permdock 0.6.0 → 0.8.0

package/dist/{src-Cu2m75uo.js → src-DZ0l9UAg.js}

@@ -1,29 +1,29 @@
 import { n as isReadonlyArray, r as isRecord, t as compact } from "./compact-CAf557ZB.js";
-import { n as freezeDeep } from "./freeze-CrU8nQeX.js";
-import { n as isForbiddenKey, r as ownGet } from "./paths-DXSHAMIa.js";
-import { f as normalizeApproval, g as assertSqlFunctionName, h as assertSqlFunctionArg, m as assertPortableTwin, p as normalizeWhere, u as assertApprovalRelations } from "./role-builder-uWQZ4v84.js";
-import { n as PermDockDeniedError } from "./errors-BKy0EfhN.js";
-import { o as sameId } from "./expiry-D4_YKRKD.js";
-import { n as internalsOf } from "./internals-Dk8A8fX3.js";
-import { c as listPermissions, i as getRegistry, n as findPermission, o as isPermission } from "./permission-registry-Br4jSNVi.js";
-import { n as isThenable$1 } from "./thenable-yD7SabqG.js";
-import { c as isEdgeRelation, m as restrictedStops, o as groupEntries, s as isComputedRelation, u as isPrincipalRelation } from "./resource-relations-D_jw0BFx.js";
-import { a as durationOf, g as secondsOf, m as rfc3339, p as nowSeconds } from "./time-DkWjdL98.js";
-import { d as scopeList, l as scopeChain, m as tenantOf, o as resolveScope, u as scopeIdOf } from "./scopes-CUPSjo9q.js";
-import { u as evaluateCondition } from "./delegation-j6-rc37o.js";
-import { _ as listPlans, a as authenticated, m as findRole, o as flattenGrantee } from "./grantee-hxrUsbpM.js";
-import { m as tenantsOf, r as isMembershipExpired } from "./tenancy-DN2QAx9z.js";
-import { o as levelNames, r as grantList, t as declaredRoleNames } from "./policy-DbM5YYtV.js";
-import { r as isPortableCondition } from "./hosted-B46-5LYE.js";
-import { n as OPERATION_RISKS, r as isOperationRisk } from "./permissions-B-wCP5ZC.js";
-import { S as tenantCustomRoles, b as resolveCustomRole, f as customRoleId, l as ceilingGrants, m as customRoleScope, p as customRoleOf } from "./evaluate-CNClBvcj.js";
-import { d as rankRoles, f as usesAssigns, i as collectSnapshotGrants, n as snapshotScopes, t as snapshotOf, u as bindingOf } from "./instance-snapshot-BOEhcqIF.js";
-import { n as relationId } from "./relations-BnCWnJGI.js";
-import { r as snapshotGrant, t as buildSnapshot } from "./snapshot-B7DkYg6g.js";
-import { n as LOCAL_CUSTOM_ROLE } from "./parse-local-manifest-CVSs6J9I.js";
-import { r as resolveSubject, s as APP } from "./permdock-BrAscV28.js";
-import { i as memoryApprovalStore } from "./store-BDutJkDL.js";
-import { n as wrapPermDock } from "./wrap-gX61EtpB.js";
+import { n as freezeDeep } from "./freeze-jjan0lCv.js";
+import { n as isForbiddenKey, r as ownGet } from "./paths-CUvURzHp.js";
+import { f as normalizeApproval, g as assertSqlFunctionName, h as assertSqlFunctionArg, m as assertPortableTwin, p as normalizeWhere, u as assertApprovalRelations } from "./role-builder-BK2-T6oD.js";
+import { n as PermDockDeniedError } from "./errors-B6R_lg2a.js";
+import { o as sameId } from "./expiry-6XByK0dm.js";
+import { n as internalsOf } from "./internals-B3IgHrvo.js";
+import { c as listPermissions, i as getRegistry, n as findPermission, o as isPermission } from "./permission-registry-B8tYxPIt.js";
+import { n as isThenable$1 } from "./thenable-BNSM1U2R.js";
+import { c as isEdgeRelation, m as restrictedStops, o as groupEntries, s as isComputedRelation, u as isPrincipalRelation } from "./resource-relations-8-pCScBO.js";
+import { a as durationOf, g as secondsOf, m as rfc3339, p as nowSeconds } from "./time-nR1JesoH.js";
+import { a as normalizeMembership$1, d as scopeIdOf, f as scopeList, h as tenantOf, l as rootScope, o as normalizeMemberships$1, s as resolveScope$1, u as scopeChain } from "./scopes-0Up_UA2t.js";
+import { u as evaluateCondition } from "./delegation-CDB6_keF.js";
+import { _ as listPlans, a as authenticated, m as findRole, o as flattenGrantee } from "./grantee-Dke-9rd1.js";
+import { m as tenantsOf, r as isMembershipExpired } from "./tenancy-5d1zVBvK.js";
+import { c as levelNames, i as grantList, n as declaredRoleNames } from "./policy-CLQ8__GF.js";
+import { o as isPortableCondition } from "./hosted-D0IzESu_.js";
+import { n as OPERATION_RISKS, r as isOperationRisk } from "./permissions-CVXmRILq.js";
+import { C as tenantCustomRoles, S as roleAllowKeys, f as customRoleId, l as ceilingGrants, m as customRoleScope, p as customRoleOf, x as resolveCustomRole } from "./evaluate-Dd8Ta0Ie.js";
+import { a as heldLevels, f as bindingOf, h as usesAssigns, m as roleMeta, n as snapshotScopes, o as collectSnapshotGrants, p as rankRoles, r as assignableCandidates, t as snapshotOf } from "./instance-snapshot--JWiTrvO.js";
+import { n as relationId } from "./relations-BxvRvDHK.js";
+import { i as snapshotGrant, r as plainPermission, t as buildSnapshot } from "./snapshot-CXlzi69u.js";
+import { n as LOCAL_CUSTOM_ROLE } from "./parse-local-manifest-DEiCF4ah.js";
+import { c as APP, r as resolveSubject } from "./permdock-L-_I_3zP.js";
+import { i as memoryApprovalStore } from "./store-RNFvaJJv.js";
+import { n as wrapPermDock } from "./wrap-B2wziJI_.js";
 //#region src/conditions/sql-function.ts
 function sqlFunction(name, options) {
 	assertSqlFunctionName(name);
@@ -51,7 +51,10 @@ function memorySettingsSource(settings) {
 		return byTenant.get(tenant);
 	} });
 }
-/** Memberships keyed by principal id; `tenant` is not a filter, as for a database source. */
+/**
+* Memberships keyed by principal id; `tenant` is not a filter, as for a
+* database source.
+*/
 function memoryMembershipSource(entries) {
 	const byPrincipal = new Map(Object.entries(entries));
 	return Object.freeze({
@@ -125,7 +128,10 @@ const OPERATION_EFFECTS = Object.freeze([
 	"spend",
 	"external"
 ]);
-/** MCP tool-name characters (MCP 2025-11-25, Tools: Tool names), so a name works as a tool name unchanged. */
+/**
+* MCP tool-name characters (MCP 2025-11-25, Tools: Tool names), so a name works
+* as a tool name unchanged.
+*/
 const NAME = /^[A-Za-z0-9_.-]{1,128}$/u;
 const META_KEYS = /* @__PURE__ */ new Set([
 	"risk",
@@ -199,7 +205,10 @@ function defineOperations(permissions, definitions) {
 }
 //#endregion
 //#region src/core/approval-policies.ts
-/** The denial detail when an `ApprovalPolicySource` fails: every call an allow would grant denies with reason `approval`. */
+/**
+* The denial detail when an `ApprovalPolicySource` fails: every call an allow
+* would grant denies with reason `approval`.
+*/
 /**
 * The in-process `ApprovalPolicySource`, usable directly as the
 * `approvalPolicies` option: it is the source and its feature at once.
@@ -284,9 +293,9 @@ function checkOne(policy, raw) {
 	}) };
 }
 /**
-* Checks one entry against the policy the way `approvalPoliciesFor` loads
-* it, for an application to refuse a bad entry when it is saved instead of
-* finding every call denied. Never throws.
+* Checks one entry against the policy the way `approvalPoliciesFor` loads it,
+* for an application to refuse a bad entry when it is saved instead of finding
+* every call denied. Never throws.
 */
 function validateApprovalPolicy(policy, entry) {
 	try {
@@ -303,9 +312,9 @@ function validateApprovalPolicy(policy, entry) {
 	}
 }
 /**
-* One raw entry checked against the policy: `null` when it names no
-* permission the policy declares (it applies to nothing), `undefined` when
-* it does not load.
+* One raw entry checked against the policy: `null` when it names no permission
+* the policy declares (it applies to nothing), `undefined` when it does not
+* load.
 */
 function loadOne(policy, raw) {
 	const checked = checkOne(policy, raw);
@@ -322,7 +331,10 @@ function loadAll(policy, raw) {
 	}
 	return Object.freeze({ tighten: (code, input) => tightenApproval(code, out, input) });
 }
-/** Reads the source once for `tenants`; a throw or an invalid entry loads as `"failed"`. */
+/**
+* Reads the source once for `tenants`; a throw or an invalid entry loads as
+* `"failed"`.
+*/
 function approvalPoliciesFor(policy, source, tenants, auth) {
 	const threw = () => {
 		auth.push({
@@ -361,7 +373,10 @@ function asStages(approval) {
 		quorum: approval.quorum
 	})];
 }
-/** An entry's stages, each carrying the entry's escalation unless it has its own. */
+/**
+* An entry's stages, each carrying the entry's escalation unless it has its
+* own.
+*/
 function entryStages(approval) {
 	const stages = asStages(approval);
 	if (approval === "human" || approval.escalation === void 0) return stages;
@@ -378,10 +393,10 @@ function shorter(a, b) {
 	return (durationOf(b) ?? Infinity) < (durationOf(a) ?? Infinity) ? b : a;
 }
 /**
-* `code` with every matching entry added as further stages: the result
-* needs all of them (`'sequential'` when any part is ordered), keeps the
-* code's escalation, the shortest `ttl`, and `distinct` unless every part
-* opts out. Without a matching entry, `code` unchanged.
+* `code` with every matching entry added as further stages: the result needs
+* all of them (`'sequential'` when any part is ordered), keeps the code's
+* escalation, the shortest `ttl`, and `distinct` unless every part opts out.
+* Without a matching entry, `code` unchanged.
 */
 function tightenApproval(code, entries, input) {
 	const extra = entries.filter((entry) => (entry.permission === void 0 || entry.permission === input.permission) && metaMatches(entry, input.operation) && matches(entry, input.tenant, input.subject, input.current, input.next, input.now, input.scopes));
@@ -621,7 +636,10 @@ function applyQuota(store, input) {
 }
 //#endregion
 //#region src/core/memory-relations.ts
-/** The holders one edge-table row names for `spec`: none when the row does not belong to it. */
+/**
+* The holders one edge-table row names for `spec`: none when the row does not
+* belong to it.
+*/
 function tableHolders(resourceName, spec, row, id) {
 	if (relationId(ownGet(row, spec.object ?? `${resourceName}_id`)) !== id) return [];
 	for (const [column, value] of Object.entries(spec.match ?? {})) if (ownGet(row, column) !== value) return [];
@@ -942,7 +960,10 @@ function permissionKeysOf(node) {
 	if (!Array.isArray(raw)) return [];
 	return raw.filter((item) => typeof item === "string");
 }
-/** `$inputs.a.b` against the frame's inputs; anything else that is a runtime expression is unknown. */
+/**
+* `$inputs.a.b` against the frame's inputs; anything else that is a runtime
+* expression is unknown.
+*/
 function valueOf(value, inputs) {
 	if (typeof value !== "string" || !value.includes("$")) return {
 		known: true,
@@ -1142,10 +1163,9 @@ function combine(decisions) {
 	return decisions.find((item) => item.outcome === outcome) ?? denied("undocumented");
 }
 /**
-* Walks an Arazzo workflow against `permdock`: each step's operation is
-* decided as `permdock.simulate` would, and a server instance emits one
-* simulate event for the whole plan. Works on an instance built from a
-* snapshot too.
+* Walks an Arazzo workflow against `permdock`: each step's operation is decided
+* as `permdock.simulate` would, and a server instance emits one simulate event
+* for the whole plan. Works on an instance built from a snapshot too.
 */
 function simulateArazzo(permdock, input) {
 	const tree = input.permissions ?? permdock.permissions;
@@ -1205,7 +1225,10 @@ function planArazzo(input, tree, decide) {
 }
 //#endregion
 //#region src/core/local-manifest.ts
-/** A relation grantee needs the relation graph, which a device does not hold: the grant decides on the server only. */
+/**
+* A relation grantee needs the relation graph, which a device does not hold:
+* the grant decides on the server only.
+*/
 function localGrant(grant) {
 	const relational = flattenGrantee(grant.to).some((item) => item.kind === "relation");
 	return snapshotGrant(relational ? {
@@ -1213,6 +1236,21 @@ function localGrant(grant) {
 		portable: false
 	} : grant, void 0);
 }
+/**
+* The levels a holder of `grants` may hand out, by permission key; only
+* permissions whose resource declares levels.
+*/
+function reachOf(policy, grants) {
+	const out = /* @__PURE__ */ new Map();
+	for (const grant of grants) {
+		const { key, resource, kind } = grant.permission;
+		const names = grant.effect === "allow" && kind === "instance" ? levelNames(policy, resource) : [];
+		if (names.length === 0) continue;
+		const held = /* @__PURE__ */ new Set([...out.get(key) ?? [], ...heldLevels(policy, grant, names)]);
+		out.set(key, names.filter((name) => held.has(name)));
+	}
+	return Object.fromEntries(out);
+}
 function customTable(policy, scope, roles) {
 	const keys = [...new Set(ceilingGrants(policy, scope).map((grant) => grant.permission.key))];
 	if (keys.length === 0) return;
@@ -1225,28 +1263,71 @@ function customTable(policy, scope, roles) {
 		tenant: LOCAL_CUSTOM_ROLE,
 		scope,
 		...body
-	}).grants.map(localGrant);
+	}).grants;
 	const permissions = {};
 	for (const key of keys) {
 		const leaf = findPermission(policy.permissions, key);
 		const names = leaf?.kind === "instance" ? levelNames(policy, leaf.resource) : [];
+		const all = resolve({ grants: [{ permission: key }] });
+		const leveled = names.map((level) => [level, resolve({ grants: [{
+			permission: key,
+			level
+		}] })]);
 		permissions[key] = compact({
-			all: resolve({ grants: [{ permission: key }] }),
-			levels: names.length === 0 ? void 0 : Object.fromEntries(names.map((level) => [level, resolve({ grants: [{
-				permission: key,
-				level
-			}] })]))
+			all: all.map(localGrant),
+			levels: names.length === 0 ? void 0 : Object.fromEntries(leveled.map(([level, grants]) => [level, grants.map(localGrant)])),
+			reach: names.length === 0 ? void 0 : reachOf(policy, all)[key] ?? [],
+			levelReach: names.length === 0 ? void 0 : Object.fromEntries(leveled.map(([level, grants]) => [level, reachOf(policy, grants)[key] ?? []]))
 		});
 	}
 	const includes = {};
+	const includeReach = {};
 	for (const role of roles) {
 		const grants = resolve({ includes: [role] });
-		if (grants.length > 0) includes[role] = grants;
+		if (grants.length > 0) {
+			includes[role] = grants.map(localGrant);
+			const reach = reachOf(policy, grants);
+			if (Object.keys(reach).length > 0) includeReach[role] = reach;
+		}
 	}
-	return {
+	return compact({
 		permissions,
-		includes
-	};
+		includes,
+		includeReach: Object.keys(includeReach).length === 0 ? void 0 : includeReach
+	});
+}
+/** The hand-out rules `buildLocalSnapshot` applies on the device. */
+function localAssignable(policy) {
+	const scopes = scopeList(policy.scopes);
+	const root = rootScope(scopes);
+	const ceiling = new Set((root === void 0 ? [] : ceilingGrants(policy, root)).map((grant) => grant.permission.key));
+	const leaves = listPermissions(policy.permissions);
+	const levels = {};
+	for (const leaf of leaves) {
+		const names = leaf.kind === "instance" ? levelNames(policy, leaf.resource) : [];
+		if (names.length > 0) levels[leaf.key] = names;
+	}
+	const grants = {};
+	for (const [index, grant] of grantList(policy).entries()) {
+		const reach = flattenGrantee(grant.to).some((item) => item.kind === "relation") ? levels[grant.permission.key] === void 0 ? void 0 : [] : reachOf(policy, [grant])[grant.permission.key];
+		if (reach !== void 0) grants[String(index)] = reach;
+	}
+	const declared = [...declaredRoleNames(policy)].toSorted();
+	return compact({
+		roles: assignableCandidates(policy).map((leaf) => ({
+			name: leaf.key,
+			on: (leaf.on === void 0 ? root : resolveScope$1(scopes, leaf.on)) ?? "global",
+			allows: [...roleAllowKeys(policy, leaf.key)].toSorted()
+		})),
+		manage: {
+			roles: declared.filter((name) => roleMeta(policy, name)?.manageRoles === true),
+			permissions: leaves.filter((leaf) => leaf.meta.manageRoles === true).map((leaf) => leaf.key)
+		},
+		assigns: usesAssigns(policy) ? Object.fromEntries(declared.map((name) => [name, policy.rolesByName.get(name)?.assigns ?? []])) : void 0,
+		permissions: leaves.filter((leaf) => ceiling.has(leaf.key)).map(plainPermission),
+		levels: Object.keys(levels).length === 0 ? void 0 : levels,
+		grants: Object.keys(grants).length === 0 ? void 0 : grants
+	});
 }
 /**
 * What the policy grants, as JSON a device turns into snapshots from its own
@@ -1277,7 +1358,8 @@ function localSnapshotManifest(policy) {
 		roles,
 		rank: usesAssigns(policy) ? rankRoles(policy, roles) : void 0,
 		grants: grantList(policy).map(localGrant),
-		custom
+		custom,
+		assignable: localAssignable(policy)
 	}));
 }
 //#endregion
@@ -1291,10 +1373,10 @@ function assertProduction(policy, options) {
 	if (options.limits === void 0 && grants.some((grant) => grant.limit !== void 0)) throw new Error("PermDock: profile 'prod' needs limits: a grant has a limit and every call would deny with limit-unavailable; pass limits: limits(store)");
 }
 /**
-* The in-process services `dev` fills in: one memory approval store that
-* every adapter of the app shares, and memory limits when a grant has a
-* `limit`. They live here, not in the adapters, so an adapter ships no store
-* and an app without `defineApp` ships neither.
+* The in-process services `dev` fills in: one memory approval store that every
+* adapter of the app shares, and memory limits when a grant has a `limit`. They
+* live here, not in the adapters, so an adapter ships no store and an app
+* without `defineApp` ships neither.
 */
 function devDefaults(policy, options) {
 	return {
@@ -1305,10 +1387,10 @@ function devDefaults(policy, options) {
 	};
 }
 /**
-* Binds the app's sources, features and services to `policy`. The result
-* is a policy: pass it wherever a policy goes (`createPermDock`, every
-* adapter, the CLI) and each picks up the app definition, with its own
-* options taking precedence. The profile defaults to `prod`.
+* Binds the app's sources, features and services to `policy`. The result is a
+* policy: pass it wherever a policy goes (`createPermDock`, every adapter, the
+* CLI) and each picks up the app definition, with its own options taking
+* precedence. The profile defaults to `prod`.
 */
 function defineApp(policy, options = {}) {
 	const profile = options.profile ?? "prod";
@@ -1356,12 +1438,12 @@ function legacyDecision(allowed, permission, subject) {
 	});
 }
 /**
-* Runs PermDock beside the application's existing checks while adopting
-* it. Each `can`, `decide`, `decideEach`, `filter` and `assert` asks both;
-* the legacy answer is returned unless the permission is in `enforce`, and
-* every disagreement reaches `onMismatch`. Promote permissions one by one
-* as their mismatches are resolved, then remove the wrap. Pass it as an
-* adapter's `wrap` option, or call it on a core instance.
+* Runs PermDock beside the application's existing checks while adopting it.
+* Each `can`, `decide`, `decideEach`, `filter` and `assert` asks both; the
+* legacy answer is returned unless the permission is in `enforce`, and every
+* disagreement reaches `onMismatch`. Promote permissions one by one as their
+* mismatches are resolved, then remove the wrap. Pass it as an adapter's `wrap`
+* option, or call it on a core instance.
 */
 function shadowMode(options) {
 	const enforced = (permission) => options.enforce === "all" || (options.enforce ?? []).some((item) => item.key === permission.key);
@@ -1466,9 +1548,9 @@ function ofTenant(tenant, roles) {
 	return Array.isArray(roles) ? roles.filter((role) => role !== null && typeof role === "object" && Reflect.get(role, "tenant") === tenant) : [];
 }
 /**
-* A `CustomRoleSource` over a reader that returns every custom role of a tenant.
-* It keeps only the roles of the requested tenant. With `read: 'held'` it
-* skips a tenant's read, and `globalRoles` and `sharedRoles`, when the
+* A `CustomRoleSource` over a reader that returns every custom role of a
+* tenant. It keeps only the roles of the requested tenant. With `read: 'held'`
+* it skips a tenant's read, and `globalRoles` and `sharedRoles`, when the
 * subject holds only declared roles there.
 */
 function customRoleSource(reader, options = {}) {
@@ -1497,10 +1579,10 @@ function withPlans(subject, plans) {
 	}));
 }
 /**
-* Builds the serializable access snapshot for a subject without a request,
-* a network call or a cache directive: call it inside the app's own
-* `'use cache: private'` function. Synchronous; the policy's `subject` and
-* `context` mappers must be synchronous too.
+* Builds the serializable access snapshot for a subject without a request, a
+* network call or a cache directive: call it inside the app's own `'use cache:
+* private'` function. Synchronous; the policy's `subject` and `context` mappers
+* must be synchronous too.
 */
 function snapshotFor(policy, user, options = {}) {
 	const auth = [];
@@ -1599,22 +1681,52 @@ function writable(options) {
 	return finishPreset(WRITABLE_ACTIONS, WRITABLE_COLLECTION, options);
 }
 //#endregion
+//#region src/core/scope-helpers.ts
+/**
+* The canonical form PermDock evaluates one membership in, or `undefined` when
+* it is malformed and grants nothing. `scopes` is the policy's or the catalog's
+* scope list; absent or empty means the implicit `tenant` and `team` pair.
+*/
+function normalizeMembership(input, scopes) {
+	return normalizeMembership$1(input, scopeList(scopes));
+}
+/**
+* Every well-formed membership of `input` in canonical form; malformed entries
+* are dropped.
+*/
+function normalizeMemberships(input, scopes) {
+	return normalizeMemberships$1(input, scopeList(scopes));
+}
+/**
+* The declared scope `name` stands for: the name itself, or the scope the
+* `tenant` (first) or `team` (second) alias names. `undefined` otherwise.
+*/
+function resolveScope(scopes, name) {
+	return resolveScope$1(scopeList(scopes), name);
+}
+//#endregion
 //#region src/core/ownership.ts
 function coversInstance(membership, scopes, scope, id, within) {
 	if (membership.scope === void 0 || membership.id === void 0) return false;
 	if (membership.scope === scope) return sameId(membership.id, id);
 	if (!scopeChain(scopes, scope).slice(1).includes(membership.scope)) return false;
-	const wanted = within === void 0 ? void 0 : Object.entries(within).find(([key]) => resolveScope(scopes, key) === membership.scope)?.[1] ?? void 0;
+	const wanted = within === void 0 ? void 0 : Object.entries(within).find(([key]) => resolveScope$1(scopes, key) === membership.scope)?.[1] ?? void 0;
 	return wanted !== void 0 && scopeIdOf(membership, membership.scope) === wanted;
 }
-/** Roles the principal holds at the instance, at an ancestor named in `within`, or globally. */
+/**
+* Roles the principal holds at the instance, at an ancestor named in `within`,
+* or globally.
+*/
 function rolesAtInstance(policy, principal, scopes, scope, id, within, now) {
 	const declared = declaredRoleNames(policy);
 	const names = new Set((principal.roles ?? []).filter((name) => declared.has(name)));
 	for (const membership of principal.memberships ?? []) if (!isMembershipExpired(membership, now) && coversInstance(membership, scopes, scope, id, within)) for (const name of membership.roles) names.add(name);
 	return rankRoles(policy, [...names]);
 }
-/** Whether the principal holds `role` on a live membership of exactly this instance. */
+/**
+* Whether the principal holds `role` on a live membership of exactly this
+* instance.
+*/
 function holdsAt(principal, role, scope, id, now) {
 	return (principal.memberships ?? []).some((membership) => membership.scope === scope && sameId(membership.id, id) && !isMembershipExpired(membership, now) && membership.roles.includes(role));
 }
@@ -1622,8 +1734,8 @@ function includedRoles(role) {
 	return isReadonlyArray(role.includes) ? role.includes.filter((name) => typeof name === "string") : [];
 }
 /**
-* The membership kinds a custom role may be held through: those every
-* included declared role with `for` allows. `undefined` when none restricts.
+* The membership kinds a custom role may be held through: those every included
+* declared role with `for` allows. `undefined` when none restricts.
 */
 function customForKinds(policy, role) {
 	let kinds;
@@ -1639,12 +1751,13 @@ function conflictsWith(policy, role) {
 	return out;
 }
 /** What the change does to the instance's holder count. */
-function countRules(binding, role, holders, delta, deny) {
-	if (binding === void 0 || delta === 0) return;
-	const min = binding.min ?? 0;
-	if (!(min > 0 || binding.max !== void 0 || binding.transferOnly === true)) return;
+function countRules(rules, holders, delta, deny) {
+	const role = rules.key;
+	if (delta === 0) return;
+	const min = rules.min ?? 0;
+	if (!(min > 0 || rules.max !== void 0 || rules.transferOnly === true)) return;
 	if (!(holders !== void 0 && Number.isInteger(holders) && holders >= 0)) {
-		deny(delta < 0 && min > 0 ? "last-holder" : delta > 0 && binding.max !== void 0 ? "max-holders" : "transfer-only", {
+		deny(delta < 0 && min > 0 ? "last-holder" : delta > 0 && rules.max !== void 0 ? "max-holders" : "transfer-only", {
 			role,
 			holders: null
 		});
@@ -1656,17 +1769,85 @@ function countRules(binding, role, holders, delta, deny) {
 		min,
 		holders
 	});
-	if (delta > 0 && binding.max !== void 0 && after > binding.max) deny("max-holders", {
+	if (delta > 0 && rules.max !== void 0 && after > rules.max) deny("max-holders", {
 		role,
-		max: binding.max,
+		max: rules.max,
 		holders
 	});
-	if (binding.transferOnly === true && holders > 0 && after > 0) deny("transfer-only", {
+	if (rules.transferOnly === true && holders > 0 && after > 0) deny("transfer-only", {
 		role,
 		holders
 	});
 }
 /**
+* The rules of a role change that need no subject: `assigns`, `for`,
+* `exclusiveWith`, `min`, `max` and `transferOnly`, from holder counts and the
+* target's roles alone. `decideRoleChange` runs the same function after its
+* actor, tenant and ceiling checks; a service that holds only the catalog calls
+* it with the `CatalogRole` entries.
+*/
+function checkRoleChange(role, input) {
+	const name = role.key;
+	const denials = [];
+	const deny = (reason, detail) => {
+		denials.push(compact({
+			role: name,
+			reason,
+			detail
+		}));
+	};
+	const kind = input.change?.kind;
+	const target = input.change?.target;
+	if (kind !== "assign" && kind !== "revoke" && kind !== "transfer" || target === null || typeof target !== "object") {
+		deny("validation");
+		return freezeDeep({
+			ok: false,
+			denials
+		});
+	}
+	const roles = input.roles ?? [];
+	const targetRoles = isReadonlyArray(target.roles) ? target.roles : [];
+	const already = targetRoles.includes(name);
+	let by = null;
+	if (kind !== "transfer" && input.actorRoles !== void 0 && roles.some((rules) => rules.assigns !== void 0)) {
+		const held = input.actorRoles;
+		by = held.find((actorRole) => roles.find((rules) => rules.key === actorRole)?.assigns?.includes(name) === true) ?? null;
+		if (by === null) deny("not-assignable-by", { held });
+	}
+	if (kind !== "revoke" && !already) {
+		const kinds = role.for;
+		if (kinds !== void 0 && (target.via === void 0 || !kinds.includes(target.via))) deny("not-allowed-for-membership", {
+			via: target.via ?? null,
+			for: kinds
+		});
+		const conflicts = new Set(role.exclusiveWith ?? []);
+		for (const rules of roles) if (rules.exclusiveWith?.includes(name) === true) conflicts.add(rules.key);
+		const clash = targetRoles.filter((held) => conflicts.has(held));
+		if (clash.length > 0) deny("conflicting-role", { with: clash });
+	}
+	const delta = kind === "assign" ? already ? 0 : 1 : kind === "revoke" ? targetRoles.length > 0 && !already ? 0 : -1 : already ? -1 : 0;
+	countRules(role, input.holders, delta, deny);
+	return freezeDeep(denials.length === 0 ? {
+		ok: true,
+		by
+	} : {
+		ok: false,
+		denials
+	});
+}
+/** A declared binding's rules, by the name `checkRoleChange` reads. */
+function rulesOf(binding) {
+	return compact({
+		key: binding.name,
+		min: binding.min,
+		max: binding.max,
+		transferOnly: binding.transferOnly,
+		assigns: binding.assigns,
+		for: binding.for,
+		exclusiveWith: binding.exclusiveWith
+	});
+}
+/**
 * A live membership of the principal on the instance or on an instance under
 * it: the one in-band fact that ties a nested instance to a tenant.
 */
@@ -1678,12 +1859,12 @@ function heldAnchor(principal, scopes, scope, id, now) {
 * the instance's own principal; nothing in `change` can stand in for it.
 */
 /**
-* Whether the subject of `permdock` may assign, revoke or transfer a role
-* in one scope instance: `assigns`, the ceiling, `for`, `exclusiveWith`,
-* `min`, `max` and `transferOnly`. It never writes; the application does,
-* and generated RLS triggers re-check the holder counts at commit. A nested
-* instance's tenant comes from a live membership the subject holds on it,
-* or from `change.within` only with `{ trusted: true }`; otherwise
+* Whether the subject of `permdock` may assign, revoke or transfer a role in
+* one scope instance: `assigns`, the ceiling, `for`, `exclusiveWith`, `min`,
+* `max` and `transferOnly`. It never writes; the application does, and
+* generated RLS triggers re-check the holder counts at commit. A nested
+* instance's tenant comes from a live membership the subject holds on it, or
+* from `change.within` only with `{ trusted: true }`; otherwise
 * `no-membership`. An instance built from a snapshot denies with
 * `unsupported`.
 */
@@ -1745,10 +1926,10 @@ function decideRoleChangeWith(policy, principal, scopes, change, customRoles, au
 		deny("unknown-role");
 		return done(null);
 	}
-	const scope = global ? "global" : resolveScope(scopes, change.scope);
+	const scope = global ? "global" : resolveScope$1(scopes, change.scope);
 	const customAt = named.map((role) => customRoleScope(role, scopes));
 	const on = declared ? binding?.on ?? findRole(policy.vocabulary?.roles, name)?.on : customAt.includes(scope) ? scope : customAt[0];
-	const heldAt = typeof on === "string" ? resolveScope(scopes, on) : global ? "global" : void 0;
+	const heldAt = typeof on === "string" ? resolveScope$1(scopes, on) : global ? "global" : void 0;
 	if (scope === void 0 || heldAt === void 0 || heldAt !== scope) {
 		deny("scope", { expected: heldAt ?? null });
 		return done(null);
@@ -1758,7 +1939,7 @@ function decideRoleChangeWith(policy, principal, scopes, change, customRoles, au
 	let custom;
 	if (!global) {
 		const root = scopes[0]?.name;
-		const supplied = change.within === void 0 ? void 0 : Object.entries(change.within).find(([key]) => resolveScope(scopes, key) === root)?.[1];
+		const supplied = change.within === void 0 ? void 0 : Object.entries(change.within).find(([key]) => resolveScope$1(scopes, key) === root)?.[1];
 		if (scope === root) tenant = id;
 		else {
 			const anchor = heldAnchor(principal, scopes, scope, id, now);
@@ -1787,9 +1968,8 @@ function decideRoleChangeWith(policy, principal, scopes, change, customRoles, au
 		return done(null);
 	}
 	const self = target.id === principal.id;
-	const targetRoles = isReadonlyArray(target.roles) ? target.roles : [];
-	const already = targetRoles.includes(name);
 	let by = null;
+	let actorRoles;
 	if (kind === "transfer") {
 		if (self) deny("self-demotion");
 		if (global ? (principal.roles ?? []).includes(name) : holdsAt(principal, name, scope, id, now)) by = name;
@@ -1799,24 +1979,26 @@ function decideRoleChangeWith(policy, principal, scopes, change, customRoles, au
 		const allowed = authority(tenant);
 		const revocable = kind === "revoke" && custom !== void 0 && allowed.inert?.has(name);
 		if (!allowed.assignable.has(name) && revocable !== true) deny("not-assignable-by");
-		else if (custom === void 0 && usesAssigns(policy) && !allowed.manage) {
-			const held = global ? rankRoles(policy, (principal.roles ?? []).filter((role) => declaredRoleNames(policy).has(role))) : rolesAtInstance(policy, principal, scopes, scope, id, within, now);
-			by = held.find((role) => bindingOf(policy, role)?.assigns?.includes(name) === true) ?? null;
-			if (by === null) deny("not-assignable-by", { held });
-		}
+		else if (custom === void 0 && usesAssigns(policy) && !allowed.manage) actorRoles = global ? rankRoles(policy, (principal.roles ?? []).filter((role) => declaredRoleNames(policy).has(role))) : rolesAtInstance(policy, principal, scopes, scope, id, within, now);
 	}
-	if (kind !== "revoke" && !already) {
-		const kinds = custom === void 0 ? binding?.for : customForKinds(policy, custom);
-		if (kinds !== void 0 && (target.via === void 0 || !kinds.includes(target.via))) deny("not-allowed-for-membership", {
-			via: target.via ?? null,
-			for: kinds
-		});
-		const conflicts = custom === void 0 ? conflictsWith(policy, name) : new Set(includedRoles(custom).flatMap((include) => Array.from(conflictsWith(policy, include))));
-		const clash = targetRoles.filter((role) => conflicts.has(role));
-		if (clash.length > 0) deny("conflicting-role", { with: clash });
-	}
-	const delta = kind === "assign" ? already ? 0 : 1 : kind === "revoke" ? targetRoles.length > 0 && !already ? 0 : -1 : already ? -1 : 0;
-	countRules(binding, name, change.holders, delta, deny);
+	const conflicts = custom === void 0 ? conflictsWith(policy, name) : new Set(includedRoles(custom).flatMap((include) => Array.from(conflictsWith(policy, include))));
+	const checked = checkRoleChange(compact({
+		...binding === void 0 ? {} : rulesOf(binding),
+		key: name,
+		for: custom === void 0 ? binding?.for : customForKinds(policy, custom),
+		exclusiveWith: [...conflicts],
+		assigns: void 0
+	}), compact({
+		change: {
+			kind,
+			target
+		},
+		holders: change.holders,
+		roles: actorRoles === void 0 ? void 0 : policy.roles.map(rulesOf),
+		actorRoles
+	}));
+	if (checked.ok) by = actorRoles === void 0 ? by : checked.by;
+	else denials.push(...checked.denials);
 	return done(by);
 }
 //#endregion
@@ -1839,8 +2021,8 @@ function field(value) {
 	return /[",\r\n]/u.test(text) ? `"${text.replaceAll("\"", "\"\"")}"` : text;
 }
 /**
-* One RFC 4180 row for a decision or approval event, without a line
-* terminator; join rows with CRLF under a `CSV_COLUMNS` header.
+* One RFC 4180 row for a decision or approval event, without a line terminator;
+* join rows with CRLF under a `CSV_COLUMNS` header.
 */
 function toCsvRow(event) {
 	return [
@@ -1857,4 +2039,4 @@ function toCsvRow(event) {
 	].map(field).join(",");
 }
 //#endregion
-export { memorySnapshotSource as A, validateApprovalPolicy as C, memoryEntitlementSource as D, memoryCustomRoleSource as E, memoryMembershipSource as O, memoryApprovalPolicySource as S, isOperationEffect as T, limits as _, readable as a, approvalPolicies as b, customRoleSource as c, defineApp as d, localSnapshotManifest as f, memoryRelationSource as g, signPolicyDocument as h, crud as i, sqlFunction as j, memorySettingsSource as k, mayAccess as l, simulateArazzo as m, toCsvRow as n, writable as o, arazzoFindings as p, decideRoleChange as r, snapshotFor as s, CSV_COLUMNS as t, shadowMode as u, memoryLimitStore as v, defineOperations as w, approvalPoliciesFor as x, stripeEntitlementSource as y };
+export { memoryCustomRoleSource as A, stripeEntitlementSource as C, validateApprovalPolicy as D, memoryApprovalPolicySource as E, sqlFunction as F, memoryMembershipSource as M, memorySettingsSource as N, defineOperations as O, memorySnapshotSource as P, memoryLimitStore as S, approvalPoliciesFor as T, arazzoFindings as _, normalizeMembership as a, memoryRelationSource as b, crud as c, snapshotFor as d, customRoleSource as f, localSnapshotManifest as g, defineApp as h, decideRoleChange as i, memoryEntitlementSource as j, isOperationEffect as k, readable as l, shadowMode as m, toCsvRow as n, normalizeMemberships as o, mayAccess as p, checkRoleChange as r, resolveScope as s, CSV_COLUMNS as t, writable as u, simulateArazzo as v, approvalPolicies as w, limits as x, signPolicyDocument as y };