permdock 0.0.0 → 0.2.0

package/dist/doctor-rOr-4ZfS.js

@@ -0,0 +1,53 @@
+import { a as listArg, i as globalArgs, t as COMMAND_DESCRIPTIONS } from "./commands-DWOrSQic.js";
+import { n as ask, t as CANCELLED } from "./prompt-CXYhLfsS.js";
+import { defineCommand } from "citty";
+//#region src/cli/commands/doctor.ts
+function doctor(ctx) {
+	return defineCommand({
+		meta: {
+			name: "doctor",
+			description: COMMAND_DESCRIPTIONS.doctor
+		},
+		args: {
+			...globalArgs,
+			only: {
+				type: "string",
+				description: "Check codes or groups to run, repeatable",
+				valueHint: "codes"
+			},
+			fix: {
+				type: "boolean",
+				description: "Apply safe fixes: install skills, regenerate the catalog"
+			},
+			strict: {
+				type: "boolean",
+				description: "Exit 1 on warnings too"
+			}
+		},
+		async run({ args: parsed, rawArgs }) {
+			let fix = parsed.fix === true;
+			if (fix && ctx.interactive) {
+				const answer = await ask(`Install the Agent Skills and regenerate the catalog in ${ctx.cwd}?`);
+				if (answer === void 0) {
+					ctx.report(CANCELLED);
+					return;
+				}
+				fix = answer;
+			}
+			const result = await (await import("./doctor-WpvG6p4k.js")).runDoctor({
+				cwd: ctx.cwd,
+				config: ctx.config,
+				only: listArg(rawArgs, "only"),
+				json: ctx.json,
+				fix,
+				strict: parsed.strict === true,
+				color: ctx.color,
+				now: ctx.now,
+				io: ctx.io
+			});
+			ctx.report(result);
+		}
+	});
+}
+//#endregion
+export { doctor };

package/dist/drizzle/index.d.ts

@@ -0,0 +1,73 @@
+import { Ir as Condition, Pr as Subject, mn as WhereResult } from "../policy-CFZAr_Al.js";
+import { r as RelationsMapping } from "../graph-sql-B-dsAT6j.js";
+import { s as MembershipsMapping } from "../compile-CNnl6uIt.js";
+import { n as WithSubjectOptions, t as RowCheck } from "../row-check-Dt35czLy.js";
+import { SQL, Table } from "drizzle-orm";
+//#region src/drizzle/types.d.ts
+/** A column of the Drizzle table `T` or an `SQL` expression; anything for a structural stand-in. */
+type DrizzleColumnOf<T> = T extends Table ? T["_"]["columns"][keyof T["_"]["columns"]] | SQL : unknown;
+type DrizzleWhereOptions<T = unknown> = {
+  /** Condition field to column of the table passed to `toWhere`. */
+  readonly columns?: Readonly<Record<string, DrizzleColumnOf<T>>>;
+  readonly subject?: Subject;
+  readonly memberships?: MembershipsMapping;
+  /** Where the relation graph lives; graph grants compile to Postgres subqueries with it and are refused without. */
+  readonly relations?: RelationsMapping;
+  readonly now?: number;
+  readonly operators?: DrizzleOperators;
+};
+type DrizzleOperators = {
+  readonly and: (...args: unknown[]) => unknown;
+  readonly or: (...args: unknown[]) => unknown;
+  readonly not: (value: unknown) => unknown;
+  readonly eq: (column: unknown, value: unknown) => unknown;
+  readonly ne: (column: unknown, value: unknown) => unknown;
+  readonly gt: (column: unknown, value: unknown) => unknown;
+  readonly gte: (column: unknown, value: unknown) => unknown;
+  readonly lt: (column: unknown, value: unknown) => unknown;
+  readonly lte: (column: unknown, value: unknown) => unknown;
+  readonly inArray: (column: unknown, values: readonly unknown[]) => unknown;
+  readonly notInArray: (column: unknown, values: readonly unknown[]) => unknown;
+  readonly isNull: (column: unknown) => unknown;
+  readonly isNotNull: (column: unknown) => unknown;
+  readonly like: (column: unknown, value: unknown) => unknown;
+  readonly sql: (strings: TemplateStringsArray, ...values: unknown[]) => unknown;
+};
+type DrizzleWithSubjectOptions = WithSubjectOptions & {
+  /** `import * as operators from 'drizzle-orm'`, on runtimes without `require`. */
+  readonly operators?: DrizzleOperators;
+};
+//#endregion
+//#region src/drizzle/to-where.d.ts
+/** Compiles a condition into a Drizzle `SQL` filter over `table`; no grant compiles to `false`. */
+export declare function toWhere<T extends object>(input: Condition | WhereResult, table: T, options?: DrizzleWhereOptions<T>): SQL;
+type DrizzleDatabase<Tx> = {
+  transaction<T>(fn: (tx: Tx) => Promise<T>): Promise<T>;
+};
+/**
+ * Runs `fn` in a transaction whose role and claims are `permdock.subject`'s, so the generated
+ * RLS policies decide for the same subject as the in-process checks.
+ */
+export declare function withSubject<Tx extends {
+  execute(query: never): unknown;
+}, T>(db: DrizzleDatabase<Tx>, permdock: {
+  readonly subject: Subject;
+}, fn: (tx: Tx) => Promise<T>, options?: DrizzleWithSubjectOptions): Promise<T>;
+type DrizzleSelectable = {
+  select(fields: Record<string, unknown>): {
+    from(table: never): {
+      where(where: unknown): {
+        limit(count: number): PromiseLike<readonly {
+          readonly granted?: unknown;
+        }[]>;
+      };
+    };
+  };
+};
+/**
+ * One query for one row: `{ found: false }` when `key` matches nothing, otherwise whether the
+ * permission filter keeps the row. Throws when `key` matches more than one row.
+ */
+export declare function checkRow<T extends object>(db: DrizzleSelectable, table: T, input: Condition | WhereResult, key: SQL, options?: DrizzleWhereOptions<T>): Promise<RowCheck>;
+//#endregion
+export type { DrizzleOperators, DrizzleWhereOptions, DrizzleWithSubjectOptions, MembershipsMapping, RelationsMapping, RowCheck, WithSubjectOptions };

package/dist/drizzle/index.js

@@ -0,0 +1,160 @@
+import { t as compact } from "../compact-y6vfu2_f.js";
+import { w as assertSafeKey } from "../permissions-DVoF6dMt.js";
+import { n as escapeLike, t as compileWhere } from "../compile-Ba4blROR.js";
+import { i as rowCheckFrom, r as subjectStatements, t as statementTemplate } from "../subject-settings-BwBmCdTR.js";
+//#region src/drizzle/to-where.ts
+function loadOperators(injected) {
+	if (injected !== void 0) return injected;
+	const loader = globalThis.process?.getBuiltinModule?.("node:module");
+	try {
+		if (loader === void 0) throw new Error("no module loader");
+		return loader.createRequire(import.meta.url)("drizzle-orm");
+	} catch {
+		throw new Error("PermDock: permdock/drizzle requires the drizzle-orm peer; pass `operators` on runtimes without require");
+	}
+}
+function ident(name) {
+	assertSafeKey(name, "sql identifier");
+	if (!/^[A-Za-z_][A-Za-z0-9_]*$/u.test(name)) throw new Error(`PermDock: unsafe SQL identifier '${name}'`);
+	return name;
+}
+function column(table, field, columns) {
+	assertSafeKey(field, "condition field");
+	const mapped = (columns !== void 0 && Object.hasOwn(columns, field) ? columns[field] : void 0) ?? (Object.hasOwn(table, field) ? table[field] : void 0);
+	if (mapped === void 0 || typeof mapped === "function") throw new Error(`PermDock: unknown column '${field}'`);
+	return mapped;
+}
+/** Drizzle's Postgres array columns (`text().array()`) report `dataType: 'array'`. */
+function isArrayColumn(col) {
+	if (col === null || typeof col !== "object") return false;
+	const { dataType, dimensions } = col;
+	return dataType === "array" || typeof dimensions === "number" && dimensions > 0;
+}
+function tagged(parts, ops) {
+	const strings = [""];
+	const values = [];
+	for (const part of parts) if ("text" in part) strings[strings.length - 1] += part.text;
+	else {
+		values.push(part.value);
+		strings.push("");
+	}
+	const template = strings;
+	Object.defineProperty(template, "raw", { value: strings });
+	return ops.sql(template, ...values);
+}
+function existsSql(node, table, options, ops) {
+	const m = (name) => `m.${ident(name)}`;
+	const parts = [
+		{ text: `exists (select 1 from ${ident(node.table)} m where ${m(node.rowColumn)} = ` },
+		{ value: column(table, node.rowField, options.columns) },
+		{ text: ` and ${m(node.user)} = ` },
+		{ value: node.userValue }
+	];
+	if (node.roles.length > 0) {
+		parts.push({ text: ` and ${m(node.role)} in (` });
+		for (const [index, role] of node.roles.entries()) {
+			if (index > 0) parts.push({ text: ", " });
+			parts.push({ value: role });
+		}
+		parts.push({ text: ")" });
+	}
+	if (node.expiresAt !== void 0) {
+		const expires = m(node.expiresAt);
+		parts.push({ text: ` and (${expires} is null or ${expires} > ` }, { value: node.now }, { text: ")" });
+	}
+	if (node.tenantColumn !== void 0 && node.tenantValue !== void 0) {
+		const tenant = m(node.tenantColumn);
+		parts.push({ text: ` and (${tenant} is null or ${tenant} = ` }, { value: node.tenantValue }, { text: ")" });
+	}
+	if (node.resourceColumn !== void 0 && node.resourceValue !== void 0) parts.push({ text: ` and ${m(node.resourceColumn)} = ` }, { value: node.resourceValue });
+	parts.push({ text: ")" });
+	return tagged(parts, ops);
+}
+function containsSql(col, value, ops) {
+	if (isArrayColumn(col)) return tagged([
+		{ value },
+		{ text: " = any(" },
+		{ value: col },
+		{ text: ")" }
+	], ops);
+	if (typeof value === "string") return ops.like(col, `%${escapeLike(value)}%`);
+	return tagged([
+		{ value: col },
+		{ text: " @> " },
+		{ value }
+	], ops);
+}
+function render(node, table, options, ops) {
+	switch (node.kind) {
+		case "never": return ops.sql`false`;
+		case "always": return ops.sql`true`;
+		case "isNull": {
+			const col = column(table, node.field, options.columns);
+			return node.negated ? ops.isNotNull(col) : ops.isNull(col);
+		}
+		case "and": return ops.and(...node.items.map((item) => render(item, table, options, ops)));
+		case "or": return ops.or(...node.items.map((item) => render(item, table, options, ops)));
+		case "not": return ops.not(render(node.item, table, options, ops));
+		case "exists": return existsSql(node, table, options, ops);
+		case "sql": return tagged(node.parts.map((part) => {
+			if ("text" in part) return part;
+			if ("column" in part) return { value: column(table, part.column, options.columns) };
+			return { value: "subject" in part ? node.subject : part.value };
+		}), ops);
+		case "compare": {
+			const col = column(table, node.field, options.columns);
+			switch (node.op) {
+				case "eq": return ops.eq(col, node.value);
+				case "ne": return ops.ne(col, node.value);
+				case "gt": return ops.gt(col, node.value);
+				case "gte": return ops.gte(col, node.value);
+				case "lt": return ops.lt(col, node.value);
+				case "lte": return ops.lte(col, node.value);
+				case "in": return ops.inArray(col, node.value);
+				case "notIn": return ops.notInArray(col, node.value);
+				case "contains": return containsSql(col, node.value, ops);
+				/* v8 ignore next 4 */
+				default: {
+					const exhaustive = node.op;
+					throw new Error(`PermDock: unknown compare '${String(exhaustive)}'`);
+				}
+			}
+		}
+		/* v8 ignore next 6 */
+		default: throw new Error(`PermDock: unknown compiled node '${String(node)}'`);
+	}
+}
+/** Compiles a condition into a Drizzle `SQL` filter over `table`; no grant compiles to `false`. */
+function toWhere(input, table, options = {}) {
+	return render(compileWhere(input, compact({
+		subject: options.subject,
+		memberships: options.memberships,
+		now: options.now,
+		relations: options.relations
+	})), table, options, loadOperators(options.operators));
+}
+/**
+* Runs `fn` in a transaction whose role and claims are `permdock.subject`'s, so the generated
+* RLS policies decide for the same subject as the in-process checks.
+*/
+function withSubject(db, permdock, fn, options = {}) {
+	const statements = subjectStatements(permdock, options);
+	const { sql } = loadOperators(options.operators);
+	return db.transaction(async (tx) => {
+		const execute = tx.execute.bind(tx);
+		for (const statement of statements) await execute(sql(statementTemplate(statement), ...statement.values));
+		return fn(tx);
+	});
+}
+/**
+* One query for one row: `{ found: false }` when `key` matches nothing, otherwise whether the
+* permission filter keeps the row. Throws when `key` matches more than one row.
+*/
+async function checkRow(db, table, input, key, options = {}) {
+	const { sql } = loadOperators(options.operators);
+	const filter = toWhere(input, table, options);
+	const rows = await db.select({ granted: sql`coalesce((${filter}), false)` }).from(table).where(key).limit(2);
+	return rowCheckFrom(rows);
+}
+//#endregion
+export { checkRow, toWhere, withSubject };

package/dist/duration-xK2jGFVc.js

@@ -0,0 +1,25 @@
+//#region src/core/duration.ts
+/**
+* Parses a duration string (`'30s'`, `'15m'`, `'4h'`, `'7d'`, `'2w'`) into
+* whole seconds. Fail-closed: a malformed or non-positive duration is
+* `undefined`, and every caller treats that as "no bound", never a default.
+*/
+const UNITS = {
+	s: 1,
+	m: 60,
+	h: 3600,
+	d: 86400,
+	w: 604800
+};
+function parseDuration(input) {
+	if (typeof input === "number") return Number.isFinite(input) && input > 0 ? Math.floor(input) : void 0;
+	if (typeof input !== "string") return;
+	const match = /^(\d+)(s|m|h|d|w)$/u.exec(input.trim());
+	if (match === null) return;
+	const amount = Number(match[1]);
+	const unit = UNITS[match[2] ?? ""];
+	if (unit === void 0 || !Number.isFinite(amount) || amount <= 0) return;
+	return amount * unit;
+}
+//#endregion
+export { parseDuration as t };

package/dist/elysia/index.d.ts

@@ -0,0 +1,49 @@
+import { C as Policy, D as PolicyVocabulary, Nr as Principal, ln as PermDock } from "../policy-CFZAr_Al.js";
+import { f as Permission } from "../permissions-DttnqqxC.js";
+import { n as RevocationFeed } from "../revocations-Cy06JNx2.js";
+import { A as ConnectionOptions, O as Connection, h as InvalidSignatureError, i as ProtectOptions, n as OpenApiHooks, w as verifyWebBotAuth, x as discoverViaSignatureAgent } from "../create-BWyx3jua.js";
+import { t as ServerAdapterOptions } from "../bind-CVy3Espv.js";
+import { Elysia } from "elysia";
+//#region src/elysia/create.d.ts
+type ElysiaCtx = {
+  readonly request: Request;
+  readonly body?: unknown;
+  readonly params?: Readonly<Record<string, string | undefined>>;
+};
+type ElysiaPermDockOptions<TUser = unknown> = ServerAdapterOptions<ElysiaCtx, TUser> & {
+  /** Ends or revalidates open sockets. */
+  readonly revocations?: RevocationFeed;
+};
+/** The `ws` Elysia passes to `.ws` handlers; `data` is the upgrade context. */
+type ElysiaSocket = {
+  readonly data: ElysiaCtx;
+  close(code?: number, reason?: string): unknown;
+};
+type ElysiaContext<V extends PolicyVocabulary = PolicyVocabulary> = ElysiaCtx & {
+  permdock: PermDock<V>;
+  permdockData?: unknown;
+};
+type ElysiaProtect = (permission: Permission | null, loadData?: (ctx: ElysiaCtx) => unknown, protectOptions?: ProtectOptions) => (ctx: ElysiaCtx) => Promise<Response | undefined>;
+/** The `permdock()` plugin: its global derive types `permdock` in every later handler. */
+type ElysiaPermDockPlugin<V extends PolicyVocabulary = PolicyVocabulary> = Elysia<"", {
+  decorator: Record<never, never>;
+  store: Record<never, never>;
+  derive: {
+    readonly permdock: PermDock<V>;
+  };
+  resolve: Record<never, never>;
+}>;
+type ElysiaPermDock<V extends PolicyVocabulary = PolicyVocabulary> = {
+  readonly permdock: () => ElysiaPermDockPlugin<V>;
+  readonly protect: ElysiaProtect;
+  /**
+   * One connection per socket: the same promise for every handler
+   * of that socket; closes it with `1008` when the connection aborts.
+   */
+  readonly connection: (ws: ElysiaSocket, connectionOptions?: ConnectionOptions) => Promise<Connection>;
+  readonly permdockHandler: () => Elysia;
+  readonly openapi: OpenApiHooks;
+};
+export declare function createPermDock<TUser, TPrincipal extends Principal = Principal, V extends PolicyVocabulary = PolicyVocabulary>(policy: Policy<TUser, TPrincipal, V>, options: ElysiaPermDockOptions<TUser>): ElysiaPermDock<V>;
+//#endregion
+export { type ElysiaContext, type ElysiaCtx, type ElysiaPermDock, type ElysiaPermDockOptions, type ElysiaProtect, type ElysiaSocket, InvalidSignatureError, discoverViaSignatureAgent, verifyWebBotAuth };

package/dist/elysia/index.js

@@ -0,0 +1,59 @@
+import { i as parsedBody, n as hasCredentials } from "../http-SO7qGttf.js";
+import { i as discoverViaSignatureAgent, r as InvalidSignatureError, s as verifyWebBotAuth } from "../evaluations-tz6D9A2G.js";
+import { t as problemFromError } from "../map-error-pgUWNNtG.js";
+import { a as socketConnection, i as decorate, r as bindKernel } from "../bind-VnYn2HKq.js";
+import { i as onRevoked, t as POLICY_VIOLATION } from "../stream-DDpvynSB.js";
+import { Elysia } from "elysia";
+//#region src/elysia/create.ts
+function createPermDock(policy, options) {
+	const seed = globalThis.crypto.randomUUID();
+	const { kernel, bind, scopeOf, handlerScope } = bindKernel(policy, options, "elysia", toRequest);
+	const permdock = () => new Elysia({
+		name: "permdock",
+		seed
+	}).derive({ as: "global" }, async (ctx) => {
+		const instance = await kernel.permdock(bind(ctx), await scopeOf(ctx));
+		decorate(ctx, instance);
+		return { permdock: instance };
+	}).onError({ as: "global" }, ({ error, request }) => problemFromError(error, { credentials: hasCredentials(request) }));
+	const protect = (permission, loadData, protectOptions) => async (ctx) => {
+		const guard = await kernel.protect(permission, loadData === void 0 ? void 0 : () => loadData(ctx), protectOptions)(bind(ctx), await scopeOf(ctx));
+		if (!guard.ok) return guard.response;
+		decorate(ctx, guard.permdock, guard.data);
+	};
+	const sockets = /* @__PURE__ */ new WeakMap();
+	const connection = (ws, connectionOptions) => socketConnection(sockets, ws.data, async () => {
+		const conn = await kernel.connection(bind(ws.data), connectionOptions, await scopeOf(ws.data));
+		onRevoked(conn, (problem) => {
+			ws.close(POLICY_VIOLATION, problem.type);
+		});
+		return conn;
+	});
+	const permdockHandler = () => {
+		const { POST, GET } = kernel.permdockHandler(handlerScope);
+		return new Elysia({
+			name: "permdock-handler",
+			seed
+		}).post("/", (ctx) => POST(bind(ctx))).get("/", (ctx) => GET(bind(ctx)));
+	};
+	return {
+		permdock,
+		protect,
+		connection,
+		permdockHandler,
+		openapi: kernel.openapi
+	};
+}
+function toRequest(ctx) {
+	const method = ctx.request.method;
+	if (method === "GET" || method === "HEAD" || ctx.body === void 0) return ctx.request;
+	const headers = new Headers(ctx.request.headers);
+	const body = parsedBody(ctx.body, headers) ?? null;
+	return new Request(ctx.request.url, {
+		method,
+		headers,
+		body
+	});
+}
+//#endregion
+export { InvalidSignatureError, createPermDock, discoverViaSignatureAgent, verifyWebBotAuth };

package/dist/errors-CWfoNg9N.js

@@ -0,0 +1,47 @@
+import { stripVTControlCharacters } from "node:util";
+//#region src/cli/errors.ts
+var CliError = class extends Error {
+	kind;
+	constructor(kind, message, options) {
+		super(message, options);
+		this.name = "CliError";
+		this.kind = kind;
+	}
+};
+const TITLES = {
+	usage: "Usage or configuration error",
+	unavailable: "A database or service the command needs did not answer",
+	failed: "The check the command ran found a problem"
+};
+function describeError(error) {
+	return error instanceof Error ? error.message : String(error);
+}
+/** An unclassified error is a usage error: a module that throws while loading is the project's to fix. */
+function cliErrorKind(error) {
+	return error instanceof CliError ? error.kind : "usage";
+}
+function exitCodeOf(kind) {
+	return kind === "usage" ? 2 : 1;
+}
+function cliProblem(kind, message, command) {
+	return {
+		type: `https://permdock.com/problems/cli-${kind}`,
+		title: TITLES[kind],
+		detail: stripVTControlCharacters(message),
+		...command === void 0 ? {} : { command },
+		exitCode: exitCodeOf(kind)
+	};
+}
+/**
+* The result a command reports for a usage error it caught. A `CliError`
+* propagates instead, so `run()` prints it, as Problem Details under `--json`.
+*/
+function usageResult(error) {
+	if (error instanceof CliError) throw error;
+	return {
+		code: 2,
+		output: describeError(error)
+	};
+}
+//#endregion
+export { exitCodeOf as a, describeError as i, cliErrorKind as n, usageResult as o, cliProblem as r, CliError as t };

package/dist/errors-Cz5zn0mW.js

@@ -0,0 +1,123 @@
+import { t as compact } from "./compact-y6vfu2_f.js";
+import { t as PROBLEM_BASE } from "./validation-error-CnjZ4t92.js";
+import { a as wireDenials, n as problemDetails } from "./problem-details-_AMOYz-w.js";
+import { n as deniedDigest, t as approvalDigest } from "./digest-BI-6aa6d.js";
+//#region src/core/errors.ts
+var PermDockDeniedError = class extends Error {
+	name = "PermDockDeniedError";
+	decision;
+	permission;
+	scope;
+	resource;
+	subject;
+	/** The resource's `disclosure` when the denied check carried a row; `'hide'` answers as `404`. */
+	disclosure;
+	/** `PERMDOCK_DENIED;<permission>`; survives the Server Component boundary (`parsePermDockDigest`). */
+	digest;
+	constructor(input) {
+		super(input.message);
+		this.decision = input.decision;
+		this.permission = input.permission;
+		this.scope = input.scope;
+		this.resource = input.resource;
+		this.subject = input.subject;
+		if (input.disclosure !== void 0) this.disclosure = input.disclosure;
+		this.digest = deniedDigest(input.permission);
+	}
+	/** The same status matrix as `protect`: `401`, `404`, `429`, `503` or `403`. */
+	toProblemDetails(options) {
+		return problemDetails(compact({
+			decision: this.decision,
+			detail: this.message,
+			instance: options?.instance,
+			permission: this.permission,
+			scope: this.scope,
+			resource: this.resource,
+			disclosure: options?.disclosure ?? this.disclosure
+		}));
+	}
+};
+var PermDockApprovalRequiredError = class extends Error {
+	name = "PermDockApprovalRequiredError";
+	decision;
+	permission;
+	scope;
+	resource;
+	token;
+	reason;
+	/** `PERMDOCK_APPROVAL_REQUIRED;<permission>;<token>`; the token is already bound to this subject. */
+	digest;
+	constructor(input) {
+		super(input.message);
+		this.decision = input.decision;
+		this.permission = input.permission;
+		this.scope = input.scope;
+		this.resource = input.resource;
+		this.token = input.decision.token;
+		this.reason = input.decision.reason;
+		this.digest = approvalDigest(input.permission, input.decision.token);
+	}
+	toProblemDetails(options) {
+		return problemDetails(compact({
+			decision: this.decision,
+			detail: this.message,
+			instance: options?.instance,
+			permission: this.permission,
+			scope: this.scope,
+			resource: this.resource
+		}));
+	}
+};
+/** The `name` of the deny grant a `deny` denial carries in `detail`, if any. */
+function denyName(detail) {
+	if (detail === null || typeof detail !== "object" || !("name" in detail)) return;
+	return typeof detail.name === "string" ? detail.name : void 0;
+}
+function deniedMessage(permission, subjectId, denials, alternatives, named = true) {
+	const clauses = denials.map((denial) => {
+		const name = denial.reason === "deny" ? denyName(denial.detail) : void 0;
+		return name === void 0 ? `${denial.role ?? "none"} (${denial.reason})` : `${denial.role ?? "none"} (${denial.reason} '${name}')`;
+	}).join(", ");
+	const alt = alternatives.length === 0 ? "" : ` Alternatives: ${alternatives.join(", ")}.`;
+	return `${permission} denied${named ? ` for subject ${subjectId ?? "anonymous"}` : ""}: ${clauses}.${alt}`;
+}
+function approvalMessage(permission, reason, token) {
+	return `${permission} requires human approval (${reason}). Token: ${token}.`;
+}
+/**
+* The `reason` of a long-lived connection's aborted `signal`. `denied` carries
+* the decision that re-denied the permission the connection was opened for.
+*/
+var PermDockRevokedError = class extends Error {
+	name = "PermDockRevokedError";
+	code;
+	permission;
+	decision;
+	constructor(input) {
+		super(`PermDock: connection ended (${input.code}).`);
+		this.code = input.code;
+		if (input.permission !== void 0) this.permission = input.permission;
+		if (input.decision !== void 0) this.decision = input.decision;
+	}
+	toProblemDetails(options) {
+		if (this.code === "denied") return compact({
+			type: `${PROBLEM_BASE}/denied`,
+			title: "Permission denied",
+			status: 403,
+			detail: this.code,
+			instance: options?.instance,
+			permission: this.permission,
+			denials: this.decision?.outcome === "denied" ? wireDenials(this.decision.denials) : void 0
+		});
+		return compact({
+			type: `${PROBLEM_BASE}/unauthenticated`,
+			title: "Authorization ended",
+			status: 401,
+			detail: this.code,
+			instance: options?.instance,
+			permission: this.permission
+		});
+	}
+};
+//#endregion
+export { deniedMessage as a, approvalMessage as i, PermDockDeniedError as n, PermDockRevokedError as r, PermDockApprovalRequiredError as t };