permdock 0.7.0 → 0.8.0

package/dist/{permdock-BfWEeMqk.js → permdock-L-_I_3zP.js}

@@ -1,33 +1,36 @@
 import { n as isReadonlyArray, r as isRecord, t as compact } from "./compact-CAf557ZB.js";
-import { n as freezeDeep, t as freezeCopy } from "./freeze-CrU8nQeX.js";
-import { n as PermDockValidationError } from "./validation-error-ZfUHbKvf.js";
-import { a as deniedMessage, i as approvalMessage, n as PermDockDeniedError, t as PermDockApprovalRequiredError } from "./errors-BKy0EfhN.js";
-import { t as attachInternals } from "./internals-Dk8A8fX3.js";
-import { _ as keyToScope, a as getResource, c as listPermissions, g as formerScopes } from "./permission-registry-DpPtSKNZ.js";
-import { n as isThenable } from "./thenable-yD7SabqG.js";
-import { i as readAppData } from "./app-data-MuyzVqX8.js";
-import { f as scopeList, h as tenantOf, o as normalizeMemberships } from "./scopes-BHsc-wp-.js";
-import { o as pickVisible, s as sanitizeContext } from "./validity-CZ7-y0Cj.js";
-import { c as nowSeconds, d as resolveActiveTenant, m as tenantsOf, p as scopeField, t as heldRoleNamesIn, u as relatesTo } from "./tenancy-CmeBQ6Nv.js";
-import { u as policyX } from "./policy-DaJy4nK4.js";
-import { t as byCodePoint } from "./compare-pfyVnBjE.js";
-import { D as emptyListeners, E as emitSafe, N as contactMemberships, O as finish, P as isContact, i as customRolesFor, o as roleSourceFor, r as assignableNamesFor, s as sourceName, t as evaluate, u as customGrantsFor, w as unknownLevelsFor } from "./evaluate-B_oqFbWC.js";
-import { a as whereGrant, c as applyRoleKinds, i as collectSnapshotGrants, l as audiencesOf, o as heldRoleNames, p as asMembershipSource, r as assignableIn, s as roleLeaf, t as snapshotOf } from "./instance-snapshot-CjcwnEiV.js";
-import { r as relationReader, t as pendingRelations } from "./relations-BnCWnJGI.js";
-import { r as snapshotGrant } from "./snapshot-CbGmYiJx.js";
-import { a as decideForTarget, i as permittedIds, o as deniedFor, r as mayUse, s as signSnapshot, t as whereFromGrants } from "./where-scope-wq2coopv.js";
-import { i as decideAllWith, n as canAllWith } from "./checks-BC_0mPIq.js";
+import { n as freezeDeep, t as freezeCopy } from "./freeze-jjan0lCv.js";
+import { n as PermDockValidationError } from "./validation-error-CYg2kJEw.js";
+import { a as deniedMessage, i as approvalMessage, n as PermDockDeniedError, t as PermDockApprovalRequiredError } from "./errors-B6R_lg2a.js";
+import { t as attachInternals } from "./internals-B3IgHrvo.js";
+import { _ as keyToScope, a as getResource, c as listPermissions, g as formerScopes } from "./permission-registry-B8tYxPIt.js";
+import { n as isThenable } from "./thenable-BNSM1U2R.js";
+import { i as readAppData } from "./app-data-UNNm07jV.js";
+import { f as scopeList, h as tenantOf, o as normalizeMemberships } from "./scopes-0Up_UA2t.js";
+import { o as pickVisible, s as sanitizeContext } from "./validity-Buc7w8E9.js";
+import { t as byCodePoint } from "./compare-DTfyUunF.js";
+import { c as nowSeconds, d as resolveActiveTenant, m as tenantsOf, p as scopeField, t as heldRoleNamesIn, u as relatesTo } from "./tenancy-5d1zVBvK.js";
+import { d as policyX } from "./policy-CLQ8__GF.js";
+import { D as emptyListeners, E as emitSafe, N as contactMemberships, O as finish, P as isContact, i as customRolesFor, o as roleSourceFor, r as assignableNamesFor, s as sourceName, t as evaluate, u as customGrantsFor, w as unknownLevelsFor } from "./evaluate-Dd8Ta0Ie.js";
+import { c as heldRoleNames, d as audiencesOf, g as asMembershipSource, i as assignableIn, l as roleLeaf, o as collectSnapshotGrants, s as whereGrant, t as snapshotOf, u as applyRoleKinds } from "./instance-snapshot--JWiTrvO.js";
+import { r as relationReader, t as pendingRelations } from "./relations-BxvRvDHK.js";
+import { i as snapshotGrant } from "./snapshot-CXlzi69u.js";
+import { a as decideForTarget, i as permittedIds, o as deniedFor, r as mayUse, s as signSnapshot, t as whereFromGrants } from "./where-scope-DlCdCM_8.js";
+import { i as decideAllWith, n as canAllWith } from "./checks-CGkP3Z7A.js";
 import { r as isSubject, t as anonymousSubject } from "./subject-BGoM5o8B.js";
 //#region src/core/app.ts
 const APP = Symbol.for("permdock.app");
-/** The app definition bound to `policy` by `defineApp`, or `undefined` for a plain policy. */
+/**
+* The app definition bound to `policy` by `defineApp`, or `undefined` for a
+* plain policy.
+*/
 function appOf(policy) {
 	const value = Reflect.get(policy, APP);
 	return value === void 0 ? void 0 : value;
 }
 /**
-* `options` with the app's values under it, key by key, for an adapter
-* factory to call first: `options = withApp(policy, options)`.
+* `options` with the app's values under it, key by key, for an adapter factory
+* to call first: `options = withApp(policy, options)`.
 */
 function withApp(policy, options) {
 	const app = appOf(policy);
@@ -39,7 +42,10 @@ function withApp(policy, options) {
 }
 //#endregion
 //#region src/core/assert-decision.ts
-/** `assert`'s outcome: the granted decision, or the error a refusal throws after `onDenied` runs. */
+/**
+* `assert`'s outcome: the granted decision, or the error a refusal throws after
+* `onDenied` runs.
+*/
 function assertDecision(policy, subject, permission, data, decision, onDenied) {
 	if (decision.outcome === "granted") return decision;
 	if (onDenied !== void 0) onDenied(decision);
@@ -72,7 +78,10 @@ function assertDecision(policy, subject, permission, data, decision, onDenied) {
 }
 //#endregion
 //#region src/core/instance-env.ts
-/** The environment `derive(options)` builds on: `base` with the sources `options` replaces loaded again. */
+/**
+* The environment `derive(options)` builds on: `base` with the sources
+* `options` replaces loaded again.
+*/
 function deriveEnv(policy, subject, base, relationCache, options) {
 	const scopes = scopeList(policy.scopes);
 	const tenants = tenantsOf(subject.principal, scopes);
@@ -140,7 +149,10 @@ function simulateEvent(policy, subject, env, evaluated) {
 }
 //#endregion
 //#region src/core/instance.ts
-/** Each round reads one more layer: link hops, then the chain, then nested groups. */
+/**
+* Each round reads one more layer: link hops, then the chain, then nested
+* groups.
+*/
 const LOAD_ROUNDS = 48;
 function buildInstance(policy, subject, envBase, team) {
 	const listeners = emptyListeners();
@@ -542,11 +554,17 @@ function expandOAuthScopes(policy, delegation) {
 		scopes: [...out]
 	};
 }
-/** The coarse scopes the policy declares that cover `permission`, in declaration order. */
+/**
+* The coarse scopes the policy declares that cover `permission`, in declaration
+* order.
+*/
 function coarseScopesFor(policy, permission) {
 	return (policy.oauthScopes ?? []).filter((entry) => entry.permissions.includes(permission.key)).map((entry) => entry.scope);
 }
-/** Every token scope that reaches `permission`: its own, any it was renamed from, and the coarse scopes covering it. */
+/**
+* Every token scope that reaches `permission`: its own, any it was renamed
+* from, and the coarse scopes covering it.
+*/
 function scopesReaching(policy, permission) {
 	return [
 		permission.scope,
@@ -555,9 +573,9 @@ function scopesReaching(policy, permission) {
 	];
 }
 /**
-* The scope an `insufficient_scope` challenge names for `permission`: the
-* first coarse scope that covers it, which the authorization server issues,
-* else the permission's own scope.
+* The scope an `insufficient_scope` challenge names for `permission`: the first
+* coarse scope that covers it, which the authorization server issues, else the
+* permission's own scope.
 */
 function challengeScope(policy, permission) {
 	return coarseScopesFor(policy, permission)[0] ?? permission.scope;
@@ -569,8 +587,8 @@ function hasScope(granted, scopes) {
 //#endregion
 //#region src/core/resolve-subject.ts
 /**
-* The tenant a user API key holds its owner to (`Credential.tenant`): only
-* the memberships inside it count, and no global role.
+* The tenant a user API key holds its owner to (`Credential.tenant`): only the
+* memberships inside it count, and no global role.
 */
 function heldTenantOf(principal) {
 	const credential = principal["credential"];
@@ -746,7 +764,10 @@ function finishSubject(policy, assembled, context, input, options, extra) {
 		liveSession: assembled.liveSession
 	}));
 }
-/** Runs the policy's membership schema over each `x`; an invalid one is dropped and reported, never the membership. */
+/**
+* Runs the policy's membership schema over each `x`; an invalid one is dropped
+* and reported, never the membership.
+*/
 function checkMembershipX(memberships, schema, auth) {
 	if (schema === void 0) return memberships;
 	let dropped = false;
@@ -977,8 +998,8 @@ function create(policy, user, given) {
 /**
 * The instance for `user`, built synchronously. Every input must answer
 * synchronously: the subject mapper, `memberships`, `customRoles`,
-* `entitlements`, `approvalPolicies` and the freshness check. One that
-* answers with a Promise throws here; use `getPermDock` for those.
+* `entitlements`, `approvalPolicies` and the freshness check. One that answers
+* with a Promise throws here; use `getPermDock` for those.
 */
 function getPermDockSync(policy, user, options = {}) {
 	const created = create(policy, user, options);
@@ -988,7 +1009,10 @@ function getPermDockSync(policy, user, options = {}) {
 	}
 	return created;
 }
-/** The instance for `user`: waits for every source, then builds it. `getPermDockSync` is the synchronous twin. */
+/**
+* The instance for `user`: waits for every source, then builds it.
+* `getPermDockSync` is the synchronous twin.
+*/
 function getPermDock(policy, user, options = {}) {
 	return Promise.resolve().then(() => create(policy, user, options));
 }

package/dist/{permission-registry-DpPtSKNZ.js → permission-registry-B8tYxPIt.js}

@@ -1,8 +1,8 @@
 import { n as isReadonlyArray, t as compact } from "./compact-CAf557ZB.js";
-import { n as freezeDeep } from "./freeze-CrU8nQeX.js";
-import { i as ownKeys, n as isForbiddenKey, t as assertSafeKey } from "./paths-DXSHAMIa.js";
-import { r as parseAppData, t as assertAppData } from "./app-data-MuyzVqX8.js";
-import { f as normaliseRelation, h as restrictedStopsOf, i as assertIncludes, n as RESOURCE_NAME, r as assertGraphTargets, t as LEVEL_NAME } from "./resource-relations-D_jw0BFx.js";
+import { n as freezeDeep } from "./freeze-jjan0lCv.js";
+import { i as ownKeys, n as isForbiddenKey, t as assertSafeKey } from "./paths-CUvURzHp.js";
+import { r as parseAppData, t as assertAppData } from "./app-data-UNNm07jV.js";
+import { f as normaliseRelation, h as restrictedStopsOf, i as assertIncludes, n as RESOURCE_NAME, r as assertGraphTargets, t as LEVEL_NAME } from "./resource-relations-8-pCScBO.js";
 //#region src/core/brands.ts
 const RESOURCE_BRAND = Symbol.for("permdock.resource");
 const TREE_REGISTRY = Symbol.for("permdock.registry");
@@ -91,7 +91,10 @@ function formerKeys(permission) {
 	const value = Reflect.get(permission, LEAF_FORMER);
 	return isReadonlyArray(value) ? value.filter((item) => typeof item === "string") : [];
 }
-/** The OAuth scope strings `permission` used to have: each former key with `.` as `:`. */
+/**
+* The OAuth scope strings `permission` used to have: each former key with `.`
+* as `:`.
+*/
 function formerScopes(permission) {
 	return formerKeys(permission).map(keyToScope);
 }
@@ -183,6 +186,9 @@ function materialiseResource(init, path, registry, leaves, build) {
 		levels[levelName] = freezeDeep({ ...condition });
 	}
 	if (Object.keys(levels).length > 0 && instanceSet.size === 0) throw new Error(`PermDock: resource '${name}' declares levels but no instance actions`);
+	const ordered = init.options.orderedLevels;
+	if (ordered !== void 0 && ordered !== true) throw new Error(`PermDock: orderedLevels on '${name}' must be true when set`);
+	if (ordered === true && Object.keys(levels).length < 2) throw new Error(`PermDock: resource '${name}' sets orderedLevels with fewer than two levels`);
 	const meta = resourceMetaFor(name, init.options.meta, build.x?.resource);
 	const resourceNode = Object.freeze({
 		...meta === void 0 ? {} : { meta },
@@ -199,7 +205,8 @@ function materialiseResource(init, path, registry, leaves, build) {
 		disclosure,
 		instanceActions: instanceSet,
 		collectionActions: collectionSet,
-		levels: Object.freeze(levels)
+		levels: Object.freeze(levels),
+		...ordered === true ? { orderedLevels: true } : {}
 	});
 	assertIncludes(resourceNode);
 	registry.set(name, resourceNode);
@@ -211,7 +218,10 @@ function materialiseResource(init, path, registry, leaves, build) {
 	});
 	return freezeDeep(node);
 }
-/** The resource a `definePermissions` resource node was built from, read from the node itself. */
+/**
+* The resource a `definePermissions` resource node was built from, read from
+* the node itself.
+*/
 function resourceOfNode(node) {
 	if (!Object.hasOwn(node, NODE_RESOURCE)) return;
 	const value = Reflect.get(node, NODE_RESOURCE);
@@ -261,7 +271,10 @@ function getResource(tree, name) {
 	return getRegistry(tree).get(name);
 }
 const RENAMED_KEY = /^\S+$/u;
-/** Current key to its former keys, from the `renamed` option; targets are checked once leaves exist. */
+/**
+* Current key to its former keys, from the `renamed` option; targets are
+* checked once leaves exist.
+*/
 function formerByKey(renamed) {
 	const former = /* @__PURE__ */ new Map();
 	if (renamed === void 0) return former;
@@ -274,8 +287,8 @@ function formerByKey(renamed) {
 	return former;
 }
 /**
-* Every current key is unique, every former key names exactly one leaf, and
-* no former key is also a current key, so a string resolves to one leaf.
+* Every current key is unique, every former key names exactly one leaf, and no
+* former key is also a current key, so a string resolves to one leaf.
 */
 function assertKeys(leaves, former) {
 	const current = /* @__PURE__ */ new Set();

package/dist/{permission-types-DhNEmoRG.d.ts → permission-types-CAY-GU7e.d.ts}

@@ -11,7 +11,10 @@ type AppData = Readonly<Record<string, MetaValue>>;
  * its output is the type PermDock gives the `x` field it checks.
  */
 type AppDataSchema<X = AppData> = StandardSchemaV1<unknown, X>;
-/** A leaf whose `meta.x` is typed by a schema; intersected so it stays assignable to the untyped leaf. */
+/**
+ * A leaf whose `meta.x` is typed by a schema; intersected so it stays
+ * assignable to the untyped leaf.
+ */
 type WithX<L, X> = [X] extends [never] ? L : L & {
   readonly meta: {
     readonly x?: Readonly<X>;
@@ -22,9 +25,26 @@ type WithX<L, X> = [X] extends [never] ? L : L & {
 declare const RESOURCE_BRAND: unique symbol;
 /**
  * Phantom key carrying a tree's resource `x` type for `getResource`. Exported
- * as a type only, so a consumer's declaration emit can name it; it has no value.
+ * as a type only, so a consumer's declaration emit can name it; it has no
+ * value.
  */
 declare const RESOURCE_X: unique symbol;
+/**
+ * Phantom key carrying the literal `name` a `resource(…, { name })` was given,
+ * so its leaves type `resource` by that name rather than the path segment. Type
+ * only; it has no value.
+ */
+declare const RESOURCE_NAME: unique symbol;
+/**
+ * Phantom key carrying a policy's `scopes` input type for `ScopeNameOf`. Type
+ * only; it has no value.
+ */
+declare const POLICY_SCOPES: unique symbol;
+/**
+ * Phantom key carrying a permission's row type for `RowOf`. Type only; a leaf
+ * never has it at run time, so leaves stay plain JSON.
+ */
+declare const PERMISSION_ROW: unique symbol;
 //#endregion
 //#region src/core/permission-types.d.ts
 /** `definePermissions` options. */
@@ -37,24 +57,33 @@ type PermissionsOptions<PX = never, RX = never> = {
    */
   readonly renamed?: Readonly<Record<string, string>>;
   /**
-   * Standard Schemas for app data. `permission` checks every action's
-   * `meta.x` and types it on the leaves; `resource` checks every resource's
-   * `meta.x` and types it on `getResource`. Both validate synchronously at
-   * definition time and throw on invalid data.
+   * Standard Schemas for app data. `permission` checks every action's `meta.x`
+   * and types it on the leaves; `resource` checks every resource's `meta.x` and
+   * types it on `getResource`. Both validate synchronously at definition time
+   * and throw on invalid data.
    */
   readonly x?: {
     readonly permission?: AppDataSchema<PX>;
     readonly resource?: AppDataSchema<RX>;
   };
 };
-/** A resource's metadata. PermDock carries it to the catalog and never reads `x`. */
+/**
+ * A resource's metadata. PermDock carries it to the catalog and never reads
+ * `x`.
+ */
 type ResourceMeta<X = AppData> = {
   readonly title?: string;
   readonly description?: string;
-  /** Data the application owns. Plain JSON, typed by `definePermissions(…, { x: { resource } })`. */
+  /**
+   * Data the application owns. Plain JSON, typed by `definePermissions(…, { x:
+   * { resource } })`.
+   */
   readonly x?: X;
 };
-/** A tree whose resources carry `meta.x` of type `X`, read through `getResource`. */
+/**
+ * A tree whose resources carry `meta.x` of type `X`, read through
+ * `getResource`.
+ */
 type ResourceXTree<X> = {
   readonly [RESOURCE_X]?: X;
 };
@@ -63,7 +92,10 @@ type ActionMeta = {
   readonly description?: string;
   readonly tags?: readonly string[];
   readonly readOnly?: boolean;
-  /** The action may destroy or overwrite data; only meaningful when not `readOnly`. */
+  /**
+   * The action may destroy or overwrite data; only meaningful when not
+   * `readOnly`.
+   */
   readonly destructive?: boolean;
   /** Repeating the action with the same input has no further effect. */
   readonly idempotent?: boolean;
@@ -72,12 +104,15 @@ type ActionMeta = {
    * assign the whole custom-role ceiling, not only what they hold themselves.
    */
   readonly manageRoles?: boolean;
-  /** Set by a generator (`permdock openapi import`) to the operation an action was inferred from. */
+  /**
+   * Set by a generator (`permdock openapi import`) to the operation an action
+   * was inferred from.
+   */
   readonly inferredFrom?: string;
   /**
    * Data the application owns, such as a risk level or an undo window. Plain
-   * JSON; PermDock carries it on the leaf, the catalog and snapshots and
-   * never reads it. `definePermissions(…, { x: { permission } })` types it.
+   * JSON; PermDock carries it on the leaf, the catalog and snapshots and never
+   * reads it. `definePermissions(…, { x: { permission } })` types it.
    */
   readonly x?: AppData;
 };
@@ -89,7 +124,17 @@ type Permission<K extends string = string, T = unknown, Kind extends PermissionK
   readonly action: string;
   readonly meta: ActionMeta;
   readonly kind: Kind;
-} & ([T] extends [never] ? unknown : unknown);
+  /**
+   * The resource row type. Method syntax keeps it bivariant: a typed leaf is
+   * still a `Permission`, and an untyped one still takes a typed closure.
+   */
+  [PERMISSION_ROW]?(row: T): void;
+};
+/**
+ * The row type of a permission's resource; `unknown` for an untyped
+ * `Permission`.
+ */
+type RowOf<P> = P extends Permission<string, infer T> ? T : unknown;
 type ResourceParent = {
   readonly field: string;
   readonly resource: string;
@@ -101,15 +146,21 @@ type RelationIncludes = {
 /** The row's `field` holds the principal id (or, with `memberOf`, a scope id). */
 type FieldRelation = RelationIncludes & {
   readonly field: string;
-  /** A declared scope name (or the `tenant` / `team` alias): the field holds that scope's id. */
+  /**
+   * A declared scope name (or the `tenant` / `team` alias): the field holds
+   * that scope's id.
+   */
   readonly memberOf?: string;
 };
-/** Literal values an edge row's columns must hold, so one table backs several relations. */
+/**
+ * Literal values an edge row's columns must hold, so one table backs several
+ * relations.
+ */
 type EdgeMatch = Readonly<Record<string, string | number | boolean>>;
 /**
- * One group resource of an edge: the relation whoever the row names must
- * hold on the group, and, when the group's id has its own typed column, that
- * column in place of the edge's `subject`.
+ * One group resource of an edge: the relation whoever the row names must hold
+ * on the group, and, when the group's id has its own typed column, that column
+ * in place of the edge's `subject`.
  */
 type EdgeGroup = string | {
   readonly relation: string;
@@ -117,12 +168,12 @@ type EdgeGroup = string | {
 };
 /**
  * Edge rows that name a group instead of a principal: `column` holds the
- * resource name, `subject` the group's id, and the row holds for whoever
- * holds `resources[<name>]` on that group. A null `column` (or `direct`)
- * names a principal; any other value matches nothing. A group with its own
- * `subject` column reads the group's id from it; without `column`, a row
- * names that group when the column is not null, and a principal when the
- * edge's `subject` is not null.
+ * resource name, `subject` the group's id, and the row holds for whoever holds
+ * `resources[<name>]` on that group. A null `column` (or `direct`) names a
+ * principal; any other value matches nothing. A group with its own `subject`
+ * column reads the group's id from it; without `column`, a row names that group
+ * when the column is not null, and a principal when the edge's `subject` is not
+ * null.
  */
 type EdgeGroups = {
   /** Required unless every group names its own `subject` column. */
@@ -131,7 +182,10 @@ type EdgeGroups = {
   /** The `column` value of a row naming a principal, besides `null`. */
   readonly direct?: string;
 };
-/** One row per holder in an edge table: `object` holds the resource id, `subject` the principal id. */
+/**
+ * One row per holder in an edge table: `object` holds the resource id,
+ * `subject` the principal id.
+ */
 type EdgeRelation = RelationIncludes & {
   readonly edge: string;
   /** Default `<resource>_id`. */
@@ -143,10 +197,16 @@ type EdgeRelation = RelationIncludes & {
   readonly match?: EdgeMatch;
   readonly groups?: EdgeGroups;
 };
-/** On a principal resource: the row's `principal` column holds the principal who holds the relation over it. */
+/**
+ * On a principal resource: the row's `principal` column holds the principal who
+ * holds the relation over it.
+ */
 type PrincipalRelation = RelationIncludes & {
   readonly principal: string;
-  /** Timestamp columns bounding when the relation holds; `null` leaves that side open. */
+  /**
+   * Timestamp columns bounding when the relation holds; `null` leaves that side
+   * open.
+   */
   readonly period?: {
     readonly startsAt?: string;
     readonly expiresAt?: string;
@@ -158,7 +218,10 @@ type ComputedRelation = {
 };
 type ResourceRelation = FieldRelation | EdgeRelation | PrincipalRelation | ComputedRelation;
 type ResourceRelationInput = string | ResourceRelation;
-/** A to-one link from a row to another resource's instance, walked by `through: [<link>]`. */
+/**
+ * A to-one link from a row to another resource's instance, walked by `through:
+ * [<link>]`.
+ */
 type ResourceLink = {
   readonly field: string;
   readonly resource: string;
@@ -170,8 +233,8 @@ type ResourceRestricted = {
 type ActionList = readonly string[] | Record<string, ActionMeta>;
 type ResourceOptions<A extends ActionList | undefined = ActionList | undefined, C extends ActionList | undefined = ActionList | undefined> = {
   /**
-   * The resource name leaves, tables, relations and AuthZEN types use; the
-   * last path segment when absent. Names are unique across a tree.
+   * The resource name leaves, tables, relations and AuthZEN types use; the last
+   * path segment when absent. Names are unique across a tree.
    */
   readonly name?: string;
   readonly id?: string;
@@ -182,7 +245,8 @@ type ResourceOptions<A extends ActionList | undefined = ActionList | undefined,
   readonly relations?: Readonly<Record<string, ResourceRelationInput>>;
   /**
    * The row field that changes whenever the row does (`updatedAt`, a revision
-   * counter). An `approval: { staleOn: 'resource-change' }` binds to its value.
+   * counter). An `approval: { staleOn: 'resource-change' }` binds to its
+   * value.
    */
   readonly version?: string;
   /**
@@ -198,19 +262,32 @@ type ResourceOptions<A extends ActionList | undefined = ActionList | undefined,
   /**
    * Named grant levels a custom role may pick per permission, each a row
    * condition (`where` shorthand or a `Condition`), such as `own`, `team` and
-   * `all`. A level narrows the ceiling grant it applies to and never widens
-   * it; it reaches only instance actions. Names match `^[a-z][a-z0-9_]*$`.
+   * `all`. A level narrows the ceiling grant it applies to and never widens it;
+   * it reaches only instance actions. Names match `^[a-z][a-z0-9_]*$`.
    */
   readonly levels?: Readonly<Record<string, ResourceLevel>>;
-  /** Display text and app data for the resource; carried to the catalog, never read in evaluation. */
+  /**
+   * `true`: `levels` run from narrowest to widest in declaration order, and a
+   * holder of a level may hand out every level declared before it. Evaluation
+   * is unchanged: each level still applies only its own condition.
+   */
+  readonly orderedLevels?: true;
+  /**
+   * Display text and app data for the resource; carried to the catalog, never
+   * read in evaluation.
+   */
   readonly meta?: ResourceMeta;
 };
-/** A level's row condition: `where` shorthand or a normalised `Condition`, checked by `definePolicy`. */
+/**
+ * A level's row condition: `where` shorthand or a normalised `Condition`,
+ * checked by `definePolicy`.
+ */
 type ResourceLevel = Readonly<Record<string, unknown>>;
-type ResourceInit<T = unknown, A extends ActionList | undefined = ActionList | undefined, C extends ActionList | undefined = ActionList | undefined> = {
+type ResourceInit<T = unknown, A extends ActionList | undefined = ActionList | undefined, C extends ActionList | undefined = ActionList | undefined, N extends string = string> = {
   readonly [RESOURCE_BRAND]: true;
   readonly schema: StandardSchemaV1<unknown, T> | undefined;
   readonly options: ResourceOptions<A, C>;
+  readonly [RESOURCE_NAME]?: N;
 };
 type ResourceNode<T = unknown> = {
   readonly name: string;
@@ -226,8 +303,13 @@ type ResourceNode<T = unknown> = {
   readonly disclosure: "hide" | "reveal";
   readonly instanceActions: ReadonlySet<string>;
   readonly collectionActions: ReadonlySet<string>;
-  /** Declared level names to their raw condition; `definePolicy` normalises them. */
+  /**
+   * Declared level names to their raw condition; `definePolicy` normalises
+   * them.
+   */
   readonly levels?: Readonly<Record<string, ResourceLevel>>;
+  /** Set when the resource declares `orderedLevels: true`. */
+  readonly orderedLevels?: true;
   /** The resource's `meta`, when it declares one. */
   readonly meta?: ResourceMeta;
 };
@@ -235,8 +317,12 @@ type PermissionTree = {
   readonly [key: string]: PermissionTree | Permission;
 };
 type ActionNames<A extends ActionList | undefined> = A extends readonly string[] ? A[number] : A extends Record<string, ActionMeta> ? keyof A & string : never;
-type LeavesFrom<Prefix extends string, Names extends string, T, Kind extends PermissionKind, X = never> = [Names] extends [never] ? object : { readonly [K in Names]: WithX<Permission<Prefix extends "" ? K : `${Prefix}.${K}`, T, Kind>, X>; };
-type InferResourceLeaves<R extends ResourceInit, Prefix extends string, X = never> = R extends ResourceInit<infer T, infer A, infer C> ? LeavesFrom<Prefix, ActionNames<A>, T, "instance", X> & LeavesFrom<Prefix, ActionNames<C>, T, "collection", X> : object;
+type LastSegment<Path extends string> = Path extends `${string}.${infer Rest}` ? LastSegment<Rest> : Path;
+type LeavesFrom<Prefix extends string, Names extends string, T, Kind extends PermissionKind, X = never, R extends string = string> = [Names] extends [never] ? object : { readonly [K in Names]: WithX<Permission<Prefix extends "" ? K : `${Prefix}.${K}`, T, Kind> & {
+  readonly resource: R;
+  readonly action: K;
+}, X>; };
+type InferResourceLeaves<R extends ResourceInit, Prefix extends string, X = never> = R extends ResourceInit<infer T, infer A, infer C, infer N> ? LeavesFrom<Prefix, ActionNames<A>, T, "instance", X, [N] extends [never] ? LastSegment<Prefix> : N> & LeavesFrom<Prefix, ActionNames<C>, T, "collection", X, [N] extends [never] ? LastSegment<Prefix> : N> : object;
 type InferPermissionTree<Input, Prefix extends string = "", X = never> = Input extends ResourceInit ? InferResourceLeaves<Input, Prefix, X> : Input extends Record<string, unknown> ? { readonly [K in keyof Input & string]: InferPermissionTree<Input[K], Prefix extends "" ? K : `${Prefix}.${K}`, X>; } : never;
 /**
  * The tree `definePermissions(input, options)` returns, nameable for an
@@ -244,4 +330,4 @@ type InferPermissionTree<Input, Prefix extends string = "", X = never> = Input e
  */
 type PermissionsOf<Input, PX = never, RX = never> = InferPermissionTree<Input, "", PX> & ResourceXTree<RX>;
 //#endregion
-export { MetaValue as A, ResourceRelation as C, RESOURCE_X as D, ResourceXTree as E, AppData as O, ResourceParent as S, ResourceRestricted as T, ResourceLevel as _, EdgeGroups as a, ResourceNode as b, FieldRelation as c, PermissionKind as d, PermissionTree as f, ResourceInit as g, PrincipalRelation as h, EdgeGroup as i, WithX as j, AppDataSchema as k, InferPermissionTree as l, PermissionsOptions as m, ActionMeta as n, EdgeMatch as o, PermissionsOf as p, ComputedRelation as r, EdgeRelation as s, ActionList as t, Permission as u, ResourceLink as v, ResourceRelationInput as w, ResourceOptions as x, ResourceMeta as y };
+export { RESOURCE_NAME as A, ResourceRelation as C, RowOf as D, ResourceXTree as E, WithX as F, AppData as M, AppDataSchema as N, PERMISSION_ROW as O, MetaValue as P, ResourceParent as S, ResourceRestricted as T, ResourceLevel as _, EdgeGroups as a, ResourceNode as b, FieldRelation as c, PermissionKind as d, PermissionTree as f, ResourceInit as g, PrincipalRelation as h, EdgeGroup as i, RESOURCE_X as j, POLICY_SCOPES as k, InferPermissionTree as l, PermissionsOptions as m, ActionMeta as n, EdgeMatch as o, PermissionsOf as p, ComputedRelation as r, EdgeRelation as s, ActionList as t, Permission as u, ResourceLink as v, ResourceRelationInput as w, ResourceOptions as x, ResourceMeta as y };

package/dist/{permissions-CoqCOfJ3.d.ts → permissions-Bx6UI8n1.d.ts}

@@ -1,11 +1,14 @@
-import { g as ResourceInit, l as InferPermissionTree } from "./permission-types-DhNEmoRG.js";
-import { r as Role, t as Plan } from "./vocabulary-Bg3eeT2H.js";
+import { g as ResourceInit, l as InferPermissionTree } from "./permission-types-CAY-GU7e.js";
+import { r as Role, t as Plan } from "./vocabulary-DEJ5j4mR.js";
 import { StandardSchemaV1 } from "@standard-schema/spec";
 //#region src/testing/saas/permissions.d.ts
 declare const SaasProjectSchema: StandardSchemaV1<SaasProject>;
 declare const SaasDocSchema: StandardSchemaV1<SaasDoc>;
 declare const SaasFolderSchema: StandardSchemaV1<SaasFolder>;
-/** A folder in an org's tree; `restricted` keeps grants held on its ancestors out. */
+/**
+ * A folder in an org's tree; `restricted` keeps grants held on its ancestors
+ * out.
+ */
 type SaasFolder = {
   readonly id: string;
   readonly orgId: string;

package/dist/{permissions-CyH2MV_B.js → permissions-CVXmRILq.js}

@@ -1,6 +1,6 @@
-import { n as freezeDeep } from "./freeze-CrU8nQeX.js";
-import { d as attachRegistry, p as walk, r as formerByKey, t as assertKeys } from "./permission-registry-DpPtSKNZ.js";
-import { r as assertGraphTargets } from "./resource-relations-D_jw0BFx.js";
+import { n as freezeDeep } from "./freeze-jjan0lCv.js";
+import { d as attachRegistry, p as walk, r as formerByKey, t as assertKeys } from "./permission-registry-B8tYxPIt.js";
+import { r as assertGraphTargets } from "./resource-relations-8-pCScBO.js";
 //#region src/core/operation-risks.ts
 /** Every `meta.risk` level, lowest first. */
 const OPERATION_RISKS = Object.freeze([

package/dist/{permissions-DArULThq.js → permissions-mDcTWoBs.js}

@@ -1,7 +1,7 @@
-import { c as crud } from "./src-DLFrtrrC.js";
-import { v as resource } from "./permission-registry-DpPtSKNZ.js";
-import { f as definePlans, p as defineRoles } from "./grantee-BrRANrpT.js";
-import { t as definePermissions } from "./permissions-CyH2MV_B.js";
+import { c as crud } from "./src-DZ0l9UAg.js";
+import { v as resource } from "./permission-registry-B8tYxPIt.js";
+import { f as definePlans, p as defineRoles } from "./grantee-Dke-9rd1.js";
+import { t as definePermissions } from "./permissions-CVXmRILq.js";
 //#region src/testing/saas/schema.ts
 function accepts(kind, value) {
 	switch (kind) {
@@ -126,7 +126,10 @@ const saasRoles = defineRoles({
 		on: "team",
 		assignable: true
 	},
-	/** Resource-scoped; `role(..., { on: saasPermissions.project })` in the policy. */
+	/**
+	* Resource-scoped; `role(..., { on: saasPermissions.project })` in the
+	* policy.
+	*/
 	collaborator: { assignable: true }
 });
 const saasPlans = definePlans({