@shivaedev/react 0.19.0 → 0.20.0

package/CHANGELOG.md

@@ -1,5 +1,11 @@
 # Changelog
 
+## 0.20.0 - 2026-10-27
+
+### Added
+
+- Read session grants with `can` and `useCan`, guard TanStack routes with `staticData.permission` and `permissionGuard`, and render one `PermissionBoundary` fallback for refused routes and forbidden queries. Signed-out route visits redirect to the application's sign-in path with their return location.
+
 ## 0.19.0 - 2026-10-27
 
 ### Breaking

package/README.md

@@ -704,6 +704,81 @@ const query = Atom.swr(atom, {
 
 `atom` is the underlying native query. `Atom.swr` owns the staleness decision; the signal only reports that the application resumed.
 
+### Session permissions and guarded routes
+
+Permissions come from the session payload's `user.permissions`, populated by `@shivaedev/access` through the server's role policy. `can(session, permission)` reads exact name and strength grants without making a request. `useCan()` supplies the same check from the nearest `PermissionBoundary` for component controls. A signed-out session has no grants. These checks control visibility; the server still authorizes every request.
+
+Declare a route's requirement in TanStack's native `staticData.permission`. Install `permissionGuard` once as the root route's `beforeLoad`; it checks the matched routes before their loaders run. Signed-out visitors go to the app's `signIn` path with the full requested location in the `returnTo` search field. A signed-in session without a required grant throws the shared `Forbidden` failure.
+
+```tsx
+import { RegistryContext } from "@effect/atom-react";
+import { createRootRouteWithContext, createRoute, createRouter, RouterProvider } from "@tanstack/react-router";
+import type * as AtomRegistry from "effect/reactivity/AtomRegistry";
+import { permission } from "@shivaedev/access/permission.ts";
+import { PermissionBoundary, useCan } from "@shivaedev/react/client/permissionBoundary.ts";
+import { useLoaderQuery } from "@shivaedev/react/client/useLoaderQuery.ts";
+import { permissionGuard } from "@shivaedev/react/permissionGuard.ts";
+import { can, type PermissionSession } from "@shivaedev/react/permissions.ts";
+import { queryRoute } from "@shivaedev/react/queryRoute.ts";
+import { api, registry } from "./notes-client.ts";
+import { auth, SignIn } from "./auth.tsx";
+
+const ReadNotes = permission("notes.read");
+const root = createRootRouteWithContext<{ registry: AtomRegistry.AtomRegistry }>()({
+  beforeLoad: permissionGuard({ session: () => auth.session, signIn: "/login" }),
+});
+const note = createRoute({
+  getParentRoute: () => root,
+  path: "/notes/$id",
+  staticData: { permission: ReadNotes },
+  ...queryRoute(({ params }: { params: { id: string }; search: Record<string, never> }) =>
+    api.get.query({ id: params.id, page: 1 }),
+  ),
+  component: () => {
+    const query = useLoaderQuery(api.get.query({ ...note.useParams(), page: 1 }), note.useLoaderData());
+    return <h1>{query.data.title}</h1>;
+  },
+});
+const login = createRoute({
+  getParentRoute: () => root,
+  path: "/login",
+  validateSearch: (search: Record<string, unknown>) => ({
+    returnTo: typeof search.returnTo === "string" ? search.returnTo : "/",
+  }),
+  component: () => {
+    const { returnTo } = login.useSearch();
+    return <SignIn onSignedIn={() => router.navigate({ href: returnTo })} />;
+  },
+});
+const router = createRouter({
+  context: { registry },
+  routeTree: root.addChildren([note, login]),
+  disableGlobalCatchBoundary: true,
+});
+
+function Controls() {
+  const can = useCan();
+  return can(ReadNotes) ? <button type="button">Read notes</button> : null;
+}
+
+export function App({ session }: { readonly session: PermissionSession | undefined }) {
+  return (
+    <PermissionBoundary session={session} fallback={<h1>Permission denied</h1>}>
+      <RegistryContext.Provider value={registry}>
+        <Controls />
+        <RouterProvider router={router} />
+      </RegistryContext.Provider>
+    </PermissionBoundary>
+  );
+}
+
+const showNotes = can(auth.session, ReadNotes);
+```
+
+`auth` owns the current session and passes it to `App`; `SignIn` updates that session before invoking `onSignedIn`. Use the session's registry for router context and React, as with other query routes. Importing `permissionGuard` augments TanStack's `StaticDataRouteOption`; route options and their inference remain native.
+
+`PermissionBoundary` renders the app's one fallback at the denied URL for a refused route, a loader's `Forbidden`, or a `useQuery`/`useLoaderQuery` result tagged `Forbidden`. Other errors propagate to an enclosing error boundary. Set TanStack's `disableGlobalCatchBoundary: true` and leave permission failures to this boundary; a route-specific `errorComponent` that consumes an error owns its rendering instead. Without a permission boundary, query failures keep their normal typed state. Like a React error boundary, remount it to clear a caught failure.
+
 ### API
 
 `useQuery(atom)` and `useAction(atom)` return these shared fields:

package/dist/client/permissionBoundary.d.ts

@@ -0,0 +1,11 @@
+import { type ReactNode } from "react";
+import type { Permission } from "@shivaedev/access/permission.ts";
+import { type PermissionSession } from "#permissions.ts";
+export interface PermissionBoundaryProps {
+    readonly children: ReactNode;
+    readonly fallback: ReactNode;
+    readonly session: PermissionSession | null | undefined;
+}
+export declare function useCan(): (permission: Permission) => boolean;
+export declare function PermissionBoundary({ children, fallback, session }: PermissionBoundaryProps): ReactNode;
+//# sourceMappingURL=permissionBoundary.d.ts.map

package/dist/client/permissionBoundary.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"permissionBoundary.d.ts","sourceRoot":"","sources":["../../src/client/permissionBoundary.ts"],"names":[],"mappings":"AAEA,OAAO,EAAiB,KAAK,SAAS,EAAc,MAAM,OAAO,CAAC;AAClE,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,iCAAiC,CAAC;AAElE,OAAO,EAAO,KAAK,iBAAiB,EAAE,MAAM,iBAAiB,CAAC;AAE9D,MAAM,WAAW,uBAAuB;IACvC,QAAQ,CAAC,QAAQ,EAAE,SAAS,CAAC;IAC7B,QAAQ,CAAC,QAAQ,EAAE,SAAS,CAAC;IAC7B,QAAQ,CAAC,OAAO,EAAE,iBAAiB,GAAG,IAAI,GAAG,SAAS,CAAC;CACvD;AAED,wBAAgB,MAAM,IAAI,CAAC,UAAU,EAAE,UAAU,KAAK,OAAO,CAG5D;AAUD,wBAAgB,kBAAkB,CAAC,EAAE,QAAQ,EAAE,QAAQ,EAAE,OAAO,EAAE,EAAE,uBAAuB,GAAG,SAAS,CAMtG"}

package/dist/client/permissionBoundary.js

@@ -0,0 +1,20 @@
+import { CatchBoundary } from "@tanstack/react-router";
+import { Predicate } from "effect";
+import { createElement, useContext } from "react";
+import { PermissionContext } from "#internal/PermissionContext.ts";
+import { can } from "#permissions.ts";
+export function useCan() {
+    const context = useContext(PermissionContext);
+    return (permission) => can(context?.session, permission);
+}
+function PermissionFailure({ error }) {
+    const context = useContext(PermissionContext);
+    if (!Predicate.isTagged(error, "Forbidden")) {
+        throw error;
+    }
+    return context?.fallback;
+}
+export function PermissionBoundary({ children, fallback, session }) {
+    return createElement(PermissionContext.Provider, { value: { fallback, session } }, createElement(CatchBoundary, { children, errorComponent: PermissionFailure, getResetKey: () => "permission" }));
+}
+//# sourceMappingURL=permissionBoundary.js.map

package/dist/client/permissionBoundary.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"permissionBoundary.js","sourceRoot":"","sources":["../../src/client/permissionBoundary.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,MAAM,wBAAwB,CAAC;AACvD,OAAO,EAAE,SAAS,EAAE,MAAM,QAAQ,CAAC;AACnC,OAAO,EAAE,aAAa,EAAkB,UAAU,EAAE,MAAM,OAAO,CAAC;AAElE,OAAO,EAAE,iBAAiB,EAAE,MAAM,gCAAgC,CAAC;AACnE,OAAO,EAAE,GAAG,EAA0B,MAAM,iBAAiB,CAAC;AAQ9D,MAAM,UAAU,MAAM;IACrB,MAAM,OAAO,GAAG,UAAU,CAAC,iBAAiB,CAAC,CAAC;IAC9C,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,GAAG,CAAC,OAAO,EAAE,OAAO,EAAE,UAAU,CAAC,CAAC;AAC1D,CAAC;AAED,SAAS,iBAAiB,CAAC,EAAE,KAAK,EAA+B;IAChE,MAAM,OAAO,GAAG,UAAU,CAAC,iBAAiB,CAAC,CAAC;IAC9C,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,KAAK,EAAE,WAAW,CAAC,EAAE,CAAC;QAC7C,MAAM,KAAK,CAAC;IACb,CAAC;IACD,OAAO,OAAO,EAAE,QAAQ,CAAC;AAC1B,CAAC;AAED,MAAM,UAAU,kBAAkB,CAAC,EAAE,QAAQ,EAAE,QAAQ,EAAE,OAAO,EAA2B;IAC1F,OAAO,aAAa,CACnB,iBAAiB,CAAC,QAAQ,EAC1B,EAAE,KAAK,EAAE,EAAE,QAAQ,EAAE,OAAO,EAAE,EAAE,EAChC,aAAa,CAAC,aAAa,EAAE,EAAE,QAAQ,EAAE,cAAc,EAAE,iBAAiB,EAAE,WAAW,EAAE,GAAG,EAAE,CAAC,YAAY,EAAE,CAAC,CAC9G,CAAC;AACH,CAAC"}

package/dist/client/resultState.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"resultState.d.ts","sourceRoot":"","sources":["../../src/client/resultState.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,KAAK,EAAE,KAAK,QAAQ,EAAE,KAAK,MAAM,EAAE,MAAM,EAAa,MAAM,QAAQ,CAAC;AAC9E,OAAO,KAAK,WAAW,MAAM,+BAA+B,CAAC;AAC7D,OAAO,KAAK,KAAK,IAAI,MAAM,wBAAwB,CAAC;AAIpD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAGvD,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AACpD,OAAO,EAAE,KAAK,aAAa,EAAmB,MAAM,uBAAuB,CAAC;AAG5E,MAAM,WAAW,WAAW,CAAC,CAAC,EAAE,CAAC;IAChC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;IAC9C,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;IAChC,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAC1B,QAAQ,CAAC,UAAU,EAAE,OAAO,CAAC;IAC7B,QAAQ,CAAC,MAAM,EAAE,WAAW,CAAC,WAAW,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;CAC/C;AAUD,wBAAgB,cAAc,CAAC,CAAC,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,OAAO,CAEhE;AASD,MAAM,WAAW,UAAU,CAAC,CAAC,EAAE,CAAC,CAAE,SAAQ,WAAW,CAAC,CAAC,EAAE,CAAC,CAAC;IAC1D,QAAQ,CAAC,OAAO,EAAE,MAAM,IAAI,CAAC;CAC7B;AACD,MAAM,WAAW,YAAY,CAAC,CAAC,GAAG,OAAO;IACxC,QAAQ,CAAC,cAAc,CAAC,EAAE,QAAQ,CAAC,KAAK,GAAG,SAAS,CAAC;IACrD,QAAQ,CAAC,gBAAgB,CAAC,EAAE,OAAO,CAAC;IACpC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC,OAAO,EAAE;QAAE,QAAQ,CAAC,KAAK,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;QAAC,QAAQ,CAAC,UAAU,EAAE,OAAO,CAAA;KAAE,KAAK,gBAAgB,GAAG,SAAS,CAAC;CAC9H;AASD,wBAAgB,QAAQ,CAAC,CAAC,EAAE,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,WAAW,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,OAAO,GAAE,YAAY,CAAC,CAAC,CAAM,GAAG,UAAU,CAAC,CAAC,EAAE,CAAC,CAAC,CAyB9H;AACD,MAAM,WAAW,WAAW,CAAC,MAAM,EAAE,CAAC,EAAE,CAAC,CAAE,SAAQ,WAAW,CAAC,CAAC,EAAE,CAAC,CAAC;IACnE,QAAQ,CAAC,QAAQ,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,IAAI,CAAC;CAC3C;AACD,wBAAgB,SAAS,CAAC,MAAM,EAAE,CAAC,EAAE,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,YAAY,CAAC,MAAM,EAAE,CAAC,EAAE,CAAC,CAAC,GAAG,WAAW,CAAC,MAAM,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC;AAC1G,wBAAgB,SAAS,CAAC,MAAM,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,aAAa,EACvD,OAAO,EAAE,IAAI,CAAC,WAAW,CAAC,CAAC,EAAE,aAAa,CAAC,EAC3C,GAAG,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC,EAAE,YAAY,CAAC,CAAC,CAAC,CAAC,EAC5D,OAAO,CAAC,EAAE,aAAa,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,GACjE,WAAW,CAAC,MAAM,EAAE,CAAC,EAAE,CAAC,GAAG,aAAa,CAAC,CAAC"}
+{"version":3,"file":"resultState.d.ts","sourceRoot":"","sources":["../../src/client/resultState.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,KAAK,EAAE,KAAK,QAAQ,EAAE,KAAK,MAAM,EAAE,MAAM,EAAa,MAAM,QAAQ,CAAC;AAC9E,OAAO,KAAK,WAAW,MAAM,+BAA+B,CAAC;AAC7D,OAAO,KAAK,KAAK,IAAI,MAAM,wBAAwB,CAAC;AAIpD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAIvD,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AACpD,OAAO,EAAE,KAAK,aAAa,EAAmB,MAAM,uBAAuB,CAAC;AAG5E,MAAM,WAAW,WAAW,CAAC,CAAC,EAAE,CAAC;IAChC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;IAC9C,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;IAChC,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAC1B,QAAQ,CAAC,UAAU,EAAE,OAAO,CAAC;IAC7B,QAAQ,CAAC,MAAM,EAAE,WAAW,CAAC,WAAW,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;CAC/C;AAUD,wBAAgB,cAAc,CAAC,CAAC,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,OAAO,CAEhE;AASD,MAAM,WAAW,UAAU,CAAC,CAAC,EAAE,CAAC,CAAE,SAAQ,WAAW,CAAC,CAAC,EAAE,CAAC,CAAC;IAC1D,QAAQ,CAAC,OAAO,EAAE,MAAM,IAAI,CAAC;CAC7B;AACD,MAAM,WAAW,YAAY,CAAC,CAAC,GAAG,OAAO;IACxC,QAAQ,CAAC,cAAc,CAAC,EAAE,QAAQ,CAAC,KAAK,GAAG,SAAS,CAAC;IACrD,QAAQ,CAAC,gBAAgB,CAAC,EAAE,OAAO,CAAC;IACpC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC,OAAO,EAAE;QAAE,QAAQ,CAAC,KAAK,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;QAAC,QAAQ,CAAC,UAAU,EAAE,OAAO,CAAA;KAAE,KAAK,gBAAgB,GAAG,SAAS,CAAC;CAC9H;AASD,wBAAgB,QAAQ,CAAC,CAAC,EAAE,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,WAAW,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,OAAO,GAAE,YAAY,CAAC,CAAC,CAAM,GAAG,UAAU,CAAC,CAAC,EAAE,CAAC,CAAC,CA2B9H;AACD,MAAM,WAAW,WAAW,CAAC,MAAM,EAAE,CAAC,EAAE,CAAC,CAAE,SAAQ,WAAW,CAAC,CAAC,EAAE,CAAC,CAAC;IACnE,QAAQ,CAAC,QAAQ,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,IAAI,CAAC;CAC3C;AACD,wBAAgB,SAAS,CAAC,MAAM,EAAE,CAAC,EAAE,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,YAAY,CAAC,MAAM,EAAE,CAAC,EAAE,CAAC,CAAC,GAAG,WAAW,CAAC,MAAM,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC;AAC1G,wBAAgB,SAAS,CAAC,MAAM,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,aAAa,EACvD,OAAO,EAAE,IAAI,CAAC,WAAW,CAAC,CAAC,EAAE,aAAa,CAAC,EAC3C,GAAG,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC,EAAE,YAAY,CAAC,CAAC,CAAC,CAAC,EAC5D,OAAO,CAAC,EAAE,aAAa,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,GACjE,WAAW,CAAC,MAAM,EAAE,CAAC,EAAE,CAAC,GAAG,aAAa,CAAC,CAAC"}

package/dist/client/resultState.js

@@ -4,6 +4,7 @@ import * as AsyncResult from "effect/reactivity/AsyncResult";
 import { useContext, useEffect, useState } from "react";
 import { queryCoalesceWindow } from "@shivaedev/contract/queryCoalesceWindow.ts";
 import { acceptLoaderQuery } from "#internal/queryHandoff.ts";
+import { usePermissionFailure } from "#internal/usePermissionFailure.ts";
 import { useQueryNotice } from "#internal/useQueryNotice.ts";
 import { useActionSource } from "./actionCompletion.js";
 import { useSessionRecheck } from "./sessionBoundary.js";
@@ -51,7 +52,9 @@ export function useQuery(atom, options = {}) {
     }
     useRecheckOnUnauthorized(result);
     useQueryNotice(result, Option.isSome(data), options.notice);
-    return { ...state(result, data), refresh: useAtomRefresh(atom) };
+    const refresh = useAtomRefresh(atom);
+    usePermissionFailure(AsyncResult.cause(result));
+    return { ...state(result, data), refresh };
 }
 export function useAction(source, run, options = {}) {
     const atom = useActionSource(source, run, options);

package/dist/client/resultState.js.map

@@ -1 +1 @@
-{"version":3,"file":"resultState.js","sourceRoot":"","sources":["../../src/client/resultState.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,cAAc,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAC/F,OAAO,EAAE,KAAK,EAA8B,MAAM,EAAE,SAAS,EAAE,MAAM,QAAQ,CAAC;AAC9E,OAAO,KAAK,WAAW,MAAM,+BAA+B,CAAC;AAG7D,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,OAAO,CAAC;AACxD,OAAO,EAAE,mBAAmB,EAAE,MAAM,4CAA4C,CAAC;AAEjF,OAAO,EAAE,iBAAiB,EAAE,MAAM,2BAA2B,CAAC;AAC9D,OAAO,EAAE,cAAc,EAAE,MAAM,6BAA6B,CAAC;AAE7D,OAAO,EAAsB,eAAe,EAAE,MAAM,uBAAuB,CAAC;AAC5E,OAAO,EAAE,iBAAiB,EAAE,MAAM,sBAAsB,CAAC;AASzD,SAAS,KAAK,CAAO,MAAqC,EAAE,IAAI,GAAG,WAAW,CAAC,KAAK,CAAC,MAAM,CAAC;IAC3F,OAAO;QACN,KAAK,EAAE,WAAW,CAAC,KAAK,CAAC,MAAM,CAAC;QAChC,IAAI;QACJ,OAAO,EAAE,MAAM,CAAC,OAAO;QACvB,UAAU,EAAE,MAAM,CAAC,OAAO,IAAI,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC;QACjD,MAAM;KACN,CAAC;AACH,CAAC;AACD,MAAM,UAAU,cAAc,CAAI,KAAqB;IACtD,OAAO,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,eAAe,CAAC,KAAK,CAAC,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,SAAS,CAAC,QAAQ,CAAC,KAAK,EAAE,cAAc,CAAC,EAAE,CAAC,CAAC;AAC1I,CAAC;AACD,SAAS,wBAAwB,CAAO,MAAqC,EAAE,OAAO,GAAG,IAAI;IAC5F,MAAM,OAAO,GAAG,iBAAiB,EAAE,CAAC;IACpC,SAAS,CAAC,GAAG,EAAE;QACd,IAAI,OAAO,IAAI,WAAW,CAAC,SAAS,CAAC,MAAM,CAAC,IAAI,cAAc,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC;YAC9E,OAAO,EAAE,CAAC;QACX,CAAC;IACF,CAAC,EAAE,CAAC,OAAO,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC,CAAC;AAChC,CAAC;AAiBD,MAAM,UAAU,QAAQ,CAAO,IAA8C,EAAE,OAAO,GAAoB,EAAE;IAC3G,MAAM,MAAM,GAAG,YAAY,CAAC,IAAI,CAAC,CAAC;IAClC,MAAM,QAAQ,GAAG,UAAU,CAAC,eAAe,CAAC,CAAC;IAC7C,SAAS,CAAC,GAAG,EAAE,CAAC,iBAAiB,CAAC,QAAQ,EAAE,IAAI,CAAC,EAAE,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC,CAAC;IACrE,SAAS,CAAC,GAAG,EAAE;QACd,IAAI,OAAO,CAAC,cAAc,KAAK,SAAS,EAAE,CAAC;YAC1C,OAAO;QACR,CAAC;QACD,MAAM,MAAM,GAAG,mBAAmB,CAAC,IAAI,CAAC,CAAC;QACzC,QAAQ,CAAC,GAAG,CAAC,MAAM,EAAE,OAAO,CAAC,cAAc,CAAC,CAAC;QAC7C,OAAO,GAAG,EAAE,CAAC,QAAQ,CAAC,GAAG,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;IAC9C,CAAC,EAAE,CAAC,QAAQ,EAAE,IAAI,EAAE,OAAO,CAAC,cAAc,CAAC,CAAC,CAAC;IAC7C,MAAM,gBAAgB,GAAG,OAAO,CAAC,gBAAgB,KAAK,IAAI,CAAC;IAC3D,MAAM,UAAU,GAAG,WAAW,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IAC7C,MAAM,CAAC,IAAI,EAAE,IAAI,CAAC,GAAG,QAAQ,CAAkB,GAAG,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,UAAU,EAAE,QAAQ,EAAE,IAAI,EAAE,gBAAgB,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC;IACvI,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,KAAK,QAAQ,IAAI,CAAC,IAAI,CAAC,QAAQ,KAAK,IAAI,IAAI,gBAAgB,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,EAAK,CAAC;IAC3H,MAAM,IAAI,GAAG,MAAM,CAAC,MAAM,CAAC,UAAU,EAAE,GAAG,EAAE,CAAC,QAAQ,CAAC,CAAC;IACvD,MAAM,QAAQ,GAAG,MAAM,CAAC,MAAM,CAAC,UAAU,CAAC,IAAI,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC;IAC7F,kGAAkG;IAClG,IAAI,IAAI,CAAC,IAAI,KAAK,IAAI,IAAI,IAAI,CAAC,QAAQ,KAAK,QAAQ,IAAI,IAAI,CAAC,MAAM,KAAK,MAAM,IAAI,IAAI,CAAC,gBAAgB,KAAK,gBAAgB,EAAE,CAAC;QAC9H,IAAI,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,QAAQ,EAAE,gBAAgB,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC,CAAC;IACpE,CAAC;IACD,wBAAwB,CAAC,MAAM,CAAC,CAAC;IACjC,cAAc,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC;IAC5D,OAAO,EAAE,GAAG,KAAK,CAAC,MAAM,EAAE,IAAI,CAAC,EAAE,OAAO,EAAE,cAAc,CAAC,IAAI,CAAC,EAAE,CAAC;AAClE,CAAC;AAUD,MAAM,UAAU,SAAS,CACxB,MAA4E,EAC5E,GAA6D,EAC7D,OAAO,GAAmC,EAAE;IAE5C,MAAM,IAAI,GAAG,eAAe,CAAC,MAAM,EAAE,GAAG,EAAE,OAAO,CAAC,CAAC;IACnD,MAAM,MAAM,GAAG,YAAY,CAAC,IAAI,CAAC,CAAC;IAClC,wBAAwB,CAAC,MAAM,EAAE,GAAG,KAAK,SAAS,CAAC,CAAC;IACpD,OAAO,EAAE,GAAG,KAAK,CAAC,MAAM,CAAC,EAAE,QAAQ,EAAE,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;AACzD,CAAC"}
+{"version":3,"file":"resultState.js","sourceRoot":"","sources":["../../src/client/resultState.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,cAAc,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAC/F,OAAO,EAAE,KAAK,EAA8B,MAAM,EAAE,SAAS,EAAE,MAAM,QAAQ,CAAC;AAC9E,OAAO,KAAK,WAAW,MAAM,+BAA+B,CAAC;AAG7D,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,OAAO,CAAC;AACxD,OAAO,EAAE,mBAAmB,EAAE,MAAM,4CAA4C,CAAC;AAEjF,OAAO,EAAE,iBAAiB,EAAE,MAAM,2BAA2B,CAAC;AAC9D,OAAO,EAAE,oBAAoB,EAAE,MAAM,mCAAmC,CAAC;AACzE,OAAO,EAAE,cAAc,EAAE,MAAM,6BAA6B,CAAC;AAE7D,OAAO,EAAsB,eAAe,EAAE,MAAM,uBAAuB,CAAC;AAC5E,OAAO,EAAE,iBAAiB,EAAE,MAAM,sBAAsB,CAAC;AASzD,SAAS,KAAK,CAAO,MAAqC,EAAE,IAAI,GAAG,WAAW,CAAC,KAAK,CAAC,MAAM,CAAC;IAC3F,OAAO;QACN,KAAK,EAAE,WAAW,CAAC,KAAK,CAAC,MAAM,CAAC;QAChC,IAAI;QACJ,OAAO,EAAE,MAAM,CAAC,OAAO;QACvB,UAAU,EAAE,MAAM,CAAC,OAAO,IAAI,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC;QACjD,MAAM;KACN,CAAC;AACH,CAAC;AACD,MAAM,UAAU,cAAc,CAAI,KAAqB;IACtD,OAAO,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,eAAe,CAAC,KAAK,CAAC,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,SAAS,CAAC,QAAQ,CAAC,KAAK,EAAE,cAAc,CAAC,EAAE,CAAC,CAAC;AAC1I,CAAC;AACD,SAAS,wBAAwB,CAAO,MAAqC,EAAE,OAAO,GAAG,IAAI;IAC5F,MAAM,OAAO,GAAG,iBAAiB,EAAE,CAAC;IACpC,SAAS,CAAC,GAAG,EAAE;QACd,IAAI,OAAO,IAAI,WAAW,CAAC,SAAS,CAAC,MAAM,CAAC,IAAI,cAAc,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC;YAC9E,OAAO,EAAE,CAAC;QACX,CAAC;IACF,CAAC,EAAE,CAAC,OAAO,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC,CAAC;AAChC,CAAC;AAiBD,MAAM,UAAU,QAAQ,CAAO,IAA8C,EAAE,OAAO,GAAoB,EAAE;IAC3G,MAAM,MAAM,GAAG,YAAY,CAAC,IAAI,CAAC,CAAC;IAClC,MAAM,QAAQ,GAAG,UAAU,CAAC,eAAe,CAAC,CAAC;IAC7C,SAAS,CAAC,GAAG,EAAE,CAAC,iBAAiB,CAAC,QAAQ,EAAE,IAAI,CAAC,EAAE,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC,CAAC;IACrE,SAAS,CAAC,GAAG,EAAE;QACd,IAAI,OAAO,CAAC,cAAc,KAAK,SAAS,EAAE,CAAC;YAC1C,OAAO;QACR,CAAC;QACD,MAAM,MAAM,GAAG,mBAAmB,CAAC,IAAI,CAAC,CAAC;QACzC,QAAQ,CAAC,GAAG,CAAC,MAAM,EAAE,OAAO,CAAC,cAAc,CAAC,CAAC;QAC7C,OAAO,GAAG,EAAE,CAAC,QAAQ,CAAC,GAAG,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;IAC9C,CAAC,EAAE,CAAC,QAAQ,EAAE,IAAI,EAAE,OAAO,CAAC,cAAc,CAAC,CAAC,CAAC;IAC7C,MAAM,gBAAgB,GAAG,OAAO,CAAC,gBAAgB,KAAK,IAAI,CAAC;IAC3D,MAAM,UAAU,GAAG,WAAW,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IAC7C,MAAM,CAAC,IAAI,EAAE,IAAI,CAAC,GAAG,QAAQ,CAAkB,GAAG,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,UAAU,EAAE,QAAQ,EAAE,IAAI,EAAE,gBAAgB,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC;IACvI,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,KAAK,QAAQ,IAAI,CAAC,IAAI,CAAC,QAAQ,KAAK,IAAI,IAAI,gBAAgB,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,EAAK,CAAC;IAC3H,MAAM,IAAI,GAAG,MAAM,CAAC,MAAM,CAAC,UAAU,EAAE,GAAG,EAAE,CAAC,QAAQ,CAAC,CAAC;IACvD,MAAM,QAAQ,GAAG,MAAM,CAAC,MAAM,CAAC,UAAU,CAAC,IAAI,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC;IAC7F,kGAAkG;IAClG,IAAI,IAAI,CAAC,IAAI,KAAK,IAAI,IAAI,IAAI,CAAC,QAAQ,KAAK,QAAQ,IAAI,IAAI,CAAC,MAAM,KAAK,MAAM,IAAI,IAAI,CAAC,gBAAgB,KAAK,gBAAgB,EAAE,CAAC;QAC9H,IAAI,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,QAAQ,EAAE,gBAAgB,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC,CAAC;IACpE,CAAC;IACD,wBAAwB,CAAC,MAAM,CAAC,CAAC;IACjC,cAAc,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC;IAC5D,MAAM,OAAO,GAAG,cAAc,CAAC,IAAI,CAAC,CAAC;IACrC,oBAAoB,CAAC,WAAW,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC;IAChD,OAAO,EAAE,GAAG,KAAK,CAAC,MAAM,EAAE,IAAI,CAAC,EAAE,OAAO,EAAE,CAAC;AAC5C,CAAC;AAUD,MAAM,UAAU,SAAS,CACxB,MAA4E,EAC5E,GAA6D,EAC7D,OAAO,GAAmC,EAAE;IAE5C,MAAM,IAAI,GAAG,eAAe,CAAC,MAAM,EAAE,GAAG,EAAE,OAAO,CAAC,CAAC;IACnD,MAAM,MAAM,GAAG,YAAY,CAAC,IAAI,CAAC,CAAC;IAClC,wBAAwB,CAAC,MAAM,EAAE,GAAG,KAAK,SAAS,CAAC,CAAC;IACpD,OAAO,EAAE,GAAG,KAAK,CAAC,MAAM,CAAC,EAAE,QAAQ,EAAE,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;AACzD,CAAC"}

package/dist/internal/PermissionContext.d.ts

@@ -0,0 +1,7 @@
+import { type ReactNode } from "react";
+import type { PermissionSession } from "#permissions.ts";
+export declare const PermissionContext: import("react").Context<{
+    readonly fallback: ReactNode;
+    readonly session: PermissionSession | null | undefined;
+} | undefined>;
+//# sourceMappingURL=PermissionContext.d.ts.map

package/dist/internal/PermissionContext.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"PermissionContext.d.ts","sourceRoot":"","sources":["../../src/internal/PermissionContext.ts"],"names":[],"mappings":"AAAA,OAAO,EAAiB,KAAK,SAAS,EAAE,MAAM,OAAO,CAAC;AACtD,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,iBAAiB,CAAC;AAEzD,eAAO,MAAM,iBAAiB;uBAAsC,SAAS;sBAAoB,iBAAiB,GAAG,IAAI,GAAG,SAAS;cAEpI,CAAC"}

package/dist/internal/PermissionContext.js

@@ -0,0 +1,3 @@
+import { createContext } from "react";
+export const PermissionContext = createContext(undefined);
+//# sourceMappingURL=PermissionContext.js.map

package/dist/internal/PermissionContext.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"PermissionContext.js","sourceRoot":"","sources":["../../src/internal/PermissionContext.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAkB,MAAM,OAAO,CAAC;AAGtD,MAAM,CAAC,MAAM,iBAAiB,GAAG,aAAa,CAC7C,SAAS,CACT,CAAC"}

package/dist/internal/usePermissionFailure.d.ts

@@ -0,0 +1,3 @@
+import { Cause, Option } from "effect";
+export declare function usePermissionFailure<E>(cause: Option.Option<Cause.Cause<E>>): void;
+//# sourceMappingURL=usePermissionFailure.d.ts.map

package/dist/internal/usePermissionFailure.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"usePermissionFailure.d.ts","sourceRoot":"","sources":["../../src/internal/usePermissionFailure.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,MAAM,EAAa,MAAM,QAAQ,CAAC;AAIlD,wBAAgB,oBAAoB,CAAC,CAAC,EAAE,KAAK,EAAE,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,GAAG,IAAI,CAQlF"}

package/dist/internal/usePermissionFailure.js

@@ -0,0 +1,13 @@
+import { Cause, Option, Predicate } from "effect";
+import { useContext } from "react";
+import { PermissionContext } from "./PermissionContext.js";
+export function usePermissionFailure(cause) {
+    const context = useContext(PermissionContext);
+    if (context !== undefined) {
+        const failure = Option.flatMap(cause, Cause.findErrorOption);
+        if (Option.isSome(failure) && Predicate.isTagged(failure.value, "Forbidden")) {
+            throw failure.value;
+        }
+    }
+}
+//# sourceMappingURL=usePermissionFailure.js.map

package/dist/internal/usePermissionFailure.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"usePermissionFailure.js","sourceRoot":"","sources":["../../src/internal/usePermissionFailure.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,QAAQ,CAAC;AAClD,OAAO,EAAE,UAAU,EAAE,MAAM,OAAO,CAAC;AACnC,OAAO,EAAE,iBAAiB,EAAE,MAAM,wBAAwB,CAAC;AAE3D,MAAM,UAAU,oBAAoB,CAAI,KAAoC;IAC3E,MAAM,OAAO,GAAG,UAAU,CAAC,iBAAiB,CAAC,CAAC;IAC9C,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;QAC3B,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC,KAAK,EAAE,KAAK,CAAC,eAAe,CAAC,CAAC;QAC7D,IAAI,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,SAAS,CAAC,QAAQ,CAAC,OAAO,CAAC,KAAK,EAAE,WAAW,CAAC,EAAE,CAAC;YAC9E,MAAM,OAAO,CAAC,KAAK,CAAC;QACrB,CAAC;IACF,CAAC;AACF,CAAC"}

package/dist/permissionGuard.d.ts

@@ -0,0 +1,22 @@
+import type { Permission } from "@shivaedev/access/permission.ts";
+import { type PermissionSession } from "./permissions.ts";
+declare module "@tanstack/react-router" {
+    interface StaticDataRouteOption {
+        readonly permission?: Permission;
+    }
+}
+export interface PermissionGuardOptions {
+    readonly session: () => PermissionSession | null | undefined;
+    readonly signIn: string;
+}
+export declare function permissionGuard({ session, signIn }: PermissionGuardOptions): ({ matches, location, }: {
+    readonly location: {
+        readonly href: string;
+    };
+    readonly matches: readonly {
+        readonly staticData: {
+            readonly permission?: Permission;
+        };
+    }[];
+}) => void;
+//# sourceMappingURL=permissionGuard.d.ts.map

package/dist/permissionGuard.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"permissionGuard.d.ts","sourceRoot":"","sources":["../src/permissionGuard.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,iCAAiC,CAAC;AAElE,OAAO,EAAO,KAAK,iBAAiB,EAAE,MAAM,kBAAkB,CAAC;AAE/D,OAAO,QAAQ,wBAAwB,CAAC;IACvC,UAAU,qBAAqB;QAC9B,QAAQ,CAAC,UAAU,CAAC,EAAE,UAAU,CAAC;KACjC;CACD;AAED,MAAM,WAAW,sBAAsB;IACtC,QAAQ,CAAC,OAAO,EAAE,MAAM,iBAAiB,GAAG,IAAI,GAAG,SAAS,CAAC;IAC7D,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACxB;AAED,wBAAgB,eAAe,CAAC,EAAE,OAAO,EAAE,MAAM,EAAE,EAAE,sBAAsB,4BAIvE;IACF,QAAQ,CAAC,QAAQ,EAAE;QAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC;IAC7C,QAAQ,CAAC,OAAO,EAAE,SAAS;QAAE,QAAQ,CAAC,UAAU,EAAE;YAAE,QAAQ,CAAC,UAAU,CAAC,EAAE,UAAU,CAAA;SAAE,CAAA;KAAE,EAAE,CAAC;CAC3F,KAAG,IAAI,CAeR"}

package/dist/permissionGuard.js

@@ -0,0 +1,21 @@
+import { redirect } from "@tanstack/react-router";
+import { Forbidden } from "@shivaedev/errors/taxonomy.ts";
+import { can } from "./permissions.js";
+export function permissionGuard({ session, signIn }) {
+    return ({ matches, location, }) => {
+        const required = matches.flatMap((match) => (match.staticData.permission === undefined ? [] : [match.staticData.permission]));
+        if (required.length === 0) {
+            return;
+        }
+        const current = session();
+        if (current === null || current === undefined) {
+            throw redirect({ search: { returnTo: location.href }, to: signIn });
+        }
+        for (const permission of required) {
+            if (!can(current, permission)) {
+                throw new Forbidden({ message: `Permission required: ${permission.name} (${permission.strength})` });
+            }
+        }
+    };
+}
+//# sourceMappingURL=permissionGuard.js.map

package/dist/permissionGuard.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"permissionGuard.js","sourceRoot":"","sources":["../src/permissionGuard.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,wBAAwB,CAAC;AAElD,OAAO,EAAE,SAAS,EAAE,MAAM,+BAA+B,CAAC;AAC1D,OAAO,EAAE,GAAG,EAA0B,MAAM,kBAAkB,CAAC;AAa/D,MAAM,UAAU,eAAe,CAAC,EAAE,OAAO,EAAE,MAAM,EAA0B;IAC1E,OAAO,CAAC,EACP,OAAO,EACP,QAAQ,GAIR,EAAQ,EAAE;QACV,MAAM,QAAQ,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,UAAU,CAAC,UAAU,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,UAAU,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;QAC9H,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC3B,OAAO;QACR,CAAC;QACD,MAAM,OAAO,GAAG,OAAO,EAAE,CAAC;QAC1B,IAAI,OAAO,KAAK,IAAI,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;YAC/C,MAAM,QAAQ,CAAC,EAAE,MAAM,EAAE,EAAE,QAAQ,EAAE,QAAQ,CAAC,IAAI,EAAE,EAAE,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC;QACrE,CAAC;QACD,KAAK,MAAM,UAAU,IAAI,QAAQ,EAAE,CAAC;YACnC,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,UAAU,CAAC,EAAE,CAAC;gBAC/B,MAAM,IAAI,SAAS,CAAC,EAAE,OAAO,EAAE,wBAAwB,UAAU,CAAC,IAAI,KAAK,UAAU,CAAC,QAAQ,GAAG,EAAE,CAAC,CAAC;YACtG,CAAC;QACF,CAAC;IACF,CAAC,CAAC;AACH,CAAC"}

package/dist/permissions.d.ts

@@ -0,0 +1,8 @@
+import type { Permission } from "@shivaedev/access/permission.ts";
+export interface PermissionSession {
+    readonly user: {
+        readonly permissions?: readonly Permission[];
+    };
+}
+export declare function can(session: PermissionSession | null | undefined, permission: Permission): boolean;
+//# sourceMappingURL=permissions.d.ts.map

package/dist/permissions.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"permissions.d.ts","sourceRoot":"","sources":["../src/permissions.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,iCAAiC,CAAC;AAElE,MAAM,WAAW,iBAAiB;IACjC,QAAQ,CAAC,IAAI,EAAE;QACd,QAAQ,CAAC,WAAW,CAAC,EAAE,SAAS,UAAU,EAAE,CAAC;KAC7C,CAAC;CACF;AAED,wBAAgB,GAAG,CAAC,OAAO,EAAE,iBAAiB,GAAG,IAAI,GAAG,SAAS,EAAE,UAAU,EAAE,UAAU,GAAG,OAAO,CAElG"}

package/dist/permissions.js

@@ -0,0 +1,4 @@
+export function can(session, permission) {
+    return session?.user.permissions?.some((grant) => grant.name === permission.name && grant.strength === permission.strength) ?? false;
+}
+//# sourceMappingURL=permissions.js.map

package/dist/permissions.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"permissions.js","sourceRoot":"","sources":["../src/permissions.ts"],"names":[],"mappings":"AAQA,MAAM,UAAU,GAAG,CAAC,OAA6C,EAAE,UAAsB;IACxF,OAAO,OAAO,EAAE,IAAI,CAAC,WAAW,EAAE,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,KAAK,UAAU,CAAC,IAAI,IAAI,KAAK,CAAC,QAAQ,KAAK,UAAU,CAAC,QAAQ,CAAC,IAAI,KAAK,CAAC;AACtI,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@shivaedev/react",
-  "version": "0.19.0",
+  "version": "0.20.0",
   "description": "React query, action, editor and session hooks for native Effect atoms",
   "keywords": [
     "effect"
@@ -46,7 +46,9 @@
     "README.md"
   ],
   "dependencies": {
-    "@shivaedev/contract": "0.17.0",
+    "@shivaedev/access": "0.1.1",
+    "@shivaedev/contract": "0.18.0",
+    "@shivaedev/errors": "0.1.0",
     "@shivaedev/form": "0.7.0",
     "@shivaedev/test": "0.10.0"
   },
@@ -55,15 +57,15 @@
     "@effect/platform-node": "4.0.5",
     "@effect/sql-pg": "4.0.5",
     "@effect/sql-sqlite-node": "4.0.5",
-    "@shivaedev/identity": "0.1.0",
-    "@shivaedev/jobs": "0.20.0",
+    "@shivaedev/identity": "0.2.0",
+    "@shivaedev/jobs": "0.21.0",
     "@shivaedev/local-postgres": "0.7.0",
     "@shivaedev/quality": "0.42.0",
-    "@shivaedev/server": "0.1.0",
+    "@shivaedev/server": "0.2.0",
     "@shivaedev/service": "0.5.0",
-    "@shivaedev/sql": "0.22.0",
-    "@shivaedev/test-sql": "0.10.0",
-    "@shivaedev/test-story": "0.21.0",
+    "@shivaedev/sql": "0.23.0",
+    "@shivaedev/test-sql": "0.10.1",
+    "@shivaedev/test-story": "0.21.1",
     "@tanstack/react-router": "1.170.45",
     "@types/node": "24.19.2",
     "@types/react": "19.3.0",

package/src/client/permissionBoundary.ts

@@ -0,0 +1,33 @@
+import { CatchBoundary } from "@tanstack/react-router";
+import { Predicate } from "effect";
+import { createElement, type ReactNode, useContext } from "react";
+import type { Permission } from "@shivaedev/access/permission.ts";
+import { PermissionContext } from "#internal/PermissionContext.ts";
+import { can, type PermissionSession } from "#permissions.ts";
+
+export interface PermissionBoundaryProps {
+	readonly children: ReactNode;
+	readonly fallback: ReactNode;
+	readonly session: PermissionSession | null | undefined;
+}
+
+export function useCan(): (permission: Permission) => boolean {
+	const context = useContext(PermissionContext);
+	return (permission) => can(context?.session, permission);
+}
+
+function PermissionFailure({ error }: { readonly error: unknown }): ReactNode {
+	const context = useContext(PermissionContext);
+	if (!Predicate.isTagged(error, "Forbidden")) {
+		throw error;
+	}
+	return context?.fallback;
+}
+
+export function PermissionBoundary({ children, fallback, session }: PermissionBoundaryProps): ReactNode {
+	return createElement(
+		PermissionContext.Provider,
+		{ value: { fallback, session } },
+		createElement(CatchBoundary, { children, errorComponent: PermissionFailure, getResetKey: () => "permission" }),
+	);
+}

package/src/client/resultState.ts

@@ -7,6 +7,7 @@ import { useContext, useEffect, useState } from "react";
 import { queryCoalesceWindow } from "@shivaedev/contract/queryCoalesceWindow.ts";
 import type { AtomServices } from "#fieldRejection.ts";
 import { acceptLoaderQuery } from "#internal/queryHandoff.ts";
+import { usePermissionFailure } from "#internal/usePermissionFailure.ts";
 import { useQueryNotice } from "#internal/useQueryNotice.ts";
 import type { NoticeDescriptor } from "#notices.ts";
 import { type ActionOptions, useActionSource } from "./actionCompletion.ts";
@@ -79,7 +80,9 @@ export function useQuery<A, E>(atom: Atom.Atom<AsyncResult.AsyncResult<A, E>>, o
 	}
 	useRecheckOnUnauthorized(result);
 	useQueryNotice(result, Option.isSome(data), options.notice);
-	return { ...state(result, data), refresh: useAtomRefresh(atom) };
+	const refresh = useAtomRefresh(atom);
+	usePermissionFailure(AsyncResult.cause(result));
+	return { ...state(result, data), refresh };
 }
 export interface ActionState<TInput, A, E> extends ResultState<A, E> {
 	readonly dispatch: (input: TInput) => void;

package/src/internal/PermissionContext.ts

@@ -0,0 +1,6 @@
+import { createContext, type ReactNode } from "react";
+import type { PermissionSession } from "#permissions.ts";
+
+export const PermissionContext = createContext<{ readonly fallback: ReactNode; readonly session: PermissionSession | null | undefined } | undefined>(
+	undefined,
+);

package/src/internal/usePermissionFailure.ts

@@ -0,0 +1,13 @@
+import { Cause, Option, Predicate } from "effect";
+import { useContext } from "react";
+import { PermissionContext } from "./PermissionContext.ts";
+
+export function usePermissionFailure<E>(cause: Option.Option<Cause.Cause<E>>): void {
+	const context = useContext(PermissionContext);
+	if (context !== undefined) {
+		const failure = Option.flatMap(cause, Cause.findErrorOption);
+		if (Option.isSome(failure) && Predicate.isTagged(failure.value, "Forbidden")) {
+			throw failure.value;
+		}
+	}
+}

package/src/permissionGuard.ts

@@ -0,0 +1,39 @@
+import { redirect } from "@tanstack/react-router";
+import type { Permission } from "@shivaedev/access/permission.ts";
+import { Forbidden } from "@shivaedev/errors/taxonomy.ts";
+import { can, type PermissionSession } from "./permissions.ts";
+
+declare module "@tanstack/react-router" {
+	interface StaticDataRouteOption {
+		readonly permission?: Permission;
+	}
+}
+
+export interface PermissionGuardOptions {
+	readonly session: () => PermissionSession | null | undefined;
+	readonly signIn: string;
+}
+
+export function permissionGuard({ session, signIn }: PermissionGuardOptions) {
+	return ({
+		matches,
+		location,
+	}: {
+		readonly location: { readonly href: string };
+		readonly matches: readonly { readonly staticData: { readonly permission?: Permission } }[];
+	}): void => {
+		const required = matches.flatMap((match) => (match.staticData.permission === undefined ? [] : [match.staticData.permission]));
+		if (required.length === 0) {
+			return;
+		}
+		const current = session();
+		if (current === null || current === undefined) {
+			throw redirect({ search: { returnTo: location.href }, to: signIn });
+		}
+		for (const permission of required) {
+			if (!can(current, permission)) {
+				throw new Forbidden({ message: `Permission required: ${permission.name} (${permission.strength})` });
+			}
+		}
+	};
+}

package/src/permissions.ts

@@ -0,0 +1,11 @@
+import type { Permission } from "@shivaedev/access/permission.ts";
+
+export interface PermissionSession {
+	readonly user: {
+		readonly permissions?: readonly Permission[];
+	};
+}
+
+export function can(session: PermissionSession | null | undefined, permission: Permission): boolean {
+	return session?.user.permissions?.some((grant) => grant.name === permission.name && grant.strength === permission.strength) ?? false;
+}