permdock 0.6.0 → 0.8.0

package/dist/{evaluate-CNClBvcj.js → evaluate-Dd8Ta0Ie.js}

@@ -1,34 +1,40 @@
 import { a as sole, n as isReadonlyArray, t as compact } from "./compact-CAf557ZB.js";
-import { n as freezeDeep } from "./freeze-CrU8nQeX.js";
-import { n as isForbiddenKey } from "./paths-DXSHAMIa.js";
-import { n as role, t as normalizeAssurance } from "./role-builder-uWQZ4v84.js";
-import { n as PermDockValidationError } from "./validation-error-ZfUHbKvf.js";
+import { n as freezeDeep } from "./freeze-jjan0lCv.js";
+import { n as isForbiddenKey } from "./paths-CUvURzHp.js";
+import { n as role, t as normalizeAssurance } from "./role-builder-BK2-T6oD.js";
+import { n as PermDockValidationError } from "./validation-error-CYg2kJEw.js";
 import { t as wireDenials } from "./wire-denial-C7PaVYEM.js";
-import { o as sameId } from "./expiry-D4_YKRKD.js";
-import { n as internalsOf } from "./internals-Dk8A8fX3.js";
-import { a as getResource, c as listPermissions, h as formerKeys, m as annotationsFor, n as findPermission } from "./permission-registry-Br4jSNVi.js";
-import { n as isThenable, t as ignoreRejection } from "./thenable-yD7SabqG.js";
-import { i as readAppData } from "./app-data-MuyzVqX8.js";
-import { a as durationOf, d as isoNow, o as epochSeconds, r as assertDuration, s as instantAt, t as INVALID_NOW } from "./time-DkWjdL98.js";
-import { t as canonicalJson } from "./canonical-json-BC8_nMTw.js";
-import { a as normalizeMemberships, d as scopeList, f as subjectForPermission, i as keepsPermission, m as tenantOf, o as resolveScope, s as rootMembershipId } from "./scopes-CUPSjo9q.js";
-import { a as readOnlyActorRefuses, c as rowIdOf, i as delegatedPermissions, l as rowValues, n as coveredByDelegation, o as requiresStandIn, r as coversRequirements, s as isRowPair, u as evaluateCondition } from "./delegation-j6-rc37o.js";
-import { a as authenticated, g as isRole, i as assurance, m as findRole, o as flattenGrantee, r as asGrantee } from "./grantee-hxrUsbpM.js";
-import { a as grantCoversField, i as wireValidity, t as isActive } from "./validity-CZ7-y0Cj.js";
-import { o as resourceRoleCondition } from "./grantee-conditions-CcXf8hMM.js";
-import { c as nowSeconds, i as matchScopedMembership, l as partitionsOf, n as inTeam, p as scopeField, r as isMembershipExpired } from "./tenancy-DN2QAx9z.js";
-import { a as levelCondition, r as grantList, t as declaredRoleNames } from "./policy-DbM5YYtV.js";
+import { o as sameId } from "./expiry-6XByK0dm.js";
+import { n as internalsOf } from "./internals-B3IgHrvo.js";
+import { a as getResource, c as listPermissions, h as formerKeys, m as annotationsFor, n as findPermission } from "./permission-registry-B8tYxPIt.js";
+import { n as isThenable, t as ignoreRejection } from "./thenable-BNSM1U2R.js";
+import { i as readAppData } from "./app-data-UNNm07jV.js";
+import { a as durationOf, d as isoNow, o as epochSeconds, r as assertDuration, s as instantAt, t as INVALID_NOW } from "./time-nR1JesoH.js";
+import { t as canonicalJson } from "./canonical-json-DwilZ1iB.js";
+import { c as rootMembershipId, f as scopeList, h as tenantOf, i as keepsPermission, o as normalizeMemberships, p as subjectForPermission, s as resolveScope } from "./scopes-0Up_UA2t.js";
+import { a as readOnlyActorRefuses, c as rowIdOf, i as delegatedPermissions, l as rowValues, n as coveredByDelegation, o as requiresStandIn, r as coversRequirements, s as isRowPair, u as evaluateCondition } from "./delegation-CDB6_keF.js";
+import { a as authenticated, g as isRole, i as assurance, m as findRole, o as flattenGrantee, r as asGrantee } from "./grantee-Dke-9rd1.js";
+import { a as grantCoversField, i as wireValidity, t as isActive } from "./validity-Buc7w8E9.js";
+import { o as resourceRoleCondition } from "./grantee-conditions-BrYPe-w0.js";
+import { c as nowSeconds, i as matchScopedMembership, l as partitionsOf, n as inTeam, p as scopeField, r as isMembershipExpired } from "./tenancy-5d1zVBvK.js";
+import { i as grantList, n as declaredRoleNames, s as levelCondition } from "./policy-CLQ8__GF.js";
 import { t as requiresApproval } from "./approval-required-TzNB9oQA.js";
-import { i as versionOf, r as tokenPayload, t as decisionToken } from "./token-BLZcjQgt.js";
-import { n as resolveRelated } from "./relation-walk-3OyDBF0S.js";
-import { t as eventInstant } from "./event-time-CsegxXxB.js";
+import { i as versionOf, r as tokenPayload, t as decisionToken } from "./token-DC9EQiet.js";
+import { n as resolveRelated } from "./relation-walk-DK_gkgL7.js";
+import { t as eventInstant } from "./event-time-BGy48400.js";
 import { n as toWireDelegation } from "./wire-delegation-Cv3W2eaM.js";
-import { n as matchGrantee, t as combineWhere } from "./grantee-match-DbENBHLB.js";
+import { n as matchGrantee, t as combineWhere } from "./grantee-match-7RZZvoT_.js";
 import { t as resourceIdOf } from "./resource-ref-CaS9yVPi.js";
 //#region src/core/approval-state.ts
-/** The denial detail when an `ApprovalPolicySource` threw or returned an invalid entry. */
+/**
+* The denial detail when an `ApprovalPolicySource` threw or returned an invalid
+* entry.
+*/
 const APPROVAL_POLICY_UNAVAILABLE = "approval-policy-unavailable";
-/** The tenant a matched allow applies in: its membership's root scope, else the active tenant. */
+/**
+* The tenant a matched allow applies in: its membership's root scope, else the
+* active tenant.
+*/
 function decisionTenant(subject, membership) {
 	return (membership === void 0 ? void 0 : rootMembershipId(membership)) ?? subject.principal?.tenant;
 }
@@ -38,9 +44,9 @@ function isContact(principal) {
 	return principal?.kind === "contact";
 }
 /**
-* A contact's memberships: only the `{ on }` ones count, each as
-* `via: 'contact'` and without seats, so a role whose `for` excludes
-* `contact` never applies and no `plan()` grantee matches.
+* A contact's memberships: only the `{ on }` ones count, each as `via:
+* 'contact'` and without seats, so a role whose `for` excludes `contact` never
+* applies and no `plan()` grantee matches.
 */
 function contactMemberships(memberships) {
 	const kept = [];
@@ -58,14 +64,17 @@ function optsIn(policy, grant) {
 	if (grant.role === null) return false;
 	return policy.roles.find(({ name }) => name === grant.role)?.for?.includes("contact") === true;
 }
-/** Whether `subject` may use the allow `grant`: false only for a contact and a write its role does not open to contacts. */
+/**
+* Whether `subject` may use the allow `grant`: false only for a contact and a
+* write its role does not open to contacts.
+*/
 function contactMayUse(policy, subject, grant) {
 	return grant.effect !== "allow" || !isContact(subject.principal) || annotationsFor(grant.permission).readOnlyHint || optsIn(policy, grant);
 }
 /**
-* The allows a contact may use for `permission`: all of them for a
-* read-only permission, otherwise only those from a role whose `for` lists
-* `contact`. Every other subject keeps every allow.
+* The allows a contact may use for `permission`: all of them for a read-only
+* permission, otherwise only those from a role whose `for` lists `contact`.
+* Every other subject keeps every allow.
 */
 function contactAllows(policy, subject, permission, allows) {
 	if (!isContact(subject.principal) || annotationsFor(permission).readOnlyHint) return allows;
@@ -190,7 +199,10 @@ function evaluateBreakGlass(spec, subject, now) {
 		}] : []]
 	};
 }
-/** Support memberships (`via: 'support'`) the subject holds that demand an actor. */
+/**
+* Support memberships (`via: 'support'`) the subject holds that demand an
+* actor.
+*/
 function actorRequiredVias(supports) {
 	return new Set(supports.filter((spec) => spec.actorRequired).map((spec) => spec.role));
 }
@@ -225,18 +237,18 @@ function activationDenied(reason, to) {
 	});
 }
 /**
-* Requests a just-in-time role activation. It never writes: a granted
-* decision carries the elevated membership under `elevation` for the app to
-* write. `approval-required` comes back first when the role's `activation`
-* sets `approval`. Fail-closed: an unknown role, an ineligible subject, a
-* missing justification or stale authentication all deny.
+* Requests a just-in-time role activation. It never writes: a granted decision
+* carries the elevated membership under `elevation` for the app to write.
+* `approval-required` comes back first when the role's `activation` sets
+* `approval`. Fail-closed: an unknown role, an ineligible subject, a missing
+* justification or stale authentication all deny.
 */
 /**
 * Requests a just-in-time activation of an eligible role for the subject of
 * `permdock`. It never writes: a granted decision carries the elevated
-* membership under `elevation` for the app to write, and
-* `approval-required` comes back first when the role's `activation` sets
-* `approval`. An instance built from a snapshot denies with `unsupported`.
+* membership under `elevation` for the app to write, and `approval-required`
+* comes back first when the role's `activation` sets `approval`. An instance
+* built from a snapshot denies with `unsupported`.
 */
 function activate(permdock, input) {
 	const internals = internalsOf(permdock);
@@ -526,7 +538,10 @@ function credentialRef(subject) {
 		kind
 	} : void 0;
 }
-/** `context.supportSession` counts only next to the `support` actor `subjectFromSupportSession` sets. */
+/**
+* `context.supportSession` counts only next to the `support` actor
+* `subjectFromSupportSession` sets.
+*/
 function supportSessionRef(subject) {
 	const value = subject.context["supportSession"];
 	if (subject.actor?.kind !== "support" || value === null || typeof value !== "object" || !("id" in value) || typeof value.id !== "string" || value.id === "") return;
@@ -610,7 +625,10 @@ function finish(policy, subject, permission, data, decision, options, env, trust
 }
 //#endregion
 //#region src/core/evaluate/complete.ts
-/** Every exit of `evaluate`: names the permission, freezes, attaches the trace and emits. */
+/**
+* Every exit of `evaluate`: names the permission, freezes, attaches the trace
+* and emits.
+*/
 function complete(call, raw, membership) {
 	const { env, permission, tracer } = call;
 	const decision = env.outcomeOnly !== true && raw.outcome === "denied" && raw.permission === void 0 ? {
@@ -640,7 +658,10 @@ function deniedWithAlternatives(state, denials) {
 }
 //#endregion
 //#region src/core/evaluate/allowed.ts
-/** The `granted` or `approval-required` decision for the chosen allow, with its token. */
+/**
+* The `granted` or `approval-required` decision for the chosen allow, with its
+* token.
+*/
 function allowedDecision(state, allow, approval, quotaState) {
 	const { policy, subject, permission, resource, env, current, next } = state;
 	const resourceId = permission.kind === "collection" ? "*" : rowIdOf(current, resource?.id);
@@ -679,7 +700,10 @@ function allowedDecision(state, allow, approval, quotaState) {
 }
 //#endregion
 //#region src/core/custom-roles.ts
-/** The current key for a stored key, current or former; `undefined` when neither. */
+/**
+* The current key for a stored key, current or former; `undefined` when
+* neither.
+*/
 function currentKey(policy, raw) {
 	const leaf = findPermission(policy.permissions, raw);
 	if (leaf === void 0) return;
@@ -711,8 +735,8 @@ function leveled(grant, level, condition) {
 }
 /**
 * The scope a custom role is held at: `scope` (a name or alias), the second
-* scope for the `team` input shape, else the first scope. `undefined` when
-* the policy does not declare it; such a role resolves to nothing.
+* scope for the `team` input shape, else the first scope. `undefined` when the
+* policy does not declare it; such a role resolves to nothing.
 */
 function customRoleScope(role, scopes) {
 	if (role.scope === "global") return role.shared === true ? void 0 : "global";
@@ -723,11 +747,17 @@ function customRoleScope(role, scopes) {
 function customRoleId(role) {
 	return role.scope === void 0 ? role.team : role.id;
 }
-/** A platform custom role: held through `principal.roles`, capped by the assignable global roles. */
+/**
+* A platform custom role: held through `principal.roles`, capped by the
+* assignable global roles.
+*/
 function isGlobalCustomRole(role) {
 	return role.scope === "global";
 }
-/** A shared custom role: defined once for every tenant, held on memberships of its scope in any tenant. */
+/**
+* A shared custom role: defined once for every tenant, held on memberships of
+* its scope in any tenant.
+*/
 function isSharedCustomRole(role) {
 	return role.shared === true;
 }
@@ -752,7 +782,8 @@ function isAssignableRole(policy, name) {
 * Every scope's ceiling, keyed by scope name (`global` for platform custom
 * roles): the code allows of declared `assignable` roles in that scope,
 * everything a custom role of the scope may ever reach. Hosted grants never
-* widen it. `assignable` narrows it to those role names (`CustomRoleSource.assignable`).
+* widen it. `assignable` narrows it to those role names
+* (`CustomRoleSource.assignable`).
 */
 function ceilings(policy, assignable) {
 	const allowed = assignable === void 0 ? void 0 : new Set(assignable);
@@ -885,7 +916,7 @@ function resolveCustomRole(policy, role) {
 		if (level !== void 0) {
 			const leaf = findPermission(policy.permissions, key);
 			const condition = typeof level === "string" && leaf?.kind === "instance" ? levelCondition(policy, leaf.resource, level) : void 0;
-			if (condition === void 0) {
+			if (condition === void 0 || typeof level !== "string") {
 				drop({
 					permission: key,
 					reason: "unknown-level",
@@ -894,7 +925,7 @@ function resolveCustomRole(policy, role) {
 				denyKeys.add(key);
 				continue;
 			}
-			narrowing = [String(level), condition];
+			narrowing = [level, condition];
 		}
 		if (!ceilingKeys.has(key)) {
 			drop({
@@ -952,6 +983,35 @@ function validateCustomRole(policy, role, options = {}) {
 		renamed: resolved.renamed
 	});
 }
+/**
+* Checks one stored allow entry, `<permission>[@<level>]`, the way
+* `permdock_custom_role_entry_problem` does in SQL. `scope` defaults to the
+* first scope; its ceiling is the allows of that scope's assignable roles.
+*/
+function parseCustomRoleEntry(policy, entry, options = {}) {
+	const at = entry.indexOf("@");
+	const raw = at === -1 ? entry : entry.slice(0, at);
+	const level = at === -1 ? void 0 : entry.slice(at + 1);
+	const checked = validateCustomRole(policy, {
+		name: "entry",
+		tenant: "entry",
+		...options.scope === void 0 ? {} : { scope: options.scope },
+		grants: [{
+			permission: raw,
+			...level === void 0 ? {} : { level }
+		}]
+	});
+	const dropped = checked.dropped[0];
+	if (dropped !== void 0) return {
+		ok: false,
+		cause: dropped.reason === "unknown-level" || dropped.reason === "outside-ceiling" ? dropped.reason : "unknown-permission"
+	};
+	return {
+		ok: true,
+		permission: checked.renamed[0]?.to ?? raw,
+		...level === void 0 ? {} : { level }
+	};
+}
 function wellFormed(role) {
 	if (role === null || typeof role !== "object" || typeof role.name !== "string") return false;
 	if (role.shared !== void 0) return role.shared === true && role.tenant === void 0 && role.team === void 0 && role.id === void 0 && (role.scope === void 0 || typeof role.scope === "string" && role.scope !== "global");
@@ -967,7 +1027,24 @@ function effectiveCustomRoles(roles) {
 	const shared = new Set(formed.filter(isSharedCustomRole).map((role) => role.name));
 	return shared.size === 0 ? formed : formed.filter((role) => isSharedCustomRole(role) || isGlobalCustomRole(role) || !shared.has(role.name));
 }
-/** Every custom role's resolved grants, once per instance. Malformed roles resolve to nothing. */
+/** The grants of `roles` that name a level their resource does not declare. */
+function unknownLevelsFor(policy, roles) {
+	const declared = declaredRoleNames(policy);
+	const out = [];
+	for (const role of effectiveCustomRoles(roles)) {
+		if (declared.has(role.name)) continue;
+		for (const entry of resolveCustomRole(policy, role).dropped) if ("permission" in entry && entry.reason === "unknown-level") out.push({
+			role: role.name,
+			permission: entry.permission,
+			level: entry.level ?? ""
+		});
+	}
+	return out;
+}
+/**
+* Every custom role's resolved grants, once per instance. Malformed roles
+* resolve to nothing.
+*/
 function customGrantsFor(policy, roles) {
 	const declared = declaredRoleNames(policy);
 	const out = [];
@@ -989,7 +1066,10 @@ function tenantCustomRoles(policy, roles) {
 	const declared = declaredRoleNames(policy);
 	return effectiveCustomRoles(roles).filter((role) => !isGlobalCustomRole(role) && !declared.has(role.name));
 }
-/** Whether a custom role held on memberships belongs to `tenant`: its own, or shared by every tenant. */
+/**
+* Whether a custom role held on memberships belongs to `tenant`: its own, or
+* shared by every tenant.
+*/
 function customRoleOf(role, tenant) {
 	return isSharedCustomRole(role) || sameId(role.tenant, tenant);
 }
@@ -1008,15 +1088,18 @@ function holdsCustomRole(membership, role, scopes) {
 function holdsGlobalCustomRole(roles, role) {
 	return isGlobalCustomRole(role) && (roles ?? []).includes(role.name);
 }
-/** A tenant's custom role inside that tenant, a shared role in any tenant, or a platform custom role anywhere. */
+/**
+* A tenant's custom role inside that tenant, a shared role in any tenant, or a
+* platform custom role anywhere.
+*/
 function isCustomRoleName(name, roles, tenant) {
 	return effectiveCustomRoles(roles).some((item) => item.name === name && (isGlobalCustomRole(item) || tenant !== void 0 && customRoleOf(item, tenant)));
 }
 /**
-* The compact JWT form of custom roles for the `memberships[].grants` claim
-* RLS reads in `jwt` mode: role name to entries, where `key` allows, `-key`
-* denies and `@role` includes. Put a team custom role on its team membership.
-* Pass `policy` to write keys stored under a former name as the current key.
+* The compact JWT form of custom roles for the `memberships[].grants` claim RLS
+* reads in `jwt` mode: role name to entries, where `key` allows, `-key` denies
+* and `@role` includes. Put a team custom role on its team membership. Pass
+* `policy` to write keys stored under a former name as the current key.
 */
 function customRoleClaim(roles, policy) {
 	const keyOf = (raw) => policy === void 0 ? raw : currentKey(policy, raw) ?? raw;
@@ -1054,7 +1137,10 @@ function membershipsClaim(memberships, customRoles, scopes) {
 }
 //#endregion
 //#region src/core/source-name.ts
-/** `{ name }` for a source that names itself, `{}` otherwise: what an auth event reports about it. */
+/**
+* `{ name }` for a source that names itself, `{}` otherwise: what an auth event
+* reports about it.
+*/
 function sourceName(source) {
 	return source?.name === void 0 ? {} : { name: source.name };
 }
@@ -1072,7 +1158,10 @@ function isSharedRole(value) {
 function onlyShared(roles) {
 	return Array.isArray(roles) ? roles.filter(isSharedRole) : [];
 }
-/** The `customRoles` option as a source: a factory is called with the resolved subject, and a throw reads none. */
+/**
+* The `customRoles` option as a source: a factory is called with the resolved
+* subject, and a throw reads none.
+*/
 function roleSourceFor(option, subject, auth) {
 	if (typeof option !== "function") return option;
 	try {
@@ -1159,8 +1248,8 @@ function assignableNamesFor(source, tenants, auth) {
 	return toMap(loaded);
 }
 /**
-* The declared role names among `names`. A custom role of `tenant` is known
-* but contributes no declared name: its grants are resolved separately
+* The declared role names among `names`. A custom role of `tenant` is known but
+* contributes no declared name: its grants are resolved separately
 * (`customGrantsFor`), bounded by the ceiling. A tenant's custom role is
 * unknown inside another tenant and for a membership without one.
 */
@@ -1218,7 +1307,10 @@ function validationMessage(permission, resource, issues) {
 }
 //#endregion
 //#region src/core/evaluate/call.ts
-/** The rows after boundary validation; on `invalid`, the rows validated before the failure. */
+/**
+* The rows after boundary validation; on `invalid`, the rows validated before
+* the failure.
+*/
 function validatedRows(call, data, rows) {
 	const { permission, policy, options } = call;
 	if (data === void 0 && !(permission.kind === "instance" && policy.validate === "always")) return rows;
@@ -1298,9 +1390,9 @@ function isUnconditionedAllow(grant, now) {
 	return grant.where === void 0 && grant.check === void 0 && grant.closure === void 0 && grant.portable && grant.purpose === void 0 && grant.viaOnly === void 0 && grant.requires === void 0 && isActive(grant.validity, now);
 }
 /**
-* The row condition a grant's `requires` adds: the row's instance of some
-* scope is one where the subject holds `key` through a role grant without a
-* row condition, minus the instances a deny of `key` reaches at that scope.
+* The row condition a grant's `requires` adds: the row's instance of some scope
+* is one where the subject holds `key` through a role grant without a row
+* condition, minus the instances a deny of `key` reaches at that scope.
 * `undefined` when the subject holds `key` globally that way, so every row
 * passes. The in-process mirror of the SQL `permdock_has_permission` and
 * `permitted_<scope>_ids_by_permission`.
@@ -1374,9 +1466,9 @@ function keyRequirement(policy, subject, key, resource, now, customRoles, custom
 //#endregion
 //#region src/core/evaluate/candidates.ts
 /**
-* A collection write proposes `next`; an update pair may move `next` out of
-* the scope `current` is in. An allow needs both in scope; a deny applies
-* when either is, so a move into or out of its scope stays denied.
+* A collection write proposes `next`; an update pair may move `next` out of the
+* scope `current` is in. An allow needs both in scope; a deny applies when
+* either is, so a move into or out of its scope stays denied.
 */
 function matchWriteScope(match, instance, current, next, deny) {
 	const first = match(instance ? current : next);
@@ -1386,7 +1478,10 @@ function matchWriteScope(match, instance, current, next, deny) {
 	const moved = match(next);
 	return moved.ok ? first : moved;
 }
-/** The code grants and custom-role grants for the permission, break-glass grants aside. */
+/**
+* The code grants and custom-role grants for the permission, break-glass grants
+* aside.
+*/
 function candidatesFor(call) {
 	const { permission } = call;
 	const candidates = (call.policy.index.grantsByKey.get(permission.key) ?? []).filter((grant) => grant.breakGlass === void 0).map((grant) => ({ grant }));
@@ -1444,7 +1539,8 @@ function holdsRole(state, item, custom) {
 }
 /**
 * Whether the subject holds every role the grantee names, at a scope the row
-* (and a write's next row) is in. `held: false` when a denial or skip was recorded.
+* (and a write's next row) is in. `held: false` when a denial or skip was
+* recorded.
 */
 function roleScope(state, grant, custom) {
 	const { subject, permission, tracer } = state;
@@ -1510,7 +1606,10 @@ function granteeOf(state, grant, custom) {
 		reason
 	});
 }
-/** One candidate grant: records an allow, a denial or a skip, or returns the decision a deny ends with. */
+/**
+* One candidate grant: records an allow, a denial or a skip, or returns the
+* decision a deny ends with.
+*/
 function evaluateCandidate(state, { grant, custom }, breakGlass) {
 	const { policy, subject, permission, now, env, tracer } = state;
 	const displayRole = grant.role;
@@ -1575,7 +1674,10 @@ function evaluateCandidate(state, { grant, custom }, breakGlass) {
 		membership: scoped.membership
 	});
 }
-/** Adds the break-glass allow, or puts its denial first, once every candidate has run. */
+/**
+* Adds the break-glass allow, or puts its denial first, once every candidate
+* has run.
+*/
 function mergeBreakGlass(state, breakGlass) {
 	if (breakGlass.grant !== void 0) {
 		state.tracer?.allows.push(matchedOf(breakGlass.grant, state.permission.key, true));
@@ -1598,8 +1700,8 @@ function noAllowDecision(state) {
 }
 /**
 * The allows a delegation leaves usable. A policy delegation is a ceiling for
-* the actor: outside it, nothing is delegated; inside it, a token delegation
-* on the call must still cover.
+* the actor: outside it, nothing is delegated; inside it, a token delegation on
+* the call must still cover.
 */
 function delegatedAllows(state) {
 	const { policy, subject, permission, current } = state;
@@ -1638,7 +1740,10 @@ function approvalOf(state, candidate) {
 }
 //#endregion
 //#region src/core/evaluate/quota.ts
-/** The quota verdict for one allow: free without a `limit`, unavailable without the `limits()` feature. */
+/**
+* The quota verdict for one allow: free without a `limit`, unavailable without
+* the `limits()` feature.
+*/
 function quotaOf(state, grant, consume) {
 	const { env, subject } = state;
 	if (grant.limit === void 0) return { ok: true };
@@ -1686,9 +1791,9 @@ function quotaAllow(state, usable) {
 /**
 * One decision, in stages: the call (clock, rows, delegated permission), the
 * subject (held roles, actor), the candidate grants (a matching deny ends
-* here), break-glass, freshness, delegation and contact, the approval and
-* quota of each usable allow, and the decision. Every exit goes through
-* `complete`, which freezes and emits.
+* here), break-glass, freshness, delegation and contact, the approval and quota
+* of each usable allow, and the decision. Every exit goes through `complete`,
+* which freezes and emits.
 */
 function evaluate(policy, given, permission, data, options, env) {
 	const call = {
@@ -1782,4 +1887,4 @@ function evaluate(policy, given, permission, data, options, env) {
 	return allowedDecision(state, chosen.allow, chosen.approval, chosen.quota);
 }
 //#endregion
-export { contactMayUse as A, validateCustomRole as C, activate as D, finish as E, isContact as M, APPROVAL_POLICY_UNAVAILABLE as N, breakGlass as O, tenantCustomRoles as S, emptyListeners as T, isSharedCustomRole as _, expandRoleNames as a, resolveCustomRole as b, andWhere as c, customRoleClaim as d, customRoleId as f, holdsGlobalCustomRole as g, holdsCustomRole as h, customRolesFor as i, contactMemberships as j, supportAccess as k, ceilingGrants as l, customRoleScope as m, requirementCondition as n, roleSourceFor as o, customRoleOf as p, assignableNamesFor as r, sourceName as s, evaluate as t, customGrantsFor as u, leveled as v, emitSafe as w, roleAllowKeys as x, membershipsClaim as y };
+export { breakGlass as A, tenantCustomRoles as C, emptyListeners as D, emitSafe as E, APPROVAL_POLICY_UNAVAILABLE as F, contactMayUse as M, contactMemberships as N, finish as O, isContact as P, roleAllowKeys as S, validateCustomRole as T, isSharedCustomRole as _, expandRoleNames as a, parseCustomRoleEntry as b, andWhere as c, customRoleClaim as d, customRoleId as f, holdsGlobalCustomRole as g, holdsCustomRole as h, customRolesFor as i, supportAccess as j, activate as k, ceilingGrants as l, customRoleScope as m, requirementCondition as n, roleSourceFor as o, customRoleOf as p, assignableNamesFor as r, sourceName as s, evaluate as t, customGrantsFor as u, leveled as v, unknownLevelsFor as w, resolveCustomRole as x, membershipsClaim as y };

package/dist/{evaluations-beAooV0n.js → evaluations-IBceAeKT.js}

@@ -1,13 +1,13 @@
 import { r as isRecord, t as compact } from "./compact-CAf557ZB.js";
-import { t as PROBLEM_BASE } from "./validation-error-ZfUHbKvf.js";
+import { t as PROBLEM_BASE } from "./validation-error-CYg2kJEw.js";
 import { t as wireDenials } from "./wire-denial-C7PaVYEM.js";
-import { c as listPermissions, g as formerScopes, h as formerKeys } from "./permission-registry-Br4jSNVi.js";
-import { h as secondsAt } from "./time-DkWjdL98.js";
+import { c as listPermissions, g as formerScopes, h as formerKeys } from "./permission-registry-B8tYxPIt.js";
+import { h as secondsAt } from "./time-nR1JesoH.js";
 import { n as resourceRef } from "./resource-ref-CaS9yVPi.js";
-import { n as readBodyText } from "./body-text-QcXok_SI.js";
-import { c as problemResponse, d as validationProblem, n as batchTooLarge } from "./problem-CTviyH5L.js";
-import { i as readApprovalHeader, s as resumeDecision } from "./helpers-CBYVMjwh.js";
-import { t as bodyTooLarge } from "./body-CH5of8Ne.js";
+import { n as readBodyText } from "./body-text-DQhcmqdY.js";
+import { f as validationProblem, l as problemResponse, n as batchTooLarge } from "./problem-BVLHFK33.js";
+import { i as readApprovalHeader, s as resumeDecision } from "./helpers-DJicaG6f.js";
+import { t as bodyTooLarge } from "./body-CJQwYVa8.js";
 import { t as timeoutSignal } from "./timeout-D51niuQP.js";
 //#region src/core/decision.ts
 /** The denial for a check that failed or named no declared permission. */
@@ -19,16 +19,25 @@ const NO_GRANT = Object.freeze({
 	})]),
 	alternatives: Object.freeze([])
 });
+/** The denial for a check whose row loader threw: it fails closed. */
+const LOAD_FAILED = Object.freeze({
+	outcome: "denied",
+	denials: Object.freeze([Object.freeze({
+		role: null,
+		reason: "validation"
+	})]),
+	alternatives: Object.freeze([])
+});
 //#endregion
 //#region src/server/evaluation-items.ts
 function firstWins(map, name, leaf) {
 	if (!map.has(name)) map.set(name, leaf);
 }
 /**
-* Indexes `tree` once. The lookup tries `action` as a permission key or
-* scope, then `<resource.type>.<action>`, then the leaf with that resource
-* and action; current names win over former ones and earlier leaves over
-* later ones. Anything else is `undefined`, which the caller denies.
+* Indexes `tree` once. The lookup tries `action` as a permission key or scope,
+* then `<resource.type>.<action>`, then the leaf with that resource and action;
+* current names win over former ones and earlier leaves over later ones.
+* Anything else is `undefined`, which the caller denies.
 */
 function permissionLookup(tree) {
 	const current = /* @__PURE__ */ new Map();
@@ -52,13 +61,19 @@ function permissionLookup(tree) {
 }
 /** AuthZEN's sentinel resource id for a collection: the type as a whole, no row. */
 const COLLECTION_ID = "*";
-/** A resource id as a row id: `undefined` for none, a non-scalar or the collection sentinel `*`. */
+/**
+* A resource id as a row id: `undefined` for none, a non-scalar or the
+* collection sentinel `*`.
+*/
 function wireResourceId(id) {
 	if (typeof id !== "string" && typeof id !== "number") return;
 	const text = String(id);
 	return text === COLLECTION_ID ? void 0 : text;
 }
-/** The row an item's resource describes: its `properties`, else `{ id }`, else none for `id: "*"`. */
+/**
+* The row an item's resource describes: its `properties`, else `{ id }`, else
+* none for `id: "*"`.
+*/
 function itemResourceData(resource) {
 	const properties = resource?.properties;
 	if (properties !== null && typeof properties === "object") return properties;
@@ -67,7 +82,10 @@ function itemResourceData(resource) {
 }
 //#endregion
 //#region src/server/web-bot-auth.ts
-/** Milliseconds a key directory fetch may take before the signature counts as unverifiable. */
+/**
+* Milliseconds a key directory fetch may take before the signature counts as
+* unverifiable.
+*/
 const DIRECTORY_TIMEOUT_MS = 5e3;
 const DEFAULT_MAX_AGE = 300;
 const FUTURE_SKEW = 60;
@@ -405,7 +423,10 @@ const EVALUATIONS_SEMANTICS = [
 	"deny_on_first_deny",
 	"permit_on_first_permit"
 ];
-/** The batch's `evaluations_semantic`: `execute_all` when absent, `undefined` for an unknown value. */
+/**
+* The batch's `evaluations_semantic`: `execute_all` when absent, `undefined`
+* for an unknown value.
+*/
 function evaluationsSemantic(body) {
 	const options = body["options"];
 	const value = isRecord(options) ? options["evaluations_semantic"] : void 0;
@@ -420,7 +441,7 @@ function unknownSemanticProblem() {
 * order, stopping after the first deny or permit.
 */
 async function evaluateBatch(items, semantic, rowOf) {
-	if (semantic === "execute_all") return Promise.all(items.map(rowOf));
+	if (semantic === "execute_all") return Promise.all(items.map((item) => rowOf(item)));
 	const stopOn = semantic === "permit_on_first_permit";
 	const rows = [];
 	for (const item of items) {
@@ -454,9 +475,9 @@ function authzenMetadata(pdp, search = {}) {
 	});
 }
 /**
-* `reason_admin` and `reason_user` for a decision that is not granted, from
-* the denial roles and reasons the context already carries. The user reason
-* names no role, grant or subject.
+* `reason_admin` and `reason_user` for a decision that is not granted, from the
+* denial roles and reasons the context already carries. The user reason names
+* no role, grant or subject.
 */
 function evaluationReasons(decision, permission) {
 	switch (decision.outcome) {
@@ -607,4 +628,4 @@ function evaluationsHandler(options) {
 	};
 }
 //#endregion
-export { wireResourceId as _, evaluationReasons as a, unknownSemanticProblem as c, discoverViaSignatureAgent as d, invalidSignatureProblem as f, permissionLookup as g, itemResourceData as h, evaluateBatch as i, withRequestId as l, webBotAuthVerifier as m, applyApprovalResume as n, evaluationsHandler as o, invalidSignatureResponse as p, authzenMetadata as r, evaluationsSemantic as s, EVALUATIONS_SEMANTICS as t, InvalidSignatureError as u, NO_GRANT as v };
+export { LOAD_FAILED as _, evaluationReasons as a, withRequestId as c, invalidSignatureProblem as d, invalidSignatureResponse as f, wireResourceId as g, permissionLookup as h, evaluateBatch as i, InvalidSignatureError as l, itemResourceData as m, applyApprovalResume as n, evaluationsHandler as o, webBotAuthVerifier as p, authzenMetadata as r, evaluationsSemantic as s, EVALUATIONS_SEMANTICS as t, discoverViaSignatureAgent as u, NO_GRANT as v };