permdock 0.3.1 → 0.5.0

package/dist/react/index.js

@@ -1,7 +1,7 @@
 "use client";
-import { r as requiredPlans } from "../problem-details-_AMOYz-w.js";
-import { t as describe } from "../describe-B_gVZEVi.js";
-import { t as approvalHeaders } from "../headers-BZSDieNT.js";
-import { a as useFilter, c as usePermission, d as useSubject, f as useTenant, i as useAssignableRoles, l as usePermissions, n as useApproval, o as useMemberships, r as useAssignablePermissions, s as usePermDock, t as Protected, u as useRoles } from "../protected-utU-SLuy.js";
-import { t as PermDockProvider } from "../provider-CSQd7m92.js";
-export { PermDockProvider, Protected, approvalHeaders, describe, requiredPlans, useApproval, useAssignablePermissions, useAssignableRoles, useFilter, useMemberships, usePermDock, usePermission, usePermissions, useRoles, useSubject, useTenant };
+import { r as requiredPlans } from "../problem-details-cn5X30gZ.js";
+import { t as describe } from "../describe-BybMRY7A.js";
+import { t as approvalHeaders } from "../headers-BIjfMaoC.js";
+import { a as useDescribe, c as useMemberships, d as usePermissions, f as useRoles, i as useAssignableRoles, l as usePermDock, m as useTenant, n as useApproval, o as useFilter, p as useSubject, r as useAssignablePermissions, s as useGate, t as Protected, u as usePermission } from "../protected-DfjY5mLA.js";
+import { t as PermDockProvider } from "../provider-CC-u3bYP.js";
+export { PermDockProvider, Protected, approvalHeaders, describe, requiredPlans, useApproval, useAssignablePermissions, useAssignableRoles, useDescribe, useFilter, useGate, useMemberships, usePermDock, usePermission, usePermissions, useRoles, useSubject, useTenant };

package/dist/react/provider-client.d.ts

@@ -1,2 +1,2 @@
-import { t as PermDockProvider } from "../provider-DZY281jO.js";
+import { t as PermDockProvider } from "../provider-DMVt6yYn.js";
 export { PermDockProvider };

package/dist/react/provider-client.js

@@ -1,3 +1,2 @@
 "use client";
-import { t as PermDockProvider } from "../provider-CSQd7m92.js";
-export { PermDockProvider };
+export { t as PermDockProvider } from "../provider-CC-u3bYP.js";

package/dist/react-native/index.d.ts

@@ -1,14 +1,14 @@
-import { At as SnapshotSource, Dr as CustomRole, Ft as TokenVerifier, Mr as Membership, Tt as Snapshot, pt as LocalSnapshotManifest } from "../policy-IB6yxpC3.js";
-import { f as Permission } from "../permissions-DttnqqxC.js";
-import { n as requiredPlans } from "../problem-details-DX075l9V.js";
-import { i as describe } from "../describe-DMYiCjJV.js";
-import { t as parseLocalSnapshotManifest } from "../parse-local-manifest-JLnaBH0S.js";
-import { t as approvalHeaders } from "../headers-Cf-zWvsO.js";
-import { a as FilterResult, c as SubjectView, i as ClientStatus, l as TenantView, n as ApprovalState, o as PermissionSet, r as ClientPermDock, s as PermissionState, t as ApprovalHandle } from "../types-CKNSyIf_.js";
-import { n as ProtectedProps } from "../types-BnIEz1sU.js";
-import { a as useFilter, c as usePermission, d as useSubject, f as useTenant, i as useAssignableRoles, l as usePermissions, n as useApproval, o as useMemberships, r as useAssignablePermissions, s as usePermDock, t as Protected, u as useRoles } from "../protected-BdnIEFkY.js";
-import { t as ClientStore } from "../store-jOBYpiXC.js";
-import { ReactElement, ReactNode } from "react";
+import { Bt as LocalSnapshotManifest, Rt as Instant, Vt as Snapshot, Zn as CustomRole, nr as Membership, ot as SnapshotSource } from "../policy-types-DzwivBgR.js";
+import { w as Permission } from "../vocabulary-D6lPdb4Z.js";
+import { n as requiredPlans } from "../problem-details-DXlt-vks.js";
+import { i as describe } from "../describe-BZUsixiL.js";
+import { t as parseLocalSnapshotManifest } from "../parse-local-manifest-DgqtruPn.js";
+import { t as approvalHeaders } from "../headers-CIbDTUTK.js";
+import { a as FilterResult, c as PermissionSet, f as SubjectView, i as ClientStatus, l as PermissionState, m as ClientStore, n as ApprovalState, o as GateMode, p as TenantView, r as ClientPermDock, s as GateView, t as ApprovalHandle } from "../types-BNORmDM8.js";
+import { r as ProtectedProps, t as PermDockDefaults } from "../types-tIgIeIKJ.js";
+import { a as useDescribe, c as useMemberships, d as usePermissions, f as useRoles, i as useAssignableRoles, l as usePermDock, m as useTenant, n as useApproval, o as useFilter, p as useSubject, r as useAssignablePermissions, s as useGate, t as Protected, u as usePermission } from "../protected-DEPHc2xV.js";
+import { a as SubscribeOnline, i as SubscribeForeground, n as ReactNativePermDockProviderProps, r as SnapshotStorage, t as NativeRevalidate } from "../types-BjV-fqcA.js";
+import { ReactElement } from "react";
 //#region src/react-native/guards.d.ts
 /** `true` once the provider has a snapshot to answer from: storage was read or a seed was given. Hide the splash screen on it. */
 export declare function useSnapshotReady(): boolean;
@@ -33,7 +33,7 @@ type LocalSnapshotData = {
     /** Attributes conditions read, such as `claims` for `principal.claims.team_ids`. */
     readonly attributes?: Readonly<Record<string, unknown>>;
   } | null;
-  /** The tenant's custom roles, in the shape a `RoleSource` returns. */
+  /** The tenant's custom roles, in the shape a `CustomRoleSource` returns. */
   readonly customRoles?: readonly CustomRole[];
 };
 type LocalSnapshotOptions = {
@@ -47,7 +47,7 @@ type LocalSnapshotOptions = {
  * The snapshot a server would send for `data`, built from the manifest. It
  * drives UI guards only: the server still decides every request.
  */
-export declare function buildLocalSnapshot(manifest: LocalSnapshotManifest, data: LocalSnapshotData, now?: number): Snapshot;
+export declare function buildLocalSnapshot(manifest: LocalSnapshotManifest, data: LocalSnapshotData, at?: Instant): Snapshot;
 /**
  * A snapshot source over the device's own membership rows (SQLite, a
  * PowerSync or Electric replica): offline, the UI guards answer from them.
@@ -55,7 +55,7 @@ export declare function buildLocalSnapshot(manifest: LocalSnapshotManifest, data
 export declare function localSnapshot(options: LocalSnapshotOptions): SnapshotSource;
 //#endregion
 //#region src/react-native/powersync.d.ts
-/** The `PowerSyncDatabase` methods `powersyncSource` calls. */
+/** The `PowerSyncDatabase` methods `powerSyncSource` calls. */
 type PowerSyncWatchable = {
   getAll(sql: string, parameters?: unknown[]): Promise<unknown[]>;
   watch(sql: string, parameters: unknown[] | undefined, handler: {
@@ -85,52 +85,13 @@ type PowerSyncSourceOptions<Q extends string> = {
  * takes the database as an argument; `permdock/react-native` never imports
  * `@powersync/*`.
  */
-export declare function powersyncSource<Q extends string>(db: PowerSyncWatchable, options: PowerSyncSourceOptions<Q>): SnapshotSource;
-//#endregion
-//#region src/react-native/types.d.ts
-type PermDockStorage = {
-  getItem(key: string): string | null | Promise<string | null>;
-  setItem(key: string, value: string): void | Promise<void>;
-  removeItem(key: string): void | Promise<void>;
-};
-type NativeRevalidate = "launch" | "focus" | number;
-/**
- * Calls `listener` when the app changes state; `active` is `false` when it
- * goes to the background. A listener called without an argument counts as
- * a return to the foreground.
- */
-type SubscribeForeground = (listener: (active?: boolean) => void) => () => void;
-/** Calls `listener` with `false` when the device loses connectivity and `true` when it returns. */
-type SubscribeOnline = (listener: (online: boolean) => void) => () => void;
-type NativePermDockProviderProps = {
-  readonly storage: PermDockStorage;
-  /**
-   * The signed-in principal's id, or `null` when nobody is signed in. Only a
-   * persisted snapshot for this id is read or written; `null` clears storage.
-   */
-  readonly subjectId: string | null;
-  readonly snapshot?: Snapshot | string;
-  readonly snapshotUrl?: string;
-  /** Hydrates from the device's own rows (`localSnapshot`); with `snapshotUrl` too, the latest answer wins. */
-  readonly source?: SnapshotSource;
-  readonly endpoint?: string;
-  readonly approvals?: string;
-  readonly tenant?: string;
-  readonly revalidate?: NativeRevalidate;
-  readonly subscribeForeground?: SubscribeForeground;
-  readonly subscribeOnline?: SubscribeOnline;
-  readonly fetch?: typeof fetch;
-  readonly headers?: Readonly<Record<string, string>>;
-  readonly maxAge?: number;
-  readonly verifier?: TokenVerifier;
-  readonly children: ReactNode;
-};
+export declare function powerSyncSource<Q extends string>(db: PowerSyncWatchable, options: PowerSyncSourceOptions<Q>): SnapshotSource;
 //#endregion
 //#region src/react-native/provider.d.ts
-export declare function PermDockProvider(props: NativePermDockProviderProps): ReactElement;
+export declare function PermDockProvider(props: ReactNativePermDockProviderProps): ReactElement;
 //#endregion
 //#region src/react-native/storage.d.ts
-export declare function memoryStorage(initial?: Readonly<Record<string, string>>): PermDockStorage;
+export declare function memorySnapshotStorage(initial?: Readonly<Record<string, string>>): SnapshotStorage;
 //#endregion
 //#region src/react-native/storage-adapters.d.ts
 /** The `expo-secure-store` functions `secureStoreStorage` calls. */
@@ -149,13 +110,13 @@ type MmkvInstance = {
   delete(key: string): unknown;
 });
 /**
- * A `PermDockStorage` over `expo-secure-store`. Values are split into chunks
+ * A `SnapshotStorage` over `expo-secure-store`. Values are split into chunks
  * of at most 2048 bytes under `<key>.<n>`; `<key>` holds the chunk count and
  * is written last, so an interrupted write reads as absent.
  */
-export declare function secureStoreStorage(store: SecureStoreModule, options?: object): PermDockStorage;
-/** A synchronous `PermDockStorage` over a `react-native-mmkv` instance: the first frame already has the snapshot. */
-export declare function mmkvStorage(mmkv: MmkvInstance): PermDockStorage;
+export declare function secureStoreStorage(store: SecureStoreModule, options?: object): SnapshotStorage;
+/** A synchronous `SnapshotStorage` over a `react-native-mmkv` instance: the first frame already has the snapshot. */
+export declare function mmkvStorage(mmkv: MmkvInstance): SnapshotStorage;
 //#endregion
 //#region src/react-native/subscriptions.d.ts
 /** The `AppState` export of `react-native`, as `appStateForeground` calls it. */
@@ -181,7 +142,7 @@ export declare function appStateForeground(appState: AppStateModule): SubscribeF
 export declare function netInfoOnline(netInfo: NetInfoModule): SubscribeOnline;
 //#endregion
 //#region src/react-native/store.d.ts
-type NativeStoreOptions = Omit<NativePermDockProviderProps, "children" | "headers"> & {
+type NativeStoreOptions = Omit<ReactNativePermDockProviderProps, "children" | "headers" | "defaults" | "messages"> & {
   readonly headers?: Readonly<Record<string, string>> | (() => Readonly<Record<string, string>> | undefined);
   /** A store this one replaces: its snapshot and tenant seed this store, so guards do not flip while it boots. */
   readonly previous?: ClientStore;
@@ -193,6 +154,6 @@ type NativeStoreOptions = Omit<NativePermDockProviderProps, "children" | "header
  * snapshot. Returns the unsubscribe.
  */
 export declare function connectSource(store: ClientStore, source: SnapshotSource, subscribeForeground?: SubscribeForeground): () => void;
-export declare function createNativeStore(options: NativeStoreOptions): ClientStore;
+export declare function nativeStore(options: NativeStoreOptions): ClientStore;
 //#endregion
-export { type AppStateModule, type ApprovalHandle, type ApprovalState, type ClientPermDock, type ClientStatus, type FilterResult, type LocalSnapshotData, type LocalSnapshotManifest, type LocalSnapshotOptions, type MmkvInstance, type NativePermDockProviderProps, type NativeRevalidate, type NetInfoModule, type PermDockStorage, type PermissionSet, type PermissionState, type PowerSyncQuery, type PowerSyncSourceOptions, type PowerSyncWatchable, Protected, type ProtectedProps, type SecureStoreModule, type SnapshotSource, type SubjectView, type SubscribeForeground, type SubscribeOnline, type TenantView, approvalHeaders, describe, parseLocalSnapshotManifest, requiredPlans, useApproval, useAssignablePermissions, useAssignableRoles, useFilter, useMemberships, usePermDock, usePermission, usePermissions, useRoles, useSubject, useTenant };
+export { type AppStateModule, type ApprovalHandle, type ApprovalState, type ClientPermDock, type ClientStatus, type FilterResult, type GateMode, type GateView, type LocalSnapshotData, type LocalSnapshotManifest, type LocalSnapshotOptions, type MmkvInstance, type NativeRevalidate, type NetInfoModule, type PermDockDefaults, type PermissionSet, type PermissionState, type PowerSyncQuery, type PowerSyncSourceOptions, type PowerSyncWatchable, Protected, type ProtectedProps, type ReactNativePermDockProviderProps, type SecureStoreModule, type SnapshotSource, type SnapshotStorage, type SubjectView, type SubscribeForeground, type SubscribeOnline, type TenantView, approvalHeaders, describe, parseLocalSnapshotManifest, requiredPlans, useApproval, useAssignablePermissions, useAssignableRoles, useDescribe, useFilter, useGate, useMemberships, usePermDock, usePermission, usePermissions, useRoles, useSubject, useTenant };

package/dist/react-native/index.js

@@ -1,19 +1,20 @@
 "use client";
-import { t as compact } from "../compact-y6vfu2_f.js";
+import { t as compact } from "../compact-CAf557ZB.js";
 import { n as freezeDeep } from "../freeze-CrU8nQeX.js";
-import { r as requiredPlans } from "../problem-details-_AMOYz-w.js";
-import { t as describe } from "../describe-B_gVZEVi.js";
-import { a as normalizeMemberships, d as scopeList, m as tenantOf$1, o as resolveScope } from "../scopes-CVdPrWN-.js";
-import { n as parseSnapshot, o as bindConditionRefs } from "../snapshot-Enxd0n-s.js";
-import { s as flattenGrantee } from "../grantee-Cv5Sogfv.js";
-import { p as resolveActiveTenant, u as nowSeconds } from "../validity-uOp8UpYn.js";
-import { n as isThenable } from "../thenable-okc2xDsj.js";
-import { r as heldRoleNames, t as emptySnapshot } from "../from-snapshot-CTLijvdm.js";
-import { t as parseLocalSnapshotManifest } from "../parse-local-manifest-BrMozJCo.js";
-import { t as approvalHeaders } from "../headers-BZSDieNT.js";
-import { n as storeOf, r as isJws, t as adapterStore } from "../store-options-ByhZq1jV.js";
-import { i as PermDockStoreContext, n as useKeyed, t as useLiveOptions } from "../live-options-H2eG8dfJ.js";
-import { a as useFilter, c as usePermission, d as useSubject, f as useTenant, i as useAssignableRoles, l as usePermissions, n as useApproval, o as useMemberships, r as useAssignablePermissions, s as usePermDock, t as Protected, u as useRoles } from "../protected-utU-SLuy.js";
+import { r as requiredPlans } from "../problem-details-cn5X30gZ.js";
+import { t as describe } from "../describe-BybMRY7A.js";
+import { n as isThenable } from "../thenable-yD7SabqG.js";
+import { h as secondsAt, m as rfc3339 } from "../time-DkWjdL98.js";
+import { a as normalizeMemberships, d as scopeList, m as tenantOf$1, o as resolveScope } from "../scopes-CUPSjo9q.js";
+import { o as flattenGrantee } from "../grantee-Cn1HyUsI.js";
+import { d as resolveActiveTenant } from "../tenancy-DN2QAx9z.js";
+import { i as bindConditionRefs, n as parseSnapshot } from "../snapshot-CXUWfsNy.js";
+import { r as heldRoleNames, t as emptySnapshot } from "../from-snapshot-D2lZt4Dd.js";
+import { t as parseLocalSnapshotManifest } from "../parse-local-manifest-CVSs6J9I.js";
+import { t as approvalHeaders } from "../headers-BIjfMaoC.js";
+import { n as storeOf, r as isJws, t as adapterStore } from "../store-options-BqEakYRa.js";
+import { a as PermDockUiContext, i as PermDockStoreContext, n as useKeyed, t as useLiveOptions } from "../live-options-BaAFCIiu.js";
+import { a as useDescribe, c as useMemberships, d as usePermissions, f as useRoles, i as useAssignableRoles, l as usePermDock, m as useTenant, n as useApproval, o as useFilter, p as useSubject, r as useAssignablePermissions, s as useGate, t as Protected, u as usePermission } from "../protected-DfjY5mLA.js";
 import { useEffect, useMemo, useRef } from "react";
 import { jsx } from "react/jsx-runtime";
 //#region src/react-native/guards.ts
@@ -130,7 +131,8 @@ function customScope(role, scopes) {
 * The snapshot a server would send for `data`, built from the manifest. It
 * drives UI guards only: the server still decides every request.
 */
-function buildLocalSnapshot(manifest, data, now = Math.floor(nowSeconds())) {
+function buildLocalSnapshot(manifest, data, at) {
+	const now = secondsAt(at);
 	if (manifest === null || typeof manifest !== "object" || manifest.v !== 1 || !isList(manifest.grants)) throw new Error("PermDock: unsupported local snapshot manifest");
 	const scopes = scopeList(manifest.scopes);
 	const input = data.principal;
@@ -189,7 +191,7 @@ function buildLocalSnapshot(manifest, data, now = Math.floor(nowSeconds())) {
 	const roles = subject.principal === null ? [] : heldRoleNames(subject, tenant, scopes, { rank: manifest.rank ?? [] }, now);
 	return freezeDeep(compact({
 		v: 1,
-		issuedAt: now,
+		issuedAt: rfc3339(now),
 		subject: {
 			principal,
 			context: {}
@@ -220,7 +222,7 @@ function localSnapshot(options) {
 * takes the database as an argument; `permdock/react-native` never imports
 * `@powersync/*`.
 */
-function powersyncSource(db, options) {
+function powerSyncSource(db, options) {
 	const names = Object.keys(options.queries);
 	return localSnapshot({
 		manifest: options.manifest,
@@ -249,7 +251,7 @@ function powersyncSource(db, options) {
 //#region src/react-native/storage.ts
 const SNAPSHOT_KEY = "permdock.snapshot";
 const TENANT_KEY = "permdock.tenant";
-function memoryStorage(initial = {}) {
+function memorySnapshotStorage(initial = {}) {
 	const map = new Map(Object.entries(initial));
 	return {
 		getItem(key) {
@@ -366,7 +368,7 @@ function clearStorage(storage) {
 function contentKey(snapshot) {
 	return JSON.stringify({
 		...snapshot,
-		issuedAt: 0
+		issuedAt: ""
 	});
 }
 /**
@@ -425,7 +427,7 @@ function parseSeed(given) {
 		return;
 	}
 }
-function createNativeStore(options) {
+function nativeStore(options) {
 	const storage = guardStorage(options.storage);
 	const signed = options.verifier !== void 0;
 	const revalidates = options.snapshotUrl !== void 0 || options.source !== void 0;
@@ -447,7 +449,10 @@ function createNativeStore(options) {
 		maxAge: options.maxAge,
 		verifier: options.verifier,
 		awaiting: waiting,
-		passCache: true
+		passCache: true,
+		onSnapshot: options.onSnapshot,
+		onClear: options.onClear,
+		approvalInterval: options.approvalInterval
 	}), snapshot, {
 		server: false,
 		stale: revalidates && (fromStorage !== void 0 || waiting),
@@ -485,7 +490,7 @@ function createNativeStore(options) {
 function PermDockProvider(props) {
 	const live = useLiveOptions(props, false);
 	const shown = useRef(null);
-	const store = useKeyed(() => createNativeStore(compact({
+	const store = useKeyed(() => nativeStore(compact({
 		storage: props.storage,
 		subjectId: props.subjectId,
 		snapshot: props.snapshot,
@@ -498,6 +503,9 @@ function PermDockProvider(props) {
 		headers: live.readHeaders,
 		maxAge: props.maxAge,
 		verifier: live.verifier,
+		onSnapshot: live.onSnapshot,
+		onClear: live.onClear,
+		approvalInterval: props.approvalInterval,
 		previous: shown.current ?? void 0
 	})), [
 		props.storage,
@@ -510,8 +518,15 @@ function PermDockProvider(props) {
 		props.tenant,
 		live.fetch,
 		props.maxAge,
-		live.verifier
+		live.verifier,
+		live.onSnapshot,
+		live.onClear,
+		props.approvalInterval
 	]);
+	const ui = useMemo(() => ({
+		defaults: props.defaults,
+		messages: props.messages
+	}), [props.defaults, props.messages]);
 	useEffect(() => {
 		const previous = shown.current;
 		shown.current = store;
@@ -580,7 +595,10 @@ function PermDockProvider(props) {
 	]);
 	return /* @__PURE__ */ jsx(PermDockStoreContext, {
 		value: store,
-		children: props.children
+		children: /* @__PURE__ */ jsx(PermDockUiContext, {
+			value: ui,
+			children: props.children
+		})
 	});
 }
 //#endregion
@@ -620,7 +638,7 @@ function chunkKey(key, index) {
 	return `${key}.${index}`;
 }
 /**
-* A `PermDockStorage` over `expo-secure-store`. Values are split into chunks
+* A `SnapshotStorage` over `expo-secure-store`. Values are split into chunks
 * of at most 2048 bytes under `<key>.<n>`; `<key>` holds the chunk count and
 * is written last, so an interrupted write reads as absent.
 */
@@ -655,7 +673,7 @@ function secureStoreStorage(store, options) {
 		}
 	};
 }
-/** A synchronous `PermDockStorage` over a `react-native-mmkv` instance: the first frame already has the snapshot. */
+/** A synchronous `SnapshotStorage` over a `react-native-mmkv` instance: the first frame already has the snapshot. */
 function mmkvStorage(mmkv) {
 	return {
 		getItem: (key) => mmkv.getString(key) ?? null,
@@ -693,4 +711,4 @@ function netInfoOnline(netInfo) {
 	});
 }
 //#endregion
-export { PermDockProvider, Protected, appStateForeground, approvalHeaders, buildLocalSnapshot, connectSource, createNativeStore, describe, localSnapshot, memoryStorage, mmkvStorage, netInfoOnline, parseLocalSnapshotManifest, powersyncSource, requiredPlans, secureStoreStorage, useApproval, useAssignablePermissions, useAssignableRoles, useFilter, useMemberships, usePermDock, usePermission, usePermissionGuard, usePermissions, useRoles, useSnapshotReady, useSubject, useTenant };
+export { PermDockProvider, Protected, appStateForeground, approvalHeaders, buildLocalSnapshot, connectSource, describe, localSnapshot, memorySnapshotStorage, mmkvStorage, nativeStore, netInfoOnline, parseLocalSnapshotManifest, powerSyncSource, requiredPlans, secureStoreStorage, useApproval, useAssignablePermissions, useAssignableRoles, useDescribe, useFilter, useGate, useMemberships, usePermDock, usePermission, usePermissionGuard, usePermissions, useRoles, useSnapshotReady, useSubject, useTenant };

package/dist/{refs-KYb4ntaz.js → refs-K6eWUJ0H.js}

@@ -1,5 +1,5 @@
 import { n as freezeDeep } from "./freeze-CrU8nQeX.js";
-import { O as readPath, k as splitPath, w as assertSafeKey } from "./permissions-DVoF6dMt.js";
+import { o as readPath, s as splitPath, t as assertSafeKey } from "./paths-DXSHAMIa.js";
 //#region src/conditions/ast.ts
 function parentHop(parent) {
 	return typeof parent === "string" ? { field: parent } : parent;

package/dist/relation-walk-3OyDBF0S.js

@@ -0,0 +1,186 @@
+import { r as isRecord } from "./compact-CAf557ZB.js";
+import { r as ownGet } from "./paths-DXSHAMIa.js";
+import { n as relationId } from "./relations-BnCWnJGI.js";
+//#region src/core/relation-walk.ts
+/** Whether the holder's period covers `now`. */
+function activeNow(holder, now) {
+	return (holder.startsAt === void 0 || holder.startsAt <= now) && (holder.expiresAt === void 0 || holder.expiresAt > now);
+}
+function holdsNow(holder, principalId, now) {
+	return "principal" in holder && holder.principal.id === principalId && activeNow(holder, now);
+}
+/** Where the walk starts after following `hops`, or why it cannot. */
+function followHops(condition, first, reader) {
+	const hops = condition.hops ?? [];
+	let id = first;
+	for (let index = 1; index < hops.length; index += 1) {
+		const from = hops[index - 1];
+		const hop = hops[index];
+		if (from === void 0 || hop === void 0)
+ /* v8 ignore next */
+		return;
+		const chain = reader.chain({
+			resource: from.resource,
+			id,
+			depth: 1,
+			through: hop.link
+		});
+		if (chain === "pending" || chain === "failed") return "relation-unavailable";
+		const next = chain.ancestors[0]?.id;
+		if (next === void 0) return;
+		id = next;
+	}
+	return { id };
+}
+function restrictedAbove(condition, row, reader) {
+	const above = condition.restrictedAncestors;
+	if (above === void 0) return false;
+	const parent = relationId(ownGet(row, above.parent));
+	if (parent === void 0) return false;
+	const chain = reader.chain({
+		resource: above.resource,
+		id: parent,
+		depth: above.depth - 1
+	});
+	if (chain === "pending" || chain === "failed") return "relation-unavailable";
+	if (chain.restricted === true || chain.ancestors.some((ancestor) => ancestor.restricted === true)) return;
+	const own = relationId(ownGet(row, above.id));
+	const ids = [
+		...own === void 0 ? [] : [own],
+		parent,
+		...chain.ancestors.map((ancestor) => ancestor.id)
+	];
+	if (new Set(ids).size !== ids.length || chain.truncated === true || chain.ancestors.length > above.depth - 1) return "relation-depth";
+	return false;
+}
+/** The instances a graph relation reads: the start, then ancestors until a restricted one or `depth`. */
+function relationWalk(condition, row, reader) {
+	if (!isRecord(row)) return;
+	const first = relationId(ownGet(row, condition.field));
+	if (first === void 0) return;
+	const rowRestricted = condition.restricted !== void 0 && ownGet(row, condition.restricted) === true;
+	const hopped = condition.hops !== void 0 && condition.hops.length > 0;
+	if ((condition.parent === true || hopped) && rowRestricted) return;
+	const above = restrictedAbove(condition, row, reader);
+	if (above !== false) return above;
+	const start = hopped ? followHops(condition, first, reader) : { id: first };
+	if (start === void 0 || start === "relation-unavailable") return start;
+	const id = start.id;
+	if (condition.depth === 0 || rowRestricted) return {
+		ids: [id],
+		truncated: false
+	};
+	const chain = reader.chain({
+		resource: condition.resource,
+		id,
+		depth: condition.depth
+	});
+	if (chain === "pending" || chain === "failed") return "relation-unavailable";
+	const ids = [id];
+	const stops = condition.passRestricted !== true;
+	let stopped = stops && chain.restricted === true;
+	if (!stopped) for (const ancestor of chain.ancestors.slice(0, condition.depth)) {
+		ids.push(ancestor.id);
+		if (stops && ancestor.restricted === true) {
+			stopped = true;
+			break;
+		}
+	}
+	if (new Set(ids).size !== ids.length) return "relation-depth";
+	return {
+		ids,
+		truncated: !stopped && (chain.ancestors.length > condition.depth || chain.truncated === true)
+	};
+}
+/**
+* Whether the subject holds the relation on the row's instance or an
+* ancestor within `depth`. A cycle is `relation-depth`; so is a chain that
+* goes on past `depth` with no holder below it. Any read the instance could
+* not answer is `relation-unavailable` unless a holder was found elsewhere.
+*/
+function resolveRelated(condition, row, subject, now, reader, permitted) {
+	if (condition.permission !== void 0) return resolveInherited(condition, condition.permission, row, reader, permitted);
+	const principal = subject.principal;
+	if (principal === null) return false;
+	const walk = relationWalk(condition, row, reader);
+	if (walk === void 0) return false;
+	if (walk === "relation-depth" || walk === "relation-unavailable") return walk;
+	if (condition.ids !== void 0) {
+		const held = new Set(condition.ids);
+		if (walk.ids.some((id) => held.has(id))) return true;
+		return walk.truncated ? "relation-depth" : false;
+	}
+	let unavailable = false;
+	let deep = false;
+	const explored = /* @__PURE__ */ new Map();
+	for (const id of walk.ids) {
+		const verdict = holdsRelation({
+			resource: condition.resource,
+			id,
+			relation: condition.relation
+		}, principal.id, now, reader, 16, /* @__PURE__ */ new Set(), explored);
+		if (verdict === true) return true;
+		if (verdict === "relation-unavailable") unavailable = true;
+		else if (verdict === "relation-depth") deep = true;
+	}
+	if (unavailable) return "relation-unavailable";
+	return walk.truncated || deep ? "relation-depth" : false;
+}
+function resolveInherited(condition, permission, row, reader, permitted) {
+	const walk = relationWalk(condition, row, reader);
+	if (walk === void 0) return false;
+	if (walk === "relation-depth" || walk === "relation-unavailable") return walk;
+	if (permitted === void 0) return "relation-unavailable";
+	let unknown = false;
+	for (const id of walk.ids) {
+		const verdict = permitted(condition.resource, id, permission);
+		if (verdict === true) return true;
+		if (verdict !== false && unknown === false) unknown = verdict;
+	}
+	return unknown;
+}
+function groupKey(group) {
+	return JSON.stringify([
+		group.resource,
+		group.id,
+		group.relation
+	]);
+}
+/**
+* Whether the principal holds `at.relation` on one instance, directly or
+* through a group whose members hold it. Groups of `at`'s own resource nest
+* at most `budget` deep; a group of another resource gets a fresh budget
+* (declarations rule out cycles across resources). A group met twice on one
+* path, or one past the budget, is `relation-depth`. `explored` holds the
+* budget each group was walked with across the whole walk: a group already
+* walked with as much budget adds nothing, since its verdict already reached
+* the caller, so shared sub-groups cost one walk rather than one per path.
+*/
+function holdsRelation(at, principalId, now, reader, budget, seen, explored) {
+	const key = groupKey(at);
+	const walked = explored.get(key);
+	if (walked !== void 0 && walked >= budget) return false;
+	explored.set(key, budget);
+	const holders = reader.holders(at);
+	if (holders === "pending" || holders === "failed") return "relation-unavailable";
+	if (holders.some((holder) => holdsNow(holder, principalId, now))) return true;
+	const path = new Set(seen).add(key);
+	let unavailable = false;
+	let deep = false;
+	for (const holder of holders) {
+		if (!("group" in holder) || !activeNow(holder, now)) continue;
+		const nested = holder.group.resource === at.resource;
+		if (nested && budget <= 0 || path.has(groupKey(holder.group))) {
+			deep = true;
+			continue;
+		}
+		const verdict = holdsRelation(holder.group, principalId, now, reader, nested ? budget - 1 : 16, path, explored);
+		if (verdict === true) return true;
+		if (verdict === "relation-unavailable") unavailable = true;
+		else if (verdict === "relation-depth") deep = true;
+	}
+	if (unavailable) return "relation-unavailable";
+	return deep ? "relation-depth" : false;
+}
+//#endregion
+export { resolveRelated as n, relationWalk as t };