permdock 0.0.0 → 0.1.0

package/dist/doctor-Bqo6FwUa.js

@@ -0,0 +1,53 @@
+import { a as listArg, i as globalArgs, t as COMMAND_DESCRIPTIONS } from "./commands-BMh_Etm2.js";
+import { n as ask, t as CANCELLED } from "./prompt-CXYhLfsS.js";
+import { defineCommand } from "citty";
+//#region src/cli/commands/doctor.ts
+function doctor(ctx) {
+	return defineCommand({
+		meta: {
+			name: "doctor",
+			description: COMMAND_DESCRIPTIONS.doctor
+		},
+		args: {
+			...globalArgs,
+			only: {
+				type: "string",
+				description: "Check codes or groups to run, repeatable",
+				valueHint: "codes"
+			},
+			fix: {
+				type: "boolean",
+				description: "Apply safe fixes: install skills, regenerate the catalog"
+			},
+			strict: {
+				type: "boolean",
+				description: "Exit 1 on warnings too"
+			}
+		},
+		async run({ args: parsed, rawArgs }) {
+			let fix = parsed.fix === true;
+			if (fix && ctx.interactive) {
+				const answer = await ask(`Install the Agent Skills and regenerate the catalog in ${ctx.cwd}?`);
+				if (answer === void 0) {
+					ctx.report(CANCELLED);
+					return;
+				}
+				fix = answer;
+			}
+			const result = await (await import("./doctor-BGle8Gqi.js")).runDoctor({
+				cwd: ctx.cwd,
+				config: ctx.config,
+				only: listArg(rawArgs, "only"),
+				json: ctx.json,
+				fix,
+				strict: parsed.strict === true,
+				color: ctx.color,
+				now: ctx.now,
+				io: ctx.io
+			});
+			ctx.report(result);
+		}
+	});
+}
+//#endregion
+export { doctor };

package/dist/drizzle/index.d.ts

@@ -0,0 +1,72 @@
+import { _r as Condition, hr as Subject, tn as WhereResult } from "../policy-CInmNGkM.js";
+import { n as WithSubjectOptions, r as RelationsMapping, t as RowCheck } from "../row-check-BajTgQZ-.js";
+import { t as MembershipsMapping } from "../compile-CQbvyIBr.js";
+import { SQL, Table } from "drizzle-orm";
+//#region src/drizzle/types.d.ts
+/** A column of the Drizzle table `T` or an `SQL` expression; anything for a structural stand-in. */
+type DrizzleColumnOf<T> = T extends Table ? T["_"]["columns"][keyof T["_"]["columns"]] | SQL : unknown;
+type DrizzleWhereOptions<T = unknown> = {
+  /** Condition field to column of the table passed to `toWhere`. */
+  readonly columns?: Readonly<Record<string, DrizzleColumnOf<T>>>;
+  readonly subject?: Subject;
+  readonly memberships?: MembershipsMapping;
+  /** Where the relation graph lives; graph grants compile to Postgres subqueries with it and are refused without. */
+  readonly relations?: RelationsMapping;
+  readonly now?: number;
+  readonly operators?: DrizzleOperators;
+};
+type DrizzleOperators = {
+  readonly and: (...args: unknown[]) => unknown;
+  readonly or: (...args: unknown[]) => unknown;
+  readonly not: (value: unknown) => unknown;
+  readonly eq: (column: unknown, value: unknown) => unknown;
+  readonly ne: (column: unknown, value: unknown) => unknown;
+  readonly gt: (column: unknown, value: unknown) => unknown;
+  readonly gte: (column: unknown, value: unknown) => unknown;
+  readonly lt: (column: unknown, value: unknown) => unknown;
+  readonly lte: (column: unknown, value: unknown) => unknown;
+  readonly inArray: (column: unknown, values: readonly unknown[]) => unknown;
+  readonly notInArray: (column: unknown, values: readonly unknown[]) => unknown;
+  readonly isNull: (column: unknown) => unknown;
+  readonly isNotNull: (column: unknown) => unknown;
+  readonly like: (column: unknown, value: unknown) => unknown;
+  readonly sql: (strings: TemplateStringsArray, ...values: unknown[]) => unknown;
+};
+type DrizzleWithSubjectOptions = WithSubjectOptions & {
+  /** `import * as operators from 'drizzle-orm'`, on runtimes without `require`. */
+  readonly operators?: DrizzleOperators;
+};
+//#endregion
+//#region src/drizzle/to-where.d.ts
+/** Compiles a condition into a Drizzle `SQL` filter over `table`; no grant compiles to `false`. */
+export declare function toWhere<T extends object>(input: Condition | WhereResult, table: T, options?: DrizzleWhereOptions<T>): SQL;
+type DrizzleDatabase<Tx> = {
+  transaction<T>(fn: (tx: Tx) => Promise<T>): Promise<T>;
+};
+/**
+ * Runs `fn` in a transaction whose role and claims are `permdock.subject`'s, so the generated
+ * RLS policies decide for the same subject as the in-process checks.
+ */
+export declare function withSubject<Tx extends {
+  execute(query: never): unknown;
+}, T>(db: DrizzleDatabase<Tx>, permdock: {
+  readonly subject: Subject;
+}, fn: (tx: Tx) => Promise<T>, options?: DrizzleWithSubjectOptions): Promise<T>;
+type DrizzleSelectable = {
+  select(fields: Record<string, unknown>): {
+    from(table: never): {
+      where(where: unknown): {
+        limit(count: number): PromiseLike<readonly {
+          readonly granted?: unknown;
+        }[]>;
+      };
+    };
+  };
+};
+/**
+ * One query for one row: `{ found: false }` when `key` matches nothing, otherwise whether the
+ * permission filter keeps the row. Throws when `key` matches more than one row.
+ */
+export declare function checkRow<T extends object>(db: DrizzleSelectable, table: T, input: Condition | WhereResult, key: SQL, options?: DrizzleWhereOptions<T>): Promise<RowCheck>;
+//#endregion
+export type { DrizzleOperators, DrizzleWhereOptions, DrizzleWithSubjectOptions, MembershipsMapping, RelationsMapping, RowCheck, WithSubjectOptions };

package/dist/drizzle/index.js

@@ -0,0 +1,160 @@
+import { t as compact } from "../compact-y6vfu2_f.js";
+import { x as assertSafeKey } from "../permissions-DC7GROPA.js";
+import { n as escapeLike, t as compileWhere } from "../compile-D22iwvuV.js";
+import { i as rowCheckFrom, r as subjectStatements, t as statementTemplate } from "../subject-settings-xt7V845g.js";
+//#region src/drizzle/to-where.ts
+function loadOperators(injected) {
+	if (injected !== void 0) return injected;
+	const loader = globalThis.process?.getBuiltinModule?.("node:module");
+	try {
+		if (loader === void 0) throw new Error("no module loader");
+		return loader.createRequire(import.meta.url)("drizzle-orm");
+	} catch {
+		throw new Error("PermDock: permdock/drizzle requires the drizzle-orm peer; pass `operators` on runtimes without require");
+	}
+}
+function ident(name) {
+	assertSafeKey(name, "sql identifier");
+	if (!/^[A-Za-z_][A-Za-z0-9_]*$/u.test(name)) throw new Error(`PermDock: unsafe SQL identifier '${name}'`);
+	return name;
+}
+function column(table, field, columns) {
+	assertSafeKey(field, "condition field");
+	const mapped = (columns !== void 0 && Object.hasOwn(columns, field) ? columns[field] : void 0) ?? (Object.hasOwn(table, field) ? table[field] : void 0);
+	if (mapped === void 0 || typeof mapped === "function") throw new Error(`PermDock: unknown column '${field}'`);
+	return mapped;
+}
+/** Drizzle's Postgres array columns (`text().array()`) report `dataType: 'array'`. */
+function isArrayColumn(col) {
+	if (col === null || typeof col !== "object") return false;
+	const { dataType, dimensions } = col;
+	return dataType === "array" || typeof dimensions === "number" && dimensions > 0;
+}
+function tagged(parts, ops) {
+	const strings = [""];
+	const values = [];
+	for (const part of parts) if ("text" in part) strings[strings.length - 1] += part.text;
+	else {
+		values.push(part.value);
+		strings.push("");
+	}
+	const template = strings;
+	Object.defineProperty(template, "raw", { value: strings });
+	return ops.sql(template, ...values);
+}
+function existsSql(node, table, options, ops) {
+	const m = (name) => `m.${ident(name)}`;
+	const parts = [
+		{ text: `exists (select 1 from ${ident(node.table)} m where ${m(node.rowColumn)} = ` },
+		{ value: column(table, node.rowField, options.columns) },
+		{ text: ` and ${m(node.user)} = ` },
+		{ value: node.userValue }
+	];
+	if (node.roles.length > 0) {
+		parts.push({ text: ` and ${m(node.role)} in (` });
+		for (const [index, role] of node.roles.entries()) {
+			if (index > 0) parts.push({ text: ", " });
+			parts.push({ value: role });
+		}
+		parts.push({ text: ")" });
+	}
+	if (node.expiresAt !== void 0) {
+		const expires = m(node.expiresAt);
+		parts.push({ text: ` and (${expires} is null or ${expires} > ` }, { value: node.now }, { text: ")" });
+	}
+	if (node.tenantColumn !== void 0 && node.tenantValue !== void 0) {
+		const tenant = m(node.tenantColumn);
+		parts.push({ text: ` and (${tenant} is null or ${tenant} = ` }, { value: node.tenantValue }, { text: ")" });
+	}
+	if (node.resourceColumn !== void 0 && node.resourceValue !== void 0) parts.push({ text: ` and ${m(node.resourceColumn)} = ` }, { value: node.resourceValue });
+	parts.push({ text: ")" });
+	return tagged(parts, ops);
+}
+function containsSql(col, value, ops) {
+	if (isArrayColumn(col)) return tagged([
+		{ value },
+		{ text: " = any(" },
+		{ value: col },
+		{ text: ")" }
+	], ops);
+	if (typeof value === "string") return ops.like(col, `%${escapeLike(value)}%`);
+	return tagged([
+		{ value: col },
+		{ text: " @> " },
+		{ value }
+	], ops);
+}
+function render(node, table, options, ops) {
+	switch (node.kind) {
+		case "never": return ops.sql`false`;
+		case "always": return ops.sql`true`;
+		case "isNull": {
+			const col = column(table, node.field, options.columns);
+			return node.negated ? ops.isNotNull(col) : ops.isNull(col);
+		}
+		case "and": return ops.and(...node.items.map((item) => render(item, table, options, ops)));
+		case "or": return ops.or(...node.items.map((item) => render(item, table, options, ops)));
+		case "not": return ops.not(render(node.item, table, options, ops));
+		case "exists": return existsSql(node, table, options, ops);
+		case "sql": return tagged(node.parts.map((part) => {
+			if ("text" in part) return part;
+			if ("column" in part) return { value: column(table, part.column, options.columns) };
+			return { value: "subject" in part ? node.subject : part.value };
+		}), ops);
+		case "compare": {
+			const col = column(table, node.field, options.columns);
+			switch (node.op) {
+				case "eq": return ops.eq(col, node.value);
+				case "ne": return ops.ne(col, node.value);
+				case "gt": return ops.gt(col, node.value);
+				case "gte": return ops.gte(col, node.value);
+				case "lt": return ops.lt(col, node.value);
+				case "lte": return ops.lte(col, node.value);
+				case "in": return ops.inArray(col, node.value);
+				case "notIn": return ops.notInArray(col, node.value);
+				case "contains": return containsSql(col, node.value, ops);
+				/* v8 ignore next 4 */
+				default: {
+					const exhaustive = node.op;
+					throw new Error(`PermDock: unknown compare '${String(exhaustive)}'`);
+				}
+			}
+		}
+		/* v8 ignore next 6 */
+		default: throw new Error(`PermDock: unknown compiled node '${String(node)}'`);
+	}
+}
+/** Compiles a condition into a Drizzle `SQL` filter over `table`; no grant compiles to `false`. */
+function toWhere(input, table, options = {}) {
+	return render(compileWhere(input, compact({
+		subject: options.subject,
+		memberships: options.memberships,
+		now: options.now,
+		relations: options.relations
+	})), table, options, loadOperators(options.operators));
+}
+/**
+* Runs `fn` in a transaction whose role and claims are `permdock.subject`'s, so the generated
+* RLS policies decide for the same subject as the in-process checks.
+*/
+function withSubject(db, permdock, fn, options = {}) {
+	const statements = subjectStatements(permdock, options);
+	const { sql } = loadOperators(options.operators);
+	return db.transaction(async (tx) => {
+		const execute = tx.execute.bind(tx);
+		for (const statement of statements) await execute(sql(statementTemplate(statement), ...statement.values));
+		return fn(tx);
+	});
+}
+/**
+* One query for one row: `{ found: false }` when `key` matches nothing, otherwise whether the
+* permission filter keeps the row. Throws when `key` matches more than one row.
+*/
+async function checkRow(db, table, input, key, options = {}) {
+	const { sql } = loadOperators(options.operators);
+	const filter = toWhere(input, table, options);
+	const rows = await db.select({ granted: sql`coalesce((${filter}), false)` }).from(table).where(key).limit(2);
+	return rowCheckFrom(rows);
+}
+//#endregion
+export { checkRow, toWhere, withSubject };

package/dist/duration-xK2jGFVc.js

@@ -0,0 +1,25 @@
+//#region src/core/duration.ts
+/**
+* Parses a duration string (`'30s'`, `'15m'`, `'4h'`, `'7d'`, `'2w'`) into
+* whole seconds. Fail-closed: a malformed or non-positive duration is
+* `undefined`, and every caller treats that as "no bound", never a default.
+*/
+const UNITS = {
+	s: 1,
+	m: 60,
+	h: 3600,
+	d: 86400,
+	w: 604800
+};
+function parseDuration(input) {
+	if (typeof input === "number") return Number.isFinite(input) && input > 0 ? Math.floor(input) : void 0;
+	if (typeof input !== "string") return;
+	const match = /^(\d+)(s|m|h|d|w)$/u.exec(input.trim());
+	if (match === null) return;
+	const amount = Number(match[1]);
+	const unit = UNITS[match[2] ?? ""];
+	if (unit === void 0 || !Number.isFinite(amount) || amount <= 0) return;
+	return amount * unit;
+}
+//#endregion
+export { parseDuration as t };

package/dist/elysia/index.d.ts

@@ -0,0 +1,71 @@
+import { $ as DecisionSink, C as Policy, E as PolicyVocabulary, Zt as PermDock, at as LimitStore, ct as MembershipSource, ft as RelationSource, mr as Principal, pt as RoleSource, sn as PolicySource, tt as EntitlementSource, xt as SnapshotSource } from "../policy-CInmNGkM.js";
+import { d as Permission } from "../permissions-B4apnahQ.js";
+import { f as ApprovalStore } from "../types-B8w5PFtS.js";
+import { n as RevocationFeed } from "../revocations-Cy06JNx2.js";
+import { o as OtelWrap } from "../types-B9dmiiab.js";
+import { r as PdpFactory } from "../types-BvBk1wgn.js";
+import { S as ConnectionOptions, b as Connection, g as discoverViaSignatureAgent, h as WebBotAuthVerifier, n as OpenApiHooks, o as TenantOption, r as ProtectOptions, u as InvalidSignatureError, y as verifyWebBotAuth } from "../create-BKF3dgFk.js";
+import { Elysia } from "elysia";
+//#region src/elysia/create.d.ts
+type ElysiaCtx = {
+  readonly request: Request;
+  readonly body?: unknown;
+  readonly params?: Readonly<Record<string, string | undefined>>;
+};
+type ElysiaPermDockOptions<TUser = unknown> = {
+  readonly subject: (ctx: ElysiaCtx) => TUser | Promise<TUser>;
+  readonly tenant?: TenantOption<ElysiaCtx>;
+  readonly memberships?: MembershipSource | readonly MembershipSource[];
+  /** The object graph for relation grants that walk a parent chain; without it they deny. */
+  readonly relations?: RelationSource;
+  readonly entitlements?: EntitlementSource;
+  readonly customRoles?: RoleSource;
+  /** Hosted grants, read once per instance; see `PolicySource`. */
+  readonly policies?: PolicySource;
+  readonly store?: ApprovalStore;
+  readonly sink?: DecisionSink;
+  readonly limits?: LimitStore;
+  /** `createPermDock` from `permdock/pdp`; `protect` then decides delegated permissions remotely. */
+  readonly pdp?: PdpFactory;
+  /** Accepted for adapter parity; not read by this adapter. */
+  readonly snapshots?: SnapshotSource;
+  /** `(permdock) => withOtel(permdock, options)` from `permdock/otel`. */
+  readonly otel?: OtelWrap;
+  /** `(request) => verifyWebBotAuth(request, options)`; a verified bot becomes the actor. */
+  readonly webBotAuth?: WebBotAuthVerifier;
+  /** Ends or revalidates open sockets. */
+  readonly revocations?: RevocationFeed;
+};
+/** The `ws` Elysia passes to `.ws` handlers; `data` is the upgrade context. */
+type ElysiaSocket = {
+  readonly data: ElysiaCtx;
+  close(code?: number, reason?: string): unknown;
+};
+type ElysiaContext<V extends PolicyVocabulary = PolicyVocabulary> = ElysiaCtx & {
+  permdock: PermDock<V>;
+  permdockData?: unknown;
+};
+type ElysiaProtect = (permission: Permission, loadData?: (ctx: ElysiaCtx) => unknown, protectOptions?: ProtectOptions) => (ctx: ElysiaCtx) => Promise<Response | undefined>;
+/** The `permdock()` plugin: its global derive types `permdock` in every later handler. */
+type ElysiaPermDockPlugin<V extends PolicyVocabulary = PolicyVocabulary> = Elysia<"", {
+  decorator: Record<never, never>;
+  store: Record<never, never>;
+  derive: {
+    readonly permdock: PermDock<V>;
+  };
+  resolve: Record<never, never>;
+}>;
+type ElysiaPermDock<V extends PolicyVocabulary = PolicyVocabulary> = {
+  readonly permdock: () => ElysiaPermDockPlugin<V>;
+  readonly protect: ElysiaProtect;
+  /**
+   * One connection per socket: the same promise for every handler
+   * of that socket; closes it with `1008` when the connection aborts.
+   */
+  readonly connection: (ws: ElysiaSocket, connectionOptions?: ConnectionOptions) => Promise<Connection>;
+  readonly permdockHandler: () => Elysia;
+  readonly openapi: OpenApiHooks;
+};
+export declare function createPermDock<TUser, TPrincipal extends Principal = Principal, V extends PolicyVocabulary = PolicyVocabulary>(policy: Policy<TUser, TPrincipal, V>, options: ElysiaPermDockOptions<TUser>): ElysiaPermDock<V>;
+//#endregion
+export { type ElysiaContext, type ElysiaCtx, type ElysiaPermDock, type ElysiaPermDockOptions, type ElysiaProtect, type ElysiaSocket, InvalidSignatureError, discoverViaSignatureAgent, verifyWebBotAuth };

package/dist/elysia/index.js

@@ -0,0 +1,103 @@
+import { t as compact } from "../compact-y6vfu2_f.js";
+import { i as discoverViaSignatureAgent, r as InvalidSignatureError, s as verifyWebBotAuth } from "../evaluations-DsAU9ppl.js";
+import { r as tenantScope, t as createKernel } from "../create-CSkhDU9T.js";
+import { t as problemFromError } from "../map-error-RJ3ZsUyA.js";
+import { i as onRevoked, t as POLICY_VIOLATION } from "../stream-Q_xlB6Ko.js";
+import { Elysia } from "elysia";
+//#region src/elysia/create.ts
+function createPermDock(policy, options) {
+	const contexts = /* @__PURE__ */ new WeakMap();
+	const bound = /* @__PURE__ */ new WeakMap();
+	const seed = globalThis.crypto.randomUUID();
+	const kernel = createKernel(policy, compact({
+		subject: (request) => {
+			const ctx = contexts.get(request);
+			return ctx === void 0 ? null : options.subject(ctx);
+		},
+		memberships: options.memberships,
+		relations: options.relations,
+		entitlements: options.entitlements,
+		customRoles: options.customRoles,
+		policies: options.policies,
+		store: options.store,
+		sink: options.sink,
+		limits: options.limits,
+		pdp: options.pdp,
+		webBotAuth: options.webBotAuth,
+		revocations: options.revocations,
+		adapter: "elysia",
+		wrap: options.otel
+	}));
+	const bind = (ctx) => {
+		const hit = bound.get(ctx);
+		if (hit !== void 0) return hit;
+		const next = toRequest(ctx);
+		bound.set(ctx, next);
+		contexts.set(next, ctx);
+		return next;
+	};
+	const scopeOf = (ctx) => tenantScope(options.tenant, ctx);
+	const decorate = (ctx, instance, data) => {
+		const scoped = ctx;
+		scoped.permdock = instance;
+		if (data !== void 0) scoped.permdockData = data;
+	};
+	const permdock = () => new Elysia({
+		name: "permdock",
+		seed
+	}).derive({ as: "global" }, async (ctx) => {
+		const instance = await kernel.permdock(bind(ctx), await scopeOf(ctx));
+		decorate(ctx, instance);
+		return { permdock: instance };
+	}).onError({ as: "global" }, ({ error }) => problemFromError(error));
+	const protect = (permission, loadData, protectOptions) => async (ctx) => {
+		const guard = await kernel.protect(permission, loadData === void 0 ? void 0 : () => loadData(ctx), protectOptions)(bind(ctx), await scopeOf(ctx));
+		if (!guard.ok) return guard.response;
+		decorate(ctx, guard.permdock, guard.data);
+	};
+	const sockets = /* @__PURE__ */ new WeakMap();
+	const connection = (ws, connectionOptions) => {
+		const hit = sockets.get(ws.data);
+		if (hit !== void 0) return hit;
+		const opened = (async () => {
+			const conn = await kernel.connection(bind(ws.data), connectionOptions, await scopeOf(ws.data));
+			onRevoked(conn, (problem) => {
+				ws.close(POLICY_VIOLATION, problem.type);
+			});
+			return conn;
+		})();
+		sockets.set(ws.data, opened);
+		return opened;
+	};
+	const permdockHandler = () => {
+		const { POST, GET } = kernel.permdockHandler((request) => {
+			const ctx = contexts.get(request);
+			return ctx === void 0 ? { tenant: void 0 } : scopeOf(ctx);
+		});
+		return new Elysia({
+			name: "permdock-handler",
+			seed
+		}).post("/", (ctx) => POST(bind(ctx))).get("/", (ctx) => GET(bind(ctx)));
+	};
+	return {
+		permdock,
+		protect,
+		connection,
+		permdockHandler,
+		openapi: kernel.openapi
+	};
+}
+function toRequest(ctx) {
+	const method = ctx.request.method;
+	if (method === "GET" || method === "HEAD" || ctx.body === void 0) return ctx.request;
+	const headers = new Headers(ctx.request.headers);
+	const body = typeof ctx.body === "string" ? ctx.body : JSON.stringify(ctx.body);
+	if (!headers.has("content-type")) headers.set("content-type", "application/json");
+	return new Request(ctx.request.url, {
+		method,
+		headers,
+		body
+	});
+}
+//#endregion
+export { InvalidSignatureError, createPermDock, discoverViaSignatureAgent, verifyWebBotAuth };

package/dist/errors-DSMnAVNa.js

@@ -0,0 +1,43 @@
+import { stripVTControlCharacters } from "node:util";
+//#region src/cli/errors.ts
+var CliError = class extends Error {
+	kind;
+	constructor(kind, message, options) {
+		super(message, options);
+		this.name = "CliError";
+		this.kind = kind;
+	}
+};
+const TITLES = {
+	usage: "Usage or configuration error",
+	unavailable: "A database or service the command needs did not answer"
+};
+/** An unclassified error is a usage error: a module that throws while loading is the project's to fix. */
+function cliErrorKind(error) {
+	return error instanceof CliError ? error.kind : "usage";
+}
+function exitCodeOf(kind) {
+	return kind === "usage" ? 2 : 1;
+}
+function cliProblem(kind, message, command) {
+	return {
+		type: `https://permdock.dev/problems/cli-${kind}`,
+		title: TITLES[kind],
+		detail: stripVTControlCharacters(message),
+		...command === void 0 ? {} : { command },
+		exitCode: exitCodeOf(kind)
+	};
+}
+/**
+* The result a command reports for a usage error it caught. A `CliError`
+* propagates instead, so `run()` prints it, as Problem Details under `--json`.
+*/
+function usageResult(error) {
+	if (error instanceof CliError) throw error;
+	return {
+		code: 2,
+		output: error instanceof Error ? error.message : String(error)
+	};
+}
+//#endregion
+export { usageResult as a, exitCodeOf as i, cliErrorKind as n, cliProblem as r, CliError as t };

package/dist/errors-DbZ1YOnb.d.ts

@@ -0,0 +1,138 @@
+import { Mn as Decision, Pt as WireDenial, hr as Subject } from "./policy-CInmNGkM.js";
+import { StandardSchemaV1 } from "@standard-schema/spec";
+//#region src/core/errors.d.ts
+/** Where and how a human approves; carries no secret. */
+type ApprovalHint = {
+  readonly at?: string;
+  readonly hint?: string;
+};
+type ProblemDetails = {
+  readonly type: string;
+  readonly title: string;
+  readonly status: number;
+  readonly detail: string;
+  readonly instance?: string;
+  readonly permission?: string;
+  readonly scope?: string;
+  readonly resource?: {
+    readonly type: string;
+    readonly id?: string;
+  };
+  readonly denials?: readonly WireDenial[];
+  readonly alternatives?: readonly string[];
+  readonly reason?: string;
+  readonly token?: string;
+  readonly issues?: readonly StandardSchemaV1.Issue[];
+  readonly approval?: ApprovalHint;
+  /** RFC 9470 step-up parameters on `step-up-required`. */
+  readonly acrValues?: readonly string[];
+  readonly maxAge?: number;
+  /** The plans that would grant the permission, on `not-entitled`. */
+  readonly plans?: readonly string[];
+};
+declare class PermDockDeniedError extends Error {
+  override readonly name: "PermDockDeniedError";
+  readonly decision: Extract<Decision, {
+    readonly outcome: "denied";
+  }>;
+  readonly permission: string;
+  readonly scope: string;
+  readonly resource: {
+    readonly type: string;
+    readonly id?: string;
+  };
+  readonly subject: Subject;
+  /** `PERMDOCK_DENIED;<permission>`; survives the Server Component boundary (`parsePermDockDigest`). */
+  readonly digest: string;
+  constructor(input: {
+    readonly decision: Extract<Decision, {
+      readonly outcome: "denied";
+    }>;
+    readonly permission: string;
+    readonly scope: string;
+    readonly resource: {
+      readonly type: string;
+      readonly id?: string;
+    };
+    readonly subject: Subject;
+    readonly message: string;
+  });
+  toProblemDetails(options?: {
+    readonly instance?: string;
+  }): ProblemDetails;
+}
+declare class PermDockApprovalRequiredError extends Error {
+  override readonly name: "PermDockApprovalRequiredError";
+  readonly decision: Extract<Decision, {
+    readonly outcome: "approval-required";
+  }>;
+  readonly permission: string;
+  readonly scope: string;
+  readonly resource: {
+    readonly type: string;
+    readonly id?: string;
+  };
+  readonly token: string;
+  readonly reason: string;
+  /** `PERMDOCK_APPROVAL_REQUIRED;<permission>;<token>`; the token is already bound to this subject. */
+  readonly digest: string;
+  constructor(input: {
+    readonly decision: Extract<Decision, {
+      readonly outcome: "approval-required";
+    }>;
+    readonly permission: string;
+    readonly scope: string;
+    readonly resource: {
+      readonly type: string;
+      readonly id?: string;
+    };
+    readonly message: string;
+  });
+  toProblemDetails(options?: {
+    readonly instance?: string;
+  }): ProblemDetails;
+}
+declare class PermDockValidationError extends Error {
+  override readonly name: "PermDockValidationError";
+  readonly code: "invalid-data" | "async-schema" | "no-schema" | "non-portable-condition";
+  readonly permission: string;
+  readonly resource: string;
+  readonly issues: readonly StandardSchemaV1.Issue[];
+  readonly boundary: string;
+  constructor(input: {
+    readonly code: "invalid-data" | "async-schema" | "no-schema" | "non-portable-condition";
+    readonly permission: string;
+    readonly resource: string;
+    readonly issues?: readonly StandardSchemaV1.Issue[];
+    readonly boundary: string;
+    readonly message: string;
+  });
+  toProblemDetails(options?: {
+    readonly instance?: string;
+  }): ProblemDetails;
+}
+type RevokedCode = "session-revoked" | "expired" | "denied" | "subject-changed";
+/**
+ * The `reason` of a long-lived connection's aborted `signal`. `denied` carries
+ * the decision that re-denied the permission the connection was opened for.
+ */
+declare class PermDockRevokedError extends Error {
+  override readonly name: "PermDockRevokedError";
+  readonly code: RevokedCode;
+  readonly permission?: string;
+  readonly decision?: Exclude<Decision, {
+    readonly outcome: "granted";
+  }>;
+  constructor(input: {
+    readonly code: RevokedCode;
+    readonly permission?: string;
+    readonly decision?: Exclude<Decision, {
+      readonly outcome: "granted";
+    }>;
+  });
+  toProblemDetails(options?: {
+    readonly instance?: string;
+  }): ProblemDetails;
+}
+//#endregion
+export { PermDockValidationError as a, PermDockRevokedError as i, PermDockApprovalRequiredError as n, ProblemDetails as o, PermDockDeniedError as r, RevokedCode as s, ApprovalHint as t };