+* the row to its parent resource or along its own self-parent, and never over
+* a `memberOf` relation, which is tenancy, not the object graph.
+*/
+function assertRelationGrants(grants, resources) {
+	for (const grant of grants) for (const item of flattenGrantee(grant.to)) {
+		if (item.kind !== "relation" || !isGraphRelation(item, resources)) continue;
+		const label = `grant ${grant.permission.key} relation '${item.relation}'`;
+		const target = resources.get(item.resource);
+		const spec = target?.relations[item.relation];
+		if (target === void 0 || spec === void 0) throw new Error(`PermDock: ${label}: ${item.resource} does not declare it`);
+		if (isFieldRelation(spec) && spec.memberOf !== void 0) throw new Error(`PermDock: ${label} is a memberOf relation; through walks the object graph, not scopes`);
+		const row = resources.get(grant.permission.resource);
+		if (Array.isArray(item.through)) {
+			if (relationHops(item, row, resources) === void 0) throw new Error(`PermDock: ${label}: the links [${item.through.join(", ")}] from ${grant.permission.resource} do not end on ${target.name}${(item.depth ?? 0) > 0 ? ` (or ${target.name} does not parent itself for depth)` : ""}`);
+			continue;
+		}
+		if (item.through === "parent" && target.name === row?.name && !isSelfParented(target)) throw new Error(`PermDock: ${label}: through: 'parent' needs ${target.name} to parent itself`);
+		if (relationStart(item, row, target) === void 0) throw new Error(item.through === void 0 ? `PermDock: ${label} is on ${target.name}, not ${grant.permission.resource}; add through: 'parent'` : `PermDock: ${label}: ${grant.permission.resource} has no parent on ${target.name}`);
+	}
+}
+function assertInheritGrants(grants, resources, tree) {
+	const keys = new Set(listPermissions(tree).map((leaf) => leaf.key));
+	const edges = /* @__PURE__ */ new Map();
+	for (const grant of grants) for (const item of flattenGrantee(grant.to)) {
+		if (item.kind !== "inherit") continue;
+		const label = `grant ${grant.permission.key} inherit '${item.permission}'`;
+		if (grant.effect !== "allow") throw new Error(`PermDock: ${label}: inherit() is allowed on an allow only`);
+		if (grant.permission.kind !== "instance") throw new Error(`PermDock: ${label}: inherit() needs an instance action; a collection action has no row to follow`);
+		if (!keys.has(item.permission)) throw new Error(`PermDock: ${label}: the policy does not declare it`);
+		if (inheritCondition(item, resources.get(grant.permission.resource), resources) === void 0) throw new Error(item.through === "parent" ? `PermDock: ${label}: ${grant.permission.resource} has no parent on ${item.resource}` : `PermDock: ${label}: the links [${item.through.join(", ")}] from ${grant.permission.resource} do not end on ${item.resource}`);
+		const next = edges.get(grant.permission.key) ?? /* @__PURE__ */ new Set();
+		next.add(item.permission);
+		edges.set(grant.permission.key, next);
+	}
+	const done = /* @__PURE__ */ new Set();
+	const visit = (key, path) => {
+		if (path.includes(key)) throw new Error(`PermDock: inherit() grants form a cycle: ${[...path.slice(path.indexOf(key)), key].join(" -> ")}`);
+		if (done.has(key)) return;
+		for (const target of edges.get(key) ?? []) visit(target, [...path, key]);
+		done.add(key);
+	};
+	for (const key of edges.keys()) visit(key, []);
+}
+function scopeOfGrant(scope, declared) {
+	if (typeof scope !== "string" || scope === "global") return scope;
+	const resolved = resolveScope(declared, scope);
+	if (resolved === void 0) throw new Error(`PermDock: definePolicy({ scopes }) must declare '${scope}' for on: '${scope}' roles`);
+	return resolved;
+}
+function rescopeGrantee(to, declared) {
+	const items = flattenGrantee(to);
+	if (!items.some((item) => item.kind === "role")) return to;
+	const mapped = items.map((item) => item.kind === "role" ? freezeDeep({
+		...item,
+		scope: scopeOfGrant(item.scope, declared)
+	}) : item);
+	if (Array.isArray(to)) return freezeDeep(mapped);
+	const [single] = mapped;
+	return single ?? to;
+}
+/** Resolves `tenant` / `team` aliases to declared names; an undeclared scope throws. */
+function rescopeGrant(grant, declared) {
+	const scope = scopeOfGrant(grant.scope, declared);
+	const to = rescopeGrantee(grant.to, declared);
+	if (scope === grant.scope && to === grant.to) return grant;
+	return freezeDeep({
+		...grant,
+		scope,
+		to
+	});
+}
+function rescopeBinding(binding, declared) {
+	const grants = binding.grants.map((grant) => rescopeGrant(grant, declared));
+	const on = typeof binding.on === "string" ? scopeOfGrant(binding.on, declared) : binding.on;
+	return freezeDeep(compact({
+		...binding,
+		grants,
+		on
+	}));
+}
+/**
+* No implicit cascade: a grant on scope S reaches a row only through the row's
+* own S key, so every resource an instance grant on S touches declares a
+* `memberOf: S` relation on that key. Without it `where()` and RLS could not
+* narrow the rows.
+*/
+function assertScopeKeys(grants, scopes, resources) {
+	for (const grant of grants) {
+		if (typeof grant.scope !== "string" || grant.scope === "global" || grant.permission.kind !== "instance") continue;
+		const key = scopes.find((scope) => scope.name === grant.scope)?.key;
+		const node = resources.get(grant.permission.resource);
+		if (key === void 0 || node === void 0) continue;
+		const fields = memberOfFields(node, grant.scope, scopes);
+		if (fields.length > 1 && !fields.includes(key)) throw new Error(`PermDock: resource '${node.name}' declares several memberOf relations to '${grant.scope}' (${fields.join(", ")}); name the one holding the instance with the scope's key '${key}'`);
+		const field = scopeField(node, grant.scope, scopes);
+		if (field !== void 0 && relatesTo(node, field, grant.scope, scopes)) continue;
+		throw new Error(`PermDock: resource '${node.name}' needs relations: { <name>: { field: '${key}', memberOf: '${grant.scope}' } } for ${grant.permission.key} on '${grant.scope}' roles`);
+	}
+}
+/** A `requires` names a permission the policy declares. */
+function assertRequires(grants, tree) {
+	const keys = new Set(listPermissions(tree).map((leaf) => leaf.key));
+	for (const grant of grants) for (const key of grant.requires ?? []) if (!keys.has(key)) throw new Error(`PermDock: '${grant.permission.key}' requires '${key}', which the policy does not declare`);
+}
+//#endregion
+//#region src/core/policy-delegation.ts
+function delegationTarget(to, index) {
+	if (typeof to === "string") return { kind: to };
+	if ("actor" in to) return { kind: to.actor };
+	const target = compact({
+		kind: to.kind,
+		id: to.id,
+		client: to.client
+	});
+	if (typeof target.kind !== "string" || target.kind === "") throw new Error(`PermDock: delegations[${index}].to needs an actor kind, such as actor('eve')`);
+	if (target.id !== void 0 && (typeof target.id !== "string" || target.id === "")) throw new Error(`PermDock: delegations[${index}].to.id must be a non-empty string`);
+	if (target.client !== void 0 && (typeof target.client !== "string" || target.client === "")) throw new Error(`PermDock: delegations[${index}].to.client must be a non-empty string`);
+	if (target.id !== void 0 && target.client !== void 0) throw new Error(`PermDock: delegations[${index}].to names both an id and a client; name one`);
+	return target;
+}
+function normalizeDelegation(input, index, tree) {
+	const label = `delegations[${index}]`;
+	const from = asGrantee(input.from);
+	const items = flattenGrantee(from);
+	if (items.length === 0) throw new Error(`PermDock: ${label}.from names nobody`);
+	if (items.some((item) => item.kind === "relation" || item.kind === "inherit")) throw new Error(`PermDock: ${label}.from names a relation or inherit(); a delegation is matched without a row, so name a role or another subject-only grantee`);
+	if (items.some((item) => item.kind === "actor")) throw new Error(`PermDock: ${label}.from names an actor; the principal hands over, the actor is \`to\``);
+	const leaves = /* @__PURE__ */ new Map();
+	for (const leaf of input.permissions.flatMap((item) => flattenPermissions(item))) {
+		if (findPermission(tree, leaf.key) === void 0) throw new Error(`PermDock: ${label} names unknown permission '${leaf.key}'`);
+		leaves.set(leaf.key, leaf);
+	}
+	const keys = [...leaves.keys()].toSorted();
+	if (keys.length === 0) throw new Error(`PermDock: ${label}.permissions is empty`);
+	return compact({
+		from,
+		to: delegationTarget(input.to, index),
+		permissions: keys,
+		readOnly: [...leaves.values()].filter((leaf) => annotationsFor(leaf).readOnlyHint).map((leaf) => leaf.key).toSorted(),
+		validity: normalizeValidity(input, label)
+	});
+}
+/** RFC 6749 section 3.3 `scope-token`: printable ASCII without space, `"` or `\`. */
+function isScopeToken(value) {
+	return /^[!#-[\]-~]+$/u.test(value);
+}
+function normalizeOAuthScopes(input, tree) {
+	if (input === void 0) return [];
+	const own = new Set(listPermissions(tree).map((leaf) => leaf.scope));
+	return Object.entries(input).map(([scope, items]) => {
+		if (!isScopeToken(scope)) throw new Error(`PermDock: oauthScopes key '${scope}' is not an OAuth scope token`);
+		if (own.has(scope)) throw new Error(`PermDock: oauthScopes key '${scope}' is a permission's own scope`);
+		const leaves = /* @__PURE__ */ new Map();
+		for (const leaf of (Array.isArray(items) ? items : []).flatMap((item) => flattenPermissions(item))) {
+			if (findPermission(tree, leaf.key) === void 0) throw new Error(`PermDock: oauthScopes '${scope}' names unknown permission '${leaf.key}'`);
+			leaves.set(leaf.key, leaf);
+		}
+		if (leaves.size === 0) throw new Error(`PermDock: oauthScopes '${scope}' covers no permission`);
+		const sorted = [...leaves.values()].toSorted((a, b) => a.key.localeCompare(b.key));
+		return {
+			scope,
+			permissions: sorted.map((leaf) => leaf.key),
+			scopes: sorted.map((leaf) => leaf.scope)
+		};
+	});
+}
+//#endregion
+//#region src/core/policy-fingerprint.ts
+function canonicalPolicy(grants, delegations, levels) {
+	const payload = canonicalGrants(grants);
+	const withDelegations = delegations.length === 0 ? payload : `${payload}\n${JSON.stringify(delegations)}`;
+	return levels === void 0 ? withDelegations : `${withDelegations}\nlevels:${canonicalJson(levels)}`;
+}
+function canonicalGrants(grants) {
+	const payload = grants.map((grant) => ({
+		permission: grant.permission.key,
+		effect: grant.effect,
+		to: grant.to,
+		role: grant.role,
+		where: grant.where,
+		check: grant.check,
+		approval: grant.approval,
+		portable: grant.portable,
+		fields: grant.fields,
+		scope: grant.scope,
+		name: grant.name,
+		purpose: grant.purpose,
+		breakGlass: grant.breakGlass,
+		viaOnly: grant.viaOnly,
+		validity: grant.validity,
+		requires: grant.requires
+	}));
+	return JSON.stringify(payload);
+}
+const POLICY_X = Symbol.for("permdock.policy-x");
+/** The app data schemas of `policy`. */
+function policyX(policy) {
+	if (!Object.hasOwn(policy, POLICY_X)) return;
+	return Reflect.get(policy, POLICY_X);
+}
+//#endregion
+//#region src/core/policy.ts
+function indexPolicy(roles, grants, vocabulary) {
+	const declaredRoles = new Set(roles.map((item) => item.name));
+	for (const leaf of listRoles(vocabulary.roles)) declaredRoles.add(leaf.key);
+	const supports = roles.flatMap((binding) => binding.support === void 0 ? [] : [binding.support]);
+	const listed = grants.length > 0 ? grants : roles.flatMap((binding) => binding.grants);
+	const byKey = /* @__PURE__ */ new Map();
+	for (const grant of listed) {
+		const bucket = byKey.get(grant.permission.key);
+		if (bucket === void 0) byKey.set(grant.permission.key, [grant]);
+		else bucket.push(grant);
+	}
+	for (const bucket of byKey.values()) Object.freeze(bucket);
+	return freezeDeep({
+		declaredRoles,
+		supports,
+		grantsByKey: byKey
+	});
+}
+function normalizeLevels(resources) {
+	const out = {};
+	for (const node of resources.values()) {
+		const entries = Object.entries({ ...node.levels });
+		if (entries.length === 0) continue;
+		const levels = {};
+		for (const [name, input] of entries) try {
+			levels[name] = Object.keys(input).length === 0 ? {
+				op: "and",
+				conditions: []
+			} : normalizeWhere(input);
+		} catch (error) {
+			throw new Error(`PermDock: level '${name}' on '${node.name}' is not a valid condition`, { cause: error });
+		}
+		out[node.name] = levels;
+	}
+	return Object.keys(out).length === 0 ? void 0 : freezeDeep(out);
+}
+/** Declared levels of `resource` with their conditions, in declaration order. */
+function policyLevels(policy, resource) {
+	const levels = policy.levels;
+	return levels !== void 0 && Object.hasOwn(levels, resource) ? Object.entries({ ...levels[resource] }) : [];
+}
+/** The condition of `level` on `resource`, if the policy declares it. */
+function levelCondition(policy, resource, level) {
+	return policyLevels(policy, resource).find(([name]) => name === level)?.[1];
+}
+/** Declared level names of `resource`, in declaration order. */
+function levelNames(policy, resource) {
+	return policyLevels(policy, resource).map(([name]) => name);
+}
+function isVocabularyInput(value) {
+	return value !== null && typeof value === "object" && "permissions" in value && isRegistryTree(value.permissions);
+}
+function mergeBindings(items) {
+	const merged = /* @__PURE__ */ new Map();
+	for (const item of items) {
+		const existing = merged.get(item.name);
+		if (existing === void 0) {
+			merged.set(item.name, item);
+			continue;
+		}
+		merged.set(item.name, freezeDeep(compact({
+			name: item.name,
+			grants: [...existing.grants, ...item.grants],
+			on: existing.on,
+			assignable: existing.assignable,
+			exclusiveWith: existing.exclusiveWith ?? item.exclusiveWith,
+			min: existing.min ?? item.min,
+			max: existing.max ?? item.max,
+			transferOnly: existing.transferOnly ?? item.transferOnly,
+			assigns: existing.assigns ?? item.assigns,
+			for: existing.for ?? item.for,
+			meta: existing.meta ?? item.meta,
+			activation: existing.activation ?? item.activation,
+			support: existing.support ?? item.support
+		})));
+	}
+	return {
+		roles: [...merged.values()],
+		rolesByName: merged
+	};
+}
+function definePolicy(permissions, options) {
+	const vocabulary = isVocabularyInput(permissions) ? permissions : { permissions };
+	const tree = vocabulary.permissions;
+	const mapper = options.principal ?? options.subject;
+	if (mapper === void 0) throw new Error("PermDock: definePolicy requires principal or subject");
+	const resources = getRegistry(tree);
+	assertParentGraph(resources);
+	const scopes = defineScopes(options.scopes);
+	const grantSchema = options.x?.grant;
+	const { roles, rolesByName } = mergeBindings((options.roles ?? []).map((binding) => {
+		const rescoped = rescopeBinding(binding, scopes);
+		const grants = rescoped.grants.map((grant) => withGrantSchema(grant, grantSchema));
+		return grants.every((grant, index) => grant === rescoped.grants[index]) ? rescoped : freezeDeep({
+			...rescoped,
+			grants
+		});
+	}));
+	const declared = new Set(roles.map((item) => item.name));
+	for (const leaf of listRoles(vocabulary.roles)) declared.add(leaf.key);
+	for (const binding of roles) for (const name of binding.assigns ?? []) if (!declared.has(name)) throw new Error(`PermDock: role '${binding.name}' names undeclared role '${name}'`);
+	const fromBindings = roles.flatMap((item) => item.grants);
+	const fromGrants = flattenGrants(options.grants ?? []).map(completeGrant).map((grant) => withGrantSchema(rescopeGrant(grant, scopes), grantSchema));
+	const grants = [...fromBindings, ...fromGrants];
+	assertScopeKeys(grants, scopes, resources);
+	assertApprovalVersions(grants, resources);
+	assertApprovalRelations(grants, resources);
+	assertRelationGrants(grants, resources);
+	assertRequires(grants, tree);
+	assertInheritGrants(grants, resources, tree);
+	const delegations = (options.delegations ?? []).map((item, index) => normalizeDelegation(item, index, tree));
+	const levels = normalizeLevels(resources);
+	const oauthScopes = normalizeOAuthScopes(options.oauthScopes, tree);
+	const fingerprint = bytesToBase64Url(sha256(oauthScopes.length === 0 ? canonicalPolicy(grants, delegations, levels) : `${canonicalPolicy(grants, delegations, levels)}\noauthScopes:${canonicalJson(oauthScopes)}`));
+	const hostable = [...new Set((options.hostable ?? []).flatMap((item) => flattenPermissions(item).map((leaf) => leaf.key)))].toSorted();
+	const fresh = [...new Set((options.fresh ?? []).flatMap((item) => flattenPermissions(item).map((leaf) => leaf.key)))].toSorted();
+	return freezeDeep({
+		permissions: tree,
+		roles,
+		rolesByName,
+		grants,
+		vocabulary,
+		scopes,
+		principal: mapper,
+		subject: mapper,
+		context: options.context,
+		validate: options.validate ?? "boundary",
+		onDenied: options.onDenied,
+		fingerprint,
+		resources,
+		...options.x === void 0 ? {} : { [POLICY_X]: options.x },
+		providers: options.providers,
+		hostable,
+		fresh,
+		delegations: delegations.length === 0 ? void 0 : delegations,
+		levels,
+		oauthScopes: oauthScopes.length === 0 ? void 0 : oauthScopes,
+		index: indexPolicy(roles, grants, vocabulary)
+	});
+}
+function exclusivePairs(policy) {
+	const pairs = /* @__PURE__ */ new Map();
+	for (const binding of policy.roles) if (binding.exclusiveWith !== void 0) pairs.set(binding.name, binding.exclusiveWith);
+	return pairs;
+}
+function grantList(policy) {
+	if (policy.grants !== void 0 && policy.grants.length > 0) return policy.grants;
+	return policy.roles.flatMap((binding) => binding.grants);
+}
+function declaredRoleNames(policy) {
+	return policy.index.declaredRoles;
+}
+function separationConflicts(policy, memberships) {
+	const exclusive = exclusivePairs(policy);
+	const seen = /* @__PURE__ */ new Set();
+	const conflicts = [];
+	for (const membership of memberships) {
+		const held = new Set(membership.roles);
+		for (const name of held) for (const other of exclusive.get(name) ?? []) {
+			if (!held.has(other)) continue;
+			const pair = [name, other].toSorted();
+			const key = `${membership.principal ?? ""}:${membership.tenant ?? ""}:${pair.join("+")}`;
+			if (seen.has(key)) continue;
+			seen.add(key);
+			conflicts.push(compact({
+				principal: membership.principal ?? "",
+				tenant: membership.tenant,
+				roles: pair
+			}));
+		}
+	}
+	return conflicts;
+}
+//#endregion
+//#region src/core/hosted.ts
+function memoryPolicySource(document = null) {
+	const current = document === null ? null : parsePolicyDocument(document);
+	return Object.freeze({
+		current: () => current,
+		refresh: () => Promise.resolve()
+	});
+}
+function rejectUnsafe(value) {
+	if (value === null || typeof value !== "object") return;
+	if (Array.isArray(value)) {
+		for (const item of value) rejectUnsafe(item);
+		return;
+	}
+	for (const key of Object.keys(value)) {
+		if (isForbiddenKey(key)) throw new Error(`PermDock: unsafe policy document key '${key}'`);
+		rejectUnsafe(value[key]);
+	}
+}
+/** Validates the document envelope; per-grant checks happen at merge time. */
+function parsePolicyDocument(json) {
+	const input = typeof json === "string" ? JSON.parse(json) : json;
+	if (!isRecord(input)) throw new TypeError("PermDock: policy document must be an object");
+	const copy = JSON.parse(JSON.stringify(input));
+	rejectUnsafe(copy);
+	if (copy["v"] !== 1) throw new Error(`PermDock: unsupported policy document version '${String(copy["v"])}'`);
+	if (typeof copy["id"] !== "string" || typeof copy["fingerprint"] !== "string" || typeof copy["catalog"] !== "string" || typeof copy["issuedAt"] !== "number" || !Array.isArray(copy["grants"])) throw new TypeError("PermDock: malformed policy document");
+	return freezeDeep(copy);
+}
+const COMPARISONS = /* @__PURE__ */ new Set([
+	"eq",
+	"ne",
+	"gt",
+	"gte",
+	"lt",
+	"lte",
+	"contains"
+]);
+function safePath(path) {
+	if (typeof path !== "string" || path.length === 0) return false;
+	return splitPath(path).every((segment) => !isForbiddenKey(segment));
+}
+function portableValue(value) {
+	if (value === null || typeof value === "string" || typeof value === "boolean" || typeof value === "number" && Number.isFinite(value)) return true;
+	if (Array.isArray(value)) return value.every(portableValue);
+	if (!isRecord(value)) return false;
+	const keys = Object.keys(value);
+	if (keys.length !== 1) return false;
+	if (keys[0] === "ref") return safePath(value["ref"]);
+	return keys[0] === "date" && typeof value["date"] === "string";
+}
+/** True for the portable subset only: no `opaque`, no `sqlFunction`, no unknown op. */
+function isPortableCondition(value) {
+	if (!isRecord(value) || typeof value["op"] !== "string") return false;
+	const op = value["op"];
+	if (COMPARISONS.has(op)) return safePath(value["field"]) && portableValue(value["value"]);
+	switch (op) {
+		case "in":
+		case "notIn": return safePath(value["field"]) && (Array.isArray(value["value"]) || isRecord(value["value"])) && portableValue(value["value"]);
+		case "isNull": return safePath(value["field"]) && typeof value["value"] === "boolean";
+		case "and":
+		case "or": return Array.isArray(value["conditions"]) && value["conditions"].every(isPortableCondition);
+		case "not": return isPortableCondition(value["condition"]);
+		case "memberOf": return (value["scope"] === "tenant" || value["scope"] === "team" || value["scope"] === "resource") && safePath(value["field"]) && Array.isArray(value["roles"]) && value["roles"].every((item) => typeof item === "string") && (value["resource"] === void 0 || typeof value["resource"] === "string") && (value["parents"] === void 0 || Array.isArray(value["parents"]) && value["parents"].every((parent) => safePath(parent) || isRecord(parent) && safePath(parent["field"]) && typeof parent["resource"] === "string"));
+		default: return false;
+	}
+}
+function approvalRank(approval) {
+	if (approval === void 0) return;
+	if (approval === "human") return {
+		distinct: true,
+		stale: false,
+		quorum: 1,
+		ttl: Number.POSITIVE_INFINITY,
+		escalates: false
+	};
+	return {
+		by: approval.stages === void 0 ? JSON.stringify(approval.by) : JSON.stringify([approval.mode, approval.stages]),
+		distinct: approval.distinct !== false,
+		stale: approval.staleOn === "resource-change",
+		quorum: approval.quorum ?? 1,
+		ttl: parseDuration(approval.ttl) ?? Number.POSITIVE_INFINITY,
+		escalates: approval.escalation !== void 0
+	};
+}
+/** A hosted approval must meet every approval a code allow requires on the permission. */
+function approvalAtLeast(hosted, code) {
+	const mine = approvalRank(hosted);
+	for (const required of code) {
+		const theirs = approvalRank(required);
+		if (theirs === void 0) continue;
+		if (mine === void 0) return false;
+		if (theirs.distinct && !mine.distinct) return false;
+		if (theirs.stale && !mine.stale) return false;
+		if (theirs.by !== void 0 && mine.by !== theirs.by) return false;
+		if (mine.quorum < theirs.quorum || mine.ttl > theirs.ttl) return false;
+		if (mine.escalates && !theirs.escalates) return false;
+	}
+	return true;
+}
+/** A grantee kind this build does not know is never declared, so the hosted grant is dropped. */
+function undeclaredKind(_grantee) {
+	return false;
+}
+function declaredGrantee(policy, grantee, permissionResource) {
+	switch (grantee.kind) {
+		case "role": return declaredRoleNames(policy).has(grantee.role);
+		case "plan": return listPlans(policy.vocabulary.plans).some((leaf) => leaf.key === grantee.plan);
+		case "relation": return grantee.resource === permissionResource && getResource(policy.permissions, grantee.resource)?.relations[grantee.relation] !== void 0 && (grantee.through === void 0 || grantee.through === "parent" && isSelfParented(getResource(policy.permissions, grantee.resource))) && (grantee.depth === void 0 || grantee.through === "parent" && Number.isInteger(grantee.depth) && grantee.depth >= 0 && grantee.depth <= 32);
+		case "anyone":
+		case "authenticated":
+		case "actor":
+		case "assurance":
+		case "inherit": return false;
+		default: return undeclaredKind(grantee);
+	}
+}
+/** Approvers are declared roles, plans or relations, or any authenticated human. */
+function approvalAcceptable(policy, approval, permissionResource) {
+	if (approval === void 0 || approval === "human") return true;
+	if (!isRecord(approval)) return false;
+	if (approval["mode"] !== void 0 || approval["stages"] !== void 0) return false;
+	if (approval["distinct"] !== void 0 && typeof approval["distinct"] !== "boolean") return false;
+	if (approval["staleOn"] !== void 0 && (approval["staleOn"] !== "resource-change" || getResource(policy.permissions, permissionResource)?.version === void 0)) return false;
+	if (approval["quorum"] !== void 0 && (!Number.isInteger(approval["quorum"]) || approval["quorum"] < 1)) return false;
+	if (approval["ttl"] !== void 0 && (typeof approval["ttl"] !== "string" || parseDuration(approval["ttl"]) === void 0)) return false;
+	const escalation = approval["escalation"];
+	if (escalation !== void 0 && (!isRecord(escalation) || typeof escalation["after"] !== "string" || parseDuration(escalation["after"]) === void 0 || !granteesAcceptable(policy, escalation["to"], permissionResource))) return false;
+	if (approval["by"] === void 0) return true;
+	return granteesAcceptable(policy, approval["by"], permissionResource);
+}
+function granteesAcceptable(policy, raw, permissionResource) {
+	if (raw === void 0) return false;
+	const items = flattenGrantee(raw);
+	return items.length > 0 && items.every((item) => isRecord(item) && item.kind !== "relation" && (item.kind === "authenticated" || declaredGrantee(policy, item, permissionResource)));
+}
+function buildGrant(policy, document, raw) {
+	if (!isRecord(raw) || typeof raw["id"] !== "string" || typeof raw["permission"] !== "string" || raw["effect"] !== void 0 && raw["effect"] !== "allow" && raw["effect"] !== "deny" || raw["to"] === void 0) return {
+		ok: false,
+		reason: "invalid"
+	};
+	const permission = findPermission(policy.permissions, raw["permission"]);
+	if (permission === void 0) return {
+		ok: false,
+		reason: "unknown-permission"
+	};
+	if (!policy.hostable.includes(permission.key)) return {
+		ok: false,
+		reason: "not-hostable"
+	};
+	const to = flattenGrantee(raw["to"]);
+	if (to.length === 0 || !to.every((item) => isRecord(item) && declaredGrantee(policy, item, permission.resource))) return {
+		ok: false,
+		reason: "unknown-grantee"
+	};
+	for (const condition of [raw["where"], raw["check"]]) if (condition !== void 0 && !isPortableCondition(condition)) return {
+		ok: false,
+		reason: "non-portable"
+	};
+	if (!approvalAcceptable(policy, raw["approval"], permission.resource)) return {
+		ok: false,
+		reason: "invalid"
+	};
+	if (raw["fields"] !== void 0 && !(Array.isArray(raw["fields"]) && raw["fields"].every((field) => typeof field === "string"))) return {
+		ok: false,
+		reason: "invalid"
+	};
+	const effect = raw["effect"] ?? "allow";
+	const options = compact({
+		where: raw["where"] === void 0 ? void 0 : normalizeWhere(raw["where"]),
+		check: raw["check"] === void 0 ? void 0 : normalizeWhere(raw["check"]),
+		approval: raw["approval"],
+		fields: raw["fields"]
+	});
+	let built;
+	try {
+		const roleItem = to.length === 1 && to[0]?.kind === "role" ? to[0] : null;
+		if (roleItem === null) {
+			const partial = (effect === "allow" ? allow : deny)(permission, {
+				...options,
+				to
+			});
+			built = completeGrant(partial);
+		} else {
+			const binding = policy.rolesByName.get(roleItem.role);
+			const leaf = findRole(policy.vocabulary.roles, roleItem.role);
+			const [first] = role(leaf ?? roleItem.role, [(effect === "allow" ? allow : deny)(permission, options)], binding?.on === void 0 ? {} : { on: binding.on }).grants;
+			if (first === void 0) throw new TypeError("PermDock: role produced no grant");
+			built = first;
+		}
+	} catch {
+		return {
+			ok: false,
+			reason: "invalid"
+		};
+	}
+	if (effect === "allow") {
+		const codeApprovals = policy.grants.filter((grant) => grant.effect === "allow" && grant.hosted === void 0 && grant.permission.key === permission.key).map((grant) => grant.approval);
+		if (!approvalAtLeast(built.approval, codeApprovals)) return {
+			ok: false,
+			reason: "weaker-approval"
+		};
+	}
+	return {
+		ok: true,
+		grant: freezeDeep({
+			...built,
+			hosted: {
+				document: document.fingerprint,
+				grant: raw["id"]
+			}
+		})
+	};
+}
+/**
+* The code policy plus the hosted grants that pass every rule. Hosted
+* allows OR with code allows and any deny still wins, so a hosted grant can
+* never override a code deny; one that fails a rule is dropped, not thrown.
+*/
+function mergeHostedGrants(policy, document) {
+	if (document === null || document.grants.length === 0) return {
+		policy,
+		dropped: []
+	};
+	const merged = [];
+	const dropped = [];
+	for (const raw of document.grants) {
+		const result = buildGrant(policy, document, raw);
+		if (result.ok) {
+			merged.push(result.grant);
+			continue;
+		}
+		dropped.push(freezeDeep({
+			kind: "hosted-grant-dropped",
+			document: document.fingerprint,
+			grant: isRecord(raw) && typeof raw.id === "string" ? raw.id : "",
+			reason: result.reason
+		}));
+	}
+	if (merged.length === 0) return {
+		policy,
+		dropped
+	};
+	const grants = [...policy.grants, ...merged];
+	return {
+		policy: freezeDeep({
+			...policy,
+			grants,
+			index: indexPolicy(policy.roles, grants, policy.vocabulary),
+			fingerprint: bytesToBase64Url(sha256(`${policy.fingerprint}:${document.fingerprint}`))
+		}),
+		dropped
+	};
+}
+//#endregion
+export { declaredRoleNames as a, levelCondition as c, separationConflicts as d, policyX as f, parsePolicyDocument as i, levelNames as l, memoryPolicySource as n, definePolicy as o, mergeHostedGrants as r, grantList as s, isPortableCondition as t, policyLevels as u };