permdock 0.6.0 → 0.8.0

package/dist/index.js

@@ -1,36 +1,38 @@
-import { a as hasConditionOp, c as isConditionRef, l as isSqlFunctionField, o as isCondition, r as principal, s as isConditionDate, t as context } from "./refs-K6eWUJ0H.js";
-import { _ as opaque, a as deny, f as normalizeApproval, n as role, r as allow, t as normalizeAssurance } from "./role-builder-uWQZ4v84.js";
-import { A as memorySnapshotSource, C as validateApprovalPolicy, D as memoryEntitlementSource, E as memoryCustomRoleSource, O as memoryMembershipSource, S as memoryApprovalPolicySource, _ as limits, a as readable, b as approvalPolicies, c as customRoleSource, d as defineApp, f as localSnapshotManifest, g as memoryRelationSource, h as signPolicyDocument, i as crud, j as sqlFunction, k as memorySettingsSource, l as mayAccess, m as simulateArazzo, n as toCsvRow, o as writable, p as arazzoFindings, r as decideRoleChange, s as snapshotFor, t as CSV_COLUMNS, u as shadowMode, v as memoryLimitStore, w as defineOperations, y as stripeEntitlementSource } from "./src-Cu2m75uo.js";
-import { a as holder, l as user, n as anyOf, t as allOf } from "./approvers-CqPOLD-o.js";
-import { n as PermDockValidationError } from "./validation-error-ZfUHbKvf.js";
-import { r as requiredPlans } from "./problem-details-cn5X30gZ.js";
-import { t as describe } from "./describe-BybMRY7A.js";
+import { c as isConditionDate, i as principal, l as isConditionRef, n as context, o as hasConditionOp, s as isCondition, t as claim, u as isSqlFunctionField } from "./refs-C8BKxc_e.js";
+import { _ as opaque, a as deny, f as normalizeApproval, n as role, r as allow, t as normalizeAssurance } from "./role-builder-BK2-T6oD.js";
+import { A as memoryCustomRoleSource, C as stripeEntitlementSource, D as validateApprovalPolicy, E as memoryApprovalPolicySource, F as sqlFunction, M as memoryMembershipSource, N as memorySettingsSource, O as defineOperations, P as memorySnapshotSource, S as memoryLimitStore, _ as arazzoFindings, a as normalizeMembership, b as memoryRelationSource, c as crud, d as snapshotFor, f as customRoleSource, g as localSnapshotManifest, h as defineApp, i as decideRoleChange, j as memoryEntitlementSource, l as readable, m as shadowMode, n as toCsvRow, o as normalizeMemberships, p as mayAccess, r as checkRoleChange, s as resolveScope, t as CSV_COLUMNS, u as writable, v as simulateArazzo, w as approvalPolicies, x as limits, y as signPolicyDocument } from "./src-DZ0l9UAg.js";
+import { a as holder, l as user, n as anyOf, t as allOf } from "./approvers-B4r0N_Uz.js";
+import { n as PermDockValidationError } from "./validation-error-CYg2kJEw.js";
+import { r as requiredPlans } from "./problem-details-CLDgX1KV.js";
+import { n as describe } from "./describe-Bb4hGK5d.js";
 import { r as parsePermDockDigest } from "./digest-BI-6aa6d.js";
-import { n as PermDockDeniedError, r as PermDockRevokedError, t as PermDockApprovalRequiredError } from "./errors-BKy0EfhN.js";
+import { n as PermDockDeniedError, r as PermDockRevokedError, t as PermDockApprovalRequiredError } from "./errors-B6R_lg2a.js";
 import { t as memoryRevocationFeed } from "./revocations-Bhr0aMIC.js";
-import { r as memoryPrincipalSource } from "./principal-source-pHneukrx.js";
-import { _ as resource, a as getResource, c as listPermissions, h as formerKeys, l as mergePermissions, n as findPermission, o as isPermission } from "./permission-registry-Br4jSNVi.js";
-import { n as memoryAutomationSource, r as parseAutomation, t as decideAutomation } from "./automation-DVjOckjV.js";
-import { n as parseSupportSession, t as decideSupportSession } from "./support-session-C6xJQYut.js";
-import { i as delegatedPermissions, n as coveredByDelegation } from "./delegation-j6-rc37o.js";
-import { _ as listPlans, a as authenticated, c as plan, f as definePlans, g as isRole, h as isPlan, i as assurance, l as relation, m as findRole, n as anyone, p as defineRoles, s as inherit, t as actor, v as listRoles } from "./grantee-hxrUsbpM.js";
-import { c as separationConflicts, n as definePolicy } from "./policy-DbM5YYtV.js";
+import { r as memoryPrincipalSource } from "./principal-source-C6N60GtM.js";
+import { a as getResource, c as listPermissions, h as formerKeys, l as mergePermissions, n as findPermission, o as isPermission, v as resource } from "./permission-registry-B8tYxPIt.js";
+import { n as memoryAutomationSource, r as parseAutomation, t as decideAutomation } from "./automation-x3KEUusw.js";
+import { t as canonicalJson } from "./canonical-json-DwilZ1iB.js";
+import { r as sha256Digest } from "./sha256-C-4WXKIu.js";
+import { n as parseSupportSession, t as decideSupportSession } from "./support-session-BsmPCbz8.js";
+import { i as delegatedPermissions, n as coveredByDelegation } from "./delegation-CDB6_keF.js";
+import { _ as listPlans, a as authenticated, c as plan, f as definePlans, g as isRole, h as isPlan, i as assurance, l as relation, m as findRole, n as anyone, p as defineRoles, s as inherit, t as actor, v as listRoles } from "./grantee-Dke-9rd1.js";
+import { o as isRoleName, r as definePolicy, u as separationConflicts } from "./policy-CLQ8__GF.js";
 import { t as requiresApproval } from "./approval-required-TzNB9oQA.js";
-import { a as mergeHostedGrants, i as memoryPolicySource, n as hostedPolicies, o as parsePolicyDocument, r as isPortableCondition, s as policyDocumentFromClaims } from "./hosted-B46-5LYE.js";
-import { n as OPERATION_RISKS, r as isOperationRisk, t as definePermissions } from "./permissions-B-wCP5ZC.js";
-import { C as validateCustomRole, D as activate, N as APPROVAL_POLICY_UNAVAILABLE, O as breakGlass, b as resolveCustomRole, d as customRoleClaim, k as supportAccess } from "./evaluate-CNClBvcj.js";
-import { _ as isExternallyManaged, g as countHolders, h as composeMemberships, m as claimsFirst } from "./instance-snapshot-BOEhcqIF.js";
-import { t as whoCan } from "./who-can-DWBAcaCQ.js";
-import { n as parseSnapshot } from "./snapshot-B7DkYg6g.js";
-import { c as snapshotFromClaims, o as signSnapshot } from "./where-scope-C9vfEphl.js";
-import { t as deliveryEvent } from "./delivery-event-xX4obB8F.js";
-import { n as fromSnapshot, t as emptySnapshot } from "./from-snapshot-CTCMsFZk.js";
-import { t as parseLocalSnapshotManifest } from "./parse-local-manifest-CVSs6J9I.js";
-import { n as getPermDockSync, t as getPermDock } from "./permdock-BrAscV28.js";
-import { n as wrapPermDock } from "./wrap-gX61EtpB.js";
-import { C as EVENT_SCHEMA_IDS, S as DIRECTORY_EVENT_SCHEMA, T as SINK_EVENT_SCHEMAS, _ as AUTOMATION_EVENT_SCHEMA, a as accessEvent, b as DECISION_EVENT_SCHEMA, c as credentialEvent, d as membershipEvent, f as memoryDecisionSink, g as ACCESS_EVENT_SCHEMA, h as toCloudEvent, i as RESERVED_CLOUD_EVENT_TYPES, m as supportSessionEvent, n as CLOUDEVENTS_CONTENT_TYPE, o as automationEvent, p as signDecisionBatch, r as CLOUD_EVENT_TYPES, s as cloudEventType, t as CLOUDEVENTS_BATCH_CONTENT_TYPE, v as CATALOG_EVENT_SCHEMA, w as MEMBERSHIP_EVENT_SCHEMA, x as DELIVERY_EVENT_SCHEMA, y as CREDENTIAL_EVENT_SCHEMA } from "./sink-BEZSlMS_.js";
-import { a as parseSinkEvent, i as parseCloudEventBatch, n as parseCatalogEventData, o as parseSinkEvents, r as parseCloudEvent, t as catalogFingerprint } from "./catalog-fingerprint-CCP0-yQS.js";
-import { i as toOcsf, n as accessToOcsf, t as OCSF_VERSION } from "./ocsf-BFp-PZZA.js";
-import { a as parseCapability, c as signCapability, i as linkPolicyViolation, o as parseCapabilityClaim, t as capabilityFromClaims } from "./capability-N1K9IpqS.js";
-import { a as decideCredential, n as credentialPolicyViolation, o as isFeedId, s as parseCredential, t as credentialDelegation } from "./credential-BcoiejpY.js";
-export { ACCESS_EVENT_SCHEMA, APPROVAL_POLICY_UNAVAILABLE, AUTOMATION_EVENT_SCHEMA, CATALOG_EVENT_SCHEMA, CLOUDEVENTS_BATCH_CONTENT_TYPE, CLOUDEVENTS_CONTENT_TYPE, CLOUD_EVENT_TYPES, CREDENTIAL_EVENT_SCHEMA, CSV_COLUMNS, DECISION_EVENT_SCHEMA, DELIVERY_EVENT_SCHEMA, DIRECTORY_EVENT_SCHEMA, EVENT_SCHEMA_IDS, MEMBERSHIP_EVENT_SCHEMA, OCSF_VERSION, OPERATION_RISKS, PermDockApprovalRequiredError, PermDockDeniedError, PermDockRevokedError, PermDockValidationError, RESERVED_CLOUD_EVENT_TYPES, SINK_EVENT_SCHEMAS, accessEvent, accessToOcsf, activate, actor, allOf, allow, anyOf, anyone, approvalPolicies, arazzoFindings, assurance, authenticated, automationEvent, breakGlass, capabilityFromClaims, catalogFingerprint, claimsFirst, cloudEventType, composeMemberships, context, countHolders, coveredByDelegation, credentialDelegation, credentialEvent, credentialPolicyViolation, crud, customRoleClaim, customRoleSource, decideAutomation, decideCredential, decideRoleChange, decideSupportSession, defineApp, defineOperations, definePermissions, definePlans, definePolicy, defineRoles, delegatedPermissions, deliveryEvent, deny, describe, emptySnapshot, findPermission, findRole, formerKeys, fromSnapshot, getPermDock, getPermDockSync, getResource, hasConditionOp, holder, hostedPolicies, inherit, isCondition, isConditionDate, isConditionRef, isExternallyManaged, isFeedId, isOperationRisk, isPermission, isPlan, isPortableCondition, isRole, isSqlFunctionField, limits, linkPolicyViolation, listPermissions, listPlans, listRoles, localSnapshotManifest, mayAccess, membershipEvent, memoryApprovalPolicySource, memoryAutomationSource, memoryCustomRoleSource, memoryDecisionSink, memoryEntitlementSource, memoryLimitStore, memoryMembershipSource, memoryPolicySource, memoryPrincipalSource, memoryRelationSource, memoryRevocationFeed, memorySettingsSource, memorySnapshotSource, mergeHostedGrants, mergePermissions, normalizeApproval, normalizeAssurance, opaque, parseAutomation, parseCapability, parseCapabilityClaim, parseCatalogEventData, parseCloudEvent, parseCloudEventBatch, parseCredential, parseLocalSnapshotManifest, parsePermDockDigest, parsePolicyDocument, parseSinkEvent, parseSinkEvents, parseSnapshot, parseSupportSession, plan, policyDocumentFromClaims, principal, readable, relation, requiredPlans, requiresApproval, resolveCustomRole, resource, role, separationConflicts, shadowMode, signCapability, signDecisionBatch, signPolicyDocument, signSnapshot, simulateArazzo, snapshotFor, snapshotFromClaims, sqlFunction, stripeEntitlementSource, supportAccess, supportSessionEvent, toCloudEvent, toCsvRow, toOcsf, user, validateApprovalPolicy, validateCustomRole, whoCan, wrapPermDock, writable };
+import { a as hostedPolicies, c as mergeHostedGrants, l as parsePolicyDocument, o as isPortableCondition, s as memoryPolicySource, u as policyDocumentFromClaims } from "./hosted-D0IzESu_.js";
+import { n as OPERATION_RISKS, r as isOperationRisk, t as definePermissions } from "./permissions-CVXmRILq.js";
+import { A as breakGlass, F as APPROVAL_POLICY_UNAVAILABLE, T as validateCustomRole, b as parseCustomRoleEntry, d as customRoleClaim, j as supportAccess, k as activate, x as resolveCustomRole } from "./evaluate-Dd8Ta0Ie.js";
+import { _ as claimsFirst, b as isExternallyManaged, v as composeMemberships, y as countHolders } from "./instance-snapshot--JWiTrvO.js";
+import { t as whoCan } from "./who-can-rI7dCR9Q.js";
+import { n as parseSnapshot } from "./snapshot-CXlzi69u.js";
+import { l as snapshotClaims, s as signSnapshot, u as snapshotFromClaims } from "./where-scope-DlCdCM_8.js";
+import { t as deliveryEvent } from "./delivery-event-JioK5YbS.js";
+import { n as fromSnapshot, t as emptySnapshot } from "./from-snapshot-DCakWRsr.js";
+import { t as parseLocalSnapshotManifest } from "./parse-local-manifest-DEiCF4ah.js";
+import { n as getPermDockSync, t as getPermDock } from "./permdock-L-_I_3zP.js";
+import { n as wrapPermDock } from "./wrap-B2wziJI_.js";
+import { C as EVENT_SCHEMA_IDS, S as DIRECTORY_EVENT_SCHEMA, T as SINK_EVENT_SCHEMAS, _ as AUTOMATION_EVENT_SCHEMA, a as accessEvent, b as DECISION_EVENT_SCHEMA, c as credentialEvent, d as membershipEvent, f as memoryDecisionSink, g as ACCESS_EVENT_SCHEMA, h as toCloudEvent, i as RESERVED_CLOUD_EVENT_TYPES, m as supportSessionEvent, n as CLOUDEVENTS_CONTENT_TYPE, o as automationEvent, p as signDecisionBatch, r as CLOUD_EVENT_TYPES, s as cloudEventType, t as CLOUDEVENTS_BATCH_CONTENT_TYPE, v as CATALOG_EVENT_SCHEMA, w as MEMBERSHIP_EVENT_SCHEMA, x as DELIVERY_EVENT_SCHEMA, y as CREDENTIAL_EVENT_SCHEMA } from "./sink-D9_vh372.js";
+import { a as parseSinkEvent, i as parseCloudEventBatch, n as parseCatalogEventData, o as parseSinkEvents, r as parseCloudEvent, t as catalogFingerprint } from "./catalog-fingerprint-e6aCWosn.js";
+import { i as toOcsf, n as accessToOcsf, t as OCSF_VERSION } from "./ocsf-TcjRBgIs.js";
+import { a as parseCapability, c as signCapability, i as linkPolicyViolation, o as parseCapabilityClaim, t as capabilityFromClaims } from "./capability-BqX94r07.js";
+import { a as decideCredential, n as credentialPolicyViolation, o as isFeedId, s as parseCredential, t as credentialDelegation } from "./credential-CyyyvCsL.js";
+export { ACCESS_EVENT_SCHEMA, APPROVAL_POLICY_UNAVAILABLE, AUTOMATION_EVENT_SCHEMA, CATALOG_EVENT_SCHEMA, CLOUDEVENTS_BATCH_CONTENT_TYPE, CLOUDEVENTS_CONTENT_TYPE, CLOUD_EVENT_TYPES, CREDENTIAL_EVENT_SCHEMA, CSV_COLUMNS, DECISION_EVENT_SCHEMA, DELIVERY_EVENT_SCHEMA, DIRECTORY_EVENT_SCHEMA, EVENT_SCHEMA_IDS, MEMBERSHIP_EVENT_SCHEMA, OCSF_VERSION, OPERATION_RISKS, PermDockApprovalRequiredError, PermDockDeniedError, PermDockRevokedError, PermDockValidationError, RESERVED_CLOUD_EVENT_TYPES, SINK_EVENT_SCHEMAS, accessEvent, accessToOcsf, activate, actor, allOf, allow, anyOf, anyone, approvalPolicies, arazzoFindings, assurance, authenticated, automationEvent, breakGlass, canonicalJson, capabilityFromClaims, catalogFingerprint, checkRoleChange, claim, claimsFirst, cloudEventType, composeMemberships, context, countHolders, coveredByDelegation, credentialDelegation, credentialEvent, credentialPolicyViolation, crud, customRoleClaim, customRoleSource, decideAutomation, decideCredential, decideRoleChange, decideSupportSession, defineApp, defineOperations, definePermissions, definePlans, definePolicy, defineRoles, delegatedPermissions, deliveryEvent, deny, describe, emptySnapshot, findPermission, findRole, formerKeys, fromSnapshot, getPermDock, getPermDockSync, getResource, hasConditionOp, holder, hostedPolicies, inherit, isCondition, isConditionDate, isConditionRef, isExternallyManaged, isFeedId, isOperationRisk, isPermission, isPlan, isPortableCondition, isRole, isRoleName, isSqlFunctionField, limits, linkPolicyViolation, listPermissions, listPlans, listRoles, localSnapshotManifest, mayAccess, membershipEvent, memoryApprovalPolicySource, memoryAutomationSource, memoryCustomRoleSource, memoryDecisionSink, memoryEntitlementSource, memoryLimitStore, memoryMembershipSource, memoryPolicySource, memoryPrincipalSource, memoryRelationSource, memoryRevocationFeed, memorySettingsSource, memorySnapshotSource, mergeHostedGrants, mergePermissions, normalizeApproval, normalizeAssurance, normalizeMembership, normalizeMemberships, opaque, parseAutomation, parseCapability, parseCapabilityClaim, parseCatalogEventData, parseCloudEvent, parseCloudEventBatch, parseCredential, parseCustomRoleEntry, parseLocalSnapshotManifest, parsePermDockDigest, parsePolicyDocument, parseSinkEvent, parseSinkEvents, parseSnapshot, parseSupportSession, plan, policyDocumentFromClaims, principal, readable, relation, requiredPlans, requiresApproval, resolveCustomRole, resolveScope, resource, role, separationConflicts, sha256Digest, shadowMode, signCapability, signDecisionBatch, signPolicyDocument, signSnapshot, simulateArazzo, snapshotClaims, snapshotFor, snapshotFromClaims, sqlFunction, stripeEntitlementSource, supportAccess, supportSessionEvent, toCloudEvent, toCsvRow, toOcsf, user, validateApprovalPolicy, validateCustomRole, whoCan, wrapPermDock, writable };

package/dist/{init-GG6Jh8HD.js → init-Dz_PsHdv.js}

@@ -1,6 +1,6 @@
-import { p as PRESET_DEFAULTS, r as PRESET_FLAGS } from "./preset-DZdU0tne.js";
+import { p as PRESET_DEFAULTS, r as PRESET_FLAGS } from "./preset-BjLzeFpp.js";
 import { t as defineLeaf } from "./command-L8EstFNm.js";
-import { c as given, i as dryRunFlag, s as forceFlag } from "./flags-C3DktBDY.js";
+import { c as given, i as dryRunFlag, s as forceFlag } from "./flags-DXjoTVbS.js";
 //#region src/cli/commands/init.ts
 function optionsOf(key) {
 	return PRESET_FLAGS[key].choices.filter((item) => item.retired !== true).map((item) => item.id);
@@ -48,7 +48,7 @@ const init = defineLeaf({
 		...forceFlag
 	},
 	async run(ctx, { flags }) {
-		const [{ runInit }, { packageManagerOf }] = await Promise.all([import("./init-DeMYsnYJ.js"), import("./peer-CRvC7Hg1.js")]);
+		const [{ runInit }, { packageManagerOf }] = await Promise.all([import("./init-cE3A8aXq.js"), import("./peer-C9LvBCcb.js")]);
 		const agent = await packageManagerOf(ctx.cwd);
 		const selection = {
 			archetype: flags.archetype,
@@ -79,7 +79,7 @@ const presetDecode = defineLeaf({
 	positionals: presetCode,
 	flags: {},
 	async run(_ctx, { args }) {
-		const { runPreset } = await import("./init-DeMYsnYJ.js");
+		const { runPreset } = await import("./init-cE3A8aXq.js");
 		return runPreset("decode", args["code"] ?? "");
 	}
 });
@@ -87,7 +87,7 @@ const presetUrl = defineLeaf({
 	positionals: presetCode,
 	flags: {},
 	async run(_ctx, { args }) {
-		const { runPreset } = await import("./init-DeMYsnYJ.js");
+		const { runPreset } = await import("./init-cE3A8aXq.js");
 		return runPreset("url", args["code"] ?? "");
 	}
 });

package/dist/{init-DeMYsnYJ.js → init-cE3A8aXq.js}

@@ -1,7 +1,8 @@
-import { n as CliError } from "./errors-CWTY6uih.js";
-import { a as decodePreset, g as resolvePreset, i as presetFlags, n as generatePreset, o as encodePreset } from "./preset-DZdU0tne.js";
-import { t as addLine } from "./peer-C8swJ2GH.js";
-import { t as applyFiles } from "./files-C5ZI27eV.js";
+import { n as CliError } from "./errors-Vpu6rKHl.js";
+import { a as decodePreset, g as resolvePreset, i as presetFlags, n as generatePreset, o as encodePreset } from "./preset-BjLzeFpp.js";
+import { a as nonEmptyOr } from "./output-tkju6U7R.js";
+import { t as addLine } from "./peer-Q0fuZ6hx.js";
+import { t as applyFiles } from "./files-B3AA05f1.js";
 import { existsSync } from "node:fs";
 import { join } from "node:path";
 //#region src/cli/init.ts
@@ -13,11 +14,10 @@ function decoded(code, command) {
 	return preset;
 }
 /**
-* Writes the preset's owned files into `cwd` and lists what to install.
-* An existing file is kept unless `force` is set, so `init` never
-* overwrites code the application already changed. It installs nothing
-* and calls no network: the package manager and shadcn commands are
-* printed for the person to run.
+* Writes the preset's owned files into `cwd` and lists what to install. An
+* existing file is kept unless `force` is set, so `init` never overwrites code
+* the application already changed. It installs nothing and calls no network:
+* the package manager and shadcn commands are printed for the person to run.
 */
 function runInit(options) {
 	const preset = typeof options.preset === "string" ? decoded(options.preset, "init") : resolvePreset(options.preset);
@@ -85,7 +85,7 @@ function runPreset(action, code) {
 	return {
 		code: 0,
 		output: `${[
-			...Object.entries(preset).map(([key, value]) => `  ${key.padEnd(12)} ${Array.isArray(value) ? value.join(", ") || "none" : String(value)}`),
+			...Object.entries(preset).map(([key, value]) => `  ${key.padEnd(12)} ${Array.isArray(value) ? nonEmptyOr(value.join(", "), "none") : String(value)}`),
 			"",
 			`  permdock init ${presetFlags(preset).join(" ")}`
 		].join("\n")}\n`,

package/dist/{instance-options-BsVpyGIk.d.ts → instance-options-B0KXqTrJ.d.ts}

@@ -1,10 +1,10 @@
-import { i as PermDockOptions } from "./permdock-SV8ZINYT.js";
+import { o as PermDockOptions } from "./permdock-B6Sf4T_S.js";
 //#region src/core/instance-options.d.ts
 type InstanceKey = "memberships" | "relations" | "entitlements" | "customRoles" | "policies" | "approvalPolicies" | "sink" | "limits" | "principals";
 /**
- * The data sources an adapter passes through to every instance it creates.
- * Each adapter's options type extends this, so a source added to core
- * reaches every adapter without a per-adapter change.
+ * The data sources an adapter passes through to every instance it creates. Each
+ * adapter's options type extends this, so a source added to core reaches every
+ * adapter without a per-adapter change.
  */
 type InstanceOptions = Pick<PermDockOptions, InstanceKey>;
 //#endregion

package/dist/{instance-snapshot-BOEhcqIF.js → instance-snapshot--JWiTrvO.js}

@@ -1,21 +1,21 @@
 import { t as compact } from "./compact-CAf557ZB.js";
-import { n as freezeDeep } from "./freeze-CrU8nQeX.js";
-import { a as hasConditionOp } from "./refs-K6eWUJ0H.js";
-import { o as sameId } from "./expiry-D4_YKRKD.js";
-import { a as getResource, c as listPermissions } from "./permission-registry-Br4jSNVi.js";
-import { n as isThenable } from "./thenable-yD7SabqG.js";
-import { u as isPrincipalRelation } from "./resource-relations-D_jw0BFx.js";
-import { p as nowSeconds, s as instantAt } from "./time-DkWjdL98.js";
-import { t as canonicalJson } from "./canonical-json-BC8_nMTw.js";
-import { c as rootScope, d as scopeList, i as keepsPermission, m as tenantOf, o as resolveScope } from "./scopes-CUPSjo9q.js";
-import { a as readOnlyActorRefuses, i as delegatedPermissions, r as coversRequirements } from "./delegation-j6-rc37o.js";
-import { b as synthesiseRole, m as findRole, o as flattenGrantee, v as listRoles, x as treeXSchema, y as sourceRoleMeta } from "./grantee-hxrUsbpM.js";
-import { c as nowSeconds$1, d as resolveActiveTenant, l as partitionsOf, p as scopeField, r as isMembershipExpired } from "./tenancy-DN2QAx9z.js";
-import { a as levelCondition, o as levelNames, r as grantList, t as declaredRoleNames } from "./policy-DbM5YYtV.js";
-import { t as byCodePoint } from "./compare-pfyVnBjE.js";
-import { A as contactMayUse, S as tenantCustomRoles, T as emptyListeners, _ as isSharedCustomRole, a as expandRoleNames, b as resolveCustomRole, g as holdsGlobalCustomRole, h as holdsCustomRole, l as ceilingGrants, m as customRoleScope, n as requirementCondition, p as customRoleOf, t as evaluate, u as customGrantsFor, x as roleAllowKeys } from "./evaluate-CNClBvcj.js";
-import { n as matchGrantee, t as combineWhere } from "./grantee-match-DbENBHLB.js";
-import { t as buildSnapshot } from "./snapshot-B7DkYg6g.js";
+import { n as freezeDeep } from "./freeze-jjan0lCv.js";
+import { o as hasConditionOp } from "./refs-C8BKxc_e.js";
+import { o as sameId } from "./expiry-6XByK0dm.js";
+import { a as getResource, c as listPermissions } from "./permission-registry-B8tYxPIt.js";
+import { n as isThenable } from "./thenable-BNSM1U2R.js";
+import { u as isPrincipalRelation } from "./resource-relations-8-pCScBO.js";
+import { p as nowSeconds, s as instantAt } from "./time-nR1JesoH.js";
+import { t as canonicalJson } from "./canonical-json-DwilZ1iB.js";
+import { f as scopeList, h as tenantOf, i as keepsPermission, l as rootScope, s as resolveScope } from "./scopes-0Up_UA2t.js";
+import { a as readOnlyActorRefuses, i as delegatedPermissions, r as coversRequirements } from "./delegation-CDB6_keF.js";
+import { b as synthesiseRole, m as findRole, o as flattenGrantee, v as listRoles, x as treeXSchema, y as sourceRoleMeta } from "./grantee-Dke-9rd1.js";
+import { t as byCodePoint } from "./compare-DTfyUunF.js";
+import { c as nowSeconds$1, d as resolveActiveTenant, l as partitionsOf, p as scopeField, r as isMembershipExpired } from "./tenancy-5d1zVBvK.js";
+import { c as levelNames, i as grantList, n as declaredRoleNames, s as levelCondition, t as coveredLevels } from "./policy-CLQ8__GF.js";
+import { C as tenantCustomRoles, D as emptyListeners, M as contactMayUse, S as roleAllowKeys, _ as isSharedCustomRole, a as expandRoleNames, g as holdsGlobalCustomRole, h as holdsCustomRole, l as ceilingGrants, m as customRoleScope, n as requirementCondition, p as customRoleOf, t as evaluate, u as customGrantsFor, x as resolveCustomRole } from "./evaluate-Dd8Ta0Ie.js";
+import { n as matchGrantee, t as combineWhere } from "./grantee-match-7RZZvoT_.js";
+import { t as buildSnapshot } from "./snapshot-CXlzi69u.js";
 //#region src/core/memberships.ts
 /** Two memberships are the same row when everything but `roles` matches. */
 function identity(membership) {
@@ -41,8 +41,8 @@ function identity(membership) {
 /**
 * Merges memberships from several sources: entries naming the same instance
 * with the same `via`, expiry, owner and seats become one entry with the union
-* of their roles. Entries that differ in any of those stay separate, so a
-* staff role and a contact role in one instance keep their own `via`.
+* of their roles. Entries that differ in any of those stay separate, so a staff
+* role and a contact role in one instance keep their own `via`.
 */
 function mergeMemberships(lists) {
 	const merged = /* @__PURE__ */ new Map();
@@ -59,8 +59,8 @@ function mergeMemberships(lists) {
 function all(values) {
 	return values.some((value) => isThenable(value)) ? Promise.all(values) : values;
 }
-function then(value, next) {
-	return isThenable(value) ? Promise.resolve(value).then(next) : next(value);
+function then(value, map) {
+	return isThenable(value) ? Promise.resolve(value).then(map) : map(value);
 }
 /**
 * One `MembershipSource` over several: memberships are merged and
@@ -71,7 +71,11 @@ function then(value, next) {
 function composeMemberships(sources) {
 	const listing = sources.filter((source) => source.list !== void 0);
 	const versioned = sources.filter((source) => source.version !== void 0);
+	const rolesReaders = sources.filter((source) => source.globalRolesFor !== void 0);
 	return {
+		...rolesReaders.length === 0 ? {} : { globalRolesFor(principal) {
+			return then(all(rolesReaders.map((source) => source.globalRolesFor?.(principal) ?? [])), (lists) => [...new Set(lists.flat())]);
+		} },
 		membershipsFor(principal, options) {
 			return then(all(sources.map((source) => source.membershipsFor(principal, options))), (lists) => mergeMemberships(lists));
 		},
@@ -105,10 +109,10 @@ function asMembershipSource(input) {
 	return Array.isArray(input) ? composeMemberships(input) : input;
 }
 /**
-* Trust the memberships the verified token carries, and read `source` only
-* when the token marks them truncated. With `version`, a token minted before
-* the latest membership change is stale for the policy's `fresh` permissions,
-* or with `onStale: 'reread'` has its memberships read from `source` instead.
+* Trust the memberships the verified token carries, and read `source` only when
+* the token marks them truncated. With `version`, a token minted before the
+* latest membership change is stale for the policy's `fresh` permissions, or
+* with `onStale: 'reread'` has its memberships read from `source` instead.
 */
 function claimsFirst(source, options = {}) {
 	const inner = asMembershipSource(source);
@@ -117,20 +121,24 @@ function claimsFirst(source, options = {}) {
 		membershipsFor: (principal, query) => inner.membershipsFor(principal, query),
 		...inner.list === void 0 ? {} : { list: (query) => inner.list?.(query) ?? [] },
 		...version === void 0 ? {} : { version },
+		...inner.globalRolesFor === void 0 ? {} : { globalRolesFor: (principal) => inner.globalRolesFor?.(principal) ?? [] },
 		...options.onStale === "reread" ? { onStale: "reread" } : {},
 		claimsFirst: true
 	};
 }
-/** Whether the identity provider owns `membership`: the application must not add, change or remove it. */
+/**
+* Whether the identity provider owns `membership`: the application must not
+* add, change or remove it.
+*/
 function isExternallyManaged(membership) {
 	return membership.managedBy === "idp";
 }
 /**
-* How many principals hold `role` in one scope instance now, from the
-* source's member list (`MembershipSource.list`): live memberships of exactly
-* that scope and instance, each principal counted once. The `holders` a
-* `decideRoleChange` with `min`, `max` or `transferOnly` needs. `undefined`
-* when the source cannot list or the read fails, which that check denies.
+* How many principals hold `role` in one scope instance now, from the source's
+* member list (`MembershipSource.list`): live memberships of exactly that scope
+* and instance, each principal counted once. The `holders` a `decideRoleChange`
+* with `min`, `max` or `transferOnly` needs. `undefined` when the source cannot
+* list or the read fails, which that check denies.
 */
 async function countHolders(source, query) {
 	const composed = asMembershipSource(source);
@@ -180,8 +188,8 @@ function mayHoldManaged(policy, role, membership) {
 /**
 * Drops every role a membership's kind may not hold (fail-closed: a missing
 * `via` is no kind) and every non-assignable role on an identity-provider
-* membership. Global roles have no kind, so a role with `for` held globally
-* is dropped too.
+* membership. Global roles have no kind, so a role with `for` held globally is
+* dropped too.
 */
 function applyRoleKinds(policy, roles, memberships) {
 	const kinds = policy.roles.some((binding) => binding.for !== void 0);
@@ -203,7 +211,10 @@ function applyRoleKinds(policy, roles, memberships) {
 function usesAssigns(policy) {
 	return policy.roles.some((binding) => binding.assigns !== void 0);
 }
-/** Declared role names in declaration order: bindings first, then vocabulary-only leaves. */
+/**
+* Declared role names in declaration order: bindings first, then
+* vocabulary-only leaves.
+*/
 function declarationOrder(policy) {
 	const names = policy.roles.map((binding) => binding.name);
 	const seen = new Set(names);
@@ -214,9 +225,9 @@ function declarationOrder(policy) {
 	return names;
 }
 /**
-* Each role's depth in the `assigns` graph: a role nobody else assigns is 0,
-* a role another assigns sits one below its deepest assigner. Cycles stop
-* after one pass per role.
+* Each role's depth in the `assigns` graph: a role nobody else assigns is 0, a
+* role another assigns sits one below its deepest assigner. Cycles stop after
+* one pass per role.
 */
 function assignDepths(policy) {
 	const names = declarationOrder(policy);
@@ -257,7 +268,10 @@ function audiencesOf(policy, names) {
 	}
 	return out;
 }
-/** Whether `membership` is the instance itself or one of its ancestors named in `within`. */
+/**
+* Whether `membership` is the instance itself or one of its ancestors named in
+* `within`.
+*/
 //#endregion
 //#region src/core/held-roles.ts
 /**
@@ -288,7 +302,10 @@ function roleLeaf(policy, name) {
 }
 //#endregion
 //#region src/core/snapshot-grants.ts
-/** A grant on a relation with a `period` is decided on the server, where the clock is. */
+/**
+* A grant on a relation with a `period` is decided on the server, where the
+* clock is.
+*/
 function periodBound(policy, grant) {
 	const relations = policy.resources.get(grant.permission.resource)?.relations;
 	return flattenGrantee(grant.to).some((item) => {
@@ -325,8 +342,8 @@ function graphAware(grant, where) {
 	}));
 }
 /**
-* `where()` keeps a grant that is server-only because it reads the graph:
-* its `related` nodes compile to subqueries given relation mappings.
+* `where()` keeps a grant that is server-only because it reads the graph: its
+* `related` nodes compile to subqueries given relation mappings.
 */
 function whereGrant(grant) {
 	return grant.graph === true ? freezeDeep({
@@ -335,8 +352,8 @@ function whereGrant(grant) {
 	}) : grant;
 }
 /**
-* Every grant the subject may reach, once per membership that holds all of
-* its scoped roles, so a client can check that membership's tenant, team or
+* Every grant the subject may reach, once per membership that holds all of its
+* scoped roles, so a client can check that membership's tenant, team or
 * resource. A scoped role held only globally reaches nothing.
 */
 function collectSnapshotGrants(policy, subject, customRoles, now = nowSeconds$1(), customGrants = customGrantsFor(policy, customRoles), mode = "held") {
@@ -402,24 +419,26 @@ function assignableCandidates(policy) {
 	return rankRoles(policy, [...new Set(names)]).map((name) => roleLeaf(policy, name));
 }
 /**
-* The levels a held allow of a permission covers: its own `level`, every
-* level when it has no row condition, or the levels whose condition equals
-* its condition.
+* The levels a held allow of a permission covers: its own `level`, every level
+* when it has no row condition, or the levels whose condition equals its
+* condition; with `orderedLevels`, also every narrower level.
 */
 function heldLevels(policy, grant, names) {
-	if (grant.level !== void 0) return [grant.level];
+	const resource = grant.permission.resource;
+	if (grant.level !== void 0) return coveredLevels(policy, resource, [grant.level]);
 	if (grant.where === void 0) return names;
 	const held = canonicalJson(grant.where);
-	return names.filter((name) => {
-		const condition = levelCondition(policy, grant.permission.resource, name);
+	return coveredLevels(policy, resource, names.filter((name) => {
+		const condition = levelCondition(policy, resource, name);
 		return condition !== void 0 && canonicalJson(condition) === held;
-	});
+	}));
 }
 /**
 * What the subject may hand out in `tenant`: declared assignable roles and the
-* tenant custom-role ceiling, narrowed by `allowed` (`CustomRoleSource.assignable`),
-* then intersected with the permissions the subject holds there. Holding a
-* role or a granted permission with `meta.manageRoles` lifts the intersection.
+* tenant custom-role ceiling, narrowed by `allowed`
+* (`CustomRoleSource.assignable`), then intersected with the permissions the
+* subject holds there. Holding a role or a granted permission with
+* `meta.manageRoles` lifts the intersection.
 */
 function assignableIn(policy, subject, customRoles, customGrants, tenant, allowed, now = nowSeconds$1(), global = false) {
 	const principal = subject.principal;
@@ -542,7 +561,10 @@ function assignableCustomRoles(policy, customRoles, tenant, declared, mayHandOut
 }
 //#endregion
 //#region src/core/instance-snapshot.ts
-/** The one path from a resolved subject to a `Snapshot`; pure apart from the default clock. */
+/**
+* The one path from a resolved subject to a `Snapshot`; pure apart from the
+* default clock.
+*/
 function snapshotOf(policy, subject, options) {
 	const now = options.now ?? nowSeconds$1();
 	const customGrants = options.customGrants ?? customGrantsFor(policy, options.customRoles);
@@ -577,7 +599,10 @@ function snapshotOf(policy, subject, options) {
 		}
 	}));
 }
-/** The policy's scopes as snapshots and `permdock cloud push` carry them, with the resources each partitions. */
+/**
+* The policy's scopes as snapshots and `permdock cloud push` carry them, with
+* the resources each partitions.
+*/
 function snapshotScopes(policy) {
 	if (policy.scopes.length === 0) return;
 	const resources = [...policy.resources.values()];
@@ -598,4 +623,4 @@ function snapshotScopes(policy) {
 	});
 }
 //#endregion
-export { isExternallyManaged as _, whereGrant as a, applyRoleKinds as c, rankRoles as d, usesAssigns as f, countHolders as g, composeMemberships as h, collectSnapshotGrants as i, audiencesOf as l, claimsFirst as m, snapshotScopes as n, heldRoleNames as o, asMembershipSource as p, assignableIn as r, roleLeaf as s, snapshotOf as t, bindingOf as u };
+export { claimsFirst as _, heldLevels as a, isExternallyManaged as b, heldRoleNames as c, audiencesOf as d, bindingOf as f, asMembershipSource as g, usesAssigns as h, assignableIn as i, roleLeaf as l, roleMeta as m, snapshotScopes as n, collectSnapshotGrants as o, rankRoles as p, assignableCandidates as r, whereGrant as s, snapshotOf as t, applyRoleKinds as u, composeMemberships as v, countHolders as y };

package/dist/{instant-BluqDvyS.js → instant-DK3Iz83e.js}

@@ -2,8 +2,8 @@
 const ISO_INSTANT = /^(\d{4}-\d{2}-\d{2})(?:[T ](\d{2}:\d{2}(?::\d{2}(?:\.\d{1,9})?)?)(Z|[+-]\d{2}(?::?\d{2})?)?)?$/u;
 /**
 * Milliseconds since the epoch for an ISO 8601 date or date-time, or
-* `undefined`. A date-time without a zone and a bare date are UTC, the same
-* in memory, in the ORM compilers and in generated SQL.
+* `undefined`. A date-time without a zone and a bare date are UTC, the same in
+* memory, in the ORM compilers and in generated SQL.
 */
 function isoInstant(value) {
 	const match = ISO_INSTANT.exec(value);

package/dist/{internals-Dk8A8fX3.js → internals-B3IgHrvo.js}

@@ -1,12 +1,15 @@
 //#region src/core/internals.ts
 const INTERNALS = Symbol.for("permdock.internals");
-/** Attaches `internals` to `instance` as a non-enumerable member; call before freezing. */
+/**
+* Attaches `internals` to `instance` as a non-enumerable member; call before
+* freezing.
+*/
 function attachInternals(instance, internals) {
 	Object.defineProperty(instance, INTERNALS, { value: internals });
 }
 /**
-* The internals of a server instance, or `undefined` for an instance built
-* from a snapshot or one that is not PermDock's. A feature function treats
+* The internals of a server instance, or `undefined` for an instance built from
+* a snapshot or one that is not PermDock's. A feature function treats
 * `undefined` as a check it cannot answer and denies with `unsupported`.
 */
 function internalsOf(permdock) {

package/dist/{json-schema-B-vAwlde.js → json-schema-BPGa-RjQ.js}

@@ -1,5 +1,5 @@
 import { r as isRecord } from "./compact-CAf557ZB.js";
-import { n as isForbiddenKey } from "./paths-DXSHAMIa.js";
+import { n as isForbiddenKey } from "./paths-CUvURzHp.js";
 //#region src/core/json-schema.ts
 function issue(issues, path, message) {
 	issues.push({
@@ -64,7 +64,10 @@ function resolveRef(root, ref) {
 	if (target === void 0) throw new TypeError(`Unsupported or unknown $ref ${ref}`);
 	return target;
 }
-/** Validates a `copyJson` result against `node`, reading `$ref` targets from `root`. */
+/**
+* Validates a `copyJson` result against `node`, reading `$ref` targets from
+* `root`.
+*/
 function checkSchema(node, value, path, issues, root = node) {
 	if (node.$ref !== void 0) {
 		checkSchema(resolveRef(root, node.$ref), value, path, issues, root);
@@ -130,7 +133,10 @@ function checkSchema(node, value, path, issues, root = node) {
 		else if (node.additionalProperties !== void 0) checkSchema(node.additionalProperties, value[key], [...path, key], issues, root);
 	}
 }
-/** The path of the first `__proto__`, `constructor` or `prototype` key in `value`, if any. */
+/**
+* The path of the first `__proto__`, `constructor` or `prototype` key in
+* `value`, if any.
+*/
 function forbiddenKeyPath(value, path = []) {
 	if (value === null || typeof value !== "object") return;
 	for (const [key, child] of Object.entries(value)) {

package/dist/{json-schema-CN_iLFH2.d.ts → json-schema-BfXgnRNT.d.ts}

@@ -1,10 +1,10 @@
 import { StandardSchemaV1 } from "@standard-schema/spec";
 //#region src/core/json-schema.d.ts
 /**
- * The JSON Schema 2020-12 keywords the package's own schemas use;
- * `checkSchema` interprets exactly these. `$ref` resolves only `#/$defs/<name>`
- * against the root node. Annotations (`title`, `description`, `format`) are
- * ignored, so a `format` always sits next to a `pattern` that enforces it.
+ * The JSON Schema 2020-12 keywords the package's own schemas use; `checkSchema`
+ * interprets exactly these. `$ref` resolves only `#/$defs/<name>` against the
+ * root node. Annotations (`title`, `description`, `format`) are ignored, so a
+ * `format` always sits next to a `pattern` that enforces it.
  */
 type JsonSchemaNode = {
   readonly $schema?: string;