permdock 0.0.0 → 0.2.0

package/dist/nest/index.js

@@ -0,0 +1,261 @@
+import { t as compact } from "../compact-y6vfu2_f.js";
+import { n as PermDockValidationError } from "../validation-error-CnjZ4t92.js";
+import { n as PermDockDeniedError, r as PermDockRevokedError, t as PermDockApprovalRequiredError } from "../errors-Cz5zn0mW.js";
+import { i as discoverViaSignatureAgent, r as InvalidSignatureError, s as verifyWebBotAuth } from "../evaluations-tz6D9A2G.js";
+import { t as problemFromError } from "../map-error-pgUWNNtG.js";
+import { a as socketConnection, r as bindKernel } from "../bind-VnYn2HKq.js";
+import { i as onRevoked, t as POLICY_VIOLATION } from "../stream-DDpvynSB.js";
+import { i as toRequest$1, n as isServerResponse, r as sendResponse } from "../http-BIhmLfCc.js";
+import { Catch, Controller, Get, Inject, Injectable, Module, Post, Req, Res, createParamDecorator } from "@nestjs/common";
+import { APP_FILTER, APP_GUARD, Reflector } from "@nestjs/core";
+//#region src/nest/decorate.ts
+/**
+* Applies method decorators to `cls.prototype[key]` without decorator syntax,
+* for projects limited to erasable TypeScript. Decorators apply in the order
+* given; each sees the descriptor the previous one left.
+*/
+function decorateMethod(cls, key, ...decorators) {
+	for (const decorator of decorators) {
+		const descriptor = Object.getOwnPropertyDescriptor(cls.prototype, key);
+		if (descriptor === void 0) throw new TypeError(`decorateMethod: ${key} is not a method of the class`);
+		const next = decorator(cls.prototype, key, descriptor);
+		if (next !== void 0) Object.defineProperty(cls.prototype, key, next);
+	}
+}
+//#endregion
+//#region src/nest/http.ts
+function isReadable(value) {
+	return typeof value === "object" && value !== null && typeof value.read === "function";
+}
+function isFastifyReply(value) {
+	if (typeof value !== "object" || value === null) return false;
+	const reply = value;
+	return typeof reply["code"] === "function" && typeof reply["header"] === "function" && typeof reply["send"] === "function";
+}
+/**
+* `@nestjs/platform-express` hands the guard an `IncomingMessage`;
+* `@nestjs/platform-fastify` hands it a `FastifyRequest` whose stream is `raw`.
+*/
+function toRequest(req) {
+	if (isReadable(req)) return toRequest$1(req);
+	const raw = req.raw;
+	return toRequest$1(req, isReadable(raw) ? raw : null);
+}
+async function sendNestResponse(res, response) {
+	if (isServerResponse(res)) {
+		await sendResponse(res, response);
+		return;
+	}
+	if (isFastifyReply(res)) {
+		res.code(response.status);
+		for (const [key, value] of response.headers.entries()) res.header(key, value);
+		await res.send(await response.text());
+		return;
+	}
+	throw new TypeError("permdock/nest supports @nestjs/platform-express and @nestjs/platform-fastify responses");
+}
+//#endregion
+//#region src/nest/create.ts
+const PROTECT_KEY = "permdock:protect";
+var PermDockHttpError = class extends Error {
+	name = "PermDockHttpError";
+	response;
+	constructor(response) {
+		super("permdock denied");
+		this.response = response;
+	}
+};
+function reflectMeta() {
+	const ref = Reflect;
+	if (typeof ref.getMetadata !== "function" || typeof ref.defineMetadata !== "function") throw new TypeError("reflect-metadata is required for permdock/nest");
+	return ref;
+}
+function applyParameter(cls, key, index, decorator) {
+	decorator(cls.prototype, key, index);
+}
+function hasEmit(value) {
+	return typeof value === "object" && value !== null && typeof value.emit === "function";
+}
+/** One call per loader for a request, so class and method rules naming the same loader share its row. */
+function loadsFor(req) {
+	const loaded = /* @__PURE__ */ new Map();
+	return (loader) => {
+		if (loader === void 0) return;
+		return () => {
+			if (req === void 0) return Promise.resolve(void 0);
+			let hit = loaded.get(loader);
+			if (hit === void 0) {
+				hit = Promise.resolve(loader(req));
+				loaded.set(loader, hit);
+			}
+			return hit;
+		};
+	};
+}
+function rulesOf(target) {
+	const found = reflectMeta().getMetadata(PROTECT_KEY, target);
+	if (!Array.isArray(found)) return [];
+	return found;
+}
+const Protect = (permission, loadData, protectOptions) => {
+	const rule = compact({
+		permission,
+		loadData,
+		options: protectOptions
+	});
+	return ((target, _propertyKey, descriptor) => {
+		const store = descriptor === void 0 ? target : descriptor.value;
+		if (typeof store !== "function" && (typeof store !== "object" || store === null)) throw new TypeError("Protect requires a class or method");
+		const existing = rulesOf(store);
+		reflectMeta().defineMetadata(PROTECT_KEY, [...existing, rule], store);
+	});
+};
+function createPermDock(policy, options) {
+	const { kernel, bind, rebind, scopeOf, handlerScope } = bindKernel(policy, options, "nest", toRequest);
+	const applyProtect = async (remaining, req, request, scope, load) => {
+		const [rule, ...rest] = remaining;
+		if (rule === void 0) return;
+		const guard = await kernel.protect(rule.permission, load(rule.loadData), rule.options)(request, scope);
+		if (!guard.ok) throw new PermDockHttpError(guard.response);
+		req.permdock = guard.permdock;
+		req.permdockData = guard.data;
+		await applyProtect(rest, req, request, scope, load);
+	};
+	const sockets = /* @__PURE__ */ new WeakMap();
+	const connection = (client, req, connectionOptions) => socketConnection(sockets, client, async () => {
+		const conn = await kernel.connection(bind(req), connectionOptions, await scopeOf(req));
+		onRevoked(conn, (problem) => {
+			client.emit?.("permdock:error", problem);
+			if (typeof client.disconnect === "function") client.disconnect(true);
+			else client.close?.(POLICY_VIOLATION, problem.type);
+		});
+		return conn;
+	});
+	/** Decides each rule for a gateway message against the client's connection, as `protect` does for HTTP. */
+	const checkMessage = async (rules, conn, req) => {
+		const request = req === void 0 ? void 0 : bind(req);
+		const load = loadsFor(req);
+		for (const rule of rules) {
+			if (conn.signal.aborted) throw conn.signal.reason instanceof PermDockRevokedError ? conn.signal.reason : new PermDockRevokedError({ code: "denied" });
+			const guard = await kernel.protectOn(conn.permdock, rule.permission, load(rule.loadData), rule.options, request);
+			if (!guard.ok) throw new PermDockHttpError(guard.response);
+		}
+	};
+	class PermDockGuard {
+		reflector;
+		constructor(reflector) {
+			this.reflector = reflector;
+		}
+		async canActivate(context) {
+			const rules = this.rulesFor(context);
+			if (context.getType() === "ws" && rules.length > 0) {
+				const opened = sockets.get(context.switchToWs().getClient());
+				if (opened !== void 0) {
+					await checkMessage(rules, await opened, options.request?.(context));
+					return true;
+				}
+			}
+			const req = context.getType() === "http" ? context.switchToHttp().getRequest() : rules.length === 0 ? void 0 : options.request?.(context);
+			if (req === void 0) return rules.length === 0;
+			const request = bind(req);
+			const scope = await scopeOf(req);
+			req.permdock = await kernel.permdock(request, scope);
+			await applyProtect(rules, req, request, scope, loadsFor(req));
+			return true;
+		}
+		rulesFor(context) {
+			const fromClass = this.reflector.get(PROTECT_KEY, context.getClass());
+			const fromHandler = this.reflector.get(PROTECT_KEY, context.getHandler());
+			return [...Array.isArray(fromClass) ? fromClass : rulesOf(context.getClass()), ...Array.isArray(fromHandler) ? fromHandler : rulesOf(context.getHandler())];
+		}
+	}
+	Inject(Reflector)(PermDockGuard, void 0, 0);
+	Injectable()(PermDockGuard);
+	class PermDockExceptionFilter {
+		send = sendNestResponse;
+		async catch(exception, host) {
+			const problem = exception instanceof PermDockHttpError ? exception.response : problemFromError(exception, { credentials: host.getType() === "http" && host.switchToHttp().getRequest().headers.authorization !== void 0 });
+			if (problem === void 0) throw new TypeError("unhandled permdock exception");
+			if (host.getType() === "http") {
+				await this.send(host.switchToHttp().getResponse(), problem);
+				return;
+			}
+			const client = host.getType() === "ws" ? host.switchToWs().getClient() : null;
+			if (!hasEmit(client)) throw exception;
+			const body = await problem.json();
+			client.emit("exception", {
+				status: "error",
+				message: typeof body.title === "string" ? body.title : "Forbidden",
+				problem: body
+			});
+		}
+	}
+	Catch(PermDockHttpError, InvalidSignatureError, PermDockDeniedError, PermDockApprovalRequiredError, PermDockRevokedError, PermDockValidationError)(PermDockExceptionFilter);
+	Injectable()(PermDockExceptionFilter);
+	class PermDockRoot {
+		static forRoot(moduleOptions = {}) {
+			return {
+				module: PermDockRoot,
+				providers: moduleOptions.guard === "global" ? [{
+					provide: APP_GUARD,
+					useExisting: PermDockGuard
+				}] : []
+			};
+		}
+	}
+	Module({
+		providers: [
+			{
+				provide: PermDockGuard,
+				useFactory: (reflector) => new PermDockGuard(reflector),
+				inject: [Reflector]
+			},
+			{
+				provide: PermDockExceptionFilter,
+				useFactory: () => new PermDockExceptionFilter()
+			},
+			{
+				provide: APP_FILTER,
+				useExisting: PermDockExceptionFilter
+			}
+		],
+		exports: [PermDockGuard, PermDockExceptionFilter]
+	})(PermDockRoot);
+	const injectPermDock = createParamDecorator((_data, ctx) => {
+		if (ctx.getType() !== "http") return;
+		return ctx.switchToHttp().getRequest().permdock;
+	});
+	const InjectPermDock = () => injectPermDock();
+	const permdockHandler = (handlerOptions = {}) => {
+		const { POST, GET } = kernel.permdockHandler(handlerScope);
+		class EvaluationsController {
+			send = sendNestResponse;
+			async post(req, res) {
+				await this.send(res, await POST(rebind(req)));
+			}
+			async get(req, res) {
+				await this.send(res, await GET(bind(req)));
+			}
+		}
+		Controller(handlerOptions.path ?? "api/permdock")(EvaluationsController);
+		decorateMethod(EvaluationsController, "post", Post());
+		decorateMethod(EvaluationsController, "get", Get());
+		applyParameter(EvaluationsController, "post", 0, Req());
+		applyParameter(EvaluationsController, "post", 1, Res({ passthrough: false }));
+		applyParameter(EvaluationsController, "get", 0, Req());
+		applyParameter(EvaluationsController, "get", 1, Res({ passthrough: false }));
+		return EvaluationsController;
+	};
+	return {
+		PermDockModule: PermDockRoot,
+		PermDockGuard,
+		Protect,
+		InjectPermDock,
+		PermDockExceptionFilter,
+		permdockHandler,
+		connection,
+		openapi: kernel.openapi
+	};
+}
+//#endregion
+export { InvalidSignatureError, createPermDock, decorateMethod, discoverViaSignatureAgent, sendResponse, toRequest, verifyWebBotAuth };

package/dist/next/client.d.ts

@@ -0,0 +1,23 @@
+import { t as PermissionBoundaryState } from "../boundary-BmHxVH1J.js";
+import { ComponentType, ReactNode } from "react";
+//#region src/next/client.d.ts
+/** A fallback node, or a function of what was refused. */
+export type PermissionBoundaryFallback = ReactNode | ((state: PermissionBoundaryState) => ReactNode);
+export type PermissionBoundaryProps = {
+  /** Rendered in place of the children when one throws `PermDockDeniedError`. */
+  readonly denied?: PermissionBoundaryFallback;
+  /** Rendered when a child throws `PermDockApprovalRequiredError`; defaults to `denied`. */
+  readonly approval?: PermissionBoundaryFallback;
+};
+/**
+ * A component-level boundary for PermDock errors thrown below it, in a Server
+ * Component or a Client Component. Other errors, `forbidden()`, `notFound()`
+ * and `redirect()` pass through.
+ */
+export declare const PermissionBoundary: ComponentType<PermissionBoundaryProps & {
+  readonly children?: ReactNode;
+}>;
+/** Inside a `PermissionBoundary` fallback: what was refused, and `retry()`. */
+export declare function usePermissionBoundary(): PermissionBoundaryState | null;
+//#endregion
+export type { PermissionBoundaryState };

package/dist/next/client.js

@@ -0,0 +1,33 @@
+"use client";
+import { n as boundaryFallback, t as boundaryDigest } from "../boundary-BM8a_P6E.js";
+import { createContext, useContext } from "react";
+import { jsx } from "react/jsx-runtime";
+import * as nextError from "next/error.js";
+//#region src/next/client.tsx
+const catchError = nextError.catchError ?? nextError.default.catchError;
+const BoundaryContext = createContext(null);
+function PermissionFallback(props, info) {
+	const parsed = boundaryDigest(info.error);
+	if (parsed === null) throw info.error;
+	const fallback = boundaryFallback(parsed, props);
+	const state = {
+		...parsed,
+		retry: info.retry
+	};
+	return /* @__PURE__ */ jsx(BoundaryContext.Provider, {
+		value: state,
+		children: typeof fallback === "function" ? fallback(state) : fallback ?? null
+	});
+}
+/**
+* A component-level boundary for PermDock errors thrown below it, in a Server
+* Component or a Client Component. Other errors, `forbidden()`, `notFound()`
+* and `redirect()` pass through.
+*/
+const PermissionBoundary = catchError(PermissionFallback);
+/** Inside a `PermissionBoundary` fallback: what was refused, and `retry()`. */
+function usePermissionBoundary() {
+	return useContext(BoundaryContext);
+}
+//#endregion
+export { PermissionBoundary, usePermissionBoundary };

package/dist/next/index.d.ts

@@ -0,0 +1,93 @@
+import { C as Policy, D as PolicyVocabulary, Nr as Principal, Tt as Snapshot, Yn as Decision, ln as PermDock } from "../policy-CFZAr_Al.js";
+import { f as Permission } from "../permissions-DttnqqxC.js";
+import { f as ApprovalStore } from "../types-vKyAMtcX.js";
+import { t as InstanceOptions } from "../instance-options-BK_rNOSC.js";
+import { o as OtelWrap } from "../types-vNSDF7Dq.js";
+import { a as snapshotHeaders, i as cacheLifeFor, n as SnapshotHeaders, o as snapshotTag, r as SnapshotHeadersOptions, t as CacheLifeForOptions } from "../snapshot-cache-DwQH8ufx.js";
+import { ReactElement, ReactNode } from "react";
+//#region src/next/types.d.ts
+type NextSubjectInput = unknown;
+type NextPermDockOptions<TUser = NextSubjectInput> = InstanceOptions & {
+  readonly subject: () => TUser | Promise<TUser>;
+  readonly tenant?: string | (() => string | undefined | Promise<string | undefined>);
+  readonly onDenied?: (decision: Decision) => never | void;
+  readonly store?: ApprovalStore;
+  /** `(permdock) => withOtel(permdock, options)` from `permdock/otel`. */
+  readonly otel?: OtelWrap;
+  /**
+   * Where `PermDockProvider` sends checks the snapshot cannot answer; default `/api/permdock`.
+   * `false` is snapshot-only: no `permdockHandler` route, and those checks are denied with
+   * reason `server-only`.
+   */
+  readonly endpoint?: string | false;
+};
+type GetPermDockQuery = {
+  readonly tenant?: string;
+};
+type GetSnapshotQuery = GetPermDockQuery & {
+  readonly include?: readonly (Permission | {
+    readonly [key: string]: unknown;
+  })[];
+  readonly tenants?: "all";
+  /** Tags added next to `snapshotTag(sub)`, such as the app's own organisation tag. */
+  readonly tags?: readonly string[];
+};
+type RequireAccessInput = {
+  readonly permission: Permission;
+  /** The row for an instance permission; omit it for a collection permission. */
+  readonly data?: unknown;
+  /** The active tenant, as for `getPermDock({ tenant })`; defaults to the factory's `tenant`. */
+  readonly tenant?: string;
+};
+type ServerPermissionState = {
+  readonly allowed: boolean;
+  readonly status: "ready";
+  readonly decision: Decision;
+};
+type ServerPermDockProviderProps = {
+  readonly children: ReactNode;
+  readonly tenant?: string;
+  readonly include?: readonly (Permission | {
+    readonly [key: string]: unknown;
+  })[];
+  readonly tenants?: "all";
+  /** Overrides the factory's `endpoint`; `false` is snapshot-only. */
+  readonly endpoint?: string | false;
+  /** Suspends permission readers until the snapshot streams in, instead of answering `pending`. */
+  readonly suspend?: boolean;
+};
+type PermDockHandler = {
+  readonly POST: (request: Request) => Promise<Response>;
+  readonly GET: (request: Request) => Promise<Response>;
+};
+type NextPermDock<V extends PolicyVocabulary = PolicyVocabulary> = {
+  readonly getPermDock: (query?: GetPermDockQuery) => Promise<PermDock<V>>;
+  /**
+   * `{ allowed, status: 'ready', decision }`. Any failure to build the
+   * instance denies; Next.js interrupts (`redirect()`, `notFound()`,
+   * request-time bailouts) from `subject` or `tenant` pass through.
+   */
+  readonly getPermission: (permission: Permission, data?: unknown, query?: GetPermDockQuery) => Promise<ServerPermissionState>;
+  /**
+   * The session's snapshot for a `'use cache: private'` function the app owns:
+   * calls `cacheLife(cacheLifeFor(snapshot))` and `cacheTag(snapshotTag(sub), ...tags)`
+   * in that scope, and throws outside one.
+   */
+  readonly getSnapshot: (query?: GetSnapshotQuery) => Promise<Snapshot>;
+  /**
+   * Resolves to the granted `Decision`. A denial calls `unauthorized()` for an
+   * anonymous subject and `forbidden()` otherwise (`experimental.authInterrupts`);
+   * approval-required and boundary validation throw as from `assert`.
+   */
+  readonly requireAccess: (input: RequireAccessInput) => Promise<Extract<Decision, {
+    readonly outcome: "granted";
+  }>>;
+  /** Never awaits: passes an unawaited snapshot to the client provider, whose hooks suspend. */
+  readonly PermDockProvider: (props: ServerPermDockProviderProps) => ReactElement;
+  readonly permdockHandler: () => PermDockHandler;
+};
+//#endregion
+//#region src/next/create.d.ts
+export declare function createPermDock<TUser = NextSubjectInput, TPrincipal extends Principal = Principal, V extends PolicyVocabulary = PolicyVocabulary>(policy: Policy<TUser, TPrincipal, V>, options: NextPermDockOptions<TUser>): NextPermDock<V>;
+//#endregion
+export { type CacheLifeForOptions, type GetPermDockQuery, type GetSnapshotQuery, type NextPermDock, type NextPermDockOptions, type PermDockHandler, type RequireAccessInput, type ServerPermDockProviderProps, type ServerPermissionState, type SnapshotHeaders, type SnapshotHeadersOptions, cacheLifeFor, snapshotHeaders, snapshotTag };

package/dist/next/index.js

@@ -0,0 +1,180 @@
+import { t as compact } from "../compact-y6vfu2_f.js";
+import { t as createPermDock$1 } from "../permdock-CzqXjCpU.js";
+import { n as snapshotHeaders, r as snapshotTag, t as cacheLifeFor } from "../snapshot-cache-D6jLelln.js";
+import { c as NO_GRANT, n as createEvaluationsHandler } from "../evaluations-tz6D9A2G.js";
+import { t as instanceOptions } from "../instance-options-Dhhcnm3y.js";
+import { cache } from "react";
+import { jsx } from "react/jsx-runtime";
+import { forbidden, unauthorized, unstable_rethrow } from "#next/navigation";
+import { cacheLife, cacheTag, io } from "next/cache.js";
+import { after } from "next/server.js";
+import { PermDockProvider } from "../react/provider-client.js";
+//#region src/next/provider.tsx
+function renderClientProvider(options) {
+	return /* @__PURE__ */ jsx(PermDockProvider, {
+		...compact({
+			snapshotPromise: options.snapshotPromise,
+			endpoint: options.endpoint,
+			tenant: options.tenant,
+			suspend: options.suspend
+		}),
+		children: options.children
+	});
+}
+//#endregion
+//#region src/next/create.ts
+function assertServerOnly() {
+	if (globalThis.document !== void 0) throw new TypeError("permdock/next is server-only. Import hooks and Protected from permdock/react.");
+}
+async function readTenant(tenant) {
+	if (tenant === void 0 || typeof tenant === "string") return tenant;
+	try {
+		return await tenant();
+	} catch (error) {
+		unstable_rethrow(error);
+		return;
+	}
+}
+/** False outside a request or prerender scope, where `after()` throws. */
+function defer(task) {
+	try {
+		after(task);
+		return true;
+	} catch {
+		return false;
+	}
+}
+function ignore() {}
+/**
+* Keeps the function alive until the sink has written and flushed: every
+* pending write and one `flush()` per render run in `after()`, so serverless
+* runtimes do not freeze with events still buffered.
+*/
+function afterResponse(sink) {
+	const flush = sink.flush?.bind(sink);
+	const scheduleFlush = cache(() => flush === void 0 ? false : defer(flush));
+	return {
+		write(events) {
+			const written = sink.write(events);
+			if (written !== void 0) defer(Promise.resolve(written).then(ignore, ignore));
+			scheduleFlush();
+			return written;
+		},
+		...flush === void 0 ? {} : { flush }
+	};
+}
+function wrapInstance(permdock, onDenied) {
+	if (onDenied === void 0) return permdock;
+	const wrap = (next) => wrapInstance(next, onDenied);
+	const assert = ((permission, data, options) => permdock.assert(permission, data, compact({
+		...options,
+		onDenied: options?.onDenied ?? onDenied
+	})));
+	return Object.freeze({
+		...permdock,
+		assert,
+		tenant: (id) => wrap(permdock.tenant(id)),
+		team: (id) => wrap(permdock.team(id)),
+		derive: (options) => {
+			const derived = permdock.derive(options);
+			return derived instanceof Promise ? derived.then(wrap) : wrap(derived);
+		}
+	});
+}
+function createPermDock(policy, options) {
+	assertServerOnly();
+	const sink = options.sink === void 0 ? void 0 : afterResponse(options.sink);
+	const resolveSubject = cache(async () => {
+		try {
+			return await options.subject();
+		} catch (error) {
+			unstable_rethrow(error);
+			return null;
+		}
+	});
+	const resolveFallbackTenant = cache(() => readTenant(options.tenant));
+	const instantiate = cache(async (tenantKey) => {
+		const tenant = tenantKey === "" ? void 0 : tenantKey;
+		const user = await resolveSubject();
+		await io();
+		const built = await createPermDock$1(policy, user, compact({
+			tenant,
+			...instanceOptions(options),
+			sink
+		}));
+		return wrapInstance(options.otel === void 0 ? built : options.otel(built), options.onDenied);
+	});
+	const getPermDock = async (query) => {
+		const tenant = query?.tenant ?? await resolveFallbackTenant();
+		return instantiate(tenant ?? "");
+	};
+	const getPermission = async (permission, data, query) => {
+		try {
+			const decision = (await getPermDock(query)).decide(permission, data);
+			return {
+				allowed: decision.outcome === "granted",
+				status: "ready",
+				decision
+			};
+		} catch (error) {
+			unstable_rethrow(error);
+			return {
+				allowed: false,
+				status: "ready",
+				decision: NO_GRANT
+			};
+		}
+	};
+	const getSnapshot = async (query = {}) => {
+		const permdock = await getPermDock(compact({ tenant: query.tenant }));
+		const snapshot = permdock.snapshot(compact({
+			include: query.include,
+			tenants: query.tenants
+		}));
+		try {
+			cacheLife(cacheLifeFor(snapshot));
+			cacheTag(snapshotTag(permdock.subject.principal?.id), ...query.tags ?? []);
+		} catch (error) {
+			unstable_rethrow(error);
+			throw new Error("PermDock: getSnapshot() sets cacheLife() and cacheTag(), so call it inside a 'use cache: private' function with cacheComponents enabled.", { cause: error });
+		}
+		return snapshot;
+	};
+	const requireAccess = async (input) => {
+		const permdock = await getPermDock(input.tenant === void 0 ? void 0 : { tenant: input.tenant });
+		const assert = permdock.assert;
+		return assert(input.permission, input.data, { onDenied: (decision) => {
+			if (decision.outcome !== "denied" || decision.denials.some((denial) => denial.reason === "validation")) return;
+			if (permdock.subject.principal === null) unauthorized();
+			forbidden();
+		} });
+	};
+	const PermDockProvider = (props) => {
+		const snapshotPromise = getPermDock(props.tenant === void 0 ? void 0 : { tenant: props.tenant }).then((permdock) => permdock.snapshot(compact({
+			include: props.include,
+			tenants: props.tenants
+		})));
+		return renderClientProvider(compact({
+			snapshotPromise,
+			endpoint: props.endpoint ?? options.endpoint ?? "/api/permdock",
+			tenant: props.tenant,
+			suspend: props.suspend,
+			children: props.children
+		}));
+	};
+	const permdockHandler = () => createEvaluationsHandler(compact({
+		policy,
+		getPermDock,
+		store: options.store
+	}));
+	return {
+		getPermDock,
+		getPermission,
+		getSnapshot,
+		requireAccess,
+		PermDockProvider,
+		permdockHandler
+	};
+}
+//#endregion
+export { cacheLifeFor, createPermDock, snapshotHeaders, snapshotTag };

package/dist/next/plugin.d.ts

@@ -0,0 +1,14 @@
+import { a as PermDockPluginOptions } from "../types-BPxgszlT.js";
+//#region src/cli/plugin.d.ts
+/** Any object: Next's `NextConfig` is an interface, so no index signature. */
+type NextConfigLike = object;
+/** What `next.config` may export: an object, or a function of the phase. */
+type NextConfigInput<T extends NextConfigLike> = T | ((phase: string, context: NextConfigContext) => T | Promise<T>);
+type NextConfigContext = {
+  readonly defaultConfig?: unknown;
+};
+/** Next's config function: Next calls it with the phase constant. */
+type NextConfigFunction<T extends NextConfigLike> = (phase: string, context: NextConfigContext) => Promise<T>;
+export declare function createPermDockPlugin(options?: PermDockPluginOptions): <T extends NextConfigLike>(nextConfig: NextConfigInput<T>) => NextConfigFunction<T>;
+//#endregion
+export type { NextConfigContext, NextConfigFunction, NextConfigInput, NextConfigLike, PermDockPluginOptions };

package/dist/next/plugin.js

@@ -0,0 +1,33 @@
+import { i as describeError } from "../errors-CWfoNg9N.js";
+import { n as createCollectScheduler, r as report, t as collectOnce } from "../watch-UihESpsJ.js";
+//#region src/cli/plugin.ts
+const PHASE_BUILD = "phase-production-build";
+const PHASE_DEV = "phase-development-server";
+function createPermDockPlugin(options) {
+	const schedulers = /* @__PURE__ */ new Map();
+	return function permdockPlugin(nextConfig) {
+		return async (phase, context) => {
+			const resolved = typeof nextConfig === "function" ? await nextConfig(phase, context) : nextConfig;
+			const cwd = process.cwd();
+			if (phase === PHASE_BUILD) {
+				const check = process.env["PERMDOCK_COLLECT"] !== "write";
+				report(await runPluginCollect(cwd, options, check));
+			} else if (phase === PHASE_DEV) {
+				const scheduler = schedulers.get(cwd) ?? createCollectScheduler(cwd, options);
+				schedulers.set(cwd, scheduler);
+				try {
+					report(await scheduler.run(false));
+				} catch (error) {
+					report(describeError(error));
+				}
+				scheduler.watch();
+			}
+			return resolved;
+		};
+	};
+}
+async function runPluginCollect(cwd, options, check) {
+	return (await collectOnce(cwd, options, check, false)).message;
+}
+//#endregion
+export { createPermDockPlugin };

package/dist/node/index.d.ts

@@ -0,0 +1,24 @@
+import { C as Policy, D as PolicyVocabulary, Nr as Principal, ln as PermDock } from "../policy-CFZAr_Al.js";
+import { f as Permission } from "../permissions-DttnqqxC.js";
+import { a as ScopeGuard, h as InvalidSignatureError, i as ProtectOptions, n as OpenApiHooks, t as Guard, w as verifyWebBotAuth, x as discoverViaSignatureAgent } from "../create-BWyx3jua.js";
+import { t as ServerAdapterOptions } from "../bind-CVy3Espv.js";
+import { a as toRequest, i as sendResponse, n as fromResponse, r as isServerResponse, t as NodeRequest } from "../http-DPuDaChb.js";
+import { IncomingMessage, ServerResponse } from "node:http";
+//#region src/node/create.d.ts
+type NodePermDockOptions<TUser = unknown> = ServerAdapterOptions<NodeRequest, TUser>;
+type NodeProtect = {
+  (permission: Permission, loadData?: (req: NodeRequest) => unknown, protectOptions?: ProtectOptions): (req: IncomingMessage) => Promise<Guard>;
+  (permission: null, loadData?: (req: NodeRequest) => unknown, protectOptions?: ProtectOptions): (req: IncomingMessage) => Promise<ScopeGuard>;
+};
+type NodePermDock<V extends PolicyVocabulary = PolicyVocabulary> = {
+  readonly permdock: (req: IncomingMessage) => Promise<PermDock<V>>;
+  readonly protect: NodeProtect;
+  readonly send: typeof sendResponse;
+  readonly permdockHandler: () => (req: IncomingMessage, res: ServerResponse) => Promise<void>;
+  readonly toRequest: typeof toRequest;
+  readonly fromResponse: typeof fromResponse;
+  readonly openapi: OpenApiHooks;
+};
+export declare function createPermDock<TUser, TPrincipal extends Principal = Principal, V extends PolicyVocabulary = PolicyVocabulary>(policy: Policy<TUser, TPrincipal, V>, options: NodePermDockOptions<TUser>): NodePermDock<V>;
+//#endregion
+export { InvalidSignatureError, type NodePermDock, type NodePermDockOptions, type NodeRequest, discoverViaSignatureAgent, fromResponse, isServerResponse, sendResponse, toRequest, verifyWebBotAuth };