permdock 0.3.1 → 0.5.0

package/dist/permissions-DVoF6dMt.js

@@ -1,662 +0,0 @@
-import { n as isReadonlyArray, t as compact } from "./compact-y6vfu2_f.js";
-import { n as freezeDeep } from "./freeze-CrU8nQeX.js";
-//#region src/core/paths.ts
-const FORBIDDEN_KEYS = /* @__PURE__ */ new Set([
-	"__proto__",
-	"constructor",
-	"prototype"
-]);
-function isForbiddenKey(key) {
-	return FORBIDDEN_KEYS.has(key);
-}
-function assertSafeKey(key, context) {
-	if (key.length === 0 || key.split(".").some(isForbiddenKey)) throw new Error(`PermDock: forbidden ${context} key '${key}'`);
-}
-function ownGet(object, key) {
-	if (isForbiddenKey(key)) return;
-	if (!Object.hasOwn(object, key)) return;
-	return object[key];
-}
-function ownKeys(object) {
-	return Object.keys(object).filter((key) => !isForbiddenKey(key));
-}
-function splitPath(path) {
-	return path.split(".").filter((segment) => segment.length > 0);
-}
-function readPath(root, path) {
-	const segments = splitPath(path);
-	let current = root;
-	for (const segment of segments) {
-		if (isForbiddenKey(segment)) return;
-		if (current === null || current === void 0 || typeof current !== "object") return;
-		current = ownGet(current, segment);
-	}
-	return current;
-}
-//#endregion
-//#region src/core/permissions.ts
-const RESOURCE_BRAND = Symbol.for("permdock.resource");
-const TREE_REGISTRY = Symbol.for("permdock.registry");
-const NODE_RESOURCE = Symbol.for("permdock.resource");
-const TREE_LEAVES = Symbol.for("permdock.leaves");
-const LEAF_FORMER = Symbol.for("permdock.former");
-/** The edge's group resources with their relation and id column. */
-function groupEntries(spec) {
-	const groups = spec.groups;
-	if (groups === void 0) return [];
-	return Object.entries(groups.resources).map(([resource, group]) => typeof group === "string" ? {
-		resource,
-		relation: group,
-		subject: spec.subject ?? "user_id",
-		typed: false
-	} : {
-		resource,
-		relation: group.relation,
-		subject: group.subject ?? spec.subject ?? "user_id",
-		typed: group.subject !== void 0
-	});
-}
-function restrictedStops(node, path) {
-	return node?.restricted !== void 0 && (node.restrictedStops === void 0 || node.restrictedStops.includes(path));
-}
-function restrictedFor(node, path) {
-	return restrictedStops(node, path) ? node?.restricted : void 0;
-}
-function isFieldRelation(relation) {
-	return relation !== void 0 && "field" in relation;
-}
-function isEdgeRelation(relation) {
-	return relation !== void 0 && "edge" in relation;
-}
-function isPrincipalRelation(relation) {
-	return relation !== void 0 && "principal" in relation;
-}
-function isComputedRelation(relation) {
-	return relation !== void 0 && !("field" in relation) && !("edge" in relation) && !("principal" in relation);
-}
-/**
-* The relations whose holders hold `name` on `node`: `name` itself when it
-* has a source, then everything it includes, transitively, each once.
-* `definePermissions` rejects cycles and unknown names, so this terminates.
-*/
-function expandRelation(node, name) {
-	const out = [];
-	const seen = /* @__PURE__ */ new Set();
-	const visit = (current) => {
-		if (seen.has(current)) return;
-		seen.add(current);
-		const spec = node?.relations[current];
-		if (spec === void 0) return;
-		if (!isComputedRelation(spec)) out.push(current);
-		for (const included of spec.includes ?? []) visit(included);
-	};
-	visit(name);
-	return out;
-}
-/** Whether `node` names itself as its parent (nested folders, sub-teams, reporting lines). */
-function isSelfParented(node) {
-	return node?.parent !== void 0 && node.parent.resource === node.name;
-}
-function isStandardSchema(value) {
-	return value !== null && typeof value === "object" && "~standard" in value && typeof value["~standard"]?.version === "number";
-}
-function isResourceInit(value) {
-	return value !== null && typeof value === "object" && RESOURCE_BRAND in value && value[RESOURCE_BRAND] === true;
-}
-function isResourceOptions(value) {
-	return value !== null && typeof value === "object" && !Array.isArray(value) && !isStandardSchema(value);
-}
-function metaFor(list, action) {
-	if (list === void 0 || Array.isArray(list)) return freezeDeep({});
-	const meta = list[action];
-	if (meta?.x !== void 0) {
-		assertMetaValue(meta.x, `meta.x of action '${action}'`, 0);
-		if (Array.isArray(meta.x)) throw new TypeError(`PermDock: meta.x of action '${action}' must be a JSON object`);
-	}
-	return freezeDeep({ ...meta });
-}
-const MAX_META_DEPTH = 8;
-function assertMetaValue(value, label, depth) {
-	if (depth > MAX_META_DEPTH) throw new Error(`PermDock: ${label} nests deeper than ${MAX_META_DEPTH}`);
-	if (value === null || typeof value === "string" || typeof value === "boolean" || typeof value === "number" && Number.isFinite(value)) return;
-	if (Array.isArray(value)) {
-		for (const item of value) assertMetaValue(item, label, depth + 1);
-		return;
-	}
-	if (typeof value === "object" && Object.getPrototypeOf(value) === Object.prototype) {
-		for (const key of Object.keys(value)) {
-			assertSafeKey(key, "meta.x key");
-			assertMetaValue(Reflect.get(value, key), label, depth + 1);
-		}
-		return;
-	}
-	throw new Error(`PermDock: ${label} must be plain JSON`);
-}
-/**
-* MCP and WebMCP tool hints from a permission's `meta`. Hints only inform the
-* client; every call is still decided on the server.
-*/
-function annotationsFor(permission) {
-	const { meta } = permission;
-	const readOnlyHint = meta.readOnly ?? (permission.action === "read" || permission.action === "list");
-	return compact({
-		readOnlyHint,
-		destructiveHint: readOnlyHint ? void 0 : meta.destructive,
-		idempotentHint: meta.idempotent
-	});
-}
-function actionNames(list) {
-	if (list === void 0) return [];
-	if (isReadonlyArray(list)) return list;
-	return Object.keys(list);
-}
-function keyToScope(key) {
-	return key.replaceAll(".", ":");
-}
-function makeLeaf(key, resourceName, action, meta, kind, former) {
-	const leaf = {
-		key,
-		scope: keyToScope(key),
-		resource: resourceName,
-		action,
-		meta
-	};
-	Object.defineProperty(leaf, "kind", {
-		value: kind,
-		enumerable: false,
-		writable: false,
-		configurable: false
-	});
-	if (former !== void 0 && former.length > 0) Object.defineProperty(leaf, LEAF_FORMER, {
-		value: Object.freeze([...former].toSorted()),
-		enumerable: false,
-		writable: false,
-		configurable: false
-	});
-	return Object.freeze(leaf);
-}
-/**
-* The keys `permission` was renamed from, sorted. Empty for a leaf without
-* renames and for one that crossed a serialisation boundary.
-*/
-function formerKeys(permission) {
-	if (!Object.hasOwn(permission, LEAF_FORMER)) return [];
-	const value = Reflect.get(permission, LEAF_FORMER);
-	return isReadonlyArray(value) ? value.filter((item) => typeof item === "string") : [];
-}
-/** The OAuth scope strings `permission` used to have: each former key with `.` as `:`. */
-function formerScopes(permission) {
-	return formerKeys(permission).map(keyToScope);
-}
-/** Former key to current key, for every leaf of `tree`. */
-function renamedKeys(tree) {
-	const map = /* @__PURE__ */ new Map();
-	for (const leaf of listPermissions(tree)) for (const old of formerKeys(leaf)) map.set(old, leaf.key);
-	return map;
-}
-function resource(schemaOrOptions, options) {
-	if (schemaOrOptions === void 0 && options === void 0) throw new Error("PermDock: resource() requires a schema or options");
-	if (isStandardSchema(schemaOrOptions)) return {
-		[RESOURCE_BRAND]: true,
-		schema: schemaOrOptions,
-		options: options ?? {}
-	};
-	if (isResourceOptions(schemaOrOptions) && options === void 0) return {
-		[RESOURCE_BRAND]: true,
-		schema: void 0,
-		options: schemaOrOptions
-	};
-	throw new Error("PermDock: resource() first argument must be a schema or options");
-}
-const RESOURCE_NAME = /^[A-Za-z][A-Za-z0-9_-]*$/u;
-/** Level names ride claims and grant keys (`key@level`), so they stay SQL- and claim-safe. */
-const LEVEL_NAME = /^[a-z][a-z0-9_]*$/u;
-const EDGE_TABLE = /^[A-Za-z_][A-Za-z0-9_]*(\.[A-Za-z_][A-Za-z0-9_]*)?$/u;
-function restrictedStopsOf(name, option, parent, links) {
-	if (option.stops === void 0) return;
-	if (!Array.isArray(option.stops) || option.stops.length === 0) throw new Error(`PermDock: resource "${name}" restricted.stops must list 'parent' or link names`);
-	const stops = /* @__PURE__ */ new Set();
-	for (const path of option.stops) {
-		if (typeof path !== "string") throw new TypeError(`PermDock: resource "${name}" restricted.stops must list 'parent' or link names`);
-		if (path === "parent" ? parent === void 0 : !Object.hasOwn(links, path)) throw new Error(`PermDock: resource "${name}" restricted.stops names '${path}', which it does not declare`);
-		stops.add(path);
-	}
-	return Object.freeze([...stops].toSorted());
-}
-function normaliseRelation(resourceName, relationName, spec) {
-	if (typeof spec === "string") {
-		assertSafeKey(spec, "relation field");
-		return { field: spec };
-	}
-	const label = `relation '${relationName}' on '${resourceName}'`;
-	const includes = normaliseIncludes(label, spec.includes);
-	const kinds = [
-		"field",
-		"edge",
-		"principal"
-	].filter((kind) => kind in spec);
-	if (kinds.length === 0 && includes !== void 0) return { includes };
-	if (kinds.length !== 1) throw new Error(`PermDock: ${label} needs exactly one of field, edge, principal or includes`);
-	const withIncludes = includes === void 0 ? {} : { includes };
-	if (isEdgeRelation(spec)) {
-		if (!EDGE_TABLE.test(spec.edge)) throw new Error(`PermDock: ${label} has an unsafe edge table '${spec.edge}'`);
-		for (const column of [
-			spec.object,
-			spec.subject,
-			spec.expiresAt
-		]) if (column !== void 0) assertSafeKey(column, "edge column");
-		return {
-			edge: spec.edge,
-			...spec.object === void 0 ? {} : { object: spec.object },
-			...spec.subject === void 0 ? {} : { subject: spec.subject },
-			...spec.expiresAt === void 0 ? {} : { expiresAt: spec.expiresAt },
-			...spec.match === void 0 ? {} : { match: normaliseMatch(label, spec.match) },
-			...spec.groups === void 0 ? {} : { groups: normaliseGroups(label, spec.groups) },
-			...withIncludes
-		};
-	}
-	if (isPrincipalRelation(spec)) {
-		assertSafeKey(spec.principal, "relation principal");
-		for (const column of [spec.period?.startsAt, spec.period?.expiresAt]) if (column !== void 0) assertSafeKey(column, "relation period");
-		return spec.period === void 0 ? {
-			principal: spec.principal,
-			...withIncludes
-		} : {
-			principal: spec.principal,
-			period: { ...spec.period },
-			...withIncludes
-		};
-	}
-	const field = spec;
-	assertSafeKey(field.field, "relation field");
-	if (field.memberOf !== void 0 && includes !== void 0) throw new Error(`PermDock: ${label} is a memberOf relation and cannot include others`);
-	return field.memberOf === void 0 ? {
-		field: field.field,
-		...withIncludes
-	} : {
-		field: field.field,
-		memberOf: field.memberOf
-	};
-}
-function normaliseIncludes(label, includes) {
-	if (includes === void 0) return;
-	if (!Array.isArray(includes) || includes.length === 0) throw new Error(`PermDock: ${label} includes must be a non-empty list of relation names`);
-	for (const name of includes) {
-		if (typeof name !== "string") throw new TypeError(`PermDock: ${label} includes a non-string name`);
-		assertSafeKey(name, "included relation");
-	}
-	return [...new Set(includes)];
-}
-function normaliseMatch(label, match) {
-	const out = {};
-	const columns = Object.keys(match);
-	if (columns.length === 0) throw new Error(`PermDock: ${label} match needs at least one column`);
-	for (const column of columns) {
-		assertSafeKey(column, "edge match column");
-		const value = match[column];
-		if (typeof value !== "string" && typeof value !== "boolean" && !(typeof value === "number" && Number.isFinite(value))) throw new Error(`PermDock: ${label} match '${column}' must be a string, a finite number or a boolean`);
-		out[column] = value;
-	}
-	return out;
-}
-function normaliseGroups(label, groups) {
-	if (groups.column !== void 0) assertSafeKey(groups.column, "edge groups column");
-	const resources = {};
-	const names = Object.keys(groups.resources);
-	if (names.length === 0) throw new Error(`PermDock: ${label} groups needs at least one resource`);
-	for (const name of names) {
-		assertSafeKey(name, "group resource");
-		const group = groups.resources[name];
-		if (typeof group === "string") {
-			assertSafeKey(group, "group relation");
-			if (groups.column === void 0) throw new Error(`PermDock: ${label} groups '${name}' needs its own subject column, or groups needs a column naming the resource`);
-			resources[name] = group;
-			continue;
-		}
-		if (group === null || typeof group !== "object") throw new TypeError(`PermDock: ${label} groups '${name}' must name a relation`);
-		const relationName = "relation" in group ? group.relation : void 0;
-		if (typeof relationName !== "string") throw new TypeError(`PermDock: ${label} groups '${name}' must name a relation`);
-		assertSafeKey(relationName, "group relation");
-		const subject = "subject" in group ? group.subject : void 0;
-		if (subject !== void 0 && typeof subject !== "string") throw new TypeError(`PermDock: ${label} groups '${name}' subject must be a column name`);
-		if (subject !== void 0) assertSafeKey(subject, "group subject column");
-		else if (groups.column === void 0) throw new Error(`PermDock: ${label} groups '${name}' needs its own subject column, or groups needs a column naming the resource`);
-		resources[name] = subject === void 0 ? { relation: relationName } : {
-			relation: relationName,
-			subject
-		};
-	}
-	if (groups.direct !== void 0 && groups.column === void 0) throw new Error(`PermDock: ${label} groups direct needs a column to compare it with`);
-	if (groups.direct !== void 0 && groups.direct in resources) throw new Error(`PermDock: ${label} groups direct '${groups.direct}' is also a group resource`);
-	return {
-		...groups.column === void 0 ? {} : { column: groups.column },
-		resources,
-		...groups.direct === void 0 ? {} : { direct: groups.direct }
-	};
-}
-/** An included relation must exist on the same resource, be tenancy-free and never include itself back. */
-function assertIncludes(node) {
-	const state = /* @__PURE__ */ new Map();
-	const visit = (name, path) => {
-		if (state.get(name) === "done") return;
-		if (state.get(name) === "visiting") throw new Error(`PermDock: relation includes on '${node.name}' form a cycle: ${[...path, name].join(" -> ")}`);
-		state.set(name, "visiting");
-		for (const included of node.relations[name]?.includes ?? []) {
-			const target = node.relations[included];
-			if (target === void 0) throw new Error(`PermDock: relation '${name}' on '${node.name}' includes '${included}', which '${node.name}' does not declare`);
-			if (isFieldRelation(target) && target.memberOf !== void 0) throw new Error(`PermDock: relation '${name}' on '${node.name}' includes the memberOf relation '${included}'; scopes are tenancy, not the object graph`);
-			visit(included, [...path, name]);
-		}
-		state.set(name, "done");
-	};
-	for (const name of Object.keys(node.relations)) visit(name, []);
-}
-function assertGroupTarget(registry, node, relationName, spec, target, targetRelation) {
-	const label = `relation '${relationName}' on '${node.name}' groups '${target}'`;
-	const targetSpec = registry.get(target)?.relations[targetRelation];
-	if (targetSpec === void 0) throw new Error(`PermDock: ${label} names '${target}#${targetRelation}', which is not declared`);
-	if (isFieldRelation(targetSpec) && targetSpec.memberOf !== void 0) throw new Error(`PermDock: ${label} names a memberOf relation; scopes are tenancy, not the object graph`);
-	if (target === node.name && (targetRelation !== relationName || spec.includes !== void 0)) throw new Error(`PermDock: ${label}: a group on its own resource must name the same relation, which includes nothing`);
-}
-/**
-* Links and group targets name declared resources and relations. Groups may
-* nest within one resource (teams in teams) through the same relation, which
-* then includes nothing, so SQL can walk it with one bounded recursive query;
-* a group cycle across resources is rejected.
-*/
-function assertGraphTargets(registry) {
-	const edges = /* @__PURE__ */ new Map();
-	for (const node of registry.values()) {
-		for (const [linkName, link] of Object.entries(node.links)) if (!registry.has(link.resource)) throw new Error(`PermDock: link '${linkName}' on '${node.name}' names the undeclared resource '${link.resource}'`);
-		for (const [relationName, spec] of Object.entries(node.relations)) {
-			if (!isEdgeRelation(spec) || spec.groups === void 0) continue;
-			for (const { resource: target, relation: targetRelation } of groupEntries(spec)) {
-				assertGroupTarget(registry, node, relationName, spec, target, targetRelation);
-				if (target !== node.name) {
-					const out = edges.get(node.name) ?? /* @__PURE__ */ new Set();
-					out.add(target);
-					edges.set(node.name, out);
-				}
-			}
-		}
-	}
-	const state = /* @__PURE__ */ new Map();
-	const visit = (name) => {
-		if (state.get(name) === "done") return;
-		if (state.get(name) === "visiting") throw new Error(`PermDock: edge groups form a cycle across resources through '${name}'`);
-		state.set(name, "visiting");
-		for (const next of edges.get(name) ?? []) visit(next);
-		state.set(name, "done");
-	};
-	for (const name of edges.keys()) visit(name);
-}
-function materialiseResource(init, path, registry, leaves, former) {
-	const segment = path.at(-1);
-	if (segment === void 0) throw new Error("PermDock: resource() cannot be the root of definePermissions");
-	const name = init.options.name ?? segment;
-	assertSafeKey(name, "resource");
-	if (init.options.name !== void 0 && !RESOURCE_NAME.test(name)) throw new Error(`PermDock: resource name '${name}' must start with a letter and hold only letters, digits, '_' and '-'`);
-	if (registry.has(name)) throw new Error(`PermDock: duplicate resource name '${name}'`);
-	const prefix = path.join(".");
-	const instanceNames = actionNames(init.options.actions);
-	const collectionNames = actionNames(init.options.collection);
-	if (instanceNames.length === 0 && collectionNames.length === 0) throw new Error(`PermDock: resource '${name}' has no actions or collection`);
-	const instanceSet = /* @__PURE__ */ new Set();
-	const collectionSet = /* @__PURE__ */ new Set();
-	const node = {};
-	for (const action of instanceNames) {
-		assertSafeKey(action, "action");
-		if (instanceSet.has(action)) throw new Error(`PermDock: duplicate action '${action}' on '${name}'`);
-		instanceSet.add(action);
-		const key = `${prefix}.${action}`;
-		const leaf = makeLeaf(key, name, action, metaFor(init.options.actions, action), "instance", former.get(key));
-		node[action] = leaf;
-		leaves.push(leaf);
-	}
-	for (const action of collectionNames) {
-		assertSafeKey(action, "action");
-		if (instanceSet.has(action) || collectionSet.has(action)) throw new Error(`PermDock: duplicate action '${action}' on '${name}'`);
-		collectionSet.add(action);
-		const key = `${prefix}.${action}`;
-		const leaf = makeLeaf(key, name, action, metaFor(init.options.collection, action), "collection", former.get(key));
-		node[action] = leaf;
-		leaves.push(leaf);
-	}
-	const parent = init.options.parent;
-	if (parent !== void 0) {
-		assertSafeKey(parent.field, "parent field");
-		assertSafeKey(parent.resource, "parent resource");
-	}
-	const version = init.options.version;
-	if (version !== void 0) assertSafeKey(version, "version field");
-	const restrictedOption = init.options.restricted;
-	const restricted = typeof restrictedOption === "string" ? restrictedOption : restrictedOption?.field;
-	if (restrictedOption !== void 0) {
-		if (typeof restricted !== "string") throw new TypeError(`PermDock: resource "${name}" restricted must name a field`);
-		assertSafeKey(restricted, "restricted field");
-	}
-	const disclosure = init.options.disclosure ?? "reveal";
-	if (disclosure !== "hide" && disclosure !== "reveal") throw new Error(`PermDock: resource "${name}" disclosure must be 'hide' or 'reveal'`);
-	const relations = {};
-	for (const [relationName, spec] of Object.entries(init.options.relations ?? {})) {
-		assertSafeKey(relationName, "relation");
-		relations[relationName] = freezeDeep(normaliseRelation(name, relationName, spec));
-	}
-	const links = {};
-	for (const [linkName, link] of Object.entries(init.options.links ?? {})) {
-		assertSafeKey(linkName, "link");
-		if (linkName === "parent") throw new Error(`PermDock: link 'parent' on '${name}' is reserved; declare it as parent`);
-		assertSafeKey(link.field, "link field");
-		assertSafeKey(link.resource, "link resource");
-		links[linkName] = freezeDeep({
-			field: link.field,
-			resource: link.resource
-		});
-	}
-	const restrictedStopList = typeof restrictedOption === "object" ? restrictedStopsOf(name, restrictedOption, parent, links) : void 0;
-	const levels = {};
-	for (const [levelName, condition] of Object.entries(init.options.levels ?? {})) {
-		if (!LEVEL_NAME.test(levelName)) throw new Error(`PermDock: level '${levelName}' on '${name}' must match ^[a-z][a-z0-9_]*$`);
-		if (condition === null || typeof condition !== "object" || Array.isArray(condition)) throw new Error(`PermDock: level '${levelName}' on '${name}' must be a condition object`);
-		levels[levelName] = freezeDeep({ ...condition });
-	}
-	if (Object.keys(levels).length > 0 && instanceSet.size === 0) throw new Error(`PermDock: resource '${name}' declares levels but no instance actions`);
-	const resourceNode = Object.freeze({
-		name,
-		path: prefix,
-		schema: init.schema,
-		id: init.options.id ?? "id",
-		parent: parent === void 0 ? void 0 : freezeDeep({ ...parent }),
-		links: freezeDeep(links),
-		relations: freezeDeep(relations),
-		version,
-		restricted,
-		...restrictedStopList === void 0 ? {} : { restrictedStops: restrictedStopList },
-		disclosure,
-		instanceActions: instanceSet,
-		collectionActions: collectionSet,
-		levels: Object.freeze(levels)
-	});
-	assertIncludes(resourceNode);
-	registry.set(name, resourceNode);
-	Object.defineProperty(node, NODE_RESOURCE, {
-		value: resourceNode,
-		enumerable: false,
-		writable: false,
-		configurable: false
-	});
-	return freezeDeep(node);
-}
-/** The resource a `definePermissions` resource node was built from, read from the node itself. */
-function resourceOfNode(node) {
-	if (!Object.hasOwn(node, NODE_RESOURCE)) return;
-	const value = Reflect.get(node, NODE_RESOURCE);
-	return isResourceNode(value) ? value : void 0;
-}
-function isResourceNode(value) {
-	return value !== null && typeof value === "object" && "name" in value && "instanceActions" in value;
-}
-function walk(input, path, registry, leaves, depth, former) {
-	if (depth > 10) throw new Error(`PermDock: permission group nesting exceeds 10`);
-	if (isResourceInit(input)) return materialiseResource(input, path, registry, leaves, former);
-	if (input === null || typeof input !== "object" || Array.isArray(input)) throw new Error(`PermDock: definePermissions expected a group or resource at '${path.join(".")}'`);
-	const group = {};
-	for (const key of Object.keys(input)) {
-		assertSafeKey(key, "group");
-		group[key] = walk(input[key], [...path, key], registry, leaves, depth + 1, former);
-	}
-	return group;
-}
-function attachRegistry(tree, registry, leaves) {
-	const attached = tree;
-	Object.defineProperty(attached, TREE_REGISTRY, {
-		value: registry,
-		enumerable: false,
-		writable: false,
-		configurable: false
-	});
-	Object.defineProperty(attached, TREE_LEAVES, {
-		value: Object.freeze([...leaves]),
-		enumerable: false,
-		writable: false,
-		configurable: false
-	});
-	return attached;
-}
-function isRegistryTree(tree) {
-	return TREE_REGISTRY in tree;
-}
-function getRegistry(tree) {
-	if (!isRegistryTree(tree)) throw new Error("PermDock: permission tree is missing its registry");
-	return tree[TREE_REGISTRY];
-}
-function getResource(tree, name) {
-	if (isForbiddenKey(name)) return;
-	return getRegistry(tree).get(name);
-}
-const RENAMED_KEY = /^\S+$/u;
-/** Current key to its former keys, from the `renamed` option; targets are checked once leaves exist. */
-function formerByKey(renamed) {
-	const former = /* @__PURE__ */ new Map();
-	if (renamed === void 0) return former;
-	if (renamed === null || typeof renamed !== "object") throw new TypeError("PermDock: renamed must map old keys to current keys");
-	for (const [old, current] of Object.entries(renamed)) {
-		if (!RENAMED_KEY.test(old) || old.split(".").some(isForbiddenKey)) throw new Error(`PermDock: renamed key '${old}' is not a valid key`);
-		if (typeof current !== "string") throw new TypeError(`PermDock: renamed key '${old}' must map to a current key`);
-		former.set(current, [...former.get(current) ?? [], old]);
-	}
-	return former;
-}
-/**
-* Every current key is unique, every former key names exactly one leaf, and
-* no former key is also a current key, so a string resolves to one leaf.
-*/
-function assertKeys(leaves, former) {
-	const current = /* @__PURE__ */ new Set();
-	for (const leaf of leaves) {
-		if (current.has(leaf.key))
- /* v8 ignore next */
-		throw new Error(`PermDock: duplicate permission key '${leaf.key}'`);
-		current.add(leaf.key);
-	}
-	for (const target of former?.keys() ?? []) if (!current.has(target)) throw new Error(`PermDock: renamed target '${target}' is not a permission key`);
-	const olds = /* @__PURE__ */ new Map();
-	for (const leaf of leaves) for (const old of formerKeys(leaf)) {
-		if (current.has(old)) throw new Error(`PermDock: renamed key '${old}' is still a permission key`);
-		const other = olds.get(old);
-		if (other !== void 0 && other !== leaf.key) throw new Error(`PermDock: renamed key '${old}' maps to both '${other}' and '${leaf.key}'`);
-		olds.set(old, leaf.key);
-	}
-}
-function definePermissions(input, options) {
-	const registry = /* @__PURE__ */ new Map();
-	const leaves = [];
-	const former = formerByKey(options?.renamed);
-	const tree = walk(input, [], registry, leaves, 0, former);
-	assertKeys(leaves, former);
-	assertGraphTargets(registry);
-	return freezeDeep(attachRegistry(tree, registry, leaves));
-}
-function collectLeaves(node) {
-	if ("key" in node && "scope" in node && "action" in node) return [node];
-	const out = [];
-	for (const key of ownKeys(node)) {
-		const child = node[key];
-		if (child !== void 0) out.push(...collectLeaves(child));
-	}
-	return out;
-}
-function listPermissions(tree) {
-	if (isRegistryTree(tree)) return tree[TREE_LEAVES];
-	return collectLeaves(tree);
-}
-function findPermission(tree, keyOrScope) {
-	if (isForbiddenKey(keyOrScope)) return;
-	const leaves = listPermissions(tree);
-	for (const leaf of leaves) if (leaf.key === keyOrScope || leaf.scope === keyOrScope) return leaf;
-	for (const leaf of leaves) if (formerKeys(leaf).includes(keyOrScope) || formerScopes(leaf).includes(keyOrScope)) return leaf;
-}
-/**
-* A permission leaf: string `key`, `scope`, `resource` and `action` plus an
-* object `meta`. `kind` is non-enumerable and does not survive
-* `JSON.stringify`, so a leaf that crossed a serialisation boundary passes
-* without it; when present it must be `instance` or `collection`.
-*/
-function isPermission(value) {
-	if (value === null || typeof value !== "object" || Array.isArray(value)) return false;
-	for (const field of [
-		"key",
-		"scope",
-		"resource",
-		"action"
-	]) if (!Object.hasOwn(value, field) || typeof Reflect.get(value, field) !== "string") return false;
-	const meta = Object.hasOwn(value, "meta") ? Reflect.get(value, "meta") : void 0;
-	if (meta === null || typeof meta !== "object" || Array.isArray(meta)) return false;
-	if (!Object.hasOwn(value, "kind")) return true;
-	const kind = Reflect.get(value, "kind");
-	return kind === "instance" || kind === "collection";
-}
-function mergeNodes(target, source, keys, registry, sourceRegistry) {
-	for (const key of ownKeys(source)) {
-		assertSafeKey(key, "group");
-		const incoming = source[key];
-		if (incoming === void 0)
- /* v8 ignore next */
-		continue;
-		const existing = target[key];
-		if (existing === void 0) {
-			target[key] = incoming;
-			if (isPermission(incoming)) {
-				if (keys.has(incoming.key))
- /* v8 ignore next */
-				throw new Error(`PermDock: duplicate permission key '${incoming.key}'`);
-				keys.add(incoming.key);
-			}
-			continue;
-		}
-		if (isPermission(existing) || isPermission(incoming)) {
-			const keyName = isPermission(incoming) ? incoming.key : isPermission(existing) ? existing.key : key;
-			throw new Error(`PermDock: duplicate permission key '${keyName}'`);
-		}
-		const nested = { ...existing };
-		mergeNodes(nested, incoming, keys, registry, sourceRegistry);
-		target[key] = freezeDeep(nested);
-	}
-	if (sourceRegistry !== void 0) for (const [name, node] of sourceRegistry) {
-		if (registry.has(name) && registry.get(name) !== node) throw new Error(`PermDock: duplicate resource name '${name}'`);
-		registry.set(name, node);
-	}
-}
-function mergePermissions(...trees) {
-	if (trees.length === 0) throw new Error("PermDock: mergePermissions() requires at least one tree");
-	const merged = {};
-	const keys = /* @__PURE__ */ new Set();
-	const registry = /* @__PURE__ */ new Map();
-	for (const tree of trees) mergeNodes(merged, tree, keys, registry, isRegistryTree(tree) ? tree[TREE_REGISTRY] : void 0);
-	assertGraphTargets(registry);
-	const leaves = collectLeaves(merged);
-	assertKeys(leaves);
-	return freezeDeep(attachRegistry(merged, registry, leaves));
-}
-//#endregion
-export { restrictedStops as C, ownKeys as D, ownGet as E, readPath as O, restrictedFor as S, isForbiddenKey as T, listPermissions as _, formerKeys as a, resource as b, getResource as c, isEdgeRelation as d, isFieldRelation as f, isSelfParented as g, isRegistryTree as h, findPermission as i, splitPath as k, groupEntries as l, isPrincipalRelation as m, definePermissions as n, formerScopes as o, isPermission as p, expandRelation as r, getRegistry as s, annotationsFor as t, isComputedRelation as u, mergePermissions as v, assertSafeKey as w, resourceOfNode as x, renamedKeys as y };