permdock 0.0.0 → 0.2.0

package/dist/problem-B43ztKIm.js

@@ -0,0 +1,191 @@
+import { t as compact } from "./compact-y6vfu2_f.js";
+import { n as PermDockValidationError, t as PROBLEM_BASE } from "./validation-error-CnjZ4t92.js";
+import { i as stepUpOf, n as problemDetails, t as notFoundDetails } from "./problem-details-_AMOYz-w.js";
+import { a as deniedMessage, i as approvalMessage } from "./errors-Cz5zn0mW.js";
+//#region src/server/problem.ts
+function quoted(value) {
+	return `"${value.replaceAll(/["\\]/gu, "")}"`;
+}
+const UTF8 = /* @__PURE__ */ new TextEncoder();
+/**
+* An RFC 9651 sf-string: `"` and `\` escaped, and anything outside printable
+* ASCII percent-encoded, which the grammar does not allow.
+*/
+function sfString(value) {
+	return `"${value.replaceAll(/[\\"]/gu, (char) => `\\${char}`).replaceAll(/[^\u0020-\u007E]/gu, (char) => Array.from(UTF8.encode(char), (byte) => `%${byte.toString(16).toUpperCase().padStart(2, "0")}`).join(""))}"`;
+}
+/** An RFC 6750 `WWW-Authenticate: Bearer` value. */
+function bearerChallenge(challenge) {
+	const parts = [`error=${quoted(challenge.error)}`];
+	if (challenge.description !== void 0) parts.push(`error_description=${quoted(challenge.description)}`);
+	if (challenge.scopes !== void 0 && challenge.scopes.length > 0) parts.push(`scope=${quoted([...new Set(challenge.scopes)].join(" "))}`);
+	if (challenge.acrValues !== void 0 && challenge.acrValues.length > 0) parts.push(`acr_values=${quoted(challenge.acrValues.join(" "))}`);
+	if (challenge.maxAge !== void 0) parts.push(`max_age=${quoted(String(challenge.maxAge))}`);
+	if (challenge.resourceMetadata !== void 0) parts.push(`resource_metadata=${quoted(challenge.resourceMetadata)}`);
+	return `Bearer ${parts.join(", ")}`;
+}
+/** The RFC 9728 well-known metadata URL for a resource identifier. */
+function protectedResourceMetadataUrl(resource) {
+	const path = resource.pathname === "/" ? "" : resource.pathname;
+	return `${resource.origin}/.well-known/oauth-protected-resource${path}`;
+}
+/** The `error_description` of every `invalid_token` challenge (RFC 6750 section 3.1). */
+const INVALID_TOKEN = "The access token is invalid";
+function wwwAuthenticate(decision, permission, credentials = true) {
+	return challengeFor(decision, permission?.scope, credentials);
+}
+function challengeFor(decision, scope, credentials = true) {
+	if (decision.outcome !== "denied") return;
+	const reasons = new Set(decision.denials.map((denial) => denial.reason));
+	if (reasons.has("insufficient-user-authentication")) return bearerChallenge({
+		error: "insufficient_user_authentication",
+		...stepUpOf(decision)
+	});
+	if (reasons.has("anonymous")) return credentials ? bearerChallenge({
+		error: "invalid_token",
+		description: INVALID_TOKEN
+	}) : "Bearer";
+	if (reasons.has("not-delegated") || reasons.has("no-delegation")) return bearerChallenge(compact({
+		error: "insufficient_scope",
+		scopes: scope === void 0 ? void 0 : [scope]
+	}));
+}
+function problemResponse(details, permission, decision, extra, credentials) {
+	const headers = new Headers({
+		...extra,
+		"content-type": "application/problem+json"
+	});
+	if (decision !== void 0) {
+		const challenge = wwwAuthenticate(decision, permission, credentials);
+		if (challenge !== void 0) headers.set("WWW-Authenticate", challenge);
+	}
+	return new Response(JSON.stringify(details), {
+		status: details.status,
+		headers
+	});
+}
+/** RFC 9457 413 for a batch over `max` evaluations. */
+function batchTooLarge(max) {
+	return problemResponse({
+		type: `${PROBLEM_BASE}/payload-too-large`,
+		title: "Payload too large",
+		status: 413,
+		detail: `evaluations batch exceeds ${String(max)}`
+	});
+}
+function validationProblem(detail) {
+	return problemResponse(compact({
+		type: `${PROBLEM_BASE}/validation`,
+		title: "Invalid request",
+		status: 400,
+		detail
+	}));
+}
+function resourceRef(permission) {
+	return { type: permission.resource };
+}
+function isLimitDetail(value) {
+	if (value === null || typeof value !== "object") return false;
+	const { count, window, resetsAt } = value;
+	return Number.isFinite(count) && Number.isFinite(window) && Number.isFinite(resetsAt);
+}
+/**
+* `Retry-After` plus the `RateLimit` / `RateLimit-Policy` fields of
+* draft-ietf-httpapi-ratelimit-headers-11, one policy per exhausted grant.
+*/
+function rateLimitHeaders(decision, now = Date.now() / 1e3) {
+	if (decision.outcome !== "denied") return {};
+	const policies = /* @__PURE__ */ new Map();
+	for (const denial of decision.denials) {
+		if (denial.reason !== "limit" || !isLimitDetail(denial.detail)) continue;
+		const name = denial.role ?? "default";
+		if (!policies.has(name)) policies.set(name, denial.detail);
+	}
+	if (policies.size === 0) return {};
+	const entries = [...policies].map(([name, detail]) => ({
+		name: sfString(name),
+		detail,
+		wait: Math.max(1, Math.ceil(detail.resetsAt - now))
+	}));
+	return {
+		"Retry-After": String(Math.min(...entries.map((entry) => entry.wait))),
+		RateLimit: entries.map((entry) => `${entry.name};r=0;t=${entry.wait}`).join(", "),
+		"RateLimit-Policy": entries.map((entry) => `${entry.name};q=${entry.detail.count};w=${entry.detail.window}`).join(", ")
+	};
+}
+/**
+* The response for a decision's Problem Details: `WWW-Authenticate` for a
+* `401` or a missing delegation, and the rate-limit fields for a `429`. A
+* hidden row's `404` carries neither, so it reads like a missing one.
+*/
+function decisionResponse(details, decision, options = {}) {
+	const headers = new Headers({
+		...details.status === 429 ? rateLimitHeaders(decision) : {},
+		"content-type": "application/problem+json"
+	});
+	const challenge = details.status === 404 ? void 0 : challengeFor(decision, options.scope, options.credentials);
+	if (challenge !== void 0) headers.set("WWW-Authenticate", challenge);
+	return new Response(JSON.stringify(details), {
+		status: details.status,
+		headers
+	});
+}
+function problemFromDecision(decision, permission, subject, options = {}) {
+	if (decision.outcome === "granted") return new Response(null, { status: 204 });
+	const validation = decision.outcome === "denied" ? decision.denials[0]?.detail : void 0;
+	if (options.disclosure !== "hide" && validation instanceof PermDockValidationError) return problemResponse(validation.toProblemDetails(), options.scope === void 0 ? permission : {
+		...permission,
+		scope: options.scope
+	}, decision);
+	const details = problemDetails(compact({
+		decision,
+		detail: decision.outcome === "approval-required" ? approvalMessage(permission.key, decision.reason, decision.token) : deniedMessage(permission.key, subject?.principal?.id, decision.denials, decision.alternatives.map((leaf) => leaf.key), subject !== void 0),
+		instance: options.instance,
+		permission: permission.key,
+		scope: permission.scope,
+		resource: resourceRef(permission),
+		disclosure: options.disclosure
+	}));
+	const approval = decision.outcome !== "approval-required" || options.approval === void 0 || options.approval.at === void 0 && options.approval.hint === void 0 ? void 0 : compact({
+		at: options.approval.at,
+		hint: options.approval.hint
+	});
+	return decisionResponse(approval === void 0 ? details : {
+		...details,
+		approval
+	}, decision, compact({
+		scope: options.scope ?? permission.scope,
+		credentials: options.credentials
+	}));
+}
+/** The `404` a missing row and a hidden one share, so the two read the same. */
+function notFoundProblem(instance) {
+	return problemResponse(notFoundDetails(instance));
+}
+const ANONYMOUS = {
+	outcome: "denied",
+	denials: [{
+		role: null,
+		reason: "anonymous"
+	}],
+	alternatives: []
+};
+/** The `401` for a request with no subject, with the RFC 6750 challenge its credentials call for. */
+function unauthenticatedProblem(credentials) {
+	return decisionResponse(problemDetails({
+		decision: ANONYMOUS,
+		detail: "anonymous"
+	}), ANONYMOUS, { credentials });
+}
+function methodNotAllowed(allow) {
+	const response = problemResponse({
+		type: `${PROBLEM_BASE}/method-not-allowed`,
+		title: "Method not allowed",
+		status: 405,
+		detail: `use ${allow}`
+	});
+	response.headers.set("Allow", allow);
+	return response;
+}
+//#endregion
+export { notFoundProblem as a, protectedResourceMetadataUrl as c, wwwAuthenticate as d, methodNotAllowed as i, unauthenticatedProblem as l, bearerChallenge as n, problemFromDecision as o, decisionResponse as r, problemResponse as s, batchTooLarge as t, validationProblem as u };

package/dist/problem-details-CkL50EEf.d.ts

@@ -0,0 +1,7 @@
+import { Yn as Decision } from "./policy-CFZAr_Al.js";
+//#region src/core/problem-details.d.ts
+type Disclosure = "hide" | "reveal";
+/** The plans a `not-entitled` denial asks for; empty unless every denial is `not-entitled`. */
+declare function requiredPlans(decision: Decision): readonly string[];
+//#endregion
+export { requiredPlans as n, Disclosure as t };

package/dist/problem-details-_AMOYz-w.js

@@ -0,0 +1,144 @@
+import { t as compact } from "./compact-y6vfu2_f.js";
+import { t as PROBLEM_BASE } from "./validation-error-CnjZ4t92.js";
+//#region src/core/wire-denial.ts
+const IN_PROCESS = /* @__PURE__ */ new Set(["closure-error", "validation"]);
+function jsonDetail(value) {
+	if (value === void 0 || value === null || value instanceof Error) return;
+	if (typeof value === "string" || typeof value === "boolean") return value;
+	if (typeof value === "number") return Number.isFinite(value) ? value : void 0;
+	if (typeof value !== "object") return;
+	try {
+		return JSON.parse(JSON.stringify(value));
+	} catch {
+		return;
+	}
+}
+function wireDenial(denial) {
+	return compact({
+		role: denial.role,
+		reason: denial.reason,
+		to: denial.to,
+		detail: IN_PROCESS.has(denial.reason) ? void 0 : jsonDetail(denial.detail)
+	});
+}
+function wireDenials(denials) {
+	return denials.map(wireDenial);
+}
+//#endregion
+//#region src/core/problem-details.ts
+/** Reasons that only arise once a matching grant was found, so they reveal nothing hidden. */
+const HOLDS_GRANT = /* @__PURE__ */ new Set([
+	"insufficient-user-authentication",
+	"limit",
+	"limit-unavailable"
+]);
+function granteesOf(to) {
+	if (to === void 0) return [];
+	return Array.isArray(to) ? to : [to];
+}
+/** The plans a `not-entitled` denial asks for; empty unless every denial is `not-entitled`. */
+function requiredPlans(decision) {
+	if (decision.outcome !== "denied" || decision.denials.length === 0 || decision.denials.some((denial) => denial.reason !== "not-entitled")) return [];
+	const plans = /* @__PURE__ */ new Set();
+	for (const denial of decision.denials) for (const item of granteesOf(denial.to)) if (item.kind === "plan") plans.add(item.plan);
+	return [...plans];
+}
+/** The `acr` values and the tightest `maxAge` the failing assurance grants ask for. */
+function stepUpOf(decision) {
+	if (decision.outcome !== "denied") return {};
+	const acr = /* @__PURE__ */ new Set();
+	let maxAge;
+	for (const denial of decision.denials) {
+		if (denial.reason !== "insufficient-user-authentication") continue;
+		for (const grantee of granteesOf(denial.to)) {
+			if (grantee.kind !== "assurance") continue;
+			for (const value of grantee.acr ?? []) acr.add(value);
+			if (grantee.maxAge !== void 0) maxAge = maxAge === void 0 ? grantee.maxAge : Math.min(maxAge, grantee.maxAge);
+		}
+	}
+	return compact({
+		acrValues: acr.size === 0 ? void 0 : [...acr],
+		maxAge
+	});
+}
+/** The `404` a missing row and a hidden one share, so the two read the same. */
+function notFoundDetails(instance) {
+	return compact({
+		type: `${PROBLEM_BASE}/not-found`,
+		title: "Not found",
+		status: 404,
+		detail: "No such resource",
+		instance
+	});
+}
+/**
+* The RFC 9457 body for a decision that is not `granted`. One status matrix
+* serves `protect`, a thrown `assert` and `problemFromError`: `401` for an
+* anonymous subject or a step-up, `404` for a hidden row, `429` for an
+* exhausted limit, `503` for an unavailable limit store, `403` otherwise.
+*/
+function problemDetails(input) {
+	const { decision } = input;
+	const base = compact({
+		instance: input.instance,
+		permission: input.permission,
+		scope: input.scope,
+		resource: input.resource
+	});
+	if (decision.outcome === "approval-required") return compact({
+		type: `${PROBLEM_BASE}/approval-required`,
+		title: "Approval required",
+		status: 403,
+		detail: input.detail,
+		...base,
+		reason: decision.reason,
+		token: decision.token
+	});
+	const reasons = new Set(decision.denials.map((denial) => denial.reason));
+	if (input.disclosure === "hide" && ![...reasons].every((reason) => HOLDS_GRANT.has(reason))) return notFoundDetails(input.instance);
+	if (reasons.has("anonymous")) return compact({
+		type: `${PROBLEM_BASE}/unauthenticated`,
+		title: "Authentication required",
+		status: 401,
+		detail: "Authenticate and repeat the request",
+		instance: input.instance,
+		permission: input.permission
+	});
+	const denied = compact({
+		type: `${PROBLEM_BASE}/denied`,
+		title: "Permission denied",
+		status: 403,
+		detail: input.detail,
+		...base,
+		denials: wireDenials(decision.denials),
+		alternatives: decision.alternatives.map((leaf) => leaf.key)
+	});
+	if (reasons.has("insufficient-user-authentication")) return {
+		...denied,
+		status: 401,
+		type: `${PROBLEM_BASE}/step-up-required`,
+		...stepUpOf(decision)
+	};
+	const plans = requiredPlans(decision);
+	if (plans.length > 0) return {
+		...denied,
+		type: `${PROBLEM_BASE}/not-entitled`,
+		title: "Plan upgrade required",
+		plans
+	};
+	if (reasons.size > 0 && [...reasons].every((reason) => reason === "limit")) return {
+		...denied,
+		status: 429,
+		type: `${PROBLEM_BASE}/rate-limited`,
+		title: "Rate limit exceeded"
+	};
+	if (reasons.has("limit-unavailable") && [...reasons].every((reason) => reason === "limit" || reason === "limit-unavailable")) return {
+		...denied,
+		status: 503,
+		type: `${PROBLEM_BASE}/limit-unavailable`,
+		title: "Rate limit unavailable"
+	};
+	return denied;
+}
+//#endregion
+export { wireDenials as a, stepUpOf as i, problemDetails as n, requiredPlans as r, notFoundDetails as t };

package/dist/prompt-CXYhLfsS.js

@@ -0,0 +1,32 @@
+import { cancel, confirm, isCancel, multiselect } from "@clack/prompts";
+//#region src/cli/commands/prompt.ts
+/** What a command reports when the person at the terminal cancels a prompt. */
+const CANCELLED = {
+	code: 2,
+	output: "Cancelled."
+};
+/** A yes or no question; `undefined` when cancelled. */
+async function ask(message) {
+	const answer = await confirm({ message });
+	if (isCancel(answer)) {
+		cancel();
+		return;
+	}
+	return answer;
+}
+/** Pick one or more of `options`, `initial` preselected; `undefined` when cancelled. */
+async function pick(message, options, initial) {
+	const answer = await multiselect({
+		message,
+		options: options.map((option) => ({ ...option })),
+		initialValues: [...initial],
+		required: true
+	});
+	if (isCancel(answer)) {
+		cancel();
+		return;
+	}
+	return answer;
+}
+//#endregion
+export { ask as n, pick as r, CANCELLED as t };

package/dist/protected-CNsMzrVd.d.ts

@@ -0,0 +1,27 @@
+import { D as PolicyVocabulary, Mr as Membership, Yn as Decision } from "./policy-CFZAr_Al.js";
+import { f as Permission } from "./permissions-DttnqqxC.js";
+import { r as Role } from "./vocabulary-DA8a8zif.js";
+import { a as FilterResult, c as SubjectView, l as TenantView, o as PermissionSet, r as ClientPermDock, s as PermissionState, t as ApprovalHandle, u as UseRolesOptions } from "./types-kxznc7cn.js";
+import { n as ProtectedProps } from "./types-C3s9xVJG.js";
+import { ReactNode } from "react";
+//#region src/react/hooks.d.ts
+declare function usePermDock<V extends PolicyVocabulary = PolicyVocabulary>(): ClientPermDock<V>;
+declare function usePermission(permission: Permission, data?: unknown): PermissionState;
+declare function usePermissions(permissions: readonly Permission[], data?: unknown): PermissionSet;
+declare function useFilter<T>(permission: Permission<string, T, "instance">, rows: readonly T[]): FilterResult<T>;
+declare function useTenant(): TenantView;
+declare function useMemberships(): readonly Membership[];
+declare function useRoles(options?: UseRolesOptions): {
+  readonly roles: readonly Role[];
+};
+declare function useAssignableRoles(): readonly Role[];
+declare function useAssignablePermissions(options?: {
+  readonly tenant?: string;
+}): readonly Permission[];
+declare function useSubject(): SubjectView;
+declare function useApproval(decision: Decision): ApprovalHandle;
+//#endregion
+//#region src/react/protected.d.ts
+declare function Protected(props: ProtectedProps): ReactNode;
+//#endregion
+export { useFilter as a, usePermission as c, useSubject as d, useTenant as f, useAssignableRoles as i, usePermissions as l, useApproval as n, useMemberships as o, useAssignablePermissions as r, usePermDock as s, Protected as t, useRoles as u };

package/dist/protected-Cs6kTaHo.js

@@ -0,0 +1,100 @@
+import { n as storeOf } from "./store-options-yO0V6gRn.js";
+import { a as protectedView, c as subjectView, i as permissionSet, l as tenantView, n as filterResult, o as rolesView, s as scopedTenant, t as approvalHandle } from "./views-Soe7bGSC.js";
+import { i as PermDockStoreContext, r as PermDockSnapshotPromiseContext } from "./live-options-H2eG8dfJ.js";
+import { Suspense, use, useMemo, useSyncExternalStore } from "react";
+import { jsx } from "react/jsx-runtime";
+//#region src/react/hooks.ts
+function useStore() {
+	const store = use(PermDockStoreContext);
+	if (store === null) throw new Error("PermDock: hooks require <PermDockProvider>.");
+	const pending = use(PermDockSnapshotPromiseContext);
+	if (pending !== null) store.adopt(use(pending), pending);
+	return store;
+}
+function usePermDock() {
+	const store = useStore();
+	return useSyncExternalStore((listener) => store.subscribe(listener), () => store.get(), () => store.get());
+}
+function usePermission(permission, data) {
+	const permdock = usePermDock();
+	return useMemo(() => storeOf(permdock).permissionState(permission, data), [
+		permdock,
+		permission,
+		data
+	]);
+}
+function usePermissions(permissions, data) {
+	const permdock = usePermDock();
+	return useMemo(() => permissionSet(storeOf(permdock), permissions, data), [
+		permdock,
+		permissions,
+		data
+	]);
+}
+function useFilter(permission, rows) {
+	const permdock = usePermDock();
+	return useMemo(() => filterResult(permdock, permission, rows), [
+		permdock,
+		permission,
+		rows
+	]);
+}
+function useTenant() {
+	const permdock = usePermDock();
+	return useMemo(() => tenantView(permdock), [permdock]);
+}
+function useMemberships() {
+	const permdock = usePermDock();
+	return useMemo(() => permdock.memberships(), [permdock]);
+}
+function useRoles(options = {}) {
+	const permdock = usePermDock();
+	const { tenant, team } = options;
+	return useMemo(() => rolesView(permdock, {
+		...tenant === void 0 ? {} : { tenant },
+		...team === void 0 ? {} : { team }
+	}), [
+		permdock,
+		tenant,
+		team
+	]);
+}
+function useAssignableRoles() {
+	const permdock = usePermDock();
+	return useMemo(() => permdock.assignableRoles(), [permdock]);
+}
+function useAssignablePermissions(options = {}) {
+	const permdock = usePermDock();
+	const { tenant } = options;
+	return useMemo(() => permdock.assignablePermissions(tenant === void 0 ? {} : { tenant }), [permdock, tenant]);
+}
+function useSubject() {
+	const permdock = usePermDock();
+	return useMemo(() => subjectView(permdock), [permdock]);
+}
+function useApproval(decision) {
+	return approvalHandle(storeOf(usePermDock()), decision);
+}
+//#endregion
+//#region src/react/protected.tsx
+function Protected(props) {
+	if (props.pending === void 0) return /* @__PURE__ */ jsx(Guard, { ...props });
+	return /* @__PURE__ */ jsx(Suspense, {
+		fallback: props.pending,
+		children: /* @__PURE__ */ jsx(Guard, { ...props })
+	});
+}
+function Guard(props) {
+	const root = usePermDock();
+	const local = usePermission(props.permission, props.data);
+	const scoped = useMemo(() => scopedTenant(root, props.tenant), [root, props.tenant]);
+	const view = protectedView(local, root, props.permission, props.data, scoped);
+	switch (view.slot) {
+		case "pending": return props.pending ?? null;
+		case "fallback": return typeof props.fallback === "function" ? props.fallback(view.decision) : props.fallback ?? null;
+		case "default": return typeof props.children === "function" ? props.children(view.decision) : props.children;
+		default: return view;
+	}
+}
+//#endregion
+export { useFilter as a, usePermission as c, useSubject as d, useTenant as f, useAssignableRoles as i, usePermissions as l, useApproval as n, useMemberships as o, useAssignablePermissions as r, usePermDock as s, Protected as t, useRoles as u };

package/dist/protected-bZs6rbT1.d.ts

@@ -0,0 +1,40 @@
+import { Yn as Decision, er as GrantedDecision, ln as PermDock } from "./policy-CFZAr_Al.js";
+import { f as Permission } from "./permissions-DttnqqxC.js";
+import { t as PermissionBoundaryState } from "./boundary-BmHxVH1J.js";
+import { s as PermissionState } from "./types-kxznc7cn.js";
+import { t as ClientStore } from "./store-D_pjn91-.js";
+import { Snippet } from "svelte";
+//#region src/svelte/boundary.d.ts
+type PermissionBoundaryProps = {
+  readonly children?: Snippet;
+  /** Rendered in place of the children when one throws `PermDockDeniedError`. */
+  readonly denied?: Snippet<[PermissionBoundaryState]>;
+  /** Rendered for `PermDockApprovalRequiredError`; defaults to `denied`. */
+  readonly approval?: Snippet<[PermissionBoundaryState]>;
+};
+//#endregion
+//#region src/client/views.d.ts
+/** What `Protected` renders: `pending` while an endpoint answer is in flight, `fallback` unless granted. */
+type ProtectedView = (PermissionState & {
+  readonly slot: "pending" | "fallback";
+}) | {
+  readonly allowed: true;
+  readonly status: PermissionState["status"];
+  readonly decision: GrantedDecision;
+  readonly slot: "default";
+};
+//#endregion
+//#region src/svelte/protected.d.ts
+type ProtectedProps = {
+  readonly permission: Permission;
+  readonly data?: unknown;
+  readonly tenant?: string;
+  readonly children?: Snippet<[Decision]>;
+  readonly pending?: Snippet;
+  readonly fallback?: Snippet<[Decision]>;
+};
+/** The instance for `tenant`, built once per store change rather than once per check. */
+declare function scopedFor(store: ClientStore, tenant: string | undefined, _generation?: number): PermDock | undefined;
+declare function viewFor(store: ClientStore, reference: Permission, data: unknown, scoped: PermDock | undefined, _generation?: number): ProtectedView;
+//#endregion
+export { PermissionBoundaryProps as i, scopedFor as n, viewFor as r, ProtectedProps as t };

package/dist/provider-Cjr62YMV.d.ts

@@ -0,0 +1,6 @@
+import { t as PermDockProviderProps } from "./types-C3s9xVJG.js";
+import { ReactElement } from "react";
+//#region src/react/provider.d.ts
+declare function PermDockProvider(props: PermDockProviderProps): ReactElement;
+//#endregion
+export { PermDockProvider as t };

package/dist/provider-DLzpb2Xz.js

@@ -0,0 +1,52 @@
+import { t as compact } from "./compact-y6vfu2_f.js";
+import { t as emptySnapshot } from "./from-snapshot-C3sHpZNS.js";
+import { t as adapterStore } from "./store-options-yO0V6gRn.js";
+import { i as PermDockStoreContext, n as useKeyed, r as PermDockSnapshotPromiseContext, t as useLiveOptions } from "./live-options-H2eG8dfJ.js";
+import { useLayoutEffect } from "react";
+import { jsx } from "react/jsx-runtime";
+//#region src/react/provider.tsx
+function PermDockProvider(props) {
+	const promise = props.snapshotPromise ?? null;
+	const suspend = props.suspend === true;
+	const awaiting = promise !== null && !suspend;
+	const live = useLiveOptions(props);
+	const store = useKeyed(() => adapterStore(compact({
+		endpoint: props.endpoint,
+		snapshotUrl: props.snapshotUrl,
+		approvals: props.approvals,
+		tenant: props.tenant,
+		fetch: live.fetch,
+		headers: live.headers,
+		maxAge: props.maxAge,
+		verifier: live.verifier,
+		awaiting,
+		passCache: true
+	}), props.snapshot ?? emptySnapshot()), [
+		props.snapshot,
+		props.endpoint,
+		props.snapshotUrl,
+		props.approvals,
+		props.tenant,
+		live.fetch,
+		live.headers,
+		props.maxAge,
+		live.verifier,
+		awaiting
+	]);
+	useLayoutEffect(() => {
+		if (promise !== null && !suspend) store.track(promise);
+	}, [
+		store,
+		promise,
+		suspend
+	]);
+	return /* @__PURE__ */ jsx(PermDockStoreContext, {
+		value: store,
+		children: /* @__PURE__ */ jsx(PermDockSnapshotPromiseContext, {
+			value: suspend ? promise : null,
+			children: props.children
+		})
+	});
+}
+//#endregion
+export { PermDockProvider as t };

package/dist/provider-store-DNyC1y48.js

@@ -0,0 +1,43 @@
+import { t as compact } from "./compact-y6vfu2_f.js";
+import { t as emptySnapshot } from "./from-snapshot-C3sHpZNS.js";
+import { i as isPromiseLike, t as adapterStore } from "./store-options-yO0V6gRn.js";
+//#region src/client/provider-store.ts
+/**
+* Store options that read `read()` on every request, so a rotated token, a
+* new `fetch` or a new verifier applies without rebuilding the store. A
+* verifier is wired only when one is present at creation: it switches the
+* store to signed snapshots.
+*/
+function liveOptions(read) {
+	return compact({
+		headers: () => read().headers,
+		fetch: (...args) => (read().fetch ?? fetch)(...args),
+		verifier: read().verifier === void 0 ? void 0 : { verify: (token, expectations) => {
+			const current = read().verifier;
+			return current === void 0 ? Promise.reject(/* @__PURE__ */ new Error("PermDock: the verifier option was removed.")) : current.verify(token, expectations);
+		} }
+	});
+}
+/**
+* The store a Vue, Svelte or Solid provider owns. A promised snapshot keeps
+* it `pending` until the promise settles; `undefined` starts empty.
+*/
+function providerStore(options, read, snapshot) {
+	const promised = isPromiseLike(snapshot);
+	const store = adapterStore(compact({
+		endpoint: options.endpoint,
+		snapshotUrl: options.snapshotUrl,
+		approvals: options.approvals,
+		tenant: options.tenant,
+		maxAge: options.maxAge,
+		...liveOptions(read)
+	}), promised || snapshot === void 0 ? emptySnapshot() : snapshot);
+	if (promised) store.follow(snapshot);
+	return store;
+}
+/** Refreshes for the tenant a reactive `tenant` option switched to; a failed refresh keeps the current answers. */
+function switchTenant(store, tenant) {
+	if (tenant !== void 0) store.get().refresh({ tenant }).catch(() => void 0);
+}
+//#endregion
+export { switchTenant as n, providerStore as t };

package/dist/react/index.d.ts

@@ -0,0 +1,8 @@
+import { n as requiredPlans } from "../problem-details-CkL50EEf.js";
+import { i as describe } from "../describe-PdoqESvg.js";
+import { t as approvalHeaders } from "../headers-Cf-zWvsO.js";
+import { a as FilterResult, c as SubjectView, i as ClientStatus, l as TenantView, n as ApprovalState, o as PermissionSet, r as ClientPermDock, s as PermissionState, t as ApprovalHandle } from "../types-kxznc7cn.js";
+import { n as ProtectedProps, t as PermDockProviderProps } from "../types-C3s9xVJG.js";
+import { a as useFilter, c as usePermission, d as useSubject, f as useTenant, i as useAssignableRoles, l as usePermissions, n as useApproval, o as useMemberships, r as useAssignablePermissions, s as usePermDock, t as Protected, u as useRoles } from "../protected-CNsMzrVd.js";
+import { t as PermDockProvider } from "../provider-Cjr62YMV.js";
+export { type ApprovalHandle, type ApprovalState, type ClientPermDock, type ClientStatus, type FilterResult, PermDockProvider, type PermDockProviderProps, type PermissionSet, type PermissionState, Protected, type ProtectedProps, type SubjectView, type TenantView, approvalHeaders, describe, requiredPlans, useApproval, useAssignablePermissions, useAssignableRoles, useFilter, useMemberships, usePermDock, usePermission, usePermissions, useRoles, useSubject, useTenant };

package/dist/react/index.js

@@ -0,0 +1,7 @@
+"use client";
+import { r as requiredPlans } from "../problem-details-_AMOYz-w.js";
+import { t as describe } from "../describe-B_gVZEVi.js";
+import { t as approvalHeaders } from "../headers-BZSDieNT.js";
+import { a as useFilter, c as usePermission, d as useSubject, f as useTenant, i as useAssignableRoles, l as usePermissions, n as useApproval, o as useMemberships, r as useAssignablePermissions, s as usePermDock, t as Protected, u as useRoles } from "../protected-Cs6kTaHo.js";
+import { t as PermDockProvider } from "../provider-DLzpb2Xz.js";
+export { PermDockProvider, Protected, approvalHeaders, describe, requiredPlans, useApproval, useAssignablePermissions, useAssignableRoles, useFilter, useMemberships, usePermDock, usePermission, usePermissions, useRoles, useSubject, useTenant };

package/dist/react/provider-client.d.ts

@@ -0,0 +1,2 @@
+import { t as PermDockProvider } from "../provider-Cjr62YMV.js";
+export { PermDockProvider };