permdock 0.4.0 → 0.6.0

package/dist/where-scope-C9vfEphl.js

@@ -0,0 +1,306 @@
+import { a as sole, r as isRecord, t as compact } from "./compact-CAf557ZB.js";
+import { n as freezeDeep } from "./freeze-CrU8nQeX.js";
+import { t as loadPrincipal } from "./principal-source-pHneukrx.js";
+import { g as secondsOf, m as rfc3339 } from "./time-DkWjdL98.js";
+import { d as scopeList, l as scopeChain, m as tenantOf, o as resolveScope, r as findScope, t as activeFor, u as scopeIdOf } from "./scopes-CUPSjo9q.js";
+import { a as readOnlyActorRefuses, n as coveredByDelegation } from "./delegation-j6-rc37o.js";
+import { r as readWireValidity, t as isActive } from "./validity-CZ7-y0Cj.js";
+import { o as resourceRoleCondition } from "./grantee-conditions-CcXf8hMM.js";
+import { c as nowSeconds, n as inTeam, o as membershipField, r as isMembershipExpired } from "./tenancy-DN2QAx9z.js";
+import { i as bindConditionRefs, n as parseSnapshot } from "./snapshot-B7DkYg6g.js";
+//#region src/core/snapshot-sign.ts
+/**
+* Signs `snapshot` as a `vnd.permdock.snapshot+jwt`. `issuedAt` and
+* `expiresAt` become `iat` and `exp` and leave the `snapshot` claim, so the
+* registered claims are the only times a verifier reads.
+*/
+function signSnapshot(snapshot, signer, options = {}) {
+	const { issuedAt, expiresAt, ...claim } = snapshot;
+	const payload = { snapshot: claim };
+	if (snapshot.subject.principal !== null) payload["sub"] = snapshot.subject.principal.id;
+	const iat = secondsOf(issuedAt);
+	return signer.sign(payload, compact({
+		typ: "vnd.permdock.snapshot+jwt",
+		audience: options.audience,
+		issuedAt: iat === void 0 || iat <= 0 ? void 0 : iat,
+		expiresAt: secondsOf(expiresAt)
+	}));
+}
+/**
+* The `snapshot` claim of verified claims with `issuedAt` and `expiresAt`
+* taken from `iat` and `exp`; `undefined` when the claim is not an object.
+*/
+function snapshotClaim(claims) {
+	const claim = claims["snapshot"];
+	if (!isRecord(claim)) return;
+	const { issuedAt: _issuedAt, expiresAt: _expiresAt, ...rest } = claim;
+	return compact({
+		...rest,
+		issuedAt: rfc3339(typeof claims.iat === "number" ? claims.iat : 0),
+		expiresAt: typeof claims.exp === "number" ? rfc3339(claims.exp) : void 0
+	});
+}
+/**
+* The snapshot a verified `vnd.permdock.snapshot+jwt` carries, parsed as
+* `parseSnapshot` parses it, with `issuedAt` and `expiresAt` from `iat` and
+* `exp`. `null` when the claim is missing or not a valid snapshot.
+*/
+function snapshotFromClaims(claims) {
+	const claim = snapshotClaim(claims);
+	if (claim === void 0) return null;
+	try {
+		return parseSnapshot(claim);
+	} catch {
+		return null;
+	}
+}
+//#endregion
+//#region src/core/decide-for.ts
+function deniedFor(permission, reason) {
+	return freezeDeep({
+		outcome: "denied",
+		permission: permission.key,
+		denials: [{
+			role: null,
+			reason
+		}],
+		alternatives: []
+	});
+}
+/** Rows are checked like `decide`; `call: 'can'` keeps every limit unconsumed. */
+const PEEK = Object.freeze({ call: "can" });
+/**
+* What `permission` on `row` decides for the principal `principalId` in the
+* caller's active tenant. Never throws, never consumes a limit, and grants
+* the caller nothing: the target is a separate instance with its own caches.
+*/
+async function decideForTarget(caller, principals, create, principalId, permission, row) {
+	if (caller.principal === null) return deniedFor(permission, "anonymous");
+	const tenant = caller.principal.tenant;
+	try {
+		const principal = await loadPrincipal(principals, principalId, tenant);
+		if (principal === null) return deniedFor(permission, "anonymous");
+		const target = await create(principal, tenant);
+		if (tenant !== void 0 && target.subject.principal?.tenant !== tenant && (principal.kind !== "contact" || target.tenants().length > 0)) return deniedFor(permission, "tenant-mismatch");
+		if (row !== void 0) await target.prefetchRelations(permission, [row]);
+		return target.decide(permission, row, PEEK);
+	} catch {
+		return deniedFor(permission, "anonymous");
+	}
+}
+//#endregion
+//#region src/core/may-use.ts
+function delegationMayCover(permission, delegation, hasActor) {
+	return [void 0, ...[...delegation?.access ?? [], ...delegation?.authorizationDetails ?? []].flatMap((entry) => typeof entry === "object" && entry !== null && typeof entry["identifier"] === "string" ? [entry["identifier"]] : [])].some((id) => coveredByDelegation(permission, delegation, id, hasActor) === void 0);
+}
+function blocksEveryRow(grant) {
+	return grant.effect === "deny" && grant.where === void 0 && grant.check === void 0 && grant.portable !== false && grant.fields === void 0 && (grant.scope === void 0 || grant.scope === "tenant");
+}
+/**
+* Whether `permission` could be granted to this instance's subject for some
+* row: the grants its snapshot carries for the active tenant, minus an
+* unconditional deny, within its delegation. A listing hint for tools and
+* skills, never a decision; the call itself is decided in full.
+*/
+function mayUse(permdock, permission) {
+	try {
+		const snapshot = permdock.snapshot();
+		if (!("grants" in snapshot)) return false;
+		const ceiling = snapshot.delegated;
+		if (ceiling !== void 0 && !ceiling.includes(permission.key) || readOnlyActorRefuses(permdock.subject.actor, permission)) return false;
+		if (!delegationMayCover(permission, permdock.subject.delegation, permdock.subject.actor !== void 0 && ceiling === void 0)) return false;
+		const tenant = permdock.subject.principal?.tenant;
+		const scopes = scopeList(snapshot.scopes);
+		const grants = snapshot.grants.filter((grant) => {
+			if (grant.permission !== permission.key) return false;
+			const owner = grant.membership === void 0 ? void 0 : tenantOf(grant.membership, scopes);
+			return owner === void 0 || owner === tenant;
+		});
+		if (grants.some(blocksEveryRow)) return false;
+		return grants.some((grant) => grant.effect === "allow");
+	} catch {
+		return false;
+	}
+}
+function isConditioned(grant) {
+	return grant.where !== void 0 || grant.check !== void 0 || grant.validity !== void 0 || grant.portable === false;
+}
+/**
+* The instances of `scope` in which the subject holds `permission`, from its
+* live memberships of exactly that scope, within its delegation: by default
+* those with an allow that carries no row condition (`where`, `check`, a
+* validity window or a non-portable test; a `fields` limit is not a row
+* condition), minus the instances any deny of the permission reaches. The
+* in-process mirror of the SQL `permitted_<scope>_ids_by_permission`. With
+* `conditioned: true` it also lists the instances where a conditioned allow
+* applies, minus only unconditional denies, as
+* `permitted_<scope>_ids_by_permission(p_permission, true)` does. A listing,
+* never a decision: a row's own check still runs `can`.
+*/
+function permittedIds(permdock, permission, scope, options = {}) {
+	try {
+		const snapshot = permdock.snapshot({ tenants: "all" });
+		if (!("grants" in snapshot)) return [];
+		const scopes = scopeList(snapshot.scopes);
+		const name = resolveScope(scopes, scope);
+		const ceiling = snapshot.delegated;
+		if (name === void 0 || ceiling !== void 0 && !ceiling.includes(permission.key) || readOnlyActorRefuses(permdock.subject.actor, permission) || !delegationMayCover(permission, permdock.subject.delegation, permdock.subject.actor !== void 0 && ceiling === void 0)) return [];
+		const conditioned = options.conditioned === true;
+		const now = nowSeconds();
+		const allowed = /* @__PURE__ */ new Set();
+		const denied = /* @__PURE__ */ new Set();
+		for (const grant of snapshot.grants) {
+			const membership = grant.membership;
+			if (grant.permission !== permission.key || grant.scope !== name || membership?.scope !== name || membership.id === void 0 || isMembershipExpired(membership, now) || options.within !== void 0 && tenantOf(membership, scopes) !== options.within) continue;
+			if (grant.effect === "deny") {
+				if (!conditioned || !isConditioned(grant)) denied.add(membership.id);
+			} else if ((conditioned || !isConditioned(grant)) && isActive(readWireValidity(grant.validity), now)) allowed.add(membership.id);
+		}
+		return [...allowed].filter((id) => !denied.has(id)).toSorted();
+	} catch {
+		return [];
+	}
+}
+//#endregion
+//#region src/core/where-scope.ts
+const ALWAYS = freezeDeep({
+	op: "eq",
+	field: "_",
+	value: true
+});
+function eq(field, value) {
+	return value === void 0 ? {
+		op: "or",
+		conditions: []
+	} : {
+		op: "eq",
+		field,
+		value
+	};
+}
+/** One equality per partitioning scope key on the membership's chain, outermost first. */
+function namedFilters(membership, scope) {
+	if (findScope(scope.scopes, membership.scope ?? "") === void 0 || !inTeam(membership, scope.scopes, scope.team) || !activeFor(membership, scope.scopes, scope.tenant) || membership.scope === void 0) return null;
+	const filters = [];
+	for (const name of scopeChain(scope.scopes, membership.scope).toReversed()) {
+		const key = scope.fieldOf?.(name) ?? findScope(scope.scopes, name)?.key;
+		if (key !== void 0 && scope.partitioned(name, key)) filters.push(eq(key, scopeIdOf(membership, name)));
+	}
+	return filters;
+}
+/**
+* The row filters a grant's membership implies, or `null` when the grant
+* reaches no row in this scope (another tenant, no active tenant, expired).
+*/
+function scopeFilters(grant, scope) {
+	if (grant.scope === void 0) return [];
+	const membership = grant.membership;
+	if (membership === void 0 || isMembershipExpired(membership, scope.now)) return null;
+	if (typeof grant.scope === "string") return membership.scope === grant.scope ? namedFilters(membership, scope) : null;
+	const on = membership.on;
+	if (on === void 0) return null;
+	if (scope.resources === void 0) return on.resource === grant.scope.resource && on.resource === scope.resource ? [eq("id", on.id)] : null;
+	const roleResource = scope.resources.get(grant.scope.resource);
+	if (on.resource !== grant.scope.resource && membershipField(roleResource, on.resource, scope.resources) === void 0) return null;
+	const walked = scope.graph === true ? resourceRoleCondition(scope.resources.get(scope.resource), on.resource, [on.id], scope.resources) : void 0;
+	if (walked !== void 0) return [walked];
+	const field = membershipField(scope.resources.get(scope.resource), on.resource, scope.resources);
+	return field === void 0 ? null : [eq(field, on.id)];
+}
+function all(conditions) {
+	if (conditions.length === 0) return ALWAYS;
+	return sole(conditions) ?? {
+		op: "and",
+		conditions: [...conditions]
+	};
+}
+function scopedCondition(grant, scope) {
+	const filters = scopeFilters(grant, scope);
+	if (filters === null) return null;
+	const parts = grant.where === void 0 ? filters : [...filters, grant.where];
+	return parts.length === 0 ? "always" : all(parts);
+}
+/** Whether an unconditional `deny` removes every row `allow` could reach. */
+function covers(deny, allow, scopes) {
+	if (deny.where !== void 0) return false;
+	const denied = deny.membership;
+	if (deny.scope === void 0 || denied === void 0) return deny.scope === void 0;
+	const allowed = allow.membership;
+	if (allowed === void 0) return false;
+	if (typeof deny.scope === "object") return typeof allow.scope === "object" && denied.on?.resource === allowed.on?.resource && denied.on?.id === allowed.on?.id;
+	if (typeof allow.scope !== "string" || allowed.scope === void 0) return false;
+	const chain = scopeChain(scopes, deny.scope);
+	return scopeChain(scopes, allowed.scope).includes(deny.scope) && chain.every((name) => scopeIdOf(allowed, name) === scopeIdOf(denied, name));
+}
+/**
+* The portable filter for one permission's grants: allows OR together, each
+* narrowed to its membership's tenant, team or resource; any applicable
+* portable deny is subtracted, and an unconditional one empties the result.
+*/
+function collect(grants, scope) {
+	const none = {
+		op: "or",
+		conditions: []
+	};
+	const partial = grants.some((grant) => grant.portable === false);
+	const denies = [];
+	for (const grant of grants) {
+		if (grant.effect !== "deny" || grant.portable === false || !isActive(readWireValidity(grant.validity, "deny"), scope.now)) continue;
+		const condition = scopedCondition(grant, scope);
+		if (condition === "always") return {
+			condition: none,
+			partial
+		};
+		if (condition !== null) denies.push({
+			grant,
+			condition
+		});
+	}
+	const parts = [];
+	for (const grant of grants) {
+		if (grant.effect !== "allow" || grant.portable === false || !isActive(readWireValidity(grant.validity), scope.now)) continue;
+		const condition = scopedCondition(grant, scope);
+		if (condition === null || denies.some((deny) => covers(deny.grant, grant, scope.scopes))) continue;
+		parts.push(all([...condition === "always" ? [] : [condition], ...denies.map((deny) => ({
+			op: "not",
+			condition: deny.condition
+		}))]));
+	}
+	if (parts.length === 0) return {
+		condition: none,
+		partial
+	};
+	return {
+		condition: sole(parts) ?? {
+			op: "or",
+			conditions: parts
+		},
+		partial
+	};
+}
+/**
+* `collect`, with every subject ref bound to `scope.subject` and the subject
+* attached (not enumerable) for `memberOf`, which needs its memberships.
+*/
+function whereFromGrants(grants, scope) {
+	const { condition, partial } = collect(grants, scope);
+	const result = {
+		condition: bindConditionRefs(condition, scope.subject),
+		partial
+	};
+	Object.defineProperty(result, "subject", {
+		value: scope.subject,
+		enumerable: false
+	});
+	Object.defineProperty(result, "scopes", {
+		value: scope.scopes,
+		enumerable: false
+	});
+	if (scope.resources !== void 0) Object.defineProperty(result, "resources", {
+		value: scope.resources,
+		enumerable: false
+	});
+	return freezeDeep(result);
+}
+//#endregion
+export { deniedFor as a, snapshotFromClaims as c, decideForTarget as i, mayUse as n, signSnapshot as o, permittedIds as r, snapshotClaim as s, whereFromGrants as t };

package/dist/who-can-DWBAcaCQ.js

@@ -0,0 +1,364 @@
+import { t as compact } from "./compact-CAf557ZB.js";
+import { n as freezeDeep } from "./freeze-CrU8nQeX.js";
+import { r as ownGet } from "./paths-DXSHAMIa.js";
+import { n as internalsOf } from "./internals-Dk8A8fX3.js";
+import { a as getResource } from "./permission-registry-Br4jSNVi.js";
+import { a as expandRelation, c as isEdgeRelation, l as isFieldRelation, u as isPrincipalRelation } from "./resource-relations-D_jw0BFx.js";
+import { s as instantAt } from "./time-DkWjdL98.js";
+import { a as normalizeMemberships, c as rootScope, d as scopeList, o as resolveScope } from "./scopes-CUPSjo9q.js";
+import { o as flattenGrantee } from "./grantee-hxrUsbpM.js";
+import { r as relationCondition } from "./grantee-conditions-CcXf8hMM.js";
+import { c as nowSeconds, p as scopeField } from "./tenancy-DN2QAx9z.js";
+import { t as byCodePoint } from "./compare-pfyVnBjE.js";
+import { T as emptyListeners, t as evaluate } from "./evaluate-CNClBvcj.js";
+import { n as relationId, t as pendingRelations } from "./relations-BnCWnJGI.js";
+import { t as relationWalk } from "./relation-walk-3OyDBF0S.js";
+//#region src/core/who-can.ts
+const MAX_ROUNDS = 48;
+async function settle(cache) {
+	for (let round = 0; round < MAX_ROUNDS; round += 1) {
+		const pending = pendingRelations(cache);
+		if (pending.length === 0) return;
+		await Promise.all(pending);
+	}
+}
+/** The holders on each instance a graph relation reads, or `undefined` when the graph cannot say. */
+async function walkHolders(condition, row, reader, cache) {
+	let walk = relationWalk(condition, row, reader);
+	if (walk === "relation-unavailable") {
+		await settle(cache);
+		walk = relationWalk(condition, row, reader);
+	}
+	if (walk === void 0) return [];
+	if (walk === "relation-depth" || walk === "relation-unavailable") return;
+	const { ids } = walk;
+	const read = () => ids.map((id) => reader.holders({
+		resource: condition.resource,
+		id,
+		relation: condition.relation
+	}));
+	let answers = read();
+	if (answers.includes("pending")) {
+		await settle(cache);
+		answers = read();
+	}
+	const out = [];
+	for (const [index, answer] of answers.entries()) {
+		const id = ids[index];
+		if (answer === "pending" || answer === "failed" || id === void 0) return;
+		out.push({
+			id,
+			holders: answer
+		});
+	}
+	return out;
+}
+async function discoverRole(item, allow, ctx) {
+	if (typeof item.scope !== "string" || item.scope === "global") {
+		ctx.incomplete();
+		return;
+	}
+	const key = scopeField(ctx.resource, item.scope, ctx.scopes);
+	const id = key === void 0 ? void 0 : relationId(ownGet(ctx.row, key));
+	if (id === void 0) return;
+	const members = await ctx.list(item.scope, id);
+	if (members === null) {
+		ctx.incomplete();
+		return;
+	}
+	for (const member of members.filter((entry) => entry.membership.roles.includes(item.role))) ctx.add(member.id, allow ? {
+		kind: "role",
+		role: item.role,
+		membership: member.membership
+	} : void 0, member.membership);
+}
+function holderVia(holder, at, share, group) {
+	if (!share) return {
+		kind: "relation",
+		...at
+	};
+	return compact({
+		kind: "share",
+		...at,
+		expiresAt: holder.expiresAt,
+		group
+	});
+}
+/**
+* Principals holding `group`'s relation, through at most `budget` more groups
+* of its resource; `undefined` when a read failed. `memo` keeps each group's
+* members per budget across one discovery, so a group shared by many paths is
+* read once; a result cut short by a cycle is path-specific and not kept.
+*/
+async function groupMembers(group, ctx, budget, seen, memo) {
+	const key = JSON.stringify([
+		group.resource,
+		group.id,
+		group.relation
+	]);
+	const memoKey = `${budget}:${key}`;
+	const known = memo.get(memoKey);
+	if (known !== void 0) return {
+		members: known,
+		cut: false
+	};
+	let holders = ctx.reader.holders(group);
+	if (holders === "pending") {
+		await settle(ctx.cache);
+		holders = ctx.reader.holders(group);
+	}
+	if (holders === "pending" || holders === "failed") return;
+	const path = new Set(seen).add(key);
+	const out = /* @__PURE__ */ new Set();
+	let cut = false;
+	for (const holder of holders) {
+		if ("principal" in holder) {
+			out.add(holder.principal.id);
+			continue;
+		}
+		const nested = JSON.stringify([
+			holder.group.resource,
+			holder.group.id,
+			holder.group.relation
+		]);
+		const same = holder.group.resource === group.resource;
+		if (path.has(nested)) {
+			cut = true;
+			continue;
+		}
+		if (same && budget <= 0) continue;
+		const walk = await groupMembers(holder.group, ctx, same ? budget - 1 : 16, path, memo);
+		if (walk === void 0) return;
+		cut ||= walk.cut;
+		for (const member of walk.members) out.add(member);
+	}
+	const members = [...out];
+	if (!cut) memo.set(memoKey, members);
+	return {
+		members,
+		cut
+	};
+}
+async function discoverGraph(condition, allow, ctx) {
+	const nodes = await walkHolders(condition, ctx.row, ctx.reader, ctx.cache);
+	if (nodes === void 0) {
+		ctx.incomplete();
+		return;
+	}
+	const node = ctx.policy.resources.get(condition.resource);
+	const memo = /* @__PURE__ */ new Map();
+	for (const entry of nodes) for (const holder of entry.holders) {
+		const at = {
+			resource: condition.resource,
+			relation: holder.relation,
+			id: entry.id
+		};
+		const share = isEdgeRelation(node?.relations[holder.relation]);
+		if ("principal" in holder) {
+			ctx.add(holder.principal.id, allow ? holderVia(holder, at, share) : void 0);
+			continue;
+		}
+		const walk = await groupMembers(holder.group, ctx, holder.group.resource === condition.resource ? 15 : 16, /* @__PURE__ */ new Set(), memo);
+		if (walk === void 0) {
+			ctx.incomplete();
+			continue;
+		}
+		for (const member of walk.members) ctx.add(member, allow ? holderVia(holder, at, share, holder.group) : void 0);
+	}
+}
+async function discoverRelation(item, allow, ctx, expanded = false) {
+	const condition = relationCondition(item, ctx.resource, ctx.scopes, { resources: ctx.policy.resources });
+	if (condition?.op === "related") {
+		await discoverGraph(condition, allow, ctx);
+		return;
+	}
+	const spec = ctx.resource?.relations[item.relation];
+	if (spec?.includes !== void 0 && !expanded) {
+		for (const name of expandRelation(ctx.resource, item.relation)) await discoverRelation({
+			...item,
+			relation: name
+		}, allow, ctx, true);
+		return;
+	}
+	const via = allow ? {
+		kind: "relation",
+		resource: ctx.permission.resource,
+		relation: item.relation,
+		id: relationId(ownGet(ctx.row, ctx.resource?.id ?? "id")) ?? ""
+	} : void 0;
+	if (isFieldRelation(spec) && spec.memberOf !== void 0) {
+		const scope = resolveScope(ctx.scopes, spec.memberOf);
+		const id = relationId(ownGet(ctx.row, spec.field));
+		const members = scope === void 0 || id === void 0 ? [] : await ctx.list(scope, id);
+		if (members === null) {
+			ctx.incomplete();
+			return;
+		}
+		for (const member of members) ctx.add(member.id, via, member.membership);
+		return;
+	}
+	const column = isFieldRelation(spec) ? spec.field : isPrincipalRelation(spec) ? spec.principal : void 0;
+	const holder = column === void 0 ? void 0 : relationId(ownGet(ctx.row, column));
+	if (holder !== void 0) ctx.add(holder, via);
+}
+function discover(grant, item, ctx) {
+	const allow = grant.effect === "allow";
+	switch (item.kind) {
+		case "role": return discoverRole(item, allow, ctx);
+		case "relation": return discoverRelation(item, allow, ctx);
+		case "anyone":
+		case "authenticated":
+		case "plan":
+		case "actor":
+		case "assurance":
+		case "inherit":
+			ctx.incomplete();
+			return Promise.resolve();
+		default: return unknownKind(item, ctx);
+	}
+}
+/** Holders of a grantee kind this build does not know cannot be listed. */
+function unknownKind(_item, ctx) {
+	ctx.incomplete();
+	return Promise.resolve();
+}
+function memberLister(source, scopes) {
+	const listed = /* @__PURE__ */ new Map();
+	const load = async (scope, id) => {
+		if (source?.list === void 0) return null;
+		try {
+			return (await source.list({
+				scope,
+				id
+			})).flatMap((entry) => typeof entry.principal?.id === "string" ? normalizeMemberships([entry.membership], scopes).map((membership) => ({
+				id: entry.principal.id,
+				membership
+			})) : []);
+		} catch {
+			return null;
+		}
+	};
+	return (scope, id) => {
+		const key = JSON.stringify([scope, id]);
+		const known = listed.get(key) ?? load(scope, id);
+		listed.set(key, known);
+		return known;
+	};
+}
+/**
+* Who holds `permission` on `resource` for the instance's policy and how
+* (role, relation or share), from `MembershipSource.list` and
+* `RelationSource.related`. It lists and never grants; `complete: false`
+* means some holders could not be listed. An instance built from a
+* snapshot answers an empty, incomplete list.
+*/
+function whoCan(permdock, permission, resource) {
+	const internals = internalsOf(permdock);
+	if (internals === void 0) return Promise.resolve(freezeDeep({
+		permission: permission.key,
+		holders: [],
+		complete: false
+	}));
+	return whoCanWith({
+		policy: internals.policy,
+		permission,
+		row: resource,
+		memberships: internals.env.memberships,
+		reader: internals.relations,
+		cache: internals.relationCache,
+		customGrants: internals.customGrants,
+		team: internals.team
+	});
+}
+async function whoCanWith(input) {
+	const { policy, permission, row } = input;
+	if (permission.kind !== "instance" || row === null || typeof row !== "object") return freezeDeep({
+		permission: permission.key,
+		holders: [],
+		complete: false
+	});
+	const scopes = scopeList(policy.scopes);
+	let complete = !input.customGrants.some((item) => item.grant.permission.key === permission.key);
+	const found = /* @__PURE__ */ new Map();
+	const ctx = {
+		policy,
+		scopes,
+		resource: getResource(policy.permissions, permission.resource),
+		permission,
+		row,
+		reader: input.reader,
+		cache: input.cache,
+		list: memberLister(input.memberships, scopes),
+		add(id, via, membership) {
+			const entry = found.get(id) ?? {
+				memberships: [],
+				via: []
+			};
+			found.set(id, entry);
+			if (via !== void 0) entry.via.push(via);
+			if (membership !== void 0) entry.memberships.push(membership);
+		},
+		incomplete() {
+			complete = false;
+		}
+	};
+	await Promise.all((policy.index.grantsByKey.get(permission.key) ?? []).flatMap((grant) => flattenGrantee(grant.to).map((item) => discover(grant, item, ctx))));
+	const root = rootScope(scopes);
+	const tenantKey = root === void 0 ? void 0 : scopeField(getResource(policy.permissions, permission.resource), root, scopes);
+	const tenant = tenantKey === void 0 ? void 0 : relationId(ownGet(row, tenantKey));
+	const env = {
+		emit: false,
+		simulated: true,
+		skipAlternatives: true,
+		customRoles: [],
+		customGrants: [],
+		listeners: emptyListeners(),
+		sink: void 0,
+		limits: void 0,
+		limitCache: /* @__PURE__ */ new Map(),
+		team: input.team,
+		relations: input.reader
+	};
+	const now = nowSeconds();
+	const ordered = [...found.entries()].toSorted(([a], [b]) => byCodePoint(a, b));
+	const decideAll = () => ordered.map(([id, entry]) => {
+		const subject = freezeDeep({
+			principal: {
+				id,
+				roles: [],
+				memberships: entry.memberships,
+				...tenant === void 0 ? {} : { tenant }
+			},
+			context: {}
+		});
+		return evaluate(policy, subject, permission, row, {
+			call: "simulate",
+			trusted: true,
+			now: instantAt(now)
+		}, env);
+	});
+	let decisions = decideAll();
+	if (pendingRelations(input.cache).length > 0) {
+		await settle(input.cache);
+		decisions = decideAll();
+	}
+	const holders = [];
+	for (const [index, [id, entry]] of ordered.entries()) {
+		const decision = decisions[index];
+		if (decision === void 0 || decision.outcome === "denied") {
+			if (decision?.outcome === "denied" && decision.denials.some((denial) => denial.reason === "relation-unavailable" || denial.reason === "relation-depth")) complete = false;
+			continue;
+		}
+		holders.push({
+			principal: { id },
+			via: entry.via
+		});
+	}
+	return freezeDeep({
+		permission: permission.key,
+		holders,
+		complete
+	});
+}
+//#endregion
+export { whoCan as t };