permdock 0.0.0 → 0.1.0

package/dist/problem-Cgp9-KZA.js

@@ -0,0 +1,226 @@
+import { t as compact } from "./compact-y6vfu2_f.js";
+import { n as requiredPlans } from "./describe-Bt1YD5uS.js";
+import { a as approvalMessage, i as PermDockValidationError, n as PermDockDeniedError, o as deniedMessage, t as PermDockApprovalRequiredError } from "./errors-Iy71s7Oj.js";
+//#region src/server/problem.ts
+const PROBLEM_BASE = "https://permdock.dev/problems";
+function quoted(value) {
+	return `"${value.replaceAll(/["\\]/gu, "")}"`;
+}
+const UTF8 = /* @__PURE__ */ new TextEncoder();
+/**
+* An RFC 9651 sf-string: `"` and `\` escaped, and anything outside printable
+* ASCII percent-encoded, which the grammar does not allow.
+*/
+function sfString(value) {
+	return `"${value.replaceAll(/[\\"]/gu, (char) => `\\${char}`).replaceAll(/[^\u0020-\u007E]/gu, (char) => Array.from(UTF8.encode(char), (byte) => `%${byte.toString(16).toUpperCase().padStart(2, "0")}`).join(""))}"`;
+}
+/** An RFC 6750 `WWW-Authenticate: Bearer` value. */
+function bearerChallenge(challenge) {
+	const parts = [`error=${quoted(challenge.error)}`];
+	if (challenge.description !== void 0) parts.push(`error_description=${quoted(challenge.description)}`);
+	if (challenge.scopes !== void 0 && challenge.scopes.length > 0) parts.push(`scope=${quoted([...new Set(challenge.scopes)].join(" "))}`);
+	if (challenge.acrValues !== void 0 && challenge.acrValues.length > 0) parts.push(`acr_values=${quoted(challenge.acrValues.join(" "))}`);
+	if (challenge.maxAge !== void 0) parts.push(`max_age=${quoted(String(challenge.maxAge))}`);
+	if (challenge.resourceMetadata !== void 0) parts.push(`resource_metadata=${quoted(challenge.resourceMetadata)}`);
+	return `Bearer ${parts.join(", ")}`;
+}
+/** The RFC 9728 well-known metadata URL for a resource identifier. */
+function protectedResourceMetadataUrl(resource) {
+	const path = resource.pathname === "/" ? "" : resource.pathname;
+	return `${resource.origin}/.well-known/oauth-protected-resource${path}`;
+}
+/** The `acr` values and the tightest `maxAge` the failing assurance grants ask for. */
+function stepUpOf(decision) {
+	if (decision.outcome !== "denied") return {};
+	const acr = /* @__PURE__ */ new Set();
+	let maxAge;
+	for (const denial of decision.denials) {
+		if (denial.reason !== "insufficient-user-authentication") continue;
+		const grantees = denial.to === void 0 ? [] : Array.isArray(denial.to) ? denial.to : [denial.to];
+		for (const grantee of grantees) {
+			if (grantee.kind !== "assurance") continue;
+			for (const value of grantee.acr ?? []) acr.add(value);
+			if (grantee.maxAge !== void 0) maxAge = maxAge === void 0 ? grantee.maxAge : Math.min(maxAge, grantee.maxAge);
+		}
+	}
+	return compact({
+		acrValues: acr.size === 0 ? void 0 : [...acr],
+		maxAge
+	});
+}
+/** The `error_description` of every `invalid_token` challenge (RFC 6750 section 3.1). */
+const INVALID_TOKEN = "The access token is invalid";
+function wwwAuthenticate(decision, permission, credentials = true) {
+	if (decision.outcome !== "denied") return;
+	const reasons = new Set(decision.denials.map((denial) => denial.reason));
+	if (reasons.has("insufficient-user-authentication")) return bearerChallenge({
+		error: "insufficient_user_authentication",
+		...stepUpOf(decision)
+	});
+	if (reasons.has("anonymous")) return credentials ? bearerChallenge({
+		error: "invalid_token",
+		description: INVALID_TOKEN
+	}) : "Bearer";
+	if (reasons.has("not-delegated") || reasons.has("no-delegation")) return bearerChallenge(compact({
+		error: "insufficient_scope",
+		scopes: permission === void 0 ? void 0 : [permission.scope]
+	}));
+}
+function problemResponse(details, permission, decision, extra, credentials) {
+	const headers = new Headers({
+		...extra,
+		"content-type": "application/problem+json"
+	});
+	if (decision !== void 0) {
+		const challenge = wwwAuthenticate(decision, permission, credentials);
+		if (challenge !== void 0) headers.set("WWW-Authenticate", challenge);
+	}
+	return new Response(JSON.stringify(details), {
+		status: details.status,
+		headers
+	});
+}
+/** RFC 9457 413 for a batch over `max` evaluations. */
+function batchTooLarge(max) {
+	return problemResponse({
+		type: `${PROBLEM_BASE}/payload-too-large`,
+		title: "Payload too large",
+		status: 413,
+		detail: `evaluations batch exceeds ${String(max)}`
+	});
+}
+function validationProblem(detail) {
+	return problemResponse(compact({
+		type: `${PROBLEM_BASE}/validation`,
+		title: "Invalid request",
+		status: 400,
+		detail
+	}));
+}
+function resourceRef(permission, data) {
+	const id = data !== null && typeof data === "object" && "id" in data ? data.id : void 0;
+	return compact({
+		type: permission.resource,
+		id: typeof id === "string" || typeof id === "number" ? String(id) : void 0
+	});
+}
+function isLimitDetail(value) {
+	if (value === null || typeof value !== "object") return false;
+	const { count, window, resetsAt } = value;
+	return Number.isFinite(count) && Number.isFinite(window) && Number.isFinite(resetsAt);
+}
+/**
+* `Retry-After` plus the `RateLimit` / `RateLimit-Policy` fields of
+* draft-ietf-httpapi-ratelimit-headers-11, one policy per exhausted grant.
+*/
+function rateLimitHeaders(decision, now = Date.now() / 1e3) {
+	if (decision.outcome !== "denied") return {};
+	const policies = /* @__PURE__ */ new Map();
+	for (const denial of decision.denials) {
+		if (denial.reason !== "limit" || !isLimitDetail(denial.detail)) continue;
+		const name = denial.role ?? "default";
+		if (!policies.has(name)) policies.set(name, denial.detail);
+	}
+	if (policies.size === 0) return {};
+	const entries = [...policies].map(([name, detail]) => ({
+		name: sfString(name),
+		detail,
+		wait: Math.max(1, Math.ceil(detail.resetsAt - now))
+	}));
+	return {
+		"Retry-After": String(Math.min(...entries.map((entry) => entry.wait))),
+		RateLimit: entries.map((entry) => `${entry.name};r=0;t=${entry.wait}`).join(", "),
+		"RateLimit-Policy": entries.map((entry) => `${entry.name};q=${entry.detail.count};w=${entry.detail.window}`).join(", ")
+	};
+}
+/** Reasons that only arise once a matching grant was found, so they reveal nothing hidden. */
+const HOLDS_GRANT = /* @__PURE__ */ new Set([
+	"insufficient-user-authentication",
+	"limit",
+	"limit-unavailable"
+]);
+function problemFromDecision(decision, permission, subject, options = {}) {
+	const base = PROBLEM_BASE;
+	if (decision.outcome === "granted") return new Response(null, { status: 204 });
+	if (decision.outcome === "approval-required") {
+		const details = new PermDockApprovalRequiredError({
+			decision,
+			permission: permission.key,
+			scope: permission.scope,
+			resource: resourceRef(permission, void 0),
+			message: approvalMessage(permission.key, decision.reason, decision.token)
+		}).toProblemDetails(compact({ instance: options.instance }));
+		const approval = options.approval === void 0 || options.approval.at === void 0 && options.approval.hint === void 0 ? void 0 : compact({
+			at: options.approval.at,
+			hint: options.approval.hint
+		});
+		return problemResponse(compact({
+			...details,
+			type: `${base}/approval-required`,
+			approval
+		}), permission, decision);
+	}
+	const reasons = new Set(decision.denials.map((denial) => denial.reason));
+	if (options.disclosure === "hide" && ![...reasons].every((reason) => HOLDS_GRANT.has(reason))) return notFoundProblem(options.instance);
+	if (decision.denials.some((denial) => denial.detail instanceof PermDockValidationError)) {
+		const validation = decision.denials[0]?.detail;
+		if (validation instanceof PermDockValidationError) return problemResponse(validation.toProblemDetails(), permission, decision);
+	}
+	const details = new PermDockDeniedError({
+		decision,
+		permission: permission.key,
+		scope: permission.scope,
+		resource: resourceRef(permission, void 0),
+		subject,
+		message: deniedMessage(permission.key, subject.principal?.id, decision.denials, decision.alternatives.map((leaf) => leaf.key))
+	}).toProblemDetails(compact({ instance: options.instance }));
+	if (reasons.has("anonymous")) return problemResponse(compact({
+		type: `${base}/unauthenticated`,
+		title: "Authentication required",
+		status: 401,
+		detail: "Authenticate and repeat the request",
+		instance: options.instance,
+		permission: permission.key
+	}), permission, decision, void 0, options.credentials);
+	if (reasons.has("insufficient-user-authentication")) return problemResponse(compact({
+		...details,
+		status: 401,
+		type: `${base}/step-up-required`,
+		...stepUpOf(decision)
+	}), permission, decision);
+	const plans = requiredPlans(decision);
+	if (plans.length > 0) return problemResponse({
+		...details,
+		type: `${base}/not-entitled`,
+		title: "Plan upgrade required",
+		plans
+	}, permission, decision);
+	if (reasons.size > 0 && [...reasons].every((reason) => reason === "limit")) return problemResponse({
+		...details,
+		status: 429,
+		type: `${base}/rate-limited`,
+		title: "Rate limit exceeded"
+	}, permission, decision, rateLimitHeaders(decision));
+	if (reasons.has("limit-unavailable") && [...reasons].every((reason) => reason === "limit" || reason === "limit-unavailable")) return problemResponse({
+		...details,
+		status: 503,
+		type: `${base}/limit-unavailable`,
+		title: "Rate limit unavailable"
+	}, permission, decision);
+	return problemResponse({
+		...details,
+		type: `${base}/denied`
+	}, permission, decision);
+}
+/** The `404` a missing row and a hidden one share, so the two read the same. */
+function notFoundProblem(instance) {
+	return problemResponse(compact({
+		type: `${PROBLEM_BASE}/not-found`,
+		title: "Not found",
+		status: 404,
+		detail: "No such resource",
+		instance
+	}));
+}
+//#endregion
+export { problemFromDecision as a, stepUpOf as c, notFoundProblem as i, validationProblem as l, batchTooLarge as n, problemResponse as o, bearerChallenge as r, protectedResourceMetadataUrl as s, PROBLEM_BASE as t, wwwAuthenticate as u };

package/dist/prompt-CXYhLfsS.js

@@ -0,0 +1,32 @@
+import { cancel, confirm, isCancel, multiselect } from "@clack/prompts";
+//#region src/cli/commands/prompt.ts
+/** What a command reports when the person at the terminal cancels a prompt. */
+const CANCELLED = {
+	code: 2,
+	output: "Cancelled."
+};
+/** A yes or no question; `undefined` when cancelled. */
+async function ask(message) {
+	const answer = await confirm({ message });
+	if (isCancel(answer)) {
+		cancel();
+		return;
+	}
+	return answer;
+}
+/** Pick one or more of `options`, `initial` preselected; `undefined` when cancelled. */
+async function pick(message, options, initial) {
+	const answer = await multiselect({
+		message,
+		options: options.map((option) => ({ ...option })),
+		initialValues: [...initial],
+		required: true
+	});
+	if (isCancel(answer)) {
+		cancel();
+		return;
+	}
+	return answer;
+}
+//#endregion
+export { ask as n, pick as r, CANCELLED as t };

package/dist/protected-B4K3BKoX.js

@@ -0,0 +1,138 @@
+import { n as PermDockStoreContext, t as PermDockSnapshotPromiseContext } from "./context-gtAwAILx.js";
+import { Suspense, use, useMemo, useSyncExternalStore } from "react";
+import { jsx } from "react/jsx-runtime";
+//#region src/react/hooks.ts
+function useStore() {
+	const store = use(PermDockStoreContext);
+	if (store === null) throw new Error("PermDock: hooks require <PermDockProvider>.");
+	const pending = use(PermDockSnapshotPromiseContext);
+	if (pending !== null) store.adopt(use(pending), pending);
+	return store;
+}
+function usePermDock() {
+	const store = useStore();
+	return useSyncExternalStore((listener) => store.subscribe(listener), () => store.get(), () => store.get());
+}
+function usePermission(permission, data) {
+	const store = useStore();
+	const permdock = useSyncExternalStore((listener) => store.subscribe(listener), () => store.get(), () => store.get());
+	return useMemo(() => store.permissionState(permission, data), [
+		store,
+		permdock,
+		permission,
+		data
+	]);
+}
+function usePermissions(permissions, data) {
+	const store = useStore();
+	const permdock = useSyncExternalStore((listener) => store.subscribe(listener), () => store.get(), () => store.get());
+	return useMemo(() => {
+		const granted = [];
+		const byKey = {};
+		for (const permission of permissions) {
+			const state = store.permissionState(permission, data);
+			byKey[permission.key] = state;
+			if (state.allowed) granted.push(permission);
+		}
+		return new Proxy({
+			granted,
+			get(permission) {
+				return byKey[permission.key];
+			}
+		}, { get(target, prop, receiver) {
+			if (typeof prop === "string" && Object.hasOwn(byKey, prop)) return byKey[prop];
+			return Reflect.get(target, prop, receiver);
+		} });
+	}, [
+		store,
+		permdock,
+		permissions,
+		data
+	]);
+}
+function useFilter(permission, rows) {
+	const permdock = usePermDock();
+	return useMemo(() => {
+		const result = [...permdock.filter(permission, rows)];
+		result.partial = permdock.where(permission).partial;
+		return result;
+	}, [
+		permdock,
+		permission,
+		rows
+	]);
+}
+function useTenant() {
+	const permdock = usePermDock();
+	return {
+		tenant: permdock.subject.principal?.tenant ?? null,
+		tenants: permdock.tenants(),
+		switchTo: (id) => permdock.refresh({ tenant: id }),
+		status: permdock.status()
+	};
+}
+function useMemberships() {
+	return usePermDock().memberships();
+}
+function useRoles(options = {}) {
+	const permdock = usePermDock();
+	return { roles: (options.team === void 0 ? permdock : permdock.team(options.team)).heldRoles(options.tenant === void 0 ? void 0 : { tenant: options.tenant }) };
+}
+function useAssignableRoles() {
+	return usePermDock().assignableRoles();
+}
+function useAssignablePermissions(options = {}) {
+	return usePermDock().assignablePermissions(options);
+}
+function useSubject() {
+	const permdock = usePermDock();
+	const snapshot = permdock.snapshot();
+	const simulated = typeof snapshot === "object" && snapshot !== null && "simulated" in snapshot && snapshot.simulated === true;
+	return {
+		principal: permdock.subject.principal,
+		actor: permdock.subject.actor,
+		delegation: permdock.subject.delegation,
+		expiresAt: permdock.subject.expiresAt,
+		simulated
+	};
+}
+function useApproval(decision) {
+	const store = useStore();
+	useSyncExternalStore((listener) => store.subscribe(listener), () => store.get(), () => store.get());
+	return {
+		state: store.approvalState(decision),
+		token: decision.outcome === "approval-required" ? decision.token : void 0,
+		request: (note) => store.requestApproval(decision, note)
+	};
+}
+//#endregion
+//#region src/react/protected.tsx
+function Protected(props) {
+	if (props.pending === void 0) return /* @__PURE__ */ jsx(Guard, { ...props });
+	return /* @__PURE__ */ jsx(Suspense, {
+		fallback: props.pending,
+		children: /* @__PURE__ */ jsx(Guard, { ...props })
+	});
+}
+function Guard(props) {
+	const root = usePermDock();
+	const local = usePermission(props.permission, props.data);
+	const run = (permdock) => {
+		const decision = permdock.decide(props.permission, props.data);
+		return {
+			allowed: decision.outcome === "granted",
+			status: "ready",
+			decision
+		};
+	};
+	const { allowed, status, decision } = props.tenant === void 0 ? local : run(root.tenant(props.tenant));
+	if (status === "pending") return props.pending ?? null;
+	if (!allowed || decision.outcome !== "granted") {
+		if (typeof props.fallback === "function") return props.fallback(decision);
+		return props.fallback ?? null;
+	}
+	if (typeof props.children === "function") return props.children(decision);
+	return props.children;
+}
+//#endregion
+export { useFilter as a, usePermission as c, useSubject as d, useTenant as f, useAssignableRoles as i, usePermissions as l, useApproval as n, useMemberships as o, useAssignablePermissions as r, usePermDock as s, Protected as t, useRoles as u };

package/dist/protected-BuPAycJT.d.ts

@@ -0,0 +1,26 @@
+import { E as PolicyVocabulary, Mn as Decision, pr as Membership } from "./policy-CInmNGkM.js";
+import { d as Permission } from "./permissions-B4apnahQ.js";
+import { r as Role } from "./vocabulary-Dk0fs-Jk.js";
+import { a as FilterResult, c as PermissionState, d as TenantView, f as UseRolesOptions, l as ProtectedProps, r as ClientPermDock, s as PermissionSet, t as ApprovalHandle, u as SubjectView } from "./types-DbWdEfcm.js";
+import { ReactNode } from "react";
+//#region src/react/hooks.d.ts
+declare function usePermDock<V extends PolicyVocabulary = PolicyVocabulary>(): ClientPermDock<V>;
+declare function usePermission(permission: Permission, data?: unknown): PermissionState;
+declare function usePermissions(permissions: readonly Permission[], data?: unknown): PermissionSet;
+declare function useFilter<T>(permission: Permission<string, T, "instance">, rows: readonly T[]): FilterResult<T>;
+declare function useTenant(): TenantView;
+declare function useMemberships(): readonly Membership[];
+declare function useRoles(options?: UseRolesOptions): {
+  readonly roles: readonly Role[];
+};
+declare function useAssignableRoles(): readonly Role[];
+declare function useAssignablePermissions(options?: {
+  readonly tenant?: string;
+}): readonly Permission[];
+declare function useSubject(): SubjectView;
+declare function useApproval(decision: Decision): ApprovalHandle;
+//#endregion
+//#region src/react/protected.d.ts
+declare function Protected(props: ProtectedProps): ReactNode;
+//#endregion
+export { useFilter as a, usePermission as c, useSubject as d, useTenant as f, useAssignableRoles as i, usePermissions as l, useApproval as n, useMemberships as o, useAssignablePermissions as r, usePermDock as s, Protected as t, useRoles as u };

package/dist/protected-wY7nXhY9.d.ts

@@ -0,0 +1,23 @@
+import { Mn as Decision } from "./policy-CInmNGkM.js";
+import { d as Permission } from "./permissions-B4apnahQ.js";
+import { i as ClientStatus } from "./types-DbWdEfcm.js";
+import { t as ClientStore } from "./store-Bq90395i.js";
+import { Snippet } from "svelte";
+//#region src/svelte/protected.d.ts
+type ProtectedProps = {
+  readonly permission: Permission;
+  readonly data?: unknown;
+  readonly tenant?: string;
+  readonly children?: Snippet<[Decision]>;
+  readonly pending?: Snippet;
+  readonly fallback?: Snippet<[Decision]>;
+};
+type ProtectedView = {
+  readonly allowed: boolean;
+  readonly status: ClientStatus;
+  readonly decision: Decision;
+  readonly slot: "pending" | "fallback" | "default";
+};
+declare function protectedView(store: ClientStore, reference: Permission, data?: unknown, tenant?: string, _generation?: number): ProtectedView;
+//#endregion
+export { protectedView as n, ProtectedProps as t };

package/dist/provider-_wx46HpB.js

@@ -0,0 +1,48 @@
+import { t as compact } from "./compact-y6vfu2_f.js";
+import { t as emptySnapshot } from "./from-snapshot-BMGnhmgv.js";
+import { n as PermDockStoreContext, t as PermDockSnapshotPromiseContext } from "./context-gtAwAILx.js";
+import { t as createClientStore } from "./store-C6hFW6ta.js";
+import { useMemo } from "react";
+import { jsx } from "react/jsx-runtime";
+//#region src/react/provider.tsx
+/** One hint per provider: the first check `endpoint: false` turns into a `server-only` denial. */
+function hintOnce() {
+	let shown = false;
+	return (permission) => {
+		if (shown) return;
+		shown = true;
+		console.info(`PermDock: ${permission.key} needs the server (a closure, graph relation or period grant) and endpoint is false, so it is denied with reason server-only; check it with getPermission instead`);
+	};
+}
+function PermDockProvider(props) {
+	const promise = props.snapshotPromise ?? null;
+	const store = useMemo(() => createClientStore(compact({
+		snapshot: props.snapshot ?? emptySnapshot(),
+		endpoint: props.endpoint === false ? void 0 : props.endpoint,
+		onServerOnly: props.endpoint === false ? hintOnce() : void 0,
+		approvals: props.approvals,
+		tenant: props.tenant,
+		fetch: props.fetch,
+		headers: props.headers,
+		maxAge: props.maxAge,
+		verifier: props.verifier
+	})), [
+		props.snapshot,
+		props.endpoint,
+		props.approvals,
+		props.tenant,
+		props.fetch,
+		props.headers,
+		props.maxAge,
+		props.verifier
+	]);
+	return /* @__PURE__ */ jsx(PermDockStoreContext, {
+		value: store,
+		children: /* @__PURE__ */ jsx(PermDockSnapshotPromiseContext, {
+			value: promise,
+			children: props.children
+		})
+	});
+}
+//#endregion
+export { PermDockProvider as t };

package/dist/provider-wTAUda2v.d.ts

@@ -0,0 +1,6 @@
+import { o as PermDockProviderProps } from "./types-DbWdEfcm.js";
+import { ReactElement } from "react";
+//#region src/react/provider.d.ts
+declare function PermDockProvider(props: PermDockProviderProps): ReactElement;
+//#endregion
+export { PermDockProvider as t };

package/dist/react/index.d.ts

@@ -0,0 +1,6 @@
+import { a as requiredPlans, i as describe } from "../describe-DernyItf.js";
+import { t as approvalHeaders } from "../headers-C8SHQccD.js";
+import { a as FilterResult, c as PermissionState, d as TenantView, i as ClientStatus, l as ProtectedProps, n as ApprovalState, o as PermDockProviderProps, r as ClientPermDock, s as PermissionSet, t as ApprovalHandle, u as SubjectView } from "../types-DbWdEfcm.js";
+import { a as useFilter, c as usePermission, d as useSubject, f as useTenant, i as useAssignableRoles, l as usePermissions, n as useApproval, o as useMemberships, r as useAssignablePermissions, s as usePermDock, t as Protected, u as useRoles } from "../protected-BuPAycJT.js";
+import { t as PermDockProvider } from "../provider-wTAUda2v.js";
+export { type ApprovalHandle, type ApprovalState, type ClientPermDock, type ClientStatus, type FilterResult, PermDockProvider, type PermDockProviderProps, type PermissionSet, type PermissionState, Protected, type ProtectedProps, type SubjectView, type TenantView, approvalHeaders, describe, requiredPlans, useApproval, useAssignablePermissions, useAssignableRoles, useFilter, useMemberships, usePermDock, usePermission, usePermissions, useRoles, useSubject, useTenant };

package/dist/react/index.js

@@ -0,0 +1,6 @@
+"use client";
+import { n as requiredPlans, t as describe } from "../describe-Bt1YD5uS.js";
+import { t as approvalHeaders } from "../headers-B5RRv3Xm.js";
+import { a as useFilter, c as usePermission, d as useSubject, f as useTenant, i as useAssignableRoles, l as usePermissions, n as useApproval, o as useMemberships, r as useAssignablePermissions, s as usePermDock, t as Protected, u as useRoles } from "../protected-B4K3BKoX.js";
+import { t as PermDockProvider } from "../provider-_wx46HpB.js";
+export { PermDockProvider, Protected, approvalHeaders, describe, requiredPlans, useApproval, useAssignablePermissions, useAssignableRoles, useFilter, useMemberships, usePermDock, usePermission, usePermissions, useRoles, useSubject, useTenant };

package/dist/react/provider-client.d.ts

@@ -0,0 +1,2 @@
+import { t as PermDockProvider } from "../provider-wTAUda2v.js";
+export { PermDockProvider };

package/dist/react/provider-client.js

@@ -0,0 +1,3 @@
+"use client";
+import { t as PermDockProvider } from "../provider-_wx46HpB.js";
+export { PermDockProvider };

package/dist/react-native/index.d.ts

@@ -0,0 +1,42 @@
+import { Et as TokenVerifier, gt as Snapshot } from "../policy-CInmNGkM.js";
+import { a as requiredPlans, i as describe } from "../describe-DernyItf.js";
+import { t as approvalHeaders } from "../headers-C8SHQccD.js";
+import { a as FilterResult, c as PermissionState, d as TenantView, i as ClientStatus, l as ProtectedProps, n as ApprovalState, r as ClientPermDock, s as PermissionSet, t as ApprovalHandle, u as SubjectView } from "../types-DbWdEfcm.js";
+import { a as useFilter, c as usePermission, d as useSubject, f as useTenant, i as useAssignableRoles, l as usePermissions, n as useApproval, o as useMemberships, r as useAssignablePermissions, s as usePermDock, t as Protected, u as useRoles } from "../protected-BuPAycJT.js";
+import { t as ClientStore } from "../store-Bq90395i.js";
+import { ReactElement, ReactNode } from "react";
+//#region src/react-native/types.d.ts
+type PermDockStorage = {
+  getItem(key: string): string | null | Promise<string | null>;
+  setItem(key: string, value: string): void | Promise<void>;
+  removeItem(key: string): void | Promise<void>;
+};
+type NativeRevalidate = "launch" | "focus" | number;
+type NativePermDockProviderProps = {
+  readonly storage: PermDockStorage;
+  readonly snapshot?: Snapshot | string;
+  readonly snapshotUrl?: string;
+  readonly endpoint?: string;
+  readonly approvals?: string;
+  readonly tenant?: string;
+  readonly subjectId?: string;
+  readonly revalidate?: NativeRevalidate;
+  readonly subscribeForeground?: (listener: () => void) => () => void;
+  readonly fetch?: typeof fetch;
+  readonly headers?: Readonly<Record<string, string>>;
+  readonly maxAge?: number;
+  readonly verifier?: TokenVerifier;
+  readonly children: ReactNode;
+};
+//#endregion
+//#region src/react-native/provider.d.ts
+export declare function PermDockProvider(props: NativePermDockProviderProps): ReactElement;
+//#endregion
+//#region src/react-native/storage.d.ts
+export declare function memoryStorage(initial?: Readonly<Record<string, string>>): PermDockStorage;
+//#endregion
+//#region src/react-native/store.d.ts
+type NativeStoreOptions = Omit<NativePermDockProviderProps, "children">;
+export declare function createNativeStore(options: NativeStoreOptions): ClientStore;
+//#endregion
+export { type ApprovalHandle, type ApprovalState, type ClientPermDock, type ClientStatus, type FilterResult, type NativePermDockProviderProps, type NativeRevalidate, type PermDockStorage, type PermissionSet, type PermissionState, Protected, type ProtectedProps, type SubjectView, type TenantView, approvalHeaders, describe, requiredPlans, useApproval, useAssignablePermissions, useAssignableRoles, useFilter, useMemberships, usePermDock, usePermission, usePermissions, useRoles, useSubject, useTenant };