permdock 0.5.0 → 0.7.0

package/dist/better-supabase/index.d.ts

@@ -1,10 +1,11 @@
-import { Rt as Instant, St as ApiKeyPrincipal, T as Policy, U as CredentialVerifier, gt as SupportSession, ir as Subject, pn as ApproverInput, qt as AuthEvent, rr as Principal } from "../policy-types-DzwivBgR.js";
-import { E as PermissionTree, w as Permission } from "../vocabulary-D6lPdb4Z.js";
-import { d as PrincipalIdentity, i as PermDockOptions, p as PrincipalSource, r as PermDock } from "../permdock-D7eeLJER.js";
-import { c as AccessReviewStore } from "../types-_sHy8BQf.js";
-import { i as SupabaseRpcCaller } from "../postgrest-NUqZT-RB.js";
-import { g as SupabaseSubjectOptions, m as SupabaseSessionLike, u as SupabasePrincipal } from "../types-CdlxsYQh.js";
-import { c as LinkPolicy, o as CapabilityPrincipal, t as Capability } from "../capability-BSslw1QV.js";
+import { Rt as Instant, St as ApiKeyPrincipal, T as Policy, U as CredentialVerifier, Zt as AuthEvent, _n as ApproverInput, gt as SupportSession, lr as Subject, sr as Principal } from "../policy-types-B-F-qAZk.js";
+import { f as PermissionTree, u as Permission } from "../permission-types-DhNEmoRG.js";
+import { a as PermDock, h as PrincipalSource, o as PermDockOptions, p as PrincipalIdentity } from "../permdock-Dco6dyCK.js";
+import { c as AccessReviewStore } from "../types-CfiKC5aN.js";
+import { i as SupabaseRpcCaller } from "../postgrest-CYacM_u7.js";
+import { a as CatalogDocument } from "../types-BXMYB7BY.js";
+import { _ as SupabaseSubjectOptions, d as SupabasePrincipal, h as SupabaseSessionLike } from "../types-BfVmNJO5.js";
+import { c as LinkPolicy, o as CapabilityPrincipal, t as Capability } from "../capability-D4UC9TTW.js";
 import { AuthorizationProvider } from "better-supabase/config";
 import { AuthSession, AuthorizationHooks, Authorizer, SupportAuthorize, SupportAuthorizeInput } from "better-supabase/server";
 import { EntitlementClaimOptions } from "better-supabase/blocks/entitlements";
@@ -460,6 +461,32 @@ type ToolPolicy<C> = {
  */
 export declare function toolPolicy<C>(options: ToolPolicyOptions<C>): ToolPolicy<C>;
 //#endregion
+//#region src/better-supabase/memberships.d.ts
+/** A row of the better-supabase `memberships` table (organizations block), as `select user_id, organization_id, role, disabled_at` returns it. */
+type BetterSupabaseMembershipRow = {
+  readonly user_id: string;
+  readonly organization_id: string;
+  readonly role: string;
+  readonly disabled_at?: string | null;
+};
+type PrincipalFromMembershipsOptions = {
+  /** The policy scope an `organization_id` is an instance of; defaults to `tenant`, the first declared scope. */
+  readonly scope?: string;
+  /**
+   * The organization the request acts in, the principal's active tenant. A
+   * scoped grant applies only there; without it, pick one per request with
+   * `permdock.tenant(id)`, or every scoped check denies with `no-tenant`.
+   */
+  readonly tenant?: string;
+};
+/**
+ * The principal `userId` is in the better-supabase organizations block: one
+ * membership per organization, keyed on `organization_id`, holding the role
+ * of each of the user's rows. Rows of another user, disabled rows and
+ * malformed rows are dropped, so a user with none holds no membership.
+ */
+export declare function principalFromMemberships(userId: string, rows: readonly BetterSupabaseMembershipRow[], options?: PrincipalFromMembershipsOptions): Principal;
+//#endregion
 //#region src/better-supabase/principals.d.ts
 /**
  * Where an identity link points: an app user, whose claims `principal`
@@ -497,6 +524,21 @@ type PrincipalSourceOptions = {
  */
 export declare function principalSource(options: PrincipalSourceOptions): PrincipalSource;
 //#endregion
+//#region src/better-supabase/role-order.d.ts
+type RoleOrderOptions = {
+  /** Keep only roles declared `on` this scope, such as the scope SSO assigns memberships in. */
+  readonly scope?: string;
+  /** The owner role, left out because better-supabase's `roleOrder` must not list it. */
+  readonly owner?: string;
+};
+/**
+ * The catalog's role keys highest first, for better-supabase's
+ * `blocks.sso.options.roleOrder`: a role that `assigns` another comes before
+ * it, and roles the `assigns` lists do not order keep catalog order. Roles that
+ * assign each other stay together in catalog order, at the first one's place.
+ */
+export declare function roleOrderFromCatalog(catalog: CatalogDocument, options?: RoleOrderOptions): readonly string[];
+//#endregion
 //#region src/better-supabase/share-links.d.ts
 /** The fields of better-supabase's `ResolvedShareLink` a link subject is built from. */
 type ShareLinkRow = {
@@ -572,4 +614,4 @@ export declare function hookCan(permdock: PermDock): NonNullable<AuthorizeHookOp
  */
 export declare function handlerCan(source: HandlerPermDockSource): ProtectWebHandlerOptions["can"];
 //#endregion
-export type { AccessPolicyOptions, AccessReviewApplierOptions, AccessReviewApplyFailure, AccessReviewApplyResult, ApiKeySession, ApiKeySessionOptions, ApiKeyVerifierOptions, AuthorizationHooksOptions, AuthorizationProviderOptions, AuthorizerOperation, AuthorizerOptions, BetterSupabaseIdentityLink, BetterSupabaseSubjectOptions, BucketAccess, CredentialGuardOptions, HandlerPermDockSource, McpToolDecision, McpToolRef, PendingSupportSession, PrincipalSourceOptions, ProviderApprovers, ServiceRoles, ShareLinkResolver, ShareLinkRow, ShareLinkSubjectOptions, ShareLinkTarget, SubscriberPolicyEvent, SubscriberPolicyOptions, SupabasePrincipal, SupportPolicyOptions, ToolPolicy, ToolPolicyOptions, TopicAccess };
+export type { AccessPolicyOptions, AccessReviewApplierOptions, AccessReviewApplyFailure, AccessReviewApplyResult, ApiKeySession, ApiKeySessionOptions, ApiKeyVerifierOptions, AuthorizationHooksOptions, AuthorizationProviderOptions, AuthorizerOperation, AuthorizerOptions, BetterSupabaseIdentityLink, BetterSupabaseMembershipRow, BetterSupabaseSubjectOptions, BucketAccess, CredentialGuardOptions, HandlerPermDockSource, McpToolDecision, McpToolRef, PendingSupportSession, PrincipalFromMembershipsOptions, PrincipalSourceOptions, ProviderApprovers, RoleOrderOptions, ServiceRoles, ShareLinkResolver, ShareLinkRow, ShareLinkSubjectOptions, ShareLinkTarget, SubscriberPolicyEvent, SubscriberPolicyOptions, SupabasePrincipal, SupportPolicyOptions, ToolPolicy, ToolPolicyOptions, TopicAccess };

package/dist/better-supabase/index.js

@@ -1,29 +1,28 @@
 import { r as isRecord, t as compact } from "../compact-CAf557ZB.js";
 import { n as freezeDeep } from "../freeze-CrU8nQeX.js";
-import { l as asApprover } from "../role-builder-CXbis5-X.js";
+import { l as asApprover } from "../role-builder-C1VJzvcr.js";
 import { a as holder, i as flattenApprovers, r as approverLeaves } from "../approvers-CqPOLD-o.js";
 import { t as loadPrincipal } from "../principal-source-pHneukrx.js";
 import { a as isId, r as idList } from "../expiry-D4_YKRKD.js";
-import { c as listPermissions, n as findPermission, o as isPermission } from "../permission-registry-Br4jSNVi.js";
+import { c as listPermissions, n as findPermission, o as isPermission } from "../permission-registry-DpPtSKNZ.js";
 import { i as dateAt, m as rfc3339, p as nowSeconds, u as isoAt } from "../time-DkWjdL98.js";
-import { t as canonicalJson } from "../canonical-json-BC8_nMTw.js";
+import { t as canonicalJson } from "../canonical-json-DwilZ1iB.js";
 import { r as sha256Digest } from "../sha256-D9ihqmvd.js";
-import { t as decideSupportSession } from "../support-session-C6xJQYut.js";
-import { d as scopeList } from "../scopes-CUPSjo9q.js";
-import { o as flattenGrantee } from "../grantee-Cn1HyUsI.js";
-import { t as byCodePoint } from "../compare-pfyVnBjE.js";
-import { o as scopesReaching, t as getPermDock } from "../permdock-B9JxkBwC.js";
+import { t as decideSupportSession } from "../support-session-Cna49-3f.js";
+import { f as scopeList } from "../scopes-BHsc-wp-.js";
+import { o as flattenGrantee } from "../grantee-BrRANrpT.js";
+import { a as delegatedScopeMap, s as scopesReaching, t as getPermDock } from "../permdock-BfWEeMqk.js";
 import { t as anonymousSubject } from "../subject-BGoM5o8B.js";
-import { i as linkPolicyViolation, n as capabilityOf, r as capabilitySubject } from "../capability-N1K9IpqS.js";
-import { r as credentialSubject, s as parseCredential } from "../credential-DM2um3ha.js";
+import { i as linkPolicyViolation, n as capabilityOf, r as capabilitySubject } from "../capability-L7NnfhiE.js";
+import { r as credentialSubject, s as parseCredential } from "../credential-CIM7wHwA.js";
 import { t as AccessReviewError } from "../errors-BDUwg2qC.js";
 import { t as policyRowConditionKeys } from "../row-conditions-h2HythXQ.js";
-import { n as subscribersFor } from "../audience-Dg8XsRaO.js";
-import { l as sqlIdent, s as quoteSqlLiteral } from "../sql-B5T1IL83.js";
-import "../sources-vs5dGOsS.js";
-import { c as subjectFromSupabaseSession, t as callRpc } from "../postgrest-CW0IqC-U.js";
-import { t as parseSupabaseManifest } from "../manifest-C8IzW3Do.js";
-import { t as parseCatalog } from "../parse-Cxq0WxrA.js";
+import { n as subscribersFor } from "../audience-BrMs8c4o.js";
+import { l as sqlIdent, s as quoteSqlLiteral } from "../sql-B96movIM.js";
+import "../sources-B-zYB4GS.js";
+import { c as subjectFromSupabaseSession, t as callRpc } from "../postgrest-r5faDIzD.js";
+import { n as parseSupabaseManifest, t as hasTokenHook } from "../manifest-B79YuF2T.js";
+import { t as parseCatalog } from "../parse-Ddhz2xf4.js";
 import { AsyncResult, dbError } from "better-supabase";
 //#region src/better-supabase/access-reviews.ts
 const NOT_MEMBER = "ORGANIZATION_NOT_MEMBER";
@@ -907,21 +906,9 @@ function operationsOf(catalog) {
 	}
 	return operations;
 }
-/**
-* better-supabase's `delegation.scopes`: each permission's own scope, and
-* each coarse scope the catalog's `oauthScopes` lists, to the permission keys
-* it reaches, sorted by code point. A key the catalog does not list is
-* dropped, so a stale `oauthScopes` entry grants nothing.
-*/
+/** better-supabase's `delegation.scopes`, the same map `rls.tokenScopes` compiles. */
 function delegatedScopes(catalog) {
-	const delegated = {};
-	const known = /* @__PURE__ */ new Set();
-	for (const permission of catalog?.permissions ?? []) {
-		known.add(permission.key);
-		(delegated[permission.scope] ??= /* @__PURE__ */ new Set()).add(permission.key);
-	}
-	for (const entry of catalog?.oauthScopes ?? []) for (const key of entry.permissions) if (known.has(key)) (delegated[entry.scope] ??= /* @__PURE__ */ new Set()).add(key);
-	return Object.fromEntries(Object.keys(delegated).toSorted(byCodePoint).map((scope) => [scope, [...delegated[scope] ?? []].toSorted(byCodePoint)]));
+	return delegatedScopeMap(catalog?.permissions ?? [], catalog?.oauthScopes);
 }
 /**
 * better-supabase's `authorization` config value, built from PermDock's
@@ -1070,7 +1057,7 @@ function authorizationProvider(options) {
 		...Object.keys(operations).length > 0 ? { operations } : {},
 		...Object.keys(delegated).length > 0 ? { delegation: { scopes: delegated } } : {},
 		decidingColumns: manifest.decidingColumns,
-		tokenHook: tokenHookOf(manifest),
+		...hasTokenHook(manifest) ? { tokenHook: tokenHookOf(manifest) } : {},
 		...problems.length > 0 ? { problems } : {}
 	});
 }
@@ -1339,6 +1326,40 @@ function toolPolicy(options) {
 	});
 }
 //#endregion
+//#region src/better-supabase/memberships.ts
+function isLiveRow(row, userId) {
+	return isRecord(row) && row["user_id"] === userId && typeof row["organization_id"] === "string" && row["organization_id"] !== "" && typeof row["role"] === "string" && row["role"] !== "" && (row["disabled_at"] === void 0 || row["disabled_at"] === null);
+}
+/**
+* The principal `userId` is in the better-supabase organizations block: one
+* membership per organization, keyed on `organization_id`, holding the role
+* of each of the user's rows. Rows of another user, disabled rows and
+* malformed rows are dropped, so a user with none holds no membership.
+*/
+function principalFromMemberships(userId, rows, options = {}) {
+	const scope = options.scope ?? "tenant";
+	const roles = /* @__PURE__ */ new Map();
+	for (const row of rows) {
+		if (!isLiveRow(row, userId)) continue;
+		const held = roles.get(row.organization_id) ?? [];
+		if (!held.includes(row.role)) held.push(row.role);
+		roles.set(row.organization_id, held);
+	}
+	const memberships = [...roles].map(([id, names]) => ({
+		scope,
+		id,
+		roles: names
+	}));
+	return freezeDeep(options.tenant === void 0 ? {
+		id: userId,
+		memberships
+	} : {
+		id: userId,
+		memberships,
+		tenant: options.tenant
+	});
+}
+//#endregion
 //#region src/better-supabase/principals.ts
 /**
 * A `PrincipalSource` over better-supabase: `principal(id)` maps the claims
@@ -1369,6 +1390,47 @@ function principalSource(options) {
 	});
 }
 //#endregion
+//#region src/better-supabase/role-order.ts
+/**
+* The catalog's role keys highest first, for better-supabase's
+* `blocks.sso.options.roleOrder`: a role that `assigns` another comes before
+* it, and roles the `assigns` lists do not order keep catalog order. Roles that
+* assign each other stay together in catalog order, at the first one's place.
+*/
+function roleOrderFromCatalog(catalog, options = {}) {
+	const roles = (catalog.roles ?? []).filter((role) => role.key !== options.owner && (options.scope === void 0 || role.on === options.scope));
+	const keys = roles.map((role) => role.key);
+	const assigns = new Map(roles.map((role) => [role.key, (role.assigns ?? []).filter((target) => target !== role.key && keys.includes(target))]));
+	const reach = new Map(keys.map((key) => [key, reachable(key, assigns)]));
+	const group = new Map(keys.map((key) => [key, keys.find((other) => other === key || reach.get(key)?.has(other) === true && reach.get(other)?.has(key) === true) ?? key]));
+	const remaining = new Set(keys);
+	const order = [];
+	while (remaining.size > 0) {
+		const ready = [...remaining].find((key) => {
+			const own = group.get(key);
+			return [...remaining].every((by) => group.get(by) === own || ![...remaining].some((target) => group.get(target) === own && (assigns.get(by) ?? []).includes(target)));
+		});
+		const own = group.get(ready ?? [...remaining][0] ?? "");
+		for (const key of keys) if (remaining.has(key) && group.get(key) === own) {
+			order.push(key);
+			remaining.delete(key);
+		}
+	}
+	return Object.freeze(order);
+}
+function reachable(from, assigns) {
+	const seen = /* @__PURE__ */ new Set();
+	const stack = [...assigns.get(from) ?? []];
+	while (stack.length > 0) {
+		const key = stack.pop();
+		if (key !== void 0 && !seen.has(key)) {
+			seen.add(key);
+			stack.push(...assigns.get(key) ?? []);
+		}
+	}
+	return seen;
+}
+//#endregion
 //#region src/better-supabase/share-links.ts
 const DEFAULT_TTL = 300;
 const MAX_TTL = 3600;
@@ -1488,4 +1550,4 @@ function handlerCan(source) {
 	};
 }
 //#endregion
-export { accessReviewApplier, apiKeyClaimOptions, apiKeyVerifier, authorizationHooks, authorizationProvider, authorizer, bucketPolicy, credentialGuard, handlerCan, hookCan, principalSource, subjectFromBetterSupabase, subjectFromShareLink, subscriberPolicy, supportPolicy, toolPolicy, topicPolicy };
+export { accessReviewApplier, apiKeyClaimOptions, apiKeyVerifier, authorizationHooks, authorizationProvider, authorizer, bucketPolicy, credentialGuard, handlerCan, hookCan, principalFromMemberships, principalSource, roleOrderFromCatalog, subjectFromBetterSupabase, subjectFromShareLink, subscriberPolicy, supportPolicy, toolPolicy, topicPolicy };

package/dist/{bind-CZzhx-Vj.js → bind-D1nO6fiC.js}

@@ -1,10 +1,10 @@
 import { t as compact } from "./compact-CAf557ZB.js";
-import { c as withApp } from "./permdock-B9JxkBwC.js";
-import { t as composeWraps } from "./wrap-gX61EtpB.js";
-import { r as instanceOptions } from "./build-instance-BMnAudHn.js";
-import { p as invalidSignatureResponse } from "./evaluations-DZ2CbV5k.js";
+import { l as withApp } from "./permdock-BfWEeMqk.js";
+import { t as composeWraps } from "./wrap-CiSc_KCq.js";
+import { r as instanceOptions } from "./build-instance-DxE7czo9.js";
+import { f as invalidSignatureResponse } from "./evaluations-DReoiVBw.js";
 import { n as tenantScope } from "./adapter-context-CRhqyzCk.js";
-import { t as createPermDock } from "./create-DnrmLnLW.js";
+import { t as createPermDock } from "./create-DJrlhEp9.js";
 //#region src/server/bind.ts
 /** The server kernel with the subject and actor callbacks reading the context `contextOf` maps a `Request` to. */
 function adapterKernel(policy, options, adapter, contextOf) {

package/dist/{bind--9EFVYWF.d.ts → bind-JDuvxjuW.d.ts}

@@ -1,11 +1,11 @@
-import { ir as Subject } from "./policy-types-DzwivBgR.js";
-import { m as ApprovalStore } from "./types-CCpc2Dcv.js";
-import { t as InstanceOptions } from "./instance-options-Omfd793B.js";
+import { lr as Subject } from "./policy-types-B-F-qAZk.js";
+import { m as ApprovalStore } from "./types-DC44-hqb.js";
+import { t as InstanceOptions } from "./instance-options-CU0YQCLH.js";
 import { t as RequestContext } from "./request-context-C2_1lchh.js";
-import { n as PermDockWrap } from "./wrap-Bd1Tejur.js";
-import { o as OtelWrap } from "./types-BqAKcRNW.js";
-import { r as PdpFactory } from "./types-ClZaWzfb.js";
-import { S as TenantOption, _ as WebBotAuthVerifier, t as DeniedResponse } from "./server-types-BLd4MnBX.js";
+import { n as PermDockWrap } from "./wrap-B6R0cMRL.js";
+import { o as OtelWrap } from "./types-CIeZcG8v.js";
+import { r as PdpFactory } from "./types-D3A19w4A.js";
+import { S as TenantOption, _ as WebBotAuthVerifier, t as DeniedResponse } from "./server-types-C4gZUEZy.js";
 //#region src/server/bind.d.ts
 /** The options of every framework adapter; `TContext` is what its callbacks receive. */
 type ServerAdapterOptions<TContext, TUser = unknown> = InstanceOptions & ServerAdapterServices & {

package/dist/{build-instance-BMnAudHn.js → build-instance-DxE7czo9.js}

@@ -1,5 +1,5 @@
 import { t as compact } from "./compact-CAf557ZB.js";
-import { t as getPermDock } from "./permdock-B9JxkBwC.js";
+import { t as getPermDock } from "./permdock-BfWEeMqk.js";
 //#region src/core/instance-options.ts
 const INSTANCE_KEYS = {
 	memberships: true,

package/dist/{canonical-json-BC8_nMTw.js → canonical-json-DwilZ1iB.js}

@@ -7,15 +7,18 @@ import { r as isRecord } from "./compact-CAf557ZB.js";
 * `"<n>n"`, and a repeated object on the current path `"[Circular]"`, so any
 * validated row serialises.
 */
-function canonicalJson(value, path = /* @__PURE__ */ new Set()) {
+function canonicalJson(value) {
+	return canonicalJsonOnPath(value, /* @__PURE__ */ new Set());
+}
+function canonicalJsonOnPath(value, path) {
 	if (typeof value === "bigint") return JSON.stringify(`${value}n`);
 	if (value instanceof Date) return JSON.stringify(Number.isNaN(value.getTime()) ? null : value.toISOString());
 	if (value !== null && typeof value === "object") {
 		if (path.has(value)) return "\"[Circular]\"";
 		path.add(value);
 		try {
-			if (Array.isArray(value)) return `[${value.map((item) => canonicalJson(item === void 0 ? null : item, path)).join(",")}]`;
-			if (isRecord(value)) return `{${Object.keys(value).toSorted().filter((key) => value[key] !== void 0).map((key) => `${JSON.stringify(key)}:${canonicalJson(value[key], path)}`).join(",")}}`;
+			if (Array.isArray(value)) return `[${value.map((item) => canonicalJsonOnPath(item === void 0 ? null : item, path)).join(",")}]`;
+			if (isRecord(value)) return `{${Object.keys(value).toSorted().filter((key) => value[key] !== void 0).map((key) => `${JSON.stringify(key)}:${canonicalJsonOnPath(value[key], path)}`).join(",")}}`;
 		} finally {
 			path.delete(value);
 		}

package/dist/{capability-BSslw1QV.d.ts → capability-D4UC9TTW.d.ts}

@@ -1,5 +1,5 @@
-import { Rt as Instant, rr as Principal, ut as TokenSigner } from "./policy-types-DzwivBgR.js";
-import { E as PermissionTree, w as Permission } from "./vocabulary-D6lPdb4Z.js";
+import { Rt as Instant, sr as Principal, ut as TokenSigner } from "./policy-types-B-F-qAZk.js";
+import { f as PermissionTree, u as Permission } from "./permission-types-DhNEmoRG.js";
 //#region src/core/capability.d.ts
 /**
  * Who may redeem a capability: anyone holding it, any signed-in principal,

package/dist/{capability-N1K9IpqS.js → capability-L7NnfhiE.js}

@@ -2,7 +2,7 @@ import { t as compact } from "./compact-CAf557ZB.js";
 import { n as freezeDeep } from "./freeze-CrU8nQeX.js";
 import { a as ownRecord } from "./paths-DXSHAMIa.js";
 import { a as isId, o as sameId, r as idList, t as expiredAt } from "./expiry-D4_YKRKD.js";
-import { c as listPermissions } from "./permission-registry-Br4jSNVi.js";
+import { c as listPermissions } from "./permission-registry-DpPtSKNZ.js";
 import { o as epochSeconds, p as nowSeconds } from "./time-DkWjdL98.js";
 import { t as anonymousSubject } from "./subject-BGoM5o8B.js";
 //#region src/core/capability.ts

package/dist/{casbin-Cr7RLtA3.js → casbin-BHijLuHY.js}

@@ -1,5 +1,5 @@
 import { t as defineLeaf } from "./command-L8EstFNm.js";
-import { c as given, l as outFlag, o as fileOut } from "./flags-C3DktBDY.js";
+import { c as given, l as outFlag, o as fileOut } from "./flags-aaeRAdiD.js";
 //#region src/cli/commands/casbin.ts
 const casbinImport = defineLeaf({
 	flags: {
@@ -16,7 +16,7 @@ const casbinImport = defineLeaf({
 		...outFlag
 	},
 	async run(ctx, { flags }) {
-		const { runCasbinImport } = await import("./casbin-Dyu2gnUD.js");
+		const { runCasbinImport } = await import("./casbin-BW9pS47J.js");
 		return runCasbinImport({
 			cwd: ctx.cwd,
 			model: given(flags.model),

package/dist/{casbin-Dyu2gnUD.js → casbin-BW9pS47J.js}

@@ -1,4 +1,4 @@
-import { t as applyFiles } from "./files-C5ZI27eV.js";
+import { t as applyFiles } from "./files-acUbNwWt.js";
 import { n as isIdentifier, t as emitPolicyModule } from "./policy-module-CTlwMvLI.js";
 import { existsSync, readFileSync } from "node:fs";
 import { resolve } from "node:path";

package/dist/{casl-64gpT-8x.js → casl-CmJlgziS.js}

@@ -1,5 +1,5 @@
 import { t as defineLeaf } from "./command-L8EstFNm.js";
-import { c as given, l as outFlag, o as fileOut } from "./flags-C3DktBDY.js";
+import { c as given, l as outFlag, o as fileOut } from "./flags-aaeRAdiD.js";
 //#region src/cli/commands/casl.ts
 const caslImport = defineLeaf({
 	flags: {
@@ -11,7 +11,7 @@ const caslImport = defineLeaf({
 		...outFlag
 	},
 	async run(ctx, { flags }) {
-		const { runCaslImport } = await import("./casl-DjEDhTCP.js");
+		const { runCaslImport } = await import("./casl-UbI8v-Wq.js");
 		return runCaslImport({
 			cwd: ctx.cwd,
 			rules: given(flags.rules),

package/dist/{casl-DjEDhTCP.js → casl-UbI8v-Wq.js}

@@ -1,5 +1,5 @@
 import { r as isRecord } from "./compact-CAf557ZB.js";
-import { t as applyFiles } from "./files-C5ZI27eV.js";
+import { t as applyFiles } from "./files-acUbNwWt.js";
 import { n as isIdentifier, t as emitPolicyModule } from "./policy-module-CTlwMvLI.js";
 import { existsSync, readFileSync } from "node:fs";
 import { resolve } from "node:path";

package/dist/catalog/index.d.ts

@@ -1,8 +1,8 @@
-import { T as Policy, rr as Principal } from "../policy-types-DzwivBgR.js";
-import { a as PolicyDocument } from "../hosted-DBDX0M-P.js";
-import { a as CatalogDocument, c as CatalogOperation, d as CatalogRole, f as CatalogScope, h as CatalogValidity, i as CatalogDelegation, l as CatalogPermission, m as CatalogUsage, n as CatalogApproval, o as CatalogGrant, p as CatalogSupportAccess, r as CatalogBreakGlass, s as CatalogOAuthScope, t as CatalogActivation, u as CatalogResource } from "../types-CZTnPFzM.js";
-import { a as CatalogFinding, i as CatalogEventData } from "../sink-Bj_lDUDq.js";
-import { a as pushedPolicy, i as parsePushedPolicy, n as PushedGrant, r as PushedPolicy, t as PUSHED_POLICY_SCHEMA } from "../pushed-policy-BImMTTIM.js";
+import { T as Policy, a as ApprovalRequirement, sr as Principal } from "../policy-types-B-F-qAZk.js";
+import { c as checkHostedGrant, n as HostedGrantCheck, o as PolicyDocument } from "../hosted-BmjzxQhp.js";
+import { a as CatalogDocument, c as CatalogOperation, d as CatalogRole, f as CatalogScope, h as CatalogValidity, i as CatalogDelegation, l as CatalogPermission, m as CatalogUsage, n as CatalogApproval, o as CatalogGrant, p as CatalogSupportAccess, r as CatalogBreakGlass, s as CatalogOAuthScope, t as CatalogActivation, u as CatalogResource } from "../types-BXMYB7BY.js";
+import { a as CatalogFinding, i as CatalogEventData } from "../sink-Cp_Eot9W.js";
+import { a as pushedPolicy, i as parsePushedPolicy, n as PushedGrant, r as PushedPolicy, t as PUSHED_POLICY_SCHEMA } from "../pushed-policy-BbcY9r_4.js";
 import { StandardSchemaV1 } from "@standard-schema/spec";
 //#region src/catalog/drift.d.ts
 /**
@@ -26,6 +26,55 @@ type CatalogDriftInput = {
  */
 export declare function catalogDrift(input: CatalogDriftInput): CatalogEventData;
 //#endregion
+//#region src/catalog/hosted-options.d.ts
+/** The declared roles held at one scope: a scope name as declared, `resource`, or `global` for a role with no `on`. */
+type HostedGrantRoleOption = {
+  readonly scope: string;
+  readonly roles: readonly string[];
+};
+type HostedGrantRelationOption = {
+  readonly relation: string;
+  /** Present when the grant may walk the resource's own parent chain. */
+  readonly through?: "parent";
+};
+/** What a hosted grant on one hostable permission may say; any other value is dropped by `mergeHostedGrants`. */
+type HostedGrantOption = {
+  readonly permission: string;
+  readonly resource: string;
+  readonly scope: string;
+  readonly effects: readonly ("allow" | "deny")[];
+  readonly grantees: {
+    readonly roles: readonly HostedGrantRoleOption[];
+    readonly plans: readonly string[];
+    readonly relations: readonly HostedGrantRelationOption[];
+  };
+  readonly approval: {
+    /** `true` when a code allow carries an approval: a hosted allow without one at least as strict is dropped (`weaker-approval`). */
+    readonly required: boolean;
+    /** The approvals code allows carry; a hosted allow must meet each. */
+    readonly meets: readonly ("human" | ApprovalRequirement)[];
+    /** `human` is `approval: 'human'`; `any` is the object form, any one approver per approval. `all` and `sequential` stages are never accepted. */
+    readonly modes: readonly ("human" | "any")[];
+    /** The object-form fields a hosted approval may set. */
+    readonly fields: readonly string[];
+    /** The grantee kinds `by` and `escalation.to` may name. */
+    readonly approvers: readonly ("role" | "plan" | "authenticated")[];
+  };
+  readonly conditions: {
+    /** `where` and `check` accept the portable condition subset only. */
+    readonly portable: true;
+    /** The resource's top-level fields, from its JSON Schema; `null` when the schema exposes none. */
+    readonly fields: readonly string[] | null;
+  };
+};
+/**
+ * What a hosted grant may say on each permission the policy marks
+ * `hostable`, in `hostable` order: the grantees, approval forms and
+ * conditions `mergeHostedGrants` accepts. For an authoring form; every
+ * grant it builds from these still goes through `checkHostedGrant`.
+ */
+export declare function hostedGrantOptions(policy: Policy): readonly HostedGrantOption[];
+//#endregion
 //#region src/catalog/json-schema-validator.d.ts
 /**
  * A Standard Schema that validates against a catalog resource's JSON Schema.
@@ -51,13 +100,24 @@ type OperationCatalog = {
  */
 export declare function operationFindings(previous: OperationCatalog, next: OperationCatalog): readonly CatalogFinding[];
 //#endregion
+//#region src/catalog/references.d.ts
+/** A permission `meta` field `parseCatalog` can require. */
+type CatalogMetaField = "title" | "risk" | "effects";
+//#endregion
 //#region src/catalog/parse.d.ts
+type ParseCatalogOptions = {
+  /** Permission `meta` fields every permission must carry; none by default. */
+  readonly requireMeta?: readonly CatalogMetaField[];
+};
 /**
- * Reads a `permissions.catalog.json` document (parsed, or the JSON text) and
- * validates it against `schemas/catalog-v1.json`. Returns a deep-frozen copy
- * built from own keys; throws `PermDockValidationError` with every issue.
+ * Reads a `permissions.catalog.json` document (parsed, or the JSON text),
+ * validates it against `schemas/catalog-v1.json`, then checks its references:
+ * role scopes, the permission keys operations, grants, delegations and OAuth
+ * scopes name, unique keys, and `requireMeta`. Returns a deep-frozen copy
+ * built from own keys; throws `PermDockValidationError` with every issue,
+ * each with its `path`.
  */
-export declare function parseCatalog(json: unknown): CatalogDocument;
+export declare function parseCatalog(json: unknown, options?: ParseCatalogOptions): CatalogDocument;
 /** Keys of the permissions the catalog marks `rowConditions: true`: the SQL helpers alone cannot enforce them. */
 export declare function rowConditionKeys(catalog: CatalogDocument): ReadonlySet<string>;
 //#endregion
@@ -81,4 +141,4 @@ type PolicyFromCatalogOptions<TUser = unknown> = {
  */
 export declare function policyFromCatalog<TUser = unknown>(catalogInput: unknown, pushedInput: unknown, options?: PolicyFromCatalogOptions<TUser>): Policy<TUser>;
 //#endregion
-export { type CatalogActivation, type CatalogApproval, type CatalogBreakGlass, type CatalogDelegation, type CatalogDocument, type CatalogDriftInput, type CatalogGrant, type CatalogOAuthScope, type CatalogOperation, type CatalogPermission, type CatalogResource, type CatalogRole, type CatalogScope, type CatalogSupportAccess, type CatalogUsage, type CatalogValidity, PUSHED_POLICY_SCHEMA, type PolicyFromCatalogOptions, type PushedGrant, type PushedPolicy, parsePushedPolicy, pushedPolicy };
+export { type CatalogActivation, type CatalogApproval, type CatalogBreakGlass, type CatalogDelegation, type CatalogDocument, type CatalogDriftInput, type CatalogGrant, type CatalogMetaField, type CatalogOAuthScope, type CatalogOperation, type CatalogPermission, type CatalogResource, type CatalogRole, type CatalogScope, type CatalogSupportAccess, type CatalogUsage, type CatalogValidity, type HostedGrantCheck, type HostedGrantOption, type HostedGrantRelationOption, type HostedGrantRoleOption, PUSHED_POLICY_SCHEMA, type ParseCatalogOptions, type PolicyFromCatalogOptions, type PushedGrant, type PushedPolicy, checkHostedGrant, parsePushedPolicy, pushedPolicy };

package/dist/catalog/index.js

@@ -1,9 +1,14 @@
+import { r as isRecord } from "../compact-CAf557ZB.js";
 import { n as freezeDeep } from "../freeze-CrU8nQeX.js";
-import { t as hostedGrantDrops } from "../hosted-BZIAYvon.js";
-import { n as rowConditionKeys, t as parseCatalog } from "../parse-Cxq0WxrA.js";
-import { t as operationFindings } from "../operation-findings-DgATDpvh.js";
-import { n as resourceSchemaFromJson, t as policyFromCatalog } from "../policy-from-catalog-DzhEc3Y9.js";
-import { n as parsePushedPolicy, r as pushedPolicy, t as PUSHED_POLICY_SCHEMA } from "../pushed-policy-DobP7AHI.js";
+import { a as getResource, n as findPermission } from "../permission-registry-DpPtSKNZ.js";
+import { d as isSelfParented } from "../resource-relations-D_jw0BFx.js";
+import { _ as listPlans, m as findRole } from "../grantee-BrRANrpT.js";
+import { t as declaredRoleNames } from "../policy-DaJy4nK4.js";
+import { i as hostedGrantDrops, n as codeApprovals, r as declaredGrantee, t as checkHostedGrant } from "../hosted-XBgU6RGT.js";
+import { n as rowConditionKeys, t as parseCatalog } from "../parse-Ddhz2xf4.js";
+import { t as operationFindings } from "../operation-findings-kRcEp8lE.js";
+import { n as resourceSchemaFromJson, t as policyFromCatalog } from "../policy-from-catalog-DFWYkNdu.js";
+import { n as parsePushedPolicy, r as pushedPolicy, t as PUSHED_POLICY_SCHEMA } from "../pushed-policy-CmYeSQqq.js";
 //#region src/catalog/drift.ts
 /** The finding a drop reason becomes; `null` for a reason the catalog did not cause. */
 function findingCode(reason) {
@@ -48,4 +53,105 @@ function catalogDrift(input) {
 	});
 }
 //#endregion
-export { PUSHED_POLICY_SCHEMA, catalogDrift, hostedGrantFindings, operationFindings, parseCatalog, parsePushedPolicy, policyFromCatalog, pushedPolicy, resourceSchemaFromJson, rowConditionKeys };
+//#region src/catalog/hosted-options.ts
+function roleScope(policy, name) {
+	const on = policy.rolesByName.get(name)?.on ?? findRole(policy.vocabulary.roles, name)?.on;
+	if (on === void 0) return "global";
+	return typeof on === "string" ? on : "resource";
+}
+function schemaFields(node) {
+	const output = (node?.schema)?.["~standard"]?.jsonSchema?.output;
+	if (typeof output !== "function") return null;
+	try {
+		const json = output({ target: "draft-2020-12" });
+		const properties = isRecord(json) ? json["properties"] : void 0;
+		return isRecord(properties) ? Object.keys(properties).toSorted() : null;
+	} catch {
+		return null;
+	}
+}
+function optionFor(policy, key) {
+	const leaf = findPermission(policy.permissions, key);
+	if (leaf === void 0) return null;
+	const accepts = (grantee) => declaredGrantee(policy, grantee, leaf.resource);
+	const byScope = /* @__PURE__ */ new Map();
+	for (const role of declaredRoleNames(policy)) {
+		const scope = roleScope(policy, role);
+		if (accepts({
+			kind: "role",
+			role,
+			scope
+		})) byScope.set(scope, [...byScope.get(scope) ?? [], role]);
+	}
+	const plans = listPlans(policy.vocabulary.plans).map((plan) => plan.key).filter((plan) => accepts({
+		kind: "plan",
+		plan
+	}));
+	const node = getResource(policy.permissions, leaf.resource);
+	const relations = Object.keys(node?.relations ?? {}).toSorted().flatMap((relation) => {
+		const direct = {
+			kind: "relation",
+			resource: leaf.resource,
+			relation
+		};
+		if (!accepts(direct)) return [];
+		return isSelfParented(node) && accepts({
+			...direct,
+			through: "parent"
+		}) ? [{
+			relation,
+			through: "parent"
+		}] : [{ relation }];
+	});
+	const meets = codeApprovals(policy, key).filter((approval) => approval !== void 0);
+	return {
+		permission: key,
+		resource: leaf.resource,
+		scope: leaf.scope,
+		effects: ["allow", "deny"],
+		grantees: {
+			roles: [...byScope].map(([scope, roles]) => ({
+				scope,
+				roles
+			})),
+			plans,
+			relations
+		},
+		approval: {
+			required: meets.length > 0,
+			meets,
+			modes: ["human", "any"],
+			fields: [
+				"by",
+				"distinct",
+				"escalation",
+				"quorum",
+				...node?.version === void 0 ? [] : ["staleOn"],
+				"ttl"
+			],
+			approvers: [
+				...byScope.size > 0 ? ["role"] : [],
+				...plans.length > 0 ? ["plan"] : [],
+				"authenticated"
+			]
+		},
+		conditions: {
+			portable: true,
+			fields: schemaFields(node)
+		}
+	};
+}
+/**
+* What a hosted grant may say on each permission the policy marks
+* `hostable`, in `hostable` order: the grantees, approval forms and
+* conditions `mergeHostedGrants` accepts. For an authoring form; every
+* grant it builds from these still goes through `checkHostedGrant`.
+*/
+function hostedGrantOptions(policy) {
+	return freezeDeep(policy.hostable.flatMap((key) => {
+		const option = optionFor(policy, key);
+		return option === null ? [] : [option];
+	}));
+}
+//#endregion
+export { PUSHED_POLICY_SCHEMA, catalogDrift, checkHostedGrant, hostedGrantFindings, hostedGrantOptions, operationFindings, parseCatalog, parsePushedPolicy, policyFromCatalog, pushedPolicy, resourceSchemaFromJson, rowConditionKeys };

package/dist/catalog-BCCjSAdH.js

@@ -0,0 +1 @@
+export { t as catalogFile, n as runCatalog } from "./catalog-D69WhFii.js";