permdock 0.4.0 → 0.6.0

package/dist/{helpers-C9YmyBIa.js → helpers-CBYVMjwh.js}

@@ -1,13 +1,16 @@
 import { t as compact } from "./compact-CAf557ZB.js";
 import { n as freezeDeep } from "./freeze-CrU8nQeX.js";
 import { r as approverLeaves } from "./approvers-CqPOLD-o.js";
-import { t as describe } from "./describe-Cgkp7eP0.js";
-import { t as parseDuration } from "./duration-xK2jGFVc.js";
-import { i as getRegistry, n as findPermission } from "./permission-registry-BsblpB-z.js";
-import { r as relationReader, t as pendingRelations } from "./relations-CvmSpG67.js";
-import { n as resolveRelated } from "./relation-walk-BXnlLtg2.js";
-import { t as ApprovalError } from "./errors-DRnGZHzF.js";
-import { f as approverRelationKey, l as APPROVAL_HEADER, n as assertApprover, s as listAllApprovals } from "./store-ILkLUj_o.js";
+import { t as describe } from "./describe-BybMRY7A.js";
+import { i as getRegistry, n as findPermission } from "./permission-registry-Br4jSNVi.js";
+import { t as assertAppData } from "./app-data-MuyzVqX8.js";
+import { a as durationOf, i as dateAt, u as isoAt } from "./time-DkWjdL98.js";
+import { r as relationReader, t as pendingRelations } from "./relations-BnCWnJGI.js";
+import { n as resolveRelated } from "./relation-walk-3OyDBF0S.js";
+import { n as toWireDelegation } from "./wire-delegation-Cv3W2eaM.js";
+import { i as approverRelationKey, s as ApprovalError, t as APPROVAL_HEADER } from "./types-DqzsnlSA.js";
+import { c as listAllApprovals, n as assertApprover } from "./store-BDutJkDL.js";
+import { n as parseApprovalHeader } from "./approval-header-CJACtHkv.js";
 //#region src/approvals/relations.ts
 const DEFAULT_PARENT_DEPTH = 16;
 /** Every approver a request names: `by`, each stage and its escalation, and `escalation.to`, inside `anyOf` groups too. */
@@ -71,7 +74,7 @@ async function approverRelations(request, subject, options) {
 	const registry = getRegistry(options.permissions);
 	const cache = /* @__PURE__ */ new Map();
 	const reader = relationReader(options.relations, cache, registry);
-	const now = (options.now ?? /* @__PURE__ */ new Date()).getTime() / 1e3;
+	const now = dateAt(options.now).getTime() / 1e3;
 	const holds = async (item) => {
 		const start = await startOf(item, request.resource.type, id, reader, cache, registry);
 		if (start === void 0) return false;
@@ -133,7 +136,7 @@ function permissionMeta(permission) {
 		resource: permission.resource
 	};
 }
-function summariseSubject(subject) {
+function summarizeSubject(subject) {
 	const principal = subject.principal;
 	return compact({
 		principal: principal === null ? null : compact({
@@ -146,10 +149,10 @@ function summariseSubject(subject) {
 			kind: subject.actor.kind
 		},
 		session: subject.session,
-		delegation: subject.delegation === void 0 ? void 0 : compact({
+		delegation: toWireDelegation(subject.delegation === void 0 ? void 0 : compact({
 			scopes: subject.delegation.scopes,
 			authorizationDetails: subject.delegation.authorizationDetails
-		})
+		}))
 	});
 }
 /**
@@ -158,13 +161,14 @@ function summariseSubject(subject) {
 * extends it.
 */
 function approvalTtl(storeTtl, approval) {
-	if (storeTtl !== void 0 && (!Number.isSafeInteger(storeTtl) || storeTtl <= 0)) throw new RangeError(`PermDock: approval ttl must be a positive whole number of milliseconds, got ${String(storeTtl)}`);
-	const base = storeTtl ?? 36e5;
-	const grant = approval === void 0 || approval === "human" ? void 0 : parseDuration(approval.ttl);
-	return grant === void 0 ? base : Math.min(base, grant * 1e3);
+	if (storeTtl !== void 0 && durationOf(storeTtl) === void 0) throw new RangeError(`PermDock: approval ttl must be a whole number of seconds above 0, got ${String(storeTtl)}`);
+	const base = storeTtl ?? 3600;
+	const grant = approval === void 0 || approval === "human" ? void 0 : durationOf(approval.ttl);
+	return grant === void 0 ? base : Math.min(base, grant);
 }
 async function requestApproval(store, decision, meta) {
-	const now = meta.now ?? /* @__PURE__ */ new Date();
+	if (meta.x !== void 0) assertAppData(meta.x, "x of an approval request");
+	const now = dateAt(meta.now);
 	const leaf = permissionMeta(meta.permission);
 	const approval = decision.grant.approval;
 	const approvers = approval === void 0 || approval === "human" ? void 0 : compact({
@@ -179,18 +183,20 @@ async function requestApproval(store, decision, meta) {
 	const ttl = approvalTtl(meta.ttl ?? store.ttl, approval);
 	const request = freezeDeep(compact({
 		v: 1,
+		id: globalThis.crypto.randomUUID(),
 		token: decision.token,
 		permission: leaf.key,
 		scope: leaf.scope,
 		resource: meta.resource ?? { type: leaf.resource },
-		subject: summariseSubject(meta.subject),
+		subject: summarizeSubject(meta.subject),
 		membership: meta.membership,
 		approvers,
 		detail: meta.detail ?? describe(decision).detail,
 		adapter: meta.adapter,
 		createdAt: now.toISOString(),
-		expiresAt: new Date(now.getTime() + ttl).toISOString(),
-		status: "pending"
+		expiresAt: isoAt(now.getTime() + ttl * 1e3),
+		status: "pending",
+		x: meta.x
 	}));
 	await store.create(request);
 	return request;
@@ -220,28 +226,29 @@ async function vouchApproval(store, token, verdict) {
 		vouched: verdict.rule
 	}));
 }
-async function inspectApproval(store, token, now = /* @__PURE__ */ new Date()) {
-	await store.expire(now);
+async function inspectApproval(store, token, at) {
+	const now = dateAt(at).getTime();
+	await store.expire({ epochMilliseconds: now });
 	const request = await store.get(token);
 	if (request === null) return {
 		ok: false,
-		detail: "approval-not-found"
+		cause: "approval-not-found"
 	};
 	if (request.status === "pending") return {
 		ok: false,
-		detail: "approval-pending"
+		cause: "approval-pending"
 	};
 	if (request.status === "rejected") return {
 		ok: false,
-		detail: "approval-rejected"
+		cause: "approval-rejected"
 	};
 	if (request.consumedAt !== void 0) return {
 		ok: false,
-		detail: "approval-consumed"
+		cause: "approval-consumed"
 	};
-	if (request.status === "expired" || Date.parse(request.expiresAt) <= now.getTime()) return {
+	if (request.status === "expired" || Date.parse(request.expiresAt) <= now) return {
 		ok: false,
-		detail: "approval-expired"
+		cause: "approval-expired"
 	};
 	return {
 		ok: true,
@@ -249,17 +256,18 @@ async function inspectApproval(store, token, now = /* @__PURE__ */ new Date()) {
 	};
 }
 /** Inspects `token` and, when it is approved, consumes it so it resumes once. */
-async function consumeApproval(store, token, now = /* @__PURE__ */ new Date()) {
+async function consumeApproval(store, token, at) {
+	const now = { epochMilliseconds: dateAt(at).getTime() };
 	const inspected = await inspectApproval(store, token, now);
 	if (!inspected.ok) return inspected;
 	if (typeof store.consume !== "function") return {
 		ok: false,
-		detail: "approval-not-found"
+		cause: "approval-not-found"
 	};
 	const consumed = await store.consume(token, now);
 	if (consumed === null) return {
 		ok: false,
-		detail: "approval-consumed"
+		cause: "approval-consumed"
 	};
 	return {
 		ok: true,
@@ -332,13 +340,13 @@ async function resumeDecision(input) {
 		inspected = await inspectApproval(store, token, input.now);
 		if (inspected.ok) {
 			const { request } = inspected;
-			if (request.permission !== input.permission.key || request.resource.id !== void 0 && request.resource.id !== input.resource.id) return approvalDenied("approval-mismatch");
+			if (request.permission !== input.permission.key || request.resource.id !== void 0 && request.resource.id !== input.resource.id || request.subject.principal?.id !== input.subject.principal?.id) return approvalDenied("approval-mismatch");
 			if (input.consume !== false) inspected = await consumeApproval(store, token, input.now);
 		}
 	} catch {
 		return approvalDenied("approval-not-found");
 	}
-	if (!inspected.ok) return approvalDenied(inspected.detail);
+	if (!inspected.ok) return approvalDenied(inspected.cause);
 	const principal = input.subject.principal;
 	if (principal === null) return approvalDenied("approval-mismatch");
 	return {
@@ -383,16 +391,15 @@ async function cancelApprovals(store, filter, meta) {
 		}
 	}))).filter(Boolean).length;
 }
+/** The token of a `PermDock-Approval` field: one RFC 9651 sf-token Item with no parameters, else `undefined`. */
 function readApprovalHeader(headers) {
-	const value = headers.get(APPROVAL_HEADER);
-	if (value === null || value.trim() === "") return;
-	return value.trim();
+	return parseApprovalHeader(headers.get(APPROVAL_HEADER));
 }
 function resumeFromHeader(store, headers, now) {
 	const token = readApprovalHeader(headers);
 	if (token === void 0) return Promise.resolve({
 		ok: false,
-		detail: "approval-not-found"
+		cause: "approval-not-found"
 	});
 	return inspectApproval(store, token, now);
 }
@@ -409,7 +416,7 @@ function resumeFromHeader(store, headers, now) {
 */
 async function storedApprovalToken(store, decision, options = {}) {
 	if (store === void 0 || decision.outcome !== "approval-required") return;
-	const now = (options.now ?? /* @__PURE__ */ new Date()).getTime();
+	const now = dateAt(options.now).getTime();
 	try {
 		const record = await store.get(decision.token);
 		if (record === null || record.status === "pending" && options.denyPending !== true || record.status === "expired" || Date.parse(record.expiresAt) <= now) return;
@@ -419,4 +426,4 @@ async function storedApprovalToken(store, decision, options = {}) {
 	}
 }
 //#endregion
-export { requestApproval as a, resumeFromHeader as c, vouchApproval as d, approverPermissions as f, readApprovalHeader as i, storedApprovalToken as l, approverRelations as m, consumeApproval as n, resolveApproval as o, heldPermissions as p, inspectApproval as r, resumeDecision as s, cancelApprovals as t, summariseSubject as u };
+export { requestApproval as a, resumeFromHeader as c, vouchApproval as d, approverPermissions as f, readApprovalHeader as i, storedApprovalToken as l, approverRelations as m, consumeApproval as n, resolveApproval as o, heldPermissions as p, inspectApproval as r, resumeDecision as s, cancelApprovals as t, summarizeSubject as u };

package/dist/hono/index.d.ts

@@ -1,8 +1,9 @@
-import { E as Policy, Or as Principal, j as PolicyVocabulary, jt as PermDock } from "../policy-types-sp9P1iIV.js";
-import { d as Permission } from "../permission-types-Dg39z9Kv.js";
-import { n as RevocationFeed } from "../revocations-Cy06JNx2.js";
-import { A as ConnectionOptions, C as verifyWebBotAuth, O as Connection, b as discoverViaSignatureAgent, i as OpenApiHooks, m as InvalidSignatureError, o as ProtectOptions } from "../server-types-DdqBwZN_.js";
-import { t as ServerAdapterOptions } from "../bind-BzqG8SMb.js";
+import { T as Policy, j as PolicyVocabulary, rr as Principal } from "../policy-types-n0uRTsW8.js";
+import { w as Permission } from "../vocabulary-CN8H_9UF.js";
+import { r as PermDock } from "../permdock-SV8ZINYT.js";
+import { n as RevocationFeed } from "../revocations-R07lFBnX.js";
+import { D as ConnectionOptions, T as Connection, f as InvalidSignatureError, i as OpenApiHooks, o as ProtectOptions, v as discoverViaSignatureAgent, x as webBotAuthVerifier } from "../server-types-CKQiCnON.js";
+import { t as ServerAdapterOptions } from "../bind-DOyrv6zi.js";
 import { Context, Hono, MiddlewareHandler } from "hono";
 import { SSEMessage, SSEStreamingApi } from "hono/streaming";
 import { WSEvents } from "hono/ws";
@@ -12,15 +13,17 @@ type HonoPermDockOptions<TUser = unknown> = ServerAdapterOptions<Context, TUser>
   readonly revocations?: RevocationFeed;
 };
 /** The `Variables` both middlewares set; Hono merges them into the route's Env. */
-type PermDockEnv<TData = unknown, V extends PolicyVocabulary = PolicyVocabulary> = {
+type HonoPermDockEnv<TData = unknown, V extends PolicyVocabulary = PolicyVocabulary> = {
   readonly Variables: {
     readonly permdock: PermDock<V>;
     readonly permdockData: TData;
   };
 };
 type HonoPermDock<V extends PolicyVocabulary = PolicyVocabulary> = {
-  readonly permdock: () => MiddlewareHandler<PermDockEnv<unknown, V>>;
-  readonly protect: <TData = unknown>(permission: Permission | null, loadData?: (c: Context) => TData | Promise<TData>, protectOptions?: ProtectOptions) => MiddlewareHandler<PermDockEnv<NonNullable<TData>, V>>;
+  /** The `PermDock` for one request, for code the middleware does not run before. */
+  readonly getPermDock: (c: Context) => Promise<PermDock<V>>;
+  readonly middleware: () => MiddlewareHandler<HonoPermDockEnv<unknown, V>>;
+  readonly protect: <TData = unknown>(permission: Permission | null, data?: (c: Context) => TData | Promise<TData>, protectOptions?: ProtectOptions) => MiddlewareHandler<HonoPermDockEnv<NonNullable<TData>, V>>;
   /** A long-lived connection for the request behind `c`. */
   readonly connection: (c: Context, connectionOptions?: ConnectionOptions) => Promise<Connection>;
   /** `upgradeWebSocket` events that close with `1008` when the connection aborts. */
@@ -45,4 +48,4 @@ type SseOptions<T> = {
 };
 export declare function createPermDock<TUser, TPrincipal extends Principal = Principal, V extends PolicyVocabulary = PolicyVocabulary>(policy: Policy<TUser, TPrincipal, V>, options: HonoPermDockOptions<TUser>): HonoPermDock<V>;
 //#endregion
-export { type HonoPermDock, type HonoPermDockOptions, InvalidSignatureError, type PermDockEnv, type SseOptions, discoverViaSignatureAgent, verifyWebBotAuth };
+export { type HonoPermDock, type HonoPermDockEnv, type HonoPermDockOptions, InvalidSignatureError, type SseOptions, discoverViaSignatureAgent, webBotAuthVerifier };

package/dist/hono/index.js

@@ -1,9 +1,9 @@
 import { t as compact } from "../compact-CAf557ZB.js";
-import { r as PermDockRevokedError } from "../errors-drnfxYtm.js";
-import { i as discoverViaSignatureAgent, r as InvalidSignatureError, s as verifyWebBotAuth } from "../evaluations-C9YJsv3H.js";
-import { t as problemFromError } from "../map-error-BE27PYkE.js";
-import { r as bindKernel } from "../bind-kk-uyCwH.js";
-import { i as onRevoked, n as guardIterable, t as POLICY_VIOLATION } from "../stream-BMui98KK.js";
+import { r as PermDockRevokedError } from "../errors-BKy0EfhN.js";
+import { d as discoverViaSignatureAgent, m as webBotAuthVerifier, u as InvalidSignatureError } from "../evaluations-beAooV0n.js";
+import { t as problemFromError } from "../map-error-Dr70oA_3.js";
+import { r as bindKernel } from "../bind-CAvgUuKs.js";
+import { a as onRevoked, n as closeReason, r as guardIterable, t as POLICY_VIOLATION } from "../stream-CvdUS9V1.js";
 import { Hono } from "hono";
 //#region src/hono/create.ts
 function socket(connection, events) {
@@ -11,7 +11,7 @@ function socket(connection, events) {
 		...events,
 		onOpen: (evt, ws) => {
 			onRevoked(connection, (problem) => {
-				ws.close(POLICY_VIOLATION, problem.type);
+				ws.close(POLICY_VIOLATION, closeReason(problem));
 			});
 			if (!connection.signal.aborted) events.onOpen?.(evt, ws);
 		},
@@ -61,16 +61,16 @@ function mapDownstream(c) {
 	}
 }
 function createPermDock(policy, options) {
-	const { kernel, bind, scopeOf, handlerScope, attach, guard: runGuard } = bindKernel(policy, options, "hono", (c) => c.req.raw);
-	const permdock = () => async (c, next) => {
+	const { kernel, bind, scopeOf, handlerScope, getPermDock, attach, guard: runGuard } = bindKernel(policy, options, "hono", (c) => c.req.raw);
+	const middleware = () => async (c, next) => {
 		const attached = await attach(c);
 		if (!attached.ok) return attached.response;
 		c.set("permdock", attached.permdock);
 		await next();
 		mapDownstream(c);
 	};
-	const protect = (permission, loadData, protectOptions) => async (c, next) => {
-		const guard = await runGuard(permission, loadData, c, protectOptions);
+	const protect = (permission, data, protectOptions) => async (c, next) => {
+		const guard = await runGuard(permission, data, c, protectOptions);
 		if (!guard.ok) return guard.response;
 		c.set("permdock", guard.permdock);
 		c.set("permdockData", guard.data);
@@ -86,7 +86,8 @@ function createPermDock(policy, options) {
 		return app;
 	};
 	return {
-		permdock,
+		getPermDock,
+		middleware,
 		protect,
 		connection,
 		socket,
@@ -96,4 +97,4 @@ function createPermDock(policy, options) {
 	};
 }
 //#endregion
-export { InvalidSignatureError, createPermDock, discoverViaSignatureAgent, verifyWebBotAuth };
+export { InvalidSignatureError, createPermDock, discoverViaSignatureAgent, webBotAuthVerifier };

package/dist/hosted-B46-5LYE.js

@@ -0,0 +1,315 @@
+import { r as isRecord, t as compact } from "./compact-CAf557ZB.js";
+import { n as freezeDeep } from "./freeze-CrU8nQeX.js";
+import { n as isForbiddenKey, s as splitPath } from "./paths-DXSHAMIa.js";
+import { a as deny, i as completeGrant, n as role, p as normalizeWhere, r as allow } from "./role-builder-uWQZ4v84.js";
+import { a as getResource, n as findPermission } from "./permission-registry-Br4jSNVi.js";
+import { d as isSelfParented } from "./resource-relations-D_jw0BFx.js";
+import { a as durationOf, l as isRfc3339, m as rfc3339 } from "./time-DkWjdL98.js";
+import { r as sha256Digest } from "./sha256-D9ihqmvd.js";
+import { _ as listPlans, m as findRole, o as flattenGrantee } from "./grantee-hxrUsbpM.js";
+import { i as indexPolicy, t as declaredRoleNames } from "./policy-DbM5YYtV.js";
+//#region src/core/hosted.ts
+function memoryPolicySource(document = null) {
+	const current = document === null ? null : parsePolicyDocument(document);
+	return Object.freeze({
+		current: () => current,
+		refresh: () => Promise.resolve()
+	});
+}
+function rejectUnsafe(value) {
+	if (value === null || typeof value !== "object") return;
+	if (Array.isArray(value)) {
+		for (const item of value) rejectUnsafe(item);
+		return;
+	}
+	for (const key of Object.keys(value)) {
+		if (isForbiddenKey(key)) throw new Error(`PermDock: unsafe policy document key '${key}'`);
+		rejectUnsafe(value[key]);
+	}
+}
+/** Validates the document envelope; per-grant checks happen at merge time. */
+function parsePolicyDocument(json) {
+	const input = typeof json === "string" ? JSON.parse(json) : json;
+	if (!isRecord(input)) throw new TypeError("PermDock: policy document must be an object");
+	const copy = JSON.parse(JSON.stringify(input));
+	rejectUnsafe(copy);
+	if (copy["v"] !== 1) throw new Error(`PermDock: unsupported policy document version '${String(copy["v"])}'`);
+	if (typeof copy["id"] !== "string" || typeof copy["fingerprint"] !== "string" || typeof copy["catalog"] !== "string" || !isRfc3339(copy["issuedAt"]) || !Array.isArray(copy["grants"])) throw new TypeError("PermDock: malformed policy document");
+	return freezeDeep(copy);
+}
+/** The document verified `vnd.permdock.policy+jwt` claims carry: `policy`, with `jti` as `id` and `iat` as `issuedAt`. Throws like `parsePolicyDocument`. */
+function policyDocumentFromClaims(claims) {
+	const claim = claims["policy"];
+	const jti = claims["jti"];
+	const iat = claims["iat"];
+	if (!isRecord(claim) || typeof jti !== "string" || typeof iat !== "number") throw new TypeError("PermDock: malformed policy document");
+	return parsePolicyDocument({
+		...claim,
+		id: jti,
+		issuedAt: rfc3339(iat)
+	});
+}
+const COMPARISONS = /* @__PURE__ */ new Set([
+	"eq",
+	"ne",
+	"gt",
+	"gte",
+	"lt",
+	"lte",
+	"contains"
+]);
+function safePath(path) {
+	if (typeof path !== "string" || path.length === 0) return false;
+	return splitPath(path).every((segment) => !isForbiddenKey(segment));
+}
+function portableValue(value) {
+	if (value === null || typeof value === "string" || typeof value === "boolean" || typeof value === "number" && Number.isFinite(value)) return true;
+	if (Array.isArray(value)) return value.every(portableValue);
+	if (!isRecord(value)) return false;
+	const keys = Object.keys(value);
+	if (keys.length !== 1) return false;
+	if (keys[0] === "ref") return safePath(value["ref"]);
+	return keys[0] === "date" && typeof value["date"] === "string";
+}
+/** True for the portable subset only: no `opaque`, no `sqlFunction`, no unknown op. */
+function isPortableCondition(value) {
+	if (!isRecord(value) || typeof value["op"] !== "string") return false;
+	const op = value["op"];
+	if (COMPARISONS.has(op)) return safePath(value["field"]) && portableValue(value["value"]);
+	switch (op) {
+		case "in":
+		case "notIn": return safePath(value["field"]) && (Array.isArray(value["value"]) || isRecord(value["value"])) && portableValue(value["value"]);
+		case "isNull": return safePath(value["field"]) && typeof value["value"] === "boolean";
+		case "and":
+		case "or": return Array.isArray(value["conditions"]) && value["conditions"].every(isPortableCondition);
+		case "not": return isPortableCondition(value["condition"]);
+		case "memberOf": return (value["scope"] === "tenant" || value["scope"] === "team" || value["scope"] === "resource") && safePath(value["field"]) && Array.isArray(value["roles"]) && value["roles"].every((item) => typeof item === "string") && (value["resource"] === void 0 || typeof value["resource"] === "string") && (value["parents"] === void 0 || Array.isArray(value["parents"]) && value["parents"].every((parent) => safePath(parent) || isRecord(parent) && safePath(parent["field"]) && typeof parent["resource"] === "string"));
+		default: return false;
+	}
+}
+function approvalRank(approval) {
+	if (approval === void 0) return;
+	if (approval === "human") return {
+		distinct: true,
+		stale: false,
+		quorum: 1,
+		ttl: Number.POSITIVE_INFINITY,
+		escalates: false
+	};
+	return {
+		by: approval.stages === void 0 ? JSON.stringify(approval.by) : JSON.stringify([approval.mode, approval.stages]),
+		distinct: approval.distinct !== false,
+		stale: approval.staleOn === "resource-change",
+		quorum: approval.quorum ?? 1,
+		ttl: durationOf(approval.ttl) ?? Number.POSITIVE_INFINITY,
+		escalates: approval.escalation !== void 0
+	};
+}
+/** A hosted approval must meet every approval a code allow requires on the permission. */
+function approvalAtLeast(hosted, code) {
+	const mine = approvalRank(hosted);
+	for (const required of code) {
+		const theirs = approvalRank(required);
+		if (theirs === void 0) continue;
+		if (mine === void 0) return false;
+		if (theirs.distinct && !mine.distinct) return false;
+		if (theirs.stale && !mine.stale) return false;
+		if (theirs.by !== void 0 && mine.by !== theirs.by) return false;
+		if (mine.quorum < theirs.quorum || mine.ttl > theirs.ttl) return false;
+		if (mine.escalates && !theirs.escalates) return false;
+	}
+	return true;
+}
+/** A grantee kind this build does not know is never declared, so the hosted grant is dropped. */
+function undeclaredKind(_grantee) {
+	return false;
+}
+function declaredGrantee(policy, grantee, permissionResource) {
+	switch (grantee.kind) {
+		case "role": return declaredRoleNames(policy).has(grantee.role);
+		case "plan": return listPlans(policy.vocabulary.plans).some((leaf) => leaf.key === grantee.plan);
+		case "relation": return grantee.resource === permissionResource && getResource(policy.permissions, grantee.resource)?.relations[grantee.relation] !== void 0 && (grantee.through === void 0 || grantee.through === "parent" && isSelfParented(getResource(policy.permissions, grantee.resource))) && (grantee.depth === void 0 || grantee.through === "parent" && Number.isInteger(grantee.depth) && grantee.depth >= 0 && grantee.depth <= 32);
+		case "anyone":
+		case "authenticated":
+		case "actor":
+		case "assurance":
+		case "inherit": return false;
+		default: return undeclaredKind(grantee);
+	}
+}
+/** Approvers are declared roles, plans or relations, or any authenticated human. */
+function approvalAcceptable(policy, approval, permissionResource) {
+	if (approval === void 0 || approval === "human") return true;
+	if (!isRecord(approval)) return false;
+	if (approval["mode"] !== void 0 || approval["stages"] !== void 0) return false;
+	if (approval["distinct"] !== void 0 && typeof approval["distinct"] !== "boolean") return false;
+	if (approval["staleOn"] !== void 0 && (approval["staleOn"] !== "resource-change" || getResource(policy.permissions, permissionResource)?.version === void 0)) return false;
+	if (approval["quorum"] !== void 0 && (!Number.isInteger(approval["quorum"]) || approval["quorum"] < 1)) return false;
+	if (approval["ttl"] !== void 0 && durationOf(approval["ttl"]) === void 0) return false;
+	const escalation = approval["escalation"];
+	if (escalation !== void 0 && (!isRecord(escalation) || durationOf(escalation["after"]) === void 0 || !granteesAcceptable(policy, escalation["to"], permissionResource))) return false;
+	if (approval["by"] === void 0) return true;
+	return granteesAcceptable(policy, approval["by"], permissionResource);
+}
+function granteesAcceptable(policy, raw, permissionResource) {
+	if (raw === void 0) return false;
+	const items = flattenGrantee(raw);
+	return items.length > 0 && items.every((item) => isRecord(item) && item.kind !== "relation" && (item.kind === "authenticated" || declaredGrantee(policy, item, permissionResource)));
+}
+function buildGrant(policy, document, raw) {
+	if (!isRecord(raw) || typeof raw["id"] !== "string" || typeof raw["permission"] !== "string" || raw["effect"] !== void 0 && raw["effect"] !== "allow" && raw["effect"] !== "deny" || raw["to"] === void 0) return {
+		ok: false,
+		reason: "invalid"
+	};
+	const permission = findPermission(policy.permissions, raw["permission"]);
+	if (permission === void 0) return {
+		ok: false,
+		reason: "unknown-permission"
+	};
+	if (!policy.hostable.includes(permission.key)) return {
+		ok: false,
+		reason: "not-hostable"
+	};
+	const to = flattenGrantee(raw["to"]);
+	if (to.length === 0 || !to.every((item) => isRecord(item) && declaredGrantee(policy, item, permission.resource))) return {
+		ok: false,
+		reason: "unknown-grantee"
+	};
+	for (const condition of [raw["where"], raw["check"]]) if (condition !== void 0 && !isPortableCondition(condition)) return {
+		ok: false,
+		reason: "non-portable"
+	};
+	if (!approvalAcceptable(policy, raw["approval"], permission.resource)) return {
+		ok: false,
+		reason: "invalid"
+	};
+	if (raw["fields"] !== void 0 && !(Array.isArray(raw["fields"]) && raw["fields"].every((field) => typeof field === "string"))) return {
+		ok: false,
+		reason: "invalid"
+	};
+	const effect = raw["effect"] ?? "allow";
+	const options = compact({
+		where: raw["where"] === void 0 ? void 0 : normalizeWhere(raw["where"]),
+		check: raw["check"] === void 0 ? void 0 : normalizeWhere(raw["check"]),
+		approval: raw["approval"],
+		fields: raw["fields"]
+	});
+	let built;
+	try {
+		const roleItem = to.length === 1 && to[0]?.kind === "role" ? to[0] : null;
+		if (roleItem === null) {
+			const partial = (effect === "allow" ? allow : deny)(permission, {
+				...options,
+				to
+			});
+			built = completeGrant(partial);
+		} else {
+			const binding = policy.rolesByName.get(roleItem.role);
+			const leaf = findRole(policy.vocabulary.roles, roleItem.role);
+			const [first] = role(leaf ?? roleItem.role, [(effect === "allow" ? allow : deny)(permission, options)], binding?.on === void 0 ? {} : { on: binding.on }).grants;
+			if (first === void 0) throw new TypeError("PermDock: role produced no grant");
+			built = first;
+		}
+	} catch {
+		return {
+			ok: false,
+			reason: "invalid"
+		};
+	}
+	if (effect === "allow") {
+		const codeApprovals = policy.grants.filter((grant) => grant.effect === "allow" && grant.hosted === void 0 && grant.permission.key === permission.key).map((grant) => grant.approval);
+		if (!approvalAtLeast(built.approval, codeApprovals)) return {
+			ok: false,
+			reason: "weaker-approval"
+		};
+	}
+	return {
+		ok: true,
+		grant: freezeDeep({
+			...built,
+			hosted: {
+				document: document.fingerprint,
+				grant: raw["id"]
+			}
+		})
+	};
+}
+/** The grants of `document` that `policy` drops, in document order; `permdock/catalog` turns them into drift findings. */
+function hostedGrantDrops(policy, document) {
+	return document.grants.flatMap((raw) => {
+		const result = buildGrant(policy, document, raw);
+		if (result.ok) return [];
+		return [freezeDeep({
+			grant: isRecord(raw) && typeof raw.id === "string" ? raw.id : "",
+			permission: isRecord(raw) && typeof raw.permission === "string" ? raw.permission : "",
+			reason: result.reason
+		})];
+	});
+}
+/**
+* The code policy plus the hosted grants that pass every rule. Hosted
+* allows OR with code allows and any deny still wins, so a hosted grant can
+* never override a code deny; one that fails a rule is dropped, not thrown.
+*/
+function mergeHostedGrants(policy, document) {
+	if (document === null || document.grants.length === 0) return {
+		policy,
+		dropped: []
+	};
+	const merged = [];
+	const dropped = [];
+	for (const raw of document.grants) {
+		const result = buildGrant(policy, document, raw);
+		if (result.ok) {
+			merged.push(result.grant);
+			continue;
+		}
+		dropped.push(freezeDeep({
+			kind: "hosted-grant-dropped",
+			document: document.fingerprint,
+			grant: isRecord(raw) && typeof raw.id === "string" ? raw.id : "",
+			reason: result.reason
+		}));
+	}
+	if (merged.length === 0) return {
+		policy,
+		dropped
+	};
+	const grants = [...policy.grants, ...merged];
+	return {
+		policy: freezeDeep({
+			...policy,
+			grants,
+			index: indexPolicy(policy.roles, grants, policy.vocabulary),
+			fingerprint: sha256Digest(`${policy.fingerprint}:${document.fingerprint}`)
+		}),
+		dropped
+	};
+}
+function hostedPolicies(source) {
+	return Object.freeze({
+		feature: "hosted-policies",
+		apply(policy) {
+			if (policy.hostable.length === 0) return {
+				policy,
+				errors: []
+			};
+			let document;
+			try {
+				document = source.current();
+			} catch (error) {
+				return {
+					policy,
+					errors: [error]
+				};
+			}
+			const merged = mergeHostedGrants(policy, document);
+			return {
+				policy: merged.policy,
+				errors: merged.dropped
+			};
+		}
+	});
+}
+//#endregion
+export { mergeHostedGrants as a, memoryPolicySource as i, hostedPolicies as n, parsePolicyDocument as o, isPortableCondition as r, policyDocumentFromClaims as s, hostedGrantDrops as t };