permdock 0.3.1 → 0.5.0

package/dist/permdock-B9JxkBwC.js

@@ -0,0 +1,868 @@
+import { n as isReadonlyArray, t as compact } from "./compact-CAf557ZB.js";
+import { n as freezeDeep, t as freezeCopy } from "./freeze-CrU8nQeX.js";
+import { n as PermDockValidationError } from "./validation-error-ZfUHbKvf.js";
+import { a as deniedMessage, i as approvalMessage, n as PermDockDeniedError, t as PermDockApprovalRequiredError } from "./errors-BKy0EfhN.js";
+import { t as attachInternals } from "./internals-Dk8A8fX3.js";
+import { a as getResource, c as listPermissions, g as formerScopes } from "./permission-registry-Br4jSNVi.js";
+import { n as isThenable } from "./thenable-yD7SabqG.js";
+import { i as readAppData } from "./app-data-MuyzVqX8.js";
+import { a as normalizeMemberships, d as scopeList, m as tenantOf } from "./scopes-CUPSjo9q.js";
+import { o as pickVisible, s as sanitizeContext } from "./validity-CZ7-y0Cj.js";
+import { c as nowSeconds, d as resolveActiveTenant, m as tenantsOf, p as scopeField, t as heldRoleNamesIn, u as relatesTo } from "./tenancy-DN2QAx9z.js";
+import { l as policyX } from "./policy-DLZJ5gAp.js";
+import { A as isContact, C as emptyListeners, S as emitSafe, i as customRolesFor, k as contactMemberships, o as roleSourceFor, r as assignableNamesFor, s as sourceName, t as evaluate, u as customGrantsFor, w as finish } from "./evaluate-_R8QkWaf.js";
+import { a as whereGrant, c as applyRoleKinds, i as collectSnapshotGrants, l as audiencesOf, o as heldRoleNames, p as asMembershipSource, r as assignableIn, s as roleLeaf, t as snapshotOf } from "./instance-snapshot-Cxq4ygFc.js";
+import { r as relationReader, t as pendingRelations } from "./relations-BnCWnJGI.js";
+import { r as snapshotGrant } from "./snapshot-CXUWfsNy.js";
+import { i as decideForTarget, n as mayUse, o as signSnapshot, r as permittedIds, t as whereFromGrants } from "./where-scope-Dv-WTP-w.js";
+import { r as isSubject, t as anonymousSubject } from "./subject-BGoM5o8B.js";
+//#region src/core/app.ts
+const APP = Symbol.for("permdock.app");
+/** The app definition bound to `policy` by `defineApp`, or `undefined` for a plain policy. */
+function appOf(policy) {
+	const value = Reflect.get(policy, APP);
+	return value === void 0 ? void 0 : value;
+}
+/**
+* `options` with the app's values under it, key by key, for an adapter
+* factory to call first: `options = withApp(policy, options)`.
+*/
+function withApp(policy, options) {
+	const app = appOf(policy);
+	if (app === void 0) return options;
+	const { profile: _profile, ...values } = app;
+	const merged = { ...values };
+	for (const [key, value] of Object.entries(options)) if (value !== void 0) merged[key] = value;
+	return merged;
+}
+//#endregion
+//#region src/core/assert-decision.ts
+/** `assert`'s outcome: the granted decision, or the error a refusal throws after `onDenied` runs. */
+function assertDecision(policy, subject, permission, data, decision, onDenied) {
+	if (decision.outcome === "granted") return decision;
+	if (onDenied !== void 0) onDenied(decision);
+	const resource = getResource(policy.permissions, permission.resource);
+	const resourceId = data !== null && typeof data === "object" ? data[resource?.id ?? "id"] : void 0;
+	const resourceRef = compact({
+		type: permission.resource,
+		id: resourceId === void 0 ? void 0 : String(resourceId)
+	});
+	if (decision.outcome === "approval-required") throw new PermDockApprovalRequiredError({
+		decision,
+		permission: permission.key,
+		scope: permission.scope,
+		resource: resourceRef,
+		message: approvalMessage(permission.key, decision.reason, decision.token)
+	});
+	if (decision.denials.some((denial) => denial.reason === "validation")) {
+		const detail = decision.denials[0]?.detail;
+		if (detail instanceof PermDockValidationError) throw detail;
+	}
+	throw new PermDockDeniedError({
+		decision,
+		permission: permission.key,
+		scope: permission.scope,
+		resource: resourceRef,
+		subject,
+		message: deniedMessage(permission.key, subject.principal?.id, decision.denials, decision.alternatives.map((leaf) => leaf.key)),
+		...data === void 0 || resource === void 0 ? {} : { disclosure: resource.disclosure }
+	});
+}
+//#endregion
+//#region src/core/instance-env.ts
+/** The environment `derive(options)` builds on: `base` with the sources `options` replaces loaded again. */
+function deriveEnv(policy, subject, base, relationCache, options) {
+	const scopes = scopeList(policy.scopes);
+	const tenants = tenantsOf(subject.principal, scopes);
+	const auth = [];
+	const named = options.customRoles === void 0 ? void 0 : roleSourceFor(options.customRoles, subject, auth);
+	const roleSource = options.customRoles === void 0 ? base.roleSource : named;
+	const roles = options.customRoles === void 0 ? base.customRoles : customRolesFor(named, tenants, auth, subject.principal === null ? void 0 : subject.principal.roles ?? [], (tenant) => heldRoleNamesIn(subject.principal, scopes, tenant));
+	const names = options.customRoles === void 0 ? base.assignable : assignableNamesFor(named, tenants, auth);
+	const approvals = options.approvalPolicies === void 0 ? base.approvalPolicies : options.approvalPolicies.load(policy, tenants, auth);
+	const envWith = (loadedRoles, loadedNames, loadedApprovals) => compact({
+		...base,
+		customRoles: loadedRoles,
+		roleSource,
+		assignable: loadedNames,
+		approvalPolicies: loadedApprovals,
+		relations: options.relations ?? base.relations,
+		principals: options.principals ?? base.principals,
+		relationCache: options.relations === void 0 ? relationCache : void 0,
+		queuedAuth: auth,
+		queuedErrors: []
+	});
+	if (isThenable(roles) || isThenable(names) || isThenable(approvals)) return Promise.all([
+		roles,
+		names,
+		approvals
+	]).then(([loadedRoles, loadedNames, loadedApprovals]) => envWith(loadedRoles, loadedNames, loadedApprovals));
+	return envWith(roles, names, approvals);
+}
+//#endregion
+//#region src/core/simulate-preview.ts
+function previewSubject(policy, subject, preview) {
+	const previewRoles = preview.roles?.map((item) => typeof item === "string" ? item : item.key);
+	const kinds = subject.principal === null ? void 0 : applyRoleKinds(policy, previewRoles ?? subject.principal.roles, preview.memberships === void 0 ? subject.principal.memberships ?? [] : normalizeMemberships(preview.memberships, scopeList(policy.scopes)));
+	const principal = subject.principal === null || kinds === void 0 ? null : freezeDeep(compact({
+		...subject.principal,
+		roles: kinds.roles,
+		memberships: preview.memberships === void 0 && subject.principal.memberships === void 0 ? void 0 : kinds.memberships,
+		tenant: preview.tenant ?? subject.principal.tenant
+	}));
+	return freezeDeep({
+		...subject,
+		principal
+	});
+}
+/** The one `simulate` event for a batch: the worst decision, with the counts. */
+function simulateEvent(policy, subject, env, evaluated) {
+	const counts = {
+		granted: 0,
+		denied: 0,
+		approvalRequired: 0
+	};
+	for (const [, , decision] of evaluated) if (decision.outcome === "granted") counts.granted += 1;
+	else if (decision.outcome === "approval-required") counts.approvalRequired += 1;
+	else counts.denied += 1;
+	const worst = evaluated.find(([, , decision]) => decision.outcome === "denied") ?? evaluated.find(([, , decision]) => decision.outcome === "approval-required") ?? evaluated[0];
+	if (worst === void 0) return;
+	const [permission, data, decision] = worst;
+	finish(policy, subject, permission, data, decision, {
+		call: "simulate",
+		trusted: true
+	}, {
+		...env,
+		emit: true
+	}, true, void 0, counts);
+}
+//#endregion
+//#region src/core/instance.ts
+/** Each round reads one more layer: link hops, then the chain, then nested groups. */
+const LOAD_ROUNDS = 48;
+function buildInstance(policy, subject, envBase, team) {
+	const listeners = emptyListeners();
+	const queuedAuth = [...envBase.queuedAuth];
+	const queuedErrors = [...envBase.queuedErrors ?? []];
+	const customGrants = customGrantsFor(policy, envBase.customRoles);
+	const relationCache = envBase.relationCache ?? /* @__PURE__ */ new Map();
+	const relations = relationReader(envBase.relations, relationCache, policy.resources);
+	const assignableAt = (tenant) => assignableIn(policy, subject, envBase.customRoles, customGrants, tenant, tenant === void 0 ? void 0 : envBase.assignable?.get(tenant));
+	const assignableGlobal = () => assignableIn(policy, subject, envBase.customRoles, customGrants, void 0, void 0, nowSeconds(), true);
+	const envFor = (emit, skipAlternatives = false) => ({
+		emit,
+		simulated: envBase.simulated,
+		skipAlternatives,
+		customRoles: envBase.customRoles,
+		customGrants,
+		listeners,
+		sink: envBase.sink,
+		limits: envBase.limits,
+		limitCache: envBase.limitCache,
+		team,
+		relations,
+		...envBase.approvalPolicies === void 0 ? {} : { approvalPolicies: envBase.approvalPolicies }
+	});
+	const decideImpl = (permission, data, options) => evaluate(policy, subject, permission, data, options ?? {}, envFor(options?.call !== "simulate", options?.call === "can"));
+	const explainImpl = (permission, data, options) => {
+		return decideImpl(permission, data, {
+			...options,
+			call: options?.call ?? "explain",
+			explain: true
+		});
+	};
+	const canImpl = (permission, data, options) => {
+		try {
+			return decideImpl(permission, data, {
+				...options,
+				call: options?.call ?? "can"
+			}).outcome === "granted";
+		} catch {
+			return false;
+		}
+	};
+	const assertImpl = (permission, data, options) => {
+		return assertDecision(policy, subject, permission, data, decideImpl(permission, data, {
+			...options,
+			call: options?.call ?? "assert"
+		}), options?.onDenied ?? policy.onDenied);
+	};
+	const instance = {
+		can: canImpl,
+		decide: decideImpl,
+		decideEach(permission, rows, options) {
+			return Object.freeze(rows.map((row) => decideImpl(permission, row, options)));
+		},
+		decideFor(principalId, permission, row) {
+			return decideForTarget(subject, envBase.principals, envBase.targets, principalId, permission, row);
+		},
+		assert: assertImpl,
+		explain: explainImpl,
+		permissions: policy.permissions,
+		roles: policy.vocabulary?.roles ?? {},
+		plans: policy.vocabulary?.plans ?? {},
+		filter(permission, rows, options) {
+			const allowed = [];
+			let granted = 0;
+			let denied = 0;
+			let approvalRequired = 0;
+			const quiet = {
+				...envFor(false, true),
+				outcomeOnly: true
+			};
+			const trusted = options?.trusted ?? true;
+			const decideOptions = {
+				...options,
+				call: "filter",
+				trusted
+			};
+			for (const row of rows) {
+				const decision = evaluate(policy, subject, permission, row, decideOptions, quiet);
+				if (decision.outcome === "granted") {
+					allowed.push(row);
+					granted += 1;
+				} else if (decision.outcome === "approval-required") approvalRequired += 1;
+				else denied += 1;
+			}
+			const summary = granted > 0 ? freezeDeep({
+				outcome: "granted",
+				subject,
+				matched: {
+					role: "*",
+					permission: permission.key
+				},
+				token: "pd1.filter"
+			}) : freezeDeep({
+				outcome: "denied",
+				permission: permission.key,
+				denials: [{
+					role: null,
+					reason: "no-grant"
+				}],
+				alternatives: []
+			});
+			finish(policy, subject, permission, rows[0], summary, decideOptions, {
+				...quiet,
+				emit: true
+			}, trusted, void 0, {
+				granted,
+				denied,
+				approvalRequired
+			});
+			return allowed;
+		},
+		pick(permission, row, options) {
+			if (row === null || typeof row !== "object") return {};
+			if (canImpl(permission, row, options) !== true) return {};
+			return pickVisible(row, (field) => {
+				const next = compact({
+					...options,
+					field
+				});
+				return canImpl(permission, row, next) === true;
+			});
+		},
+		where(permission) {
+			const grants = collectSnapshotGrants(policy, subject, envBase.customRoles, nowSeconds(), customGrants).filter((item) => item.grant.permission.key === permission.key).map((item) => snapshotGrant(whereGrant(item.grant), item.membership));
+			return whereFromGrants(grants, compact({
+				resource: permission.resource,
+				resources: policy.resources,
+				graph: envBase.relations !== void 0,
+				scopes: scopeList(policy.scopes),
+				partitioned: (name, key) => relatesTo(getResource(policy.permissions, permission.resource), key, name, scopeList(policy.scopes)),
+				fieldOf: (name) => scopeField(getResource(policy.permissions, permission.resource), name, scopeList(policy.scopes)),
+				tenant: subject.principal?.tenant,
+				team,
+				now: nowSeconds(),
+				subject
+			}));
+		},
+		actions(resource, data, options) {
+			const fromTree = listPermissions(resource);
+			return (fromTree.length > 0 ? fromTree : "resource" in resource && typeof resource.resource === "string" ? listPermissions(policy.permissions).filter((item) => item.resource === resource.resource) : []).filter((item) => canImpl(item, data, options) === true);
+		},
+		async prefetchRelations(permission, rows) {
+			if (envBase.relations === void 0) return;
+			const quiet = {
+				...envFor(false),
+				simulated: true,
+				skipAlternatives: true
+			};
+			for (let round = 0; round < LOAD_ROUNDS; round += 1) {
+				for (const row of rows) evaluate(policy, subject, permission, row, {
+					call: "simulate",
+					trusted: true
+				}, quiet);
+				const pending = pendingRelations(relationCache);
+				if (pending.length === 0) return;
+				await Promise.all(pending);
+			}
+		},
+		simulate: ((input, options) => {
+			const evaluated = [];
+			const quietly = (permission, data) => {
+				const decision = evaluate(policy, subject, permission, data, compact({
+					call: "simulate",
+					trusted: true,
+					now: options?.now
+				}), envFor(false));
+				evaluated.push([
+					permission,
+					data,
+					decision
+				]);
+				return decision;
+			};
+			if (isReadonlyArray(input)) {
+				const decisions = input.map(([permission, data]) => quietly(permission, data));
+				simulateEvent(policy, subject, envFor(false), evaluated);
+				return decisions;
+			}
+			return buildInstance(policy, previewSubject(policy, subject, input), {
+				...envBase,
+				simulated: true,
+				relationCache
+			}, team);
+		}),
+		snapshot: ((options) => {
+			const snapshot = snapshotOf(policy, subject, compact({
+				customRoles: envBase.customRoles,
+				customGrants,
+				assignable: envBase.assignable,
+				include: options?.include,
+				tenants: options?.tenants,
+				simulated: envBase.simulated
+			}));
+			if (options?.signer !== void 0) return signSnapshot(snapshot, options.signer, compact({ audience: options.audience }));
+			return snapshot;
+		}),
+		on(event, handler) {
+			const set = listeners[event];
+			set.add(handler);
+			if (event === "auth") for (const queued of queuedAuth) try {
+				handler(queued);
+			} catch (error) {
+				emitSafe(listeners.error, error, listeners);
+			}
+			if (event === "error") for (const queued of queuedErrors) try {
+				handler(queued);
+			} catch {}
+			return () => {
+				set.delete(handler);
+			};
+		},
+		tenant(id) {
+			if (subject.principal === null) return buildInstance(policy, subject, {
+				...envBase,
+				relationCache
+			}, team);
+			return buildInstance(policy, freezeDeep(compact({
+				...subject,
+				principal: compact({
+					...subject.principal,
+					tenant: resolveActiveTenant(subject.principal, id, scopeList(policy.scopes))
+				})
+			})), {
+				...envBase,
+				relationCache
+			}, team);
+		},
+		team(id) {
+			return buildInstance(policy, subject, {
+				...envBase,
+				relationCache
+			}, id);
+		},
+		memberships() {
+			return subject.principal?.memberships ?? [];
+		},
+		tenants() {
+			return tenantsOf(subject.principal, scopeList(policy.scopes));
+		},
+		heldRoles(options) {
+			return heldRoleNames(policy, subject, options?.tenant ?? subject.principal?.tenant, options?.scope === void 0 ? void 0 : compact({
+				scope: options.scope,
+				id: options.id
+			})).map((name) => roleLeaf(policy, name));
+		},
+		audiences() {
+			return audiencesOf(policy, heldRoleNames(policy, subject, subject.principal?.tenant));
+		},
+		assignableRoles(options) {
+			if (options?.scope === "global") return assignableGlobal().roles.filter((leaf) => leaf.on === void 0);
+			return assignableAt(options?.tenant ?? subject.principal?.tenant).roles;
+		},
+		assignablePermissions(options) {
+			if (options?.scope === "global") return assignableGlobal().permissions;
+			const tenant = options?.tenant ?? subject.principal?.tenant;
+			return tenant === void 0 ? [] : assignableAt(tenant).permissions;
+		},
+		assignableLevels(permission, options) {
+			const of = (found) => (Object.hasOwn(found.levels, permission.key) ? found.levels[permission.key] : void 0) ?? [];
+			if (options?.scope === "global") return of(assignableGlobal());
+			const tenant = options?.tenant ?? subject.principal?.tenant;
+			return tenant === void 0 ? [] : of(assignableAt(tenant));
+		},
+		mayUse(permission) {
+			return mayUse(instance, permission);
+		},
+		permittedIds(permission, scope, options) {
+			return permittedIds(instance, permission, scope, options);
+		},
+		async derive(options) {
+			return buildInstance(policy, subject, await deriveEnv(policy, subject, envBase, relationCache, options), team);
+		},
+		subject
+	};
+	attachInternals(instance, {
+		instance,
+		policy,
+		subject,
+		env: envBase,
+		team,
+		customGrants,
+		relations,
+		relationCache,
+		assignable: (tenant) => tenant === void 0 ? assignableGlobal() : assignableAt(tenant),
+		now: () => nowSeconds(),
+		simulateWith: (run) => {
+			const evaluated = [];
+			const result = run((permission, data) => {
+				const decision = evaluate(policy, subject, permission, data, {
+					call: "simulate",
+					trusted: true
+				}, envFor(false));
+				evaluated.push([
+					permission,
+					data,
+					decision
+				]);
+				return decision;
+			});
+			simulateEvent(policy, subject, envFor(false), evaluated);
+			return result;
+		}
+	});
+	return Object.freeze(instance);
+}
+//#endregion
+//#region src/core/oauth-scopes.ts
+/**
+* `delegation` with every coarse OAuth scope the policy declares in
+* `oauthScopes` followed by the scopes of the permissions it covers, so the
+* delegation checks downstream match them. The token's scopes stay first and
+* unchanged; an undeclared scope expands to nothing.
+*/
+function expandOAuthScopes(policy, delegation) {
+	const declared = policy.oauthScopes;
+	const scopes = delegation?.scopes;
+	if (declared === void 0 || delegation === void 0 || scopes === void 0) return delegation;
+	const out = new Set(scopes);
+	for (const entry of declared) if (scopes.includes(entry.scope)) for (const scope of entry.scopes) out.add(scope);
+	return out.size === scopes.length ? delegation : {
+		...delegation,
+		scopes: [...out]
+	};
+}
+/** The coarse scopes the policy declares that cover `permission`, in declaration order. */
+function coarseScopesFor(policy, permission) {
+	return (policy.oauthScopes ?? []).filter((entry) => entry.permissions.includes(permission.key)).map((entry) => entry.scope);
+}
+/** Every token scope that reaches `permission`: its own, any it was renamed from, and the coarse scopes covering it. */
+function scopesReaching(policy, permission) {
+	return [
+		permission.scope,
+		...formerScopes(permission),
+		...coarseScopesFor(policy, permission)
+	];
+}
+/**
+* The scope an `insufficient_scope` challenge names for `permission`: the
+* first coarse scope that covers it, which the authorization server issues,
+* else the permission's own scope.
+*/
+function challengeScope(policy, permission) {
+	return coarseScopesFor(policy, permission)[0] ?? permission.scope;
+}
+/** Whether a token holding `granted` carries any of `scopes`. */
+function hasScope(granted, scopes) {
+	return scopes.some((scope) => granted?.includes(scope) === true);
+}
+//#endregion
+//#region src/core/resolve-subject.ts
+/**
+* The tenant a user API key holds its owner to (`Credential.tenant`): only
+* the memberships inside it count, and no global role.
+*/
+function heldTenantOf(principal) {
+	const credential = principal["credential"];
+	if (credential === null || typeof credential !== "object" || !Object.hasOwn(credential, "tenant") || !Object.hasOwn(credential, "kind")) return;
+	const record = credential;
+	return record.kind === "user" && typeof record.tenant === "string" && record.tenant !== "" ? record.tenant : void 0;
+}
+function outsideHeld(held, options) {
+	return held !== void 0 && options.tenant !== void 0 && options.tenant !== held;
+}
+function assemblePrincipal(policy, user, options, auth) {
+	let principal;
+	let context = {};
+	let actor = options.actor;
+	let delegation = options.delegation;
+	let session = options.session;
+	let expiresAt = options.expiresAt;
+	let liveSession;
+	try {
+		if (user === null || user === void 0) principal = policy.subject(user);
+		else if (isSubject(user)) {
+			principal = user.principal;
+			context = user.context;
+			actor = user.actor ?? actor;
+			delegation = user.delegation ?? delegation;
+			session = user.session ?? session;
+			expiresAt = user.expiresAt ?? expiresAt;
+			liveSession = user.liveSession === true ? true : void 0;
+		} else principal = policy.subject(user);
+	} catch {
+		principal = null;
+	}
+	const contextResult = withRequestContext(options.context, resolveContext(policy, user, context, auth));
+	let memberships = principal?.memberships ?? [];
+	let live = false;
+	const source = options.memberships === void 0 ? void 0 : asMembershipSource(options.memberships);
+	const fromClaims = source?.claimsFirst === true && principal?.memberships !== void 0 && principal.membershipsTruncated !== true;
+	const read = (from, of) => {
+		try {
+			return from.membershipsFor(compact({
+				id: of.id,
+				kind: of.kind
+			}), compact({ tenant: options.tenant }));
+		} catch {
+			auth.push({
+				reason: "source-threw",
+				source: "memberships",
+				...sourceName(source)
+			});
+			return [];
+		}
+	};
+	let stale;
+	if (principal !== null && source !== void 0 && !fromClaims) {
+		live = true;
+		memberships = read(source, principal);
+	} else if (principal?.memberships !== void 0 && fromClaims && source.onStale === "reread" && source.version !== void 0) {
+		const reread = rereadStale(source, principal, principal.memberships, () => read(source, principal), auth);
+		memberships = reread.memberships;
+		stale = reread.stale;
+	}
+	return compact({
+		principal,
+		context: contextResult,
+		actor,
+		delegation: expandOAuthScopes(policy, delegation),
+		session,
+		expiresAt,
+		memberships,
+		live,
+		stale,
+		liveSession: principal === null ? void 0 : liveSession
+	});
+}
+function versionQuery(principal) {
+	return compact({
+		id: principal.id,
+		roles: principal.roles,
+		memberships: principal.memberships
+	});
+}
+function rereadStale(source, principal, claims, read, auth) {
+	const claimed = principal.authzVersion;
+	const judge = (current) => typeof claimed === "number" && current !== void 0 && claimed >= current ? "fresh" : "reread";
+	const unknown = () => {
+		auth.push({
+			reason: "source-threw",
+			source: "memberships",
+			...sourceName(source)
+		});
+		return "unknown";
+	};
+	let freshness;
+	try {
+		const current = source.version?.(versionQuery(principal));
+		freshness = isThenable(current) ? Promise.resolve(current).then(judge, unknown) : judge(current);
+	} catch {
+		freshness = unknown();
+	}
+	if (isThenable(freshness)) return {
+		memberships: freshness.then((found) => found === "reread" ? read() : claims),
+		stale: freshness.then((found) => found === "unknown")
+	};
+	return {
+		memberships: freshness === "reread" ? read() : claims,
+		stale: freshness === "unknown"
+	};
+}
+function finishSubject(policy, assembled, context, input, options, extra) {
+	if (assembled.principal === null) return freezeCopy(compact({
+		...anonymousSubject(context),
+		actor: assembled.actor,
+		delegation: assembled.delegation,
+		session: assembled.session,
+		expiresAt: assembled.expiresAt
+	}));
+	const scopes = scopeList(policy.scopes);
+	const held = heldTenantOf(assembled.principal);
+	const contact = isContact(assembled.principal);
+	const normalized = checkMembershipX(normalizeMemberships(input, scopes), policyX(policy)?.membership, extra.auth);
+	const kinds = applyRoleKinds(policy, contact ? [] : assembled.principal.roles, contact ? contactMemberships(normalized) : normalized);
+	const roles = held === void 0 ? kinds.roles : [];
+	const memberships = held === void 0 ? kinds.memberships : outsideHeld(held, options) ? [] : kinds.memberships.filter((membership) => tenantOf(membership, scopes) === held);
+	const plans = contact ? [] : [.../* @__PURE__ */ new Set([...assembled.principal.plans ?? [], ...extra.plans])];
+	const withMemberships = freezeCopy(compact({
+		...assembled.principal,
+		roles,
+		memberships,
+		plans: plans.length > 0 ? plans : contact ? void 0 : assembled.principal.plans,
+		tenant: contact ? void 0 : activeTenantOf(policy, assembled, memberships, options)
+	}));
+	return freezeCopy(compact({
+		principal: withMemberships,
+		actor: assembled.actor,
+		delegation: assembled.delegation,
+		context: freezeCopy(context),
+		session: assembled.session,
+		expiresAt: assembled.expiresAt,
+		stale: extra.stale ? true : void 0,
+		liveSession: assembled.liveSession
+	}));
+}
+/** Runs the policy's membership schema over each `x`; an invalid one is dropped and reported, never the membership. */
+function checkMembershipX(memberships, schema, auth) {
+	if (schema === void 0) return memberships;
+	let dropped = false;
+	const checked = memberships.map((membership) => {
+		if (membership.x === void 0) return membership;
+		const x = readAppData(schema, membership.x);
+		if (x === void 0) {
+			dropped = true;
+			const { x: _dropped, ...rest } = membership;
+			return Object.freeze(rest);
+		}
+		return Object.freeze({
+			...membership,
+			x: freezeCopy(x)
+		});
+	});
+	if (dropped) auth.push({
+		reason: "schema",
+		source: "memberships",
+		cause: "x"
+	});
+	return checked;
+}
+function activeTenantOf(policy, assembled, memberships, options) {
+	if (assembled.principal === null) return;
+	const held = heldTenantOf(assembled.principal);
+	if (held !== void 0) return outsideHeld(held, options) ? void 0 : held;
+	return resolveActiveTenant({
+		...assembled.principal,
+		memberships
+	}, options.tenant ?? assembled.principal.tenant, scopeList(policy.scopes));
+}
+function settle(value, fallback, onError) {
+	if (isThenable(value)) return Promise.resolve(value).catch(() => {
+		onError();
+		return fallback;
+	});
+	return value;
+}
+/**
+* Whether the token's memberships are behind the source for `fresh`
+* permissions. Live memberships are never stale; token memberships are stale
+* unless a source reports a version the token's `authzVersion` has reached.
+*/
+function staleness(policy, assembled, options, auth) {
+	const principal = assembled.principal;
+	if ((policy.fresh ?? []).length === 0 || principal === null || assembled.live) return false;
+	if (assembled.stale !== void 0) return assembled.stale;
+	const source = options.memberships === void 0 ? void 0 : asMembershipSource(options.memberships);
+	const claimed = principal.authzVersion;
+	if (source?.version === void 0 || typeof claimed !== "number") return true;
+	const compare = (current) => current === void 0 || claimed < current;
+	try {
+		const current = source.version(versionQuery(principal));
+		return isThenable(current) ? settle(Promise.resolve(current).then(compare), true, () => {
+			auth.push({
+				reason: "source-threw",
+				source: "memberships",
+				...sourceName(source)
+			});
+		}) : compare(current);
+	} catch {
+		auth.push({
+			reason: "source-threw",
+			source: "memberships",
+			...sourceName(source)
+		});
+		return true;
+	}
+}
+function cleanNames(list) {
+	return Array.isArray(list) ? list.filter((item) => typeof item === "string" && item !== "") : [];
+}
+function entitlementsOf(assembled, tenant, options, auth) {
+	const source = options.entitlements;
+	if (source === void 0 || assembled.principal === null || outsideHeld(heldTenantOf(assembled.principal), options)) return [];
+	try {
+		const found = source.entitlementsFor({ id: assembled.principal.id }, compact({ tenant }));
+		return isThenable(found) ? settle(Promise.resolve(found).then(cleanNames), [], () => {
+			auth.push({
+				reason: "source-threw",
+				source: "entitlements"
+			});
+		}) : cleanNames(found);
+	} catch {
+		auth.push({
+			reason: "source-threw",
+			source: "entitlements"
+		});
+		return [];
+	}
+}
+function resolveContext(policy, user, fallback, auth) {
+	if (policy.context === void 0) return sanitizeContext(fallback);
+	try {
+		const loaded = policy.context(user);
+		if (isThenable(loaded)) return loaded.then((value) => sanitizeContext(value), () => {
+			auth.push({
+				reason: "source-threw",
+				source: "context"
+			});
+			return {};
+		});
+		return sanitizeContext(loaded);
+	} catch {
+		auth.push({
+			reason: "source-threw",
+			source: "context"
+		});
+		return {};
+	}
+}
+function withRequestContext(request, resolved) {
+	if (request === void 0) return resolved;
+	const base = sanitizeContext(request);
+	return isThenable(resolved) ? resolved.then((value) => ({
+		...base,
+		...value
+	})) : {
+		...base,
+		...resolved
+	};
+}
+function resolveSubject(policy, user, options, auth) {
+	const assembled = assemblePrincipal(policy, user, options, auth);
+	const memberships = settle(assembled.memberships, [], () => {
+		auth.push({
+			reason: "source-threw",
+			source: "memberships"
+		});
+	});
+	const stale = staleness(policy, assembled, options, auth);
+	const withPlans = (resolved) => entitlementsOf(assembled, activeTenantOf(policy, assembled, applyRoleKinds(policy, assembled.principal?.roles, normalizeMemberships(resolved, scopeList(policy.scopes))).memberships, options), options, auth);
+	if (isThenable(assembled.context) || isThenable(memberships) || isThenable(stale)) return Promise.all([
+		Promise.resolve(assembled.context),
+		Promise.resolve(memberships),
+		Promise.resolve(stale)
+	]).then(async ([context, resolved, isStale]) => finishSubject(policy, assembled, context, resolved, options, {
+		stale: isStale,
+		plans: await withPlans(resolved),
+		auth
+	}));
+	const plans = withPlans(memberships);
+	if (isThenable(plans)) return Promise.resolve(plans).then((resolved) => finishSubject(policy, assembled, assembled.context, memberships, options, {
+		stale,
+		plans: resolved,
+		auth
+	}));
+	return finishSubject(policy, assembled, assembled.context, memberships, options, {
+		stale,
+		plans,
+		auth
+	});
+}
+//#endregion
+//#region src/core/permdock.ts
+function instantiate(codePolicy, subject, options, auth) {
+	const { policy, errors } = options.policies?.apply(codePolicy) ?? {
+		policy: codePolicy,
+		errors: []
+	};
+	const scopes = scopeList(policy.scopes);
+	const tenants = tenantsOf(subject.principal, scopes);
+	const roleSource = roleSourceFor(options.customRoles, subject, auth);
+	const customRoles = customRolesFor(roleSource, tenants, auth, subject.principal === null ? void 0 : subject.principal.roles ?? [], (tenant) => heldRoleNamesIn(subject.principal, scopes, tenant));
+	const assignable = assignableNamesFor(roleSource, tenants, auth);
+	const approvals = options.approvalPolicies?.load(policy, tenants, auth);
+	const build = (roles, names, approvalPolicies) => buildInstance(policy, subject, compact({
+		customRoles: roles,
+		sink: options.sink,
+		limits: options.limits,
+		limitCache: /* @__PURE__ */ new Map(),
+		simulated: false,
+		roleSource,
+		assignable: names,
+		queuedAuth: auth,
+		queuedErrors: errors,
+		relations: options.relations,
+		approvalPolicies,
+		memberships: options.memberships === void 0 ? void 0 : asMembershipSource(options.memberships),
+		principals: options.principals,
+		settings: options.settings,
+		targets: (principal, tenant) => getPermDock(codePolicy, {
+			principal,
+			context: {}
+		}, compact({
+			tenant,
+			memberships: options.memberships,
+			customRoles: options.customRoles,
+			entitlements: options.entitlements,
+			limits: options.limits,
+			policies: options.policies,
+			relations: options.relations,
+			approvalPolicies: options.approvalPolicies
+		}))
+	}));
+	if (isThenable(customRoles) || isThenable(assignable) || isThenable(approvals)) return Promise.all([
+		customRoles,
+		assignable,
+		approvals
+	]).then(([roles, names, loaded]) => build(roles, names, loaded));
+	return build(customRoles, assignable, approvals);
+}
+function create(policy, user, given) {
+	const options = withApp(policy, given);
+	const auth = [];
+	const subject = resolveSubject(policy, user, options, auth);
+	if (isThenable(subject)) return subject.then((resolved) => instantiate(policy, resolved, options, auth));
+	return instantiate(policy, subject, options, auth);
+}
+/**
+* The instance for `user`, built synchronously. Every input must answer
+* synchronously: the subject mapper, `memberships`, `customRoles`,
+* `entitlements`, `approvalPolicies` and the freshness check. One that
+* answers with a Promise throws here; use `getPermDock` for those.
+*/
+function getPermDockSync(policy, user, options = {}) {
+	const created = create(policy, user, options);
+	if (isThenable(created)) {
+		created.then(void 0, () => void 0);
+		throw new Error("PermDock: getPermDockSync got a Promise from the subject mapper or a source (memberships, customRoles, entitlements, approvalPolicies); use getPermDock for asynchronous inputs");
+	}
+	return created;
+}
+/** The instance for `user`: waits for every source, then builds it. `getPermDockSync` is the synchronous twin. */
+function getPermDock(policy, user, options = {}) {
+	return Promise.resolve().then(() => create(policy, user, options));
+}
+//#endregion
+export { hasScope as a, withApp as c, challengeScope as i, getPermDockSync as n, scopesReaching as o, resolveSubject as r, APP as s, getPermDock as t };