permdock 0.5.0 → 0.7.0

package/dist/{sources-BV9j0DeZ.d.ts → sources-DEEuGb8S.d.ts}

@@ -1,6 +1,7 @@
-import { et as MembershipSource } from "./policy-types-DzwivBgR.js";
-import { n as RoleThrough, y as SupabaseSuspension } from "./types-CdlxsYQh.js";
-import { o as SupabaseManifestMembership } from "./manifest-mx5ghSFM.js";
+import { et as MembershipSource } from "./policy-types-B-F-qAZk.js";
+import { b as SupabaseSuspension, n as RoleMap, r as RoleThrough } from "./types-BfVmNJO5.js";
+import { t as SqlQuery } from "./sql-CDEPCA0g.js";
+import { c as SupabaseManifestMembership } from "./manifest-BVhExYhw.js";
 //#region src/supabase/roles.d.ts
 /** A roles table a role column references, by `schema.table`. */
 type RoleKeys = {
@@ -12,15 +13,26 @@ type RoleKeys = {
   /** The referencing table's column. */
   readonly ref: string;
 };
-//#endregion
-//#region src/supabase/sources.d.ts
+/** One role source of a membership row: a key column, or a reference to a roles table. */
+type RoleSource = string | RoleThrough | RoleMap;
+/** A role source, or several the row holds at once. */
+type RoleSpec = RoleSource | readonly RoleSource[];
 /**
- * Runs one parameterised statement: `pg`'s `client.query` (which resolves
- * `{ rows }`) and `postgres`'s `sql.unsafe` (which resolves the rows) both fit.
+ * A roles table whose tenant rows are written by tenants. A role key read
+ * through it from a tenant row that is one of `declared` reads as null, so a
+ * tenant cannot claim the grants of a declared role by naming a role after it.
  */
-type SqlQuery = (text: string, values: readonly unknown[]) => Promise<readonly Record<string, unknown>[] | {
-  readonly rows: readonly Record<string, unknown>[];
-}>;
+type RoleGuard = {
+  /** `schema.table`, or `public`. */
+  readonly table: string;
+  /** The tenant column of the roles table. */
+  readonly tenant: string;
+  /** A tenant row with this column true is the application's own copy of a declared role. */
+  readonly skip?: string | undefined;
+  readonly declared: readonly string[];
+};
+//#endregion
+//#region src/supabase/sources.d.ts
 type Common = {
   readonly table: string;
   /** Runs the lookups; without it the source only describes SQL (for `permdock supabase hook generate`). */
@@ -41,7 +53,7 @@ type MembershipTableOptions = Common & {
      * The role key column, a reference to a roles table that holds the key,
      * or several of them: the row holds every non-null key.
      */
-    readonly role?: string | RoleThrough | readonly (string | RoleThrough)[];
+    readonly role?: RoleSpec;
     readonly via?: string;
     readonly expiresAt?: string;
     readonly disabledAt?: string;
@@ -73,8 +85,8 @@ type MembershipJunctionOptions = Common & {
    * roles every row holds (a contact table with no role column), or
    * `{ sources }`: several role columns whose non-null keys the row holds.
    */
-  readonly roles: string | RoleThrough | readonly string[] | {
-    readonly sources: readonly (string | RoleThrough)[];
+  readonly roles: string | RoleThrough | RoleMap | readonly string[] | {
+    readonly sources: readonly RoleSource[];
   };
   /** The membership kind every row has (`contact`, `staff`, `partner`). */
   readonly via?: string;
@@ -135,6 +147,41 @@ type MembershipSql = {
   readonly manifest: SupabaseManifestMembership;
   /** What the ownership triggers count; absent on a source that is not a table. */
   readonly holders?: MembershipHolders;
+  /** The rows as plain columns, for Sync Streams and `powerSyncSource`; a source without it does not sync. */
+  readonly stream?: MembershipStream;
+};
+/**
+ * One membership source as columns a Sync Streams query can filter on.
+ * Tables are `schema.table`; a `through` table is qualified in the source's
+ * schema when it names none.
+ */
+type MembershipStream = {
+  readonly table: string;
+  /** The user id column, or the reference to the table that holds the user id. */
+  readonly user: string | RoleThrough;
+  /** The scope column, or the scope every row is a membership of. */
+  readonly scope: {
+    readonly column: string;
+  } | {
+    readonly value: string;
+  };
+  readonly id: string;
+  /** The role sources (the row holds every non-null key), or the fixed roles every row holds. */
+  readonly roles: RoleSpec | {
+    readonly value: readonly string[];
+  };
+  /** The membership kind column, or the kind every row has. */
+  readonly via?: {
+    readonly column: string;
+  } | {
+    readonly value: string;
+  };
+  readonly expiresAt?: string;
+  readonly disabledAt?: string;
+  /** A row may hold no role key: such a row is no membership, and a reader drops it. */
+  readonly nullableRoles: boolean;
+  /** The guard the source reads its roles table with: a tenant row named like a declared role is no role. */
+  readonly guard?: RoleGuard;
 };
 /**
  * The rows of a membership table, for the holder-count and transfer-only
@@ -158,6 +205,8 @@ type MembershipHolders = {
 };
 type SqlMembershipSource = MembershipSource & {
   readonly sql: MembershipSql;
+  /** The same source with the role keys of tenant rows of `guard.table` named like a declared role read as null. */
+  readonly guarded?: (guard: RoleGuard) => SqlMembershipSource;
 };
 /** The part of `@supabase/server`'s `PostgresApi` a `SqlQuery` needs. */
 type SupabasePostgres = {
@@ -187,4 +236,4 @@ declare function authzVersion(options: {
   readonly schema?: string;
 }): NonNullable<MembershipSource["version"]>;
 //#endregion
-export { MembershipTableOptions as a, SupabasePostgres as c, supabasePostgresQuery as d, tableMembershipSource as f, MembershipSql as i, authzVersion as l, MembershipHolders as n, SqlMembershipSource as o, MembershipJunctionOptions as r, SqlQuery as s, AUTHZ_VERSION_TABLE as t, junctionMembershipSource as u };
+export { MembershipStream as a, SupabasePostgres as c, supabasePostgresQuery as d, tableMembershipSource as f, MembershipSql as i, authzVersion as l, MembershipHolders as n, MembershipTableOptions as o, MembershipJunctionOptions as r, SqlMembershipSource as s, AUTHZ_VERSION_TABLE as t, junctionMembershipSource as u };

package/dist/sources-qoIJQrJv.js

@@ -0,0 +1,11 @@
+//#region src/cli/sql/sources.ts
+/**
+* The membership sources a project reads: `rls.membershipSources`, else
+* `supabase.hook.memberships`. Every generator, doctor check and verifier
+* resolves them here, so they all read the same tables.
+*/
+function membershipSourcesOf(config) {
+	return config.rls?.membershipSources ?? config.supabase?.hook?.memberships ?? [];
+}
+//#endregion
+export { membershipSourcesOf as t };

package/dist/{sql-B5T1IL83.js → sql-B96movIM.js}

@@ -1,4 +1,8 @@
 //#region src/core/sql.ts
+/** The rows of a `SqlQuery` result, whichever of its two shapes the driver resolved. */
+function sqlRows(result) {
+	return Array.isArray(result) ? result : result.rows;
+}
 /** A bare Postgres identifier PermDock emits unquoted-safe: letters, digits and `_`, not starting with a digit. */
 const SQL_IDENT = /^[A-Za-z_][A-Za-z0-9_]*$/u;
 /** A validated, double-quoted identifier; anything outside `SQL_IDENT` throws. */
@@ -52,4 +56,4 @@ function defaultSqlCommand(action) {
 	}
 }
 //#endregion
-export { quoteQualifiedTable as a, quoteSqlTable as c, qualifySqlTable as i, sqlIdent as l, defaultSqlCommand as n, quoteSqlIdent as o, escapeSqlIdent as r, quoteSqlLiteral as s, SQL_IDENT as t, sqlTextArray as u };
+export { quoteQualifiedTable as a, quoteSqlTable as c, sqlTextArray as d, qualifySqlTable as i, sqlIdent as l, defaultSqlCommand as n, quoteSqlIdent as o, escapeSqlIdent as r, quoteSqlLiteral as s, SQL_IDENT as t, sqlRows as u };

package/dist/sql-CDEPCA0g.d.ts

@@ -0,0 +1,10 @@
+//#region src/core/sql.d.ts
+/**
+ * Runs one parameterised statement: `pg`'s `client.query` (which resolves
+ * `{ rows }`) and `postgres`'s `sql.unsafe` (which resolves the rows) both fit.
+ */
+type SqlQuery = (text: string, values: readonly unknown[]) => Promise<readonly Record<string, unknown>[] | {
+  readonly rows: readonly Record<string, unknown>[];
+}>;
+//#endregion
+export { SqlQuery as t };

package/dist/{src-DLfUWFAI.js → src-DLFrtrrC.js}

@@ -1,29 +1,29 @@
 import { n as isReadonlyArray, r as isRecord, t as compact } from "./compact-CAf557ZB.js";
 import { n as freezeDeep } from "./freeze-CrU8nQeX.js";
 import { n as isForbiddenKey, r as ownGet } from "./paths-DXSHAMIa.js";
-import { f as normalizeApproval, g as assertSqlFunctionName, h as assertSqlFunctionArg, m as assertPortableTwin, p as normalizeWhere, u as assertApprovalRelations } from "./role-builder-CXbis5-X.js";
+import { f as normalizeApproval, g as assertSqlFunctionName, h as assertSqlFunctionArg, m as assertPortableTwin, p as normalizeWhere, u as assertApprovalRelations } from "./role-builder-C1VJzvcr.js";
 import { n as PermDockDeniedError } from "./errors-BKy0EfhN.js";
 import { o as sameId } from "./expiry-D4_YKRKD.js";
 import { n as internalsOf } from "./internals-Dk8A8fX3.js";
-import { c as listPermissions, i as getRegistry, n as findPermission, o as isPermission } from "./permission-registry-Br4jSNVi.js";
+import { c as listPermissions, i as getRegistry, n as findPermission, o as isPermission } from "./permission-registry-DpPtSKNZ.js";
 import { n as isThenable$1 } from "./thenable-yD7SabqG.js";
 import { c as isEdgeRelation, m as restrictedStops, o as groupEntries, s as isComputedRelation, u as isPrincipalRelation } from "./resource-relations-D_jw0BFx.js";
 import { a as durationOf, g as secondsOf, m as rfc3339, p as nowSeconds } from "./time-DkWjdL98.js";
-import { d as scopeList, l as scopeChain, m as tenantOf, o as resolveScope, u as scopeIdOf } from "./scopes-CUPSjo9q.js";
-import { u as evaluateCondition } from "./delegation-DaXVdDhM.js";
-import { _ as listPlans, a as authenticated, m as findRole, o as flattenGrantee } from "./grantee-Cn1HyUsI.js";
-import { m as tenantsOf, r as isMembershipExpired } from "./tenancy-DN2QAx9z.js";
-import { o as levelNames, r as grantList, t as declaredRoleNames } from "./policy-DLZJ5gAp.js";
-import { r as isPortableCondition } from "./hosted-BZIAYvon.js";
-import { n as OPERATION_RISKS, r as isOperationRisk } from "./permissions-B-wCP5ZC.js";
-import { b as tenantCustomRoles, f as customRoleId, l as ceilingGrants, p as customRoleScope, v as resolveCustomRole } from "./evaluate-_R8QkWaf.js";
-import { d as rankRoles, f as usesAssigns, i as collectSnapshotGrants, n as snapshotScopes, t as snapshotOf, u as bindingOf } from "./instance-snapshot-Cxq4ygFc.js";
+import { a as normalizeMembership$1, d as scopeIdOf, f as scopeList, h as tenantOf, o as normalizeMemberships$1, s as resolveScope$1, u as scopeChain } from "./scopes-BHsc-wp-.js";
+import { u as evaluateCondition } from "./delegation-C5rOdTp5.js";
+import { _ as listPlans, a as authenticated, m as findRole, o as flattenGrantee } from "./grantee-BrRANrpT.js";
+import { m as tenantsOf, r as isMembershipExpired } from "./tenancy-CmeBQ6Nv.js";
+import { r as grantList, s as levelNames, t as declaredRoleNames } from "./policy-DaJy4nK4.js";
+import { o as isPortableCondition } from "./hosted-XBgU6RGT.js";
+import { n as OPERATION_RISKS, r as isOperationRisk } from "./permissions-CyH2MV_B.js";
+import { C as tenantCustomRoles, f as customRoleId, l as ceilingGrants, m as customRoleScope, p as customRoleOf, x as resolveCustomRole } from "./evaluate-B_oqFbWC.js";
+import { d as rankRoles, f as usesAssigns, i as collectSnapshotGrants, n as snapshotScopes, t as snapshotOf, u as bindingOf } from "./instance-snapshot-CjcwnEiV.js";
 import { n as relationId } from "./relations-BnCWnJGI.js";
-import { r as snapshotGrant, t as buildSnapshot } from "./snapshot-CXUWfsNy.js";
-import { n as LOCAL_CUSTOM_ROLE } from "./parse-local-manifest-CVSs6J9I.js";
-import { r as resolveSubject, s as APP } from "./permdock-B9JxkBwC.js";
-import { i as memoryApprovalStore } from "./store-4u_hxjWa.js";
-import { n as wrapPermDock } from "./wrap-gX61EtpB.js";
+import { r as snapshotGrant, t as buildSnapshot } from "./snapshot-CbGmYiJx.js";
+import { n as LOCAL_CUSTOM_ROLE } from "./parse-local-manifest-T1Q8X3A2.js";
+import { c as APP, r as resolveSubject } from "./permdock-BfWEeMqk.js";
+import { i as memoryApprovalStore } from "./store-DSP9oGvh.js";
+import { n as wrapPermDock } from "./wrap-CiSc_KCq.js";
 //#region src/conditions/sql-function.ts
 function sqlFunction(name, options) {
 	assertSqlFunctionName(name);
@@ -89,7 +89,12 @@ function memorySnapshotSource(initial) {
 function memoryCustomRoleSource(customRoles) {
 	const byTenant = /* @__PURE__ */ new Map();
 	const global = [];
+	const shared = [];
 	for (const role of customRoles) {
+		if (role.shared === true) {
+			shared.push(role);
+			continue;
+		}
 		if (role.tenant === void 0) {
 			global.push(role);
 			continue;
@@ -104,6 +109,9 @@ function memoryCustomRoleSource(customRoles) {
 		},
 		globalRoles() {
 			return [...global];
+		},
+		sharedRoles() {
+			return [...shared];
 		}
 	};
 }
@@ -1460,8 +1468,8 @@ function ofTenant(tenant, roles) {
 /**
 * A `CustomRoleSource` over a reader that returns every custom role of a tenant.
 * It keeps only the roles of the requested tenant. With `read: 'held'` it
-* skips a tenant's read, and `globalRoles`, when the subject holds only
-* declared roles there.
+* skips a tenant's read, and `globalRoles` and `sharedRoles`, when the
+* subject holds only declared roles there.
 */
 function customRoleSource(reader, options = {}) {
 	const declared = options.read === "held" ? declaredRoleNames(options.policy) : void 0;
@@ -1472,7 +1480,8 @@ function customRoleSource(reader, options = {}) {
 			return isThenable$1(roles) ? roles.then((list) => ofTenant(tenant, list)) : ofTenant(tenant, roles);
 		},
 		...reader.assignable === void 0 ? {} : { assignable: (tenant) => reader.assignable?.(tenant) ?? [] },
-		...reader.globalRoles === void 0 ? {} : { globalRoles: (context) => declared !== void 0 && context?.held.every((name) => declared.has(name)) === true ? [] : reader.globalRoles?.() ?? [] }
+		...reader.globalRoles === void 0 ? {} : { globalRoles: (context) => declared !== void 0 && context?.held.every((name) => declared.has(name)) === true ? [] : reader.globalRoles?.() ?? [] },
+		...reader.sharedRoles === void 0 ? {} : { sharedRoles: (context) => declared !== void 0 && context?.held.every((name) => declared.has(name)) === true ? [] : reader.sharedRoles?.() ?? [] }
 	});
 }
 //#endregion
@@ -1503,7 +1512,7 @@ function snapshotFor(policy, user, options = {}) {
 	if (isThenable$1(resolved)) throw new TypeError("PermDock: snapshotFor() needs synchronous subject and context mappers. Resolve async data first and pass it as a Subject, or use (await getPermDock(...)).snapshot().");
 	const subject = withPlans(resolved, options.plans);
 	const tenants = new Set(tenantsOf(subject.principal, scopeList(policy.scopes)));
-	const customRoles = (options.customRoles ?? []).filter((item) => item.scope === "global" || item.tenant !== void 0 && tenants.has(item.tenant));
+	const customRoles = (options.customRoles ?? []).filter((item) => item.scope === "global" || item.shared === true && tenants.size > 0 || item.tenant !== void 0 && tenants.has(item.tenant));
 	const names = options.assignable;
 	const assignable = names === void 0 ? void 0 : new Map([...tenants].map((tenant) => [tenant, Object.hasOwn(names, tenant) ? names[tenant] ?? [] : []]));
 	return snapshotOf(policy, subject, compact({
@@ -1590,12 +1599,34 @@ function writable(options) {
 	return finishPreset(WRITABLE_ACTIONS, WRITABLE_COLLECTION, options);
 }
 //#endregion
+//#region src/core/scope-helpers.ts
+/**
+* The canonical form PermDock evaluates one membership in, or `undefined`
+* when it is malformed and grants nothing. `scopes` is the policy's or the
+* catalog's scope list; absent or empty means the implicit `tenant` and
+* `team` pair.
+*/
+function normalizeMembership(input, scopes) {
+	return normalizeMembership$1(input, scopeList(scopes));
+}
+/** Every well-formed membership of `input` in canonical form; malformed entries are dropped. */
+function normalizeMemberships(input, scopes) {
+	return normalizeMemberships$1(input, scopeList(scopes));
+}
+/**
+* The declared scope `name` stands for: the name itself, or the scope the
+* `tenant` (first) or `team` (second) alias names. `undefined` otherwise.
+*/
+function resolveScope(scopes, name) {
+	return resolveScope$1(scopeList(scopes), name);
+}
+//#endregion
 //#region src/core/ownership.ts
 function coversInstance(membership, scopes, scope, id, within) {
 	if (membership.scope === void 0 || membership.id === void 0) return false;
 	if (membership.scope === scope) return sameId(membership.id, id);
 	if (!scopeChain(scopes, scope).slice(1).includes(membership.scope)) return false;
-	const wanted = within === void 0 ? void 0 : Object.entries(within).find(([key]) => resolveScope(scopes, key) === membership.scope)?.[1] ?? void 0;
+	const wanted = within === void 0 ? void 0 : Object.entries(within).find(([key]) => resolveScope$1(scopes, key) === membership.scope)?.[1] ?? void 0;
 	return wanted !== void 0 && scopeIdOf(membership, membership.scope) === wanted;
 }
 /** Roles the principal holds at the instance, at an ancestor named in `within`, or globally. */
@@ -1630,12 +1661,13 @@ function conflictsWith(policy, role) {
 	return out;
 }
 /** What the change does to the instance's holder count. */
-function countRules(binding, role, holders, delta, deny) {
-	if (binding === void 0 || delta === 0) return;
-	const min = binding.min ?? 0;
-	if (!(min > 0 || binding.max !== void 0 || binding.transferOnly === true)) return;
+function countRules(rules, holders, delta, deny) {
+	const role = rules.key;
+	if (delta === 0) return;
+	const min = rules.min ?? 0;
+	if (!(min > 0 || rules.max !== void 0 || rules.transferOnly === true)) return;
 	if (!(holders !== void 0 && Number.isInteger(holders) && holders >= 0)) {
-		deny(delta < 0 && min > 0 ? "last-holder" : delta > 0 && binding.max !== void 0 ? "max-holders" : "transfer-only", {
+		deny(delta < 0 && min > 0 ? "last-holder" : delta > 0 && rules.max !== void 0 ? "max-holders" : "transfer-only", {
 			role,
 			holders: null
 		});
@@ -1647,17 +1679,85 @@ function countRules(binding, role, holders, delta, deny) {
 		min,
 		holders
 	});
-	if (delta > 0 && binding.max !== void 0 && after > binding.max) deny("max-holders", {
+	if (delta > 0 && rules.max !== void 0 && after > rules.max) deny("max-holders", {
 		role,
-		max: binding.max,
+		max: rules.max,
 		holders
 	});
-	if (binding.transferOnly === true && holders > 0 && after > 0) deny("transfer-only", {
+	if (rules.transferOnly === true && holders > 0 && after > 0) deny("transfer-only", {
 		role,
 		holders
 	});
 }
 /**
+* The rules of a role change that need no subject: `assigns`, `for`,
+* `exclusiveWith`, `min`, `max` and `transferOnly`, from holder counts and
+* the target's roles alone. `decideRoleChange` runs the same function after
+* its actor, tenant and ceiling checks; a service that holds only the
+* catalog calls it with the `CatalogRole` entries.
+*/
+function checkRoleChange(role, input) {
+	const name = role.key;
+	const denials = [];
+	const deny = (reason, detail) => {
+		denials.push(compact({
+			role: name,
+			reason,
+			detail
+		}));
+	};
+	const kind = input.change?.kind;
+	const target = input.change?.target;
+	if (kind !== "assign" && kind !== "revoke" && kind !== "transfer" || target === null || typeof target !== "object") {
+		deny("validation");
+		return freezeDeep({
+			ok: false,
+			denials
+		});
+	}
+	const roles = input.roles ?? [];
+	const targetRoles = isReadonlyArray(target.roles) ? target.roles : [];
+	const already = targetRoles.includes(name);
+	let by = null;
+	if (kind !== "transfer" && input.actorRoles !== void 0 && roles.some((rules) => rules.assigns !== void 0)) {
+		const held = input.actorRoles;
+		by = held.find((actorRole) => roles.find((rules) => rules.key === actorRole)?.assigns?.includes(name) === true) ?? null;
+		if (by === null) deny("not-assignable-by", { held });
+	}
+	if (kind !== "revoke" && !already) {
+		const kinds = role.for;
+		if (kinds !== void 0 && (target.via === void 0 || !kinds.includes(target.via))) deny("not-allowed-for-membership", {
+			via: target.via ?? null,
+			for: kinds
+		});
+		const conflicts = new Set(role.exclusiveWith ?? []);
+		for (const rules of roles) if (rules.exclusiveWith?.includes(name) === true) conflicts.add(rules.key);
+		const clash = targetRoles.filter((held) => conflicts.has(held));
+		if (clash.length > 0) deny("conflicting-role", { with: clash });
+	}
+	const delta = kind === "assign" ? already ? 0 : 1 : kind === "revoke" ? targetRoles.length > 0 && !already ? 0 : -1 : already ? -1 : 0;
+	countRules(role, input.holders, delta, deny);
+	return freezeDeep(denials.length === 0 ? {
+		ok: true,
+		by
+	} : {
+		ok: false,
+		denials
+	});
+}
+/** A declared binding's rules, by the name `checkRoleChange` reads. */
+function rulesOf(binding) {
+	return compact({
+		key: binding.name,
+		min: binding.min,
+		max: binding.max,
+		transferOnly: binding.transferOnly,
+		assigns: binding.assigns,
+		for: binding.for,
+		exclusiveWith: binding.exclusiveWith
+	});
+}
+/**
 * A live membership of the principal on the instance or on an instance under
 * it: the one in-band fact that ties a nested instance to a tenant.
 */
@@ -1736,10 +1836,10 @@ function decideRoleChangeWith(policy, principal, scopes, change, customRoles, au
 		deny("unknown-role");
 		return done(null);
 	}
-	const scope = global ? "global" : resolveScope(scopes, change.scope);
+	const scope = global ? "global" : resolveScope$1(scopes, change.scope);
 	const customAt = named.map((role) => customRoleScope(role, scopes));
 	const on = declared ? binding?.on ?? findRole(policy.vocabulary?.roles, name)?.on : customAt.includes(scope) ? scope : customAt[0];
-	const heldAt = typeof on === "string" ? resolveScope(scopes, on) : global ? "global" : void 0;
+	const heldAt = typeof on === "string" ? resolveScope$1(scopes, on) : global ? "global" : void 0;
 	if (scope === void 0 || heldAt === void 0 || heldAt !== scope) {
 		deny("scope", { expected: heldAt ?? null });
 		return done(null);
@@ -1749,7 +1849,7 @@ function decideRoleChangeWith(policy, principal, scopes, change, customRoles, au
 	let custom;
 	if (!global) {
 		const root = scopes[0]?.name;
-		const supplied = change.within === void 0 ? void 0 : Object.entries(change.within).find(([key]) => resolveScope(scopes, key) === root)?.[1];
+		const supplied = change.within === void 0 ? void 0 : Object.entries(change.within).find(([key]) => resolveScope$1(scopes, key) === root)?.[1];
 		if (scope === root) tenant = id;
 		else {
 			const anchor = heldAnchor(principal, scopes, scope, id, now);
@@ -1767,7 +1867,7 @@ function decideRoleChangeWith(policy, principal, scopes, change, customRoles, au
 			return done(null);
 		}
 		const found = tenant;
-		custom = named.find((role) => sameId(role.tenant, found) && customRoleScope(role, scopes) === scope && sameId(customRoleId(role) ?? id, id));
+		custom = named.find((role) => customRoleOf(role, found) && customRoleScope(role, scopes) === scope && sameId(customRoleId(role) ?? id, id));
 	}
 	if (!declared && custom === void 0) {
 		deny("unknown-role");
@@ -1778,9 +1878,8 @@ function decideRoleChangeWith(policy, principal, scopes, change, customRoles, au
 		return done(null);
 	}
 	const self = target.id === principal.id;
-	const targetRoles = isReadonlyArray(target.roles) ? target.roles : [];
-	const already = targetRoles.includes(name);
 	let by = null;
+	let actorRoles;
 	if (kind === "transfer") {
 		if (self) deny("self-demotion");
 		if (global ? (principal.roles ?? []).includes(name) : holdsAt(principal, name, scope, id, now)) by = name;
@@ -1790,24 +1889,26 @@ function decideRoleChangeWith(policy, principal, scopes, change, customRoles, au
 		const allowed = authority(tenant);
 		const revocable = kind === "revoke" && custom !== void 0 && allowed.inert?.has(name);
 		if (!allowed.assignable.has(name) && revocable !== true) deny("not-assignable-by");
-		else if (custom === void 0 && usesAssigns(policy) && !allowed.manage) {
-			const held = global ? rankRoles(policy, (principal.roles ?? []).filter((role) => declaredRoleNames(policy).has(role))) : rolesAtInstance(policy, principal, scopes, scope, id, within, now);
-			by = held.find((role) => bindingOf(policy, role)?.assigns?.includes(name) === true) ?? null;
-			if (by === null) deny("not-assignable-by", { held });
-		}
+		else if (custom === void 0 && usesAssigns(policy) && !allowed.manage) actorRoles = global ? rankRoles(policy, (principal.roles ?? []).filter((role) => declaredRoleNames(policy).has(role))) : rolesAtInstance(policy, principal, scopes, scope, id, within, now);
 	}
-	if (kind !== "revoke" && !already) {
-		const kinds = custom === void 0 ? binding?.for : customForKinds(policy, custom);
-		if (kinds !== void 0 && (target.via === void 0 || !kinds.includes(target.via))) deny("not-allowed-for-membership", {
-			via: target.via ?? null,
-			for: kinds
-		});
-		const conflicts = custom === void 0 ? conflictsWith(policy, name) : new Set(includedRoles(custom).flatMap((include) => Array.from(conflictsWith(policy, include))));
-		const clash = targetRoles.filter((role) => conflicts.has(role));
-		if (clash.length > 0) deny("conflicting-role", { with: clash });
-	}
-	const delta = kind === "assign" ? already ? 0 : 1 : kind === "revoke" ? targetRoles.length > 0 && !already ? 0 : -1 : already ? -1 : 0;
-	countRules(binding, name, change.holders, delta, deny);
+	const conflicts = custom === void 0 ? conflictsWith(policy, name) : new Set(includedRoles(custom).flatMap((include) => Array.from(conflictsWith(policy, include))));
+	const checked = checkRoleChange(compact({
+		...binding === void 0 ? {} : rulesOf(binding),
+		key: name,
+		for: custom === void 0 ? binding?.for : customForKinds(policy, custom),
+		exclusiveWith: [...conflicts],
+		assigns: void 0
+	}), compact({
+		change: {
+			kind,
+			target
+		},
+		holders: change.holders,
+		roles: actorRoles === void 0 ? void 0 : policy.roles.map(rulesOf),
+		actorRoles
+	}));
+	if (checked.ok) by = actorRoles === void 0 ? by : checked.by;
+	else denials.push(...checked.denials);
 	return done(by);
 }
 //#endregion
@@ -1848,4 +1949,4 @@ function toCsvRow(event) {
 	].map(field).join(",");
 }
 //#endregion
-export { memorySnapshotSource as A, validateApprovalPolicy as C, memoryEntitlementSource as D, memoryCustomRoleSource as E, memoryMembershipSource as O, memoryApprovalPolicySource as S, isOperationEffect as T, limits as _, readable as a, approvalPolicies as b, customRoleSource as c, defineApp as d, localSnapshotManifest as f, memoryRelationSource as g, signPolicyDocument as h, crud as i, sqlFunction as j, memorySettingsSource as k, mayAccess as l, simulateArazzo as m, toCsvRow as n, writable as o, arazzoFindings as p, decideRoleChange as r, snapshotFor as s, CSV_COLUMNS as t, shadowMode as u, memoryLimitStore as v, defineOperations as w, approvalPoliciesFor as x, stripeEntitlementSource as y };
+export { memoryCustomRoleSource as A, stripeEntitlementSource as C, validateApprovalPolicy as D, memoryApprovalPolicySource as E, sqlFunction as F, memoryMembershipSource as M, memorySettingsSource as N, defineOperations as O, memorySnapshotSource as P, memoryLimitStore as S, approvalPoliciesFor as T, arazzoFindings as _, normalizeMembership as a, memoryRelationSource as b, crud as c, snapshotFor as d, customRoleSource as f, localSnapshotManifest as g, defineApp as h, decideRoleChange as i, memoryEntitlementSource as j, isOperationEffect as k, readable as l, shadowMode as m, toCsvRow as n, normalizeMemberships as o, mayAccess as p, checkRoleChange as r, resolveScope as s, CSV_COLUMNS as t, writable as u, simulateArazzo as v, approvalPolicies as w, limits as x, signPolicyDocument as y };

package/dist/ssf/index.d.ts

@@ -1,4 +1,4 @@
-import { A as SsfSubject, C as SsfEventName, D as SsfReceiver, E as SsfPermDockOptions, M as SsfTransmitterConfiguration, N as SsfVerification, O as SsfStreamConfiguration, S as SsfEventListener, T as SsfPermDock, _ as SetSubject, a as PollHandle, b as SsfEventHandler, c as PushSetOptions, d as SetDelivery, f as SetDeliveryFailureCause, g as SetQueue, h as SetPollHandlerOptions, i as CaepReason, j as SsfSubjectResolver, k as SsfStreamStatus, l as ReplayStore, m as SetEvent, n as CaepEventName, o as PollOptions, p as SetError, r as CaepInitiatingEntity, s as PollResult, t as CaepCommon, u as RiscEventName, v as SignSetOptions, w as SsfOnEvent, x as SsfEventInput, y as SsfAuditEvent } from "../types-DiQjupG2.js";
-import { t as memoryReplayStore } from "../replay-D7iKcLFe.js";
-import { _ as setPollHandler, a as CaepTokenClaimsChange, c as RiscEvents, d as caepEvents, f as pushSet, g as memorySetQueue, h as streamVerificationEvent, i as CaepEvents, l as SSF_POLL_DELIVERY, m as signSet, n as CaepCredentialChange, o as RiscAccountDisabled, p as riscEvents, r as CaepDeviceComplianceChange, s as RiscCredentialCompromise, t as CaepAssuranceLevelChange, u as SSF_PUSH_DELIVERY, v as createPermDock } from "../index-D8EovfsP.js";
-export { type CaepAssuranceLevelChange, type CaepCommon, type CaepCredentialChange, type CaepDeviceComplianceChange, type CaepEventName, type CaepEvents, type CaepInitiatingEntity, type CaepReason, type CaepTokenClaimsChange, type PollHandle, type PollOptions, type PollResult, type PushSetOptions, type ReplayStore, type RiscAccountDisabled, type RiscCredentialCompromise, type RiscEventName, type RiscEvents, SSF_POLL_DELIVERY, SSF_PUSH_DELIVERY, type SetDelivery, type SetDeliveryFailureCause, type SetError, type SetEvent, type SetPollHandlerOptions, type SetQueue, type SetSubject, type SignSetOptions, type SsfAuditEvent, type SsfEventHandler, type SsfEventInput, type SsfEventListener, type SsfEventName, type SsfOnEvent, type SsfPermDock, type SsfPermDockOptions, type SsfReceiver, type SsfStreamConfiguration, type SsfStreamStatus, type SsfSubject, type SsfSubjectResolver, type SsfTransmitterConfiguration, type SsfVerification, caepEvents, createPermDock, memoryReplayStore, memorySetQueue, pushSet, riscEvents, setPollHandler, signSet, streamVerificationEvent };
+import { A as SsfSubject, C as SsfEventName, D as SsfReceiver, E as SsfPermDockOptions, M as SsfTransmitterConfiguration, N as SsfVerification, O as SsfStreamConfiguration, S as SsfEventListener, T as SsfPermDock, _ as SetSubject, a as PollHandle, b as SsfEventHandler, c as PushSetOptions, d as SetDelivery, f as SetDeliveryFailureCause, g as SetQueue, h as SetPollHandlerOptions, i as CaepReason, j as SsfSubjectResolver, k as SsfStreamStatus, l as ReplayStore, m as SetEvent, n as CaepEventName, o as PollOptions, p as SetError, r as CaepInitiatingEntity, s as PollResult, t as CaepCommon, u as RiscEventName, v as SignSetOptions, w as SsfOnEvent, x as SsfEventInput, y as SsfAuditEvent } from "../types-cTos-H7p.js";
+import { t as memoryReplayStore } from "../replay-DCDD_ZfL.js";
+import { A as createPermDock, C as memorySsfStreamStore, D as PollSetsResult, E as PollSetsOptions, O as PolledSet, S as SsfStreamStore, T as setPollHandler, _ as SsfFanOut, a as CaepTokenClaimsChange, b as ssfTransmitter, c as RiscEvents, d as caepEvents, f as pushSet, g as FanOutSetOptions, h as streamVerificationEvent, i as CaepEvents, k as pollSets, l as SSF_POLL_DELIVERY, m as signSet, n as CaepCredentialChange, o as RiscAccountDisabled, p as riscEvents, r as CaepDeviceComplianceChange, s as RiscCredentialCompromise, t as CaepAssuranceLevelChange, u as SSF_PUSH_DELIVERY, v as SsfTransmitterOptions, w as memorySetQueue, x as SsfStream, y as fanOutSet } from "../index-CMiPH2Tv.js";
+export { type CaepAssuranceLevelChange, type CaepCommon, type CaepCredentialChange, type CaepDeviceComplianceChange, type CaepEventName, type CaepEvents, type CaepInitiatingEntity, type CaepReason, type CaepTokenClaimsChange, type FanOutSetOptions, type PollHandle, type PollOptions, type PollResult, type PollSetsOptions, type PollSetsResult, type PolledSet, type PushSetOptions, type ReplayStore, type RiscAccountDisabled, type RiscCredentialCompromise, type RiscEventName, type RiscEvents, SSF_POLL_DELIVERY, SSF_PUSH_DELIVERY, type SetDelivery, type SetDeliveryFailureCause, type SetError, type SetEvent, type SetPollHandlerOptions, type SetQueue, type SetSubject, type SignSetOptions, type SsfAuditEvent, type SsfEventHandler, type SsfEventInput, type SsfEventListener, type SsfEventName, type SsfFanOut, type SsfOnEvent, type SsfPermDock, type SsfPermDockOptions, type SsfReceiver, type SsfStream, type SsfStreamConfiguration, type SsfStreamStatus, type SsfStreamStore, type SsfSubject, type SsfSubjectResolver, type SsfTransmitterConfiguration, type SsfTransmitterOptions, type SsfVerification, caepEvents, createPermDock, fanOutSet, memoryReplayStore, memorySetQueue, memorySsfStreamStore, pollSets, pushSet, riscEvents, setPollHandler, signSet, ssfTransmitter, streamVerificationEvent };