permdock 0.6.0 → 0.8.0

package/dist/{permdock-BrAscV28.js → permdock-L-_I_3zP.js}

@@ -1,31 +1,36 @@
-import { n as isReadonlyArray, t as compact } from "./compact-CAf557ZB.js";
-import { n as freezeDeep, t as freezeCopy } from "./freeze-CrU8nQeX.js";
-import { n as PermDockValidationError } from "./validation-error-ZfUHbKvf.js";
-import { a as deniedMessage, i as approvalMessage, n as PermDockDeniedError, t as PermDockApprovalRequiredError } from "./errors-BKy0EfhN.js";
-import { t as attachInternals } from "./internals-Dk8A8fX3.js";
-import { a as getResource, c as listPermissions, g as formerScopes } from "./permission-registry-Br4jSNVi.js";
-import { n as isThenable } from "./thenable-yD7SabqG.js";
-import { i as readAppData } from "./app-data-MuyzVqX8.js";
-import { a as normalizeMemberships, d as scopeList, m as tenantOf } from "./scopes-CUPSjo9q.js";
-import { o as pickVisible, s as sanitizeContext } from "./validity-CZ7-y0Cj.js";
-import { c as nowSeconds, d as resolveActiveTenant, m as tenantsOf, p as scopeField, t as heldRoleNamesIn, u as relatesTo } from "./tenancy-DN2QAx9z.js";
-import { l as policyX } from "./policy-DbM5YYtV.js";
-import { E as finish, M as isContact, T as emptyListeners, i as customRolesFor, j as contactMemberships, o as roleSourceFor, r as assignableNamesFor, s as sourceName, t as evaluate, u as customGrantsFor, w as emitSafe } from "./evaluate-CNClBvcj.js";
-import { a as whereGrant, c as applyRoleKinds, i as collectSnapshotGrants, l as audiencesOf, o as heldRoleNames, p as asMembershipSource, r as assignableIn, s as roleLeaf, t as snapshotOf } from "./instance-snapshot-BOEhcqIF.js";
-import { r as relationReader, t as pendingRelations } from "./relations-BnCWnJGI.js";
-import { r as snapshotGrant } from "./snapshot-B7DkYg6g.js";
-import { i as decideForTarget, n as mayUse, o as signSnapshot, r as permittedIds, t as whereFromGrants } from "./where-scope-C9vfEphl.js";
+import { n as isReadonlyArray, r as isRecord, t as compact } from "./compact-CAf557ZB.js";
+import { n as freezeDeep, t as freezeCopy } from "./freeze-jjan0lCv.js";
+import { n as PermDockValidationError } from "./validation-error-CYg2kJEw.js";
+import { a as deniedMessage, i as approvalMessage, n as PermDockDeniedError, t as PermDockApprovalRequiredError } from "./errors-B6R_lg2a.js";
+import { t as attachInternals } from "./internals-B3IgHrvo.js";
+import { _ as keyToScope, a as getResource, c as listPermissions, g as formerScopes } from "./permission-registry-B8tYxPIt.js";
+import { n as isThenable } from "./thenable-BNSM1U2R.js";
+import { i as readAppData } from "./app-data-UNNm07jV.js";
+import { f as scopeList, h as tenantOf, o as normalizeMemberships } from "./scopes-0Up_UA2t.js";
+import { o as pickVisible, s as sanitizeContext } from "./validity-Buc7w8E9.js";
+import { t as byCodePoint } from "./compare-DTfyUunF.js";
+import { c as nowSeconds, d as resolveActiveTenant, m as tenantsOf, p as scopeField, t as heldRoleNamesIn, u as relatesTo } from "./tenancy-5d1zVBvK.js";
+import { d as policyX } from "./policy-CLQ8__GF.js";
+import { D as emptyListeners, E as emitSafe, N as contactMemberships, O as finish, P as isContact, i as customRolesFor, o as roleSourceFor, r as assignableNamesFor, s as sourceName, t as evaluate, u as customGrantsFor, w as unknownLevelsFor } from "./evaluate-Dd8Ta0Ie.js";
+import { c as heldRoleNames, d as audiencesOf, g as asMembershipSource, i as assignableIn, l as roleLeaf, o as collectSnapshotGrants, s as whereGrant, t as snapshotOf, u as applyRoleKinds } from "./instance-snapshot--JWiTrvO.js";
+import { r as relationReader, t as pendingRelations } from "./relations-BxvRvDHK.js";
+import { i as snapshotGrant } from "./snapshot-CXlzi69u.js";
+import { a as decideForTarget, i as permittedIds, o as deniedFor, r as mayUse, s as signSnapshot, t as whereFromGrants } from "./where-scope-DlCdCM_8.js";
+import { i as decideAllWith, n as canAllWith } from "./checks-CGkP3Z7A.js";
 import { r as isSubject, t as anonymousSubject } from "./subject-BGoM5o8B.js";
 //#region src/core/app.ts
 const APP = Symbol.for("permdock.app");
-/** The app definition bound to `policy` by `defineApp`, or `undefined` for a plain policy. */
+/**
+* The app definition bound to `policy` by `defineApp`, or `undefined` for a
+* plain policy.
+*/
 function appOf(policy) {
 	const value = Reflect.get(policy, APP);
 	return value === void 0 ? void 0 : value;
 }
 /**
-* `options` with the app's values under it, key by key, for an adapter
-* factory to call first: `options = withApp(policy, options)`.
+* `options` with the app's values under it, key by key, for an adapter factory
+* to call first: `options = withApp(policy, options)`.
 */
 function withApp(policy, options) {
 	const app = appOf(policy);
@@ -37,7 +42,10 @@ function withApp(policy, options) {
 }
 //#endregion
 //#region src/core/assert-decision.ts
-/** `assert`'s outcome: the granted decision, or the error a refusal throws after `onDenied` runs. */
+/**
+* `assert`'s outcome: the granted decision, or the error a refusal throws after
+* `onDenied` runs.
+*/
 function assertDecision(policy, subject, permission, data, decision, onDenied) {
 	if (decision.outcome === "granted") return decision;
 	if (onDenied !== void 0) onDenied(decision);
@@ -70,7 +78,10 @@ function assertDecision(policy, subject, permission, data, decision, onDenied) {
 }
 //#endregion
 //#region src/core/instance-env.ts
-/** The environment `derive(options)` builds on: `base` with the sources `options` replaces loaded again. */
+/**
+* The environment `derive(options)` builds on: `base` with the sources
+* `options` replaces loaded again.
+*/
 function deriveEnv(policy, subject, base, relationCache, options) {
 	const scopes = scopeList(policy.scopes);
 	const tenants = tenantsOf(subject.principal, scopes);
@@ -138,13 +149,17 @@ function simulateEvent(policy, subject, env, evaluated) {
 }
 //#endregion
 //#region src/core/instance.ts
-/** Each round reads one more layer: link hops, then the chain, then nested groups. */
+/**
+* Each round reads one more layer: link hops, then the chain, then nested
+* groups.
+*/
 const LOAD_ROUNDS = 48;
 function buildInstance(policy, subject, envBase, team) {
 	const listeners = emptyListeners();
 	const queuedAuth = [...envBase.queuedAuth];
 	const queuedErrors = [...envBase.queuedErrors ?? []];
 	const customGrants = customGrantsFor(policy, envBase.customRoles);
+	const unknownLevels = unknownLevelsFor(policy, envBase.customRoles);
 	const relationCache = envBase.relationCache ?? /* @__PURE__ */ new Map();
 	const relations = relationReader(envBase.relations, relationCache, policy.resources);
 	const assignableAt = (tenant) => assignableIn(policy, subject, envBase.customRoles, customGrants, tenant, tenant === void 0 ? void 0 : envBase.assignable?.get(tenant));
@@ -165,11 +180,25 @@ function buildInstance(policy, subject, envBase, team) {
 	});
 	const decideImpl = (permission, data, options) => evaluate(policy, subject, permission, data, options ?? {}, envFor(options?.call !== "simulate", options?.call === "can"));
 	const explainImpl = (permission, data, options) => {
-		return decideImpl(permission, data, {
+		const explained = decideImpl(permission, data, {
 			...options,
 			call: options?.call ?? "explain",
 			explain: true
 		});
+		const named = unknownLevels.filter((entry) => entry.permission === permission.key);
+		return named.length === 0 ? explained : {
+			...explained,
+			trace: {
+				...explained.trace,
+				skipped: [...explained.trace.skipped, ...named.map((entry) => ({
+					role: entry.role,
+					permission: entry.permission,
+					effect: "allow",
+					why: "unknown-level",
+					level: entry.level
+				}))]
+			}
+		};
 	};
 	const canImpl = (permission, data, options) => {
 		try {
@@ -190,9 +219,44 @@ function buildInstance(policy, subject, envBase, team) {
 	const instance = {
 		can: canImpl,
 		decide: decideImpl,
+		canAll: (checks, options) => canAllWith(canImpl, checks, options),
+		decideAll: (checks, options) => decideAllWith(decideImpl, checks, options),
 		decideEach(permission, rows, options) {
 			return Object.freeze(rows.map((row) => decideImpl(permission, row, options)));
 		},
+		async decideIds(permission, ids, options) {
+			const { data, ...decide } = options;
+			const invalid = () => deniedFor(permission, "validation");
+			let loaded;
+			try {
+				loaded = await data(ids);
+			} catch {
+				return Object.freeze(ids.map(invalid));
+			}
+			const resource = getResource(policy.permissions, permission.resource);
+			const scopes = scopeList(policy.scopes);
+			const root = scopes[0]?.name;
+			const rowOf = (id) => {
+				if (loaded instanceof Map) return loaded.get(id);
+				return isReadonlyArray(loaded) ? loaded.find((row) => isRecord(row) && resource !== void 0 && row[resource.id] === id) : void 0;
+			};
+			const tenantField = root === void 0 ? void 0 : scopeField(resource, root, scopes);
+			const results = [];
+			for (const id of ids) {
+				const row = rowOf(id);
+				if (row === void 0 || row === null) {
+					results.push(invalid());
+					continue;
+				}
+				const tenant = tenantField !== void 0 && isRecord(row) ? row[tenantField] : void 0;
+				const target = typeof tenant === "string" && tenant !== "" ? instance.tenant(tenant) : instance;
+				results.push(target.decide(permission, row, {
+					...decide,
+					trusted: true
+				}));
+			}
+			return Object.freeze(results);
+		},
 		decideFor(principalId, permission, row) {
 			return decideForTarget(subject, envBase.principals, envBase.targets, principalId, permission, row);
 		},
@@ -356,11 +420,13 @@ function buildInstance(policy, subject, envBase, team) {
 				...envBase,
 				relationCache
 			}, team);
+			const activeTenant = resolveActiveTenant(subject.principal, id, scopeList(policy.scopes));
 			return buildInstance(policy, freezeDeep(compact({
 				...subject,
 				principal: compact({
 					...subject.principal,
-					tenant: resolveActiveTenant(subject.principal, id, scopeList(policy.scopes))
+					tenant: activeTenant,
+					unheldTenant: activeTenant === void 0 ? id : void 0
 				})
 			})), {
 				...envBase,
@@ -448,6 +514,30 @@ function buildInstance(policy, subject, envBase, team) {
 //#endregion
 //#region src/core/oauth-scopes.ts
 /**
+* Every OAuth scope a token may carry to the permission keys it reaches: each
+* permission's own scope, the scopes of the keys it was renamed from, and each
+* coarse `oauthScopes` scope. Scopes and keys are sorted by code point. A key
+* outside `permissions` is dropped, so a stale `oauthScopes` entry grants
+* nothing. better-supabase's `delegation.scopes` and the SQL helpers'
+* `rls.tokenScopes` ceiling both read this map.
+*/
+function delegatedScopeMap(permissions, oauthScopes = []) {
+	const delegated = /* @__PURE__ */ new Map();
+	const add = (scope, key) => {
+		const keys = delegated.get(scope) ?? /* @__PURE__ */ new Set();
+		keys.add(key);
+		delegated.set(scope, keys);
+	};
+	const known = /* @__PURE__ */ new Set();
+	for (const permission of permissions) {
+		known.add(permission.key);
+		add(permission.scope, permission.key);
+		for (const former of permission.renamedFrom ?? []) add(keyToScope(former), permission.key);
+	}
+	for (const entry of oauthScopes) for (const key of entry.permissions) if (known.has(key)) add(entry.scope, key);
+	return Object.fromEntries([...delegated.keys()].toSorted(byCodePoint).map((scope) => [scope, [...delegated.get(scope) ?? []].toSorted(byCodePoint)]));
+}
+/**
 * `delegation` with every coarse OAuth scope the policy declares in
 * `oauthScopes` followed by the scopes of the permissions it covers, so the
 * delegation checks downstream match them. The token's scopes stay first and
@@ -464,11 +554,17 @@ function expandOAuthScopes(policy, delegation) {
 		scopes: [...out]
 	};
 }
-/** The coarse scopes the policy declares that cover `permission`, in declaration order. */
+/**
+* The coarse scopes the policy declares that cover `permission`, in declaration
+* order.
+*/
 function coarseScopesFor(policy, permission) {
 	return (policy.oauthScopes ?? []).filter((entry) => entry.permissions.includes(permission.key)).map((entry) => entry.scope);
 }
-/** Every token scope that reaches `permission`: its own, any it was renamed from, and the coarse scopes covering it. */
+/**
+* Every token scope that reaches `permission`: its own, any it was renamed
+* from, and the coarse scopes covering it.
+*/
 function scopesReaching(policy, permission) {
 	return [
 		permission.scope,
@@ -477,9 +573,9 @@ function scopesReaching(policy, permission) {
 	];
 }
 /**
-* The scope an `insufficient_scope` challenge names for `permission`: the
-* first coarse scope that covers it, which the authorization server issues,
-* else the permission's own scope.
+* The scope an `insufficient_scope` challenge names for `permission`: the first
+* coarse scope that covers it, which the authorization server issues, else the
+* permission's own scope.
 */
 function challengeScope(policy, permission) {
 	return coarseScopesFor(policy, permission)[0] ?? permission.scope;
@@ -491,8 +587,8 @@ function hasScope(granted, scopes) {
 //#endregion
 //#region src/core/resolve-subject.ts
 /**
-* The tenant a user API key holds its owner to (`Credential.tenant`): only
-* the memberships inside it count, and no global role.
+* The tenant a user API key holds its owner to (`Credential.tenant`): only the
+* memberships inside it count, and no global role.
 */
 function heldTenantOf(principal) {
 	const credential = principal["credential"];
@@ -546,16 +642,22 @@ function assemblePrincipal(policy, user, options, auth) {
 		}
 	};
 	let stale;
+	let roles;
 	if (principal !== null && source !== void 0 && !fromClaims) {
 		live = true;
 		memberships = read(source, principal);
 	} else if (principal?.memberships !== void 0 && fromClaims && source.onStale === "reread" && source.version !== void 0) {
-		const reread = rereadStale(source, principal, principal.memberships, () => read(source, principal), auth);
+		const reread = rereadStale(source, principal, principal.memberships, () => read(source, principal), auth, source.globalRolesFor === void 0 ? void 0 : () => source.globalRolesFor?.(compact({
+			id: principal.id,
+			kind: principal.kind
+		})) ?? []);
 		memberships = reread.memberships;
 		stale = reread.stale;
+		roles = reread.roles;
 	}
 	return compact({
 		principal,
+		roles,
 		context: contextResult,
 		actor,
 		delegation: expandOAuthScopes(policy, delegation),
@@ -574,7 +676,7 @@ function versionQuery(principal) {
 		memberships: principal.memberships
 	});
 }
-function rereadStale(source, principal, claims, read, auth) {
+function rereadStale(source, principal, claims, read, auth, readRoles) {
 	const claimed = principal.authzVersion;
 	const judge = (current) => typeof claimed === "number" && current !== void 0 && claimed >= current ? "fresh" : "reread";
 	const unknown = () => {
@@ -592,14 +694,39 @@ function rereadStale(source, principal, claims, read, auth) {
 	} catch {
 		freshness = unknown();
 	}
-	if (isThenable(freshness)) return {
-		memberships: freshness.then((found) => found === "reread" ? read() : claims),
-		stale: freshness.then((found) => found === "unknown")
+	const failed = () => {
+		auth.push({
+			reason: "source-threw",
+			source: "memberships",
+			...sourceName(source)
+		});
+		return [];
 	};
-	return {
-		memberships: freshness === "reread" ? read() : claims,
-		stale: freshness === "unknown"
+	const rolesOf = (found) => {
+		if (found !== "reread" || readRoles === void 0) return;
+		try {
+			const roles = readRoles();
+			return isThenable(roles) ? Promise.resolve(roles).catch(failed) : roles;
+		} catch {
+			return failed();
+		}
 	};
+	if (isThenable(freshness)) {
+		const settled = freshness.then((found) => ({
+			found,
+			roles: rolesOf(found)
+		}));
+		return {
+			memberships: settled.then(({ found }) => found === "reread" ? read() : claims),
+			stale: settled.then(({ found }) => found === "unknown"),
+			roles: settled.then(({ roles }) => roles)
+		};
+	}
+	return compact({
+		memberships: freshness === "reread" ? read() : claims,
+		stale: freshness === "unknown",
+		roles: rolesOf(freshness)
+	});
 }
 function finishSubject(policy, assembled, context, input, options, extra) {
 	if (assembled.principal === null) return freezeCopy(compact({
@@ -617,12 +744,14 @@ function finishSubject(policy, assembled, context, input, options, extra) {
 	const roles = held === void 0 ? kinds.roles : [];
 	const memberships = held === void 0 ? kinds.memberships : outsideHeld(held, options) ? [] : kinds.memberships.filter((membership) => tenantOf(membership, scopes) === held);
 	const plans = contact ? [] : [.../* @__PURE__ */ new Set([...assembled.principal.plans ?? [], ...extra.plans])];
+	const activeTenant = contact ? void 0 : activeTenantOf(policy, assembled, memberships, options);
 	const withMemberships = freezeCopy(compact({
 		...assembled.principal,
 		roles,
 		memberships,
 		plans: plans.length > 0 ? plans : contact ? void 0 : assembled.principal.plans,
-		tenant: contact ? void 0 : activeTenantOf(policy, assembled, memberships, options)
+		tenant: activeTenant,
+		unheldTenant: activeTenant === void 0 ? options.tenant : void 0
 	}));
 	return freezeCopy(compact({
 		principal: withMemberships,
@@ -635,7 +764,10 @@ function finishSubject(policy, assembled, context, input, options, extra) {
 		liveSession: assembled.liveSession
 	}));
 }
-/** Runs the policy's membership schema over each `x`; an invalid one is dropped and reported, never the membership. */
+/**
+* Runs the policy's membership schema over each `x`; an invalid one is dropped
+* and reported, never the membership.
+*/
 function checkMembershipX(memberships, schema, auth) {
 	if (schema === void 0) return memberships;
 	let dropped = false;
@@ -760,7 +892,17 @@ function withRequestContext(request, resolved) {
 	};
 }
 function resolveSubject(policy, user, options, auth) {
-	const assembled = assemblePrincipal(policy, user, options, auth);
+	const first = assemblePrincipal(policy, user, options, auth);
+	const apply = (roles) => resolveAssembled(policy, roles === void 0 || first.principal === null ? first : {
+		...first,
+		principal: {
+			...first.principal,
+			roles
+		}
+	}, options, auth);
+	return isThenable(first.roles) ? Promise.resolve(first.roles).then(apply) : apply(first.roles);
+}
+function resolveAssembled(policy, assembled, options, auth) {
 	const memberships = settle(assembled.memberships, [], () => {
 		auth.push({
 			reason: "source-threw",
@@ -803,35 +945,42 @@ function instantiate(codePolicy, subject, options, auth) {
 	const customRoles = customRolesFor(roleSource, tenants, auth, subject.principal === null ? void 0 : subject.principal.roles ?? [], (tenant) => heldRoleNamesIn(subject.principal, scopes, tenant));
 	const assignable = assignableNamesFor(roleSource, tenants, auth);
 	const approvals = options.approvalPolicies?.load(policy, tenants, auth);
-	const build = (roles, names, approvalPolicies) => buildInstance(policy, subject, compact({
-		customRoles: roles,
-		sink: options.sink,
-		limits: options.limits,
-		limitCache: /* @__PURE__ */ new Map(),
-		simulated: false,
-		roleSource,
-		assignable: names,
-		queuedAuth: auth,
-		queuedErrors: errors,
-		relations: options.relations,
-		approvalPolicies,
-		memberships: options.memberships === void 0 ? void 0 : asMembershipSource(options.memberships),
-		principals: options.principals,
-		settings: options.settings,
-		targets: (principal, tenant) => getPermDock(codePolicy, {
-			principal,
-			context: {}
-		}, compact({
-			tenant,
-			memberships: options.memberships,
-			customRoles: options.customRoles,
-			entitlements: options.entitlements,
+	const build = (roles, names, approvalPolicies) => {
+		for (const entry of unknownLevelsFor(policy, roles)) auth.push({
+			reason: "schema",
+			source: "customRoles",
+			cause: `unknown-level: ${entry.role} grants ${entry.permission} at '${entry.level}', which its resource does not declare`
+		});
+		return buildInstance(policy, subject, compact({
+			customRoles: roles,
+			sink: options.sink,
 			limits: options.limits,
-			policies: options.policies,
+			limitCache: /* @__PURE__ */ new Map(),
+			simulated: false,
+			roleSource,
+			assignable: names,
+			queuedAuth: auth,
+			queuedErrors: errors,
 			relations: options.relations,
-			approvalPolicies: options.approvalPolicies
-		}))
-	}));
+			approvalPolicies,
+			memberships: options.memberships === void 0 ? void 0 : asMembershipSource(options.memberships),
+			principals: options.principals,
+			settings: options.settings,
+			targets: (principal, tenant) => getPermDock(codePolicy, {
+				principal,
+				context: {}
+			}, compact({
+				tenant,
+				memberships: options.memberships,
+				customRoles: options.customRoles,
+				entitlements: options.entitlements,
+				limits: options.limits,
+				policies: options.policies,
+				relations: options.relations,
+				approvalPolicies: options.approvalPolicies
+			}))
+		}));
+	};
 	if (isThenable(customRoles) || isThenable(assignable) || isThenable(approvals)) return Promise.all([
 		customRoles,
 		assignable,
@@ -849,8 +998,8 @@ function create(policy, user, given) {
 /**
 * The instance for `user`, built synchronously. Every input must answer
 * synchronously: the subject mapper, `memberships`, `customRoles`,
-* `entitlements`, `approvalPolicies` and the freshness check. One that
-* answers with a Promise throws here; use `getPermDock` for those.
+* `entitlements`, `approvalPolicies` and the freshness check. One that answers
+* with a Promise throws here; use `getPermDock` for those.
 */
 function getPermDockSync(policy, user, options = {}) {
 	const created = create(policy, user, options);
@@ -860,9 +1009,12 @@ function getPermDockSync(policy, user, options = {}) {
 	}
 	return created;
 }
-/** The instance for `user`: waits for every source, then builds it. `getPermDockSync` is the synchronous twin. */
+/**
+* The instance for `user`: waits for every source, then builds it.
+* `getPermDockSync` is the synchronous twin.
+*/
 function getPermDock(policy, user, options = {}) {
 	return Promise.resolve().then(() => create(policy, user, options));
 }
 //#endregion
-export { hasScope as a, withApp as c, challengeScope as i, getPermDockSync as n, scopesReaching as o, resolveSubject as r, APP as s, getPermDock as t };
+export { delegatedScopeMap as a, APP as c, challengeScope as i, withApp as l, getPermDockSync as n, hasScope as o, resolveSubject as r, scopesReaching as s, getPermDock as t };

package/dist/{permission-registry-Br4jSNVi.js → permission-registry-B8tYxPIt.js}

@@ -1,8 +1,8 @@
 import { n as isReadonlyArray, t as compact } from "./compact-CAf557ZB.js";
-import { n as freezeDeep } from "./freeze-CrU8nQeX.js";
-import { i as ownKeys, n as isForbiddenKey, t as assertSafeKey } from "./paths-DXSHAMIa.js";
-import { r as parseAppData, t as assertAppData } from "./app-data-MuyzVqX8.js";
-import { f as normaliseRelation, h as restrictedStopsOf, i as assertIncludes, n as RESOURCE_NAME, r as assertGraphTargets, t as LEVEL_NAME } from "./resource-relations-D_jw0BFx.js";
+import { n as freezeDeep } from "./freeze-jjan0lCv.js";
+import { i as ownKeys, n as isForbiddenKey, t as assertSafeKey } from "./paths-CUvURzHp.js";
+import { r as parseAppData, t as assertAppData } from "./app-data-UNNm07jV.js";
+import { f as normaliseRelation, h as restrictedStopsOf, i as assertIncludes, n as RESOURCE_NAME, r as assertGraphTargets, t as LEVEL_NAME } from "./resource-relations-8-pCScBO.js";
 //#region src/core/brands.ts
 const RESOURCE_BRAND = Symbol.for("permdock.resource");
 const TREE_REGISTRY = Symbol.for("permdock.registry");
@@ -91,7 +91,10 @@ function formerKeys(permission) {
 	const value = Reflect.get(permission, LEAF_FORMER);
 	return isReadonlyArray(value) ? value.filter((item) => typeof item === "string") : [];
 }
-/** The OAuth scope strings `permission` used to have: each former key with `.` as `:`. */
+/**
+* The OAuth scope strings `permission` used to have: each former key with `.`
+* as `:`.
+*/
 function formerScopes(permission) {
 	return formerKeys(permission).map(keyToScope);
 }
@@ -183,6 +186,9 @@ function materialiseResource(init, path, registry, leaves, build) {
 		levels[levelName] = freezeDeep({ ...condition });
 	}
 	if (Object.keys(levels).length > 0 && instanceSet.size === 0) throw new Error(`PermDock: resource '${name}' declares levels but no instance actions`);
+	const ordered = init.options.orderedLevels;
+	if (ordered !== void 0 && ordered !== true) throw new Error(`PermDock: orderedLevels on '${name}' must be true when set`);
+	if (ordered === true && Object.keys(levels).length < 2) throw new Error(`PermDock: resource '${name}' sets orderedLevels with fewer than two levels`);
 	const meta = resourceMetaFor(name, init.options.meta, build.x?.resource);
 	const resourceNode = Object.freeze({
 		...meta === void 0 ? {} : { meta },
@@ -199,7 +205,8 @@ function materialiseResource(init, path, registry, leaves, build) {
 		disclosure,
 		instanceActions: instanceSet,
 		collectionActions: collectionSet,
-		levels: Object.freeze(levels)
+		levels: Object.freeze(levels),
+		...ordered === true ? { orderedLevels: true } : {}
 	});
 	assertIncludes(resourceNode);
 	registry.set(name, resourceNode);
@@ -211,7 +218,10 @@ function materialiseResource(init, path, registry, leaves, build) {
 	});
 	return freezeDeep(node);
 }
-/** The resource a `definePermissions` resource node was built from, read from the node itself. */
+/**
+* The resource a `definePermissions` resource node was built from, read from
+* the node itself.
+*/
 function resourceOfNode(node) {
 	if (!Object.hasOwn(node, NODE_RESOURCE)) return;
 	const value = Reflect.get(node, NODE_RESOURCE);
@@ -261,7 +271,10 @@ function getResource(tree, name) {
 	return getRegistry(tree).get(name);
 }
 const RENAMED_KEY = /^\S+$/u;
-/** Current key to its former keys, from the `renamed` option; targets are checked once leaves exist. */
+/**
+* Current key to its former keys, from the `renamed` option; targets are
+* checked once leaves exist.
+*/
 function formerByKey(renamed) {
 	const former = /* @__PURE__ */ new Map();
 	if (renamed === void 0) return former;
@@ -274,8 +287,8 @@ function formerByKey(renamed) {
 	return former;
 }
 /**
-* Every current key is unique, every former key names exactly one leaf, and
-* no former key is also a current key, so a string resolves to one leaf.
+* Every current key is unique, every former key names exactly one leaf, and no
+* former key is also a current key, so a string resolves to one leaf.
 */
 function assertKeys(leaves, former) {
 	const current = /* @__PURE__ */ new Set();
@@ -382,4 +395,4 @@ function renamedKeys(tree) {
 	return map;
 }
 //#endregion
-export { resource as _, getResource as a, listPermissions as c, attachRegistry as d, resourceOfNode as f, formerScopes as g, formerKeys as h, getRegistry as i, mergePermissions as l, annotationsFor as m, findPermission as n, isPermission as o, walk as p, formerByKey as r, isRegistryTree as s, assertKeys as t, renamedKeys as u };
+export { keyToScope as _, getResource as a, listPermissions as c, attachRegistry as d, resourceOfNode as f, formerScopes as g, formerKeys as h, getRegistry as i, mergePermissions as l, annotationsFor as m, findPermission as n, isPermission as o, walk as p, formerByKey as r, isRegistryTree as s, assertKeys as t, renamedKeys as u, resource as v };