permdock 0.4.0 → 0.5.0

package/dist/src-Bb7no-hS.js

@@ -1,639 +0,0 @@
-import { r as isRecord, t as compact } from "./compact-CAf557ZB.js";
-import { n as freezeDeep } from "./freeze-CrU8nQeX.js";
-import { n as isThenable, s as ownGet } from "./thenable-QSmvt-vZ.js";
-import { _ as assertSqlFunctionName, g as assertSqlFunctionArg, h as assertPortableTwin, m as normalizeWhere } from "./role-builder-B4GbKM-i.js";
-import { d as scopeList, m as tenantOf } from "./scopes-tvpa34ep.js";
-import { r as snapshotGrant, t as buildSnapshot } from "./snapshot-Dc9CHPME.js";
-import { d as attachRegistry, i as getRegistry, n as findPermission, p as walk, r as formerByKey, t as assertKeys } from "./permission-registry-BsblpB-z.js";
-import { c as isEdgeRelation, m as restrictedStops, o as groupEntries, r as assertGraphTargets, s as isComputedRelation, u as isPrincipalRelation } from "./resource-relations-D1Un3pcz.js";
-import { _ as listPlans, o as flattenGrantee } from "./grantee-CXY-0C87.js";
-import { t as canonicalJson } from "./canonical-json-CFKyFOke.js";
-import { m as tenantsOf } from "./tenancy-DshjqY0n.js";
-import { a as declaredRoleNames, l as levelNames, s as grantList } from "./hosted-CBHgkzDl.js";
-import { n as sha256, t as bytesToBase64Url } from "./sha256-BO0swRXL.js";
-import { c as collectSnapshotGrants, l as rankRoles, m as ceilingGrants, n as resolveSubject, o as snapshotOf, s as snapshotScopes, u as usesAssigns, y as resolveCustomRole } from "./permdock-L26udHSk.js";
-import { n as relationId } from "./relations-CvmSpG67.js";
-import { n as LOCAL_CUSTOM_ROLE } from "./parse-local-manifest-C-q02Pal.js";
-//#region src/conditions/sql-function.ts
-function sqlFunction(name, options) {
-	assertSqlFunctionName(name);
-	const args = options.args ?? [];
-	for (const arg of args) assertSqlFunctionArg(arg);
-	const twin = normalizeWhere(options.twin);
-	assertPortableTwin(twin);
-	return freezeDeep({
-		op: "sqlFunction",
-		name,
-		args,
-		twin
-	});
-}
-//#endregion
-//#region src/core/memory-sources.ts
-function memoryEntitlementSource(entries) {
-	return { entitlementsFor(_principal, options) {
-		return options.tenant === void 0 ? [] : [...entries[options.tenant] ?? []];
-	} };
-}
-function memorySettings(settings) {
-	const byTenant = new Map(Object.entries(settings));
-	return Object.freeze({ settingsFor(tenant) {
-		return byTenant.get(tenant);
-	} });
-}
-/** Memberships keyed by principal id; `tenant` is not a filter, as for a database source. */
-function memoryMembershipSource(entries) {
-	const byPrincipal = new Map(Object.entries(entries));
-	return Object.freeze({
-		membershipsFor(principal) {
-			return [...byPrincipal.get(principal.id) ?? []];
-		},
-		list(query) {
-			const members = [];
-			for (const [id, memberships] of byPrincipal) for (const membership of memberships) if (membership.scope === query.scope && membership.id === query.id) members.push({
-				principal: { id },
-				membership
-			});
-			return members;
-		}
-	});
-}
-/** A snapshot held in memory; `set` replaces it and notifies every subscriber. */
-function memorySnapshotSource(initial) {
-	let current = initial;
-	const listeners = /* @__PURE__ */ new Set();
-	return Object.freeze({
-		get: () => current,
-		subscribe(listener) {
-			listeners.add(listener);
-			return () => {
-				listeners.delete(listener);
-			};
-		},
-		set(snapshot) {
-			current = snapshot;
-			for (const listener of listeners) listener();
-		}
-	});
-}
-function memoryRoleSource(customRoles) {
-	const byTenant = /* @__PURE__ */ new Map();
-	const global = [];
-	for (const role of customRoles) {
-		if (role.tenant === void 0) {
-			global.push(role);
-			continue;
-		}
-		const list = byTenant.get(role.tenant) ?? [];
-		list.push(role);
-		byTenant.set(role.tenant, list);
-	}
-	return {
-		rolesFor(tenant) {
-			return [...byTenant.get(tenant) ?? []];
-		},
-		globalRoles() {
-			return [...global];
-		}
-	};
-}
-//#endregion
-//#region src/core/stripe-entitlements.ts
-const PAGE = 100;
-const MAX_PAGES = 10;
-/**
-* Plan names from Stripe Entitlements: the `lookup_key` of every active
-* entitlement of the tenant's Stripe customer. `customer` maps the active
-* tenant to its customer id; no tenant or no customer means no entitlements.
-* Pass it as `entitlements`, and grant with `plan('<lookup_key>')`.
-*/
-function fromStripeEntitlements(options) {
-	return { async entitlementsFor(principal, query) {
-		if (query.tenant === void 0) return [];
-		const customer = await options.customer(query.tenant, principal);
-		if (customer === void 0 || customer === "") return [];
-		const keys = /* @__PURE__ */ new Set();
-		let after;
-		for (let page = 0; page < MAX_PAGES; page += 1) {
-			const result = await options.stripe.entitlements.activeEntitlements.list(after === void 0 ? {
-				customer,
-				limit: PAGE
-			} : {
-				customer,
-				limit: PAGE,
-				starting_after: after
-			});
-			for (const item of result.data) if (typeof item.lookup_key === "string" && item.lookup_key !== "") keys.add(item.lookup_key);
-			const last = result.data.at(-1);
-			if (!result.has_more || last === void 0) break;
-			after = last.id;
-		}
-		return [...keys].toSorted();
-	} };
-}
-//#endregion
-//#region src/core/memory-relations.ts
-/** The holders one edge-table row names for `spec`: none when the row does not belong to it. */
-function tableHolders(resourceName, spec, row, id) {
-	if (relationId(ownGet(row, spec.object ?? `${resourceName}_id`)) !== id) return [];
-	for (const [column, value] of Object.entries(spec.match ?? {})) if (ownGet(row, column) !== value) return [];
-	const expiresAt = spec.expiresAt === void 0 ? void 0 : seconds(ownGet(row, spec.expiresAt));
-	const period = expiresAt === void 0 ? {} : { expiresAt };
-	const groups = spec.groups;
-	const direct = relationId(ownGet(row, spec.subject ?? "user_id"));
-	if (groups === void 0) return direct === void 0 ? [] : [{
-		principal: { id: direct },
-		...period
-	}];
-	if (groups.column === void 0) {
-		const out = direct === void 0 ? [] : [{
-			principal: { id: direct },
-			...period
-		}];
-		for (const group of groupEntries(spec)) {
-			const groupId = relationId(ownGet(row, group.subject));
-			if (groupId !== void 0) out.push({
-				group: {
-					resource: group.resource,
-					id: groupId,
-					relation: group.relation
-				},
-				...period
-			});
-		}
-		return out;
-	}
-	const kind = ownGet(row, groups.column);
-	if (kind === null || kind === void 0 || kind === groups.direct) return direct === void 0 ? [] : [{
-		principal: { id: direct },
-		...period
-	}];
-	const group = groupEntries(spec).find((entry) => entry.resource === kind);
-	const groupId = group === void 0 ? void 0 : relationId(ownGet(row, group.subject));
-	return group === void 0 || groupId === void 0 ? [] : [{
-		group: {
-			resource: group.resource,
-			id: groupId,
-			relation: group.relation
-		},
-		...period
-	}];
-}
-function seconds(value) {
-	if (value instanceof Date) {
-		const time = value.getTime();
-		return Number.isNaN(time) ? void 0 : time / 1e3;
-	}
-	if (typeof value === "number" && Number.isFinite(value)) return value;
-	if (typeof value === "string") {
-		const parsed = Date.parse(value);
-		return Number.isNaN(parsed) ? void 0 : parsed / 1e3;
-	}
-}
-function restrictedOf(node, row) {
-	return node.restricted !== void 0 && row !== void 0 && ownGet(row, node.restricted) === true;
-}
-function edgeHolder(edge) {
-	const holder = { principal: { id: edge.principal } };
-	if (edge.startsAt !== void 0) holder.startsAt = edge.startsAt;
-	if (edge.expiresAt !== void 0) holder.expiresAt = edge.expiresAt;
-	return holder;
-}
-/**
-* An in-process `RelationSource` over plain rows and edges, read against the
-* resource definitions in `permissions`. For tests, fixtures and small apps.
-*/
-function memoryRelations(permissions, data = {}) {
-	const registry = getRegistry(permissions);
-	const byId = /* @__PURE__ */ new Map();
-	for (const [name, rows] of Object.entries(data.rows ?? {})) {
-		const node = registry.get(name);
-		const index = /* @__PURE__ */ new Map();
-		for (const row of rows) {
-			const id = relationId(ownGet(row, node?.id ?? "id"));
-			if (id !== void 0) index.set(id, row);
-		}
-		byId.set(name, index);
-	}
-	const rowOf = (resource, id) => byId.get(resource)?.get(id);
-	return {
-		row({ resource, id }) {
-			return rowOf(resource, id) ?? null;
-		},
-		ancestors({ resource, id, depth, through }) {
-			const node = registry.get(resource);
-			const start = rowOf(resource, id);
-			if (node === void 0 || start === void 0) return { ancestors: [] };
-			if (through !== "parent") {
-				const link = Object.hasOwn(node.links, through) ? node.links[through] : void 0;
-				const next = link === void 0 ? void 0 : relationId(ownGet(start, link.field));
-				if (next === void 0 || depth < 1) return { ancestors: [] };
-				return { ancestors: [{ id: next }] };
-			}
-			const restricted = restrictedOf(node, start);
-			const stops = restrictedStops(node, "parent");
-			if (restricted && stops || node.parent === void 0 || node.parent.resource !== resource) return restricted ? {
-				restricted: true,
-				ancestors: []
-			} : { ancestors: [] };
-			const field = node.parent.field;
-			const seen = /* @__PURE__ */ new Set([id]);
-			const ancestors = [];
-			let next = relationId(ownGet(start, field));
-			while (next !== void 0 && ancestors.length < depth) {
-				const row = rowOf(resource, next);
-				if (row === void 0) {
-					next = void 0;
-					break;
-				}
-				const hidden = restrictedOf(node, row);
-				ancestors.push(hidden ? {
-					id: next,
-					restricted: true
-				} : { id: next });
-				if (seen.has(next) || hidden && stops) {
-					next = void 0;
-					break;
-				}
-				seen.add(next);
-				next = relationId(ownGet(row, field));
-			}
-			const chain = restricted ? {
-				restricted: true,
-				ancestors
-			} : { ancestors };
-			return next === void 0 || rowOf(resource, next) === void 0 ? chain : {
-				...chain,
-				truncated: true
-			};
-		},
-		related({ resource, id, relation }) {
-			const spec = registry.get(resource)?.relations[relation];
-			if (spec === void 0 || isComputedRelation(spec)) return [];
-			if (isEdgeRelation(spec)) {
-				const table = data.tables?.[spec.edge];
-				if (table !== void 0) return table.flatMap((row) => tableHolders(resource, spec, row, id));
-				return (data.edges?.[resource]?.[relation] ?? []).filter((edge) => edge.id === id).map(edgeHolder);
-			}
-			const row = rowOf(resource, id);
-			if (row === void 0) return [];
-			if (isPrincipalRelation(spec)) {
-				const holder = relationId(ownGet(row, spec.principal));
-				if (holder === void 0) return [];
-				const startsAt = spec.period?.startsAt === void 0 ? void 0 : seconds(ownGet(row, spec.period.startsAt));
-				const expiresAt = spec.period?.expiresAt === void 0 ? void 0 : seconds(ownGet(row, spec.period.expiresAt));
-				return [{
-					principal: { id: holder },
-					...startsAt === void 0 ? {} : { startsAt },
-					...expiresAt === void 0 ? {} : { expiresAt }
-				}];
-			}
-			if (spec.memberOf !== void 0) return [];
-			const holder = relationId(ownGet(row, spec.field));
-			return holder === void 0 ? [] : [{ principal: { id: holder } }];
-		}
-	};
-}
-//#endregion
-//#region src/core/local-manifest.ts
-/** A relation grantee needs the relation graph, which a device does not hold: the grant decides on the server only. */
-function localGrant(grant) {
-	const relational = flattenGrantee(grant.to).some((item) => item.kind === "relation");
-	return snapshotGrant(relational ? {
-		...grant,
-		portable: false
-	} : grant, void 0);
-}
-function customTable(policy, scope, roles) {
-	const keys = [...new Set(ceilingGrants(policy, scope).map((grant) => grant.permission.key))];
-	if (keys.length === 0) return;
-	const resolve = (body) => resolveCustomRole(policy, scope === "global" ? {
-		name: LOCAL_CUSTOM_ROLE,
-		scope: "global",
-		...body
-	} : {
-		name: LOCAL_CUSTOM_ROLE,
-		tenant: LOCAL_CUSTOM_ROLE,
-		scope,
-		...body
-	}).grants.map(localGrant);
-	const permissions = {};
-	for (const key of keys) {
-		const leaf = findPermission(policy.permissions, key);
-		const names = leaf?.kind === "instance" ? levelNames(policy, leaf.resource) : [];
-		permissions[key] = compact({
-			all: resolve({ grants: [{ permission: key }] }),
-			levels: names.length === 0 ? void 0 : Object.fromEntries(names.map((level) => [level, resolve({ grants: [{
-				permission: key,
-				level
-			}] })]))
-		});
-	}
-	const includes = {};
-	for (const role of roles) {
-		const grants = resolve({ includes: [role] });
-		if (grants.length > 0) includes[role] = grants;
-	}
-	return {
-		permissions,
-		includes
-	};
-}
-/**
-* What the policy grants, as JSON a device turns into snapshots from its own
-* membership rows (`localSnapshot` in `permdock/react-native`). Write it at
-* build time; the policy itself never ships to the client.
-*/
-function localSnapshotManifest(policy) {
-	const roles = [...declaredRoleNames(policy)].toSorted();
-	const custom = {};
-	for (const scope of [...scopeList(policy.scopes).map((item) => item.name), "global"]) {
-		const table = customTable(policy, scope, roles);
-		if (table !== void 0) custom[scope] = table;
-	}
-	const scopes = snapshotScopes(policy);
-	const { vocabulary } = buildSnapshot({
-		subject: {
-			principal: null,
-			context: {}
-		},
-		roles: [],
-		grants: [],
-		vocabulary: policy.vocabulary
-	});
-	return freezeDeep(compact({
-		v: 1,
-		scopes,
-		vocabulary,
-		roles,
-		rank: usesAssigns(policy) ? rankRoles(policy, roles) : void 0,
-		grants: grantList(policy).map(localGrant),
-		custom
-	}));
-}
-//#endregion
-//#region src/core/may-access.ts
-function policyPlans(policy) {
-	const names = new Set(listPlans(policy.vocabulary?.plans).map((p) => p.key));
-	for (const grant of grantList(policy)) for (const item of flattenGrantee(grant.to)) if (item.kind === "plan") names.add(item.plan);
-	return [...names];
-}
-function heldRoleNames(principal) {
-	return [...principal.roles ?? [], ...(principal.memberships ?? []).flatMap((item) => item.roles)];
-}
-/**
-* An optimistic routing hint for a proxy or middleware, never a decision.
-* `false` only when the subject's declared roles provably lack `permission`;
-* `true` whenever custom roles, plans, memberships the claims do not carry or
-* row conditions could still grant it. Synchronous, no network, never throws.
-* Pages, Server Actions and RLS remain the enforcement points.
-*/
-function mayAccess(policy, user, permission, options = {}) {
-	try {
-		const resolved = resolveSubject(policy, user, compact({ tenant: options.tenant }), []);
-		if (isThenable(resolved)) return true;
-		const principal = resolved.principal;
-		const relevant = policy.index.grantsByKey.get(permission.key) ?? [];
-		if (principal !== null) {
-			const declared = declaredRoleNames(policy);
-			if (heldRoleNames(principal).some((name) => !declared.has(name))) return true;
-			if ((principal.memberships ?? []).length === 0 && relevant.some((grant) => grant.scope !== "global")) return true;
-		}
-		const tenant = options.tenant;
-		const subject = principal === null ? resolved : {
-			...resolved,
-			principal: {
-				...principal,
-				plans: policyPlans(policy),
-				memberships: (principal.memberships ?? []).filter((item) => {
-					const owner = tenantOf(item, scopeList(policy.scopes));
-					return tenant === void 0 || owner === void 0 || owner === tenant;
-				})
-			}
-		};
-		const matched = collectSnapshotGrants(policy, subject, []).filter((item) => item.grant.permission.key === permission.key);
-		if (matched.some((item) => item.grant.effect === "deny" && item.grant.where === void 0 && item.grant.check === void 0 && item.grant.portable)) return false;
-		return matched.some((item) => item.grant.effect === "allow");
-	} catch {
-		return true;
-	}
-}
-//#endregion
-//#region src/core/custom-role-source.ts
-function ofTenant(tenant, roles) {
-	return Array.isArray(roles) ? roles.filter((role) => role !== null && typeof role === "object" && Reflect.get(role, "tenant") === tenant) : [];
-}
-/**
-* A `RoleSource` over a reader that returns every custom role of a tenant.
-* It keeps only the roles of the requested tenant. With `read: 'held'` it
-* skips a tenant's read, and `globalRoles`, when the subject holds only
-* declared roles there.
-*/
-function customRoleSource(reader, options = {}) {
-	const declared = options.read === "held" ? declaredRoleNames(options.policy) : void 0;
-	return Object.freeze({
-		rolesFor(tenant, context) {
-			if (declared !== void 0 && context?.held.every((name) => declared.has(name)) === true) return [];
-			const roles = reader.rolesOf(tenant);
-			return isThenable(roles) ? roles.then((list) => ofTenant(tenant, list)) : ofTenant(tenant, roles);
-		},
-		...reader.assignable === void 0 ? {} : { assignable: (tenant) => reader.assignable?.(tenant) ?? [] },
-		...reader.globalRoles === void 0 ? {} : { globalRoles: (context) => declared !== void 0 && context?.held.every((name) => declared.has(name)) === true ? [] : reader.globalRoles?.() ?? [] }
-	});
-}
-//#endregion
-//#region src/core/snapshot-for.ts
-function withPlans(subject, plans) {
-	if (plans === void 0 || subject.principal === null) return subject;
-	return freezeDeep(compact({
-		...subject,
-		principal: compact({
-			...subject.principal,
-			plans: [...plans]
-		})
-	}));
-}
-/**
-* Builds the serializable access snapshot for a subject without a request,
-* a network call or a cache directive: call it inside the app's own
-* `'use cache: private'` function. Synchronous; the policy's `subject` and
-* `context` mappers must be synchronous too.
-*/
-function snapshotFor(policy, user, options = {}) {
-	const auth = [];
-	const memberships = options.memberships;
-	const resolved = resolveSubject(policy, user, compact({
-		tenant: options.tenant,
-		memberships: memberships === void 0 ? void 0 : { membershipsFor: () => [...memberships] }
-	}), auth);
-	if (isThenable(resolved)) throw new TypeError("PermDock: snapshotFor() needs synchronous subject and context mappers. Resolve async data first and pass it as a Subject, or use createPermDock(...).snapshot().");
-	const subject = withPlans(resolved, options.plans);
-	const tenants = new Set(tenantsOf(subject.principal, scopeList(policy.scopes)));
-	const customRoles = (options.customRoles ?? []).filter((item) => item.scope === "global" || item.tenant !== void 0 && tenants.has(item.tenant));
-	const names = options.assignable;
-	const assignable = names === void 0 ? void 0 : new Map([...tenants].map((tenant) => [tenant, Object.hasOwn(names, tenant) ? names[tenant] ?? [] : []]));
-	return snapshotOf(policy, subject, compact({
-		customRoles,
-		assignable,
-		include: options.include,
-		tenants: options.tenants,
-		now: options.now
-	}));
-}
-//#endregion
-//#region src/core/permissions.ts
-function definePermissions(input, options) {
-	const registry = /* @__PURE__ */ new Map();
-	const leaves = [];
-	const former = formerByKey(options?.renamed);
-	const tree = walk(input, [], registry, leaves, 0, {
-		former,
-		x: options?.x
-	});
-	assertKeys(leaves, former);
-	assertGraphTargets(registry);
-	return freezeDeep(attachRegistry(tree, registry, leaves));
-}
-//#endregion
-//#region src/core/presets.ts
-const CRUD_ACTIONS = {
-	read: { readOnly: true },
-	update: {},
-	delete: { destructive: true }
-};
-const CRUD_COLLECTION = {
-	create: {},
-	list: { readOnly: true }
-};
-const READABLE_ACTIONS = { read: { readOnly: true } };
-const READABLE_COLLECTION = { list: { readOnly: true } };
-const WRITABLE_ACTIONS = {
-	read: { readOnly: true },
-	update: {}
-};
-const WRITABLE_COLLECTION = {};
-function isNameList(list) {
-	return Array.isArray(list);
-}
-function toRecord(list) {
-	if (list === void 0) return {};
-	if (isNameList(list)) {
-		const out = {};
-		for (const name of list) out[name] = {};
-		return out;
-	}
-	return { ...list };
-}
-function mergeMeta(base, extra) {
-	return compact({
-		title: extra.title ?? base.title,
-		description: extra.description ?? base.description,
-		tags: extra.tags ?? base.tags,
-		readOnly: extra.readOnly ?? base.readOnly,
-		destructive: extra.destructive ?? base.destructive,
-		idempotent: extra.idempotent ?? base.idempotent
-	});
-}
-function mergeActionLists(base, extra) {
-	const extraRecord = toRecord(extra);
-	const out = {};
-	for (const [name, baseMeta] of Object.entries(base)) {
-		const extraMeta = extraRecord[name];
-		out[name] = extraMeta === void 0 ? baseMeta : mergeMeta(baseMeta, extraMeta);
-	}
-	for (const [name, extraMeta] of Object.entries(extraRecord)) {
-		if (Object.hasOwn(out, name)) continue;
-		out[name] = extraMeta;
-	}
-	return freezeDeep(out);
-}
-function finishPreset(baseActions, baseCollection, options) {
-	const actions = mergeActionLists(baseActions, options?.actions);
-	const collection = mergeActionLists(baseCollection, options?.collection);
-	return compact({
-		id: options?.id,
-		parent: options?.parent,
-		relations: options?.relations,
-		restricted: options?.restricted,
-		disclosure: options?.disclosure,
-		actions,
-		collection: Object.keys(collection).length === 0 ? void 0 : collection
-	});
-}
-function crud(options) {
-	return finishPreset(CRUD_ACTIONS, CRUD_COLLECTION, options);
-}
-function readable(options) {
-	return finishPreset(READABLE_ACTIONS, READABLE_COLLECTION, options);
-}
-function writable(options) {
-	return finishPreset(WRITABLE_ACTIONS, WRITABLE_COLLECTION, options);
-}
-//#endregion
-//#region src/core/csv.ts
-/** The CSV export columns, in order; the header row of every CSV file. */
-const CSV_COLUMNS = Object.freeze([
-	"time",
-	"principal",
-	"actor",
-	"tenant",
-	"permission",
-	"outcome",
-	"matched.role",
-	"via",
-	"denials.reason",
-	"token"
-]);
-function field(value) {
-	const text = value ?? "";
-	return /[",\r\n]/u.test(text) ? `"${text.replaceAll("\"", "\"\"")}"` : text;
-}
-/**
-* One RFC 4180 row for a decision or approval event, without a line
-* terminator; join rows with CRLF under a `CSV_COLUMNS` header.
-*/
-function toCsvRow(event) {
-	return [
-		event.at,
-		event.subject.principal?.id,
-		event.subject.actor?.id,
-		event.tenant,
-		event.permission,
-		event.outcome,
-		event.matched?.role,
-		event.via,
-		event.denials?.map((denial) => denial.reason).join(";"),
-		event.token
-	].map(field).join(",");
-}
-//#endregion
-//#region src/core/catalog-fingerprint.ts
-const OMITTED_TOP_LEVEL = /* @__PURE__ */ new Set([
-	"generatedAt",
-	"generator",
-	"fingerprint"
-]);
-function fingerprintInput(catalog) {
-	const out = {};
-	for (const [key, value] of Object.entries(catalog)) {
-		if (OMITTED_TOP_LEVEL.has(key)) continue;
-		out[key] = key === "permissions" && Array.isArray(value) ? value.map((permission) => {
-			if (!isRecord(permission)) return permission;
-			const { usages: _usages, ...rest } = permission;
-			return rest;
-		}) : value;
-	}
-	return out;
-}
-/**
-* The catalog v1 fingerprint: base64url SHA-256 of canonical JSON (keys
-* sorted, no whitespace) without `generatedAt`, `generator`, `fingerprint`
-* and every `permissions[].usages`, so neither the CLI version, the clock nor
-* call sites change it.
-*/
-function catalogFingerprint(catalog) {
-	if (!isRecord(catalog)) throw new TypeError("PermDock: a catalog must be an object");
-	return bytesToBase64Url(sha256(canonicalJson(fingerprintInput(catalog))));
-}
-//#endregion
-export { memorySettings as _, readable as a, snapshotFor as c, localSnapshotManifest as d, memoryRelations as f, memoryRoleSource as g, memoryMembershipSource as h, crud as i, customRoleSource as l, memoryEntitlementSource as m, CSV_COLUMNS as n, writable as o, fromStripeEntitlements as p, toCsvRow as r, definePermissions as s, catalogFingerprint as t, mayAccess as u, memorySnapshotSource as v, sqlFunction as y };

package/dist/subject-C6dLxqHU.js

@@ -1,24 +0,0 @@
-//#region src/core/subject.ts
-function isPrincipal(value) {
-	if (value === null || typeof value !== "object" || Array.isArray(value)) return false;
-	if ("principal" in value && "context" in value) return false;
-	const record = value;
-	if (typeof record.id !== "string") return false;
-	return Array.isArray(record.roles) || Array.isArray(record.memberships) || record.kind === "user" || record.kind === "service" || record.kind === "workload" || record.kind === "link" || typeof record.issuer === "string";
-}
-function isSubject(value) {
-	return value !== null && typeof value === "object" && "principal" in value && "context" in value && typeof value.context === "object";
-}
-function isActor(value) {
-	if (value === null || typeof value !== "object" || Array.isArray(value)) return false;
-	const record = value;
-	return typeof record.id === "string" && typeof record.kind === "string";
-}
-function anonymousSubject(context = {}) {
-	return Object.freeze({
-		principal: null,
-		context: Object.freeze({ ...context })
-	});
-}
-//#endregion
-export { isSubject as i, isActor as n, isPrincipal as r, anonymousSubject as t };