permdock 0.4.0 → 0.6.0

package/dist/instance-snapshot-BOEhcqIF.js

@@ -0,0 +1,601 @@
+import { t as compact } from "./compact-CAf557ZB.js";
+import { n as freezeDeep } from "./freeze-CrU8nQeX.js";
+import { a as hasConditionOp } from "./refs-K6eWUJ0H.js";
+import { o as sameId } from "./expiry-D4_YKRKD.js";
+import { a as getResource, c as listPermissions } from "./permission-registry-Br4jSNVi.js";
+import { n as isThenable } from "./thenable-yD7SabqG.js";
+import { u as isPrincipalRelation } from "./resource-relations-D_jw0BFx.js";
+import { p as nowSeconds, s as instantAt } from "./time-DkWjdL98.js";
+import { t as canonicalJson } from "./canonical-json-BC8_nMTw.js";
+import { c as rootScope, d as scopeList, i as keepsPermission, m as tenantOf, o as resolveScope } from "./scopes-CUPSjo9q.js";
+import { a as readOnlyActorRefuses, i as delegatedPermissions, r as coversRequirements } from "./delegation-j6-rc37o.js";
+import { b as synthesiseRole, m as findRole, o as flattenGrantee, v as listRoles, x as treeXSchema, y as sourceRoleMeta } from "./grantee-hxrUsbpM.js";
+import { c as nowSeconds$1, d as resolveActiveTenant, l as partitionsOf, p as scopeField, r as isMembershipExpired } from "./tenancy-DN2QAx9z.js";
+import { a as levelCondition, o as levelNames, r as grantList, t as declaredRoleNames } from "./policy-DbM5YYtV.js";
+import { t as byCodePoint } from "./compare-pfyVnBjE.js";
+import { A as contactMayUse, S as tenantCustomRoles, T as emptyListeners, _ as isSharedCustomRole, a as expandRoleNames, b as resolveCustomRole, g as holdsGlobalCustomRole, h as holdsCustomRole, l as ceilingGrants, m as customRoleScope, n as requirementCondition, p as customRoleOf, t as evaluate, u as customGrantsFor, x as roleAllowKeys } from "./evaluate-CNClBvcj.js";
+import { n as matchGrantee, t as combineWhere } from "./grantee-match-DbENBHLB.js";
+import { t as buildSnapshot } from "./snapshot-B7DkYg6g.js";
+//#region src/core/memberships.ts
+/** Two memberships are the same row when everything but `roles` matches. */
+function identity(membership) {
+	const within = Object.entries(membership.within ?? {}).toSorted(([a], [b]) => byCodePoint(a, b));
+	return JSON.stringify([
+		membership.scope ?? null,
+		membership.id ?? null,
+		within,
+		membership.on ?? null,
+		membership.tenant ?? null,
+		membership.team ?? null,
+		membership.via ?? null,
+		membership.expiresAt ?? null,
+		membership.grantedBy ?? null,
+		membership.reason ?? null,
+		membership.member?.group ?? null,
+		[...membership.eligible ?? []].toSorted(),
+		membership.managedBy ?? null,
+		[...membership.entitlements ?? []].toSorted(),
+		membership.keep === void 0 ? null : [...membership.keep].toSorted()
+	]);
+}
+/**
+* Merges memberships from several sources: entries naming the same instance
+* with the same `via`, expiry, owner and seats become one entry with the union
+* of their roles. Entries that differ in any of those stay separate, so a
+* staff role and a contact role in one instance keep their own `via`.
+*/
+function mergeMemberships(lists) {
+	const merged = /* @__PURE__ */ new Map();
+	for (const list of lists) for (const membership of list) {
+		const key = identity(membership);
+		const found = merged.get(key);
+		merged.set(key, found === void 0 ? membership : {
+			...found,
+			roles: [.../* @__PURE__ */ new Set([...found.roles, ...membership.roles])]
+		});
+	}
+	return [...merged.values()];
+}
+function all(values) {
+	return values.some((value) => isThenable(value)) ? Promise.all(values) : values;
+}
+function then(value, next) {
+	return isThenable(value) ? Promise.resolve(value).then(next) : next(value);
+}
+/**
+* One `MembershipSource` over several: memberships are merged and
+* de-duplicated, `list` concatenates the sources that can list, and `version`
+* is the highest version any source reports. A source that throws makes the
+* whole lookup throw, which the subject resolver turns into no memberships.
+*/
+function composeMemberships(sources) {
+	const listing = sources.filter((source) => source.list !== void 0);
+	const versioned = sources.filter((source) => source.version !== void 0);
+	return {
+		membershipsFor(principal, options) {
+			return then(all(sources.map((source) => source.membershipsFor(principal, options))), (lists) => mergeMemberships(lists));
+		},
+		...listing.length === 0 ? {} : { list(query) {
+			return then(all(listing.map((source) => source.list?.(query) ?? [])), (lists) => {
+				const seen = /* @__PURE__ */ new Map();
+				for (const entry of lists.flat()) {
+					const key = `${entry.principal.id}\u0000${identity(entry.membership)}`;
+					const found = seen.get(key);
+					seen.set(key, found === void 0 ? entry : {
+						principal: entry.principal,
+						membership: {
+							...found.membership,
+							roles: [.../* @__PURE__ */ new Set([...found.membership.roles, ...entry.membership.roles])]
+						}
+					});
+				}
+				return [...seen.values()];
+			});
+		} },
+		...versioned.length === 0 ? {} : { version(principal) {
+			return then(all(versioned.map((source) => source.version?.(principal))), (versions) => {
+				const known = versions.filter((value) => typeof value === "number" && Number.isFinite(value));
+				return known.length === 0 ? void 0 : Math.max(...known);
+			});
+		} }
+	};
+}
+/** A single source, or several composed. */
+function asMembershipSource(input) {
+	return Array.isArray(input) ? composeMemberships(input) : input;
+}
+/**
+* Trust the memberships the verified token carries, and read `source` only
+* when the token marks them truncated. With `version`, a token minted before
+* the latest membership change is stale for the policy's `fresh` permissions,
+* or with `onStale: 'reread'` has its memberships read from `source` instead.
+*/
+function claimsFirst(source, options = {}) {
+	const inner = asMembershipSource(source);
+	const version = options.version ?? (inner.version === void 0 ? void 0 : (principal) => inner.version?.(principal));
+	return {
+		membershipsFor: (principal, query) => inner.membershipsFor(principal, query),
+		...inner.list === void 0 ? {} : { list: (query) => inner.list?.(query) ?? [] },
+		...version === void 0 ? {} : { version },
+		...options.onStale === "reread" ? { onStale: "reread" } : {},
+		claimsFirst: true
+	};
+}
+/** Whether the identity provider owns `membership`: the application must not add, change or remove it. */
+function isExternallyManaged(membership) {
+	return membership.managedBy === "idp";
+}
+/**
+* How many principals hold `role` in one scope instance now, from the
+* source's member list (`MembershipSource.list`): live memberships of exactly
+* that scope and instance, each principal counted once. The `holders` a
+* `decideRoleChange` with `min`, `max` or `transferOnly` needs. `undefined`
+* when the source cannot list or the read fails, which that check denies.
+*/
+async function countHolders(source, query) {
+	const composed = asMembershipSource(source);
+	if (composed.list === void 0) return;
+	const role = typeof query.role === "string" ? query.role : query.role.key;
+	try {
+		const entries = await composed.list({
+			scope: query.scope,
+			id: query.id
+		});
+		const now = nowSeconds();
+		const holders = /* @__PURE__ */ new Set();
+		for (const entry of entries) {
+			const membership = entry.membership;
+			if (membership.scope === query.scope && membership.id === query.id && membership.roles.includes(role) && (membership.expiresAt === void 0 || membership.expiresAt > now)) holders.add(entry.principal.id);
+		}
+		return holders.size;
+	} catch {
+		return;
+	}
+}
+//#endregion
+//#region src/core/role-rank.ts
+function bindingOf(policy, name) {
+	return policy.rolesByName.get(name);
+}
+function roleMeta(policy, name) {
+	return bindingOf(policy, name)?.meta ?? findRole(policy.vocabulary?.roles, name)?.meta;
+}
+/** A role with `for` is held only through a membership of one of those kinds. */
+function mayHoldVia(policy, role, via) {
+	const kinds = bindingOf(policy, role)?.for;
+	return kinds === void 0 || via !== void 0 && kinds.includes(via);
+}
+function sameList(a, b) {
+	return a.length === b.length && a.every((item, index) => item === b[index]);
+}
+/**
+* The identity provider may only hand out what the application could: a
+* declared role with `assignable: false` (an owner, a platform role) never
+* rides in on a `managedBy: 'idp'` membership. A name the policy does not
+* declare stays, because only a tenant's custom role can give it meaning.
+*/
+function mayHoldManaged(policy, role, membership) {
+	return !isExternallyManaged(membership) || bindingOf(policy, role)?.assignable !== false;
+}
+/**
+* Drops every role a membership's kind may not hold (fail-closed: a missing
+* `via` is no kind) and every non-assignable role on an identity-provider
+* membership. Global roles have no kind, so a role with `for` held globally
+* is dropped too.
+*/
+function applyRoleKinds(policy, roles, memberships) {
+	const kinds = policy.roles.some((binding) => binding.for !== void 0);
+	if (!kinds && !memberships.some(isExternallyManaged)) return {
+		roles,
+		memberships
+	};
+	return {
+		roles: kinds ? roles?.filter((name) => mayHoldVia(policy, name, void 0)) ?? roles : roles,
+		memberships: memberships.map((membership) => {
+			const allowed = membership.roles.filter((name) => mayHoldVia(policy, name, membership.via) && mayHoldManaged(policy, name, membership));
+			return sameList(allowed, membership.roles) ? membership : freezeDeep({
+				...membership,
+				roles: allowed
+			});
+		})
+	};
+}
+function usesAssigns(policy) {
+	return policy.roles.some((binding) => binding.assigns !== void 0);
+}
+/** Declared role names in declaration order: bindings first, then vocabulary-only leaves. */
+function declarationOrder(policy) {
+	const names = policy.roles.map((binding) => binding.name);
+	const seen = new Set(names);
+	for (const leaf of listRoles(policy.vocabulary?.roles)) if (!seen.has(leaf.key)) {
+		names.push(leaf.key);
+		seen.add(leaf.key);
+	}
+	return names;
+}
+/**
+* Each role's depth in the `assigns` graph: a role nobody else assigns is 0,
+* a role another assigns sits one below its deepest assigner. Cycles stop
+* after one pass per role.
+*/
+function assignDepths(policy) {
+	const names = declarationOrder(policy);
+	const depth = new Map(names.map((name) => [name, 0]));
+	for (let pass = 0; pass < names.length; pass += 1) {
+		let changed = false;
+		for (const binding of policy.roles) {
+			const from = depth.get(binding.name) ?? 0;
+			for (const target of binding.assigns ?? []) if (target !== binding.name && (depth.get(target) ?? 0) < from + 1) {
+				depth.set(target, from + 1);
+				changed = true;
+			}
+		}
+		if (!changed) break;
+	}
+	return depth;
+}
+/**
+* `names` ordered by rank: assigners before the roles they assign, then
+* declaration order. Without an `assigns` graph the order is kept.
+*/
+function rankRoles(policy, names) {
+	if (!usesAssigns(policy)) return names;
+	const order = declarationOrder(policy);
+	const depth = assignDepths(policy);
+	const index = (name) => {
+		const found = order.indexOf(name);
+		return found === -1 ? order.length : found;
+	};
+	return [...names].toSorted((a, b) => (depth.get(a) ?? Number.MAX_SAFE_INTEGER) - (depth.get(b) ?? Number.MAX_SAFE_INTEGER) || index(a) - index(b));
+}
+/** The distinct `meta.audience` values of `names`, in rank order. */
+function audiencesOf(policy, names) {
+	const out = [];
+	for (const name of rankRoles(policy, names)) {
+		const audience = roleMeta(policy, name)?.audience;
+		if (typeof audience === "string" && !out.includes(audience)) out.push(audience);
+	}
+	return out;
+}
+/** Whether `membership` is the instance itself or one of its ancestors named in `within`. */
+//#endregion
+//#region src/core/held-roles.ts
+/**
+* Role names held in `tenant` on live memberships, global roles included, in
+* rank order. With `scope`, only the roles of that scope's memberships (and
+* instance `id`).
+*/
+function heldRoleNames(policy, subject, tenant, only, now) {
+	if (subject.principal === null) return [];
+	const scopes = scopeList(policy.scopes);
+	const scope = only?.scope === void 0 ? void 0 : resolveScope(scopes, only.scope);
+	if (only?.scope !== void 0 && scope === void 0) return [];
+	const names = new Set(scope === void 0 ? subject.principal.roles ?? [] : []);
+	for (const membership of subject.principal.memberships ?? []) {
+		if (isMembershipExpired(membership, now) || membership.keep !== void 0) continue;
+		if (!(scope === void 0 ? tenantOf(membership, scopes) === tenant : membership.scope === scope && (only?.id === void 0 || sameId(membership.id, only.id)))) continue;
+		for (const role of membership.roles) names.add(role);
+	}
+	return rankRoles(policy, [...names]);
+}
+function roleLeaf(policy, name) {
+	const binding = policy.rolesByName.get(name);
+	return findRole(policy.vocabulary?.roles, name) ?? synthesiseRole(name, compact({
+		on: typeof binding?.on === "string" ? binding.on : void 0,
+		assignable: binding?.assignable,
+		meta: binding?.meta
+	}));
+}
+//#endregion
+//#region src/core/snapshot-grants.ts
+/** A grant on a relation with a `period` is decided on the server, where the clock is. */
+function periodBound(policy, grant) {
+	const relations = policy.resources.get(grant.permission.resource)?.relations;
+	return flattenGrantee(grant.to).some((item) => {
+		if (item.kind !== "relation") return false;
+		const spec = relations?.[item.relation];
+		return isPrincipalRelation(spec) && spec.period !== void 0;
+	});
+}
+function includePrefixes(include) {
+	if (include === void 0) return;
+	return include.map((item) => {
+		if ("key" in item && typeof item.key === "string") return item.key;
+		const first = listPermissions(item)[0];
+		if (first === void 0) return "";
+		const parts = first.key.split(".");
+		parts.pop();
+		return parts.join(".");
+	});
+}
+/**
+* The grant with its grantee's row condition. A graph relation needs the
+* `RelationSource`, which snapshots and `where()` do not carry, so the grant
+* becomes server-only (`portable: false`) there.
+*/
+function graphAware(grant, where) {
+	const combined = combineWhere(grant.where, where);
+	const graph = hasConditionOp(combined, "related");
+	const inherits = flattenGrantee(grant.to).some((item) => item.kind === "inherit");
+	return freezeDeep(compact({
+		...grant,
+		where: combined,
+		portable: graph ? false : grant.portable,
+		graph: graph && grant.portable && !inherits ? true : void 0
+	}));
+}
+/**
+* `where()` keeps a grant that is server-only because it reads the graph:
+* its `related` nodes compile to subqueries given relation mappings.
+*/
+function whereGrant(grant) {
+	return grant.graph === true ? freezeDeep({
+		...grant,
+		portable: true
+	}) : grant;
+}
+/**
+* Every grant the subject may reach, once per membership that holds all of
+* its scoped roles, so a client can check that membership's tenant, team or
+* resource. A scoped role held only globally reaches nothing.
+*/
+function collectSnapshotGrants(policy, subject, customRoles, now = nowSeconds$1(), customGrants = customGrantsFor(policy, customRoles), mode = "held") {
+	const skip = (grant, match) => mode === "held" ? !match.matched : match.matched || match.reason !== "not-entitled" || grant.effect !== "allow";
+	const scopes = scopeList(policy.scopes);
+	const declared = declaredRoleNames(policy);
+	const global = expandRoleNames(subject.principal?.roles ?? [], declared, customRoles, subject.principal?.tenant);
+	const held = (subject.principal?.memberships ?? []).map((membership) => ({
+		membership,
+		roles: new Set(expandRoleNames(membership.roles, declared, customRoles, tenantOf(membership, scopes)).roles)
+	}));
+	const holds = (entry, item) => entry.roles.has(item.role) && (typeof item.scope === "string" ? entry.membership.scope === item.scope : entry.membership.on !== void 0);
+	const requirementOf = (grant, resource) => grant.requires === void 0 || grant.effect !== "allow" ? void 0 : requirementCondition(policy, subject, grant.requires, resource, now, customRoles, customGrants);
+	const out = [];
+	for (const grant of grantList(policy)) {
+		if (!contactMayUse(policy, subject, grant)) continue;
+		if (mode === "held" && !coversRequirements(policy.permissions, grant.requires, subject.delegation)) continue;
+		const resource = getResource(policy.permissions, grant.permission.resource);
+		const match = matchGrantee(grant.to, subject, now, resource, scopes, policy.resources);
+		if (skip(grant, match)) continue;
+		const roleItems = flattenGrantee(grant.to).filter((item) => item.kind === "role");
+		if (roleItems.length > 0 && subject.principal === null) continue;
+		if (!roleItems.every((item) => item.scope !== "global" || global.roles.includes(item.role))) continue;
+		const merged = graphAware(grant, combineWhere(match.where, requirementOf(grant, resource)));
+		const scoped = roleItems.filter((item) => item.scope !== "global");
+		if (scoped.length === 0) {
+			out.push({ grant: merged });
+			continue;
+		}
+		for (const entry of held) if (keepsPermission(entry.membership, grant.permission.key) && scoped.every((item) => item.kind === "role" && holds(entry, item))) out.push({
+			grant: merged,
+			membership: entry.membership
+		});
+	}
+	for (const { grant, role } of customGrants) {
+		if (!contactMayUse(policy, subject, grant)) continue;
+		const globalHeld = holdsGlobalCustomRole(subject.principal?.roles, role);
+		const holders = held.filter((entry) => keepsPermission(entry.membership, grant.permission.key) && holdsCustomRole(entry.membership, role, scopes));
+		if (holders.length === 0 && !globalHeld) continue;
+		const resource = getResource(policy.permissions, grant.permission.resource);
+		const match = matchGrantee(grant.to, subject, now, resource, scopes, policy.resources);
+		if (skip(grant, match)) continue;
+		const merged = graphAware(grant, combineWhere(match.where, requirementOf(grant, resource)));
+		if (globalHeld) out.push({ grant: merged });
+		for (const entry of holders) out.push({
+			grant: merged,
+			membership: entry.membership
+		});
+	}
+	const fresh = policy.fresh ?? [];
+	if (mode === "held" && subject.stale === true && fresh.length > 0) return out.filter(({ grant }) => grant.effect === "deny" || !fresh.includes(grant.permission.key));
+	return out;
+}
+//#endregion
+//#region src/core/assignable.ts
+/**
+* Declared roles a tenant admin may hand out or compose, before any
+* intersection: `assignable` roles, plus every role some `assigns` lists.
+*/
+function assignableCandidates(policy) {
+	const listed = new Set(policy.roles.flatMap((binding) => binding.assigns ?? []));
+	const names = [...listRoles(policy.vocabulary?.roles).filter((leaf) => leaf.assignable || listed.has(leaf.key)).map((leaf) => leaf.key), ...policy.roles.filter((binding) => binding.assignable || listed.has(binding.name)).map((binding) => binding.name)];
+	return rankRoles(policy, [...new Set(names)]).map((name) => roleLeaf(policy, name));
+}
+/**
+* The levels a held allow of a permission covers: its own `level`, every
+* level when it has no row condition, or the levels whose condition equals
+* its condition.
+*/
+function heldLevels(policy, grant, names) {
+	if (grant.level !== void 0) return [grant.level];
+	if (grant.where === void 0) return names;
+	const held = canonicalJson(grant.where);
+	return names.filter((name) => {
+		const condition = levelCondition(policy, grant.permission.resource, name);
+		return condition !== void 0 && canonicalJson(condition) === held;
+	});
+}
+/**
+* What the subject may hand out in `tenant`: declared assignable roles and the
+* tenant custom-role ceiling, narrowed by `allowed` (`CustomRoleSource.assignable`),
+* then intersected with the permissions the subject holds there. Holding a
+* role or a granted permission with `meta.manageRoles` lifts the intersection.
+*/
+function assignableIn(policy, subject, customRoles, customGrants, tenant, allowed, now = nowSeconds$1(), global = false) {
+	const principal = subject.principal;
+	if (principal === null) return {
+		roles: [],
+		permissions: [],
+		levels: {},
+		manage: false,
+		inert: []
+	};
+	const scopes = scopeList(policy.scopes);
+	const scoped = tenant === void 0 ? subject : freezeDeep(compact({
+		...subject,
+		principal: compact({
+			...principal,
+			tenant: resolveActiveTenant(principal, tenant, scopes, now)
+		})
+	}));
+	const heldGrants = collectSnapshotGrants(policy, scoped, customRoles, now, customGrants).filter((item) => item.grant.effect === "allow" && (item.membership === void 0 || !global && tenantOf(item.membership, scopes) === tenant && !isMembershipExpired(item.membership, now))).map((item) => item.grant);
+	const heldKeys = new Set(heldGrants.map((grant) => grant.permission.key));
+	const heldNames = heldRoleNames(policy, subject, tenant, void 0, now);
+	const quiet = {
+		emit: false,
+		simulated: true,
+		skipAlternatives: true,
+		customRoles,
+		customGrants,
+		listeners: emptyListeners(),
+		sink: void 0,
+		limits: void 0,
+		limitCache: /* @__PURE__ */ new Map(),
+		team: void 0
+	};
+	const manage = heldNames.some((name) => roleMeta(policy, name)?.manageRoles === true) || listPermissions(policy.permissions).some((leaf) => leaf.meta.manageRoles === true && evaluate(policy, scoped, leaf, void 0, {
+		call: "simulate",
+		trusted: true,
+		now: instantAt(now)
+	}, quiet).outcome === "granted");
+	const narrowed = allowed === void 0 ? void 0 : new Set(allowed);
+	const candidates = assignableCandidates(policy).filter((leaf) => narrowed === void 0 || narrowed.has(leaf.key));
+	const held = new Set(heldNames);
+	const listed = usesAssigns(policy) ? new Set(heldNames.flatMap((name) => policy.rolesByName.get(name)?.assigns ?? [])) : void 0;
+	const roles = manage ? candidates : candidates.filter((leaf) => {
+		if (listed !== void 0) return listed.has(leaf.key);
+		if (held.has(leaf.key)) return true;
+		const keys = [...roleAllowKeys(policy, leaf.key)];
+		return keys.length > 0 && keys.every((key) => heldKeys.has(key));
+	});
+	const root = global ? "global" : rootScope(scopes);
+	const ceiling = new Set((root === void 0 ? [] : ceilingGrants(policy, root, allowed)).map((grant) => grant.permission.key));
+	const permissions = listPermissions(policy.permissions).filter((leaf) => ceiling.has(leaf.key) && (manage || heldKeys.has(leaf.key)));
+	const offeredLevels = (key, names) => {
+		if (manage) return names;
+		const reached = new Set(heldGrants.filter((grant) => grant.permission.key === key).flatMap((grant) => heldLevels(policy, grant, names)));
+		return names.filter((name) => reached.has(name));
+	};
+	const levels = {};
+	for (const leaf of permissions) {
+		const names = leaf.kind === "instance" ? levelNames(policy, leaf.resource) : [];
+		if (names.length > 0) levels[leaf.key] = offeredLevels(leaf.key, names);
+	}
+	const ceilingKeys = /* @__PURE__ */ new Map();
+	const mayHandOut = (scope, grant) => {
+		const key = grant.permission.key;
+		let keys = ceilingKeys.get(scope);
+		if (keys === void 0) {
+			keys = new Set(ceilingGrants(policy, scope, allowed).map((item) => item.permission.key));
+			ceilingKeys.set(scope, keys);
+		}
+		if (!keys.has(key) || !(manage || heldKeys.has(key))) return false;
+		const names = grant.permission.kind === "instance" ? levelNames(policy, grant.permission.resource) : [];
+		if (names.length === 0) return true;
+		const offered = offeredLevels(key, names);
+		return heldLevels(policy, grant, names).every((name) => offered.includes(name));
+	};
+	const custom = global || tenant === void 0 ? {
+		roles: [],
+		inert: []
+	} : assignableCustomRoles(policy, customRoles, tenant, manage ? void 0 : roles, mayHandOut);
+	return {
+		roles: [...roles, ...custom.roles],
+		permissions,
+		levels,
+		manage,
+		inert: custom.inert
+	};
+}
+/**
+* The tenant's custom roles the subject may hand out: held at a scope it may
+* assign declared roles at (any scope with `meta.manageRoles`), allowing at
+* least one permission after the ceiling, and only permissions and levels it
+* may hand out at that scope. A role that allows nothing is `inert`.
+*/
+function assignableCustomRoles(policy, customRoles, tenant, declared, mayHandOut) {
+	const scopes = scopeList(policy.scopes);
+	const root = rootScope(scopes);
+	const assignsAt = declared === void 0 ? void 0 : new Set(declared.map((leaf) => leaf.on === void 0 ? root : resolveScope(scopes, leaf.on)));
+	const out = /* @__PURE__ */ new Map();
+	const inert = /* @__PURE__ */ new Set();
+	for (const role of tenantCustomRoles(policy, customRoles)) {
+		if (!customRoleOf(role, tenant) || out.has(role.name)) continue;
+		const at = customRoleScope(role, scopes);
+		if (at === void 0 || assignsAt !== void 0 && !assignsAt.has(at)) continue;
+		const { grants } = resolveCustomRole(policy, role);
+		if (!grants.some((grant) => grant.effect === "allow")) {
+			inert.add(role.name);
+			continue;
+		}
+		if (grants.every((grant) => grant.effect === "deny" || mayHandOut(at, grant))) out.set(role.name, synthesiseRole(role.name, compact({
+			on: at,
+			assignable: true,
+			meta: sourceRoleMeta(role.meta, treeXSchema(policy.vocabulary?.roles)),
+			shared: isSharedCustomRole(role) ? true : void 0
+		})));
+	}
+	return {
+		roles: [...out.values()].toSorted((a, b) => Number(a.shared !== true) - Number(b.shared !== true) || byCodePoint(a.key, b.key)),
+		inert: [...inert].filter((name) => !out.has(name)).toSorted()
+	};
+}
+//#endregion
+//#region src/core/instance-snapshot.ts
+/** The one path from a resolved subject to a `Snapshot`; pure apart from the default clock. */
+function snapshotOf(policy, subject, options) {
+	const now = options.now ?? nowSeconds$1();
+	const customGrants = options.customGrants ?? customGrantsFor(policy, options.customRoles);
+	const roles = heldRoleNames(policy, subject, subject.principal?.tenant, void 0, now);
+	const audiences = audiencesOf(policy, roles);
+	const delegated = delegatedPermissions(policy.delegations, subject, new Set(roles), now);
+	return buildSnapshot(compact({
+		subject,
+		roles,
+		audiences: audiences.length === 0 ? void 0 : audiences,
+		notEntitled: collectSnapshotGrants(policy, subject, options.customRoles, now, customGrants, "not-entitled"),
+		grants: collectSnapshotGrants(policy, subject, options.customRoles, now, customGrants).filter((item) => delegated !== void 0 || item.grant.effect === "deny" || !readOnlyActorRefuses(subject.actor, item.grant.permission)).map((item) => periodBound(policy, item.grant) ? Object.assign({}, item, { grant: freezeDeep({
+			...item.grant,
+			portable: false
+		}) }) : item),
+		include: includePrefixes(options.include),
+		tenants: options.tenants,
+		simulated: options.simulated,
+		now: Math.floor(now),
+		vocabulary: policy.vocabulary,
+		scopes: snapshotScopes(policy),
+		idOf: (name) => getResource(policy.permissions, name)?.id,
+		delegated,
+		assignable: (tenant) => {
+			const found = assignableIn(policy, subject, options.customRoles, customGrants, tenant, options.assignable?.get(tenant), now);
+			return compact({
+				tenant,
+				roles: found.roles.map((leaf) => leaf.key),
+				permissions: found.permissions,
+				levels: Object.keys(found.levels).length === 0 ? void 0 : found.levels
+			});
+		}
+	}));
+}
+/** The policy's scopes as snapshots and `permdock cloud push` carry them, with the resources each partitions. */
+function snapshotScopes(policy) {
+	if (policy.scopes.length === 0) return;
+	const resources = [...policy.resources.values()];
+	return policy.scopes.map((scope) => {
+		const nodes = resources.filter((node) => partitionsOf(node, policy.scopes).includes(scope.name));
+		const partitioned = nodes.map((node) => node.name);
+		const fields = Object.fromEntries(nodes.flatMap((node) => {
+			const field = scopeField(node, scope.name, policy.scopes);
+			return field === void 0 || field === scope.key ? [] : [[node.name, field]];
+		}));
+		return compact({
+			name: scope.name,
+			key: scope.key ?? "",
+			within: scope.within,
+			resources: partitioned.length === 0 ? void 0 : partitioned,
+			fields: Object.keys(fields).length === 0 ? void 0 : fields
+		});
+	});
+}
+//#endregion
+export { isExternallyManaged as _, whereGrant as a, applyRoleKinds as c, rankRoles as d, usesAssigns as f, countHolders as g, composeMemberships as h, collectSnapshotGrants as i, audiencesOf as l, claimsFirst as m, snapshotScopes as n, heldRoleNames as o, asMembershipSource as p, assignableIn as r, roleLeaf as s, snapshotOf as t, bindingOf as u };

package/dist/instant-BluqDvyS.js

@@ -0,0 +1,19 @@
+//#region src/conditions/instant.ts
+const ISO_INSTANT = /^(\d{4}-\d{2}-\d{2})(?:[T ](\d{2}:\d{2}(?::\d{2}(?:\.\d{1,9})?)?)(Z|[+-]\d{2}(?::?\d{2})?)?)?$/u;
+/**
+* Milliseconds since the epoch for an ISO 8601 date or date-time, or
+* `undefined`. A date-time without a zone and a bare date are UTC, the same
+* in memory, in the ORM compilers and in generated SQL.
+*/
+function isoInstant(value) {
+	const match = ISO_INSTANT.exec(value);
+	if (match === null) return;
+	const [, day, time, zone] = match;
+	let offset = zone ?? (time === void 0 ? "" : "Z");
+	if (/^[+-]\d{2}$/u.test(offset)) offset = `${offset}:00`;
+	else if (/^[+-]\d{4}$/u.test(offset)) offset = `${offset.slice(0, 3)}:${offset.slice(3)}`;
+	const parsed = Date.parse(time === void 0 ? `${day}` : `${day}T${time}${offset}`);
+	return Number.isNaN(parsed) ? void 0 : parsed;
+}
+//#endregion
+export { isoInstant as t };

package/dist/internals-Dk8A8fX3.js

@@ -0,0 +1,17 @@
+//#region src/core/internals.ts
+const INTERNALS = Symbol.for("permdock.internals");
+/** Attaches `internals` to `instance` as a non-enumerable member; call before freezing. */
+function attachInternals(instance, internals) {
+	Object.defineProperty(instance, INTERNALS, { value: internals });
+}
+/**
+* The internals of a server instance, or `undefined` for an instance built
+* from a snapshot or one that is not PermDock's. A feature function treats
+* `undefined` as a check it cannot answer and denies with `unsupported`.
+*/
+function internalsOf(permdock) {
+	const value = Reflect.get(permdock, INTERNALS);
+	return value === void 0 ? void 0 : value;
+}
+//#endregion
+export { internalsOf as n, attachInternals as t };