@symbiote-native/tracking-transparency 0.1.0 → 0.2.0

package/build/angular/services/permissions.service/index.d.ts

@@ -2,6 +2,10 @@ import { type Signal } from '@angular/core';
 import { type PermissionResponse } from '../../../core';
 export declare class PermissionsService {
     private readonly status;
+    private readonly fetchError;
+    private isAutoFetchStarted;
+    /** Why the auto-fetch left `status` at null. Cleared by the next successful get()/request(). */
+    readonly error: Signal<Error | null>;
     connect(): Signal<PermissionResponse | null>;
     get(): Promise<PermissionResponse>;
     request(): Promise<PermissionResponse>;

package/build/angular/services/permissions.service/index.js

@@ -39,6 +39,11 @@ var __runInitializers = (this && this.__runInitializers) || function (thisArg, i
 //
 //   readonly status = inject(PermissionsService).connect();
 //   // template: {{ status()?.granted }}
+//
+// The auto-fetch has nobody to reject to, so its failure lands in the `error` signal instead of
+// escaping as an unhandled rejection: a null status with a non-null error is how a consumer tells
+// "the fetch failed" from "not fetched yet". get()/request() still reject to their direct caller —
+// only the automatic call is made safe.
 import { Injectable, signal } from '@angular/core';
 import { getTrackingPermissionsAsync, requestTrackingPermissionsAsync, } from '../../../core/index.js';
 let PermissionsService = (() => {
@@ -56,20 +61,32 @@ let PermissionsService = (() => {
             __runInitializers(_classThis, _classExtraInitializers);
         }
         status = signal(null);
+        fetchError = signal(null);
+        isAutoFetchStarted = false;
+        /** Why the auto-fetch left `status` at null. Cleared by the next successful get()/request(). */
+        error = this.fetchError.asReadonly();
         connect() {
-            if (this.status() === null) {
-                void this.get();
+            // Latched rather than guarded on `status() === null`: a failed fetch leaves status null
+            // forever, so the old guard turned every later connect() into another native call — unbounded
+            // once connect() is reached from a change-detected expression instead of a field initializer.
+            if (!this.isAutoFetchStarted) {
+                this.isAutoFetchStarted = true;
+                this.get().catch((cause) => {
+                    this.fetchError.set(cause instanceof Error ? cause : new Error(String(cause)));
+                });
             }
             return this.status.asReadonly();
         }
         async get() {
             const response = await getTrackingPermissionsAsync();
             this.status.set(response);
+            this.fetchError.set(null);
             return response;
         }
         async request() {
             const response = await requestTrackingPermissionsAsync();
             this.status.set(response);
+            this.fetchError.set(null);
             return response;
         }
     };

package/build/react/hooks/use-permissions/index.d.ts

@@ -2,5 +2,6 @@ import { type PermissionResponse } from '../../../core';
 export declare function usePermissions(): [
     PermissionResponse | null,
     () => Promise<PermissionResponse>,
-    () => Promise<PermissionResponse>
+    () => Promise<PermissionResponse>,
+    Error | null
 ];

package/build/react/hooks/use-permissions/index.js

@@ -2,29 +2,42 @@
 // auto-fetches the current permission status on mount, then exposes get/request as imperative
 // callbacks. Mirrors the shape @symbiote-native/cellular's own usePermissions ships in parallel,
 // so both stay byte-for-byte consistent.
+//
+// The mount fetch has nobody to reject to, so its failure lands in the 4th tuple slot (`error`)
+// instead of escaping as an unhandled rejection: a null status with a non-null error is how a
+// consumer tells "the fetch failed" from "not fetched yet". get()/request() still reject to their
+// direct caller — only the automatic call is made safe.
 import { useCallback, useEffect, useRef, useState } from 'react';
 import { getTrackingPermissionsAsync, requestTrackingPermissionsAsync, } from '../../../core/index.js';
 export function usePermissions() {
     const isMounted = useRef(true);
     const [status, setStatus] = useState(null);
+    const [error, setError] = useState(null);
     const getPermission = useCallback(async () => {
         const response = await getTrackingPermissionsAsync();
-        if (isMounted.current)
+        if (isMounted.current) {
             setStatus(response);
+            setError(null);
+        }
         return response;
     }, []);
     const requestPermission = useCallback(async () => {
         const response = await requestTrackingPermissionsAsync();
-        if (isMounted.current)
+        if (isMounted.current) {
             setStatus(response);
+            setError(null);
+        }
         return response;
     }, []);
     useEffect(() => {
         isMounted.current = true;
-        void getPermission();
+        getPermission().catch((cause) => {
+            if (isMounted.current)
+                setError(cause instanceof Error ? cause : new Error(String(cause)));
+        });
         return () => {
             isMounted.current = false;
         };
     }, [getPermission]);
-    return [status, requestPermission, getPermission];
+    return [status, requestPermission, getPermission, error];
 }

package/build/svelte/index.d.ts

@@ -0,0 +1,2 @@
+export { usePermissions } from './runes/use-permissions.svelte';
+export * from '../core';

package/build/svelte/index.js

@@ -0,0 +1,6 @@
+// @symbiote-native/tracking-transparency/svelte: the Svelte entry over the framework-agnostic core.
+// Same reasoning as the React and Vue entries — only the permission surface gets a lifecycle rune,
+// every other export is a plain re-export — mirrors the lifecycle-bucket naming convention of
+// adapters/svelte/src/runes (never `hooks/`/`composables/`, those are React's and Vue's terms).
+export { usePermissions } from './runes/use-permissions.svelte';
+export * from '../core/index.js';

package/build/svelte/runes/use-permissions.svelte.d.ts

@@ -0,0 +1,7 @@
+import { type PermissionResponse } from '../../core';
+export declare function usePermissions(): {
+    readonly status: PermissionResponse | null;
+    readonly error: Error | null;
+    request: () => Promise<PermissionResponse>;
+    get: () => Promise<PermissionResponse>;
+};

package/build/svelte/runes/use-permissions.svelte.js

@@ -0,0 +1,49 @@
+// Svelte lifecycle wiring over the framework-agnostic core (core/tracking-transparency.ts) —
+// auto-fetches the current permission status on mount, then exposes get/request as imperative
+// callbacks. Just a one-shot get with no ongoing subscription, so `$effect` needs no cleanup.
+//
+// `.svelte.ts` (not `.ts`): runes ($state/$effect) only work in files with this extension
+// outside an actual `.svelte` component. `status` is returned as a getter, NOT a bare
+// `$state`: Svelte 5 reactivity is lexically scoped to the declaring module and doesn't
+// survive being returned as a raw value from a plain function — mirrors how Vue's `Ref`
+// needs `.value` to unwrap.
+//
+// The mount fetch has nobody to reject to, so its failure lands in `error` (a second boxed getter,
+// same reason as `status`) instead of escaping as an unhandled rejection: a null status with a
+// non-null error is how a consumer tells "the fetch failed" from "not fetched yet".
+// get()/request() still reject to their direct caller — only the automatic call is made safe.
+import { getTrackingPermissionsAsync, requestTrackingPermissionsAsync, } from '../../core/index.js';
+export function usePermissions() {
+    let status = $state(null);
+    let error = $state(null);
+    const get = async () => {
+        const response = await getTrackingPermissionsAsync();
+        status = response;
+        error = null;
+        return response;
+    };
+    const request = async () => {
+        const response = await requestTrackingPermissionsAsync();
+        status = response;
+        error = null;
+        return response;
+    };
+    $effect(() => {
+        // `get` is a plain closure, not reactive state, so the effect has an empty dependency set and
+        // runs exactly once on mount — the twin of Vue's onMounted. The catch runs after the effect
+        // has settled, so writing `error` there adds no dependency and does not re-arm it.
+        get().catch((cause) => {
+            error = cause instanceof Error ? cause : new Error(String(cause));
+        });
+    });
+    return {
+        get status() {
+            return status;
+        },
+        get error() {
+            return error;
+        },
+        request,
+        get,
+    };
+}

package/build/vue/composables/use-permissions/index.d.ts

@@ -2,6 +2,7 @@ import { type Ref } from '@vue/runtime-core';
 import { type PermissionResponse } from '../../../core';
 export declare function usePermissions(): {
     status: Ref<PermissionResponse | null>;
+    error: Ref<Error | null>;
     request: () => Promise<PermissionResponse>;
     get: () => Promise<PermissionResponse>;
 };

package/build/vue/composables/use-permissions/index.js

@@ -2,22 +2,32 @@
 // auto-fetches the current permission status on mount (mirrors use-battery-level's
 // onMounted/onUnmounted style, but there is no ongoing subscription to tear down here, just a
 // one-shot get), then exposes get/request as imperative callbacks.
+//
+// The mount fetch has nobody to reject to, so its failure lands in the `error` ref instead of
+// escaping as an unhandled rejection: a null status with a non-null error is how a consumer tells
+// "the fetch failed" from "not fetched yet". get()/request() still reject to their direct caller —
+// only the automatic call is made safe.
 import { onMounted, ref } from '@vue/runtime-core';
 import { getTrackingPermissionsAsync, requestTrackingPermissionsAsync, } from '../../../core/index.js';
 export function usePermissions() {
     const status = ref(null);
+    const error = ref(null);
     const get = async () => {
         const response = await getTrackingPermissionsAsync();
         status.value = response;
+        error.value = null;
         return response;
     };
     const request = async () => {
         const response = await requestTrackingPermissionsAsync();
         status.value = response;
+        error.value = null;
         return response;
     };
     onMounted(() => {
-        void get();
+        get().catch((cause) => {
+            error.value = cause instanceof Error ? cause : new Error(String(cause));
+        });
     });
-    return { status, request, get };
+    return { status, error, request, get };
 }

package/build-ngc/angular/services/permissions.service/index.d.ts

@@ -3,6 +3,10 @@ import { type PermissionResponse } from '../../../core';
 import * as i0 from "@angular/core";
 export declare class PermissionsService {
     private readonly status;
+    private readonly fetchError;
+    private isAutoFetchStarted;
+    /** Why the auto-fetch left `status` at null. Cleared by the next successful get()/request(). */
+    readonly error: Signal<Error | null>;
     connect(): Signal<PermissionResponse | null>;
     get(): Promise<PermissionResponse>;
     request(): Promise<PermissionResponse>;

package/build-ngc/angular/services/permissions.service/index.js

@@ -5,32 +5,50 @@
 //
 //   readonly status = inject(PermissionsService).connect();
 //   // template: {{ status()?.granted }}
+//
+// The auto-fetch has nobody to reject to, so its failure lands in the `error` signal instead of
+// escaping as an unhandled rejection: a null status with a non-null error is how a consumer tells
+// "the fetch failed" from "not fetched yet". get()/request() still reject to their direct caller —
+// only the automatic call is made safe.
 import { Injectable, signal } from '@angular/core';
 import { getTrackingPermissionsAsync, requestTrackingPermissionsAsync, } from '../../../core';
 import * as i0 from "@angular/core";
 export class PermissionsService {
     status = signal(null, /* @ts-ignore */
     ...(ngDevMode ? [{ debugName: "status" }] : /* istanbul ignore next */ []));
+    fetchError = signal(null, /* @ts-ignore */
+    ...(ngDevMode ? [{ debugName: "fetchError" }] : /* istanbul ignore next */ []));
+    isAutoFetchStarted = false;
+    /** Why the auto-fetch left `status` at null. Cleared by the next successful get()/request(). */
+    error = this.fetchError.asReadonly();
     connect() {
-        if (this.status() === null) {
-            void this.get();
+        // Latched rather than guarded on `status() === null`: a failed fetch leaves status null
+        // forever, so the old guard turned every later connect() into another native call — unbounded
+        // once connect() is reached from a change-detected expression instead of a field initializer.
+        if (!this.isAutoFetchStarted) {
+            this.isAutoFetchStarted = true;
+            this.get().catch((cause) => {
+                this.fetchError.set(cause instanceof Error ? cause : new Error(String(cause)));
+            });
         }
         return this.status.asReadonly();
     }
     async get() {
         const response = await getTrackingPermissionsAsync();
         this.status.set(response);
+        this.fetchError.set(null);
         return response;
     }
     async request() {
         const response = await requestTrackingPermissionsAsync();
         this.status.set(response);
+        this.fetchError.set(null);
         return response;
     }
-    static ɵfac = i0.ɵɵngDeclareFactory({ minVersion: "12.0.0", version: "22.0.5", ngImport: i0, type: PermissionsService, deps: [], target: i0.ɵɵFactoryTarget.Injectable });
-    static ɵprov = i0.ɵɵngDeclareInjectable({ minVersion: "12.0.0", version: "22.0.5", ngImport: i0, type: PermissionsService, providedIn: 'root' });
+    static ɵfac = i0.ɵɵngDeclareFactory({ minVersion: "12.0.0", version: "22.0.8", ngImport: i0, type: PermissionsService, deps: [], target: i0.ɵɵFactoryTarget.Injectable });
+    static ɵprov = i0.ɵɵngDeclareInjectable({ minVersion: "12.0.0", version: "22.0.8", ngImport: i0, type: PermissionsService, providedIn: 'root' });
 }
-i0.ɵɵngDeclareClassMetadata({ minVersion: "12.0.0", version: "22.0.5", ngImport: i0, type: PermissionsService, decorators: [{
+i0.ɵɵngDeclareClassMetadata({ minVersion: "12.0.0", version: "22.0.8", ngImport: i0, type: PermissionsService, decorators: [{
             type: Injectable,
             args: [{ providedIn: 'root' }]
         }] });

package/build-ngc/angular/services/permissions.service/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../src/angular/services/permissions.service/index.ts"],"names":[],"mappings":"AAAA,mFAAmF;AACnF,4FAA4F;AAC5F,yFAAyF;AACzF,+BAA+B;AAC/B,EAAE;AACF,4DAA4D;AAC5D,yCAAyC;AACzC,OAAO,EAAE,UAAU,EAAE,MAAM,EAAe,MAAM,eAAe,CAAC;AAChE,OAAO,EACL,2BAA2B,EAC3B,+BAA+B,GAEhC,MAAM,eAAe,CAAC;;AAGvB,MAAM,OAAO,kBAAkB;IACZ,MAAM,GAAG,MAAM,CAA4B,IAAI;+EAAC,CAAC;IAElE,OAAO;QACL,IAAI,IAAI,CAAC,MAAM,EAAE,KAAK,IAAI,EAAE,CAAC;YAC3B,KAAK,IAAI,CAAC,GAAG,EAAE,CAAC;QAClB,CAAC;QACD,OAAO,IAAI,CAAC,MAAM,CAAC,UAAU,EAAE,CAAC;IAClC,CAAC;IAED,KAAK,CAAC,GAAG;QACP,MAAM,QAAQ,GAAG,MAAM,2BAA2B,EAAE,CAAC;QACrD,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QAC1B,OAAO,QAAQ,CAAC;IAClB,CAAC;IAED,KAAK,CAAC,OAAO;QACX,MAAM,QAAQ,GAAG,MAAM,+BAA+B,EAAE,CAAC;QACzD,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QAC1B,OAAO,QAAQ,CAAC;IAClB,CAAC;uGApBU,kBAAkB;2GAAlB,kBAAkB,cADL,MAAM;;2FACnB,kBAAkB;kBAD9B,UAAU;mBAAC,EAAE,UAAU,EAAE,MAAM,EAAE"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../src/angular/services/permissions.service/index.ts"],"names":[],"mappings":"AAAA,mFAAmF;AACnF,4FAA4F;AAC5F,yFAAyF;AACzF,+BAA+B;AAC/B,EAAE;AACF,4DAA4D;AAC5D,yCAAyC;AACzC,EAAE;AACF,gGAAgG;AAChG,kGAAkG;AAClG,mGAAmG;AACnG,wCAAwC;AACxC,OAAO,EAAE,UAAU,EAAE,MAAM,EAAe,MAAM,eAAe,CAAC;AAChE,OAAO,EACL,2BAA2B,EAC3B,+BAA+B,GAEhC,MAAM,eAAe,CAAC;;AAGvB,MAAM,OAAO,kBAAkB;IACZ,MAAM,GAAG,MAAM,CAA4B,IAAI;+EAAC,CAAC;IACjD,UAAU,GAAG,MAAM,CAAe,IAAI;mFAAC,CAAC;IACjD,kBAAkB,GAAG,KAAK,CAAC;IAEnC,gGAAgG;IACvF,KAAK,GAAyB,IAAI,CAAC,UAAU,CAAC,UAAU,EAAE,CAAC;IAEpE,OAAO;QACL,wFAAwF;QACxF,8FAA8F;QAC9F,8FAA8F;QAC9F,IAAI,CAAC,IAAI,CAAC,kBAAkB,EAAE,CAAC;YAC7B,IAAI,CAAC,kBAAkB,GAAG,IAAI,CAAC;YAC/B,IAAI,CAAC,GAAG,EAAE,CAAC,KAAK,CAAC,CAAC,KAAc,EAAE,EAAE;gBAClC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;YACjF,CAAC,CAAC,CAAC;QACL,CAAC;QACD,OAAO,IAAI,CAAC,MAAM,CAAC,UAAU,EAAE,CAAC;IAClC,CAAC;IAED,KAAK,CAAC,GAAG;QACP,MAAM,QAAQ,GAAG,MAAM,2BAA2B,EAAE,CAAC;QACrD,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QAC1B,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAC1B,OAAO,QAAQ,CAAC;IAClB,CAAC;IAED,KAAK,CAAC,OAAO;QACX,MAAM,QAAQ,GAAG,MAAM,+BAA+B,EAAE,CAAC;QACzD,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QAC1B,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAC1B,OAAO,QAAQ,CAAC;IAClB,CAAC;uGAjCU,kBAAkB;2GAAlB,kBAAkB,cADL,MAAM;;2FACnB,kBAAkB;kBAD9B,UAAU;mBAAC,EAAE,UAAU,EAAE,MAAM,EAAE"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@symbiote-native/tracking-transparency",
-  "version": "0.1.0",
+  "version": "0.2.0",
   "description": "expo-tracking-transparency wrapped for SymbioteNative — one framework-agnostic core, built once and reachable from the React, Vue, and Angular adapters. iOS App Tracking Transparency prompt (permission get/request, always-granted on Android/web) plus the advertising-ID getter.",
   "license": "MIT",
   "repository": {
@@ -30,6 +30,10 @@
       "types": "./build/react/index.d.ts",
       "default": "./build/react/index.js"
     },
+    "./svelte": {
+      "types": "./build/svelte/index.d.ts",
+      "default": "./build/svelte/index.js"
+    },
     "./angular": {
       "types": "./build-ngc/angular/index.d.ts",
       "react-native": "./build-ngc/angular/index.js",
@@ -53,15 +57,17 @@
     "expo-modules-core": "57.0.5"
   },
   "peerDependencies": {
+    "@symbiote-native/angular": ">=0.6.2",
     "@symbiote-native/engine": ">=0.1.7",
+    "@symbiote-native/react": ">=0.2.8",
+    "@symbiote-native/svelte": ">=0.1.0",
+    "@symbiote-native/vue": ">=0.3.8",
     "@angular/core": ">=20",
     "@vue/runtime-core": "^3.5.13",
     "react": ">=19.0.0",
     "react-native": ">=0.86",
-    "vue": ">=3.5.0",
-    "@symbiote-native/angular": "0.6.2",
-    "@symbiote-native/react": "0.2.8",
-    "@symbiote-native/vue": "0.3.8"
+    "svelte": ">=5.56.0",
+    "vue": ">=3.5.0"
   },
   "peerDependenciesMeta": {
     "@symbiote-native/angular": {
@@ -70,6 +76,9 @@
     "@symbiote-native/react": {
       "optional": true
     },
+    "@symbiote-native/svelte": {
+      "optional": true
+    },
     "@symbiote-native/vue": {
       "optional": true
     },
@@ -82,24 +91,29 @@
     "react": {
       "optional": true
     },
+    "svelte": {
+      "optional": true
+    },
     "vue": {
       "optional": true
     }
   },
   "devDependencies": {
-    "@angular/compiler": "^22",
-    "@angular/compiler-cli": "^22",
-    "@angular/core": "^22",
+    "@angular/compiler": "~22.0.8",
+    "@angular/compiler-cli": "~22.0.8",
+    "@angular/core": "~22.0.8",
     "@types/node": "^26.0.0",
     "@types/react": "^19.2.0",
     "@vue/runtime-core": "^3.5.13",
     "react": "19.2.3",
+    "svelte": "^5.56.0",
     "typescript": "~6.0.0",
-    "@symbiote-native/angular": "0.6.2",
-    "@symbiote-native/engine": "0.1.7",
-    "@symbiote-native/react": "0.2.8",
+    "@symbiote-native/angular": "0.7.0",
+    "@symbiote-native/engine": "0.2.0",
+    "@symbiote-native/react": "0.3.0",
+    "@symbiote-native/svelte": "0.2.0",
     "@symbiote-native/test-utils": "0.1.6",
-    "@symbiote-native/vue": "0.3.8"
+    "@symbiote-native/vue": "0.4.0"
   },
   "scripts": {
     "typecheck": "tsc --build",

package/src/angular/services/permissions.service/index.ts

@@ -5,6 +5,11 @@
 //
 //   readonly status = inject(PermissionsService).connect();
 //   // template: {{ status()?.granted }}
+//
+// The auto-fetch has nobody to reject to, so its failure lands in the `error` signal instead of
+// escaping as an unhandled rejection: a null status with a non-null error is how a consumer tells
+// "the fetch failed" from "not fetched yet". get()/request() still reject to their direct caller —
+// only the automatic call is made safe.
 import { Injectable, signal, type Signal } from '@angular/core';
 import {
   getTrackingPermissionsAsync,
@@ -15,10 +20,21 @@ import {
 @Injectable({ providedIn: 'root' })
 export class PermissionsService {
   private readonly status = signal<PermissionResponse | null>(null);
+  private readonly fetchError = signal<Error | null>(null);
+  private isAutoFetchStarted = false;
+
+  /** Why the auto-fetch left `status` at null. Cleared by the next successful get()/request(). */
+  readonly error: Signal<Error | null> = this.fetchError.asReadonly();
 
   connect(): Signal<PermissionResponse | null> {
-    if (this.status() === null) {
-      void this.get();
+    // Latched rather than guarded on `status() === null`: a failed fetch leaves status null
+    // forever, so the old guard turned every later connect() into another native call — unbounded
+    // once connect() is reached from a change-detected expression instead of a field initializer.
+    if (!this.isAutoFetchStarted) {
+      this.isAutoFetchStarted = true;
+      this.get().catch((cause: unknown) => {
+        this.fetchError.set(cause instanceof Error ? cause : new Error(String(cause)));
+      });
     }
     return this.status.asReadonly();
   }
@@ -26,12 +42,14 @@ export class PermissionsService {
   async get(): Promise<PermissionResponse> {
     const response = await getTrackingPermissionsAsync();
     this.status.set(response);
+    this.fetchError.set(null);
     return response;
   }
 
   async request(): Promise<PermissionResponse> {
     const response = await requestTrackingPermissionsAsync();
     this.status.set(response);
+    this.fetchError.set(null);
     return response;
   }
 }

package/src/react/hooks/use-permissions/index.ts

@@ -2,6 +2,11 @@
 // auto-fetches the current permission status on mount, then exposes get/request as imperative
 // callbacks. Mirrors the shape @symbiote-native/cellular's own usePermissions ships in parallel,
 // so both stay byte-for-byte consistent.
+//
+// The mount fetch has nobody to reject to, so its failure lands in the 4th tuple slot (`error`)
+// instead of escaping as an unhandled rejection: a null status with a non-null error is how a
+// consumer tells "the fetch failed" from "not fetched yet". get()/request() still reject to their
+// direct caller — only the automatic call is made safe.
 import { useCallback, useEffect, useRef, useState } from 'react';
 import {
   getTrackingPermissionsAsync,
@@ -13,29 +18,39 @@ export function usePermissions(): [
   PermissionResponse | null,
   () => Promise<PermissionResponse>,
   () => Promise<PermissionResponse>,
+  Error | null,
 ] {
   const isMounted = useRef(true);
   const [status, setStatus] = useState<PermissionResponse | null>(null);
+  const [error, setError] = useState<Error | null>(null);
 
   const getPermission = useCallback(async () => {
     const response = await getTrackingPermissionsAsync();
-    if (isMounted.current) setStatus(response);
+    if (isMounted.current) {
+      setStatus(response);
+      setError(null);
+    }
     return response;
   }, []);
 
   const requestPermission = useCallback(async () => {
     const response = await requestTrackingPermissionsAsync();
-    if (isMounted.current) setStatus(response);
+    if (isMounted.current) {
+      setStatus(response);
+      setError(null);
+    }
     return response;
   }, []);
 
   useEffect(() => {
     isMounted.current = true;
-    void getPermission();
+    getPermission().catch((cause: unknown) => {
+      if (isMounted.current) setError(cause instanceof Error ? cause : new Error(String(cause)));
+    });
     return () => {
       isMounted.current = false;
     };
   }, [getPermission]);
 
-  return [status, requestPermission, getPermission];
+  return [status, requestPermission, getPermission, error];
 }

package/src/svelte/index.ts

@@ -0,0 +1,7 @@
+// @symbiote-native/tracking-transparency/svelte: the Svelte entry over the framework-agnostic core.
+// Same reasoning as the React and Vue entries — only the permission surface gets a lifecycle rune,
+// every other export is a plain re-export — mirrors the lifecycle-bucket naming convention of
+// adapters/svelte/src/runes (never `hooks/`/`composables/`, those are React's and Vue's terms).
+
+export { usePermissions } from './runes/use-permissions.svelte';
+export * from '../core';

package/src/svelte/runes/use-permissions.svelte.ts

@@ -0,0 +1,63 @@
+// Svelte lifecycle wiring over the framework-agnostic core (core/tracking-transparency.ts) —
+// auto-fetches the current permission status on mount, then exposes get/request as imperative
+// callbacks. Just a one-shot get with no ongoing subscription, so `$effect` needs no cleanup.
+//
+// `.svelte.ts` (not `.ts`): runes ($state/$effect) only work in files with this extension
+// outside an actual `.svelte` component. `status` is returned as a getter, NOT a bare
+// `$state`: Svelte 5 reactivity is lexically scoped to the declaring module and doesn't
+// survive being returned as a raw value from a plain function — mirrors how Vue's `Ref`
+// needs `.value` to unwrap.
+//
+// The mount fetch has nobody to reject to, so its failure lands in `error` (a second boxed getter,
+// same reason as `status`) instead of escaping as an unhandled rejection: a null status with a
+// non-null error is how a consumer tells "the fetch failed" from "not fetched yet".
+// get()/request() still reject to their direct caller — only the automatic call is made safe.
+import {
+  getTrackingPermissionsAsync,
+  requestTrackingPermissionsAsync,
+  type PermissionResponse,
+} from '../../core';
+
+export function usePermissions(): {
+  readonly status: PermissionResponse | null;
+  readonly error: Error | null;
+  request: () => Promise<PermissionResponse>;
+  get: () => Promise<PermissionResponse>;
+} {
+  let status = $state<PermissionResponse | null>(null);
+  let error = $state<Error | null>(null);
+
+  const get = async (): Promise<PermissionResponse> => {
+    const response = await getTrackingPermissionsAsync();
+    status = response;
+    error = null;
+    return response;
+  };
+
+  const request = async (): Promise<PermissionResponse> => {
+    const response = await requestTrackingPermissionsAsync();
+    status = response;
+    error = null;
+    return response;
+  };
+
+  $effect(() => {
+    // `get` is a plain closure, not reactive state, so the effect has an empty dependency set and
+    // runs exactly once on mount — the twin of Vue's onMounted. The catch runs after the effect
+    // has settled, so writing `error` there adds no dependency and does not re-arm it.
+    get().catch((cause: unknown) => {
+      error = cause instanceof Error ? cause : new Error(String(cause));
+    });
+  });
+
+  return {
+    get status(): PermissionResponse | null {
+      return status;
+    },
+    get error(): Error | null {
+      return error;
+    },
+    request,
+    get,
+  };
+}

package/src/svelte/svelte-ambient.d.ts

@@ -0,0 +1,6 @@
+// Pulls in svelte's ambient global declarations ($state/$effect/...) for this package's tsc
+// program. adapters/svelte gets these for free because render.ts does a real value import from
+// 'svelte' (any file in a program importing a module loads its ambient globals for the whole
+// program); this package has no such import, so a triple-slash reference does the same job
+// explicitly rather than relying on an incidental side-effect.
+/// <reference types="svelte" />

package/src/vue/composables/use-permissions/index.ts

@@ -2,6 +2,11 @@
 // auto-fetches the current permission status on mount (mirrors use-battery-level's
 // onMounted/onUnmounted style, but there is no ongoing subscription to tear down here, just a
 // one-shot get), then exposes get/request as imperative callbacks.
+//
+// The mount fetch has nobody to reject to, so its failure lands in the `error` ref instead of
+// escaping as an unhandled rejection: a null status with a non-null error is how a consumer tells
+// "the fetch failed" from "not fetched yet". get()/request() still reject to their direct caller —
+// only the automatic call is made safe.
 import { onMounted, ref, type Ref } from '@vue/runtime-core';
 import {
   getTrackingPermissionsAsync,
@@ -11,26 +16,32 @@ import {
 
 export function usePermissions(): {
   status: Ref<PermissionResponse | null>;
+  error: Ref<Error | null>;
   request: () => Promise<PermissionResponse>;
   get: () => Promise<PermissionResponse>;
 } {
   const status = ref<PermissionResponse | null>(null);
+  const error = ref<Error | null>(null);
 
   const get = async () => {
     const response = await getTrackingPermissionsAsync();
     status.value = response;
+    error.value = null;
     return response;
   };
 
   const request = async () => {
     const response = await requestTrackingPermissionsAsync();
     status.value = response;
+    error.value = null;
     return response;
   };
 
   onMounted(() => {
-    void get();
+    get().catch((cause: unknown) => {
+      error.value = cause instanceof Error ? cause : new Error(String(cause));
+    });
   });
 
-  return { status, request, get };
+  return { status, error, request, get };
 }