permdock 0.3.1 → 0.5.0

package/dist/files-C5ZI27eV.js

@@ -0,0 +1,124 @@
+import { n as CliError } from "./errors-CWTY6uih.js";
+import { existsSync, mkdirSync, readFileSync, realpathSync, renameSync, rmSync, writeFileSync } from "node:fs";
+import { dirname, relative, resolve } from "node:path";
+import { execFileSync } from "node:child_process";
+//#region src/cli/core/files.ts
+function outcomeOf(abs, text) {
+	if (!existsSync(abs)) return "created";
+	return readFileSync(abs, "utf8") === text ? "unchanged" : "updated";
+}
+/** What writing `files` would do, without writing. */
+function planFiles(cwd, files) {
+	return files.map((file) => ({
+		path: file.path,
+		outcome: outcomeOf(resolve(cwd, file.path), file.text)
+	}));
+}
+/**
+* Writes every created or updated file, all or nothing: each one is staged
+* beside its target first, and a failed stage removes the others before
+* anything is replaced. `dryRun` only plans.
+*/
+function applyFiles(cwd, files, options = {}) {
+	const planned = planFiles(cwd, files);
+	if (options.dryRun === true) return planned;
+	const staged = [];
+	try {
+		for (const [index, file] of files.entries()) {
+			if (planned[index]?.outcome === "unchanged") continue;
+			const target = resolve(cwd, file.path);
+			const temp = `${target}.permdock-${String(process.pid)}.tmp`;
+			mkdirSync(dirname(target), { recursive: true });
+			writeFileSync(temp, file.text);
+			staged.push({
+				temp,
+				target
+			});
+		}
+	} catch (error) {
+		for (const { temp } of staged) rmSync(temp, { force: true });
+		throw new CliError("failed", `could not write ${describe(error)}; wrote nothing`, {
+			code: "write_failed",
+			cause: error
+		});
+	}
+	for (const { temp, target } of staged) renameSync(temp, target);
+	return planned;
+}
+function describe(error) {
+	return error instanceof Error ? error.message : String(error);
+}
+const VERBS = {
+	created: ["Created", "Would create"],
+	updated: ["Updated", "Would update"],
+	unchanged: ["Unchanged", "Unchanged"]
+};
+/** One line per file: `Created x`, or `Would create x` under `--dry-run`. */
+function fileSummary(applied, dryRun) {
+	return applied.map((file) => `${VERBS[file.outcome][dryRun ? 1 : 0]} ${file.path}`).join("\n");
+}
+/**
+* The files among `paths` with uncommitted changes in git. Outside a git
+* work tree, or without git, nothing counts as dirty.
+*/
+function dirtyFiles(cwd, paths) {
+	if (paths.length === 0) return [];
+	let status;
+	try {
+		status = execFileSync("git", [
+			"status",
+			"--porcelain",
+			"-z",
+			"--",
+			...paths.map((path) => resolve(cwd, path))
+		], {
+			cwd,
+			encoding: "utf8",
+			stdio: [
+				"ignore",
+				"pipe",
+				"ignore"
+			]
+		});
+	} catch {
+		return [];
+	}
+	let root;
+	try {
+		root = execFileSync("git", ["rev-parse", "--show-toplevel"], {
+			cwd,
+			encoding: "utf8",
+			stdio: [
+				"ignore",
+				"pipe",
+				"ignore"
+			]
+		}).trim();
+	} catch {
+		return [];
+	}
+	return status.split("\0").filter((entry) => entry.length > 3).map((entry) => relative(realpathSync(cwd), resolve(root, entry.slice(3))));
+}
+/**
+* A rewrite of hand-written files stops when one of them has uncommitted
+* changes, so `git diff` shows only what the command changed. `--force`
+* rewrites anyway.
+*/
+function refuseDirty(input) {
+	if (input.force) return;
+	const dirty = dirtyFiles(input.cwd, input.paths);
+	if (dirty.length === 0) return;
+	throw new CliError("action", `${input.command} rewrites files with uncommitted changes: ${dirty.join(", ")}. Commit or stash them first, so git diff shows only the rewrite.`, {
+		code: "dirty_worktree",
+		extensions: { files: dirty },
+		next: [{
+			when: "to see the changes first",
+			command: `permdock ${input.invocation} --dry-run`
+		}, {
+			when: "to rewrite anyway",
+			command: `permdock ${input.invocation} --force`
+		}]
+	});
+}
+//#endregion
+export { fileSummary as n, refuseDirty as r, applyFiles as t };

package/dist/{files-DWUN9PzI.js → files-D_JIzUrP.js}

@@ -1,5 +1,5 @@
-import { existsSync, globSync, readdirSync, realpathSync, statSync } from "node:fs";
-import { basename, extname, join, relative, resolve } from "node:path";
+import { existsSync, globSync, mkdirSync, readFileSync, readdirSync, realpathSync, statSync, writeFileSync } from "node:fs";
+import { basename, dirname, extname, join, relative, resolve } from "node:path";
 //#region src/cli/files.ts
 const SOURCE_EXT = /* @__PURE__ */ new Set([
 	".ts",
@@ -121,5 +121,14 @@ function defaultSrcPath() {
 function doctorSrcPath(config) {
 	return config.doctor?.srcPath ?? config.collect?.srcPath ?? defaultSrcPath();
 }
+/** The parsed JSON at `path`; throws when it is unreadable or not JSON. */
+function readJsonFile(path) {
+	return JSON.parse(readFileSync(path, "utf8"));
+}
+/** Writes `text` to `path`, creating its directory first. */
+function writeFileEnsuringDir(path, text) {
+	mkdirSync(dirname(path), { recursive: true });
+	writeFileSync(path, text);
+}
 //#endregion
-export { sqlFiles as a, rel as i, doctorSrcPath as n, listSourceFiles as r, defaultSrcPath as t };
+export { rel as a, readJsonFile as i, doctorSrcPath as n, sqlFiles as o, listSourceFiles as r, writeFileEnsuringDir as s, defaultSrcPath as t };

package/dist/{fixtures-ht28Cplr.js → fixtures-B7XrLeY7.js}

@@ -1,23 +1,23 @@
-import { a as loadModule, o as pickNamed } from "./load-DhWEB9P1.js";
-import { existsSync, readFileSync } from "node:fs";
+import { r as isRecord } from "./compact-CAf557ZB.js";
+import { i as configError } from "./errors-CWTY6uih.js";
+import { i as readJsonFile } from "./files-D_JIzUrP.js";
+import { a as loadModule, s as pickNamed } from "./load-DFS_ry0W.js";
+import { existsSync } from "node:fs";
 import { resolve } from "node:path";
 //#region src/cli/fixtures.ts
-function isRecord(value) {
-	return value !== null && typeof value === "object" && !Array.isArray(value);
-}
 function asFixtures(value) {
 	const list = Array.isArray(value) ? value : isRecord(value) && Array.isArray(value["fixtures"]) ? value["fixtures"] : void 0;
-	if (list === void 0) throw new Error("PermDock CLI: fixtures must be an array or { fixtures }");
+	if (list === void 0) throw configError("PermDock CLI: fixtures must be an array or { fixtures }");
 	return list.map((item, index) => {
-		if (!isRecord(item) || !isRecord(item["subject"]) || item["row"] === void 0) throw new Error(`PermDock CLI: fixture ${index} needs subject and row`);
+		if (!isRecord(item) || !isRecord(item["subject"]) || item["row"] === void 0) throw configError(`PermDock CLI: fixture ${index} needs subject and row`);
 		if (typeof item["action"] !== "string") throw new TypeError(`PermDock CLI: fixture ${index} needs action`);
 		if (typeof item["subject"]["id"] !== "string") throw new TypeError(`PermDock CLI: fixture ${index} subject needs id`);
 		const memberships = item["subject"]["memberships"];
-		if (memberships !== void 0 && !Array.isArray(memberships)) throw new Error(`PermDock CLI: fixture ${index} subject.memberships must be an array`);
+		if (memberships !== void 0 && !Array.isArray(memberships)) throw configError(`PermDock CLI: fixture ${index} subject.memberships must be an array`);
 		const tenant = item["subject"]["tenant"];
-		if (tenant !== void 0 && typeof tenant !== "string") throw new Error(`PermDock CLI: fixture ${index} subject.tenant must be a string`);
+		if (tenant !== void 0 && typeof tenant !== "string") throw configError(`PermDock CLI: fixture ${index} subject.tenant must be a string`);
 		const claims = item["subject"]["claims"];
-		if (claims !== void 0 && !isRecord(claims)) throw new Error(`PermDock CLI: fixture ${index} subject.claims must be an object`);
+		if (claims !== void 0 && !isRecord(claims)) throw configError(`PermDock CLI: fixture ${index} subject.claims must be an object`);
 		return item;
 	});
 }
@@ -29,9 +29,9 @@ function asCustomRoles(value) {
 /** A `.json` file or a module exporting `fixtures` (or default) and optionally `customRoles`. */
 async function loadFixtures(cwd, path) {
 	const abs = resolve(cwd, path);
-	if (!existsSync(abs)) throw new Error(`PermDock CLI: fixtures not found: ${path}`);
+	if (!existsSync(abs)) throw configError(`PermDock CLI: fixtures not found: ${path}`);
 	if (abs.endsWith(".json")) {
-		const parsed = JSON.parse(readFileSync(abs, "utf8"));
+		const parsed = readJsonFile(abs);
 		return {
 			fixtures: asFixtures(parsed),
 			customRoles: asCustomRoles(parsed)

package/dist/flags-C3DktBDY.js

@@ -0,0 +1,86 @@
+import { n as CliError } from "./errors-CWTY6uih.js";
+import { n as secretInput } from "./credentials-DPyHmYz5.js";
+//#region src/cli/core/flags.ts
+/** The flag vocabulary shared with better-supabase: one spelling per meaning. */
+const dbUrlFlags = { "db-url-stdin": {
+	type: "boolean",
+	description: "Read the Postgres connection string from stdin (default $DATABASE_URL, then $SUPABASE_DB_URL)"
+} };
+const outFlag = { out: {
+	type: "string",
+	description: "File to write",
+	valueHint: "file"
+} };
+const checkFlag = { check: {
+	type: "boolean",
+	description: "Exit 1 when a file on disk is stale; write nothing"
+} };
+const dryRunFlag = { "dry-run": {
+	type: "boolean",
+	description: "Print what would change; write nothing"
+} };
+const forceFlag = { force: {
+	type: "boolean",
+	description: "Overwrite files PermDock did not write or that changed by hand"
+} };
+const policyFlag = { policy: {
+	type: "string",
+	description: "Module exporting the policy (default policy in the config)",
+	valueHint: "module"
+} };
+const permissionsFlag = { permissions: {
+	type: "string",
+	description: "Module exporting the permissions (default permissions in the config)",
+	valueHint: "module"
+} };
+const failOnFlag = { "fail-on": {
+	type: "enum",
+	options: ["error", "warning"],
+	default: "error",
+	description: "Lowest finding severity that exits 1"
+} };
+const validatorFlag = { validator: {
+	type: "enum",
+	options: [
+		"zod",
+		"valibot",
+		"arktype"
+	],
+	description: "Schema library for the generated resources (default zod)"
+} };
+/**
+* The connection string from `--db-url-stdin`, or, when the leaf needs one,
+* `DATABASE_URL` then `SUPABASE_DB_URL`: the order better-supabase reads them.
+*/
+async function dbUrl(ctx, flags, options) {
+	const piped = await secretInput(ctx, {
+		flag: "db-url",
+		stdin: flags["db-url-stdin"]
+	});
+	if (piped !== void 0 || options?.required !== true) return piped;
+	for (const name of DB_URL_ENV) {
+		const value = ctx.env[name];
+		if (value !== void 0 && value !== "") {
+			ctx.addSecret(value);
+			return value;
+		}
+	}
+}
+const DB_URL_ENV = ["DATABASE_URL", "SUPABASE_DB_URL"];
+/** A string flag given with a value; a bare flag reads as `""`. */
+function given(value) {
+	return value === void 0 || value === "" ? void 0 : value;
+}
+/**
+* `--out` for a command that only writes a file: `-` is refused instead of
+* creating a file named `-`.
+*/
+function fileOut(command, value) {
+	if (value === "-") throw new CliError("usage", `${command}: --out - is not supported; name a file.`, {
+		code: "invalid_value",
+		extensions: { flag: "--out" }
+	});
+	return given(value);
+}
+//#endregion
+export { failOnFlag as a, given as c, policyFlag as d, validatorFlag as f, dryRunFlag as i, outFlag as l, dbUrl as n, fileOut as o, dbUrlFlags as r, forceFlag as s, checkFlag as t, permissionsFlag as u };

package/dist/{from-snapshot-CTLijvdm.js → from-snapshot-D2lZt4Dd.js}

@@ -1,17 +1,20 @@
-import { t as compact } from "./compact-y6vfu2_f.js";
+import { t as compact } from "./compact-CAf557ZB.js";
 import { n as freezeDeep } from "./freeze-CrU8nQeX.js";
-import { _ as listPermissions } from "./permissions-DVoF6dMt.js";
-import { a as deniedMessage, i as approvalMessage, n as PermDockDeniedError, t as PermDockApprovalRequiredError } from "./errors-Cz5zn0mW.js";
-import { n as sameId } from "./ids-DC4V4CFu.js";
-import { a as normalizeMemberships, d as scopeList, m as tenantOf, o as resolveScope, t as activeFor } from "./scopes-CVdPrWN-.js";
-import { a as whereFromGrants, c as rowIdOf, d as isArazzoSimulateInput, f as simulateArazzo, i as signSnapshot, l as rowValues, p as evaluateCondition } from "./snapshot-Enxd0n-s.js";
-import { D as synthesiseRole, E as listRoles, S as findRole, d as matchGrantee } from "./grantee-Cv5Sogfv.js";
-import { n as pickVisible, t as grantCoversField } from "./fields-BMl1RxoX.js";
-import { a as isMembershipExpired, i as inTeam, l as nestedAppliesWithoutRow, m as rowInScope, p as resolveActiveTenant, t as isActive, u as nowSeconds } from "./validity-uOp8UpYn.js";
+import { a as deniedMessage, i as approvalMessage, n as PermDockDeniedError, t as PermDockApprovalRequiredError } from "./errors-BKy0EfhN.js";
+import { o as sameId } from "./expiry-D4_YKRKD.js";
+import { c as listPermissions } from "./permission-registry-Br4jSNVi.js";
+import { g as secondsOf, o as epochSeconds, t as INVALID_NOW } from "./time-DkWjdL98.js";
+import { a as normalizeMemberships, d as scopeList, m as tenantOf, o as resolveScope, t as activeFor } from "./scopes-CUPSjo9q.js";
+import { a as readOnlyActorRefuses, c as rowIdOf, l as rowValues, n as coveredByDelegation, u as evaluateCondition } from "./delegation-DaXVdDhM.js";
+import { b as synthesiseRole, m as findRole, v as listRoles } from "./grantee-Cn1HyUsI.js";
+import { a as grantCoversField, o as pickVisible, r as readWireValidity, t as isActive } from "./validity-CZ7-y0Cj.js";
+import { c as nowSeconds, d as resolveActiveTenant, f as rowInScope, n as inTeam, r as isMembershipExpired, s as nestedAppliesWithoutRow } from "./tenancy-DN2QAx9z.js";
 import { t as requiresApproval } from "./approval-required-TzNB9oQA.js";
-import { t as coveredByDelegation } from "./delegation-D8pUEuce.js";
+import { r as tokenPayload, t as decisionToken } from "./token-BLZcjQgt.js";
+import { t as fromWireDelegation } from "./wire-delegation-Cv3W2eaM.js";
+import { n as matchGrantee } from "./grantee-match-DHArqY82.js";
 import { t as resourceIdOf } from "./resource-ref-CaS9yVPi.js";
-import { n as payloadDigest, t as decisionToken } from "./token-CIWxJOCh.js";
+import { a as deniedFor, n as mayUse, o as signSnapshot, r as permittedIds, t as whereFromGrants } from "./where-scope-Dv-WTP-w.js";
 //#region src/core/snapshot-evaluate.ts
 function coveredByInclude(snapshot, permission) {
 	const include = snapshot.include;
@@ -81,6 +84,8 @@ function conditionOk(grant, permission, current, next, subject, now, scopes) {
 		matched: false,
 		reason: "opaque-condition"
 	};
+	const deny = grant.effect === "deny";
+	let whereMatched;
 	if (grant.where !== void 0) {
 		if (permission.kind === "collection" || current === void 0) return {
 			matched: false,
@@ -90,17 +95,22 @@ function conditionOk(grant, permission, current, next, subject, now, scopes) {
 			matched: false,
 			reason: "opaque-condition"
 		};
-		const matched = evaluateCondition(grant.where, current, subject, now, scopes, void 0, onOpaque);
+		whereMatched = evaluateCondition(grant.where, current, subject, now, scopes, void 0, onOpaque);
 		if (opaqueReached) return {
 			matched: false,
 			reason: "opaque-condition"
 		};
-		if (!matched) return {
+		if (whereMatched && deny) return { matched: true };
+		if (!whereMatched && !deny) return {
 			matched: false,
 			reason: "condition"
 		};
 	}
-	const check = grant.check;
+	const check = grant.check ?? (permission.action === "update" ? grant.where : void 0);
+	if (check === void 0 && whereMatched === false) return {
+		matched: false,
+		reason: "condition"
+	};
 	if (check !== void 0) {
 		if (check.op === "opaque") return {
 			matched: false,
@@ -126,6 +136,8 @@ function matchedOf(grant) {
 	return compact({
 		role: grant.role,
 		permission: grant.permission,
+		name: grant.name,
+		meta: grant.meta,
 		to: grant.to,
 		where: grant.where,
 		check: grant.check,
@@ -133,7 +145,7 @@ function matchedOf(grant) {
 	});
 }
 function evaluateSnapshot(snapshot, subject, permission, data, team, options, outcomeOnly = false) {
-	let clock = options.now;
+	let clock = options.now === void 0 ? void 0 : epochSeconds(options.now);
 	const now = () => clock ??= nowSeconds();
 	const tracer = options.explain === true ? {
 		evaluated: 0,
@@ -141,15 +153,22 @@ function evaluateSnapshot(snapshot, subject, permission, data, team, options, ou
 		denies: [],
 		skipped: []
 	} : void 0;
-	const done = (decision) => outcomeOnly ? decision : freezeDeep(tracer === void 0 ? decision : {
-		...decision,
-		trace: {
-			evaluated: tracer.evaluated,
-			allows: tracer.allows,
-			denies: tracer.denies,
-			skipped: tracer.skipped
-		}
-	});
+	const done = (raw) => {
+		if (outcomeOnly) return raw;
+		const decision = raw.outcome === "denied" ? {
+			...raw,
+			permission: permission.key
+		} : raw;
+		return freezeDeep(tracer === void 0 ? decision : {
+			...decision,
+			trace: {
+				evaluated: tracer.evaluated,
+				allows: tracer.allows,
+				denies: tracer.denies,
+				skipped: tracer.skipped
+			}
+		});
+	};
 	const skip = (grant, why) => {
 		tracer?.skipped.push({
 			role: grant.role,
@@ -166,6 +185,15 @@ function evaluateSnapshot(snapshot, subject, permission, data, team, options, ou
 		}],
 		alternatives: []
 	});
+	if (clock !== void 0 && !Number.isFinite(clock)) return done({
+		outcome: "denied",
+		denials: [{
+			role: null,
+			reason: "validation",
+			detail: INVALID_NOW
+		}],
+		alternatives: []
+	});
 	const { current, next } = rowValues(permission, data);
 	const scopes = scopeList(snapshot.scopes);
 	const denials = [];
@@ -183,7 +211,7 @@ function evaluateSnapshot(snapshot, subject, permission, data, team, options, ou
 			continue;
 		}
 		let scoped = scopeOk(snapshot, grant, permission, subject, permission.kind === "instance" ? current : next, team, now(), options.scope);
-		if (scoped.ok && permission.kind === "instance" && next !== current) scoped = scopeOk(snapshot, grant, permission, subject, next, team, now(), options.scope);
+		if (scoped.ok !== (grant.effect === "deny") && permission.kind === "instance" && next !== current) scoped = scopeOk(snapshot, grant, permission, subject, next, team, now(), options.scope);
 		if (!scoped.ok) {
 			denials.push(compact({
 				role: grant.role,
@@ -192,7 +220,7 @@ function evaluateSnapshot(snapshot, subject, permission, data, team, options, ou
 			}));
 			continue;
 		}
-		if (!isActive(grant.validity, now())) {
+		if (!isActive(readWireValidity(grant.validity, grant.effect), now())) {
 			if (grant.effect === "allow") denials.push({
 				role: grant.role,
 				reason: "inactive-grant",
@@ -269,7 +297,7 @@ function evaluateSnapshot(snapshot, subject, permission, data, team, options, ou
 			alternatives: []
 		});
 	}
-	if (snapshot.delegated !== void 0 && !snapshot.delegated.includes(permission.key)) return done({
+	if (snapshot.delegated !== void 0 && !snapshot.delegated.includes(permission.key) || readOnlyActorRefuses(subject.actor, permission)) return done({
 		outcome: "denied",
 		denials: [{
 			role: null,
@@ -292,8 +320,8 @@ function evaluateSnapshot(snapshot, subject, permission, data, team, options, ou
 		resourceId,
 		principal: subject.principal,
 		actor: subject.actor,
-		fingerprint: `snapshot:${String(snapshot.issuedAt)}`,
-		payload: resourceId === "*" && (next ?? current) !== void 0 ? payloadDigest(next ?? current) : void 0
+		fingerprint: `snapshot:${snapshot.issuedAt}`,
+		payload: tokenPayload(resourceId, next ?? current, options.args)
 	});
 	const grant = matchedOf(matched);
 	if (requiresApproval(matched.approval)) return done({
@@ -302,12 +330,13 @@ function evaluateSnapshot(snapshot, subject, permission, data, team, options, ou
 		reason: "human",
 		token
 	});
-	return done({
+	return done(compact({
 		outcome: "granted",
 		subject,
 		matched: grant,
-		token
-	});
+		token,
+		obligations: matched.obligations
+	}));
 }
 function whereFromSnapshot(snapshot, subject, permission, team) {
 	return whereFromGrants(snapshot.grants.filter((grant) => grant.permission === permission.key), {
@@ -334,9 +363,9 @@ function subjectFromSnapshot(snapshot, tenant) {
 			...principal,
 			tenant: nextTenant
 		}),
-		delegation: snapshot.subject.delegation,
+		delegation: fromWireDelegation(snapshot.subject.delegation),
 		context: snapshot.subject.context,
-		expiresAt: snapshot.expiresAt
+		expiresAt: secondsOf(snapshot.expiresAt)
 	}));
 }
 /**
@@ -405,12 +434,18 @@ function fromSnapshot(snapshot, options = {}) {
 	});
 	const explain = ((permission, data, decideOptions) => run(permission, data, {
 		...decideOptions,
-		source: decideOptions?.source ?? "explain",
+		call: decideOptions?.call ?? "explain",
 		explain: true
 	}));
 	const instance = {
 		can,
 		decide,
+		decideEach(permission, rows, decideOptions) {
+			return Object.freeze(rows.map((row) => run(permission, row, decideOptions)));
+		},
+		decideFor(_principalId, permission) {
+			return Promise.resolve(deniedFor(permission, "unsupported"));
+		},
 		assert,
 		explain,
 		permissions: {},
@@ -438,7 +473,6 @@ function fromSnapshot(snapshot, options = {}) {
 		},
 		simulate: ((input, simulateOptions) => {
 			if (Array.isArray(input)) return input.map(([permission, data]) => run(permission, data, compact({ now: simulateOptions?.now })));
-			if (isArazzoSimulateInput(input)) return simulateArazzo(input, input.permissions, (permission, data) => run(permission, data));
 			const preview = input;
 			const previewRoles = preview.roles?.map((item) => typeof item === "string" ? item : item.key);
 			return fromSnapshot(freezeDeep({
@@ -455,7 +489,7 @@ function fromSnapshot(snapshot, options = {}) {
 				}
 			}), options);
 		}),
-		snapshot: ((signing) => signing?.signer === void 0 ? snapshot : signSnapshot(snapshot, signing.signer, signing.audience)),
+		snapshot: ((signing) => signing?.signer === void 0 ? snapshot : signSnapshot(snapshot, signing.signer, compact({ audience: signing.audience }))),
 		on() {
 			return () => void 0;
 		},
@@ -497,38 +531,17 @@ function fromSnapshot(snapshot, options = {}) {
 			}
 			return out;
 		},
-		loadRelations() {
+		prefetchRelations() {
 			return Promise.resolve();
 		},
-		whoCan(permission) {
-			return Promise.resolve(freezeDeep({
-				permission: permission.key,
-				holders: [],
-				complete: false
-			}));
+		mayUse(permission) {
+			return mayUse(instance, permission);
 		},
-		decideRoleChange(change) {
-			return freezeDeep({
-				outcome: "denied",
-				change,
-				denials: [{
-					role: null,
-					reason: "unsupported"
-				}]
-			});
+		permittedIds(permission, scope, query) {
+			return permittedIds(instance, permission, scope, query);
 		},
 		derive() {
-			return instance;
-		},
-		activate() {
-			return freezeDeep({
-				outcome: "denied",
-				denials: [{
-					role: null,
-					reason: "unsupported"
-				}],
-				alternatives: []
-			});
+			return Promise.resolve(instance);
 		},
 		assignableRoles(query) {
 			if (query?.scope === "global") return [];
@@ -556,7 +569,7 @@ function fromSnapshot(snapshot, options = {}) {
 function emptySnapshot() {
 	return freezeDeep({
 		v: 1,
-		issuedAt: 0,
+		issuedAt: "1970-01-01T00:00:00.000Z",
 		subject: {
 			principal: null,
 			context: {}

package/dist/{generate-CH7ThJ14.js → generate-CNU1pIOo.js}

@@ -1,3 +1,4 @@
+import { r as isRecord } from "./compact-CAf557ZB.js";
 import { t as byCodePoint } from "./compare-pfyVnBjE.js";
 //#region src/cli/generate.ts
 const IDENTIFIER = /^[A-Za-z_$][A-Za-z0-9_$]*$/u;
@@ -19,9 +20,6 @@ function emptySchema(kind) {
 function propertyKey(name) {
 	return IDENTIFIER.test(name) ? name : JSON.stringify(name);
 }
-function isRecord(value) {
-	return value !== null && typeof value === "object" && !Array.isArray(value);
-}
 function literalEnum(schema) {
 	const values = schema["enum"];
 	if (!Array.isArray(values) || values.length === 0 || !values.every((value) => typeof value === "string")) return;