permdock 0.4.0 → 0.6.0

package/dist/evaluate-CNClBvcj.js

@@ -0,0 +1,1785 @@
+import { a as sole, n as isReadonlyArray, t as compact } from "./compact-CAf557ZB.js";
+import { n as freezeDeep } from "./freeze-CrU8nQeX.js";
+import { n as isForbiddenKey } from "./paths-DXSHAMIa.js";
+import { n as role, t as normalizeAssurance } from "./role-builder-uWQZ4v84.js";
+import { n as PermDockValidationError } from "./validation-error-ZfUHbKvf.js";
+import { t as wireDenials } from "./wire-denial-C7PaVYEM.js";
+import { o as sameId } from "./expiry-D4_YKRKD.js";
+import { n as internalsOf } from "./internals-Dk8A8fX3.js";
+import { a as getResource, c as listPermissions, h as formerKeys, m as annotationsFor, n as findPermission } from "./permission-registry-Br4jSNVi.js";
+import { n as isThenable, t as ignoreRejection } from "./thenable-yD7SabqG.js";
+import { i as readAppData } from "./app-data-MuyzVqX8.js";
+import { a as durationOf, d as isoNow, o as epochSeconds, r as assertDuration, s as instantAt, t as INVALID_NOW } from "./time-DkWjdL98.js";
+import { t as canonicalJson } from "./canonical-json-BC8_nMTw.js";
+import { a as normalizeMemberships, d as scopeList, f as subjectForPermission, i as keepsPermission, m as tenantOf, o as resolveScope, s as rootMembershipId } from "./scopes-CUPSjo9q.js";
+import { a as readOnlyActorRefuses, c as rowIdOf, i as delegatedPermissions, l as rowValues, n as coveredByDelegation, o as requiresStandIn, r as coversRequirements, s as isRowPair, u as evaluateCondition } from "./delegation-j6-rc37o.js";
+import { a as authenticated, g as isRole, i as assurance, m as findRole, o as flattenGrantee, r as asGrantee } from "./grantee-hxrUsbpM.js";
+import { a as grantCoversField, i as wireValidity, t as isActive } from "./validity-CZ7-y0Cj.js";
+import { o as resourceRoleCondition } from "./grantee-conditions-CcXf8hMM.js";
+import { c as nowSeconds, i as matchScopedMembership, l as partitionsOf, n as inTeam, p as scopeField, r as isMembershipExpired } from "./tenancy-DN2QAx9z.js";
+import { a as levelCondition, r as grantList, t as declaredRoleNames } from "./policy-DbM5YYtV.js";
+import { t as requiresApproval } from "./approval-required-TzNB9oQA.js";
+import { i as versionOf, r as tokenPayload, t as decisionToken } from "./token-BLZcjQgt.js";
+import { n as resolveRelated } from "./relation-walk-3OyDBF0S.js";
+import { t as eventInstant } from "./event-time-CsegxXxB.js";
+import { n as toWireDelegation } from "./wire-delegation-Cv3W2eaM.js";
+import { n as matchGrantee, t as combineWhere } from "./grantee-match-DbENBHLB.js";
+import { t as resourceIdOf } from "./resource-ref-CaS9yVPi.js";
+//#region src/core/approval-state.ts
+/** The denial detail when an `ApprovalPolicySource` threw or returned an invalid entry. */
+const APPROVAL_POLICY_UNAVAILABLE = "approval-policy-unavailable";
+/** The tenant a matched allow applies in: its membership's root scope, else the active tenant. */
+function decisionTenant(subject, membership) {
+	return (membership === void 0 ? void 0 : rootMembershipId(membership)) ?? subject.principal?.tenant;
+}
+//#endregion
+//#region src/core/contact.ts
+function isContact(principal) {
+	return principal?.kind === "contact";
+}
+/**
+* A contact's memberships: only the `{ on }` ones count, each as
+* `via: 'contact'` and without seats, so a role whose `for` excludes
+* `contact` never applies and no `plan()` grantee matches.
+*/
+function contactMemberships(memberships) {
+	const kept = [];
+	for (const membership of memberships) {
+		if (membership.on === void 0) continue;
+		const { entitlements: _seats, ...rest } = membership;
+		kept.push(Object.freeze({
+			...rest,
+			via: "contact"
+		}));
+	}
+	return kept;
+}
+function optsIn(policy, grant) {
+	if (grant.role === null) return false;
+	return policy.roles.find(({ name }) => name === grant.role)?.for?.includes("contact") === true;
+}
+/** Whether `subject` may use the allow `grant`: false only for a contact and a write its role does not open to contacts. */
+function contactMayUse(policy, subject, grant) {
+	return grant.effect !== "allow" || !isContact(subject.principal) || annotationsFor(grant.permission).readOnlyHint || optsIn(policy, grant);
+}
+/**
+* The allows a contact may use for `permission`: all of them for a
+* read-only permission, otherwise only those from a role whose `for` lists
+* `contact`. Every other subject keeps every allow.
+*/
+function contactAllows(policy, subject, permission, allows) {
+	if (!isContact(subject.principal) || annotationsFor(permission).readOnlyHint) return allows;
+	return allows.filter(({ grant }) => optsIn(policy, grant));
+}
+//#endregion
+//#region src/core/elevated.ts
+function flattenPermissions(input) {
+	if (input !== null && typeof input === "object" && "key" in input && "action" in input) return [input];
+	if (isReadonlyArray(input)) return input.flatMap((item) => flattenPermissions(item));
+	return [...listPermissions(input)];
+}
+/**
+* The only deny override: a break-glass grant overrides deny grants whose
+* `name` it lists, and nothing else. It is an allow that stays non-portable
+* (RLS never compiles it) and grants only once its `requires` are met.
+*/
+function breakGlass(permission, options = {}) {
+	if (options.maxDuration !== void 0) assertDuration(options.maxDuration, "breakGlass maxDuration");
+	const purpose = options.requires?.purpose === void 0 || options.requires.purpose.length === 0 ? void 0 : Object.freeze([...new Set(options.requires.purpose)]);
+	const spec = compact({
+		overrides: Object.freeze([...new Set(options.overrides ?? [])]),
+		purpose,
+		reason: options.requires?.reason === true,
+		assurance: normalizeAssurance(options.requires?.assurance),
+		maxDuration: options.maxDuration,
+		obligations: Object.freeze([...new Set(options.obligations ?? [])])
+	});
+	const grants = flattenPermissions(permission).map((leaf) => freezeDeep(compact({
+		permission: leaf,
+		effect: "allow",
+		to: authenticated(),
+		portable: false,
+		breakGlass: spec
+	})));
+	return sole(grants) ?? grants;
+}
+function supportAccess(options) {
+	for (const duration of options.consent.durations) assertDuration(duration, `supportAccess consent duration on role '${options.role}'`);
+	const via = options.role;
+	const forbidden = (options.forbid ?? []).flatMap((item) => flattenPermissions(item));
+	const binding = role(options.role, [], {
+		on: options.on ?? "tenant",
+		for: [via]
+	});
+	const denies = forbidden.map((leaf) => freezeDeep(compact({
+		permission: leaf,
+		effect: "deny",
+		to: authenticated(),
+		role: options.role,
+		scope: "global",
+		viaOnly: via,
+		portable: false
+	})));
+	const support = freezeDeep(compact({
+		role: options.role,
+		actorRequired: options.actorRequired === true,
+		consent: {
+			by: asGrantee(options.consent.by),
+			durations: Object.freeze([...new Set(options.consent.durations)])
+		},
+		group: options.group ?? "vendor-support"
+	}));
+	return freezeDeep({
+		...binding,
+		grants: [...binding.grants, ...denies],
+		support
+	});
+}
+/** Whether the subject's authentication is fresh enough for an elevated grant. */
+function assuranceMet(requirement, subject, now) {
+	if (requirement === void 0) return true;
+	const held = subject.principal?.assurance;
+	if (requirement.acr !== void 0 && requirement.acr.length > 0) {
+		const acr = held?.acr;
+		if (acr === void 0 || !requirement.acr.includes(acr)) return false;
+	}
+	if (requirement.amr !== void 0 && requirement.amr.length > 0) {
+		const amr = held?.amr ?? [];
+		if (!requirement.amr.every((method) => amr.includes(method))) return false;
+	}
+	if (requirement.maxAge !== void 0) {
+		const authTime = held?.authTime;
+		if (authTime === void 0 || now - authTime > requirement.maxAge) return false;
+	}
+	return true;
+}
+/** `context.purpose` as a list of strings; fail-closed to empty. */
+function purposesOf(subject) {
+	const value = subject.context["purpose"];
+	return Array.isArray(value) ? value.filter((item) => typeof item === "string") : typeof value === "string" && value !== "" ? [value] : [];
+}
+/**
+* Whether a break-glass grant fires for this subject. It engages when the
+* caller asserts a purpose (`context.purpose`); once engaged, an unlisted
+* purpose, a missing reason or stale authentication denies with the matching
+* reason, and everything met grants with the declared obligations.
+*/
+function evaluateBreakGlass(spec, subject, now) {
+	const purposes = purposesOf(subject);
+	if (purposes.length === 0) return { kind: "inactive" };
+	const required = spec.purpose;
+	if (required !== void 0 && !purposes.some((purpose) => required.includes(purpose))) return {
+		kind: "denied",
+		reason: "purpose"
+	};
+	const reason = subject.context["reason"];
+	if (spec.reason && (typeof reason !== "string" || reason === "")) return {
+		kind: "denied",
+		reason: "reason-required"
+	};
+	if (spec.assurance !== void 0 && !assuranceMet(spec.assurance, subject, now)) return {
+		kind: "denied",
+		reason: "insufficient-user-authentication",
+		to: assurance(spec.assurance)
+	};
+	return {
+		kind: "granted",
+		obligations: [...spec.obligations.map((kind) => ({ kind })), ...typeof reason === "string" && reason !== "" ? [{
+			kind: "justify",
+			reason
+		}] : []]
+	};
+}
+/** Support memberships (`via: 'support'`) the subject holds that demand an actor. */
+function actorRequiredVias(supports) {
+	return new Set(supports.filter((spec) => spec.actorRequired).map((spec) => spec.role));
+}
+/** Whether a membership is a support membership of one of the given kinds. */
+function isSupportMembership(membership, vias) {
+	return membership.via !== void 0 && vias.has(membership.via);
+}
+/**
+* Whether the caller's `within` names the same ancestors as the eligible
+* membership. Omitted means "whatever the membership holds"; any entry that
+* disagrees, or names an ancestor the membership lacks, refuses.
+*/
+function withinAgrees(scopes, held, requested) {
+	if (requested === void 0) return true;
+	return Object.entries(requested).every(([key, id]) => {
+		const name = resolveScope(scopes, key) ?? key;
+		return held !== void 0 && Object.hasOwn(held, name) && held[name] === id;
+	});
+}
+function activationDenied(reason, to) {
+	return freezeDeep({
+		outcome: "denied",
+		denials: [to === void 0 ? {
+			role: null,
+			reason
+		} : {
+			role: null,
+			reason,
+			to
+		}],
+		alternatives: []
+	});
+}
+/**
+* Requests a just-in-time role activation. It never writes: a granted
+* decision carries the elevated membership under `elevation` for the app to
+* write. `approval-required` comes back first when the role's `activation`
+* sets `approval`. Fail-closed: an unknown role, an ineligible subject, a
+* missing justification or stale authentication all deny.
+*/
+/**
+* Requests a just-in-time activation of an eligible role for the subject of
+* `permdock`. It never writes: a granted decision carries the elevated
+* membership under `elevation` for the app to write, and
+* `approval-required` comes back first when the role's `activation` sets
+* `approval`. An instance built from a snapshot denies with `unsupported`.
+*/
+function activate(permdock, input) {
+	const internals = internalsOf(permdock);
+	if (internals === void 0) return freezeDeep({
+		outcome: "denied",
+		denials: [{
+			role: null,
+			reason: "unsupported"
+		}],
+		alternatives: []
+	});
+	return activateFor(internals.policy, internals.subject, input, internals.now());
+}
+function activateFor(policy, subject, input, now = nowSeconds()) {
+	const roleName = isRole(input.role) ? input.role.key : input.role;
+	const binding = policy.rolesByName.get(roleName);
+	const activation = binding?.activation;
+	const principal = subject.principal;
+	if (principal === null) return activationDenied("anonymous");
+	if (binding === void 0 || activation === void 0) return activationDenied("unknown-role");
+	const scopes = scopeList(policy.scopes);
+	const scope = resolveScope(scopes, input.scope) ?? input.scope;
+	const eligible = (principal.memberships ?? []).find((membership) => membership.scope === scope && sameId(membership.id, input.id) && !isMembershipExpired(membership, now) && (membership.eligible ?? []).includes(roleName) && withinAgrees(scopes, membership.within, input.within));
+	if (eligible === void 0) return activationDenied("no-membership");
+	const within = eligible.within;
+	if (activation.justification === "required") {
+		const reason = input.reason;
+		if (typeof reason !== "string" || reason === "") return activationDenied("reason-required");
+	}
+	if (activation.assurance !== void 0 && !assuranceMet(activation.assurance, subject, now)) return activationDenied("insufficient-user-authentication", assurance(activation.assurance));
+	const requested = durationOf(input.duration);
+	if (input.duration !== void 0 && requested === void 0) return activationDenied("validation");
+	const cap = durationOf(activation.maxDuration);
+	const seconds = cap === void 0 ? requested : Math.min(requested ?? cap, cap);
+	const membership = freezeDeep(compact({
+		scope,
+		id: input.id,
+		within,
+		roles: [roleName],
+		via: "elevated",
+		expiresAt: seconds === void 0 ? void 0 : Math.floor(now) + seconds,
+		grantedBy: principal.id,
+		reason: input.reason
+	}));
+	const token = decisionToken({
+		key: `activate:${roleName}`,
+		resourceId: within === void 0 ? `${scope}:${input.id}` : `${scope}:${input.id}@${canonicalJson(within)}`,
+		principal,
+		actor: subject.actor,
+		fingerprint: policy.fingerprint
+	});
+	if (activation.approval !== void 0) return freezeDeep({
+		outcome: "approval-required",
+		grant: {
+			role: roleName,
+			permission: `activate:${roleName}`
+		},
+		reason: "human",
+		token
+	});
+	return freezeDeep({
+		outcome: "granted",
+		subject,
+		matched: {
+			role: roleName,
+			permission: `activate:${roleName}`
+		},
+		token,
+		elevation: membership
+	});
+}
+//#endregion
+//#region src/core/grant-conditions.ts
+function evaluateGrantCondition(grant, permission, current, next, subject, now, scopes, relations, permitted) {
+	let unknown;
+	const onOpaque = () => {
+		unknown ??= "opaque-condition";
+	};
+	const related = (condition, row) => {
+		if (relations === void 0) {
+			unknown ??= "relation-unavailable";
+			return false;
+		}
+		const verdict = resolveRelated(condition, row, subject, now, relations, permitted);
+		if (verdict === "relation-depth" || verdict === "relation-unavailable") {
+			unknown ??= verdict;
+			return false;
+		}
+		return verdict;
+	};
+	if (!grant.portable && grant.closure !== void 0) try {
+		const result = grant.closure(next ?? current, {
+			subject,
+			actor: subject.actor,
+			delegation: subject.delegation,
+			context: subject.context
+		});
+		if (isThenable(result)) return {
+			matched: false,
+			reason: "closure-error",
+			cause: result
+		};
+		return { matched: result === true };
+	} catch (error) {
+		return {
+			matched: false,
+			reason: "closure-error",
+			cause: error
+		};
+	}
+	const deny = grant.effect === "deny";
+	let whereMatched;
+	if (grant.where !== void 0) {
+		if (permission.kind === "collection") return {
+			matched: false,
+			reason: "condition"
+		};
+		if (current === void 0) return {
+			matched: false,
+			reason: "condition"
+		};
+		if (grant.where.op === "opaque" || grant.check?.op === "opaque") return {
+			matched: false,
+			reason: "opaque-condition"
+		};
+		whereMatched = evaluateCondition(grant.where, current, subject, now, scopes, related, onOpaque);
+		if (unknown !== void 0) return {
+			matched: false,
+			reason: unknown
+		};
+		if (whereMatched && deny) return { matched: true };
+		if (!whereMatched && !deny) return {
+			matched: false,
+			reason: "condition"
+		};
+	}
+	const checkCondition = grant.check ?? (permission.action === "update" ? grant.where : void 0);
+	if (checkCondition === void 0 && whereMatched === false) return {
+		matched: false,
+		reason: "condition"
+	};
+	if (checkCondition !== void 0) {
+		if (checkCondition.op === "opaque") return {
+			matched: false,
+			reason: "opaque-condition"
+		};
+		if (next === void 0) return {
+			matched: false,
+			reason: "condition"
+		};
+		const matched = evaluateCondition(checkCondition, next, subject, now, scopes, related, onOpaque);
+		if (unknown !== void 0) return {
+			matched: false,
+			reason: unknown
+		};
+		if (!matched) return {
+			matched: false,
+			reason: "condition"
+		};
+	}
+	return { matched: true };
+}
+/** A grant whose condition could not be answered; a deny with one denies. */
+function isUnevaluable(reason) {
+	return reason === "relation-depth" || reason === "relation-unavailable" || reason === "closure-error" || reason === "opaque-condition";
+}
+function shouldConsumeQuota(call, simulated) {
+	if (simulated) return false;
+	switch (call) {
+		case "can":
+		case "filter":
+		case "simulate":
+		case "explain": return false;
+		case "decide":
+		case "assert":
+		case "endpoint":
+		case "adapter":
+		case "approval":
+		case void 0: return true;
+		default: return call;
+	}
+}
+function isDelegatedPermission(policy, permission) {
+	const providers = policy.providers;
+	if (providers === void 0 || providers.length === 0) return false;
+	for (const provider of providers) if (provider.handles(permission)) return true;
+	return false;
+}
+/** The `MatchedGrant` view of a grant, shared by `matched` and the trace. */
+function matchedOf(grant, permissionKey, breakGlass) {
+	return compact({
+		role: grant.role,
+		permission: permissionKey,
+		name: grant.name,
+		meta: grant.meta,
+		to: grant.to,
+		where: grant.where,
+		check: grant.check,
+		approval: grant.approval,
+		hosted: grant.hosted,
+		breakGlass
+	});
+}
+//#endregion
+//#region src/core/evaluation-alternatives.ts
+function alternativesFor(evaluate, policy, permission, subject, now, env) {
+	return listPermissions(policy.permissions).filter((leaf) => leaf.resource === permission.resource && leaf.key !== permission.key).filter((leaf) => {
+		return evaluate(policy, subject, leaf, void 0, {
+			trusted: true,
+			call: "simulate",
+			now: instantAt(now)
+		}, {
+			...env,
+			emit: false,
+			skipAlternatives: true,
+			outcomeOnly: true
+		}).outcome === "granted";
+	});
+}
+function inheritedVerdict(evaluate, policy, subject, resource, id, key, now, env) {
+	const leaf = findPermission(policy.permissions, key);
+	const loaded = env.relations?.row({
+		resource,
+		id
+	});
+	if (leaf === void 0 || loaded === void 0) return "relation-unavailable";
+	if (loaded === "pending" || loaded === "failed") return "relation-unavailable";
+	if (loaded.row === null) return false;
+	const decision = evaluate(policy, subject, leaf, loaded.row, {
+		trusted: true,
+		call: "simulate",
+		now: instantAt(now)
+	}, {
+		...env,
+		emit: false,
+		skipAlternatives: true,
+		outcomeOnly: true
+	});
+	if (decision.outcome === "granted") return true;
+	const reasons = decision.outcome === "denied" ? decision.denials.map((denial) => denial.reason) : [];
+	return reasons.includes("relation-unavailable") ? "relation-unavailable" : reasons.includes("relation-depth") ? "relation-depth" : false;
+}
+//#endregion
+//#region src/core/evaluation-trace.ts
+function skip(tracer, grant, permissionKey, why) {
+	tracer?.skipped.push({
+		role: grant.role,
+		permission: permissionKey,
+		effect: grant.effect,
+		why
+	});
+}
+function traceOf(tracer) {
+	return {
+		evaluated: tracer.evaluated,
+		allows: tracer.allows,
+		denies: tracer.denies,
+		skipped: tracer.skipped
+	};
+}
+//#endregion
+//#region src/core/events.ts
+function emitSafe(listeners, payload, errors) {
+	for (const listener of listeners) try {
+		listener(payload);
+	} catch (error) {
+		for (const handler of errors.error) try {
+			handler(error);
+		} catch {}
+	}
+}
+function emptyListeners() {
+	return {
+		decision: /* @__PURE__ */ new Set(),
+		denied: /* @__PURE__ */ new Set(),
+		approval: /* @__PURE__ */ new Set(),
+		auth: /* @__PURE__ */ new Set(),
+		error: /* @__PURE__ */ new Set()
+	};
+}
+function credentialRef(subject) {
+	const value = subject.principal?.["credential"];
+	if (value === null || typeof value !== "object") return;
+	const { id, kind } = value;
+	return typeof id === "string" && (kind === "user" || kind === "service") ? {
+		id,
+		kind
+	} : void 0;
+}
+/** `context.supportSession` counts only next to the `support` actor `subjectFromSupportSession` sets. */
+function supportSessionRef(subject) {
+	const value = subject.context["supportSession"];
+	if (subject.actor?.kind !== "support" || value === null || typeof value !== "object" || !("id" in value) || typeof value.id !== "string" || value.id === "") return;
+	return { id: value.id };
+}
+function finish(policy, subject, permission, data, decision, options, env, trusted, membership, counts) {
+	const heard = env.sink !== void 0 || env.listeners.decision.size > 0 || decision.outcome === "denied" && env.listeners.denied.size > 0 || decision.outcome === "approval-required" && env.listeners.approval.size > 0;
+	if (!env.emit || !heard) return;
+	const resource = getResource(policy.permissions, permission.resource);
+	const resourceId = data !== null && typeof data === "object" ? data[resource?.id ?? "id"] : void 0;
+	const event = freezeDeep(compact({
+		type: "decision",
+		at: isoNow(),
+		outcome: decision.outcome,
+		permission: permission.key,
+		scope: permission.scope,
+		resource: compact({
+			type: permission.resource,
+			id: resourceId === void 0 ? void 0 : String(resourceId)
+		}),
+		subject: compact({
+			principal: subject.principal === null ? null : compact({
+				id: subject.principal.id,
+				roles: subject.principal.roles ?? [],
+				tenant: subject.principal.tenant
+			}),
+			actor: subject.actor === void 0 ? void 0 : {
+				id: subject.actor.id,
+				kind: subject.actor.kind
+			},
+			delegation: toWireDelegation(subject.delegation),
+			credential: credentialRef(subject),
+			supportSession: supportSessionRef(subject)
+		}),
+		tenant: subject.principal?.tenant,
+		membership: membership === void 0 ? void 0 : compact({
+			...membership,
+			expiresAt: eventInstant(membership.expiresAt)
+		}),
+		via: membership?.via ?? null,
+		matched: decision.outcome === "granted" ? compact({
+			role: decision.matched.role,
+			permission: decision.matched.permission,
+			name: decision.matched.name,
+			meta: decision.matched.meta,
+			to: decision.matched.to,
+			hosted: decision.matched.hosted,
+			breakGlass: decision.matched.breakGlass
+		}) : decision.outcome === "approval-required" ? compact({
+			role: decision.grant.role,
+			permission: decision.grant.permission,
+			name: decision.grant.name,
+			meta: decision.grant.meta,
+			to: decision.grant.to,
+			hosted: decision.grant.hosted
+		}) : void 0,
+		obligations: decision.outcome === "granted" && (decision.obligations?.length ?? 0) > 0 ? decision.obligations : void 0,
+		purpose: Array.isArray(subject.context["purpose"]) && subject.context["purpose"].length > 0 ? subject.context["purpose"] : void 0,
+		reason: typeof subject.context["reason"] === "string" && subject.context["reason"] !== "" ? subject.context["reason"] : void 0,
+		denials: decision.outcome === "denied" ? wireDenials(decision.denials) : void 0,
+		alternatives: decision.outcome === "denied" ? decision.alternatives.map((leaf) => leaf.key) : void 0,
+		token: decision.outcome === "granted" || decision.outcome === "approval-required" ? decision.token : void 0,
+		trusted,
+		call: options.call ?? "decide",
+		adapter: options.adapter,
+		model: options.model === "" ? void 0 : options.model,
+		counts,
+		x: options.x === void 0 ? void 0 : readAppData(void 0, options.x)
+	}));
+	emitSafe(env.listeners.decision, event, env.listeners);
+	if (decision.outcome === "denied") emitSafe(env.listeners.denied, event, env.listeners);
+	if (decision.outcome === "approval-required") emitSafe(env.listeners.approval, event, env.listeners);
+	if (env.sink !== void 0) try {
+		const written = env.sink.write([event]);
+		if (isThenable(written)) written.catch((error) => {
+			emitSafe(env.listeners.error, error, env.listeners);
+		});
+	} catch (error) {
+		emitSafe(env.listeners.error, error, env.listeners);
+	}
+}
+//#endregion
+//#region src/core/evaluate/complete.ts
+/** Every exit of `evaluate`: names the permission, freezes, attaches the trace and emits. */
+function complete(call, raw, membership) {
+	const { env, permission, tracer } = call;
+	const decision = env.outcomeOnly !== true && raw.outcome === "denied" && raw.permission === void 0 ? {
+		...raw,
+		permission: permission.key
+	} : raw;
+	const final = env.outcomeOnly === true ? decision : freezeDeep(tracer === void 0 ? decision : {
+		...decision,
+		trace: traceOf(tracer)
+	});
+	finish(call.policy, call.given, permission, call.current, final, call.options, env, call.options.trusted === true, membership);
+	return final;
+}
+function deniedNow(call, denial) {
+	return complete(call, {
+		outcome: "denied",
+		denials: [denial],
+		alternatives: []
+	});
+}
+function deniedWithAlternatives(state, denials) {
+	return complete(state, {
+		outcome: "denied",
+		denials,
+		alternatives: state.env.skipAlternatives ? [] : alternativesFor(state.evaluate, state.policy, state.permission, state.subject, state.now, state.env)
+	});
+}
+//#endregion
+//#region src/core/evaluate/allowed.ts
+/** The `granted` or `approval-required` decision for the chosen allow, with its token. */
+function allowedDecision(state, allow, approval, quotaState) {
+	const { policy, subject, permission, resource, env, current, next } = state;
+	const resourceId = permission.kind === "collection" ? "*" : rowIdOf(current, resource?.id);
+	const version = approval !== void 0 && approval !== "human" && approval.staleOn === "resource-change" && resource?.version !== void 0 ? versionOf(current, resource.version) : void 0;
+	const token = env.simulated ? "pd1.simulated" : env.outcomeOnly === true ? "pd1.outcome" : decisionToken({
+		key: permission.key,
+		resourceId,
+		principal: subject.principal,
+		actor: subject.actor,
+		fingerprint: policy.fingerprint,
+		version,
+		payload: tokenPayload(resourceId, next ?? current, state.options.args)
+	});
+	const matched = compact({
+		...matchedOf(allow.grant, permission.key, allow.breakGlass),
+		approval
+	});
+	const obligations = [
+		...quotaState.obligations ?? [],
+		...allow.obligations ?? [],
+		...allow.grant.obligations ?? []
+	];
+	return complete(state, requiresApproval(approval) ? {
+		outcome: "approval-required",
+		grant: matched,
+		reason: "human",
+		token
+	} : {
+		outcome: "granted",
+		subject,
+		matched,
+		token,
+		...quotaState,
+		...obligations.length === 0 ? {} : { obligations }
+	}, allow.membership);
+}
+//#endregion
+//#region src/core/custom-roles.ts
+/** The current key for a stored key, current or former; `undefined` when neither. */
+function currentKey(policy, raw) {
+	const leaf = findPermission(policy.permissions, raw);
+	if (leaf === void 0) return;
+	return leaf.key === raw || formerKeys(leaf).includes(raw) ? leaf.key : void 0;
+}
+const GRANT_KEYS = /* @__PURE__ */ new Set([
+	"permission",
+	"effect",
+	"level"
+]);
+/** `where` narrowed by a level; the empty level (`{}`) leaves it as is. */
+function andWhere(where, level) {
+	if (level.op === "and" && level.conditions.length === 0) return where;
+	return where === void 0 ? level : {
+		op: "and",
+		conditions: [where, level]
+	};
+}
+/** A ceiling grant narrowed by a level's condition and marked with the level. */
+function leveled(grant, level, condition) {
+	const where = andWhere(grant.where, condition);
+	const check = grant.check === void 0 ? void 0 : andWhere(grant.check, condition);
+	return freezeDeep({
+		...grant,
+		level,
+		...where === void 0 ? {} : { where },
+		...check === void 0 ? {} : { check }
+	});
+}
+/**
+* The scope a custom role is held at: `scope` (a name or alias), the second
+* scope for the `team` input shape, else the first scope. `undefined` when
+* the policy does not declare it; such a role resolves to nothing.
+*/
+function customRoleScope(role, scopes) {
+	if (role.scope === "global") return role.shared === true ? void 0 : "global";
+	if (role.scope !== void 0) return resolveScope(scopes, role.scope);
+	return resolveScope(scopes, role.team === void 0 ? "tenant" : "team");
+}
+/** The instance of its scope a custom role is pinned to, if any. */
+function customRoleId(role) {
+	return role.scope === void 0 ? role.team : role.id;
+}
+/** A platform custom role: held through `principal.roles`, capped by the assignable global roles. */
+function isGlobalCustomRole(role) {
+	return role.scope === "global";
+}
+/** A shared custom role: defined once for every tenant, held on memberships of its scope in any tenant. */
+function isSharedCustomRole(role) {
+	return role.shared === true;
+}
+function isCeilingScope(scope) {
+	return typeof scope === "string";
+}
+function soleRole(grant) {
+	const roles = flattenGrantee(grant.to).filter((item) => item.kind === "role");
+	const first = roles[0];
+	return roles.length === 1 && first?.kind === "role" ? first.role : void 0;
+}
+/** Permission keys a declared role's allows reach, hosted grants included. */
+function roleAllowKeys(policy, name) {
+	return new Set(grantList(policy).filter((grant) => grant.effect === "allow" && soleRole(grant) === name).map((grant) => grant.permission.key));
+}
+function isAssignableRole(policy, name) {
+	const binding = policy.rolesByName.get(name);
+	if (binding !== void 0) return binding.assignable;
+	return findRole(policy.vocabulary?.roles, name)?.assignable === true;
+}
+/**
+* Every scope's ceiling, keyed by scope name (`global` for platform custom
+* roles): the code allows of declared `assignable` roles in that scope,
+* everything a custom role of the scope may ever reach. Hosted grants never
+* widen it. `assignable` narrows it to those role names (`CustomRoleSource.assignable`).
+*/
+function ceilings(policy, assignable) {
+	const allowed = assignable === void 0 ? void 0 : new Set(assignable);
+	const byScope = /* @__PURE__ */ new Map();
+	for (const grant of grantList(policy)) {
+		const name = soleRole(grant);
+		if (grant.effect !== "allow" || grant.hosted !== void 0 || !isCeilingScope(grant.scope) || name === void 0 || !isAssignableRole(policy, name) || allowed !== void 0 && !allowed.has(name)) continue;
+		const list = byScope.get(grant.scope) ?? [];
+		list.push(grant);
+		byScope.set(grant.scope, list);
+	}
+	return byScope;
+}
+function ceilingGrants(policy, scope, assignable) {
+	return ceilings(policy, assignable).get(scope) ?? [];
+}
+function retarget(grant, role, scope) {
+	const grantee = {
+		kind: "role",
+		role: role.name,
+		scope
+	};
+	const others = flattenGrantee(grant.to).filter((item) => item.kind !== "role");
+	return freezeDeep({
+		...grant,
+		to: others.length === 0 ? grantee : [grantee, ...others],
+		role: role.name,
+		scope
+	});
+}
+/**
+* The one resolver behind evaluation, snapshots and `validateCustomRole`.
+* Included roles' grants plus the role's own allows, minus its denies, all
+* intersected with the ceiling. An allow inherits the condition, approval and
+* limit of the declared grant it comes from: an included assignable role's
+* grant when there is one, otherwise every ceiling grant of that permission,
+* together with the denies of the roles those grants belong to.
+*/
+function resolveCustomRole(policy, role) {
+	const scope = customRoleScope(role, scopeList(policy.scopes));
+	if (scope === void 0) return freezeDeep({
+		grants: [],
+		dropped: [],
+		renamed: []
+	});
+	const ceiling = ceilingGrants(policy, scope);
+	const ceilingSet = new Set(ceiling);
+	const ceilingKeys = new Set(ceiling.map((grant) => grant.permission.key));
+	const declared = declaredRoleNames(policy);
+	const all = grantList(policy).filter((grant) => grant.hosted === void 0);
+	const dropped = [];
+	const renamed = [];
+	const seen = /* @__PURE__ */ new Set();
+	const drop = (entry) => {
+		const id = "role" in entry ? `role:${entry.role}` : `${entry.reason}:${entry.permission}`;
+		if (!seen.has(id)) {
+			seen.add(id);
+			dropped.push(entry);
+		}
+	};
+	const included = [];
+	const includedKeys = /* @__PURE__ */ new Set();
+	const allowKeys = /* @__PURE__ */ new Map();
+	const denyKeys = /* @__PURE__ */ new Set();
+	const allowAll = (key) => {
+		allowKeys.set(key, "all");
+	};
+	for (const name of Array.isArray(role.includes) ? role.includes : []) {
+		if (typeof name !== "string" || !declared.has(name)) {
+			drop({
+				role: String(name),
+				reason: "unknown-role"
+			});
+			continue;
+		}
+		for (const grant of all) {
+			if (soleRole(grant) !== name) continue;
+			const key = grant.permission.key;
+			if (grant.effect === "deny") {
+				if (grant.scope === scope) included.push(grant);
+			} else if (ceilingSet.has(grant)) {
+				included.push(grant);
+				includedKeys.add(key);
+			} else if (ceilingKeys.has(key)) allowAll(key);
+			else drop({
+				permission: key,
+				reason: "outside-ceiling"
+			});
+		}
+	}
+	const entries = Array.isArray(role.grants) ? role.grants : [];
+	for (const item of entries) {
+		if (item === null || typeof item !== "object") {
+			drop({
+				permission: String(item),
+				reason: "unknown-permission"
+			});
+			continue;
+		}
+		const entry = item;
+		const raw = entry.permission;
+		const key = typeof raw === "string" ? currentKey(policy, raw) : void 0;
+		if (key === void 0) {
+			drop({
+				permission: String(raw),
+				reason: "unknown-permission"
+			});
+			continue;
+		}
+		if (key !== raw) renamed.push({
+			from: String(raw),
+			to: key
+		});
+		const effect = entry.effect ?? "allow";
+		const extra = Object.keys(entry).some((name) => !GRANT_KEYS.has(name));
+		const level = entry.level;
+		if (extra || effect !== "allow" && effect !== "deny" || effect === "deny" && level !== void 0) {
+			drop({
+				permission: key,
+				reason: "condition-not-allowed"
+			});
+			denyKeys.add(key);
+			continue;
+		}
+		if (effect === "deny") {
+			denyKeys.add(key);
+			continue;
+		}
+		let narrowing;
+		if (level !== void 0) {
+			const leaf = findPermission(policy.permissions, key);
+			const condition = typeof level === "string" && leaf?.kind === "instance" ? levelCondition(policy, leaf.resource, level) : void 0;
+			if (condition === void 0) {
+				drop({
+					permission: key,
+					reason: "unknown-level",
+					level: String(level)
+				});
+				denyKeys.add(key);
+				continue;
+			}
+			narrowing = [String(level), condition];
+		}
+		if (!ceilingKeys.has(key)) {
+			drop({
+				permission: key,
+				reason: "outside-ceiling"
+			});
+			continue;
+		}
+		const held = allowKeys.get(key);
+		if (narrowing === void 0) allowAll(key);
+		else if (held === void 0) allowKeys.set(key, new Map([narrowing]));
+		else if (held !== "all") held.set(...narrowing);
+	}
+	const out = [];
+	const push = (grant) => {
+		if (!out.includes(grant)) out.push(grant);
+	};
+	for (const grant of included) if (grant.effect === "deny" || !denyKeys.has(grant.permission.key)) push(grant);
+	for (const [key, levels] of allowKeys) {
+		if (denyKeys.has(key) || includedKeys.has(key)) continue;
+		const sources = /* @__PURE__ */ new Set();
+		for (const grant of ceiling) {
+			if (grant.permission.key !== key) continue;
+			sources.add(soleRole(grant) ?? "");
+			if (levels === "all") {
+				push(grant);
+				continue;
+			}
+			for (const [level, condition] of levels) push(leveled(grant, level, condition));
+		}
+		for (const grant of all) if (grant.effect === "deny" && grant.permission.key === key && sources.has(soleRole(grant) ?? "")) push(grant);
+	}
+	return freezeDeep({
+		grants: out.map((grant) => retarget(grant, role, scope)),
+		dropped,
+		renamed
+	});
+}
+function validateCustomRole(policy, role, options = {}) {
+	if (!isSharedCustomRole(role) && !isGlobalCustomRole(role) && (options.shared ?? []).some((item) => wellFormed(item) && isSharedCustomRole(item) && item.name === role.name)) return freezeDeep({
+		ok: false,
+		permissions: [],
+		dropped: [{
+			role: role.name,
+			reason: "name-taken"
+		}],
+		renamed: []
+	});
+	const resolved = resolveCustomRole(policy, role);
+	const permissions = [...new Set(resolved.grants.filter((grant) => grant.effect === "allow").map((grant) => grant.permission.key))].toSorted();
+	return freezeDeep({
+		ok: resolved.dropped.length === 0,
+		permissions,
+		dropped: resolved.dropped,
+		renamed: resolved.renamed
+	});
+}
+function wellFormed(role) {
+	if (role === null || typeof role !== "object" || typeof role.name !== "string") return false;
+	if (role.shared !== void 0) return role.shared === true && role.tenant === void 0 && role.team === void 0 && role.id === void 0 && (role.scope === void 0 || typeof role.scope === "string" && role.scope !== "global");
+	if (role.scope === "global") return role.tenant === void 0 && role.team === void 0 && role.id === void 0;
+	return typeof role.tenant === "string" && (role.team === void 0 || typeof role.team === "string") && (role.scope === void 0 || typeof role.scope === "string") && (role.id === void 0 || typeof role.id === "string");
+}
+/**
+* The well-formed roles, without a tenant role that a shared role of the same
+* name shadows: the shared role is the one every tenant sees.
+*/
+function effectiveCustomRoles(roles) {
+	const formed = roles.filter(wellFormed);
+	const shared = new Set(formed.filter(isSharedCustomRole).map((role) => role.name));
+	return shared.size === 0 ? formed : formed.filter((role) => isSharedCustomRole(role) || isGlobalCustomRole(role) || !shared.has(role.name));
+}
+/** Every custom role's resolved grants, once per instance. Malformed roles resolve to nothing. */
+function customGrantsFor(policy, roles) {
+	const declared = declaredRoleNames(policy);
+	const out = [];
+	for (const role of effectiveCustomRoles(roles)) {
+		if (declared.has(role.name)) continue;
+		for (const grant of resolveCustomRole(policy, role).grants) out.push({
+			grant,
+			role
+		});
+	}
+	return out;
+}
+/**
+* The well-formed custom roles held on memberships: tenant and shared, not
+* platform. A declared role name is never one, and a shared role shadows a
+* tenant role of the same name.
+*/
+function tenantCustomRoles(policy, roles) {
+	const declared = declaredRoleNames(policy);
+	return effectiveCustomRoles(roles).filter((role) => !isGlobalCustomRole(role) && !declared.has(role.name));
+}
+/** Whether a custom role held on memberships belongs to `tenant`: its own, or shared by every tenant. */
+function customRoleOf(role, tenant) {
+	return isSharedCustomRole(role) || sameId(role.tenant, tenant);
+}
+/**
+* A membership at the role's scope, inside its tenant (and instance, when
+* pinned), naming it. A shared role is held at its scope in any tenant.
+*/
+function holdsCustomRole(membership, role, scopes) {
+	if (isGlobalCustomRole(role) || !wellFormed(role)) return false;
+	const scope = customRoleScope(role, scopes);
+	const id = customRoleId(role);
+	const tenant = tenantOf(membership, scopes);
+	return scope !== void 0 && membership.scope === scope && (isSharedCustomRole(role) ? tenant !== void 0 : sameId(tenant, role.tenant)) && (id === void 0 || sameId(membership.id, id)) && membership.roles.includes(role.name);
+}
+/** Whether `principal.roles` names the platform custom role. */
+function holdsGlobalCustomRole(roles, role) {
+	return isGlobalCustomRole(role) && (roles ?? []).includes(role.name);
+}
+/** A tenant's custom role inside that tenant, a shared role in any tenant, or a platform custom role anywhere. */
+function isCustomRoleName(name, roles, tenant) {
+	return effectiveCustomRoles(roles).some((item) => item.name === name && (isGlobalCustomRole(item) || tenant !== void 0 && customRoleOf(item, tenant)));
+}
+/**
+* The compact JWT form of custom roles for the `memberships[].grants` claim
+* RLS reads in `jwt` mode: role name to entries, where `key` allows, `-key`
+* denies and `@role` includes. Put a team custom role on its team membership.
+* Pass `policy` to write keys stored under a former name as the current key.
+*/
+function customRoleClaim(roles, policy) {
+	const keyOf = (raw) => policy === void 0 ? raw : currentKey(policy, raw) ?? raw;
+	const claim = {};
+	for (const role of roles) {
+		if (!wellFormed(role) || isForbiddenKey(role.name)) continue;
+		const entries = claim[role.name] ?? [];
+		const includes = Array.isArray(role.includes) ? role.includes : [];
+		const grants = Array.isArray(role.grants) ? role.grants : [];
+		for (const name of includes) entries.push(`@${name}`);
+		for (const grant of grants) {
+			if (grant.effect === "deny") {
+				entries.push(`-${keyOf(grant.permission)}`);
+				continue;
+			}
+			const level = grant.level;
+			entries.push(typeof level === "string" && level !== "" ? `${keyOf(grant.permission)}@${level}` : keyOf(grant.permission));
+		}
+		claim[role.name] = entries;
+	}
+	return freezeDeep(claim);
+}
+/**
+* The `memberships` claim RLS reads in `jwt` mode: each membership canonical,
+* with the custom roles it holds as the compact `grants` map.
+*/
+function membershipsClaim(memberships, customRoles, scopes) {
+	const claim = [];
+	const effective = effectiveCustomRoles(customRoles);
+	for (const membership of normalizeMemberships(memberships, scopes)) {
+		const held = effective.filter((role) => holdsCustomRole(membership, role, scopes));
+		claim.push(held.length === 0 ? membership : Object.assign({}, membership, { grants: customRoleClaim(held) }));
+	}
+	return claim;
+}
+//#endregion
+//#region src/core/source-name.ts
+/** `{ name }` for a source that names itself, `{}` otherwise: what an auth event reports about it. */
+function sourceName(source) {
+	return source?.name === void 0 ? {} : { name: source.name };
+}
+//#endregion
+//#region src/core/role-loading.ts
+function isGlobalRole(value) {
+	return value !== null && typeof value === "object" && Reflect.get(value, "scope") === "global";
+}
+function onlyGlobal(roles) {
+	return Array.isArray(roles) ? roles.filter(isGlobalRole) : [];
+}
+function isSharedRole(value) {
+	return value !== null && typeof value === "object" && Reflect.get(value, "shared") === true;
+}
+function onlyShared(roles) {
+	return Array.isArray(roles) ? roles.filter(isSharedRole) : [];
+}
+/** The `customRoles` option as a source: a factory is called with the resolved subject, and a throw reads none. */
+function roleSourceFor(option, subject, auth) {
+	if (typeof option !== "function") return option;
+	try {
+		return option(subject);
+	} catch {
+		auth.push({
+			reason: "source-threw",
+			source: "customRoles"
+		});
+		return;
+	}
+}
+function customRolesFor(source, tenants, auth, globalHeld, heldIn) {
+	if (source === void 0) return [];
+	const loaded = [];
+	for (const tenant of tenants) try {
+		loaded.push(source.rolesFor(tenant, { held: heldIn(tenant) }));
+	} catch {
+		auth.push({
+			reason: "source-threw",
+			source: "customRoles",
+			...sourceName(source)
+		});
+		loaded.push([]);
+	}
+	const once = (read, keep) => {
+		try {
+			const roles = read();
+			loaded.push(isThenable(roles) ? roles.then(keep) : keep(roles));
+		} catch {
+			auth.push({
+				reason: "source-threw",
+				source: "customRoles",
+				...sourceName(source)
+			});
+			loaded.push([]);
+		}
+	};
+	if (globalHeld !== void 0 && source.globalRoles !== void 0) {
+		const read = source.globalRoles.bind(source);
+		once(() => read({ held: globalHeld }), onlyGlobal);
+	}
+	if (tenants.length > 0 && source.sharedRoles !== void 0) {
+		const read = source.sharedRoles.bind(source);
+		const held = [...new Set(tenants.flatMap((tenant) => heldIn(tenant)))];
+		once(() => read({ held }), onlyShared);
+	}
+	if (loaded.some((item) => isThenable(item))) return Promise.all(loaded.map((item) => Promise.resolve(item).catch(() => {
+		auth.push({
+			reason: "source-threw",
+			source: "customRoles",
+			...sourceName(source)
+		});
+		return [];
+	}))).then((lists) => lists.flat());
+	return loaded.flat();
+}
+function stringList(value) {
+	return Array.isArray(value) ? value.filter((item) => typeof item === "string") : [];
+}
+/**
+* `CustomRoleSource.assignable` per tenant; `undefined` when the source has no
+* `assignable`. A tenant whose call throws or answers junk assigns nothing.
+*/
+function assignableNamesFor(source, tenants, auth) {
+	if (source?.assignable === void 0) return;
+	const failed = () => {
+		auth.push({
+			reason: "source-threw",
+			source: "customRoles",
+			...sourceName(source)
+		});
+		return [];
+	};
+	const loaded = tenants.map((tenant) => {
+		try {
+			return source.assignable?.(tenant) ?? [];
+		} catch {
+			return failed();
+		}
+	});
+	const toMap = (lists) => new Map(tenants.map((tenant, index) => [tenant, stringList(lists[index])]));
+	if (loaded.some((item) => isThenable(item))) return Promise.all(loaded.map((item) => Promise.resolve(item).catch(failed))).then(toMap);
+	return toMap(loaded);
+}
+/**
+* The declared role names among `names`. A custom role of `tenant` is known
+* but contributes no declared name: its grants are resolved separately
+* (`customGrantsFor`), bounded by the ceiling. A tenant's custom role is
+* unknown inside another tenant and for a membership without one.
+*/
+function expandRoleNames(names, declared, custom, tenant) {
+	const resolved = /* @__PURE__ */ new Set();
+	const unknown = [];
+	for (const name of names) if (declared.has(name)) resolved.add(name);
+	else if (!isCustomRoleName(name, custom, tenant)) unknown.push(name);
+	return {
+		roles: [...resolved],
+		unknown
+	};
+}
+//#endregion
+//#region src/core/validation.ts
+function validateBoundary(permission, resource, data, mode, trusted, boundary = "manual") {
+	if (!(mode === "always" || mode === "boundary" && !trusted)) return data;
+	if (resource?.schema === void 0) {
+		if (mode === "always") throw new PermDockValidationError({
+			code: "no-schema",
+			permission: permission.key,
+			resource: permission.resource,
+			boundary,
+			message: `${permission.key}: no schema for resource ${permission.resource}.`
+		});
+		return data;
+	}
+	const result = resource.schema["~standard"].validate(data);
+	if (isThenable(result)) {
+		ignoreRejection(result);
+		throw new PermDockValidationError({
+			code: "async-schema",
+			permission: permission.key,
+			resource: permission.resource,
+			boundary,
+			message: `${permission.key}: schema for ${permission.resource} is async.`
+		});
+	}
+	if ("issues" in result && result.issues !== void 0) throw new PermDockValidationError({
+		code: "invalid-data",
+		permission: permission.key,
+		resource: permission.resource,
+		issues: result.issues,
+		boundary,
+		message: validationMessage(permission, resource, result.issues)
+	});
+	return result.value;
+}
+function validationMessage(permission, resource, issues) {
+	const parts = issues.map((issue) => {
+		const path = issue.path?.map((item) => typeof item === "object" && "key" in item ? String(item.key) : String(item)).join(".") ?? "/";
+		return `invalid ${resource.name} data at ${path}: ${issue.message}`;
+	});
+	return `${permission.key}: ${parts.join("; ")}.`;
+}
+//#endregion
+//#region src/core/evaluate/call.ts
+/** The rows after boundary validation; on `invalid`, the rows validated before the failure. */
+function validatedRows(call, data, rows) {
+	const { permission, policy, options } = call;
+	if (data === void 0 && !(permission.kind === "instance" && policy.validate === "always")) return rows;
+	const check = (value) => validateBoundary(permission, call.resource, value, policy.validate, options.trusted === true, options.boundary ?? "manual");
+	let current = rows.current;
+	try {
+		if (permission.kind === "instance" && isRowPair(data)) {
+			current = check(data.current);
+			return {
+				current,
+				next: check(data.next)
+			};
+		}
+		const validated = check(data);
+		return permission.kind === "instance" ? {
+			current: validated,
+			next: validated
+		} : {
+			current,
+			next: validated
+		};
+	} catch (error) {
+		if (error instanceof PermDockValidationError && error.code === "invalid-data") return {
+			current,
+			next: rows.next,
+			invalid: error
+		};
+		throw error;
+	}
+}
+function heldRoles(call, scopes, declared) {
+	const { subject, env } = call;
+	const global = expandRoleNames(subject.principal?.roles ?? [], declared, env.customRoles, subject.principal?.tenant);
+	if (subject.principal !== null && global.unknown.length > 0) emitSafe(env.listeners.auth, {
+		reason: "unknown-role",
+		source: "roles"
+	}, env.listeners);
+	const matching = new Set(global.roles);
+	const denials = [];
+	for (const membership of subject.principal?.memberships ?? []) {
+		if (!inTeam(membership, scopes, env.team)) continue;
+		const expanded = expandRoleNames(membership.roles, declared, env.customRoles, tenantOf(membership, scopes));
+		for (const name of expanded.roles) matching.add(name);
+		for (const name of expanded.unknown) denials.push({
+			role: name,
+			reason: "unknown-role"
+		});
+	}
+	return {
+		global,
+		matching,
+		denials
+	};
+}
+/** A support membership the policy says needs an actor, held without one. */
+function lacksActor(call, scopes) {
+	const { subject, now, env } = call;
+	const actorVias = actorRequiredVias(call.policy.index.supports);
+	return actorVias.size > 0 && subject.actor === void 0 && (subject.principal?.memberships ?? []).some((membership) => isSupportMembership(membership, actorVias) && !isMembershipExpired(membership, now) && inTeam(membership, scopes, env.team));
+}
+function walkRoleFor(call) {
+	const { env } = call;
+	if (env.relations?.available !== true) return;
+	return (membership, row) => {
+		const on = membership.on;
+		const condition = on === void 0 ? void 0 : resourceRoleCondition(call.resource, on.resource, [on.id], call.policy.resources);
+		return condition === void 0 || env.relations === void 0 ? false : resolveRelated(condition, row, call.subject, call.now, env.relations);
+	};
+}
+//#endregion
+//#region src/core/requires-conditions.ts
+const NEVER = freezeDeep({
+	op: "or",
+	conditions: []
+});
+function isUnconditionedAllow(grant, now) {
+	return grant.where === void 0 && grant.check === void 0 && grant.closure === void 0 && grant.portable && grant.purpose === void 0 && grant.viaOnly === void 0 && grant.requires === void 0 && isActive(grant.validity, now);
+}
+/**
+* The row condition a grant's `requires` adds: the row's instance of some
+* scope is one where the subject holds `key` through a role grant without a
+* row condition, minus the instances a deny of `key` reaches at that scope.
+* `undefined` when the subject holds `key` globally that way, so every row
+* passes. The in-process mirror of the SQL `permdock_has_permission` and
+* `permitted_<scope>_ids_by_permission`.
+*/
+function requirementCondition(policy, subject, keys, resource, now, customRoles, customGrants) {
+	let where;
+	for (const key of keys) where = combineWhere(where, keyRequirement(policy, subject, key, resource, now, customRoles, customGrants));
+	return where;
+}
+function keyRequirement(policy, subject, key, resource, now, customRoles, customGrants) {
+	const principal = subject.principal;
+	if (principal === null) return NEVER;
+	const scopes = scopeList(policy.scopes);
+	const declared = declaredRoleNames(policy);
+	const global = new Set(expandRoleNames(principal.roles ?? [], declared, customRoles, principal.tenant).roles);
+	const held = (principal.memberships ?? []).filter((membership) => !isMembershipExpired(membership, now) && keepsPermission(membership, key)).map((membership) => ({
+		membership,
+		roles: new Set(expandRoleNames(membership.roles, declared, customRoles, tenantOf(membership, scopes)).roles)
+	}));
+	const allowed = /* @__PURE__ */ new Map();
+	const denied = /* @__PURE__ */ new Map();
+	let globalAllow = false;
+	let globalDeny = false;
+	const note = (effect, membership) => {
+		if (membership === void 0) {
+			if (effect === "allow") globalAllow = true;
+			else globalDeny = true;
+			return;
+		}
+		if (membership.scope === void 0 || membership.id === void 0) return;
+		const target = effect === "allow" ? allowed : denied;
+		const ids = target.get(membership.scope) ?? /* @__PURE__ */ new Set();
+		ids.add(membership.id);
+		target.set(membership.scope, ids);
+	};
+	const applies = (grant) => grant.effect === "allow" ? isUnconditionedAllow(grant, now) : isActive(grant.validity, now);
+	for (const grant of policy.index.grantsByKey.get(key) ?? []) {
+		const items = flattenGrantee(grant.to);
+		if (grant.breakGlass !== void 0 || !applies(grant) || items.length === 0 || !items.every((item) => item.kind === "role")) continue;
+		const roles = items.flatMap((item) => item.kind === "role" ? [item] : []);
+		if (!roles.every((item) => item.scope !== "global" || global.has(item.role))) continue;
+		const scoped = roles.filter((item) => item.scope !== "global");
+		if (scoped.length === 0) {
+			note(grant.effect);
+			continue;
+		}
+		for (const entry of held) if (scoped.every((item) => typeof item.scope === "string" && entry.membership.scope === item.scope && entry.roles.has(item.role))) note(grant.effect, entry.membership);
+	}
+	for (const { grant, role } of customGrants) {
+		if (grant.permission.key !== key || !applies(grant)) continue;
+		if (holdsGlobalCustomRole(principal.roles, role)) note(grant.effect);
+		for (const entry of held) if (holdsCustomRole(entry.membership, role, scopes)) note(grant.effect, entry.membership);
+	}
+	if (globalAllow && !globalDeny) return;
+	const parts = [];
+	for (const name of resource === void 0 ? [] : partitionsOf(resource, scopes)) {
+		const field = scopeField(resource, name, scopes);
+		const deniedIds = denied.get(name);
+		const ids = [...allowed.get(name) ?? []].filter((id) => deniedIds?.has(id) !== true).toSorted();
+		if (field !== void 0 && ids.length > 0) parts.push({
+			op: "in",
+			field,
+			value: ids
+		});
+	}
+	return sole(parts) ?? {
+		op: "or",
+		conditions: parts
+	};
+}
+//#endregion
+//#region src/core/evaluate/candidates.ts
+/**
+* A collection write proposes `next`; an update pair may move `next` out of
+* the scope `current` is in. An allow needs both in scope; a deny applies
+* when either is, so a move into or out of its scope stays denied.
+*/
+function matchWriteScope(match, instance, current, next, deny) {
+	const first = match(instance ? current : next);
+	if (!instance || next === current) return first;
+	if (deny) return first.ok ? first : match(next);
+	if (!first.ok) return first;
+	const moved = match(next);
+	return moved.ok ? first : moved;
+}
+/** The code grants and custom-role grants for the permission, break-glass grants aside. */
+function candidatesFor(call) {
+	const { permission } = call;
+	const candidates = (call.policy.index.grantsByKey.get(permission.key) ?? []).filter((grant) => grant.breakGlass === void 0).map((grant) => ({ grant }));
+	for (const item of call.env.customGrants) if (item.grant.permission.key === permission.key) candidates.push({
+		grant: item.grant,
+		custom: item.role
+	});
+	return candidates;
+}
+function breakGlassFor(call, scopes) {
+	const { permission, subject, now, tracer } = call;
+	const overrides = /* @__PURE__ */ new Set();
+	let denial;
+	for (const grant of call.policy.index.grantsByKey.get(permission.key) ?? []) {
+		if (grant.breakGlass === void 0) continue;
+		if (tracer !== void 0) tracer.evaluated += 1;
+		if (!matchGrantee(grant.to, subject, now, call.resource, scopes).matched) {
+			skip(tracer, grant, permission.key, "grantee");
+			continue;
+		}
+		const result = evaluateBreakGlass(grant.breakGlass, subject, now);
+		if (result.kind === "inactive") {
+			skip(tracer, grant, permission.key, "break-glass-inactive");
+			continue;
+		}
+		for (const name of grant.breakGlass.overrides) overrides.add(name);
+		if (result.kind === "granted") return {
+			grant,
+			obligations: result.obligations,
+			overrides,
+			denial
+		};
+		denial ??= result.reason === "insufficient-user-authentication" ? {
+			role: null,
+			reason: result.reason,
+			to: result.to
+		} : {
+			role: null,
+			reason: result.reason
+		};
+	}
+	return {
+		grant: void 0,
+		obligations: [],
+		overrides,
+		denial
+	};
+}
+function holdsCustom(state, custom) {
+	return isGlobalCustomRole(custom) ? holdsGlobalCustomRole(state.subject.principal?.roles ?? [], custom) : (state.subject.principal?.memberships ?? []).some((membership) => inTeam(membership, state.scopes, state.env.team) && holdsCustomRole(membership, custom, state.scopes));
+}
+function holdsRole(state, item, custom) {
+	if (custom !== void 0) return holdsCustom(state, custom);
+	return item.scope === "global" ? state.roles.global.roles.includes(item.role) : state.roles.matching.has(item.role);
+}
+/**
+* Whether the subject holds every role the grantee names, at a scope the row
+* (and a write's next row) is in. `held: false` when a denial or skip was recorded.
+*/
+function roleScope(state, grant, custom) {
+	const { subject, permission, tracer } = state;
+	const roleItems = flattenGrantee(grant.to).filter((item) => item.kind === "role");
+	if (roleItems.length === 0) return { held: true };
+	if (subject.principal === null) {
+		state.denials.push({
+			role: grant.role,
+			reason: "anonymous"
+		});
+		return { held: false };
+	}
+	let membership;
+	for (const roleItem of roleItems) {
+		if (!holdsRole(state, roleItem, custom)) {
+			skip(tracer, grant, permission.key, "role");
+			return { held: false };
+		}
+		const matchRow = (row) => matchScopedMembership(subject, roleItem.scope, roleItem.role, row, state.scopes, state.resource, state.policy.resources, state.now, (held) => {
+			if (custom === void 0) return expandRoleNames(held.roles, state.declared, state.env.customRoles, tenantOf(held, state.scopes)).roles;
+			return holdsCustomRole(held, custom, state.scopes) ? [custom.name] : [];
+		}, state.env.team, state.walkRole, permission.kind === "instance", state.options.scope);
+		const scopeMatch = matchWriteScope(matchRow, permission.kind === "instance", state.current, state.next, grant.effect === "deny");
+		if (!scopeMatch.ok) {
+			state.denials.push({
+				role: roleItem.role,
+				reason: scopeMatch.reason
+			});
+			return { held: false };
+		}
+		membership = scopeMatch.membership ?? membership;
+	}
+	return membership === void 0 ? { held: true } : {
+		held: true,
+		membership
+	};
+}
+/** Whether the grantee matches; records the denial or skip when it does not. */
+function granteeOf(state, grant, custom) {
+	const { subject, now, permission } = state;
+	if (grant.viaOnly !== void 0 && !(subject.principal?.memberships ?? []).some((membership) => membership.via === grant.viaOnly && !isMembershipExpired(membership, now) && inTeam(membership, state.scopes, state.env.team))) {
+		skip(state.tracer, grant, permission.key, "via-only");
+		return;
+	}
+	const required = grant.purpose;
+	if (required !== void 0 && !state.purposes.some((purpose) => required.includes(purpose))) {
+		skip(state.tracer, grant, permission.key, "purpose");
+		return;
+	}
+	const granteeMatch = matchGrantee(grant.to, subject, now, state.resource, state.scopes, state.policy.resources, grant.effect === "deny");
+	if (granteeMatch.matched) return granteeMatch;
+	const reason = granteeMatch.reason ?? "no-grant";
+	if (reason === "not-entitled" && !flattenGrantee(grant.to).every((item) => item.kind !== "role" || holdsRole(state, item, custom))) {
+		skip(state.tracer, grant, permission.key, "grantee");
+		return;
+	}
+	state.denials.push((reason === "insufficient-user-authentication" || reason === "not-entitled") && grant.to !== void 0 ? {
+		role: grant.role,
+		reason,
+		to: grant.to
+	} : {
+		role: grant.role,
+		reason
+	});
+}
+/** One candidate grant: records an allow, a denial or a skip, or returns the decision a deny ends with. */
+function evaluateCandidate(state, { grant, custom }, breakGlass) {
+	const { policy, subject, permission, now, env, tracer } = state;
+	const displayRole = grant.role;
+	if (tracer !== void 0) tracer.evaluated += 1;
+	const granteeMatch = granteeOf(state, grant, custom);
+	if (granteeMatch === void 0) return;
+	const scoped = roleScope(state, grant, custom);
+	if (!scoped.held) return;
+	if (!isActive(grant.validity, now)) {
+		if (grant.effect === "allow") state.denials.push({
+			role: displayRole,
+			reason: "inactive-grant",
+			detail: wireValidity(grant.validity) ?? {}
+		});
+		else skip(tracer, grant, permission.key, "validity");
+		return;
+	}
+	const requirement = grant.requires === void 0 || grant.effect !== "allow" ? void 0 : requirementCondition(policy, subject, grant.requires, state.resource, now, env.customRoles, env.customGrants);
+	const merged = freezeDeep(compact({
+		...grant,
+		where: combineWhere(combineWhere(grant.where, granteeMatch.where), requirement)
+	}));
+	const condition = evaluateGrantCondition(merged, permission, state.current, state.next, subject, now, state.scopes, env.relations, (target, id, key) => inheritedVerdict(state.evaluate, policy, state.given, target, id, key, now, env));
+	if (!condition.matched && condition.reason === "closure-error") emitSafe(env.listeners.error, condition.cause ?? /* @__PURE__ */ new Error("closure-error"), env.listeners);
+	if (!condition.matched && grant.effect === "deny" && isUnevaluable(condition.reason) && grantCoversField(grant.fields, state.options.field, grant.effect)) {
+		tracer?.denies.push(matchedOf(merged, permission.key));
+		return deniedNow(state, {
+			role: displayRole,
+			reason: condition.reason ?? "relation-unavailable"
+		});
+	}
+	if (!condition.matched) {
+		state.denials.push({
+			role: displayRole,
+			reason: condition.reason ?? "condition",
+			detail: condition.cause
+		});
+		return;
+	}
+	if (!grantCoversField(grant.fields, state.options.field, grant.effect)) {
+		skip(tracer, grant, permission.key, "field");
+		return;
+	}
+	if (grant.effect === "deny") {
+		tracer?.denies.push(matchedOf(merged, permission.key));
+		if (grant.name !== void 0 && breakGlass.overrides.has(grant.name)) {
+			if (breakGlass.grant !== void 0) return;
+			if (breakGlass.denial !== void 0) return deniedWithAlternatives(state, [breakGlass.denial]);
+		}
+		return deniedWithAlternatives(state, [grant.name === void 0 ? {
+			role: displayRole,
+			reason: "deny"
+		} : {
+			role: displayRole,
+			reason: "deny",
+			detail: { name: grant.name }
+		}]);
+	}
+	tracer?.allows.push(matchedOf(merged, permission.key));
+	state.allows.push(scoped.membership === void 0 ? { grant: merged } : {
+		grant: merged,
+		membership: scoped.membership
+	});
+}
+/** Adds the break-glass allow, or puts its denial first, once every candidate has run. */
+function mergeBreakGlass(state, breakGlass) {
+	if (breakGlass.grant !== void 0) {
+		state.tracer?.allows.push(matchedOf(breakGlass.grant, state.permission.key, true));
+		state.allows.push({
+			grant: breakGlass.grant,
+			obligations: breakGlass.obligations,
+			breakGlass: true
+		});
+	} else if (breakGlass.denial !== void 0) state.denials.unshift(breakGlass.denial);
+}
+//#endregion
+//#region src/core/evaluate/post-allow.ts
+function noAllowDecision(state) {
+	const { denials, subject, roles } = state;
+	const reason = denials[0]?.reason ?? (subject.principal === null ? "anonymous" : roles.global.unknown.length > 0 && roles.global.roles.length === 0 ? "unknown-role" : "no-grant");
+	return deniedWithAlternatives(state, denials.length > 0 ? denials : [{
+		role: null,
+		reason
+	}]);
+}
+/**
+* The allows a delegation leaves usable. A policy delegation is a ceiling for
+* the actor: outside it, nothing is delegated; inside it, a token delegation
+* on the call must still cover.
+*/
+function delegatedAllows(state) {
+	const { policy, subject, permission, current } = state;
+	const ceiling = delegatedPermissions(policy.delegations, subject, state.roles.matching, state.now);
+	if (ceiling !== void 0 && !ceiling.has(permission.key) || readOnlyActorRefuses(subject.actor, permission)) return deniedWithAlternatives(state, [{
+		role: null,
+		reason: "not-delegated"
+	}]);
+	const unscoped = subject.actor !== void 0 && ceiling === void 0;
+	let delegationMiss = coveredByDelegation(permission, subject.delegation, resourceIdOf(current), unscoped);
+	const requirementsCovered = state.allows.filter((candidate) => coversRequirements(policy.permissions, candidate.grant.requires, subject.delegation, resourceIdOf(current), unscoped));
+	const usable = delegationMiss === void 0 ? requirementsCovered : requirementsCovered.filter((candidate) => requiresStandIn(candidate.grant));
+	if (delegationMiss === "not-delegated" && usable.length > 0) delegationMiss = void 0;
+	if (delegationMiss === void 0 && usable.length === 0) delegationMiss = "not-delegated";
+	if (delegationMiss !== void 0) return deniedWithAlternatives(state, [{
+		role: null,
+		reason: delegationMiss
+	}]);
+	return usable;
+}
+//#endregion
+//#region src/core/evaluate/approval.ts
+/** The allow's approval, tightened by the loaded `ApprovalPolicySource` entries. */
+function approvalOf(state, candidate) {
+	const approvalPolicies = state.env.approvalPolicies;
+	return approvalPolicies === void 0 || approvalPolicies === "failed" ? candidate.grant.approval : approvalPolicies.tighten(candidate.grant.approval, {
+		permission: state.permission.key,
+		tenant: decisionTenant(state.subject, candidate.membership),
+		subject: state.subject,
+		current: state.current,
+		next: state.next,
+		now: state.now,
+		scopes: state.scopes,
+		operation: state.options.operation?.meta
+	});
+}
+//#endregion
+//#region src/core/evaluate/quota.ts
+/** The quota verdict for one allow: free without a `limit`, unavailable without the `limits()` feature. */
+function quotaOf(state, grant, consume) {
+	const { env, subject } = state;
+	if (grant.limit === void 0) return { ok: true };
+	if (env.limits === void 0) return {
+		ok: false,
+		reason: "limit-unavailable"
+	};
+	return env.limits.quota({
+		cache: env.limitCache,
+		limit: grant.limit,
+		permissionKey: state.permission.key,
+		subjectId: subject.principal?.id ?? "",
+		tenant: subject.principal?.tenant,
+		now: state.now,
+		consume
+	});
+}
+/** The first usable allow whose quota admits the call, or the quota denials. */
+function quotaAllow(state, usable) {
+	const denials = [];
+	for (const candidate of usable) {
+		const approval = approvalOf(state, candidate);
+		const quota = quotaOf(state, candidate.grant, !requiresApproval(approval) && shouldConsumeQuota(state.options.call, state.env.simulated));
+		if (quota.ok) return {
+			allow: candidate,
+			approval,
+			quota: compact({
+				quota: quota.quota,
+				obligations: quota.obligations
+			})
+		};
+		denials.push(quota.reason === "limit" ? {
+			role: candidate.grant.role,
+			reason: "limit",
+			detail: quota.detail
+		} : {
+			role: candidate.grant.role,
+			reason: quota.reason
+		});
+	}
+	return { denials };
+}
+//#endregion
+//#region src/core/evaluate/index.ts
+/**
+* One decision, in stages: the call (clock, rows, delegated permission), the
+* subject (held roles, actor), the candidate grants (a matching deny ends
+* here), break-glass, freshness, delegation and contact, the approval and
+* quota of each usable allow, and the decision. Every exit goes through
+* `complete`, which freezes and emits.
+*/
+function evaluate(policy, given, permission, data, options, env) {
+	const call = {
+		policy,
+		given,
+		subject: subjectForPermission(given, permission.key),
+		permission,
+		options,
+		env,
+		now: epochSeconds(options.now),
+		resource: getResource(policy.permissions, permission.resource),
+		tracer: options.explain === true ? {
+			evaluated: 0,
+			allows: [],
+			denies: [],
+			skipped: []
+		} : void 0,
+		evaluate
+	};
+	if (!Number.isFinite(call.now)) return deniedNow({
+		...call,
+		now: epochSeconds(),
+		current: data
+	}, {
+		role: null,
+		reason: "validation",
+		detail: INVALID_NOW
+	});
+	const rows = validatedRows(call, data, rowValues(permission, data));
+	if (rows.invalid !== void 0) return deniedNow({
+		...call,
+		current: rows.current
+	}, {
+		role: null,
+		reason: "validation",
+		detail: rows.invalid
+	});
+	const settled = {
+		...call,
+		current: rows.current
+	};
+	if (isDelegatedPermission(policy, permission)) return deniedNow(settled, {
+		role: null,
+		reason: "pdp-unavailable",
+		detail: "use permdock/pdp getPermDock"
+	});
+	const scopes = scopeList(policy.scopes);
+	const declared = declaredRoleNames(policy);
+	const roles = heldRoles(call, scopes, declared);
+	if (lacksActor(call, scopes)) return deniedNow(settled, {
+		role: null,
+		reason: "actor-required"
+	});
+	const state = {
+		...call,
+		current: rows.current,
+		next: rows.next,
+		scopes,
+		declared,
+		roles,
+		purposes: purposesOf(call.subject),
+		walkRole: walkRoleFor(call),
+		denials: roles.denials,
+		allows: []
+	};
+	const breakGlass = breakGlassFor(call, scopes);
+	for (const candidate of candidatesFor(call)) {
+		const decision = evaluateCandidate(state, candidate, breakGlass);
+		if (decision !== void 0) return decision;
+	}
+	mergeBreakGlass(state, breakGlass);
+	if (state.allows.length === 0) return noAllowDecision(state);
+	if (state.subject.stale === true && (policy.fresh ?? []).includes(permission.key)) return deniedNow(state, {
+		role: null,
+		reason: "stale-credentials"
+	});
+	const delegated = delegatedAllows(state);
+	if (!Array.isArray(delegated)) return delegated;
+	const usable = contactAllows(policy, state.subject, permission, delegated);
+	if (usable.length === 0) return deniedWithAlternatives(state, [{
+		role: null,
+		reason: "not-delegated"
+	}]);
+	if (env.approvalPolicies === "failed") return deniedNow(state, {
+		role: null,
+		reason: "approval",
+		detail: APPROVAL_POLICY_UNAVAILABLE
+	});
+	const chosen = quotaAllow(state, usable);
+	if ("denials" in chosen) return deniedWithAlternatives(state, chosen.denials.length > 0 ? chosen.denials : state.denials);
+	return allowedDecision(state, chosen.allow, chosen.approval, chosen.quota);
+}
+//#endregion
+export { contactMayUse as A, validateCustomRole as C, activate as D, finish as E, isContact as M, APPROVAL_POLICY_UNAVAILABLE as N, breakGlass as O, tenantCustomRoles as S, emptyListeners as T, isSharedCustomRole as _, expandRoleNames as a, resolveCustomRole as b, andWhere as c, customRoleClaim as d, customRoleId as f, holdsGlobalCustomRole as g, holdsCustomRole as h, customRolesFor as i, contactMemberships as j, supportAccess as k, ceilingGrants as l, customRoleScope as m, requirementCondition as n, roleSourceFor as o, customRoleOf as p, assignableNamesFor as r, sourceName as s, evaluate as t, customGrantsFor as u, leveled as v, emitSafe as w, roleAllowKeys as x, membershipsClaim as y };