permdock 0.4.0 → 0.6.0

package/dist/src-Cu2m75uo.js

@@ -0,0 +1,1860 @@
+import { n as isReadonlyArray, r as isRecord, t as compact } from "./compact-CAf557ZB.js";
+import { n as freezeDeep } from "./freeze-CrU8nQeX.js";
+import { n as isForbiddenKey, r as ownGet } from "./paths-DXSHAMIa.js";
+import { f as normalizeApproval, g as assertSqlFunctionName, h as assertSqlFunctionArg, m as assertPortableTwin, p as normalizeWhere, u as assertApprovalRelations } from "./role-builder-uWQZ4v84.js";
+import { n as PermDockDeniedError } from "./errors-BKy0EfhN.js";
+import { o as sameId } from "./expiry-D4_YKRKD.js";
+import { n as internalsOf } from "./internals-Dk8A8fX3.js";
+import { c as listPermissions, i as getRegistry, n as findPermission, o as isPermission } from "./permission-registry-Br4jSNVi.js";
+import { n as isThenable$1 } from "./thenable-yD7SabqG.js";
+import { c as isEdgeRelation, m as restrictedStops, o as groupEntries, s as isComputedRelation, u as isPrincipalRelation } from "./resource-relations-D_jw0BFx.js";
+import { a as durationOf, g as secondsOf, m as rfc3339, p as nowSeconds } from "./time-DkWjdL98.js";
+import { d as scopeList, l as scopeChain, m as tenantOf, o as resolveScope, u as scopeIdOf } from "./scopes-CUPSjo9q.js";
+import { u as evaluateCondition } from "./delegation-j6-rc37o.js";
+import { _ as listPlans, a as authenticated, m as findRole, o as flattenGrantee } from "./grantee-hxrUsbpM.js";
+import { m as tenantsOf, r as isMembershipExpired } from "./tenancy-DN2QAx9z.js";
+import { o as levelNames, r as grantList, t as declaredRoleNames } from "./policy-DbM5YYtV.js";
+import { r as isPortableCondition } from "./hosted-B46-5LYE.js";
+import { n as OPERATION_RISKS, r as isOperationRisk } from "./permissions-B-wCP5ZC.js";
+import { S as tenantCustomRoles, b as resolveCustomRole, f as customRoleId, l as ceilingGrants, m as customRoleScope, p as customRoleOf } from "./evaluate-CNClBvcj.js";
+import { d as rankRoles, f as usesAssigns, i as collectSnapshotGrants, n as snapshotScopes, t as snapshotOf, u as bindingOf } from "./instance-snapshot-BOEhcqIF.js";
+import { n as relationId } from "./relations-BnCWnJGI.js";
+import { r as snapshotGrant, t as buildSnapshot } from "./snapshot-B7DkYg6g.js";
+import { n as LOCAL_CUSTOM_ROLE } from "./parse-local-manifest-CVSs6J9I.js";
+import { r as resolveSubject, s as APP } from "./permdock-BrAscV28.js";
+import { i as memoryApprovalStore } from "./store-BDutJkDL.js";
+import { n as wrapPermDock } from "./wrap-gX61EtpB.js";
+//#region src/conditions/sql-function.ts
+function sqlFunction(name, options) {
+	assertSqlFunctionName(name);
+	const args = options.args ?? [];
+	for (const arg of args) assertSqlFunctionArg(arg);
+	const twin = normalizeWhere(options.twin);
+	assertPortableTwin(twin);
+	return freezeDeep({
+		op: "sqlFunction",
+		name,
+		args,
+		twin
+	});
+}
+//#endregion
+//#region src/core/memory-sources.ts
+function memoryEntitlementSource(entries) {
+	return { entitlementsFor(_principal, options) {
+		return options.tenant === void 0 ? [] : [...entries[options.tenant] ?? []];
+	} };
+}
+function memorySettingsSource(settings) {
+	const byTenant = new Map(Object.entries(settings));
+	return Object.freeze({ settingsFor(tenant) {
+		return byTenant.get(tenant);
+	} });
+}
+/** Memberships keyed by principal id; `tenant` is not a filter, as for a database source. */
+function memoryMembershipSource(entries) {
+	const byPrincipal = new Map(Object.entries(entries));
+	return Object.freeze({
+		membershipsFor(principal) {
+			return [...byPrincipal.get(principal.id) ?? []];
+		},
+		list(query) {
+			const members = [];
+			for (const [id, memberships] of byPrincipal) for (const membership of memberships) if (membership.scope === query.scope && membership.id === query.id) members.push({
+				principal: { id },
+				membership
+			});
+			return members;
+		}
+	});
+}
+/** A snapshot held in memory; `set` replaces it and notifies every subscriber. */
+function memorySnapshotSource(initial) {
+	let current = initial;
+	const listeners = /* @__PURE__ */ new Set();
+	return Object.freeze({
+		get: () => current,
+		subscribe(listener) {
+			listeners.add(listener);
+			return () => {
+				listeners.delete(listener);
+			};
+		},
+		set(snapshot) {
+			current = snapshot;
+			for (const listener of listeners) listener();
+		}
+	});
+}
+function memoryCustomRoleSource(customRoles) {
+	const byTenant = /* @__PURE__ */ new Map();
+	const global = [];
+	const shared = [];
+	for (const role of customRoles) {
+		if (role.shared === true) {
+			shared.push(role);
+			continue;
+		}
+		if (role.tenant === void 0) {
+			global.push(role);
+			continue;
+		}
+		const list = byTenant.get(role.tenant) ?? [];
+		list.push(role);
+		byTenant.set(role.tenant, list);
+	}
+	return {
+		rolesFor(tenant) {
+			return [...byTenant.get(tenant) ?? []];
+		},
+		globalRoles() {
+			return [...global];
+		},
+		sharedRoles() {
+			return [...shared];
+		}
+	};
+}
+//#endregion
+//#region src/core/operations.ts
+const OPERATION_EFFECTS = Object.freeze([
+	"read",
+	"write",
+	"delete",
+	"send",
+	"spend",
+	"external"
+]);
+/** MCP tool-name characters (MCP 2025-11-25, Tools: Tool names), so a name works as a tool name unchanged. */
+const NAME = /^[A-Za-z0-9_.-]{1,128}$/u;
+const META_KEYS = /* @__PURE__ */ new Set([
+	"risk",
+	"effects",
+	"title"
+]);
+function isOperationEffect(value) {
+	return OPERATION_EFFECTS.some((effect) => effect === value);
+}
+function readMeta(name, value) {
+	if (value === void 0) return Object.freeze({});
+	if (value === null || typeof value !== "object" || Array.isArray(value)) throw new TypeError(`Operation "${name}": meta must be an object.`);
+	for (const key of Object.keys(value)) if (!META_KEYS.has(key)) throw new TypeError(`Operation "${name}": meta.${key} is not one of risk, effects, title.`);
+	const meta = {};
+	const risk = Reflect.get(value, "risk");
+	if (risk !== void 0) {
+		if (!isOperationRisk(risk)) throw new TypeError(`Operation "${name}": meta.risk must be one of ${OPERATION_RISKS.join(", ")}.`);
+		meta.risk = risk;
+	}
+	const effects = Reflect.get(value, "effects");
+	if (effects !== void 0) {
+		if (!Array.isArray(effects) || !effects.every(isOperationEffect) || new Set(effects).size !== effects.length) throw new TypeError(`Operation "${name}": meta.effects must list distinct values of ${OPERATION_EFFECTS.join(", ")}.`);
+		meta.effects = Object.freeze([...effects]);
+	}
+	const title = Reflect.get(value, "title");
+	if (title !== void 0) {
+		if (typeof title !== "string" || title.trim() === "") throw new TypeError(`Operation "${name}": meta.title must be a non-empty string.`);
+		meta.title = title;
+	}
+	return Object.freeze(meta);
+}
+function treeLeaf(keys, name, field, value) {
+	if (!isPermission(value)) throw new TypeError(`Operation "${name}": ${field} must be a permission from the tree.`);
+	if (!keys.has(value.key)) throw new TypeError(`Operation "${name}": ${field} ${value.key} is not a permission of the tree passed to defineOperations.`);
+	return value;
+}
+/**
+* Binds each named operation to a permission of `permissions`. Throws at
+* definition time for a permission or `results` outside the tree, a name that
+* is not 1 to 128 of `A-Z a-z 0-9 _ . -` or repeats another case-insensitively,
+* a `data` that is not a function, or meta outside the closed lists.
+*/
+function defineOperations(permissions, definitions) {
+	const keys = new Map(listPermissions(permissions).map((leaf) => [leaf.key, leaf]));
+	const seen = /* @__PURE__ */ new Map();
+	const out = {};
+	for (const name of Object.keys(definitions)) {
+		if (!NAME.test(name) || isForbiddenKey(name)) throw new TypeError(`Operation name "${name}" must be 1 to 128 of A-Z a-z 0-9 _ . -.`);
+		const folded = name.toLowerCase();
+		const previous = seen.get(folded);
+		if (previous !== void 0) throw new TypeError(`Operation name "${name}" is a duplicate of "${previous}".`);
+		seen.set(folded, name);
+		const definition = definitions[name];
+		if (definition === null || typeof definition !== "object" || Array.isArray(definition)) throw new TypeError(`Operation "${name}" must be an object.`);
+		const permission = treeLeaf(keys, name, "permission", Reflect.get(definition, "permission"));
+		const value = Reflect.get(definition, "data");
+		if (value !== void 0 && typeof value !== "function") throw new TypeError(`Operation "${name}": data must be a function.`);
+		const data = value;
+		const resultsValue = Reflect.get(definition, "results");
+		const results = resultsValue === void 0 ? void 0 : treeLeaf(keys, name, "results", resultsValue);
+		const meta = readMeta(name, Reflect.get(definition, "meta"));
+		out[name] = Object.freeze({
+			name,
+			permission,
+			...data === void 0 ? {} : { data },
+			...results === void 0 ? {} : { results },
+			meta
+		});
+	}
+	return Object.freeze(out);
+}
+//#endregion
+//#region src/core/approval-policies.ts
+/** The denial detail when an `ApprovalPolicySource` fails: every call an allow would grant denies with reason `approval`. */
+/**
+* The in-process `ApprovalPolicySource`, usable directly as the
+* `approvalPolicies` option: it is the source and its feature at once.
+*/
+function memoryApprovalPolicySource(policies) {
+	const entries = [...policies];
+	const source = { approvalPoliciesFor(query) {
+		return entries.filter((entry) => entry.tenant === void 0 || query.tenants.includes(entry.tenant));
+	} };
+	return Object.freeze({
+		...source,
+		...approvalPolicies(source)
+	});
+}
+function approvalPolicies(source) {
+	return Object.freeze({
+		feature: "approval-policies",
+		load: (policy, tenants, auth) => approvalPoliciesFor(policy, source, tenants, auth)
+	});
+}
+function isStringList(value) {
+	return Array.isArray(value) && value.every((item) => typeof item === "string");
+}
+function metaList(value, is) {
+	if (value === void 0) return;
+	if (!Array.isArray(value) || value.length === 0 || !value.every(is)) return "invalid";
+	return new Set(value);
+}
+/** An entry with no permission, matched on operation meta alone. */
+function checkMetaOnly(raw, risk, effects) {
+	const { tenant, actors, where, check, approval } = raw;
+	if (risk === void 0 && effects === void 0 || where !== void 0 || tenant !== void 0 && typeof tenant !== "string" || actors !== void 0 && !isStringList(actors) || check !== void 0 && !isPortableCondition(check) || approval !== "human" && !isRecord(approval)) return { problem: "invalid" };
+	let normalized;
+	try {
+		normalized = normalizeApproval(approval);
+	} catch {
+		return { problem: "invalid" };
+	}
+	if (normalized === void 0 || normalized !== "human" && normalized.staleOn !== void 0) return { problem: "invalid" };
+	return { entry: compact({
+		risk,
+		effects,
+		tenant,
+		actors: actors === void 0 ? void 0 : new Set(actors),
+		check: check === void 0 ? void 0 : normalizeWhere(check),
+		approval: normalized
+	}) };
+}
+function checkOne(policy, raw) {
+	if (!isRecord(raw)) return { problem: "invalid" };
+	const risk = metaList(raw["risk"], isOperationRisk);
+	const effects = metaList(raw["effects"], isOperationEffect);
+	if (risk === "invalid" || effects === "invalid") return { problem: "invalid" };
+	if (raw["permission"] === void 0) return checkMetaOnly(raw, risk, effects);
+	if (typeof raw["permission"] !== "string") return { problem: "invalid" };
+	const permission = findPermission(policy.permissions, raw["permission"]);
+	if (permission === void 0) return { problem: "unknown-permission" };
+	const { tenant, actors, where, check, approval } = raw;
+	if (tenant !== void 0 && typeof tenant !== "string" || actors !== void 0 && !isStringList(actors) || where !== void 0 && !isPortableCondition(where) || check !== void 0 && !isPortableCondition(check) || approval !== "human" && !isRecord(approval)) return { problem: "invalid" };
+	if (where !== void 0 && permission.kind !== "instance") return { problem: "where-on-collection" };
+	let normalized;
+	try {
+		normalized = normalizeApproval(approval, permission.key);
+		if (normalized !== void 0) assertApprovalRelations([{
+			permission,
+			approval: normalized
+		}], policy.resources);
+	} catch {
+		return { problem: "invalid" };
+	}
+	if (normalized === void 0) return { problem: "invalid" };
+	if (normalized !== "human" && normalized.staleOn !== void 0 && (permission.kind !== "instance" || policy.resources.get(permission.resource)?.version === void 0)) return { problem: "stale-on-without-version" };
+	return { entry: compact({
+		permission: permission.key,
+		risk,
+		effects,
+		tenant,
+		actors: actors === void 0 ? void 0 : new Set(actors),
+		where: where === void 0 ? void 0 : normalizeWhere(where),
+		check: check === void 0 ? void 0 : normalizeWhere(check),
+		approval: normalized
+	}) };
+}
+/**
+* Checks one entry against the policy the way `approvalPoliciesFor` loads
+* it, for an application to refuse a bad entry when it is saved instead of
+* finding every call denied. Never throws.
+*/
+function validateApprovalPolicy(policy, entry) {
+	try {
+		const checked = checkOne(policy, entry);
+		return "problem" in checked ? {
+			ok: false,
+			problem: checked.problem
+		} : { ok: true };
+	} catch {
+		return {
+			ok: false,
+			problem: "invalid"
+		};
+	}
+}
+/**
+* One raw entry checked against the policy: `null` when it names no
+* permission the policy declares (it applies to nothing), `undefined` when
+* it does not load.
+*/
+function loadOne(policy, raw) {
+	const checked = checkOne(policy, raw);
+	if ("entry" in checked) return checked.entry;
+	return checked.problem === "unknown-permission" ? null : void 0;
+}
+function loadAll(policy, raw) {
+	if (!Array.isArray(raw)) return "failed";
+	const out = [];
+	for (const item of raw) {
+		const loaded = loadOne(policy, item);
+		if (loaded === void 0) return "failed";
+		if (loaded !== null) out.push(loaded);
+	}
+	return Object.freeze({ tighten: (code, input) => tightenApproval(code, out, input) });
+}
+/** Reads the source once for `tenants`; a throw or an invalid entry loads as `"failed"`. */
+function approvalPoliciesFor(policy, source, tenants, auth) {
+	const threw = () => {
+		auth.push({
+			reason: "source-threw",
+			source: "approvalPolicies"
+		});
+		return "failed";
+	};
+	let raw;
+	try {
+		raw = source.approvalPoliciesFor({ tenants });
+	} catch {
+		return threw();
+	}
+	if (isThenable$1(raw)) return Promise.resolve(raw).then((value) => loadAll(policy, value), threw);
+	return loadAll(policy, raw);
+}
+function metaMatches(entry, operation) {
+	if (entry.risk === void 0 && entry.effects === void 0) return true;
+	if (operation === void 0) return false;
+	if (entry.risk !== void 0 && (operation.risk === void 0 || !entry.risk.has(operation.risk))) return false;
+	const effects = entry.effects;
+	return effects === void 0 || (operation.effects ?? []).some((effect) => effects.has(effect));
+}
+function matches(entry, tenant, subject, current, next, now, scopes) {
+	if (entry.tenant !== void 0 && entry.tenant !== tenant) return false;
+	if (entry.actors !== void 0 && (subject.actor === void 0 || !entry.actors.has(subject.actor.kind))) return false;
+	if (entry.where !== void 0 && !evaluateCondition(entry.where, current, subject, now, scopes)) return false;
+	return entry.check === void 0 || evaluateCondition(entry.check, next ?? current, subject, now, scopes);
+}
+function asStages(approval) {
+	if (approval === "human") return [{ by: authenticated() }];
+	if (approval.stages !== void 0) return approval.stages;
+	return [compact({
+		by: approval.by ?? authenticated(),
+		quorum: approval.quorum
+	})];
+}
+/** An entry's stages, each carrying the entry's escalation unless it has its own. */
+function entryStages(approval) {
+	const stages = asStages(approval);
+	if (approval === "human" || approval.escalation === void 0) return stages;
+	const escalation = approval.escalation;
+	return stages.map((stage) => stage.escalation === void 0 ? compact({
+		by: stage.by,
+		quorum: stage.quorum,
+		escalation
+	}) : stage);
+}
+function shorter(a, b) {
+	if (a === void 0) return b;
+	if (b === void 0) return a;
+	return (durationOf(b) ?? Infinity) < (durationOf(a) ?? Infinity) ? b : a;
+}
+/**
+* `code` with every matching entry added as further stages: the result
+* needs all of them (`'sequential'` when any part is ordered), keeps the
+* code's escalation, the shortest `ttl`, and `distinct` unless every part
+* opts out. Without a matching entry, `code` unchanged.
+*/
+function tightenApproval(code, entries, input) {
+	const extra = entries.filter((entry) => (entry.permission === void 0 || entry.permission === input.permission) && metaMatches(entry, input.operation) && matches(entry, input.tenant, input.subject, input.current, input.next, input.now, input.scopes));
+	if (extra.length === 0) return code;
+	const parts = [...code === void 0 ? [] : [code], ...extra.map((entry) => entry.approval)];
+	const stages = [];
+	const seen = /* @__PURE__ */ new Set();
+	let sequential = false;
+	let distinct = false;
+	let staleOn;
+	let ttl;
+	for (const [index, part] of parts.entries()) {
+		const fromCode = code !== void 0 && index === 0;
+		for (const stage of fromCode ? asStages(part) : entryStages(part)) {
+			const key = JSON.stringify(stage);
+			if (!seen.has(key)) {
+				seen.add(key);
+				stages.push(stage);
+			}
+		}
+		if (part === "human") {
+			distinct = true;
+			continue;
+		}
+		sequential ||= part.mode === "sequential";
+		distinct ||= part.distinct !== false;
+		staleOn ??= part.staleOn;
+		ttl = shorter(ttl, part.ttl);
+	}
+	return compact({
+		mode: sequential ? "sequential" : "all",
+		stages,
+		distinct: distinct ? void 0 : false,
+		staleOn,
+		ttl,
+		escalation: code === void 0 || code === "human" ? void 0 : code.escalation
+	});
+}
+//#endregion
+//#region src/core/stripe-entitlements.ts
+const PAGE = 100;
+const MAX_PAGES = 10;
+/**
+* Plan names from Stripe Entitlements: the `lookup_key` of every active
+* entitlement of the tenant's Stripe customer. `customer` maps the active
+* tenant to its customer id; no tenant or no customer means no entitlements.
+* Pass it as `entitlements`, and grant with `plan('<lookup_key>')`.
+*/
+function stripeEntitlementSource(options) {
+	return { async entitlementsFor(principal, query) {
+		if (query.tenant === void 0) return [];
+		const customer = await options.customer(query.tenant, principal);
+		if (customer === void 0 || customer === "") return [];
+		const keys = /* @__PURE__ */ new Set();
+		let after;
+		for (let page = 0; page < MAX_PAGES; page += 1) {
+			const result = await options.stripe.entitlements.activeEntitlements.list(after === void 0 ? {
+				customer,
+				limit: PAGE
+			} : {
+				customer,
+				limit: PAGE,
+				starting_after: after
+			});
+			for (const item of result.data) if (typeof item.lookup_key === "string" && item.lookup_key !== "") keys.add(item.lookup_key);
+			const last = result.data.at(-1);
+			if (!result.has_more || last === void 0) break;
+			after = last.id;
+		}
+		return [...keys].toSorted();
+	} };
+}
+//#endregion
+//#region src/core/limits.ts
+function isThenable(value) {
+	return value !== null && typeof value === "object" && "then" in value && typeof value.then === "function";
+}
+function limitWindowId(per, now) {
+	const seconds = durationOf(per);
+	return seconds === void 0 ? void 0 : String(Math.floor(now / seconds));
+}
+function limitCacheKey(input, now) {
+	const window = limitWindowId(input.per, now);
+	return window === void 0 ? void 0 : JSON.stringify([
+		input.tenant ?? null,
+		input.subjectId,
+		input.key,
+		input.per,
+		window
+	]);
+}
+function locate$1(input) {
+	const now = nowSeconds(input.now);
+	const seconds = durationOf(input.per);
+	const id = limitCacheKey(input, now);
+	if (seconds === void 0 || id === void 0) return;
+	return {
+		id,
+		until: (Math.floor(now / seconds) + 1) * seconds,
+		now
+	};
+}
+function memoryLimitStore() {
+	const used = /* @__PURE__ */ new Map();
+	let earliest = Number.POSITIVE_INFINITY;
+	const sweep = (now) => {
+		if (now < earliest) return;
+		earliest = Number.POSITIVE_INFINITY;
+		for (const [id, entry] of used) if (entry.until <= now) used.delete(id);
+		else earliest = Math.min(earliest, entry.until);
+	};
+	return {
+		remaining(input) {
+			const cap = input.count;
+			const slot = locate$1(input);
+			if (!Number.isFinite(cap) || cap <= 0 || slot === void 0) return { remaining: -1 };
+			return { remaining: cap - (used.get(slot.id)?.count ?? 0) };
+		},
+		consume(input) {
+			const cap = input.count;
+			const slot = locate$1(input);
+			if (!Number.isFinite(cap) || cap <= 0 || slot === void 0) return { remaining: -1 };
+			sweep(slot.now);
+			const seen = used.get(slot.id)?.count ?? 0;
+			if (seen >= cap) return { remaining: -1 };
+			used.set(slot.id, {
+				count: seen + 1,
+				until: slot.until
+			});
+			earliest = Math.min(earliest, slot.until);
+			return { remaining: cap - seen - 1 };
+		},
+		size() {
+			return used.size;
+		}
+	};
+}
+/**
+* `left` is what remains once this call counts: the store's answer after
+* `consume`, or one less than `remaining` when only peeking. Below zero the
+* call is past the count.
+*/
+function verdictFor(limit, left, now) {
+	const seconds = durationOf(limit.per);
+	if (seconds === void 0) return {
+		ok: false,
+		reason: "limit-unavailable"
+	};
+	const resetsAt = rfc3339((Math.floor(now / seconds) + 1) * seconds);
+	if (left < 0) return limit.mode === "soft" ? {
+		ok: true,
+		quota: {
+			remaining: 0,
+			resetsAt
+		},
+		obligations: [{ kind: "over-limit" }]
+	} : {
+		ok: false,
+		reason: "limit",
+		detail: {
+			count: limit.count,
+			per: seconds,
+			resetsAt
+		}
+	};
+	return limit.alertAt !== void 0 && (limit.count - left) / limit.count >= limit.alertAt ? {
+		ok: true,
+		quota: {
+			remaining: left,
+			resetsAt
+		},
+		obligations: [{ kind: "near-limit" }]
+	} : {
+		ok: true,
+		quota: {
+			remaining: left,
+			resetsAt
+		}
+	};
+}
+function limits(store) {
+	return Object.freeze({
+		feature: "limits",
+		quota: (input) => applyQuota(store, input)
+	});
+}
+function applyQuota(store, input) {
+	const limit = input.limit;
+	const payload = {
+		key: input.permissionKey,
+		subjectId: input.subjectId,
+		count: limit.count,
+		per: limit.per,
+		now: { epochMilliseconds: input.now * 1e3 },
+		...input.tenant === void 0 ? {} : { tenant: input.tenant }
+	};
+	const cacheKey = limitCacheKey(payload, input.now);
+	if (cacheKey === void 0) return {
+		ok: false,
+		reason: "limit-unavailable"
+	};
+	if (!input.consume) {
+		try {
+			const peeked = store.remaining(payload);
+			if (isThenable(peeked)) return {
+				ok: false,
+				reason: "limit-unavailable"
+			};
+			if (peeked !== void 0) return verdictFor(limit, peeked.remaining - 1, input.now);
+		} catch {
+			return {
+				ok: false,
+				reason: "limit-unavailable"
+			};
+		}
+		const cached = input.cache.get(cacheKey);
+		if (cached === void 0) return {
+			ok: false,
+			reason: "limit-unavailable"
+		};
+		return verdictFor(limit, cached - 1, input.now);
+	}
+	try {
+		const consumed = store.consume(payload);
+		if (isThenable(consumed)) return {
+			ok: false,
+			reason: "limit-unavailable"
+		};
+		input.cache.set(cacheKey, consumed.remaining);
+		return verdictFor(limit, consumed.remaining, input.now);
+	} catch {
+		return {
+			ok: false,
+			reason: "limit-unavailable"
+		};
+	}
+}
+//#endregion
+//#region src/core/memory-relations.ts
+/** The holders one edge-table row names for `spec`: none when the row does not belong to it. */
+function tableHolders(resourceName, spec, row, id) {
+	if (relationId(ownGet(row, spec.object ?? `${resourceName}_id`)) !== id) return [];
+	for (const [column, value] of Object.entries(spec.match ?? {})) if (ownGet(row, column) !== value) return [];
+	const expiresAt = spec.expiresAt === void 0 ? void 0 : seconds(ownGet(row, spec.expiresAt));
+	const period = expiresAt === void 0 ? {} : { expiresAt };
+	const groups = spec.groups;
+	const direct = relationId(ownGet(row, spec.subject ?? "user_id"));
+	if (groups === void 0) return direct === void 0 ? [] : [{
+		principal: { id: direct },
+		...period
+	}];
+	if (groups.column === void 0) {
+		const out = direct === void 0 ? [] : [{
+			principal: { id: direct },
+			...period
+		}];
+		for (const group of groupEntries(spec)) {
+			const groupId = relationId(ownGet(row, group.subject));
+			if (groupId !== void 0) out.push({
+				group: {
+					resource: group.resource,
+					id: groupId,
+					relation: group.relation
+				},
+				...period
+			});
+		}
+		return out;
+	}
+	const kind = ownGet(row, groups.column);
+	if (kind === null || kind === void 0 || kind === groups.direct) return direct === void 0 ? [] : [{
+		principal: { id: direct },
+		...period
+	}];
+	const group = groupEntries(spec).find((entry) => entry.resource === kind);
+	const groupId = group === void 0 ? void 0 : relationId(ownGet(row, group.subject));
+	return group === void 0 || groupId === void 0 ? [] : [{
+		group: {
+			resource: group.resource,
+			id: groupId,
+			relation: group.relation
+		},
+		...period
+	}];
+}
+function seconds(value) {
+	if (value instanceof Date) {
+		const time = value.getTime();
+		return Number.isNaN(time) ? void 0 : time / 1e3;
+	}
+	if (typeof value === "number" && Number.isFinite(value)) return value;
+	if (typeof value === "string") {
+		const parsed = Date.parse(value);
+		return Number.isNaN(parsed) ? void 0 : parsed / 1e3;
+	}
+}
+function restrictedOf(node, row) {
+	return node.restricted !== void 0 && row !== void 0 && ownGet(row, node.restricted) === true;
+}
+function edgeHolder(edge) {
+	const holder = { principal: { id: edge.principal } };
+	if (edge.startsAt !== void 0) holder.startsAt = edge.startsAt;
+	if (edge.expiresAt !== void 0) holder.expiresAt = edge.expiresAt;
+	return holder;
+}
+/**
+* An in-process `RelationSource` over plain rows and edges, read against the
+* resource definitions in `permissions`. For tests, fixtures and small apps.
+*/
+function memoryRelationSource(permissions, data = {}) {
+	const registry = getRegistry(permissions);
+	const byId = /* @__PURE__ */ new Map();
+	for (const [name, rows] of Object.entries(data.rows ?? {})) {
+		const node = registry.get(name);
+		const index = /* @__PURE__ */ new Map();
+		for (const row of rows) {
+			const id = relationId(ownGet(row, node?.id ?? "id"));
+			if (id !== void 0) index.set(id, row);
+		}
+		byId.set(name, index);
+	}
+	const rowOf = (resource, id) => byId.get(resource)?.get(id);
+	return {
+		row({ resource, id }) {
+			return rowOf(resource, id) ?? null;
+		},
+		ancestors({ resource, id, depth, through }) {
+			const node = registry.get(resource);
+			const start = rowOf(resource, id);
+			if (node === void 0 || start === void 0) return { ancestors: [] };
+			if (through !== "parent") {
+				const link = Object.hasOwn(node.links, through) ? node.links[through] : void 0;
+				const next = link === void 0 ? void 0 : relationId(ownGet(start, link.field));
+				if (next === void 0 || depth < 1) return { ancestors: [] };
+				return { ancestors: [{ id: next }] };
+			}
+			const restricted = restrictedOf(node, start);
+			const stops = restrictedStops(node, "parent");
+			if (restricted && stops || node.parent === void 0 || node.parent.resource !== resource) return restricted ? {
+				restricted: true,
+				ancestors: []
+			} : { ancestors: [] };
+			const field = node.parent.field;
+			const seen = /* @__PURE__ */ new Set([id]);
+			const ancestors = [];
+			let next = relationId(ownGet(start, field));
+			while (next !== void 0 && ancestors.length < depth) {
+				const row = rowOf(resource, next);
+				if (row === void 0) {
+					next = void 0;
+					break;
+				}
+				const hidden = restrictedOf(node, row);
+				ancestors.push(hidden ? {
+					id: next,
+					restricted: true
+				} : { id: next });
+				if (seen.has(next) || hidden && stops) {
+					next = void 0;
+					break;
+				}
+				seen.add(next);
+				next = relationId(ownGet(row, field));
+			}
+			const chain = restricted ? {
+				restricted: true,
+				ancestors
+			} : { ancestors };
+			return next === void 0 || rowOf(resource, next) === void 0 ? chain : {
+				...chain,
+				truncated: true
+			};
+		},
+		related({ resource, id, relation }) {
+			const spec = registry.get(resource)?.relations[relation];
+			if (spec === void 0 || isComputedRelation(spec)) return [];
+			if (isEdgeRelation(spec)) {
+				const table = data.tables?.[spec.edge];
+				if (table !== void 0) return table.flatMap((row) => tableHolders(resource, spec, row, id));
+				return (data.edges?.[resource]?.[relation] ?? []).filter((edge) => edge.id === id).map(edgeHolder);
+			}
+			const row = rowOf(resource, id);
+			if (row === void 0) return [];
+			if (isPrincipalRelation(spec)) {
+				const holder = relationId(ownGet(row, spec.principal));
+				if (holder === void 0) return [];
+				const startsAt = spec.period?.startsAt === void 0 ? void 0 : seconds(ownGet(row, spec.period.startsAt));
+				const expiresAt = spec.period?.expiresAt === void 0 ? void 0 : seconds(ownGet(row, spec.period.expiresAt));
+				return [{
+					principal: { id: holder },
+					...startsAt === void 0 ? {} : { startsAt },
+					...expiresAt === void 0 ? {} : { expiresAt }
+				}];
+			}
+			if (spec.memberOf !== void 0) return [];
+			const holder = relationId(ownGet(row, spec.field));
+			return holder === void 0 ? [] : [{ principal: { id: holder } }];
+		}
+	};
+}
+//#endregion
+//#region src/core/policy-sign.ts
+/**
+* Signs `document` as a `vnd.permdock.policy+jwt`: the `policy` claim holds
+* every field but `id` and `issuedAt`, which become `jti` and `iat`, so
+* `policyDocumentFromClaims` reads it back. `iss` is the signer's own.
+*/
+function signPolicyDocument(document, signer, options) {
+	const { id, issuedAt, ...policy } = document;
+	const iat = secondsOf(issuedAt);
+	return signer.sign({ policy }, {
+		typ: "vnd.permdock.policy+jwt",
+		audience: options.audience,
+		jti: id,
+		...iat === void 0 ? {} : { issuedAt: iat },
+		...options.expiresAt === void 0 ? {} : { expiresAt: options.expiresAt }
+	});
+}
+//#endregion
+//#region src/core/arazzo.ts
+const VERSION = /^1\.[01]\.\d+(?:-.+)?$/u;
+const STEP_TARGETS = [
+	"operationId",
+	"operationPath",
+	"workflowId",
+	"channelPath"
+];
+const denied = (reason) => freezeDeep({
+	outcome: "denied",
+	denials: [{
+		role: null,
+		reason
+	}],
+	alternatives: []
+});
+function asString(value) {
+	return typeof value === "string" && value.length > 0 ? value : void 0;
+}
+function parseParameters(raw, components, where) {
+	if (raw === void 0) return [];
+	if (!Array.isArray(raw)) return `${where}: parameters must be an array`;
+	const out = [];
+	for (const item of raw) {
+		if (!isRecord(item)) return `${where}: a parameter is not an object`;
+		const reference = asString(item["reference"]);
+		if (reference !== void 0) {
+			const match = /^\$components\.parameters\.(.+)$/u.exec(reference);
+			const target = match?.[1] === void 0 ? void 0 : components[match[1]];
+			const name = isRecord(target) ? asString(target["name"]) : void 0;
+			if (!isRecord(target) || name === void 0 || !("value" in target)) return `${where}: unresolved parameter reference ${reference}`;
+			out.push({
+				name,
+				value: "value" in item ? item["value"] : target["value"]
+			});
+			continue;
+		}
+		const name = asString(item["name"]);
+		if (name === void 0 || !("value" in item)) return `${where}: a parameter needs a name and a value`;
+		out.push({
+			name,
+			value: item["value"]
+		});
+	}
+	return out;
+}
+function parseDocument(arazzo) {
+	if (!isRecord(arazzo)) return "Arazzo document is not an object";
+	const version = arazzo["arazzo"];
+	if (typeof version !== "string" || !VERSION.test(version)) return "arazzo must be a 1.0.x or 1.1.x version";
+	if (!isRecord(arazzo["info"])) return "info is required";
+	const rawSources = arazzo["sourceDescriptions"];
+	if (!Array.isArray(rawSources) || rawSources.length === 0) return "sourceDescriptions needs at least one entry";
+	const sources = [];
+	for (const source of rawSources) {
+		const name = isRecord(source) ? asString(source["name"]) : void 0;
+		if (!isRecord(source) || name === void 0 || asString(source["url"]) === void 0) return "a sourceDescription needs a name and a url";
+		if (sources.some((item) => item.name === name)) return `duplicate sourceDescription ${name}`;
+		sources.push({
+			name,
+			type: asString(source["type"]) ?? "openapi"
+		});
+	}
+	const components = isRecord(arazzo["components"]) && isRecord(arazzo["components"]["parameters"]) ? arazzo["components"]["parameters"] : {};
+	const rawWorkflows = arazzo["workflows"];
+	if (!Array.isArray(rawWorkflows) || rawWorkflows.length === 0) return "workflows needs at least one entry";
+	const workflows = [];
+	for (const item of rawWorkflows) {
+		const workflowId = isRecord(item) ? asString(item["workflowId"]) : void 0;
+		if (!isRecord(item) || workflowId === void 0) return "a workflow needs a workflowId";
+		if (workflows.some((workflow) => workflow.workflowId === workflowId)) return `duplicate workflowId ${workflowId}`;
+		const parameters = parseParameters(item["parameters"], components, workflowId);
+		if (typeof parameters === "string") return parameters;
+		const rawSteps = item["steps"];
+		if (!Array.isArray(rawSteps) || rawSteps.length === 0) return `${workflowId}: steps needs at least one entry`;
+		const steps = [];
+		for (const step of rawSteps) {
+			const stepId = isRecord(step) ? asString(step["stepId"]) : void 0;
+			if (!isRecord(step) || stepId === void 0) return `${workflowId}: a step needs a stepId`;
+			if (steps.some((other) => other.stepId === stepId)) return `${workflowId}: duplicate stepId ${stepId}`;
+			const targets = STEP_TARGETS.filter((field) => asString(step[field]) !== void 0);
+			if (targets.length !== 1 && !(targets.length === 2 && targets.includes("operationId") && targets.includes("channelPath"))) return `${workflowId}.${stepId}: a step needs exactly one of operationId, operationPath or workflowId`;
+			const stepParameters = parseParameters(step["parameters"], components, `${workflowId}.${stepId}`);
+			if (typeof stepParameters === "string") return stepParameters;
+			steps.push(compact({
+				stepId,
+				operationId: asString(step["operationId"]),
+				operationPath: asString(step["operationPath"]),
+				workflowId: asString(step["workflowId"]),
+				channelPath: asString(step["channelPath"]),
+				parameters: stepParameters
+			}));
+		}
+		workflows.push({
+			workflowId,
+			parameters,
+			steps
+		});
+	}
+	return {
+		sources,
+		workflows
+	};
+}
+function unescapePointer(token) {
+	return token.replaceAll("~1", "/").replaceAll("~0", "~");
+}
+function readPointer(doc, pointer) {
+	if (!pointer.startsWith("#/")) return;
+	let current = doc;
+	for (const raw of pointer.slice(2).split("/")) {
+		if (!isRecord(current)) return;
+		let token;
+		try {
+			token = unescapePointer(decodeURIComponent(raw));
+		} catch {
+			return;
+		}
+		if (!Object.hasOwn(current, token)) return;
+		current = current[token];
+	}
+	return current;
+}
+function findOperation(openapi, operationId) {
+	if (!isRecord(openapi) || !isRecord(openapi["paths"])) return;
+	for (const pathItem of Object.values(openapi["paths"])) {
+		if (!isRecord(pathItem)) continue;
+		for (const [method, operation] of Object.entries(pathItem)) if (!method.startsWith("x-") && isRecord(operation) && operation["operationId"] === operationId) return operation;
+	}
+}
+/** One description, or a map of descriptions keyed by source `name`. */
+function descriptionFor(openapi, name) {
+	if (isRecord(openapi) && !("openapi" in openapi) && !("paths" in openapi) && isRecord(openapi[name])) return openapi[name];
+	return openapi;
+}
+function permissionKeysOf(node) {
+	if (!isRecord(node)) return [];
+	const raw = node["x-permdock-permissions"];
+	if (!Array.isArray(raw)) return [];
+	return raw.filter((item) => typeof item === "string");
+}
+/** `$inputs.a.b` against the frame's inputs; anything else that is a runtime expression is unknown. */
+function valueOf(value, inputs) {
+	if (typeof value !== "string" || !value.includes("$")) return {
+		known: true,
+		value
+	};
+	const match = /^\$inputs\.([^#{}]+)$/u.exec(value);
+	if (match?.[1] === void 0) return value.startsWith("$") || value.includes("{$") ? { known: false } : {
+		known: true,
+		value
+	};
+	let current = inputs;
+	for (const part of match[1].split(".")) {
+		if (!isRecord(current) || !Object.hasOwn(current, part)) return { known: false };
+		current = current[part];
+	}
+	return {
+		known: true,
+		value: current
+	};
+}
+function bind(parameters, inputs) {
+	const record = {};
+	let provisional = false;
+	for (const parameter of parameters) {
+		const bound = valueOf(parameter.value, inputs);
+		if (!bound.known) {
+			provisional = true;
+			continue;
+		}
+		Object.defineProperty(record, parameter.name, {
+			value: bound.value,
+			enumerable: true,
+			writable: true,
+			configurable: true
+		});
+	}
+	return {
+		record,
+		provisional
+	};
+}
+function flatten(doc, workflowId, inputs, seen, out) {
+	if (seen.has(workflowId)) return "workflowId cycle";
+	const workflow = doc.workflows.find((item) => item.workflowId === workflowId);
+	if (workflow === void 0) return `unknown workflowId ${workflowId}`;
+	seen.add(workflowId);
+	for (const step of workflow.steps) {
+		if (step.workflowId === void 0 || step.workflowId.startsWith("$sourceDescriptions.")) {
+			out.push({
+				step,
+				workflow,
+				inputs
+			});
+			continue;
+		}
+		const nested = flatten(doc, step.workflowId, bind(step.parameters, inputs).record, seen, out);
+		if (nested !== void 0) return nested;
+	}
+	seen.delete(workflowId);
+}
+function locate(doc, openapi, step) {
+	if (step.workflowId !== void 0) return {
+		reason: "unsupported",
+		detail: "workflows in another Arazzo document are not resolved"
+	};
+	let sourceName;
+	let operationId = step.operationId;
+	let pointer;
+	if (step.operationPath !== void 0) {
+		const match = /^\{?\$sourceDescriptions\.([^.}#]+)(?:\.url)?\}?(#.*)?$/u.exec(step.operationPath);
+		if (match?.[1] === void 0) return {
+			reason: "undocumented",
+			detail: "operationPath is not a $sourceDescriptions reference"
+		};
+		sourceName = match[1];
+		pointer = match[2] ?? "";
+	} else if (operationId !== void 0) {
+		const match = /^\$sourceDescriptions\.([^.]+)\.(.+)$/u.exec(operationId);
+		if (match?.[1] !== void 0 && match[2] !== void 0) {
+			sourceName = match[1];
+			operationId = match[2];
+		}
+	}
+	const candidates = sourceName === void 0 ? doc.sources.filter((source) => source.type !== "arazzo") : doc.sources.filter((source) => source.name === sourceName);
+	if (candidates.length === 0) return {
+		reason: "undocumented",
+		detail: sourceName === void 0 ? "no API sourceDescription" : `unknown sourceDescription ${sourceName}`
+	};
+	if (step.channelPath !== void 0) return {
+		reason: "unsupported",
+		detail: "AsyncAPI steps are not evaluated"
+	};
+	const found = [];
+	for (const source of candidates) {
+		const description = descriptionFor(openapi, source.name);
+		const node = pointer === void 0 ? operationId === void 0 ? void 0 : findOperation(description, operationId) : readPointer(description, pointer);
+		if (node !== void 0 || candidates.length === 1) found.push({
+			source,
+			node
+		});
+	}
+	if (found.length > 1) return {
+		reason: "undocumented",
+		detail: "operationId matches several sources; qualify it with $sourceDescriptions"
+	};
+	const [hit] = found;
+	if (hit?.source.type === "asyncapi") return {
+		reason: "unsupported",
+		detail: "AsyncAPI steps are not evaluated"
+	};
+	if (hit === void 0 || hit.source.type === "arazzo" || !isRecord(hit.node)) return {
+		reason: "undocumented",
+		detail: "operation not found"
+	};
+	return compact({
+		node: hit.node,
+		operationId: asString(hit.node["operationId"]) ?? operationId
+	});
+}
+function resolve(doc, openapi, tree, flat) {
+	const { step, workflow, inputs } = flat;
+	const base = {
+		stepId: step.stepId,
+		workflowId: workflow.workflowId
+	};
+	const located = locate(doc, openapi, step);
+	const { record, provisional } = bind([...workflow.parameters.filter((parameter) => !step.parameters.some((own) => own.name === parameter.name)), ...step.parameters], inputs);
+	const data = Object.keys(inputs).length + Object.keys(record).length === 0 ? void 0 : {
+		...inputs,
+		...record
+	};
+	if ("reason" in located) return {
+		...base,
+		...compact({ operationId: step.operationId }),
+		keys: [],
+		finding: located,
+		data,
+		provisional
+	};
+	const keys = permissionKeysOf(located.node);
+	const unknown = tree === void 0 ? void 0 : keys.find((key) => findPermission(tree, key) === void 0);
+	return {
+		...base,
+		...compact({ operationId: located.operationId }),
+		keys,
+		...keys.length === 0 ? { finding: {
+			reason: "undocumented",
+			detail: "operation has no x-permdock-permissions"
+		} } : unknown === void 0 ? {} : { finding: {
+			reason: "unknown-key",
+			detail: unknown
+		} },
+		data,
+		provisional
+	};
+}
+function resolveAll(input, tree) {
+	const doc = parseDocument(input.arazzo);
+	if (typeof doc === "string") return {
+		workflowId: input.workflowId ?? "",
+		error: doc
+	};
+	const workflowId = input.workflowId ?? doc.workflows[0]?.workflowId ?? "";
+	const flat = [];
+	const error = flatten(doc, workflowId, input.inputs ?? {}, /* @__PURE__ */ new Set(), flat);
+	if (error !== void 0) return {
+		workflowId,
+		error
+	};
+	return {
+		workflowId,
+		steps: flat.map((item) => resolve(doc, input.openapi, tree, item))
+	};
+}
+function arazzoFindings(input, tree) {
+	const resolved = resolveAll(input, tree);
+	if ("error" in resolved) return [{
+		stepId: "document",
+		workflowId: resolved.workflowId,
+		reason: "validation",
+		detail: resolved.error
+	}];
+	return resolved.steps.flatMap((step) => step.finding === void 0 ? [] : [{
+		stepId: step.stepId,
+		workflowId: step.workflowId,
+		reason: step.finding.reason,
+		detail: step.finding.detail
+	}]);
+}
+function worst(outcomes) {
+	if (outcomes.includes("denied")) return "denied";
+	if (outcomes.includes("approval-required")) return "approval-required";
+	return "granted";
+}
+function combine(decisions) {
+	const outcome = worst(decisions.map((item) => item.outcome));
+	return decisions.find((item) => item.outcome === outcome) ?? denied("undocumented");
+}
+/**
+* Walks an Arazzo workflow against `permdock`: each step's operation is
+* decided as `permdock.simulate` would, and a server instance emits one
+* simulate event for the whole plan. Works on an instance built from a
+* snapshot too.
+*/
+function simulateArazzo(permdock, input) {
+	const tree = input.permissions ?? permdock.permissions;
+	const internals = internalsOf(permdock);
+	if (internals !== void 0) return internals.simulateWith((decide) => planArazzo(input, tree, decide));
+	return planArazzo(input, tree, (permission, data) => permdock.simulate([[permission, data]])[0] ?? unknownStep(permission));
+}
+function unknownStep(permission) {
+	return {
+		outcome: "denied",
+		denials: [{
+			role: null,
+			reason: "no-grant",
+			detail: permission.key
+		}],
+		alternatives: []
+	};
+}
+function planArazzo(input, tree, decide) {
+	const resolved = resolveAll(input, tree);
+	if ("error" in resolved) return freezeDeep({
+		workflowId: resolved.workflowId === "" ? "unknown" : resolved.workflowId,
+		outcome: "denied",
+		steps: [{
+			stepId: "document",
+			permissions: [],
+			decision: denied("validation")
+		}]
+	});
+	const steps = resolved.steps.map((step) => {
+		const owner = step.workflowId === resolved.workflowId ? void 0 : step.workflowId;
+		if (step.finding !== void 0) return compact({
+			stepId: step.stepId,
+			workflowId: owner,
+			operationId: step.operationId,
+			permissions: [],
+			decision: denied(step.finding.reason === "unsupported" ? "unsupported" : "undocumented")
+		});
+		const permissions = step.keys.flatMap((key) => {
+			const leaf = tree === void 0 ? void 0 : findPermission(tree, key);
+			return leaf === void 0 ? [] : [leaf];
+		});
+		return compact({
+			stepId: step.stepId,
+			workflowId: owner,
+			operationId: step.operationId,
+			permissions,
+			decision: combine(permissions.map((permission) => decide(permission, step.data))),
+			provisional: step.provisional ? true : void 0
+		});
+	});
+	return freezeDeep({
+		workflowId: resolved.workflowId,
+		outcome: worst(steps.map((step) => step.decision.outcome)),
+		steps
+	});
+}
+//#endregion
+//#region src/core/local-manifest.ts
+/** A relation grantee needs the relation graph, which a device does not hold: the grant decides on the server only. */
+function localGrant(grant) {
+	const relational = flattenGrantee(grant.to).some((item) => item.kind === "relation");
+	return snapshotGrant(relational ? {
+		...grant,
+		portable: false
+	} : grant, void 0);
+}
+function customTable(policy, scope, roles) {
+	const keys = [...new Set(ceilingGrants(policy, scope).map((grant) => grant.permission.key))];
+	if (keys.length === 0) return;
+	const resolve = (body) => resolveCustomRole(policy, scope === "global" ? {
+		name: LOCAL_CUSTOM_ROLE,
+		scope: "global",
+		...body
+	} : {
+		name: LOCAL_CUSTOM_ROLE,
+		tenant: LOCAL_CUSTOM_ROLE,
+		scope,
+		...body
+	}).grants.map(localGrant);
+	const permissions = {};
+	for (const key of keys) {
+		const leaf = findPermission(policy.permissions, key);
+		const names = leaf?.kind === "instance" ? levelNames(policy, leaf.resource) : [];
+		permissions[key] = compact({
+			all: resolve({ grants: [{ permission: key }] }),
+			levels: names.length === 0 ? void 0 : Object.fromEntries(names.map((level) => [level, resolve({ grants: [{
+				permission: key,
+				level
+			}] })]))
+		});
+	}
+	const includes = {};
+	for (const role of roles) {
+		const grants = resolve({ includes: [role] });
+		if (grants.length > 0) includes[role] = grants;
+	}
+	return {
+		permissions,
+		includes
+	};
+}
+/**
+* What the policy grants, as JSON a device turns into snapshots from its own
+* membership rows (`localSnapshot` in `permdock/react-native`). Write it at
+* build time; the policy itself never ships to the client.
+*/
+function localSnapshotManifest(policy) {
+	const roles = [...declaredRoleNames(policy)].toSorted();
+	const custom = {};
+	for (const scope of [...scopeList(policy.scopes).map((item) => item.name), "global"]) {
+		const table = customTable(policy, scope, roles);
+		if (table !== void 0) custom[scope] = table;
+	}
+	const scopes = snapshotScopes(policy);
+	const { vocabulary } = buildSnapshot({
+		subject: {
+			principal: null,
+			context: {}
+		},
+		roles: [],
+		grants: [],
+		vocabulary: policy.vocabulary
+	});
+	return freezeDeep(compact({
+		v: 1,
+		scopes,
+		vocabulary,
+		roles,
+		rank: usesAssigns(policy) ? rankRoles(policy, roles) : void 0,
+		grants: grantList(policy).map(localGrant),
+		custom
+	}));
+}
+//#endregion
+//#region src/app/define-app.ts
+function grantsOf(policy) {
+	return [...policy.index.grantsByKey.values()].flat();
+}
+function assertProduction(policy, options) {
+	const grants = grantsOf(policy);
+	if (options.store === void 0 && grants.some((grant) => grant.approval !== void 0)) throw new Error("PermDock: profile 'prod' needs a store: a grant requires approval and approvals cannot complete without an ApprovalStore");
+	if (options.limits === void 0 && grants.some((grant) => grant.limit !== void 0)) throw new Error("PermDock: profile 'prod' needs limits: a grant has a limit and every call would deny with limit-unavailable; pass limits: limits(store)");
+}
+/**
+* The in-process services `dev` fills in: one memory approval store that
+* every adapter of the app shares, and memory limits when a grant has a
+* `limit`. They live here, not in the adapters, so an adapter ships no store
+* and an app without `defineApp` ships neither.
+*/
+function devDefaults(policy, options) {
+	return {
+		...options,
+		profile: "dev",
+		...options.store === void 0 ? { store: memoryApprovalStore() } : {},
+		...options.limits === void 0 && grantsOf(policy).some((grant) => grant.limit !== void 0) ? { limits: limits(memoryLimitStore()) } : {}
+	};
+}
+/**
+* Binds the app's sources, features and services to `policy`. The result
+* is a policy: pass it wherever a policy goes (`createPermDock`, every
+* adapter, the CLI) and each picks up the app definition, with its own
+* options taking precedence. The profile defaults to `prod`.
+*/
+function defineApp(policy, options = {}) {
+	const profile = options.profile ?? "prod";
+	const definition = profile === "dev" ? devDefaults(policy, options) : {
+		...options,
+		profile
+	};
+	if (profile === "prod") assertProduction(policy, definition);
+	const prototype = Object.getPrototypeOf(policy);
+	const app = Object.create(prototype, Object.getOwnPropertyDescriptors(policy));
+	Object.defineProperty(app, APP, { value: Object.freeze(definition) });
+	return Object.freeze(app);
+}
+//#endregion
+//#region src/core/shadow.ts
+function legacyAnswer(legacy, permission, data, subject) {
+	try {
+		return legacy({
+			permission,
+			data,
+			subject
+		}) === true;
+	} catch {
+		return false;
+	}
+}
+function legacyDecision(allowed, permission, subject) {
+	return allowed ? freezeDeep({
+		outcome: "granted",
+		subject,
+		matched: {
+			role: "legacy",
+			permission: permission.key
+		},
+		token: "pd1.legacy"
+	}) : freezeDeep({
+		outcome: "denied",
+		permission: permission.key,
+		denials: [{
+			role: null,
+			reason: "no-grant",
+			detail: "legacy"
+		}],
+		alternatives: []
+	});
+}
+/**
+* Runs PermDock beside the application's existing checks while adopting
+* it. Each `can`, `decide`, `decideEach`, `filter` and `assert` asks both;
+* the legacy answer is returned unless the permission is in `enforce`, and
+* every disagreement reaches `onMismatch`. Promote permissions one by one
+* as their mismatches are resolved, then remove the wrap. Pass it as an
+* adapter's `wrap` option, or call it on a core instance.
+*/
+function shadowMode(options) {
+	const enforced = (permission) => options.enforce === "all" || (options.enforce ?? []).some((item) => item.key === permission.key);
+	const report = (mismatch) => {
+		try {
+			options.onMismatch?.(mismatch);
+		} catch {}
+	};
+	return (permdock) => wrapPermDock(permdock, (inner) => {
+		const decide = (permission, data, decideOptions) => {
+			const ours = inner.decide(permission, data, decideOptions);
+			const theirs = legacyAnswer(options.legacy, permission, data, inner.subject);
+			const enforce = enforced(permission);
+			if (theirs !== (ours.outcome === "granted")) report({
+				permission: permission.key,
+				principal: inner.subject.principal?.id ?? null,
+				legacy: theirs,
+				permdock: ours.outcome,
+				enforced: enforce
+			});
+			if (enforce || theirs === (ours.outcome === "granted")) return ours;
+			return legacyDecision(theirs, permission, inner.subject);
+		};
+		const can = (permission, data, decideOptions) => {
+			try {
+				return decide(permission, data, decideOptions).outcome === "granted";
+			} catch {
+				return false;
+			}
+		};
+		return {
+			decide,
+			can,
+			decideEach: (permission, rows, decideOptions) => rows.map((row) => decide(permission, row, decideOptions)),
+			filter: (permission, rows, decideOptions) => rows.filter((row) => can(permission, row, decideOptions)),
+			assert: ((permission, data, decideOptions) => {
+				const decision = decide(permission, data, decideOptions);
+				if (decision.outcome === "granted") return decision;
+				if (decision.outcome === "approval-required") return inner.assert(permission, data, decideOptions);
+				throw new PermDockDeniedError({
+					decision,
+					permission: permission.key,
+					scope: permission.scope,
+					resource: { type: permission.resource },
+					subject: inner.subject,
+					message: `PermDock: ${permission.key} denied`
+				});
+			})
+		};
+	});
+}
+//#endregion
+//#region src/core/may-access.ts
+function policyPlans(policy) {
+	const names = new Set(listPlans(policy.vocabulary?.plans).map((p) => p.key));
+	for (const grant of grantList(policy)) for (const item of flattenGrantee(grant.to)) if (item.kind === "plan") names.add(item.plan);
+	return [...names];
+}
+function heldRoleNames(principal) {
+	return [...principal.roles ?? [], ...(principal.memberships ?? []).flatMap((item) => item.roles)];
+}
+/**
+* An optimistic routing hint for a proxy or middleware, never a decision.
+* `false` only when the subject's declared roles provably lack `permission`;
+* `true` whenever custom roles, plans, memberships the claims do not carry or
+* row conditions could still grant it. Synchronous, no network, never throws.
+* Pages, Server Actions and RLS remain the enforcement points.
+*/
+function mayAccess(policy, user, permission, options = {}) {
+	try {
+		const resolved = resolveSubject(policy, user, compact({ tenant: options.tenant }), []);
+		if (isThenable$1(resolved)) return true;
+		const principal = resolved.principal;
+		const relevant = policy.index.grantsByKey.get(permission.key) ?? [];
+		if (principal !== null) {
+			const declared = declaredRoleNames(policy);
+			if (heldRoleNames(principal).some((name) => !declared.has(name))) return true;
+			if ((principal.memberships ?? []).length === 0 && relevant.some((grant) => grant.scope !== "global")) return true;
+		}
+		const tenant = options.tenant;
+		const subject = principal === null ? resolved : {
+			...resolved,
+			principal: {
+				...principal,
+				plans: policyPlans(policy),
+				memberships: (principal.memberships ?? []).filter((item) => {
+					const owner = tenantOf(item, scopeList(policy.scopes));
+					return tenant === void 0 || owner === void 0 || owner === tenant;
+				})
+			}
+		};
+		const matched = collectSnapshotGrants(policy, subject, []).filter((item) => item.grant.permission.key === permission.key);
+		if (matched.some((item) => item.grant.effect === "deny" && item.grant.where === void 0 && item.grant.check === void 0 && item.grant.portable)) return false;
+		return matched.some((item) => item.grant.effect === "allow");
+	} catch {
+		return true;
+	}
+}
+//#endregion
+//#region src/core/custom-role-source.ts
+function ofTenant(tenant, roles) {
+	return Array.isArray(roles) ? roles.filter((role) => role !== null && typeof role === "object" && Reflect.get(role, "tenant") === tenant) : [];
+}
+/**
+* A `CustomRoleSource` over a reader that returns every custom role of a tenant.
+* It keeps only the roles of the requested tenant. With `read: 'held'` it
+* skips a tenant's read, and `globalRoles` and `sharedRoles`, when the
+* subject holds only declared roles there.
+*/
+function customRoleSource(reader, options = {}) {
+	const declared = options.read === "held" ? declaredRoleNames(options.policy) : void 0;
+	return Object.freeze({
+		rolesFor(tenant, context) {
+			if (declared !== void 0 && context?.held.every((name) => declared.has(name)) === true) return [];
+			const roles = reader.rolesFor(tenant);
+			return isThenable$1(roles) ? roles.then((list) => ofTenant(tenant, list)) : ofTenant(tenant, roles);
+		},
+		...reader.assignable === void 0 ? {} : { assignable: (tenant) => reader.assignable?.(tenant) ?? [] },
+		...reader.globalRoles === void 0 ? {} : { globalRoles: (context) => declared !== void 0 && context?.held.every((name) => declared.has(name)) === true ? [] : reader.globalRoles?.() ?? [] },
+		...reader.sharedRoles === void 0 ? {} : { sharedRoles: (context) => declared !== void 0 && context?.held.every((name) => declared.has(name)) === true ? [] : reader.sharedRoles?.() ?? [] }
+	});
+}
+//#endregion
+//#region src/core/snapshot-for.ts
+function withPlans(subject, plans) {
+	if (plans === void 0 || subject.principal === null) return subject;
+	return freezeDeep(compact({
+		...subject,
+		principal: compact({
+			...subject.principal,
+			plans: [...plans]
+		})
+	}));
+}
+/**
+* Builds the serializable access snapshot for a subject without a request,
+* a network call or a cache directive: call it inside the app's own
+* `'use cache: private'` function. Synchronous; the policy's `subject` and
+* `context` mappers must be synchronous too.
+*/
+function snapshotFor(policy, user, options = {}) {
+	const auth = [];
+	const memberships = options.memberships;
+	const resolved = resolveSubject(policy, user, compact({
+		tenant: options.tenant,
+		memberships: memberships === void 0 ? void 0 : { membershipsFor: () => [...memberships] }
+	}), auth);
+	if (isThenable$1(resolved)) throw new TypeError("PermDock: snapshotFor() needs synchronous subject and context mappers. Resolve async data first and pass it as a Subject, or use (await getPermDock(...)).snapshot().");
+	const subject = withPlans(resolved, options.plans);
+	const tenants = new Set(tenantsOf(subject.principal, scopeList(policy.scopes)));
+	const customRoles = (options.customRoles ?? []).filter((item) => item.scope === "global" || item.shared === true && tenants.size > 0 || item.tenant !== void 0 && tenants.has(item.tenant));
+	const names = options.assignable;
+	const assignable = names === void 0 ? void 0 : new Map([...tenants].map((tenant) => [tenant, Object.hasOwn(names, tenant) ? names[tenant] ?? [] : []]));
+	return snapshotOf(policy, subject, compact({
+		customRoles,
+		assignable,
+		include: options.include,
+		tenants: options.tenants,
+		now: options.now === void 0 ? void 0 : nowSeconds(options.now)
+	}));
+}
+//#endregion
+//#region src/core/presets.ts
+const CRUD_ACTIONS = {
+	read: { readOnly: true },
+	update: {},
+	delete: { destructive: true }
+};
+const CRUD_COLLECTION = {
+	create: {},
+	list: { readOnly: true }
+};
+const READABLE_ACTIONS = { read: { readOnly: true } };
+const READABLE_COLLECTION = { list: { readOnly: true } };
+const WRITABLE_ACTIONS = {
+	read: { readOnly: true },
+	update: {}
+};
+const WRITABLE_COLLECTION = {};
+function isNameList(list) {
+	return Array.isArray(list);
+}
+function toRecord(list) {
+	if (list === void 0) return {};
+	if (isNameList(list)) {
+		const out = {};
+		for (const name of list) out[name] = {};
+		return out;
+	}
+	return { ...list };
+}
+function mergeMeta(base, extra) {
+	return compact({
+		title: extra.title ?? base.title,
+		description: extra.description ?? base.description,
+		tags: extra.tags ?? base.tags,
+		readOnly: extra.readOnly ?? base.readOnly,
+		destructive: extra.destructive ?? base.destructive,
+		idempotent: extra.idempotent ?? base.idempotent
+	});
+}
+function mergeActionLists(base, extra) {
+	const extraRecord = toRecord(extra);
+	const out = {};
+	for (const [name, baseMeta] of Object.entries(base)) {
+		const extraMeta = extraRecord[name];
+		out[name] = extraMeta === void 0 ? baseMeta : mergeMeta(baseMeta, extraMeta);
+	}
+	for (const [name, extraMeta] of Object.entries(extraRecord)) {
+		if (Object.hasOwn(out, name)) continue;
+		out[name] = extraMeta;
+	}
+	return freezeDeep(out);
+}
+function finishPreset(baseActions, baseCollection, options) {
+	const actions = mergeActionLists(baseActions, options?.actions);
+	const collection = mergeActionLists(baseCollection, options?.collection);
+	return compact({
+		id: options?.id,
+		parent: options?.parent,
+		relations: options?.relations,
+		restricted: options?.restricted,
+		disclosure: options?.disclosure,
+		actions,
+		collection: Object.keys(collection).length === 0 ? void 0 : collection
+	});
+}
+function crud(options) {
+	return finishPreset(CRUD_ACTIONS, CRUD_COLLECTION, options);
+}
+function readable(options) {
+	return finishPreset(READABLE_ACTIONS, READABLE_COLLECTION, options);
+}
+function writable(options) {
+	return finishPreset(WRITABLE_ACTIONS, WRITABLE_COLLECTION, options);
+}
+//#endregion
+//#region src/core/ownership.ts
+function coversInstance(membership, scopes, scope, id, within) {
+	if (membership.scope === void 0 || membership.id === void 0) return false;
+	if (membership.scope === scope) return sameId(membership.id, id);
+	if (!scopeChain(scopes, scope).slice(1).includes(membership.scope)) return false;
+	const wanted = within === void 0 ? void 0 : Object.entries(within).find(([key]) => resolveScope(scopes, key) === membership.scope)?.[1] ?? void 0;
+	return wanted !== void 0 && scopeIdOf(membership, membership.scope) === wanted;
+}
+/** Roles the principal holds at the instance, at an ancestor named in `within`, or globally. */
+function rolesAtInstance(policy, principal, scopes, scope, id, within, now) {
+	const declared = declaredRoleNames(policy);
+	const names = new Set((principal.roles ?? []).filter((name) => declared.has(name)));
+	for (const membership of principal.memberships ?? []) if (!isMembershipExpired(membership, now) && coversInstance(membership, scopes, scope, id, within)) for (const name of membership.roles) names.add(name);
+	return rankRoles(policy, [...names]);
+}
+/** Whether the principal holds `role` on a live membership of exactly this instance. */
+function holdsAt(principal, role, scope, id, now) {
+	return (principal.memberships ?? []).some((membership) => membership.scope === scope && sameId(membership.id, id) && !isMembershipExpired(membership, now) && membership.roles.includes(role));
+}
+function includedRoles(role) {
+	return isReadonlyArray(role.includes) ? role.includes.filter((name) => typeof name === "string") : [];
+}
+/**
+* The membership kinds a custom role may be held through: those every
+* included declared role with `for` allows. `undefined` when none restricts.
+*/
+function customForKinds(policy, role) {
+	let kinds;
+	for (const name of includedRoles(role)) {
+		const listed = bindingOf(policy, name)?.for;
+		if (listed !== void 0) kinds = kinds === void 0 ? listed : kinds.filter((kind) => listed.includes(kind));
+	}
+	return kinds;
+}
+function conflictsWith(policy, role) {
+	const out = new Set(bindingOf(policy, role)?.exclusiveWith ?? []);
+	for (const binding of policy.roles) if (binding.exclusiveWith?.includes(role) === true) out.add(binding.name);
+	return out;
+}
+/** What the change does to the instance's holder count. */
+function countRules(binding, role, holders, delta, deny) {
+	if (binding === void 0 || delta === 0) return;
+	const min = binding.min ?? 0;
+	if (!(min > 0 || binding.max !== void 0 || binding.transferOnly === true)) return;
+	if (!(holders !== void 0 && Number.isInteger(holders) && holders >= 0)) {
+		deny(delta < 0 && min > 0 ? "last-holder" : delta > 0 && binding.max !== void 0 ? "max-holders" : "transfer-only", {
+			role,
+			holders: null
+		});
+		return;
+	}
+	const after = holders + delta;
+	if (delta < 0 && min > 0 && after < min) deny("last-holder", {
+		role,
+		min,
+		holders
+	});
+	if (delta > 0 && binding.max !== void 0 && after > binding.max) deny("max-holders", {
+		role,
+		max: binding.max,
+		holders
+	});
+	if (binding.transferOnly === true && holders > 0 && after > 0) deny("transfer-only", {
+		role,
+		holders
+	});
+}
+/**
+* A live membership of the principal on the instance or on an instance under
+* it: the one in-band fact that ties a nested instance to a tenant.
+*/
+function heldAnchor(principal, scopes, scope, id, now) {
+	return (principal.memberships ?? []).find((membership) => !isMembershipExpired(membership, now) && membership.scope !== void 0 && scopeChain(scopes, membership.scope).includes(scope) && scopeIdOf(membership, scope) === id && tenantOf(membership, scopes) !== void 0);
+}
+/**
+* The one rule check behind `permdock.decideRoleChange`. The actor is always
+* the instance's own principal; nothing in `change` can stand in for it.
+*/
+/**
+* Whether the subject of `permdock` may assign, revoke or transfer a role
+* in one scope instance: `assigns`, the ceiling, `for`, `exclusiveWith`,
+* `min`, `max` and `transferOnly`. It never writes; the application does,
+* and generated RLS triggers re-check the holder counts at commit. A nested
+* instance's tenant comes from a live membership the subject holds on it,
+* or from `change.within` only with `{ trusted: true }`; otherwise
+* `no-membership`. An instance built from a snapshot denies with
+* `unsupported`.
+*/
+function decideRoleChange(permdock, change, options = {}) {
+	const internals = internalsOf(permdock);
+	if (internals === void 0) return freezeDeep({
+		outcome: "denied",
+		change,
+		denials: [{
+			role: null,
+			reason: "unsupported"
+		}]
+	});
+	const { policy, subject } = internals;
+	return decideRoleChangeWith(policy, subject.principal, scopeList(policy.scopes), change, internals.env.customRoles, (tenant) => {
+		const found = internals.assignable(tenant);
+		return {
+			assignable: new Set(found.roles.map((leaf) => leaf.key)),
+			manage: found.manage,
+			inert: new Set(found.inert)
+		};
+	}, internals.now(), options);
+}
+function decideRoleChangeWith(policy, principal, scopes, change, customRoles, authority, now, options = {}) {
+	const name = typeof change?.role === "string" ? change.role : change?.role?.key;
+	const denials = [];
+	const deny = (reason, detail) => {
+		denials.push(compact({
+			role: name ?? null,
+			reason,
+			detail
+		}));
+	};
+	const done = (role) => freezeDeep(denials.length === 0 ? {
+		outcome: "granted",
+		change,
+		role
+	} : {
+		outcome: "denied",
+		change,
+		denials
+	});
+	if (principal === null) {
+		deny("anonymous");
+		return done(null);
+	}
+	const kind = change?.kind;
+	const target = change?.target;
+	const global = change?.scope === "global";
+	if (typeof name !== "string" || kind !== "assign" && kind !== "revoke" && kind !== "transfer" || (global ? change.id !== void 0 : typeof change.id !== "string" || change.id === "") || target === null || typeof target !== "object" || typeof target.id !== "string" || target.id === "") {
+		deny("validation");
+		return done(null);
+	}
+	const id = change.id ?? "";
+	const binding = bindingOf(policy, name);
+	const declared = declaredRoleNames(policy).has(name);
+	const named = declared || global ? [] : tenantCustomRoles(policy, customRoles).filter((role) => role.name === name);
+	if (!declared && named.length === 0) {
+		deny("unknown-role");
+		return done(null);
+	}
+	const scope = global ? "global" : resolveScope(scopes, change.scope);
+	const customAt = named.map((role) => customRoleScope(role, scopes));
+	const on = declared ? binding?.on ?? findRole(policy.vocabulary?.roles, name)?.on : customAt.includes(scope) ? scope : customAt[0];
+	const heldAt = typeof on === "string" ? resolveScope(scopes, on) : global ? "global" : void 0;
+	if (scope === void 0 || heldAt === void 0 || heldAt !== scope) {
+		deny("scope", { expected: heldAt ?? null });
+		return done(null);
+	}
+	let tenant;
+	let within = change.within;
+	let custom;
+	if (!global) {
+		const root = scopes[0]?.name;
+		const supplied = change.within === void 0 ? void 0 : Object.entries(change.within).find(([key]) => resolveScope(scopes, key) === root)?.[1];
+		if (scope === root) tenant = id;
+		else {
+			const anchor = heldAnchor(principal, scopes, scope, id, now);
+			const held = anchor === void 0 ? void 0 : tenantOf(anchor, scopes);
+			if (held !== void 0) {
+				tenant = supplied === void 0 || supplied === held ? held : void 0;
+				within = anchor?.within;
+			} else if (options.trusted === true) tenant = supplied;
+		}
+		if (tenant === void 0) {
+			deny("no-membership", {
+				scope,
+				id
+			});
+			return done(null);
+		}
+		const found = tenant;
+		custom = named.find((role) => customRoleOf(role, found) && customRoleScope(role, scopes) === scope && sameId(customRoleId(role) ?? id, id));
+	}
+	if (!declared && custom === void 0) {
+		deny("unknown-role");
+		return done(null);
+	}
+	if (target.managedBy === "idp") {
+		deny("externally-managed");
+		return done(null);
+	}
+	const self = target.id === principal.id;
+	const targetRoles = isReadonlyArray(target.roles) ? target.roles : [];
+	const already = targetRoles.includes(name);
+	let by = null;
+	if (kind === "transfer") {
+		if (self) deny("self-demotion");
+		if (global ? (principal.roles ?? []).includes(name) : holdsAt(principal, name, scope, id, now)) by = name;
+		else deny("not-assignable-by", { holds: false });
+	} else {
+		if (self) deny(kind === "revoke" ? "self-demotion" : "not-assignable-by", { self: true });
+		const allowed = authority(tenant);
+		const revocable = kind === "revoke" && custom !== void 0 && allowed.inert?.has(name);
+		if (!allowed.assignable.has(name) && revocable !== true) deny("not-assignable-by");
+		else if (custom === void 0 && usesAssigns(policy) && !allowed.manage) {
+			const held = global ? rankRoles(policy, (principal.roles ?? []).filter((role) => declaredRoleNames(policy).has(role))) : rolesAtInstance(policy, principal, scopes, scope, id, within, now);
+			by = held.find((role) => bindingOf(policy, role)?.assigns?.includes(name) === true) ?? null;
+			if (by === null) deny("not-assignable-by", { held });
+		}
+	}
+	if (kind !== "revoke" && !already) {
+		const kinds = custom === void 0 ? binding?.for : customForKinds(policy, custom);
+		if (kinds !== void 0 && (target.via === void 0 || !kinds.includes(target.via))) deny("not-allowed-for-membership", {
+			via: target.via ?? null,
+			for: kinds
+		});
+		const conflicts = custom === void 0 ? conflictsWith(policy, name) : new Set(includedRoles(custom).flatMap((include) => Array.from(conflictsWith(policy, include))));
+		const clash = targetRoles.filter((role) => conflicts.has(role));
+		if (clash.length > 0) deny("conflicting-role", { with: clash });
+	}
+	const delta = kind === "assign" ? already ? 0 : 1 : kind === "revoke" ? targetRoles.length > 0 && !already ? 0 : -1 : already ? -1 : 0;
+	countRules(binding, name, change.holders, delta, deny);
+	return done(by);
+}
+//#endregion
+//#region src/core/csv.ts
+/** The CSV export columns, in order; the header row of every CSV file. */
+const CSV_COLUMNS = Object.freeze([
+	"time",
+	"principal",
+	"actor",
+	"tenant",
+	"permission",
+	"outcome",
+	"matched.role",
+	"via",
+	"denials.reason",
+	"token"
+]);
+function field(value) {
+	const text = value ?? "";
+	return /[",\r\n]/u.test(text) ? `"${text.replaceAll("\"", "\"\"")}"` : text;
+}
+/**
+* One RFC 4180 row for a decision or approval event, without a line
+* terminator; join rows with CRLF under a `CSV_COLUMNS` header.
+*/
+function toCsvRow(event) {
+	return [
+		event.at,
+		event.subject.principal?.id,
+		event.subject.actor?.id,
+		event.tenant,
+		event.permission,
+		event.outcome,
+		event.matched?.role,
+		event.via,
+		event.denials?.map((denial) => denial.reason).join(";"),
+		event.token
+	].map(field).join(",");
+}
+//#endregion
+export { memorySnapshotSource as A, validateApprovalPolicy as C, memoryEntitlementSource as D, memoryCustomRoleSource as E, memoryMembershipSource as O, memoryApprovalPolicySource as S, isOperationEffect as T, limits as _, readable as a, approvalPolicies as b, customRoleSource as c, defineApp as d, localSnapshotManifest as f, memoryRelationSource as g, signPolicyDocument as h, crud as i, sqlFunction as j, memorySettingsSource as k, mayAccess as l, simulateArazzo as m, toCsvRow as n, writable as o, arazzoFindings as p, decideRoleChange as r, snapshotFor as s, CSV_COLUMNS as t, shadowMode as u, memoryLimitStore as v, defineOperations as w, approvalPoliciesFor as x, stripeEntitlementSource as y };