permdock 0.7.0 → 0.8.0

package/dist/{src-DLFrtrrC.js → src-DZ0l9UAg.js}

@@ -1,29 +1,29 @@
 import { n as isReadonlyArray, r as isRecord, t as compact } from "./compact-CAf557ZB.js";
-import { n as freezeDeep } from "./freeze-CrU8nQeX.js";
-import { n as isForbiddenKey, r as ownGet } from "./paths-DXSHAMIa.js";
-import { f as normalizeApproval, g as assertSqlFunctionName, h as assertSqlFunctionArg, m as assertPortableTwin, p as normalizeWhere, u as assertApprovalRelations } from "./role-builder-C1VJzvcr.js";
-import { n as PermDockDeniedError } from "./errors-BKy0EfhN.js";
-import { o as sameId } from "./expiry-D4_YKRKD.js";
-import { n as internalsOf } from "./internals-Dk8A8fX3.js";
-import { c as listPermissions, i as getRegistry, n as findPermission, o as isPermission } from "./permission-registry-DpPtSKNZ.js";
-import { n as isThenable$1 } from "./thenable-yD7SabqG.js";
-import { c as isEdgeRelation, m as restrictedStops, o as groupEntries, s as isComputedRelation, u as isPrincipalRelation } from "./resource-relations-D_jw0BFx.js";
-import { a as durationOf, g as secondsOf, m as rfc3339, p as nowSeconds } from "./time-DkWjdL98.js";
-import { a as normalizeMembership$1, d as scopeIdOf, f as scopeList, h as tenantOf, o as normalizeMemberships$1, s as resolveScope$1, u as scopeChain } from "./scopes-BHsc-wp-.js";
-import { u as evaluateCondition } from "./delegation-C5rOdTp5.js";
-import { _ as listPlans, a as authenticated, m as findRole, o as flattenGrantee } from "./grantee-BrRANrpT.js";
-import { m as tenantsOf, r as isMembershipExpired } from "./tenancy-CmeBQ6Nv.js";
-import { r as grantList, s as levelNames, t as declaredRoleNames } from "./policy-DaJy4nK4.js";
-import { o as isPortableCondition } from "./hosted-XBgU6RGT.js";
-import { n as OPERATION_RISKS, r as isOperationRisk } from "./permissions-CyH2MV_B.js";
-import { C as tenantCustomRoles, f as customRoleId, l as ceilingGrants, m as customRoleScope, p as customRoleOf, x as resolveCustomRole } from "./evaluate-B_oqFbWC.js";
-import { d as rankRoles, f as usesAssigns, i as collectSnapshotGrants, n as snapshotScopes, t as snapshotOf, u as bindingOf } from "./instance-snapshot-CjcwnEiV.js";
-import { n as relationId } from "./relations-BnCWnJGI.js";
-import { r as snapshotGrant, t as buildSnapshot } from "./snapshot-CbGmYiJx.js";
-import { n as LOCAL_CUSTOM_ROLE } from "./parse-local-manifest-T1Q8X3A2.js";
-import { c as APP, r as resolveSubject } from "./permdock-BfWEeMqk.js";
-import { i as memoryApprovalStore } from "./store-DSP9oGvh.js";
-import { n as wrapPermDock } from "./wrap-CiSc_KCq.js";
+import { n as freezeDeep } from "./freeze-jjan0lCv.js";
+import { n as isForbiddenKey, r as ownGet } from "./paths-CUvURzHp.js";
+import { f as normalizeApproval, g as assertSqlFunctionName, h as assertSqlFunctionArg, m as assertPortableTwin, p as normalizeWhere, u as assertApprovalRelations } from "./role-builder-BK2-T6oD.js";
+import { n as PermDockDeniedError } from "./errors-B6R_lg2a.js";
+import { o as sameId } from "./expiry-6XByK0dm.js";
+import { n as internalsOf } from "./internals-B3IgHrvo.js";
+import { c as listPermissions, i as getRegistry, n as findPermission, o as isPermission } from "./permission-registry-B8tYxPIt.js";
+import { n as isThenable$1 } from "./thenable-BNSM1U2R.js";
+import { c as isEdgeRelation, m as restrictedStops, o as groupEntries, s as isComputedRelation, u as isPrincipalRelation } from "./resource-relations-8-pCScBO.js";
+import { a as durationOf, g as secondsOf, m as rfc3339, p as nowSeconds } from "./time-nR1JesoH.js";
+import { a as normalizeMembership$1, d as scopeIdOf, f as scopeList, h as tenantOf, l as rootScope, o as normalizeMemberships$1, s as resolveScope$1, u as scopeChain } from "./scopes-0Up_UA2t.js";
+import { u as evaluateCondition } from "./delegation-CDB6_keF.js";
+import { _ as listPlans, a as authenticated, m as findRole, o as flattenGrantee } from "./grantee-Dke-9rd1.js";
+import { m as tenantsOf, r as isMembershipExpired } from "./tenancy-5d1zVBvK.js";
+import { c as levelNames, i as grantList, n as declaredRoleNames } from "./policy-CLQ8__GF.js";
+import { o as isPortableCondition } from "./hosted-D0IzESu_.js";
+import { n as OPERATION_RISKS, r as isOperationRisk } from "./permissions-CVXmRILq.js";
+import { C as tenantCustomRoles, S as roleAllowKeys, f as customRoleId, l as ceilingGrants, m as customRoleScope, p as customRoleOf, x as resolveCustomRole } from "./evaluate-Dd8Ta0Ie.js";
+import { a as heldLevels, f as bindingOf, h as usesAssigns, m as roleMeta, n as snapshotScopes, o as collectSnapshotGrants, p as rankRoles, r as assignableCandidates, t as snapshotOf } from "./instance-snapshot--JWiTrvO.js";
+import { n as relationId } from "./relations-BxvRvDHK.js";
+import { i as snapshotGrant, r as plainPermission, t as buildSnapshot } from "./snapshot-CXlzi69u.js";
+import { n as LOCAL_CUSTOM_ROLE } from "./parse-local-manifest-DEiCF4ah.js";
+import { c as APP, r as resolveSubject } from "./permdock-L-_I_3zP.js";
+import { i as memoryApprovalStore } from "./store-RNFvaJJv.js";
+import { n as wrapPermDock } from "./wrap-B2wziJI_.js";
 //#region src/conditions/sql-function.ts
 function sqlFunction(name, options) {
 	assertSqlFunctionName(name);
@@ -51,7 +51,10 @@ function memorySettingsSource(settings) {
 		return byTenant.get(tenant);
 	} });
 }
-/** Memberships keyed by principal id; `tenant` is not a filter, as for a database source. */
+/**
+* Memberships keyed by principal id; `tenant` is not a filter, as for a
+* database source.
+*/
 function memoryMembershipSource(entries) {
 	const byPrincipal = new Map(Object.entries(entries));
 	return Object.freeze({
@@ -125,7 +128,10 @@ const OPERATION_EFFECTS = Object.freeze([
 	"spend",
 	"external"
 ]);
-/** MCP tool-name characters (MCP 2025-11-25, Tools: Tool names), so a name works as a tool name unchanged. */
+/**
+* MCP tool-name characters (MCP 2025-11-25, Tools: Tool names), so a name works
+* as a tool name unchanged.
+*/
 const NAME = /^[A-Za-z0-9_.-]{1,128}$/u;
 const META_KEYS = /* @__PURE__ */ new Set([
 	"risk",
@@ -199,7 +205,10 @@ function defineOperations(permissions, definitions) {
 }
 //#endregion
 //#region src/core/approval-policies.ts
-/** The denial detail when an `ApprovalPolicySource` fails: every call an allow would grant denies with reason `approval`. */
+/**
+* The denial detail when an `ApprovalPolicySource` fails: every call an allow
+* would grant denies with reason `approval`.
+*/
 /**
 * The in-process `ApprovalPolicySource`, usable directly as the
 * `approvalPolicies` option: it is the source and its feature at once.
@@ -284,9 +293,9 @@ function checkOne(policy, raw) {
 	}) };
 }
 /**
-* Checks one entry against the policy the way `approvalPoliciesFor` loads
-* it, for an application to refuse a bad entry when it is saved instead of
-* finding every call denied. Never throws.
+* Checks one entry against the policy the way `approvalPoliciesFor` loads it,
+* for an application to refuse a bad entry when it is saved instead of finding
+* every call denied. Never throws.
 */
 function validateApprovalPolicy(policy, entry) {
 	try {
@@ -303,9 +312,9 @@ function validateApprovalPolicy(policy, entry) {
 	}
 }
 /**
-* One raw entry checked against the policy: `null` when it names no
-* permission the policy declares (it applies to nothing), `undefined` when
-* it does not load.
+* One raw entry checked against the policy: `null` when it names no permission
+* the policy declares (it applies to nothing), `undefined` when it does not
+* load.
 */
 function loadOne(policy, raw) {
 	const checked = checkOne(policy, raw);
@@ -322,7 +331,10 @@ function loadAll(policy, raw) {
 	}
 	return Object.freeze({ tighten: (code, input) => tightenApproval(code, out, input) });
 }
-/** Reads the source once for `tenants`; a throw or an invalid entry loads as `"failed"`. */
+/**
+* Reads the source once for `tenants`; a throw or an invalid entry loads as
+* `"failed"`.
+*/
 function approvalPoliciesFor(policy, source, tenants, auth) {
 	const threw = () => {
 		auth.push({
@@ -361,7 +373,10 @@ function asStages(approval) {
 		quorum: approval.quorum
 	})];
 }
-/** An entry's stages, each carrying the entry's escalation unless it has its own. */
+/**
+* An entry's stages, each carrying the entry's escalation unless it has its
+* own.
+*/
 function entryStages(approval) {
 	const stages = asStages(approval);
 	if (approval === "human" || approval.escalation === void 0) return stages;
@@ -378,10 +393,10 @@ function shorter(a, b) {
 	return (durationOf(b) ?? Infinity) < (durationOf(a) ?? Infinity) ? b : a;
 }
 /**
-* `code` with every matching entry added as further stages: the result
-* needs all of them (`'sequential'` when any part is ordered), keeps the
-* code's escalation, the shortest `ttl`, and `distinct` unless every part
-* opts out. Without a matching entry, `code` unchanged.
+* `code` with every matching entry added as further stages: the result needs
+* all of them (`'sequential'` when any part is ordered), keeps the code's
+* escalation, the shortest `ttl`, and `distinct` unless every part opts out.
+* Without a matching entry, `code` unchanged.
 */
 function tightenApproval(code, entries, input) {
 	const extra = entries.filter((entry) => (entry.permission === void 0 || entry.permission === input.permission) && metaMatches(entry, input.operation) && matches(entry, input.tenant, input.subject, input.current, input.next, input.now, input.scopes));
@@ -621,7 +636,10 @@ function applyQuota(store, input) {
 }
 //#endregion
 //#region src/core/memory-relations.ts
-/** The holders one edge-table row names for `spec`: none when the row does not belong to it. */
+/**
+* The holders one edge-table row names for `spec`: none when the row does not
+* belong to it.
+*/
 function tableHolders(resourceName, spec, row, id) {
 	if (relationId(ownGet(row, spec.object ?? `${resourceName}_id`)) !== id) return [];
 	for (const [column, value] of Object.entries(spec.match ?? {})) if (ownGet(row, column) !== value) return [];
@@ -942,7 +960,10 @@ function permissionKeysOf(node) {
 	if (!Array.isArray(raw)) return [];
 	return raw.filter((item) => typeof item === "string");
 }
-/** `$inputs.a.b` against the frame's inputs; anything else that is a runtime expression is unknown. */
+/**
+* `$inputs.a.b` against the frame's inputs; anything else that is a runtime
+* expression is unknown.
+*/
 function valueOf(value, inputs) {
 	if (typeof value !== "string" || !value.includes("$")) return {
 		known: true,
@@ -1142,10 +1163,9 @@ function combine(decisions) {
 	return decisions.find((item) => item.outcome === outcome) ?? denied("undocumented");
 }
 /**
-* Walks an Arazzo workflow against `permdock`: each step's operation is
-* decided as `permdock.simulate` would, and a server instance emits one
-* simulate event for the whole plan. Works on an instance built from a
-* snapshot too.
+* Walks an Arazzo workflow against `permdock`: each step's operation is decided
+* as `permdock.simulate` would, and a server instance emits one simulate event
+* for the whole plan. Works on an instance built from a snapshot too.
 */
 function simulateArazzo(permdock, input) {
 	const tree = input.permissions ?? permdock.permissions;
@@ -1205,7 +1225,10 @@ function planArazzo(input, tree, decide) {
 }
 //#endregion
 //#region src/core/local-manifest.ts
-/** A relation grantee needs the relation graph, which a device does not hold: the grant decides on the server only. */
+/**
+* A relation grantee needs the relation graph, which a device does not hold:
+* the grant decides on the server only.
+*/
 function localGrant(grant) {
 	const relational = flattenGrantee(grant.to).some((item) => item.kind === "relation");
 	return snapshotGrant(relational ? {
@@ -1213,6 +1236,21 @@ function localGrant(grant) {
 		portable: false
 	} : grant, void 0);
 }
+/**
+* The levels a holder of `grants` may hand out, by permission key; only
+* permissions whose resource declares levels.
+*/
+function reachOf(policy, grants) {
+	const out = /* @__PURE__ */ new Map();
+	for (const grant of grants) {
+		const { key, resource, kind } = grant.permission;
+		const names = grant.effect === "allow" && kind === "instance" ? levelNames(policy, resource) : [];
+		if (names.length === 0) continue;
+		const held = /* @__PURE__ */ new Set([...out.get(key) ?? [], ...heldLevels(policy, grant, names)]);
+		out.set(key, names.filter((name) => held.has(name)));
+	}
+	return Object.fromEntries(out);
+}
 function customTable(policy, scope, roles) {
 	const keys = [...new Set(ceilingGrants(policy, scope).map((grant) => grant.permission.key))];
 	if (keys.length === 0) return;
@@ -1225,28 +1263,71 @@ function customTable(policy, scope, roles) {
 		tenant: LOCAL_CUSTOM_ROLE,
 		scope,
 		...body
-	}).grants.map(localGrant);
+	}).grants;
 	const permissions = {};
 	for (const key of keys) {
 		const leaf = findPermission(policy.permissions, key);
 		const names = leaf?.kind === "instance" ? levelNames(policy, leaf.resource) : [];
+		const all = resolve({ grants: [{ permission: key }] });
+		const leveled = names.map((level) => [level, resolve({ grants: [{
+			permission: key,
+			level
+		}] })]);
 		permissions[key] = compact({
-			all: resolve({ grants: [{ permission: key }] }),
-			levels: names.length === 0 ? void 0 : Object.fromEntries(names.map((level) => [level, resolve({ grants: [{
-				permission: key,
-				level
-			}] })]))
+			all: all.map(localGrant),
+			levels: names.length === 0 ? void 0 : Object.fromEntries(leveled.map(([level, grants]) => [level, grants.map(localGrant)])),
+			reach: names.length === 0 ? void 0 : reachOf(policy, all)[key] ?? [],
+			levelReach: names.length === 0 ? void 0 : Object.fromEntries(leveled.map(([level, grants]) => [level, reachOf(policy, grants)[key] ?? []]))
 		});
 	}
 	const includes = {};
+	const includeReach = {};
 	for (const role of roles) {
 		const grants = resolve({ includes: [role] });
-		if (grants.length > 0) includes[role] = grants;
+		if (grants.length > 0) {
+			includes[role] = grants.map(localGrant);
+			const reach = reachOf(policy, grants);
+			if (Object.keys(reach).length > 0) includeReach[role] = reach;
+		}
 	}
-	return {
+	return compact({
 		permissions,
-		includes
-	};
+		includes,
+		includeReach: Object.keys(includeReach).length === 0 ? void 0 : includeReach
+	});
+}
+/** The hand-out rules `buildLocalSnapshot` applies on the device. */
+function localAssignable(policy) {
+	const scopes = scopeList(policy.scopes);
+	const root = rootScope(scopes);
+	const ceiling = new Set((root === void 0 ? [] : ceilingGrants(policy, root)).map((grant) => grant.permission.key));
+	const leaves = listPermissions(policy.permissions);
+	const levels = {};
+	for (const leaf of leaves) {
+		const names = leaf.kind === "instance" ? levelNames(policy, leaf.resource) : [];
+		if (names.length > 0) levels[leaf.key] = names;
+	}
+	const grants = {};
+	for (const [index, grant] of grantList(policy).entries()) {
+		const reach = flattenGrantee(grant.to).some((item) => item.kind === "relation") ? levels[grant.permission.key] === void 0 ? void 0 : [] : reachOf(policy, [grant])[grant.permission.key];
+		if (reach !== void 0) grants[String(index)] = reach;
+	}
+	const declared = [...declaredRoleNames(policy)].toSorted();
+	return compact({
+		roles: assignableCandidates(policy).map((leaf) => ({
+			name: leaf.key,
+			on: (leaf.on === void 0 ? root : resolveScope$1(scopes, leaf.on)) ?? "global",
+			allows: [...roleAllowKeys(policy, leaf.key)].toSorted()
+		})),
+		manage: {
+			roles: declared.filter((name) => roleMeta(policy, name)?.manageRoles === true),
+			permissions: leaves.filter((leaf) => leaf.meta.manageRoles === true).map((leaf) => leaf.key)
+		},
+		assigns: usesAssigns(policy) ? Object.fromEntries(declared.map((name) => [name, policy.rolesByName.get(name)?.assigns ?? []])) : void 0,
+		permissions: leaves.filter((leaf) => ceiling.has(leaf.key)).map(plainPermission),
+		levels: Object.keys(levels).length === 0 ? void 0 : levels,
+		grants: Object.keys(grants).length === 0 ? void 0 : grants
+	});
 }
 /**
 * What the policy grants, as JSON a device turns into snapshots from its own
@@ -1277,7 +1358,8 @@ function localSnapshotManifest(policy) {
 		roles,
 		rank: usesAssigns(policy) ? rankRoles(policy, roles) : void 0,
 		grants: grantList(policy).map(localGrant),
-		custom
+		custom,
+		assignable: localAssignable(policy)
 	}));
 }
 //#endregion
@@ -1291,10 +1373,10 @@ function assertProduction(policy, options) {
 	if (options.limits === void 0 && grants.some((grant) => grant.limit !== void 0)) throw new Error("PermDock: profile 'prod' needs limits: a grant has a limit and every call would deny with limit-unavailable; pass limits: limits(store)");
 }
 /**
-* The in-process services `dev` fills in: one memory approval store that
-* every adapter of the app shares, and memory limits when a grant has a
-* `limit`. They live here, not in the adapters, so an adapter ships no store
-* and an app without `defineApp` ships neither.
+* The in-process services `dev` fills in: one memory approval store that every
+* adapter of the app shares, and memory limits when a grant has a `limit`. They
+* live here, not in the adapters, so an adapter ships no store and an app
+* without `defineApp` ships neither.
 */
 function devDefaults(policy, options) {
 	return {
@@ -1305,10 +1387,10 @@ function devDefaults(policy, options) {
 	};
 }
 /**
-* Binds the app's sources, features and services to `policy`. The result
-* is a policy: pass it wherever a policy goes (`createPermDock`, every
-* adapter, the CLI) and each picks up the app definition, with its own
-* options taking precedence. The profile defaults to `prod`.
+* Binds the app's sources, features and services to `policy`. The result is a
+* policy: pass it wherever a policy goes (`createPermDock`, every adapter, the
+* CLI) and each picks up the app definition, with its own options taking
+* precedence. The profile defaults to `prod`.
 */
 function defineApp(policy, options = {}) {
 	const profile = options.profile ?? "prod";
@@ -1356,12 +1438,12 @@ function legacyDecision(allowed, permission, subject) {
 	});
 }
 /**
-* Runs PermDock beside the application's existing checks while adopting
-* it. Each `can`, `decide`, `decideEach`, `filter` and `assert` asks both;
-* the legacy answer is returned unless the permission is in `enforce`, and
-* every disagreement reaches `onMismatch`. Promote permissions one by one
-* as their mismatches are resolved, then remove the wrap. Pass it as an
-* adapter's `wrap` option, or call it on a core instance.
+* Runs PermDock beside the application's existing checks while adopting it.
+* Each `can`, `decide`, `decideEach`, `filter` and `assert` asks both; the
+* legacy answer is returned unless the permission is in `enforce`, and every
+* disagreement reaches `onMismatch`. Promote permissions one by one as their
+* mismatches are resolved, then remove the wrap. Pass it as an adapter's `wrap`
+* option, or call it on a core instance.
 */
 function shadowMode(options) {
 	const enforced = (permission) => options.enforce === "all" || (options.enforce ?? []).some((item) => item.key === permission.key);
@@ -1466,9 +1548,9 @@ function ofTenant(tenant, roles) {
 	return Array.isArray(roles) ? roles.filter((role) => role !== null && typeof role === "object" && Reflect.get(role, "tenant") === tenant) : [];
 }
 /**
-* A `CustomRoleSource` over a reader that returns every custom role of a tenant.
-* It keeps only the roles of the requested tenant. With `read: 'held'` it
-* skips a tenant's read, and `globalRoles` and `sharedRoles`, when the
+* A `CustomRoleSource` over a reader that returns every custom role of a
+* tenant. It keeps only the roles of the requested tenant. With `read: 'held'`
+* it skips a tenant's read, and `globalRoles` and `sharedRoles`, when the
 * subject holds only declared roles there.
 */
 function customRoleSource(reader, options = {}) {
@@ -1497,10 +1579,10 @@ function withPlans(subject, plans) {
 	}));
 }
 /**
-* Builds the serializable access snapshot for a subject without a request,
-* a network call or a cache directive: call it inside the app's own
-* `'use cache: private'` function. Synchronous; the policy's `subject` and
-* `context` mappers must be synchronous too.
+* Builds the serializable access snapshot for a subject without a request, a
+* network call or a cache directive: call it inside the app's own `'use cache:
+* private'` function. Synchronous; the policy's `subject` and `context` mappers
+* must be synchronous too.
 */
 function snapshotFor(policy, user, options = {}) {
 	const auth = [];
@@ -1601,15 +1683,17 @@ function writable(options) {
 //#endregion
 //#region src/core/scope-helpers.ts
 /**
-* The canonical form PermDock evaluates one membership in, or `undefined`
-* when it is malformed and grants nothing. `scopes` is the policy's or the
-* catalog's scope list; absent or empty means the implicit `tenant` and
-* `team` pair.
+* The canonical form PermDock evaluates one membership in, or `undefined` when
+* it is malformed and grants nothing. `scopes` is the policy's or the catalog's
+* scope list; absent or empty means the implicit `tenant` and `team` pair.
 */
 function normalizeMembership(input, scopes) {
 	return normalizeMembership$1(input, scopeList(scopes));
 }
-/** Every well-formed membership of `input` in canonical form; malformed entries are dropped. */
+/**
+* Every well-formed membership of `input` in canonical form; malformed entries
+* are dropped.
+*/
 function normalizeMemberships(input, scopes) {
 	return normalizeMemberships$1(input, scopeList(scopes));
 }
@@ -1629,14 +1713,20 @@ function coversInstance(membership, scopes, scope, id, within) {
 	const wanted = within === void 0 ? void 0 : Object.entries(within).find(([key]) => resolveScope$1(scopes, key) === membership.scope)?.[1] ?? void 0;
 	return wanted !== void 0 && scopeIdOf(membership, membership.scope) === wanted;
 }
-/** Roles the principal holds at the instance, at an ancestor named in `within`, or globally. */
+/**
+* Roles the principal holds at the instance, at an ancestor named in `within`,
+* or globally.
+*/
 function rolesAtInstance(policy, principal, scopes, scope, id, within, now) {
 	const declared = declaredRoleNames(policy);
 	const names = new Set((principal.roles ?? []).filter((name) => declared.has(name)));
 	for (const membership of principal.memberships ?? []) if (!isMembershipExpired(membership, now) && coversInstance(membership, scopes, scope, id, within)) for (const name of membership.roles) names.add(name);
 	return rankRoles(policy, [...names]);
 }
-/** Whether the principal holds `role` on a live membership of exactly this instance. */
+/**
+* Whether the principal holds `role` on a live membership of exactly this
+* instance.
+*/
 function holdsAt(principal, role, scope, id, now) {
 	return (principal.memberships ?? []).some((membership) => membership.scope === scope && sameId(membership.id, id) && !isMembershipExpired(membership, now) && membership.roles.includes(role));
 }
@@ -1644,8 +1734,8 @@ function includedRoles(role) {
 	return isReadonlyArray(role.includes) ? role.includes.filter((name) => typeof name === "string") : [];
 }
 /**
-* The membership kinds a custom role may be held through: those every
-* included declared role with `for` allows. `undefined` when none restricts.
+* The membership kinds a custom role may be held through: those every included
+* declared role with `for` allows. `undefined` when none restricts.
 */
 function customForKinds(policy, role) {
 	let kinds;
@@ -1691,10 +1781,10 @@ function countRules(rules, holders, delta, deny) {
 }
 /**
 * The rules of a role change that need no subject: `assigns`, `for`,
-* `exclusiveWith`, `min`, `max` and `transferOnly`, from holder counts and
-* the target's roles alone. `decideRoleChange` runs the same function after
-* its actor, tenant and ceiling checks; a service that holds only the
-* catalog calls it with the `CatalogRole` entries.
+* `exclusiveWith`, `min`, `max` and `transferOnly`, from holder counts and the
+* target's roles alone. `decideRoleChange` runs the same function after its
+* actor, tenant and ceiling checks; a service that holds only the catalog calls
+* it with the `CatalogRole` entries.
 */
 function checkRoleChange(role, input) {
 	const name = role.key;
@@ -1769,12 +1859,12 @@ function heldAnchor(principal, scopes, scope, id, now) {
 * the instance's own principal; nothing in `change` can stand in for it.
 */
 /**
-* Whether the subject of `permdock` may assign, revoke or transfer a role
-* in one scope instance: `assigns`, the ceiling, `for`, `exclusiveWith`,
-* `min`, `max` and `transferOnly`. It never writes; the application does,
-* and generated RLS triggers re-check the holder counts at commit. A nested
-* instance's tenant comes from a live membership the subject holds on it,
-* or from `change.within` only with `{ trusted: true }`; otherwise
+* Whether the subject of `permdock` may assign, revoke or transfer a role in
+* one scope instance: `assigns`, the ceiling, `for`, `exclusiveWith`, `min`,
+* `max` and `transferOnly`. It never writes; the application does, and
+* generated RLS triggers re-check the holder counts at commit. A nested
+* instance's tenant comes from a live membership the subject holds on it, or
+* from `change.within` only with `{ trusted: true }`; otherwise
 * `no-membership`. An instance built from a snapshot denies with
 * `unsupported`.
 */
@@ -1931,8 +2021,8 @@ function field(value) {
 	return /[",\r\n]/u.test(text) ? `"${text.replaceAll("\"", "\"\"")}"` : text;
 }
 /**
-* One RFC 4180 row for a decision or approval event, without a line
-* terminator; join rows with CRLF under a `CSV_COLUMNS` header.
+* One RFC 4180 row for a decision or approval event, without a line terminator;
+* join rows with CRLF under a `CSV_COLUMNS` header.
 */
 function toCsvRow(event) {
 	return [

package/dist/ssf/index.d.ts

@@ -1,4 +1,4 @@
-import { A as SsfSubject, C as SsfEventName, D as SsfReceiver, E as SsfPermDockOptions, M as SsfTransmitterConfiguration, N as SsfVerification, O as SsfStreamConfiguration, S as SsfEventListener, T as SsfPermDock, _ as SetSubject, a as PollHandle, b as SsfEventHandler, c as PushSetOptions, d as SetDelivery, f as SetDeliveryFailureCause, g as SetQueue, h as SetPollHandlerOptions, i as CaepReason, j as SsfSubjectResolver, k as SsfStreamStatus, l as ReplayStore, m as SetEvent, n as CaepEventName, o as PollOptions, p as SetError, r as CaepInitiatingEntity, s as PollResult, t as CaepCommon, u as RiscEventName, v as SignSetOptions, w as SsfOnEvent, x as SsfEventInput, y as SsfAuditEvent } from "../types-cTos-H7p.js";
-import { t as memoryReplayStore } from "../replay-DCDD_ZfL.js";
-import { A as createPermDock, C as memorySsfStreamStore, D as PollSetsResult, E as PollSetsOptions, O as PolledSet, S as SsfStreamStore, T as setPollHandler, _ as SsfFanOut, a as CaepTokenClaimsChange, b as ssfTransmitter, c as RiscEvents, d as caepEvents, f as pushSet, g as FanOutSetOptions, h as streamVerificationEvent, i as CaepEvents, k as pollSets, l as SSF_POLL_DELIVERY, m as signSet, n as CaepCredentialChange, o as RiscAccountDisabled, p as riscEvents, r as CaepDeviceComplianceChange, s as RiscCredentialCompromise, t as CaepAssuranceLevelChange, u as SSF_PUSH_DELIVERY, v as SsfTransmitterOptions, w as memorySetQueue, x as SsfStream, y as fanOutSet } from "../index-CMiPH2Tv.js";
+import { A as SsfSubject, C as SsfEventName, D as SsfReceiver, E as SsfPermDockOptions, M as SsfTransmitterConfiguration, N as SsfVerification, O as SsfStreamConfiguration, S as SsfEventListener, T as SsfPermDock, _ as SetSubject, a as PollHandle, b as SsfEventHandler, c as PushSetOptions, d as SetDelivery, f as SetDeliveryFailureCause, g as SetQueue, h as SetPollHandlerOptions, i as CaepReason, j as SsfSubjectResolver, k as SsfStreamStatus, l as ReplayStore, m as SetEvent, n as CaepEventName, o as PollOptions, p as SetError, r as CaepInitiatingEntity, s as PollResult, t as CaepCommon, u as RiscEventName, v as SignSetOptions, w as SsfOnEvent, x as SsfEventInput, y as SsfAuditEvent } from "../types-DjuMBNF9.js";
+import { t as memoryReplayStore } from "../replay-DNftIb_R.js";
+import { A as createPermDock, C as memorySsfStreamStore, D as PollSetsResult, E as PollSetsOptions, O as PolledSet, S as SsfStreamStore, T as setPollHandler, _ as SsfFanOut, a as CaepTokenClaimsChange, b as ssfTransmitter, c as RiscEvents, d as caepEvents, f as pushSet, g as FanOutSetOptions, h as streamVerificationEvent, i as CaepEvents, k as pollSets, l as SSF_POLL_DELIVERY, m as signSet, n as CaepCredentialChange, o as RiscAccountDisabled, p as riscEvents, r as CaepDeviceComplianceChange, s as RiscCredentialCompromise, t as CaepAssuranceLevelChange, u as SSF_PUSH_DELIVERY, v as SsfTransmitterOptions, w as memorySetQueue, x as SsfStream, y as fanOutSet } from "../index-BhxEUY9J.js";
 export { type CaepAssuranceLevelChange, type CaepCommon, type CaepCredentialChange, type CaepDeviceComplianceChange, type CaepEventName, type CaepEvents, type CaepInitiatingEntity, type CaepReason, type CaepTokenClaimsChange, type FanOutSetOptions, type PollHandle, type PollOptions, type PollResult, type PollSetsOptions, type PollSetsResult, type PolledSet, type PushSetOptions, type ReplayStore, type RiscAccountDisabled, type RiscCredentialCompromise, type RiscEventName, type RiscEvents, SSF_POLL_DELIVERY, SSF_PUSH_DELIVERY, type SetDelivery, type SetDeliveryFailureCause, type SetError, type SetEvent, type SetPollHandlerOptions, type SetQueue, type SetSubject, type SignSetOptions, type SsfAuditEvent, type SsfEventHandler, type SsfEventInput, type SsfEventListener, type SsfEventName, type SsfFanOut, type SsfOnEvent, type SsfPermDock, type SsfPermDockOptions, type SsfReceiver, type SsfStream, type SsfStreamConfiguration, type SsfStreamStatus, type SsfStreamStore, type SsfSubject, type SsfSubjectResolver, type SsfTransmitterConfiguration, type SsfTransmitterOptions, type SsfVerification, caepEvents, createPermDock, fanOutSet, memoryReplayStore, memorySetQueue, memorySsfStreamStore, pollSets, pushSet, riscEvents, setPollHandler, signSet, ssfTransmitter, streamVerificationEvent };