permdock 0.4.0 → 0.5.0

package/dist/policies-CO1oOymN.js

@@ -0,0 +1,295 @@
+import { a as sole } from "./compact-CAf557ZB.js";
+import { i as configError, n as CliError } from "./errors-CWTY6uih.js";
+import { i as requirePeer } from "./peer-C8swJ2GH.js";
+import { M as qualified, _ as subjectClaimJsonSql } from "./shared-CD11nBbC.js";
+//#region src/cli/pg.ts
+const CONNECT_TIMEOUT_MS = 1e4;
+const STATEMENT_TIMEOUT_MS = 6e4;
+function loadPg(command, cwd) {
+	return requirePeer(() => import("pg"), "pg", command, cwd);
+}
+function options(db) {
+	return {
+		connectionString: db,
+		connectionTimeoutMillis: CONNECT_TIMEOUT_MS,
+		statement_timeout: STATEMENT_TIMEOUT_MS
+	};
+}
+function unreachable(command, cause) {
+	return new CliError("unavailable", `PermDock CLI: ${command.replace(/^permdock /u, "")} could not connect`, {
+		cause,
+		code: "database_unreachable"
+	});
+}
+/** The default `connect` of a command: one connection, failing with a message that names `command`. */
+function pgConnector(command, cwd = process.cwd()) {
+	return (db) => connectPg(db, command, cwd);
+}
+/** One connection, for commands that run a transaction. */
+async function connectPg(db, command, cwd) {
+	const client = new (await (loadPg(command, cwd))).Client(options(db));
+	try {
+		await client.connect();
+	} catch (cause) {
+		throw unreachable(command, cause);
+	}
+	return {
+		query: (sql, values) => client.query(sql, values),
+		end: () => client.end()
+	};
+}
+/** A small pool, for independent catalog reads that can run in parallel. */
+async function connectPgPool(db, command, cwd = process.cwd()) {
+	const pool = new (await (loadPg(command, cwd))).Pool({
+		...options(db),
+		max: 4
+	});
+	try {
+		(await pool.connect()).release();
+	} catch (cause) {
+		await pool.end();
+		throw unreachable(command, cause);
+	}
+	return {
+		query: (sql, values) => pool.query(sql, values),
+		end: () => pool.end()
+	};
+}
+//#endregion
+//#region src/cli/sql/clauses.ts
+/** True when `sql` is one parenthesised expression, so AND / OR need not wrap it again. */
+function isWrapped(sql) {
+	if (!sql.startsWith("(") || !sql.endsWith(")")) return false;
+	let depth = 0;
+	let quoted = false;
+	for (let index = 0; index < sql.length; index += 1) {
+		const ch = sql[index];
+		if (ch === "'") quoted = !quoted;
+		else if (!quoted && ch === "(") depth += 1;
+		else if (!quoted && ch === ")") {
+			depth -= 1;
+			if (depth === 0 && index < sql.length - 1) return false;
+		}
+	}
+	return depth === 0;
+}
+function wrapSql(sql) {
+	return isWrapped(sql) ? sql : `(${sql})`;
+}
+/**
+* The grant's `validFrom` / `validUntil` as a clock check: `from` inclusive,
+* `until` exclusive, matching the in-process evaluator.
+*/
+function validitySql(validity) {
+	if (validity === void 0) return;
+	return andSql(validity.from === void 0 ? void 0 : `now() >= to_timestamp(${validity.from})`, validity.until === void 0 ? void 0 : `now() < to_timestamp(${validity.until})`);
+}
+function andSql(...parts) {
+	const present = parts.filter((part) => part !== void 0 && part !== "true");
+	if (present.length === 0) return;
+	return present.length === 1 ? present[0] : present.map(wrapSql).join(" and ");
+}
+/** `USING` and `WITH CHECK` for a branch: its access check ANDed with its row conditions. */
+function branchClauses(branch) {
+	const using = branch.command === "insert" ? void 0 : andSql(branch.access, branch.using) ?? "true";
+	const check = branch.command === "insert" || branch.command === "update" ? andSql(branch.access, branch.check) ?? "true" : void 0;
+	return {
+		...using === void 0 ? {} : { using },
+		...check === void 0 ? {} : { check }
+	};
+}
+//#endregion
+//#region src/cli/rls/policies.ts
+/** Each database role gets its own policy, so no role sees two permissive policies for one command. */
+const AUDIENCES = ["authenticated", "anon"];
+const DEFAULT_POLICY_NAME = "{table}_{op}";
+const DEFAULT_PER_ROLE_NAME = "{role}_{permission}";
+const PLACEHOLDER = /\{(table|op|role|permission)\}/gu;
+function sanitize(name) {
+	return name.replaceAll(/[^A-Za-z0-9_]/g, "_");
+}
+function render(template, values) {
+	return sanitize(template.replaceAll(PLACEHOLDER, (_match, key) => values[key]));
+}
+/** Rejects a template that cannot name every policy of the chosen shape uniquely. */
+function assertPolicyName(template, perRole) {
+	if (!perRole && /\{(role|permission)\}/u.test(template)) throw configError("PermDock CLI: --policy-name {role} and {permission} need --policy-per-role; a collapsed policy covers several roles");
+	if (!perRole && !(template.includes("{table}") && template.includes("{op}"))) throw configError("PermDock CLI: --policy-name needs {table} and {op} so each table and command gets its own policy");
+}
+function orSql(parts) {
+	const distinct = [...new Set(parts)];
+	if (distinct.includes("true")) return "true";
+	return sole(distinct) ?? distinct.map(wrapSql).join(" or ");
+}
+function negate(sql) {
+	return sql === void 0 ? void 0 : `(${sql}) is not true`;
+}
+function policyOf(name, branch, using, check) {
+	const deny = branch.effect === "deny";
+	const policy = {
+		name,
+		table: branch.table,
+		command: branch.command,
+		effect: branch.effect,
+		roles: branch.roles
+	};
+	const finalUsing = deny ? negate(using) : using;
+	const finalCheck = deny ? negate(check) : check;
+	if (finalUsing !== void 0) policy.using = finalUsing;
+	if (finalCheck !== void 0) policy.check = finalCheck;
+	return policy;
+}
+function uniqueName(names, name) {
+	const seen = names.get(name) ?? 0;
+	names.set(name, seen + 1);
+	return seen === 0 ? name : `${name}_${seen + 1}`;
+}
+function perRolePolicies(branches, template) {
+	const names = /* @__PURE__ */ new Map();
+	return branches.map((branch) => {
+		const clauses = branchClauses(branch);
+		const deny = branch.effect === "deny";
+		const base = render(template, {
+			table: branch.table,
+			op: branch.command,
+			role: branch.label,
+			permission: branch.permissionKey
+		});
+		const name = `${deny ? "deny_" : ""}${base}${branch.coverage === true ? "_select_coverage" : ""}`;
+		return policyOf(uniqueName(names, name), branch, clauses.using, clauses.check);
+	});
+}
+/**
+* Branches of one grant-key group share their row condition, so the group
+* becomes one OR branch whose access ORs the helper calls of each scope.
+*/
+function mergeGroups(branches) {
+	const merged = [];
+	const byKey = /* @__PURE__ */ new Map();
+	for (const branch of branches) {
+		const id = branch.grantKey === void 0 ? void 0 : `${branch.table}\u0000${branch.command}\u0000${branch.grantKey}\u0000${branch.coverage === true}`;
+		const entry = id === void 0 ? void 0 : byKey.get(id);
+		if (entry === void 0) {
+			const created = {
+				branch,
+				accesses: branch.access === void 0 ? [] : [branch.access]
+			};
+			if (id !== void 0) byKey.set(id, created);
+			merged.push(created);
+			continue;
+		}
+		if (branch.access !== void 0 && !entry.accesses.includes(branch.access)) entry.accesses.push(branch.access);
+	}
+	return merged.map(({ branch, accesses }) => accesses.length <= 1 ? branch : withAccess(branch, orSql(accesses)));
+}
+function withAccess(branch, access) {
+	return {
+		...branch,
+		access
+	};
+}
+function collapsedPolicies(branches, template) {
+	const groups = /* @__PURE__ */ new Map();
+	for (const branch of mergeGroups(branches)) {
+		const id = `${branch.table}\u0000${branch.command}\u0000${branch.effect}`;
+		groups.set(id, [...groups.get(id) ?? [], branch]);
+	}
+	const names = /* @__PURE__ */ new Map();
+	return [...groups.values()].flatMap((group) => AUDIENCES.flatMap((audience) => {
+		const members = group.filter((branch) => branch.roles.includes(audience));
+		const [first] = members;
+		if (first === void 0) return [];
+		const deny = first.effect === "deny";
+		const clauses = members.map(branchClauses);
+		const usings = clauses.flatMap((item) => item.using === void 0 ? [] : [item.using]);
+		const checks = clauses.flatMap((item) => item.check === void 0 ? [] : [item.check]);
+		const base = render(template, {
+			table: first.table,
+			op: first.command,
+			role: first.label,
+			permission: first.permissionKey
+		});
+		return [policyOf(uniqueName(names, `${deny ? "deny_" : ""}${base}${audience === "anon" ? "_anon" : ""}`), {
+			...first,
+			roles: [audience]
+		}, usings.length === 0 ? void 0 : orSql(usings), checks.length === 0 ? void 0 : orSql(checks))];
+	}));
+}
+/**
+* Assembles policies. The default is one PERMISSIVE policy per table,
+* command and database role (Splinter `multiple_permissive_policies` stays
+* quiet), with denies in one RESTRICTIVE policy per table, command and role.
+*/
+function assemblePolicies(branches, shape) {
+	const template = shape.name ?? (shape.perRole ? DEFAULT_PER_ROLE_NAME : DEFAULT_POLICY_NAME);
+	assertPolicyName(template, shape.perRole);
+	return shape.perRole ? perRolePolicies(branches, template) : collapsedPolicies(branches, template);
+}
+const DEFAULT_READ_ONLY_ACTORS = ["support", "impersonation"];
+const ACTOR_KIND = /^[a-z][a-z0-9_-]*$/u;
+/** The actor kinds `rls.readOnlyActors` names, or `undefined` when it is off. */
+function readOnlyActorKinds(setting) {
+	if (setting === void 0 || setting === false) return;
+	const kinds = setting === true ? DEFAULT_READ_ONLY_ACTORS : setting;
+	if (kinds.length === 0 || kinds.some((kind) => !ACTOR_KIND.test(kind))) throw configError("PermDock CLI: rls.readOnlyActors must be true or a non-empty list of actor kinds such as 'support'");
+	return [...new Set(kinds)];
+}
+/** `permdock_actor_may_write()`, for hand-written write policies. Names are part of the SQL contract. */
+const ACTOR_MAY_WRITE = "permdock_actor_may_write";
+/**
+* True unless the token's `act` claim (`act`, as SQL `jsonb`) is a session
+* of one of `kinds` that is not `read_only: false`, or an agent with
+* `read_only: true` (agents default to writable, as better-supabase reads them).
+*/
+function readOnlyActorPasses(act, kinds) {
+	const list = `array[${kinds.map((kind) => `'${kind}'`).join(", ")}]::text[]`;
+	const passes = `(not coalesce(${kinds.includes("support") ? `(${act} ->> 'kind') = any(${list}) or ((${act} ->> 'kind') is null and ${act} ? 'session_id')` : `(${act} ->> 'kind') = any(${list})`}, false) or coalesce((${act} ->> 'read_only') = 'false', false))`;
+	return kinds.includes("agent") ? passes : `${passes} and not coalesce((${act} ->> 'kind') = 'agent' and (${act} ->> 'read_only') = 'true', false)`;
+}
+/**
+* `permdock_actor_may_write()`: {@link readOnlyActorPasses} as a function, so
+* hand-written write policies apply the same read-only default.
+*/
+function actorMayWriteSql(ctx, kinds) {
+	const fn = qualified(ctx, ACTOR_MAY_WRITE);
+	return `-- rls.readOnlyActors: false for a token whose act claim is a read-only ${kinds.join(" or ")} session; hand-written write policies call it
+create or replace function ${fn}()
+returns boolean
+language sql
+stable
+set search_path = ''
+as $$
+  select ${readOnlyActorPasses(subjectClaimJsonSql(ctx, "act"), kinds)}
+$$;
+revoke execute on function ${fn}() from public, anon;
+grant execute on function ${fn}() to authenticated;
+`;
+}
+/**
+* One restrictive policy per table and write command the allow policies
+* grant to `authenticated`: the write passes unless the token's `act` claim
+* (`act`, as SQL `jsonb`) is a session of one of `kinds` that is not
+* `read_only: false`. Reads are never touched.
+*/
+function readOnlyActorPolicies(policies, act, kinds) {
+	const passes = readOnlyActorPasses(act, kinds);
+	const seen = /* @__PURE__ */ new Set();
+	const out = [];
+	for (const policy of policies) {
+		const key = `${policy.table}\u0000${policy.command}`;
+		if (policy.effect !== "allow" || policy.command === "select" || !policy.roles.includes("authenticated") || seen.has(key)) continue;
+		seen.add(key);
+		out.push({
+			name: sanitize(`${policy.table}_${policy.command}_read_only_actors`),
+			table: policy.table,
+			command: policy.command,
+			effect: "deny",
+			roles: ["authenticated"],
+			...policy.command === "insert" ? {} : { using: passes },
+			...policy.command === "delete" ? {} : { check: passes }
+		});
+	}
+	return out;
+}
+//#endregion
+export { readOnlyActorKinds as a, branchClauses as c, connectPgPool as d, pgConnector as f, orSql as i, validitySql as l, actorMayWriteSql as n, readOnlyActorPolicies as o, assemblePolicies as r, andSql as s, ACTOR_MAY_WRITE as t, wrapSql as u };

package/dist/{policy-ur0BBK_e.d.ts → policy-Czo4n3Hs.d.ts}

@@ -1,5 +1,5 @@
-import { E as Policy, Or as Principal, kr as Subject } from "./policy-types-sp9P1iIV.js";
-import { c as saasPlans, l as saasRoles, s as saasPermissions } from "./permissions-COH-KRgT.js";
+import { T as Policy, ir as Subject, rr as Principal } from "./policy-types-DzwivBgR.js";
+import { c as saasPlans, l as saasRoles, s as saasPermissions } from "./permissions-oEWfl-kl.js";
 //#region src/testing/saas/policy.d.ts
 /** Daily API-key quota per subject; the bucket should be per tenant too. */
 declare const SAAS_API_KEY_LIMIT = 5;

package/dist/{hosted-CBHgkzDl.js → policy-DLZJ5gAp.js}

@@ -1,17 +1,16 @@
-import { r as isRecord, t as compact } from "./compact-CAf557ZB.js";
+import { t as compact } from "./compact-CAf557ZB.js";
 import { n as freezeDeep } from "./freeze-CrU8nQeX.js";
-import { o as isForbiddenKey, u as splitPath } from "./thenable-QSmvt-vZ.js";
-import { a as deny, c as withGrantSchema, d as assertApprovalRelations, f as assertApprovalVersions, i as completeGrant, m as normalizeWhere, n as role, o as flattenGrants, r as allow, s as flattenPermissions } from "./role-builder-B4GbKM-i.js";
-import { n as defineScopes, o as resolveScope } from "./scopes-tvpa34ep.js";
-import { t as parseDuration } from "./duration-xK2jGFVc.js";
-import { a as getResource, c as listPermissions, i as getRegistry, m as annotationsFor, n as findPermission, s as isRegistryTree } from "./permission-registry-BsblpB-z.js";
-import { d as isSelfParented, l as isFieldRelation } from "./resource-relations-D1Un3pcz.js";
-import { _ as listPlans, m as findRole, o as flattenGrantee, r as asGrantee, v as listRoles } from "./grantee-CXY-0C87.js";
-import { n as normalizeValidity } from "./validity-dVrUEPJt.js";
-import { t as canonicalJson } from "./canonical-json-CFKyFOke.js";
-import { a as relationStart, i as relationHops, n as isGraphRelation, t as inheritCondition } from "./grantee-conditions-MQs5NIuX.js";
-import { a as memberOfFields, p as scopeField, u as relatesTo } from "./tenancy-DshjqY0n.js";
-import { n as sha256, t as bytesToBase64Url } from "./sha256-BO0swRXL.js";
+import { c as withGrantSchema, d as assertApprovalVersions, i as completeGrant, o as flattenGrants, p as normalizeWhere, s as flattenPermissions, u as assertApprovalRelations } from "./role-builder-CXbis5-X.js";
+import { c as listPermissions, i as getRegistry, m as annotationsFor, n as findPermission, s as isRegistryTree } from "./permission-registry-Br4jSNVi.js";
+import { d as isSelfParented, l as isFieldRelation } from "./resource-relations-D_jw0BFx.js";
+import { t as canonicalJson } from "./canonical-json-BC8_nMTw.js";
+import { r as sha256Digest } from "./sha256-D9ihqmvd.js";
+import { n as defineScopes, o as resolveScope } from "./scopes-CUPSjo9q.js";
+import { o as flattenGrantee, r as asGrantee, v as listRoles } from "./grantee-Cn1HyUsI.js";
+import { n as normalizeValidity } from "./validity-CZ7-y0Cj.js";
+import { a as relationStart, i as relationHops, n as isGraphRelation, t as inheritCondition } from "./grantee-conditions-CcXf8hMM.js";
+import { a as memberOfFields, p as scopeField, u as relatesTo } from "./tenancy-DN2QAx9z.js";
+import { t as byCodePoint } from "./compare-pfyVnBjE.js";
 //#region src/core/policy-assertions.ts
 function assertParentGraph(resources) {
 	for (const node of resources.values()) {
@@ -179,7 +178,7 @@ function normalizeOAuthScopes(input, tree) {
 			leaves.set(leaf.key, leaf);
 		}
 		if (leaves.size === 0) throw new Error(`PermDock: oauthScopes '${scope}' covers no permission`);
-		const sorted = [...leaves.values()].toSorted((a, b) => a.key.localeCompare(b.key));
+		const sorted = [...leaves.values()].toSorted((a, b) => byCodePoint(a.key, b.key));
 		return {
 			scope,
 			permissions: sorted.map((leaf) => leaf.key),
@@ -307,8 +306,8 @@ function mergeBindings(items) {
 function definePolicy(permissions, options) {
 	const vocabulary = isVocabularyInput(permissions) ? permissions : { permissions };
 	const tree = vocabulary.permissions;
-	const mapper = options.principal ?? options.subject;
-	if (mapper === void 0) throw new Error("PermDock: definePolicy requires principal or subject");
+	const mapper = options.subject;
+	if (typeof mapper !== "function") throw new TypeError("PermDock: definePolicy requires a subject function");
 	const resources = getRegistry(tree);
 	assertParentGraph(resources);
 	const scopes = defineScopes(options.scopes);
@@ -336,7 +335,7 @@ function definePolicy(permissions, options) {
 	const delegations = (options.delegations ?? []).map((item, index) => normalizeDelegation(item, index, tree));
 	const levels = normalizeLevels(resources);
 	const oauthScopes = normalizeOAuthScopes(options.oauthScopes, tree);
-	const fingerprint = bytesToBase64Url(sha256(oauthScopes.length === 0 ? canonicalPolicy(grants, delegations, levels) : `${canonicalPolicy(grants, delegations, levels)}\noauthScopes:${canonicalJson(oauthScopes)}`));
+	const fingerprint = sha256Digest(oauthScopes.length === 0 ? canonicalPolicy(grants, delegations, levels) : `${canonicalPolicy(grants, delegations, levels)}\noauthScopes:${canonicalJson(oauthScopes)}`);
 	const hostable = [...new Set((options.hostable ?? []).flatMap((item) => flattenPermissions(item).map((leaf) => leaf.key)))].toSorted();
 	const fresh = [...new Set((options.fresh ?? []).flatMap((item) => flattenPermissions(item).map((leaf) => leaf.key)))].toSorted();
 	return freezeDeep({
@@ -397,259 +396,4 @@ function separationConflicts(policy, memberships) {
 	return conflicts;
 }
 //#endregion
-//#region src/core/hosted.ts
-function memoryPolicySource(document = null) {
-	const current = document === null ? null : parsePolicyDocument(document);
-	return Object.freeze({
-		current: () => current,
-		refresh: () => Promise.resolve()
-	});
-}
-function rejectUnsafe(value) {
-	if (value === null || typeof value !== "object") return;
-	if (Array.isArray(value)) {
-		for (const item of value) rejectUnsafe(item);
-		return;
-	}
-	for (const key of Object.keys(value)) {
-		if (isForbiddenKey(key)) throw new Error(`PermDock: unsafe policy document key '${key}'`);
-		rejectUnsafe(value[key]);
-	}
-}
-/** Validates the document envelope; per-grant checks happen at merge time. */
-function parsePolicyDocument(json) {
-	const input = typeof json === "string" ? JSON.parse(json) : json;
-	if (!isRecord(input)) throw new TypeError("PermDock: policy document must be an object");
-	const copy = JSON.parse(JSON.stringify(input));
-	rejectUnsafe(copy);
-	if (copy["v"] !== 1) throw new Error(`PermDock: unsupported policy document version '${String(copy["v"])}'`);
-	if (typeof copy["id"] !== "string" || typeof copy["fingerprint"] !== "string" || typeof copy["catalog"] !== "string" || typeof copy["issuedAt"] !== "number" || !Array.isArray(copy["grants"])) throw new TypeError("PermDock: malformed policy document");
-	return freezeDeep(copy);
-}
-const COMPARISONS = /* @__PURE__ */ new Set([
-	"eq",
-	"ne",
-	"gt",
-	"gte",
-	"lt",
-	"lte",
-	"contains"
-]);
-function safePath(path) {
-	if (typeof path !== "string" || path.length === 0) return false;
-	return splitPath(path).every((segment) => !isForbiddenKey(segment));
-}
-function portableValue(value) {
-	if (value === null || typeof value === "string" || typeof value === "boolean" || typeof value === "number" && Number.isFinite(value)) return true;
-	if (Array.isArray(value)) return value.every(portableValue);
-	if (!isRecord(value)) return false;
-	const keys = Object.keys(value);
-	if (keys.length !== 1) return false;
-	if (keys[0] === "ref") return safePath(value["ref"]);
-	return keys[0] === "date" && typeof value["date"] === "string";
-}
-/** True for the portable subset only: no `opaque`, no `sqlFunction`, no unknown op. */
-function isPortableCondition(value) {
-	if (!isRecord(value) || typeof value["op"] !== "string") return false;
-	const op = value["op"];
-	if (COMPARISONS.has(op)) return safePath(value["field"]) && portableValue(value["value"]);
-	switch (op) {
-		case "in":
-		case "notIn": return safePath(value["field"]) && (Array.isArray(value["value"]) || isRecord(value["value"])) && portableValue(value["value"]);
-		case "isNull": return safePath(value["field"]) && typeof value["value"] === "boolean";
-		case "and":
-		case "or": return Array.isArray(value["conditions"]) && value["conditions"].every(isPortableCondition);
-		case "not": return isPortableCondition(value["condition"]);
-		case "memberOf": return (value["scope"] === "tenant" || value["scope"] === "team" || value["scope"] === "resource") && safePath(value["field"]) && Array.isArray(value["roles"]) && value["roles"].every((item) => typeof item === "string") && (value["resource"] === void 0 || typeof value["resource"] === "string") && (value["parents"] === void 0 || Array.isArray(value["parents"]) && value["parents"].every((parent) => safePath(parent) || isRecord(parent) && safePath(parent["field"]) && typeof parent["resource"] === "string"));
-		default: return false;
-	}
-}
-function approvalRank(approval) {
-	if (approval === void 0) return;
-	if (approval === "human") return {
-		distinct: true,
-		stale: false,
-		quorum: 1,
-		ttl: Number.POSITIVE_INFINITY,
-		escalates: false
-	};
-	return {
-		by: approval.stages === void 0 ? JSON.stringify(approval.by) : JSON.stringify([approval.mode, approval.stages]),
-		distinct: approval.distinct !== false,
-		stale: approval.staleOn === "resource-change",
-		quorum: approval.quorum ?? 1,
-		ttl: parseDuration(approval.ttl) ?? Number.POSITIVE_INFINITY,
-		escalates: approval.escalation !== void 0
-	};
-}
-/** A hosted approval must meet every approval a code allow requires on the permission. */
-function approvalAtLeast(hosted, code) {
-	const mine = approvalRank(hosted);
-	for (const required of code) {
-		const theirs = approvalRank(required);
-		if (theirs === void 0) continue;
-		if (mine === void 0) return false;
-		if (theirs.distinct && !mine.distinct) return false;
-		if (theirs.stale && !mine.stale) return false;
-		if (theirs.by !== void 0 && mine.by !== theirs.by) return false;
-		if (mine.quorum < theirs.quorum || mine.ttl > theirs.ttl) return false;
-		if (mine.escalates && !theirs.escalates) return false;
-	}
-	return true;
-}
-/** A grantee kind this build does not know is never declared, so the hosted grant is dropped. */
-function undeclaredKind(_grantee) {
-	return false;
-}
-function declaredGrantee(policy, grantee, permissionResource) {
-	switch (grantee.kind) {
-		case "role": return declaredRoleNames(policy).has(grantee.role);
-		case "plan": return listPlans(policy.vocabulary.plans).some((leaf) => leaf.key === grantee.plan);
-		case "relation": return grantee.resource === permissionResource && getResource(policy.permissions, grantee.resource)?.relations[grantee.relation] !== void 0 && (grantee.through === void 0 || grantee.through === "parent" && isSelfParented(getResource(policy.permissions, grantee.resource))) && (grantee.depth === void 0 || grantee.through === "parent" && Number.isInteger(grantee.depth) && grantee.depth >= 0 && grantee.depth <= 32);
-		case "anyone":
-		case "authenticated":
-		case "actor":
-		case "assurance":
-		case "inherit": return false;
-		default: return undeclaredKind(grantee);
-	}
-}
-/** Approvers are declared roles, plans or relations, or any authenticated human. */
-function approvalAcceptable(policy, approval, permissionResource) {
-	if (approval === void 0 || approval === "human") return true;
-	if (!isRecord(approval)) return false;
-	if (approval["mode"] !== void 0 || approval["stages"] !== void 0) return false;
-	if (approval["distinct"] !== void 0 && typeof approval["distinct"] !== "boolean") return false;
-	if (approval["staleOn"] !== void 0 && (approval["staleOn"] !== "resource-change" || getResource(policy.permissions, permissionResource)?.version === void 0)) return false;
-	if (approval["quorum"] !== void 0 && (!Number.isInteger(approval["quorum"]) || approval["quorum"] < 1)) return false;
-	if (approval["ttl"] !== void 0 && (typeof approval["ttl"] !== "string" || parseDuration(approval["ttl"]) === void 0)) return false;
-	const escalation = approval["escalation"];
-	if (escalation !== void 0 && (!isRecord(escalation) || typeof escalation["after"] !== "string" || parseDuration(escalation["after"]) === void 0 || !granteesAcceptable(policy, escalation["to"], permissionResource))) return false;
-	if (approval["by"] === void 0) return true;
-	return granteesAcceptable(policy, approval["by"], permissionResource);
-}
-function granteesAcceptable(policy, raw, permissionResource) {
-	if (raw === void 0) return false;
-	const items = flattenGrantee(raw);
-	return items.length > 0 && items.every((item) => isRecord(item) && item.kind !== "relation" && (item.kind === "authenticated" || declaredGrantee(policy, item, permissionResource)));
-}
-function buildGrant(policy, document, raw) {
-	if (!isRecord(raw) || typeof raw["id"] !== "string" || typeof raw["permission"] !== "string" || raw["effect"] !== void 0 && raw["effect"] !== "allow" && raw["effect"] !== "deny" || raw["to"] === void 0) return {
-		ok: false,
-		reason: "invalid"
-	};
-	const permission = findPermission(policy.permissions, raw["permission"]);
-	if (permission === void 0) return {
-		ok: false,
-		reason: "unknown-permission"
-	};
-	if (!policy.hostable.includes(permission.key)) return {
-		ok: false,
-		reason: "not-hostable"
-	};
-	const to = flattenGrantee(raw["to"]);
-	if (to.length === 0 || !to.every((item) => isRecord(item) && declaredGrantee(policy, item, permission.resource))) return {
-		ok: false,
-		reason: "unknown-grantee"
-	};
-	for (const condition of [raw["where"], raw["check"]]) if (condition !== void 0 && !isPortableCondition(condition)) return {
-		ok: false,
-		reason: "non-portable"
-	};
-	if (!approvalAcceptable(policy, raw["approval"], permission.resource)) return {
-		ok: false,
-		reason: "invalid"
-	};
-	if (raw["fields"] !== void 0 && !(Array.isArray(raw["fields"]) && raw["fields"].every((field) => typeof field === "string"))) return {
-		ok: false,
-		reason: "invalid"
-	};
-	const effect = raw["effect"] ?? "allow";
-	const options = compact({
-		where: raw["where"] === void 0 ? void 0 : normalizeWhere(raw["where"]),
-		check: raw["check"] === void 0 ? void 0 : normalizeWhere(raw["check"]),
-		approval: raw["approval"],
-		fields: raw["fields"]
-	});
-	let built;
-	try {
-		const roleItem = to.length === 1 && to[0]?.kind === "role" ? to[0] : null;
-		if (roleItem === null) {
-			const partial = (effect === "allow" ? allow : deny)(permission, {
-				...options,
-				to
-			});
-			built = completeGrant(partial);
-		} else {
-			const binding = policy.rolesByName.get(roleItem.role);
-			const leaf = findRole(policy.vocabulary.roles, roleItem.role);
-			const [first] = role(leaf ?? roleItem.role, [(effect === "allow" ? allow : deny)(permission, options)], binding?.on === void 0 ? {} : { on: binding.on }).grants;
-			if (first === void 0) throw new TypeError("PermDock: role produced no grant");
-			built = first;
-		}
-	} catch {
-		return {
-			ok: false,
-			reason: "invalid"
-		};
-	}
-	if (effect === "allow") {
-		const codeApprovals = policy.grants.filter((grant) => grant.effect === "allow" && grant.hosted === void 0 && grant.permission.key === permission.key).map((grant) => grant.approval);
-		if (!approvalAtLeast(built.approval, codeApprovals)) return {
-			ok: false,
-			reason: "weaker-approval"
-		};
-	}
-	return {
-		ok: true,
-		grant: freezeDeep({
-			...built,
-			hosted: {
-				document: document.fingerprint,
-				grant: raw["id"]
-			}
-		})
-	};
-}
-/**
-* The code policy plus the hosted grants that pass every rule. Hosted
-* allows OR with code allows and any deny still wins, so a hosted grant can
-* never override a code deny; one that fails a rule is dropped, not thrown.
-*/
-function mergeHostedGrants(policy, document) {
-	if (document === null || document.grants.length === 0) return {
-		policy,
-		dropped: []
-	};
-	const merged = [];
-	const dropped = [];
-	for (const raw of document.grants) {
-		const result = buildGrant(policy, document, raw);
-		if (result.ok) {
-			merged.push(result.grant);
-			continue;
-		}
-		dropped.push(freezeDeep({
-			kind: "hosted-grant-dropped",
-			document: document.fingerprint,
-			grant: isRecord(raw) && typeof raw.id === "string" ? raw.id : "",
-			reason: result.reason
-		}));
-	}
-	if (merged.length === 0) return {
-		policy,
-		dropped
-	};
-	const grants = [...policy.grants, ...merged];
-	return {
-		policy: freezeDeep({
-			...policy,
-			grants,
-			index: indexPolicy(policy.roles, grants, policy.vocabulary),
-			fingerprint: bytesToBase64Url(sha256(`${policy.fingerprint}:${document.fingerprint}`))
-		}),
-		dropped
-	};
-}
-//#endregion
-export { declaredRoleNames as a, levelCondition as c, separationConflicts as d, policyX as f, parsePolicyDocument as i, levelNames as l, memoryPolicySource as n, definePolicy as o, mergeHostedGrants as r, grantList as s, isPortableCondition as t, policyLevels as u };
+export { levelCondition as a, separationConflicts as c, indexPolicy as i, policyX as l, definePolicy as n, levelNames as o, grantList as r, policyLevels as s, declaredRoleNames as t, normalizeDelegation as u };