permdock 0.5.0 → 0.7.0

package/dist/{peer-CRvC7Hg1.js → peer-DOzzMfZL.js}

@@ -1 +1 @@
-export { t as addLine, n as packageManagerOf, r as peerHint, i as requirePeer } from "./peer-C8swJ2GH.js";
+export { t as addLine, n as packageManagerOf, r as peerHint, i as requirePeer } from "./peer-12Q5I_RH.js";

package/dist/{permdock-B9JxkBwC.js → permdock-BfWEeMqk.js}

@@ -1,20 +1,22 @@
-import { n as isReadonlyArray, t as compact } from "./compact-CAf557ZB.js";
+import { n as isReadonlyArray, r as isRecord, t as compact } from "./compact-CAf557ZB.js";
 import { n as freezeDeep, t as freezeCopy } from "./freeze-CrU8nQeX.js";
 import { n as PermDockValidationError } from "./validation-error-ZfUHbKvf.js";
 import { a as deniedMessage, i as approvalMessage, n as PermDockDeniedError, t as PermDockApprovalRequiredError } from "./errors-BKy0EfhN.js";
 import { t as attachInternals } from "./internals-Dk8A8fX3.js";
-import { a as getResource, c as listPermissions, g as formerScopes } from "./permission-registry-Br4jSNVi.js";
+import { _ as keyToScope, a as getResource, c as listPermissions, g as formerScopes } from "./permission-registry-DpPtSKNZ.js";
 import { n as isThenable } from "./thenable-yD7SabqG.js";
 import { i as readAppData } from "./app-data-MuyzVqX8.js";
-import { a as normalizeMemberships, d as scopeList, m as tenantOf } from "./scopes-CUPSjo9q.js";
+import { f as scopeList, h as tenantOf, o as normalizeMemberships } from "./scopes-BHsc-wp-.js";
 import { o as pickVisible, s as sanitizeContext } from "./validity-CZ7-y0Cj.js";
-import { c as nowSeconds, d as resolveActiveTenant, m as tenantsOf, p as scopeField, t as heldRoleNamesIn, u as relatesTo } from "./tenancy-DN2QAx9z.js";
-import { l as policyX } from "./policy-DLZJ5gAp.js";
-import { A as isContact, C as emptyListeners, S as emitSafe, i as customRolesFor, k as contactMemberships, o as roleSourceFor, r as assignableNamesFor, s as sourceName, t as evaluate, u as customGrantsFor, w as finish } from "./evaluate-_R8QkWaf.js";
-import { a as whereGrant, c as applyRoleKinds, i as collectSnapshotGrants, l as audiencesOf, o as heldRoleNames, p as asMembershipSource, r as assignableIn, s as roleLeaf, t as snapshotOf } from "./instance-snapshot-Cxq4ygFc.js";
+import { c as nowSeconds, d as resolveActiveTenant, m as tenantsOf, p as scopeField, t as heldRoleNamesIn, u as relatesTo } from "./tenancy-CmeBQ6Nv.js";
+import { u as policyX } from "./policy-DaJy4nK4.js";
+import { t as byCodePoint } from "./compare-pfyVnBjE.js";
+import { D as emptyListeners, E as emitSafe, N as contactMemberships, O as finish, P as isContact, i as customRolesFor, o as roleSourceFor, r as assignableNamesFor, s as sourceName, t as evaluate, u as customGrantsFor, w as unknownLevelsFor } from "./evaluate-B_oqFbWC.js";
+import { a as whereGrant, c as applyRoleKinds, i as collectSnapshotGrants, l as audiencesOf, o as heldRoleNames, p as asMembershipSource, r as assignableIn, s as roleLeaf, t as snapshotOf } from "./instance-snapshot-CjcwnEiV.js";
 import { r as relationReader, t as pendingRelations } from "./relations-BnCWnJGI.js";
-import { r as snapshotGrant } from "./snapshot-CXUWfsNy.js";
-import { i as decideForTarget, n as mayUse, o as signSnapshot, r as permittedIds, t as whereFromGrants } from "./where-scope-Dv-WTP-w.js";
+import { r as snapshotGrant } from "./snapshot-CbGmYiJx.js";
+import { a as decideForTarget, i as permittedIds, o as deniedFor, r as mayUse, s as signSnapshot, t as whereFromGrants } from "./where-scope-wq2coopv.js";
+import { i as decideAllWith, n as canAllWith } from "./checks-BC_0mPIq.js";
 import { r as isSubject, t as anonymousSubject } from "./subject-BGoM5o8B.js";
 //#region src/core/app.ts
 const APP = Symbol.for("permdock.app");
@@ -145,6 +147,7 @@ function buildInstance(policy, subject, envBase, team) {
 	const queuedAuth = [...envBase.queuedAuth];
 	const queuedErrors = [...envBase.queuedErrors ?? []];
 	const customGrants = customGrantsFor(policy, envBase.customRoles);
+	const unknownLevels = unknownLevelsFor(policy, envBase.customRoles);
 	const relationCache = envBase.relationCache ?? /* @__PURE__ */ new Map();
 	const relations = relationReader(envBase.relations, relationCache, policy.resources);
 	const assignableAt = (tenant) => assignableIn(policy, subject, envBase.customRoles, customGrants, tenant, tenant === void 0 ? void 0 : envBase.assignable?.get(tenant));
@@ -165,11 +168,25 @@ function buildInstance(policy, subject, envBase, team) {
 	});
 	const decideImpl = (permission, data, options) => evaluate(policy, subject, permission, data, options ?? {}, envFor(options?.call !== "simulate", options?.call === "can"));
 	const explainImpl = (permission, data, options) => {
-		return decideImpl(permission, data, {
+		const explained = decideImpl(permission, data, {
 			...options,
 			call: options?.call ?? "explain",
 			explain: true
 		});
+		const named = unknownLevels.filter((entry) => entry.permission === permission.key);
+		return named.length === 0 ? explained : {
+			...explained,
+			trace: {
+				...explained.trace,
+				skipped: [...explained.trace.skipped, ...named.map((entry) => ({
+					role: entry.role,
+					permission: entry.permission,
+					effect: "allow",
+					why: "unknown-level",
+					level: entry.level
+				}))]
+			}
+		};
 	};
 	const canImpl = (permission, data, options) => {
 		try {
@@ -190,9 +207,44 @@ function buildInstance(policy, subject, envBase, team) {
 	const instance = {
 		can: canImpl,
 		decide: decideImpl,
+		canAll: (checks, options) => canAllWith(canImpl, checks, options),
+		decideAll: (checks, options) => decideAllWith(decideImpl, checks, options),
 		decideEach(permission, rows, options) {
 			return Object.freeze(rows.map((row) => decideImpl(permission, row, options)));
 		},
+		async decideIds(permission, ids, options) {
+			const { data, ...decide } = options;
+			const invalid = () => deniedFor(permission, "validation");
+			let loaded;
+			try {
+				loaded = await data(ids);
+			} catch {
+				return Object.freeze(ids.map(invalid));
+			}
+			const resource = getResource(policy.permissions, permission.resource);
+			const scopes = scopeList(policy.scopes);
+			const root = scopes[0]?.name;
+			const rowOf = (id) => {
+				if (loaded instanceof Map) return loaded.get(id);
+				return isReadonlyArray(loaded) ? loaded.find((row) => isRecord(row) && resource !== void 0 && row[resource.id] === id) : void 0;
+			};
+			const tenantField = root === void 0 ? void 0 : scopeField(resource, root, scopes);
+			const results = [];
+			for (const id of ids) {
+				const row = rowOf(id);
+				if (row === void 0 || row === null) {
+					results.push(invalid());
+					continue;
+				}
+				const tenant = tenantField !== void 0 && isRecord(row) ? row[tenantField] : void 0;
+				const target = typeof tenant === "string" && tenant !== "" ? instance.tenant(tenant) : instance;
+				results.push(target.decide(permission, row, {
+					...decide,
+					trusted: true
+				}));
+			}
+			return Object.freeze(results);
+		},
 		decideFor(principalId, permission, row) {
 			return decideForTarget(subject, envBase.principals, envBase.targets, principalId, permission, row);
 		},
@@ -356,11 +408,13 @@ function buildInstance(policy, subject, envBase, team) {
 				...envBase,
 				relationCache
 			}, team);
+			const activeTenant = resolveActiveTenant(subject.principal, id, scopeList(policy.scopes));
 			return buildInstance(policy, freezeDeep(compact({
 				...subject,
 				principal: compact({
 					...subject.principal,
-					tenant: resolveActiveTenant(subject.principal, id, scopeList(policy.scopes))
+					tenant: activeTenant,
+					unheldTenant: activeTenant === void 0 ? id : void 0
 				})
 			})), {
 				...envBase,
@@ -448,6 +502,30 @@ function buildInstance(policy, subject, envBase, team) {
 //#endregion
 //#region src/core/oauth-scopes.ts
 /**
+* Every OAuth scope a token may carry to the permission keys it reaches: each
+* permission's own scope, the scopes of the keys it was renamed from, and each
+* coarse `oauthScopes` scope. Scopes and keys are sorted by code point. A key
+* outside `permissions` is dropped, so a stale `oauthScopes` entry grants
+* nothing. better-supabase's `delegation.scopes` and the SQL helpers'
+* `rls.tokenScopes` ceiling both read this map.
+*/
+function delegatedScopeMap(permissions, oauthScopes = []) {
+	const delegated = /* @__PURE__ */ new Map();
+	const add = (scope, key) => {
+		const keys = delegated.get(scope) ?? /* @__PURE__ */ new Set();
+		keys.add(key);
+		delegated.set(scope, keys);
+	};
+	const known = /* @__PURE__ */ new Set();
+	for (const permission of permissions) {
+		known.add(permission.key);
+		add(permission.scope, permission.key);
+		for (const former of permission.renamedFrom ?? []) add(keyToScope(former), permission.key);
+	}
+	for (const entry of oauthScopes) for (const key of entry.permissions) if (known.has(key)) add(entry.scope, key);
+	return Object.fromEntries([...delegated.keys()].toSorted(byCodePoint).map((scope) => [scope, [...delegated.get(scope) ?? []].toSorted(byCodePoint)]));
+}
+/**
 * `delegation` with every coarse OAuth scope the policy declares in
 * `oauthScopes` followed by the scopes of the permissions it covers, so the
 * delegation checks downstream match them. The token's scopes stay first and
@@ -546,16 +624,22 @@ function assemblePrincipal(policy, user, options, auth) {
 		}
 	};
 	let stale;
+	let roles;
 	if (principal !== null && source !== void 0 && !fromClaims) {
 		live = true;
 		memberships = read(source, principal);
 	} else if (principal?.memberships !== void 0 && fromClaims && source.onStale === "reread" && source.version !== void 0) {
-		const reread = rereadStale(source, principal, principal.memberships, () => read(source, principal), auth);
+		const reread = rereadStale(source, principal, principal.memberships, () => read(source, principal), auth, source.globalRolesFor === void 0 ? void 0 : () => source.globalRolesFor?.(compact({
+			id: principal.id,
+			kind: principal.kind
+		})) ?? []);
 		memberships = reread.memberships;
 		stale = reread.stale;
+		roles = reread.roles;
 	}
 	return compact({
 		principal,
+		roles,
 		context: contextResult,
 		actor,
 		delegation: expandOAuthScopes(policy, delegation),
@@ -574,7 +658,7 @@ function versionQuery(principal) {
 		memberships: principal.memberships
 	});
 }
-function rereadStale(source, principal, claims, read, auth) {
+function rereadStale(source, principal, claims, read, auth, readRoles) {
 	const claimed = principal.authzVersion;
 	const judge = (current) => typeof claimed === "number" && current !== void 0 && claimed >= current ? "fresh" : "reread";
 	const unknown = () => {
@@ -592,14 +676,39 @@ function rereadStale(source, principal, claims, read, auth) {
 	} catch {
 		freshness = unknown();
 	}
-	if (isThenable(freshness)) return {
-		memberships: freshness.then((found) => found === "reread" ? read() : claims),
-		stale: freshness.then((found) => found === "unknown")
+	const failed = () => {
+		auth.push({
+			reason: "source-threw",
+			source: "memberships",
+			...sourceName(source)
+		});
+		return [];
 	};
-	return {
-		memberships: freshness === "reread" ? read() : claims,
-		stale: freshness === "unknown"
+	const rolesOf = (found) => {
+		if (found !== "reread" || readRoles === void 0) return;
+		try {
+			const roles = readRoles();
+			return isThenable(roles) ? Promise.resolve(roles).catch(failed) : roles;
+		} catch {
+			return failed();
+		}
 	};
+	if (isThenable(freshness)) {
+		const settled = freshness.then((found) => ({
+			found,
+			roles: rolesOf(found)
+		}));
+		return {
+			memberships: settled.then(({ found }) => found === "reread" ? read() : claims),
+			stale: settled.then(({ found }) => found === "unknown"),
+			roles: settled.then(({ roles }) => roles)
+		};
+	}
+	return compact({
+		memberships: freshness === "reread" ? read() : claims,
+		stale: freshness === "unknown",
+		roles: rolesOf(freshness)
+	});
 }
 function finishSubject(policy, assembled, context, input, options, extra) {
 	if (assembled.principal === null) return freezeCopy(compact({
@@ -617,12 +726,14 @@ function finishSubject(policy, assembled, context, input, options, extra) {
 	const roles = held === void 0 ? kinds.roles : [];
 	const memberships = held === void 0 ? kinds.memberships : outsideHeld(held, options) ? [] : kinds.memberships.filter((membership) => tenantOf(membership, scopes) === held);
 	const plans = contact ? [] : [.../* @__PURE__ */ new Set([...assembled.principal.plans ?? [], ...extra.plans])];
+	const activeTenant = contact ? void 0 : activeTenantOf(policy, assembled, memberships, options);
 	const withMemberships = freezeCopy(compact({
 		...assembled.principal,
 		roles,
 		memberships,
 		plans: plans.length > 0 ? plans : contact ? void 0 : assembled.principal.plans,
-		tenant: contact ? void 0 : activeTenantOf(policy, assembled, memberships, options)
+		tenant: activeTenant,
+		unheldTenant: activeTenant === void 0 ? options.tenant : void 0
 	}));
 	return freezeCopy(compact({
 		principal: withMemberships,
@@ -760,7 +871,17 @@ function withRequestContext(request, resolved) {
 	};
 }
 function resolveSubject(policy, user, options, auth) {
-	const assembled = assemblePrincipal(policy, user, options, auth);
+	const first = assemblePrincipal(policy, user, options, auth);
+	const apply = (roles) => resolveAssembled(policy, roles === void 0 || first.principal === null ? first : {
+		...first,
+		principal: {
+			...first.principal,
+			roles
+		}
+	}, options, auth);
+	return isThenable(first.roles) ? Promise.resolve(first.roles).then(apply) : apply(first.roles);
+}
+function resolveAssembled(policy, assembled, options, auth) {
 	const memberships = settle(assembled.memberships, [], () => {
 		auth.push({
 			reason: "source-threw",
@@ -803,35 +924,42 @@ function instantiate(codePolicy, subject, options, auth) {
 	const customRoles = customRolesFor(roleSource, tenants, auth, subject.principal === null ? void 0 : subject.principal.roles ?? [], (tenant) => heldRoleNamesIn(subject.principal, scopes, tenant));
 	const assignable = assignableNamesFor(roleSource, tenants, auth);
 	const approvals = options.approvalPolicies?.load(policy, tenants, auth);
-	const build = (roles, names, approvalPolicies) => buildInstance(policy, subject, compact({
-		customRoles: roles,
-		sink: options.sink,
-		limits: options.limits,
-		limitCache: /* @__PURE__ */ new Map(),
-		simulated: false,
-		roleSource,
-		assignable: names,
-		queuedAuth: auth,
-		queuedErrors: errors,
-		relations: options.relations,
-		approvalPolicies,
-		memberships: options.memberships === void 0 ? void 0 : asMembershipSource(options.memberships),
-		principals: options.principals,
-		settings: options.settings,
-		targets: (principal, tenant) => getPermDock(codePolicy, {
-			principal,
-			context: {}
-		}, compact({
-			tenant,
-			memberships: options.memberships,
-			customRoles: options.customRoles,
-			entitlements: options.entitlements,
+	const build = (roles, names, approvalPolicies) => {
+		for (const entry of unknownLevelsFor(policy, roles)) auth.push({
+			reason: "schema",
+			source: "customRoles",
+			cause: `unknown-level: ${entry.role} grants ${entry.permission} at '${entry.level}', which its resource does not declare`
+		});
+		return buildInstance(policy, subject, compact({
+			customRoles: roles,
+			sink: options.sink,
 			limits: options.limits,
-			policies: options.policies,
+			limitCache: /* @__PURE__ */ new Map(),
+			simulated: false,
+			roleSource,
+			assignable: names,
+			queuedAuth: auth,
+			queuedErrors: errors,
 			relations: options.relations,
-			approvalPolicies: options.approvalPolicies
-		}))
-	}));
+			approvalPolicies,
+			memberships: options.memberships === void 0 ? void 0 : asMembershipSource(options.memberships),
+			principals: options.principals,
+			settings: options.settings,
+			targets: (principal, tenant) => getPermDock(codePolicy, {
+				principal,
+				context: {}
+			}, compact({
+				tenant,
+				memberships: options.memberships,
+				customRoles: options.customRoles,
+				entitlements: options.entitlements,
+				limits: options.limits,
+				policies: options.policies,
+				relations: options.relations,
+				approvalPolicies: options.approvalPolicies
+			}))
+		}));
+	};
 	if (isThenable(customRoles) || isThenable(assignable) || isThenable(approvals)) return Promise.all([
 		customRoles,
 		assignable,
@@ -865,4 +993,4 @@ function getPermDock(policy, user, options = {}) {
 	return Promise.resolve().then(() => create(policy, user, options));
 }
 //#endregion
-export { hasScope as a, withApp as c, challengeScope as i, getPermDockSync as n, scopesReaching as o, resolveSubject as r, APP as s, getPermDock as t };
+export { delegatedScopeMap as a, APP as c, challengeScope as i, withApp as l, getPermDockSync as n, hasScope as o, resolveSubject as r, scopesReaching as s, getPermDock as t };

package/dist/{permdock-D7eeLJER.d.ts → permdock-Dco6dyCK.d.ts}

@@ -1,7 +1,8 @@
-import { $n as Delegation, Bn as LimitDetail, G as CustomRoleSourceFactory, Hn as Obligation, J as EntitlementSource, Nn as Decision, Q as LimitStore, Rn as ExplainedDecision, Rt as Instant, T as Policy, Un as Quota, Vt as Snapshot, W as CustomRoleSource, Xt as DecisionEvent, _ as GrantLimit, at as SettingsSource, cn as Scope, et as MembershipSource, h as Grant, i as ApprovalOption, ir as Subject, it as RelationSource, j as PolicyVocabulary, lr as Condition, nr as Membership, q as DecisionSink, qn as Actor, qt as AuthEvent, rr as Principal, sr as AdapterId, ut as TokenSigner } from "./policy-types-DzwivBgR.js";
-import { N as ResourceNode, V as AppData, a as RoleTree, n as PlanTree, r as Role, w as Permission } from "./vocabulary-D6lPdb4Z.js";
-import { i as OperationEffect, s as OperationMeta, t as Operation, u as OperationRisk } from "./operations-CxybZErY.js";
-import { i as HostedPolicies } from "./hosted-DBDX0M-P.js";
+import { G as CustomRoleSourceFactory, Gt as Snapshot, Hn as ExplainedDecision, J as EntitlementSource, Kn as Obligation, Ln as Decision, Q as LimitStore, Rt as Instant, T as Policy, W as CustomRoleSource, Wn as LimitDetail, Zn as Actor, Zt as AuthEvent, _ as GrantLimit, at as SettingsSource, en as DecisionEvent, et as MembershipSource, fn as Scope, fr as AdapterId, h as Grant, i as ApprovalOption, it as RelationSource, j as PolicyVocabulary, lr as Subject, mr as Condition, or as Membership, q as DecisionSink, qn as Quota, rr as Delegation, sr as Principal, ut as TokenSigner } from "./policy-types-B-F-qAZk.js";
+import { O as AppData, b as ResourceNode, u as Permission } from "./permission-types-DhNEmoRG.js";
+import { a as RoleTree, n as PlanTree, r as Role } from "./vocabulary-Bg3eeT2H.js";
+import { i as OperationEffect, s as OperationMeta, t as Operation, u as OperationRisk } from "./operations-BNLes61x.js";
+import { a as HostedPolicies } from "./hosted-BmjzxQhp.js";
 //#region src/core/approval-policies.d.ts
 /**
  * One approval requirement kept as data, for a tenant or the whole platform.
@@ -122,6 +123,10 @@ declare function tightenApproval(code: Grant["approval"], entries: readonly Load
   readonly operation?: OperationMeta | undefined;
 }): Grant["approval"];
 //#endregion
+//#region src/core/checks.d.ts
+/** One check of `canAll` or `decideAll`: a permission alone, or with the row it is checked on. */
+type PermissionCheck = Permission | readonly [permission: Permission, data?: unknown];
+//#endregion
 //#region src/core/limits.d.ts
 declare function memoryLimitStore(): LimitStore & {
   /** Live counters, for tests and diagnostics. */
@@ -216,6 +221,12 @@ declare function memoryPrincipalSource<TPrincipal extends Principal>(input: {
 type Boundary = "http-body" | "mcp-args" | "tool-args" | "decision-endpoint" | "manual";
 //#endregion
 //#region src/core/permdock.d.ts
+/** Rows the server loaded for `decideIds`: by id, or a list carrying the resource id field. */
+type LoadedRows = ReadonlyMap<string, unknown> | readonly unknown[];
+type DecideIdsOptions = Omit<DecideOptions, "trusted" | "boundary"> & {
+  /** Loads the rows for `ids`; ids it leaves out are denied with `validation`. */
+  readonly data: (ids: readonly string[]) => LoadedRows | Promise<LoadedRows>;
+};
 type DecideOptions = {
   /** `true` skips schema validation for a row the server loaded itself. Otherwise `data` is validated against the resource schema first (`validate: 'boundary'`), and a failure denies with reason `validation`. */
   readonly trusted?: boolean;
@@ -316,12 +327,30 @@ type PermDock<V extends PolicyVocabulary = PolicyVocabulary> = {
      */
     (permission: Permission, data: unknown, options?: DecideOptions): Decision;
   };
+  /**
+   * `can` for every check, on one instance: `true` only when each is
+   * granted, and `false` for an empty list. A check is a permission, or a
+   * `[permission, row]` pair. It stops at the first check that is not granted.
+   */
+  readonly canAll: (checks: readonly PermissionCheck[], options?: DecideOptions) => boolean;
+  /** `decide` for every check, in check order; a check is a permission or a `[permission, row]` pair. */
+  readonly decideAll: (checks: readonly PermissionCheck[], options?: DecideOptions) => readonly Decision[];
   /**
    * `decide` for each row, in row order. Each row is its own call: a limit
    * is consumed once per granted row, so rows past the cap are denied with
    * `limit`, and each `approval-required` row carries its own token.
    */
   readonly decideEach: (permission: Permission, rows: readonly unknown[], options?: DecideOptions) => readonly Decision[];
+  /**
+   * `decide` for each id, in id order, on rows the server loads itself:
+   * `options.data(ids)` answers a map from id to row, or the rows with their
+   * resource id field. Each row is trusted (no schema check) and decided in
+   * the tenant its own root scope field names, as `permdock.tenant(<that
+   * value>)` would, so one call can span tenants. An id with no loaded row,
+   * a loader that throws and a row of another resource are denied with
+   * `validation`. A snapshot instance denies every id with `unsupported`.
+   */
+  readonly decideIds: (permission: Permission, ids: readonly string[], options: DecideIdsOptions) => Promise<readonly Decision[]>;
   /**
    * What `permission` on `row` decides for the principal `principalId`,
    * loaded from `principals` in this instance's active tenant with no actor
@@ -499,4 +528,4 @@ declare function getPermDockSync<TUser, TPrincipal extends Principal = Principal
 /** The instance for `user`: waits for every source, then builds it. `getPermDockSync` is the synchronous twin. */
 declare function getPermDock<TUser, TPrincipal extends Principal = Principal, V extends PolicyVocabulary = PolicyVocabulary>(policy: Policy<TUser, TPrincipal, V>, user: TUser | Subject | null, options?: PermDockOptions): Promise<PermDock<V>>;
 //#endregion
-export { ApprovalPolicyValidation as C, validateApprovalPolicy as E, ApprovalPolicySource as S, memoryApprovalPolicySource as T, limits as _, RowPair as a, ApprovalPolicy as b, WhereResult as c, PrincipalIdentity as d, PrincipalIdentityLink as f, Limits as g, PermittedIdsOptions as h, PermDockOptions as i, getPermDock as l, memoryPrincipalSource as m, DeriveOptions as n, SimulateOptions as o, PrincipalSource as p, PermDock as r, SnapshotOptions as s, DecideOptions as t, getPermDockSync as u, memoryLimitStore as v, approvalPolicies as w, ApprovalPolicyProblem as x, ApprovalPolicies as y };
+export { ApprovalPolicy as C, approvalPolicies as D, ApprovalPolicyValidation as E, memoryApprovalPolicySource as O, ApprovalPolicies as S, ApprovalPolicySource as T, PermittedIdsOptions as _, PermDock as a, memoryLimitStore as b, SimulateOptions as c, getPermDock as d, getPermDockSync as f, memoryPrincipalSource as g, PrincipalSource as h, LoadedRows as i, validateApprovalPolicy as k, SnapshotOptions as l, PrincipalIdentityLink as m, DecideOptions as n, PermDockOptions as o, PrincipalIdentity as p, DeriveOptions as r, RowPair as s, DecideIdsOptions as t, WhereResult as u, Limits as v, ApprovalPolicyProblem as w, PermissionCheck as x, limits as y };

package/dist/{permission-registry-Br4jSNVi.js → permission-registry-DpPtSKNZ.js}

@@ -382,4 +382,4 @@ function renamedKeys(tree) {
 	return map;
 }
 //#endregion
-export { resource as _, getResource as a, listPermissions as c, attachRegistry as d, resourceOfNode as f, formerScopes as g, formerKeys as h, getRegistry as i, mergePermissions as l, annotationsFor as m, findPermission as n, isPermission as o, walk as p, formerByKey as r, isRegistryTree as s, assertKeys as t, renamedKeys as u };
+export { keyToScope as _, getResource as a, listPermissions as c, attachRegistry as d, resourceOfNode as f, formerScopes as g, formerKeys as h, getRegistry as i, mergePermissions as l, annotationsFor as m, findPermission as n, isPermission as o, walk as p, formerByKey as r, isRegistryTree as s, assertKeys as t, renamedKeys as u, resource as v };

package/dist/{vocabulary-D6lPdb4Z.d.ts → permission-types-DhNEmoRG.d.ts}

@@ -238,68 +238,10 @@ type ActionNames<A extends ActionList | undefined> = A extends readonly string[]
 type LeavesFrom<Prefix extends string, Names extends string, T, Kind extends PermissionKind, X = never> = [Names] extends [never] ? object : { readonly [K in Names]: WithX<Permission<Prefix extends "" ? K : `${Prefix}.${K}`, T, Kind>, X>; };
 type InferResourceLeaves<R extends ResourceInit, Prefix extends string, X = never> = R extends ResourceInit<infer T, infer A, infer C> ? LeavesFrom<Prefix, ActionNames<A>, T, "instance", X> & LeavesFrom<Prefix, ActionNames<C>, T, "collection", X> : object;
 type InferPermissionTree<Input, Prefix extends string = "", X = never> = Input extends ResourceInit ? InferResourceLeaves<Input, Prefix, X> : Input extends Record<string, unknown> ? { readonly [K in keyof Input & string]: InferPermissionTree<Input[K], Prefix extends "" ? K : `${Prefix}.${K}`, X>; } : never;
-//#endregion
-//#region src/core/vocabulary.d.ts
-declare const ROLE_KIND: "role";
-declare const PLAN_KIND: "plan";
-/** `defineRoles` and `definePlans` options. */
-type VocabularyOptions<X = never> = {
-  /**
-   * A Standard Schema for every leaf's `meta.x`, validated synchronously at
-   * definition time. On a role tree it also checks the `meta.x` of custom
-   * roles a `CustomRoleSource` returns; an invalid one is dropped, not the role.
-   */
-  readonly x?: AppDataSchema<X>;
-};
 /**
- * A role's metadata. `audience` names the surface its holders use (`'staff'`,
- * `'portal'`, `'platform'`); `permdock.audiences()` lists the distinct
- * audiences of the roles held in the active scope.
+ * The tree `definePermissions(input, options)` returns, nameable for an
+ * explicit annotation under `isolatedDeclarations`.
  */
-type RoleMeta = ActionMeta & {
-  readonly audience?: string;
-};
-type Role<K extends string = string> = {
-  readonly key: K;
-  /** A declared scope name, or the `tenant` / `team` alias. */
-  readonly on?: string;
-  readonly assignable: boolean;
-  readonly meta: RoleMeta;
-  readonly kind: typeof ROLE_KIND;
-};
-type Plan<K extends string = string> = {
-  readonly key: K;
-  readonly meta: ActionMeta;
-  readonly kind: typeof PLAN_KIND;
-};
-type RoleInit = {
-  /** A declared scope name, or the `tenant` / `team` alias. */
-  readonly on?: string;
-  readonly assignable?: boolean;
-  readonly meta?: RoleMeta;
-};
-type PlanInit = {
-  readonly meta?: ActionMeta;
-};
-type RoleTree = {
-  readonly [key: string]: Role;
-};
-type PlanTree = {
-  readonly [key: string]: Plan;
-};
-type Vocabulary = {
-  readonly permissions?: unknown;
-  readonly roles?: RoleTree;
-  readonly plans?: PlanTree;
-};
-type InferRoleTree<Input, X = never> = { readonly [K in keyof Input & string]: WithX<Role<K>, X>; };
-type InferPlanTree<Input, X = never> = { readonly [K in keyof Input & string]: WithX<Plan<K>, X>; };
-declare function isRole(value: unknown): value is Role;
-declare function isPlan(value: unknown): value is Plan;
-declare function defineRoles<const Input extends Record<string, RoleInit>, X = never>(input: Input, options?: VocabularyOptions<X>): InferRoleTree<Input, X>;
-declare function definePlans<const Input extends Record<string, PlanInit>, X = never>(input: Input, options?: VocabularyOptions<X>): InferPlanTree<Input, X>;
-declare function listRoles(tree: RoleTree | undefined): readonly Role[];
-declare function listPlans(tree: PlanTree | undefined): readonly Plan[];
-declare function findRole(tree: RoleTree | undefined, key: string): Role | undefined;
+type PermissionsOf<Input, PX = never, RX = never> = InferPermissionTree<Input, "", PX> & ResourceXTree<RX>;
 //#endregion
-export { ResourceLevel as A, RESOURCE_X as B, InferPermissionTree as C, PermissionsOptions as D, PermissionTree as E, ResourceParent as F, AppDataSchema as H, ResourceRelation as I, ResourceRelationInput as L, ResourceMeta as M, ResourceNode as N, PrincipalRelation as O, ResourceOptions as P, ResourceRestricted as R, FieldRelation as S, PermissionKind as T, MetaValue as U, AppData as V, ComputedRelation as _, RoleTree as a, EdgeMatch as b, definePlans as c, isPlan as d, isRole as f, ActionMeta as g, ActionList as h, RoleMeta as i, ResourceLink as j, ResourceInit as k, defineRoles as l, listRoles as m, PlanTree as n, Vocabulary as o, listPlans as p, Role as r, VocabularyOptions as s, Plan as t, findRole as u, EdgeGroup as v, Permission as w, EdgeRelation as x, EdgeGroups as y, ResourceXTree as z };
+export { MetaValue as A, ResourceRelation as C, RESOURCE_X as D, ResourceXTree as E, AppData as O, ResourceParent as S, ResourceRestricted as T, ResourceLevel as _, EdgeGroups as a, ResourceNode as b, FieldRelation as c, PermissionKind as d, PermissionTree as f, ResourceInit as g, PrincipalRelation as h, EdgeGroup as i, WithX as j, AppDataSchema as k, InferPermissionTree as l, PermissionsOptions as m, ActionMeta as n, EdgeMatch as o, PermissionsOf as p, ComputedRelation as r, EdgeRelation as s, ActionList as t, Permission as u, ResourceLink as v, ResourceRelationInput as w, ResourceOptions as x, ResourceMeta as y };

package/dist/{permissions-oEWfl-kl.d.ts → permissions-CoqCOfJ3.d.ts}

@@ -1,4 +1,5 @@
-import { C as InferPermissionTree, k as ResourceInit, r as Role, t as Plan } from "./vocabulary-D6lPdb4Z.js";
+import { g as ResourceInit, l as InferPermissionTree } from "./permission-types-DhNEmoRG.js";
+import { r as Role, t as Plan } from "./vocabulary-Bg3eeT2H.js";
 import { StandardSchemaV1 } from "@standard-schema/spec";
 //#region src/testing/saas/permissions.d.ts
 declare const SaasProjectSchema: StandardSchemaV1<SaasProject>;

package/dist/{permissions-B-wCP5ZC.js → permissions-CyH2MV_B.js}

@@ -1,5 +1,5 @@
 import { n as freezeDeep } from "./freeze-CrU8nQeX.js";
-import { d as attachRegistry, p as walk, r as formerByKey, t as assertKeys } from "./permission-registry-Br4jSNVi.js";
+import { d as attachRegistry, p as walk, r as formerByKey, t as assertKeys } from "./permission-registry-DpPtSKNZ.js";
 import { r as assertGraphTargets } from "./resource-relations-D_jw0BFx.js";
 //#region src/core/operation-risks.ts
 /** Every `meta.risk` level, lowest first. */

package/dist/{permissions-CZKiUfFM.js → permissions-DArULThq.js}

@@ -1,7 +1,7 @@
-import { i as crud } from "./src-DLfUWFAI.js";
-import { _ as resource } from "./permission-registry-Br4jSNVi.js";
-import { f as definePlans, p as defineRoles } from "./grantee-Cn1HyUsI.js";
-import { t as definePermissions } from "./permissions-B-wCP5ZC.js";
+import { c as crud } from "./src-DLFrtrrC.js";
+import { v as resource } from "./permission-registry-DpPtSKNZ.js";
+import { f as definePlans, p as defineRoles } from "./grantee-BrRANrpT.js";
+import { t as definePermissions } from "./permissions-CyH2MV_B.js";
 //#region src/testing/saas/schema.ts
 function accepts(kind, value) {
 	switch (kind) {

package/dist/pkce-5h8NgMQJ.js

@@ -0,0 +1,21 @@
+//#region src/cloud/pkce.ts
+function base64url(bytes) {
+	let binary = "";
+	for (const byte of bytes) binary += String.fromCodePoint(byte);
+	return btoa(binary).replaceAll("+", "-").replaceAll("/", "_").replace(/=+$/u, "");
+}
+/** `length` random bytes as base64url, from Web Crypto. */
+function randomToken(length) {
+	return base64url(globalThis.crypto.getRandomValues(new Uint8Array(length)));
+}
+/** An RFC 7636 verifier of 43 characters and its `S256` challenge. */
+async function pkce() {
+	const verifier = randomToken(32);
+	const digest = await globalThis.crypto.subtle.digest("SHA-256", new TextEncoder().encode(verifier));
+	return {
+		verifier,
+		challenge: base64url(new Uint8Array(digest))
+	};
+}
+//#endregion
+export { randomToken as n, pkce as t };

package/dist/{policies-CO1oOymN.js → policies-B2lZIurj.js}

@@ -1,7 +1,7 @@
 import { a as sole } from "./compact-CAf557ZB.js";
-import { i as configError, n as CliError } from "./errors-CWTY6uih.js";
-import { i as requirePeer } from "./peer-C8swJ2GH.js";
-import { M as qualified, _ as subjectClaimJsonSql } from "./shared-CD11nBbC.js";
+import { i as configError, n as CliError } from "./errors-DpP_U6Bf.js";
+import { i as requirePeer } from "./peer-12Q5I_RH.js";
+import { D as qualified, _ as subjectClaimJsonSql } from "./shared-fMKOv8hP.js";
 //#region src/cli/pg.ts
 const CONNECT_TIMEOUT_MS = 1e4;
 const STATEMENT_TIMEOUT_MS = 6e4;

package/dist/{policy-Czo4n3Hs.d.ts → policy-B7dg_yzu.d.ts}

@@ -1,5 +1,5 @@
-import { T as Policy, ir as Subject, rr as Principal } from "./policy-types-DzwivBgR.js";
-import { c as saasPlans, l as saasRoles, s as saasPermissions } from "./permissions-oEWfl-kl.js";
+import { T as Policy, lr as Subject, sr as Principal } from "./policy-types-B-F-qAZk.js";
+import { c as saasPlans, l as saasRoles, s as saasPermissions } from "./permissions-CoqCOfJ3.js";
 //#region src/testing/saas/policy.d.ts
 /** Daily API-key quota per subject; the bucket should be per tenant too. */
 declare const SAAS_API_KEY_LIMIT = 5;

package/dist/{policy-DLZJ5gAp.js → policy-DaJy4nK4.js}

@@ -1,15 +1,15 @@
 import { t as compact } from "./compact-CAf557ZB.js";
 import { n as freezeDeep } from "./freeze-CrU8nQeX.js";
-import { c as withGrantSchema, d as assertApprovalVersions, i as completeGrant, o as flattenGrants, p as normalizeWhere, s as flattenPermissions, u as assertApprovalRelations } from "./role-builder-CXbis5-X.js";
-import { c as listPermissions, i as getRegistry, m as annotationsFor, n as findPermission, s as isRegistryTree } from "./permission-registry-Br4jSNVi.js";
+import { c as withGrantSchema, d as assertApprovalVersions, i as completeGrant, o as flattenGrants, p as normalizeWhere, s as flattenPermissions, u as assertApprovalRelations } from "./role-builder-C1VJzvcr.js";
+import { c as listPermissions, i as getRegistry, m as annotationsFor, n as findPermission, s as isRegistryTree } from "./permission-registry-DpPtSKNZ.js";
 import { d as isSelfParented, l as isFieldRelation } from "./resource-relations-D_jw0BFx.js";
-import { t as canonicalJson } from "./canonical-json-BC8_nMTw.js";
+import { t as canonicalJson } from "./canonical-json-DwilZ1iB.js";
 import { r as sha256Digest } from "./sha256-D9ihqmvd.js";
-import { n as defineScopes, o as resolveScope } from "./scopes-CUPSjo9q.js";
-import { o as flattenGrantee, r as asGrantee, v as listRoles } from "./grantee-Cn1HyUsI.js";
+import { n as defineScopes, s as resolveScope } from "./scopes-BHsc-wp-.js";
+import { o as flattenGrantee, r as asGrantee, v as listRoles } from "./grantee-BrRANrpT.js";
 import { n as normalizeValidity } from "./validity-CZ7-y0Cj.js";
-import { a as relationStart, i as relationHops, n as isGraphRelation, t as inheritCondition } from "./grantee-conditions-CcXf8hMM.js";
-import { a as memberOfFields, p as scopeField, u as relatesTo } from "./tenancy-DN2QAx9z.js";
+import { a as relationStart, i as relationHops, n as isGraphRelation, t as inheritCondition } from "./grantee-conditions-C6P1Tvol.js";
+import { a as memberOfFields, p as scopeField, u as relatesTo } from "./tenancy-CmeBQ6Nv.js";
 import { t as byCodePoint } from "./compare-pfyVnBjE.js";
 //#region src/core/policy-assertions.ts
 function assertParentGraph(resources) {
@@ -374,6 +374,15 @@ function grantList(policy) {
 function declaredRoleNames(policy) {
 	return policy.index.declaredRoles;
 }
+/**
+* Whether `value` names a role the policy declares, for a role read as a
+* string from a database or a token. A name it rejects is an unknown role,
+* which grants nothing (`unknown-role`). A tenant's custom roles are not
+* declared; `CustomRoleSource` resolves them.
+*/
+function isRoleName(policy, value) {
+	return typeof value === "string" && policy.index.declaredRoles.has(value);
+}
 function separationConflicts(policy, memberships) {
 	const exclusive = exclusivePairs(policy);
 	const seen = /* @__PURE__ */ new Set();
@@ -396,4 +405,4 @@ function separationConflicts(policy, memberships) {
 	return conflicts;
 }
 //#endregion
-export { levelCondition as a, separationConflicts as c, indexPolicy as i, policyX as l, definePolicy as n, levelNames as o, grantList as r, policyLevels as s, declaredRoleNames as t, normalizeDelegation as u };
+export { isRoleName as a, policyLevels as c, normalizeDelegation as d, indexPolicy as i, separationConflicts as l, definePolicy as n, levelCondition as o, grantList as r, levelNames as s, declaredRoleNames as t, policyX as u };