permdock 0.1.0 → 0.2.0

package/dist/prisma/index.js

@@ -1,9 +1,9 @@
 import { t as compact } from "../compact-y6vfu2_f.js";
-import { n as freezeDeep } from "../freeze-y1_jQL4v.js";
-import { x as assertSafeKey } from "../permissions-DC7GROPA.js";
-import { i as PermDockValidationError } from "../errors-Iy71s7Oj.js";
-import { a as relatedRowGuard, l as renderGraphSql, n as escapeLike, s as relatedTargetsSql, t as compileWhere } from "../compile-D22iwvuV.js";
-import { a as rowCheckOf, n as statementText, r as subjectStatements } from "../subject-settings-xt7V845g.js";
+import { n as freezeDeep } from "../freeze-CrU8nQeX.js";
+import { w as assertSafeKey } from "../permissions-DVoF6dMt.js";
+import { n as PermDockValidationError } from "../validation-error-CnjZ4t92.js";
+import { a as relatedRowGuard, l as renderGraphSql, n as escapeLike, s as relatedTargetsSql, t as compileWhere, u as restrictedRowsSql } from "../compile-Ba4blROR.js";
+import { a as rowCheckOf, n as statementText, r as subjectStatements } from "../subject-settings-BwBmCdTR.js";
 //#region src/prisma/to-where.ts
 function fieldTests(options) {
 	const mapped = (field) => fieldName(field, options.fields);
@@ -129,8 +129,10 @@ function permdockExtension() {
 		query: { $allModels: {
 			findMany: wrap,
 			findFirst: wrap,
+			findFirstOrThrow: wrap,
 			count: wrap,
 			aggregate: wrap,
+			groupBy: wrap,
 			updateMany: wrap,
 			deleteMany: wrap
 		} }
@@ -349,10 +351,42 @@ async function resolveRelated(where, options) {
 	async function resolveNode(node) {
 		if (resources === void 0) throw refused("related: the where() result carries no resource graph");
 		if (node.ids === void 0 && (subject === void 0 || subject === "")) return NOTHING;
-		const query = renderGraphSql(relatedTargetsSql(node, {
+		const mapping = {
 			...options.relations,
 			resources
-		}), {
+		};
+		const ids = await readIds(relatedTargetsSql(node, mapping), node.field);
+		if (ids.length === 0) return NOTHING;
+		const reach = {
+			op: "in",
+			field: node.field,
+			value: ids
+		};
+		const guard = relatedRowGuard(node);
+		const conditions = [reach, ...guard === void 0 ? [] : [notRestricted(guard)]];
+		const above = node.restrictedAncestors;
+		if (above !== void 0) {
+			const closed = await readIds(restrictedRowsSql(above, mapping), above.parent);
+			if (closed.length > 0) conditions.push({
+				op: "or",
+				conditions: [{
+					op: "isNull",
+					field: above.parent,
+					value: true
+				}, {
+					op: "notIn",
+					field: above.parent,
+					value: closed
+				}]
+			});
+		}
+		return conditions.length === 1 ? reach : {
+			op: "and",
+			conditions
+		};
+	}
+	async function readIds(parts, field) {
+		const query = renderGraphSql(parts, {
 			subject: subject ?? "",
 			placeholder: (index) => `$${String(index)}`,
 			/* v8 ignore next 3 */
@@ -360,26 +394,16 @@ async function resolveRelated(where, options) {
 				throw refused(`related: no row column '${name}' in an id query`);
 			}
 		});
-		const ids = (await options.run({
+		return (await options.run({
 			sql: `select distinct r.id from (${query.sql}) r where r.id is not null`,
 			values: query.values
 		})).flatMap((row) => {
 			const id = row["id"];
 			if (typeof id !== "string" && typeof id !== "number") return [];
 			const text = String(id);
-			const parsed = options.parse === void 0 ? text : options.parse(text, node.field);
+			const parsed = options.parse === void 0 ? text : options.parse(text, field);
 			return typeof parsed === "string" || typeof parsed === "number" || typeof parsed === "boolean" ? [parsed] : [];
 		});
-		const reach = ids.length === 0 ? NOTHING : {
-			op: "in",
-			field: node.field,
-			value: ids
-		};
-		const guard = relatedRowGuard(node);
-		return guard === void 0 || ids.length === 0 ? reach : {
-			op: "and",
-			conditions: [reach, notRestricted(guard)]
-		};
 	}
 	async function resolve(node) {
 		switch (node.op) {
@@ -408,7 +432,8 @@ async function resolveRelated(where, options) {
 			case "notIn":
 			case "isNull":
 			case "memberOf":
-			case "opaque": return node;
+			case "opaque":
+			case "liveSession": return node;
 			default: return node;
 		}
 	}

package/dist/{problem-Cgp9-KZA.js → problem-B43ztKIm.js}

@@ -1,8 +1,8 @@
 import { t as compact } from "./compact-y6vfu2_f.js";
-import { n as requiredPlans } from "./describe-Bt1YD5uS.js";
-import { a as approvalMessage, i as PermDockValidationError, n as PermDockDeniedError, o as deniedMessage, t as PermDockApprovalRequiredError } from "./errors-Iy71s7Oj.js";
+import { n as PermDockValidationError, t as PROBLEM_BASE } from "./validation-error-CnjZ4t92.js";
+import { i as stepUpOf, n as problemDetails, t as notFoundDetails } from "./problem-details-_AMOYz-w.js";
+import { a as deniedMessage, i as approvalMessage } from "./errors-Cz5zn0mW.js";
 //#region src/server/problem.ts
-const PROBLEM_BASE = "https://permdock.dev/problems";
 function quoted(value) {
 	return `"${value.replaceAll(/["\\]/gu, "")}"`;
 }
@@ -29,28 +29,12 @@ function protectedResourceMetadataUrl(resource) {
 	const path = resource.pathname === "/" ? "" : resource.pathname;
 	return `${resource.origin}/.well-known/oauth-protected-resource${path}`;
 }
-/** The `acr` values and the tightest `maxAge` the failing assurance grants ask for. */
-function stepUpOf(decision) {
-	if (decision.outcome !== "denied") return {};
-	const acr = /* @__PURE__ */ new Set();
-	let maxAge;
-	for (const denial of decision.denials) {
-		if (denial.reason !== "insufficient-user-authentication") continue;
-		const grantees = denial.to === void 0 ? [] : Array.isArray(denial.to) ? denial.to : [denial.to];
-		for (const grantee of grantees) {
-			if (grantee.kind !== "assurance") continue;
-			for (const value of grantee.acr ?? []) acr.add(value);
-			if (grantee.maxAge !== void 0) maxAge = maxAge === void 0 ? grantee.maxAge : Math.min(maxAge, grantee.maxAge);
-		}
-	}
-	return compact({
-		acrValues: acr.size === 0 ? void 0 : [...acr],
-		maxAge
-	});
-}
 /** The `error_description` of every `invalid_token` challenge (RFC 6750 section 3.1). */
 const INVALID_TOKEN = "The access token is invalid";
 function wwwAuthenticate(decision, permission, credentials = true) {
+	return challengeFor(decision, permission?.scope, credentials);
+}
+function challengeFor(decision, scope, credentials = true) {
 	if (decision.outcome !== "denied") return;
 	const reasons = new Set(decision.denials.map((denial) => denial.reason));
 	if (reasons.has("insufficient-user-authentication")) return bearerChallenge({
@@ -63,7 +47,7 @@ function wwwAuthenticate(decision, permission, credentials = true) {
 	}) : "Bearer";
 	if (reasons.has("not-delegated") || reasons.has("no-delegation")) return bearerChallenge(compact({
 		error: "insufficient_scope",
-		scopes: permission === void 0 ? void 0 : [permission.scope]
+		scopes: scope === void 0 ? void 0 : [scope]
 	}));
 }
 function problemResponse(details, permission, decision, extra, credentials) {
@@ -97,12 +81,8 @@ function validationProblem(detail) {
 		detail
 	}));
 }
-function resourceRef(permission, data) {
-	const id = data !== null && typeof data === "object" && "id" in data ? data.id : void 0;
-	return compact({
-		type: permission.resource,
-		id: typeof id === "string" || typeof id === "number" ? String(id) : void 0
-	});
+function resourceRef(permission) {
+	return { type: permission.resource };
 }
 function isLimitDetail(value) {
 	if (value === null || typeof value !== "object") return false;
@@ -133,94 +113,79 @@ function rateLimitHeaders(decision, now = Date.now() / 1e3) {
 		"RateLimit-Policy": entries.map((entry) => `${entry.name};q=${entry.detail.count};w=${entry.detail.window}`).join(", ")
 	};
 }
-/** Reasons that only arise once a matching grant was found, so they reveal nothing hidden. */
-const HOLDS_GRANT = /* @__PURE__ */ new Set([
-	"insufficient-user-authentication",
-	"limit",
-	"limit-unavailable"
-]);
+/**
+* The response for a decision's Problem Details: `WWW-Authenticate` for a
+* `401` or a missing delegation, and the rate-limit fields for a `429`. A
+* hidden row's `404` carries neither, so it reads like a missing one.
+*/
+function decisionResponse(details, decision, options = {}) {
+	const headers = new Headers({
+		...details.status === 429 ? rateLimitHeaders(decision) : {},
+		"content-type": "application/problem+json"
+	});
+	const challenge = details.status === 404 ? void 0 : challengeFor(decision, options.scope, options.credentials);
+	if (challenge !== void 0) headers.set("WWW-Authenticate", challenge);
+	return new Response(JSON.stringify(details), {
+		status: details.status,
+		headers
+	});
+}
 function problemFromDecision(decision, permission, subject, options = {}) {
-	const base = PROBLEM_BASE;
 	if (decision.outcome === "granted") return new Response(null, { status: 204 });
-	if (decision.outcome === "approval-required") {
-		const details = new PermDockApprovalRequiredError({
-			decision,
-			permission: permission.key,
-			scope: permission.scope,
-			resource: resourceRef(permission, void 0),
-			message: approvalMessage(permission.key, decision.reason, decision.token)
-		}).toProblemDetails(compact({ instance: options.instance }));
-		const approval = options.approval === void 0 || options.approval.at === void 0 && options.approval.hint === void 0 ? void 0 : compact({
-			at: options.approval.at,
-			hint: options.approval.hint
-		});
-		return problemResponse(compact({
-			...details,
-			type: `${base}/approval-required`,
-			approval
-		}), permission, decision);
-	}
-	const reasons = new Set(decision.denials.map((denial) => denial.reason));
-	if (options.disclosure === "hide" && ![...reasons].every((reason) => HOLDS_GRANT.has(reason))) return notFoundProblem(options.instance);
-	if (decision.denials.some((denial) => denial.detail instanceof PermDockValidationError)) {
-		const validation = decision.denials[0]?.detail;
-		if (validation instanceof PermDockValidationError) return problemResponse(validation.toProblemDetails(), permission, decision);
-	}
-	const details = new PermDockDeniedError({
+	const validation = decision.outcome === "denied" ? decision.denials[0]?.detail : void 0;
+	if (options.disclosure !== "hide" && validation instanceof PermDockValidationError) return problemResponse(validation.toProblemDetails(), options.scope === void 0 ? permission : {
+		...permission,
+		scope: options.scope
+	}, decision);
+	const details = problemDetails(compact({
 		decision,
+		detail: decision.outcome === "approval-required" ? approvalMessage(permission.key, decision.reason, decision.token) : deniedMessage(permission.key, subject?.principal?.id, decision.denials, decision.alternatives.map((leaf) => leaf.key), subject !== void 0),
+		instance: options.instance,
 		permission: permission.key,
 		scope: permission.scope,
-		resource: resourceRef(permission, void 0),
-		subject,
-		message: deniedMessage(permission.key, subject.principal?.id, decision.denials, decision.alternatives.map((leaf) => leaf.key))
-	}).toProblemDetails(compact({ instance: options.instance }));
-	if (reasons.has("anonymous")) return problemResponse(compact({
-		type: `${base}/unauthenticated`,
-		title: "Authentication required",
-		status: 401,
-		detail: "Authenticate and repeat the request",
-		instance: options.instance,
-		permission: permission.key
-	}), permission, decision, void 0, options.credentials);
-	if (reasons.has("insufficient-user-authentication")) return problemResponse(compact({
-		...details,
-		status: 401,
-		type: `${base}/step-up-required`,
-		...stepUpOf(decision)
-	}), permission, decision);
-	const plans = requiredPlans(decision);
-	if (plans.length > 0) return problemResponse({
-		...details,
-		type: `${base}/not-entitled`,
-		title: "Plan upgrade required",
-		plans
-	}, permission, decision);
-	if (reasons.size > 0 && [...reasons].every((reason) => reason === "limit")) return problemResponse({
-		...details,
-		status: 429,
-		type: `${base}/rate-limited`,
-		title: "Rate limit exceeded"
-	}, permission, decision, rateLimitHeaders(decision));
-	if (reasons.has("limit-unavailable") && [...reasons].every((reason) => reason === "limit" || reason === "limit-unavailable")) return problemResponse({
-		...details,
-		status: 503,
-		type: `${base}/limit-unavailable`,
-		title: "Rate limit unavailable"
-	}, permission, decision);
-	return problemResponse({
+		resource: resourceRef(permission),
+		disclosure: options.disclosure
+	}));
+	const approval = decision.outcome !== "approval-required" || options.approval === void 0 || options.approval.at === void 0 && options.approval.hint === void 0 ? void 0 : compact({
+		at: options.approval.at,
+		hint: options.approval.hint
+	});
+	return decisionResponse(approval === void 0 ? details : {
 		...details,
-		type: `${base}/denied`
-	}, permission, decision);
+		approval
+	}, decision, compact({
+		scope: options.scope ?? permission.scope,
+		credentials: options.credentials
+	}));
 }
 /** The `404` a missing row and a hidden one share, so the two read the same. */
 function notFoundProblem(instance) {
-	return problemResponse(compact({
-		type: `${PROBLEM_BASE}/not-found`,
-		title: "Not found",
-		status: 404,
-		detail: "No such resource",
-		instance
-	}));
+	return problemResponse(notFoundDetails(instance));
+}
+const ANONYMOUS = {
+	outcome: "denied",
+	denials: [{
+		role: null,
+		reason: "anonymous"
+	}],
+	alternatives: []
+};
+/** The `401` for a request with no subject, with the RFC 6750 challenge its credentials call for. */
+function unauthenticatedProblem(credentials) {
+	return decisionResponse(problemDetails({
+		decision: ANONYMOUS,
+		detail: "anonymous"
+	}), ANONYMOUS, { credentials });
+}
+function methodNotAllowed(allow) {
+	const response = problemResponse({
+		type: `${PROBLEM_BASE}/method-not-allowed`,
+		title: "Method not allowed",
+		status: 405,
+		detail: `use ${allow}`
+	});
+	response.headers.set("Allow", allow);
+	return response;
 }
 //#endregion
-export { problemFromDecision as a, stepUpOf as c, notFoundProblem as i, validationProblem as l, batchTooLarge as n, problemResponse as o, bearerChallenge as r, protectedResourceMetadataUrl as s, PROBLEM_BASE as t, wwwAuthenticate as u };
+export { notFoundProblem as a, protectedResourceMetadataUrl as c, wwwAuthenticate as d, methodNotAllowed as i, unauthenticatedProblem as l, bearerChallenge as n, problemFromDecision as o, decisionResponse as r, problemResponse as s, batchTooLarge as t, validationProblem as u };

package/dist/problem-details-CkL50EEf.d.ts

@@ -0,0 +1,7 @@
+import { Yn as Decision } from "./policy-CFZAr_Al.js";
+//#region src/core/problem-details.d.ts
+type Disclosure = "hide" | "reveal";
+/** The plans a `not-entitled` denial asks for; empty unless every denial is `not-entitled`. */
+declare function requiredPlans(decision: Decision): readonly string[];
+//#endregion
+export { requiredPlans as n, Disclosure as t };

package/dist/problem-details-_AMOYz-w.js

@@ -0,0 +1,144 @@
+import { t as compact } from "./compact-y6vfu2_f.js";
+import { t as PROBLEM_BASE } from "./validation-error-CnjZ4t92.js";
+//#region src/core/wire-denial.ts
+const IN_PROCESS = /* @__PURE__ */ new Set(["closure-error", "validation"]);
+function jsonDetail(value) {
+	if (value === void 0 || value === null || value instanceof Error) return;
+	if (typeof value === "string" || typeof value === "boolean") return value;
+	if (typeof value === "number") return Number.isFinite(value) ? value : void 0;
+	if (typeof value !== "object") return;
+	try {
+		return JSON.parse(JSON.stringify(value));
+	} catch {
+		return;
+	}
+}
+function wireDenial(denial) {
+	return compact({
+		role: denial.role,
+		reason: denial.reason,
+		to: denial.to,
+		detail: IN_PROCESS.has(denial.reason) ? void 0 : jsonDetail(denial.detail)
+	});
+}
+function wireDenials(denials) {
+	return denials.map(wireDenial);
+}
+//#endregion
+//#region src/core/problem-details.ts
+/** Reasons that only arise once a matching grant was found, so they reveal nothing hidden. */
+const HOLDS_GRANT = /* @__PURE__ */ new Set([
+	"insufficient-user-authentication",
+	"limit",
+	"limit-unavailable"
+]);
+function granteesOf(to) {
+	if (to === void 0) return [];
+	return Array.isArray(to) ? to : [to];
+}
+/** The plans a `not-entitled` denial asks for; empty unless every denial is `not-entitled`. */
+function requiredPlans(decision) {
+	if (decision.outcome !== "denied" || decision.denials.length === 0 || decision.denials.some((denial) => denial.reason !== "not-entitled")) return [];
+	const plans = /* @__PURE__ */ new Set();
+	for (const denial of decision.denials) for (const item of granteesOf(denial.to)) if (item.kind === "plan") plans.add(item.plan);
+	return [...plans];
+}
+/** The `acr` values and the tightest `maxAge` the failing assurance grants ask for. */
+function stepUpOf(decision) {
+	if (decision.outcome !== "denied") return {};
+	const acr = /* @__PURE__ */ new Set();
+	let maxAge;
+	for (const denial of decision.denials) {
+		if (denial.reason !== "insufficient-user-authentication") continue;
+		for (const grantee of granteesOf(denial.to)) {
+			if (grantee.kind !== "assurance") continue;
+			for (const value of grantee.acr ?? []) acr.add(value);
+			if (grantee.maxAge !== void 0) maxAge = maxAge === void 0 ? grantee.maxAge : Math.min(maxAge, grantee.maxAge);
+		}
+	}
+	return compact({
+		acrValues: acr.size === 0 ? void 0 : [...acr],
+		maxAge
+	});
+}
+/** The `404` a missing row and a hidden one share, so the two read the same. */
+function notFoundDetails(instance) {
+	return compact({
+		type: `${PROBLEM_BASE}/not-found`,
+		title: "Not found",
+		status: 404,
+		detail: "No such resource",
+		instance
+	});
+}
+/**
+* The RFC 9457 body for a decision that is not `granted`. One status matrix
+* serves `protect`, a thrown `assert` and `problemFromError`: `401` for an
+* anonymous subject or a step-up, `404` for a hidden row, `429` for an
+* exhausted limit, `503` for an unavailable limit store, `403` otherwise.
+*/
+function problemDetails(input) {
+	const { decision } = input;
+	const base = compact({
+		instance: input.instance,
+		permission: input.permission,
+		scope: input.scope,
+		resource: input.resource
+	});
+	if (decision.outcome === "approval-required") return compact({
+		type: `${PROBLEM_BASE}/approval-required`,
+		title: "Approval required",
+		status: 403,
+		detail: input.detail,
+		...base,
+		reason: decision.reason,
+		token: decision.token
+	});
+	const reasons = new Set(decision.denials.map((denial) => denial.reason));
+	if (input.disclosure === "hide" && ![...reasons].every((reason) => HOLDS_GRANT.has(reason))) return notFoundDetails(input.instance);
+	if (reasons.has("anonymous")) return compact({
+		type: `${PROBLEM_BASE}/unauthenticated`,
+		title: "Authentication required",
+		status: 401,
+		detail: "Authenticate and repeat the request",
+		instance: input.instance,
+		permission: input.permission
+	});
+	const denied = compact({
+		type: `${PROBLEM_BASE}/denied`,
+		title: "Permission denied",
+		status: 403,
+		detail: input.detail,
+		...base,
+		denials: wireDenials(decision.denials),
+		alternatives: decision.alternatives.map((leaf) => leaf.key)
+	});
+	if (reasons.has("insufficient-user-authentication")) return {
+		...denied,
+		status: 401,
+		type: `${PROBLEM_BASE}/step-up-required`,
+		...stepUpOf(decision)
+	};
+	const plans = requiredPlans(decision);
+	if (plans.length > 0) return {
+		...denied,
+		type: `${PROBLEM_BASE}/not-entitled`,
+		title: "Plan upgrade required",
+		plans
+	};
+	if (reasons.size > 0 && [...reasons].every((reason) => reason === "limit")) return {
+		...denied,
+		status: 429,
+		type: `${PROBLEM_BASE}/rate-limited`,
+		title: "Rate limit exceeded"
+	};
+	if (reasons.has("limit-unavailable") && [...reasons].every((reason) => reason === "limit" || reason === "limit-unavailable")) return {
+		...denied,
+		status: 503,
+		type: `${PROBLEM_BASE}/limit-unavailable`,
+		title: "Rate limit unavailable"
+	};
+	return denied;
+}
+//#endregion
+export { wireDenials as a, stepUpOf as i, problemDetails as n, requiredPlans as r, notFoundDetails as t };

package/dist/{protected-BuPAycJT.d.ts → protected-CNsMzrVd.d.ts}

@@ -1,7 +1,8 @@
-import { E as PolicyVocabulary, Mn as Decision, pr as Membership } from "./policy-CInmNGkM.js";
-import { d as Permission } from "./permissions-B4apnahQ.js";
-import { r as Role } from "./vocabulary-Dk0fs-Jk.js";
-import { a as FilterResult, c as PermissionState, d as TenantView, f as UseRolesOptions, l as ProtectedProps, r as ClientPermDock, s as PermissionSet, t as ApprovalHandle, u as SubjectView } from "./types-DbWdEfcm.js";
+import { D as PolicyVocabulary, Mr as Membership, Yn as Decision } from "./policy-CFZAr_Al.js";
+import { f as Permission } from "./permissions-DttnqqxC.js";
+import { r as Role } from "./vocabulary-DA8a8zif.js";
+import { a as FilterResult, c as SubjectView, l as TenantView, o as PermissionSet, r as ClientPermDock, s as PermissionState, t as ApprovalHandle, u as UseRolesOptions } from "./types-kxznc7cn.js";
+import { n as ProtectedProps } from "./types-C3s9xVJG.js";
 import { ReactNode } from "react";
 //#region src/react/hooks.d.ts
 declare function usePermDock<V extends PolicyVocabulary = PolicyVocabulary>(): ClientPermDock<V>;

package/dist/protected-Cs6kTaHo.js

@@ -0,0 +1,100 @@
+import { n as storeOf } from "./store-options-yO0V6gRn.js";
+import { a as protectedView, c as subjectView, i as permissionSet, l as tenantView, n as filterResult, o as rolesView, s as scopedTenant, t as approvalHandle } from "./views-Soe7bGSC.js";
+import { i as PermDockStoreContext, r as PermDockSnapshotPromiseContext } from "./live-options-H2eG8dfJ.js";
+import { Suspense, use, useMemo, useSyncExternalStore } from "react";
+import { jsx } from "react/jsx-runtime";
+//#region src/react/hooks.ts
+function useStore() {
+	const store = use(PermDockStoreContext);
+	if (store === null) throw new Error("PermDock: hooks require <PermDockProvider>.");
+	const pending = use(PermDockSnapshotPromiseContext);
+	if (pending !== null) store.adopt(use(pending), pending);
+	return store;
+}
+function usePermDock() {
+	const store = useStore();
+	return useSyncExternalStore((listener) => store.subscribe(listener), () => store.get(), () => store.get());
+}
+function usePermission(permission, data) {
+	const permdock = usePermDock();
+	return useMemo(() => storeOf(permdock).permissionState(permission, data), [
+		permdock,
+		permission,
+		data
+	]);
+}
+function usePermissions(permissions, data) {
+	const permdock = usePermDock();
+	return useMemo(() => permissionSet(storeOf(permdock), permissions, data), [
+		permdock,
+		permissions,
+		data
+	]);
+}
+function useFilter(permission, rows) {
+	const permdock = usePermDock();
+	return useMemo(() => filterResult(permdock, permission, rows), [
+		permdock,
+		permission,
+		rows
+	]);
+}
+function useTenant() {
+	const permdock = usePermDock();
+	return useMemo(() => tenantView(permdock), [permdock]);
+}
+function useMemberships() {
+	const permdock = usePermDock();
+	return useMemo(() => permdock.memberships(), [permdock]);
+}
+function useRoles(options = {}) {
+	const permdock = usePermDock();
+	const { tenant, team } = options;
+	return useMemo(() => rolesView(permdock, {
+		...tenant === void 0 ? {} : { tenant },
+		...team === void 0 ? {} : { team }
+	}), [
+		permdock,
+		tenant,
+		team
+	]);
+}
+function useAssignableRoles() {
+	const permdock = usePermDock();
+	return useMemo(() => permdock.assignableRoles(), [permdock]);
+}
+function useAssignablePermissions(options = {}) {
+	const permdock = usePermDock();
+	const { tenant } = options;
+	return useMemo(() => permdock.assignablePermissions(tenant === void 0 ? {} : { tenant }), [permdock, tenant]);
+}
+function useSubject() {
+	const permdock = usePermDock();
+	return useMemo(() => subjectView(permdock), [permdock]);
+}
+function useApproval(decision) {
+	return approvalHandle(storeOf(usePermDock()), decision);
+}
+//#endregion
+//#region src/react/protected.tsx
+function Protected(props) {
+	if (props.pending === void 0) return /* @__PURE__ */ jsx(Guard, { ...props });
+	return /* @__PURE__ */ jsx(Suspense, {
+		fallback: props.pending,
+		children: /* @__PURE__ */ jsx(Guard, { ...props })
+	});
+}
+function Guard(props) {
+	const root = usePermDock();
+	const local = usePermission(props.permission, props.data);
+	const scoped = useMemo(() => scopedTenant(root, props.tenant), [root, props.tenant]);
+	const view = protectedView(local, root, props.permission, props.data, scoped);
+	switch (view.slot) {
+		case "pending": return props.pending ?? null;
+		case "fallback": return typeof props.fallback === "function" ? props.fallback(view.decision) : props.fallback ?? null;
+		case "default": return typeof props.children === "function" ? props.children(view.decision) : props.children;
+		default: return view;
+	}
+}
+//#endregion
+export { useFilter as a, usePermission as c, useSubject as d, useTenant as f, useAssignableRoles as i, usePermissions as l, useApproval as n, useMemberships as o, useAssignablePermissions as r, usePermDock as s, Protected as t, useRoles as u };

package/dist/protected-bZs6rbT1.d.ts

@@ -0,0 +1,40 @@
+import { Yn as Decision, er as GrantedDecision, ln as PermDock } from "./policy-CFZAr_Al.js";
+import { f as Permission } from "./permissions-DttnqqxC.js";
+import { t as PermissionBoundaryState } from "./boundary-BmHxVH1J.js";
+import { s as PermissionState } from "./types-kxznc7cn.js";
+import { t as ClientStore } from "./store-D_pjn91-.js";
+import { Snippet } from "svelte";
+//#region src/svelte/boundary.d.ts
+type PermissionBoundaryProps = {
+  readonly children?: Snippet;
+  /** Rendered in place of the children when one throws `PermDockDeniedError`. */
+  readonly denied?: Snippet<[PermissionBoundaryState]>;
+  /** Rendered for `PermDockApprovalRequiredError`; defaults to `denied`. */
+  readonly approval?: Snippet<[PermissionBoundaryState]>;
+};
+//#endregion
+//#region src/client/views.d.ts
+/** What `Protected` renders: `pending` while an endpoint answer is in flight, `fallback` unless granted. */
+type ProtectedView = (PermissionState & {
+  readonly slot: "pending" | "fallback";
+}) | {
+  readonly allowed: true;
+  readonly status: PermissionState["status"];
+  readonly decision: GrantedDecision;
+  readonly slot: "default";
+};
+//#endregion
+//#region src/svelte/protected.d.ts
+type ProtectedProps = {
+  readonly permission: Permission;
+  readonly data?: unknown;
+  readonly tenant?: string;
+  readonly children?: Snippet<[Decision]>;
+  readonly pending?: Snippet;
+  readonly fallback?: Snippet<[Decision]>;
+};
+/** The instance for `tenant`, built once per store change rather than once per check. */
+declare function scopedFor(store: ClientStore, tenant: string | undefined, _generation?: number): PermDock | undefined;
+declare function viewFor(store: ClientStore, reference: Permission, data: unknown, scoped: PermDock | undefined, _generation?: number): ProtectedView;
+//#endregion
+export { PermissionBoundaryProps as i, scopedFor as n, viewFor as r, ProtectedProps as t };

package/dist/{provider-wTAUda2v.d.ts → provider-Cjr62YMV.d.ts}

@@ -1,4 +1,4 @@
-import { o as PermDockProviderProps } from "./types-DbWdEfcm.js";
+import { t as PermDockProviderProps } from "./types-C3s9xVJG.js";
 import { ReactElement } from "react";
 //#region src/react/provider.d.ts
 declare function PermDockProvider(props: PermDockProviderProps): ReactElement;