permdock 0.1.0 → 0.2.0

package/dist/supabase-hook-D5qVd_D8.js

@@ -0,0 +1,2 @@
+import { i as runSupabase } from "./supabase-hook-BuxLQLpU.js";
+export { runSupabase };

package/dist/supautils-DYZnzRWV.js

@@ -0,0 +1,91 @@
+import { d as group, p as sqlStatements } from "./supabase-config-Bs44dare.js";
+//#region src/cli/supautils.ts
+/** `supautils.reserved_roles` of supabase/postgres 17.11.0.002 (supautils 3.4.4). */
+const RESERVED_ROLES = /* @__PURE__ */ new Set([
+	"supabase_admin",
+	"supabase_auth_admin",
+	"supabase_storage_admin",
+	"supabase_read_only_user",
+	"supabase_realtime_admin",
+	"supabase_replication_admin",
+	"supabase_etl_admin",
+	"supabase_privileged_role",
+	"dashboard_user",
+	"pgbouncer",
+	"service_role",
+	"authenticator",
+	"authenticated",
+	"anon"
+]);
+/** The `*` entries of `reserved_roles`: `postgres` may still `set` or `reset` their settings. */
+const CONFIGURABLE_ROLES = /* @__PURE__ */ new Set([
+	"service_role",
+	"authenticator",
+	"authenticated",
+	"anon"
+]);
+/** `supautils.reserved_memberships` of the same image. */
+const RESERVED_MEMBERSHIPS = /* @__PURE__ */ new Set([
+	"pg_read_server_files",
+	"pg_write_server_files",
+	"pg_execute_server_program",
+	"supabase_admin",
+	"supabase_auth_admin",
+	"supabase_storage_admin",
+	"supabase_read_only_user",
+	"supabase_realtime_admin",
+	"supabase_replication_admin",
+	"supabase_etl_admin",
+	"dashboard_user",
+	"pgbouncer",
+	"authenticator"
+]);
+const ROLE = String.raw`(?:"[^"]+"|\w+)`;
+const ROLES = String.raw`${ROLE}(?:\s*,\s*${ROLE})*`;
+const ALTER_ROLE = new RegExp(String.raw`^alter\s+(role|user|group)\s+(${ROLE})\s+([\s\S]*)$`, "iu");
+const DROP_ROLE = new RegExp(String.raw`^drop\s+(?:role|user|group)\s+(?:if\s+exists\s+)?(${ROLES})\s*$`, "iu");
+const GRANT_ROLE = /^grant\s+([\s\S]+?)\s+to\s/iu;
+const CREATE_IN_ROLE = new RegExp(String.raw`^create\s+(?:role|user|group)\s+${ROLE}\b[\s\S]*?\bin\s+(?:role|group)\s+(${ROLES})`, "iu");
+const CONFIG_CHANGE = /^(?:in\s+database\s+\S+\s+)?(?:set|reset)\s/iu;
+function roleName(name) {
+	return name.replaceAll("\"", "").toLowerCase();
+}
+function roleList(list) {
+	return list.split(",").map((name) => roleName(name.trim()));
+}
+function rejection(text) {
+	const alter = ALTER_ROLE.exec(text);
+	if (alter !== null) {
+		const role = roleName(group(alter, 2));
+		const rest = group(alter, 3);
+		if (group(alter, 1).toLowerCase() === "group" && /^add\s/iu.test(rest)) return RESERVED_MEMBERSHIPS.has(role) ? `grants membership in the reserved role ${role}` : void 0;
+		if (!RESERVED_ROLES.has(role) || CONFIGURABLE_ROLES.has(role) && CONFIG_CHANGE.test(rest)) return;
+		return `changes the reserved role ${role}`;
+	}
+	const drop = DROP_ROLE.exec(text);
+	if (drop !== null) {
+		const role = roleList(group(drop, 1)).find((name) => RESERVED_ROLES.has(name));
+		return role === void 0 ? void 0 : `drops the reserved role ${role}`;
+	}
+	const grant = GRANT_ROLE.exec(text);
+	const granted = CREATE_IN_ROLE.exec(text)?.[1] ?? (grant === null || /\bon\b/iu.test(group(grant, 1)) ? void 0 : group(grant, 1));
+	if (granted === void 0) return;
+	const role = roleList(granted).find((name) => RESERVED_MEMBERSHIPS.has(name));
+	return role === void 0 ? void 0 : `grants membership in the reserved role ${role}`;
+}
+/**
+* The statements of `sql` that supautils rejects for a non-superuser:
+* changing or dropping a reserved role, other than `set` or `reset` on the
+* four API roles, and granting a reserved membership.
+*/
+function supautilsRejections(sql) {
+	return sqlStatements(sql).flatMap(({ line, text }) => {
+		const reason = rejection(text);
+		return reason === void 0 ? [] : [{
+			line,
+			reason
+		}];
+	});
+}
+//#endregion
+export { supautilsRejections as t };

package/dist/svelte/PermissionBoundary.svelte

@@ -0,0 +1,37 @@
+<script lang="ts">
+  import {
+    boundaryDigest,
+    boundaryFallback,
+    type PermissionBoundaryProps,
+    type PermissionBoundaryState,
+  } from './runtime.js';
+
+  let { children, denied, approval }: PermissionBoundaryProps = $props();
+
+  let refused = $state<PermissionBoundaryState | null>(null);
+
+  // A rethrown error reaches the next boundary up.
+  function onerror(error: unknown, reset: () => void): void {
+    const digest = boundaryDigest(error);
+    if (digest === null) {
+      throw error;
+    }
+    refused = {
+      ...digest,
+      retry: (): void => {
+        refused = null;
+        reset();
+      },
+    };
+  }
+</script>
+
+<svelte:boundary {onerror}>
+  {@render children?.()}
+  {#snippet failed()}
+    {#if refused !== null}
+      {@const fallback = boundaryFallback(refused, { denied, approval })}
+      {@render fallback?.(refused)}
+    {/if}
+  {/snippet}
+</svelte:boundary>

package/dist/svelte/Protected.svelte

@@ -1,7 +1,12 @@
 <script lang="ts">
   import { onDestroy } from 'svelte';
 
-  import { getStore, protectedView, type ProtectedProps } from './runtime.js';
+  import {
+    getStore,
+    scopedFor,
+    viewFor,
+    type ProtectedProps,
+  } from './runtime.js';
 
   let {
     permission,
@@ -19,9 +24,10 @@
       tick += 1;
     }),
   );
+  const scoped = $derived(scopedFor(store, tenant, tick));
   const view = $derived.by(() => {
     const generation = tick;
-    return protectedView(store, permission, data, tenant, generation);
+    return viewFor(store, permission, data, scoped, generation);
   });
 </script>
 

package/dist/svelte/index.d.ts

@@ -1,10 +1,13 @@
-import { a as requiredPlans, i as describe } from "../describe-DernyItf.js";
-import { t as approvalHeaders } from "../headers-C8SHQccD.js";
-import { a as FilterResult, c as PermissionState, d as TenantView, f as UseRolesOptions, i as ClientStatus, n as ApprovalState, r as ClientPermDock, s as PermissionSet, t as ApprovalHandle, u as SubjectView } from "../types-DbWdEfcm.js";
-import { a as getPermDock, c as permissions, d as subject, f as tenant, i as filtered, l as roles, n as assignable, o as memberships, p as PermDockSvelteOptions, r as assignablePermissions, s as permission, t as approval, u as setPermDock } from "../stores-CvOnu_2T.js";
-import { t as ProtectedProps } from "../protected-wY7nXhY9.js";
+import { n as requiredPlans } from "../problem-details-CkL50EEf.js";
+import { i as describe } from "../describe-PdoqESvg.js";
+import { t as PermissionBoundaryState } from "../boundary-BmHxVH1J.js";
+import { t as approvalHeaders } from "../headers-Cf-zWvsO.js";
+import { a as FilterResult, c as SubjectView, i as ClientStatus, l as TenantView, n as ApprovalState, o as PermissionSet, r as ClientPermDock, s as PermissionState, t as ApprovalHandle, u as UseRolesOptions } from "../types-kxznc7cn.js";
+import { i as PermissionBoundaryProps, t as ProtectedProps } from "../protected-bZs6rbT1.js";
+import { a as getPermDock, c as permissions, d as subject, f as tenant, i as filtered, l as roles, n as assignable, o as memberships, p as PermDockSvelteOptions, r as assignablePermissions, s as permission, t as approval, u as setPermDock } from "../stores-DVR5NHLE.js";
 import { Component } from "svelte";
 //#region src/svelte/index.d.ts
 export declare const Protected: Component<ProtectedProps>;
+export declare const PermissionBoundary: Component<PermissionBoundaryProps>;
 //#endregion
-export { type ApprovalHandle, type ApprovalState, type ClientPermDock, type ClientStatus, type FilterResult, type PermDockSvelteOptions, type PermissionSet, type PermissionState, type ProtectedProps, type SubjectView, type TenantView, type UseRolesOptions, approval, approvalHeaders, assignable, assignablePermissions, describe, filtered, getPermDock, memberships, permission, permissions, requiredPlans, roles, setPermDock, subject, tenant };
+export { type ApprovalHandle, type ApprovalState, type ClientPermDock, type ClientStatus, type FilterResult, type PermDockSvelteOptions, type PermissionBoundaryProps, type PermissionBoundaryState, type PermissionSet, type PermissionState, type ProtectedProps, type SubjectView, type TenantView, type UseRolesOptions, approval, approvalHeaders, assignable, assignablePermissions, describe, filtered, getPermDock, memberships, permission, permissions, requiredPlans, roles, setPermDock, subject, tenant };

package/dist/svelte/index.js

@@ -1,11 +1,63 @@
-import { n as requiredPlans, t as describe } from "../describe-Bt1YD5uS.js";
-import { t as approvalHeaders } from "../headers-B5RRv3Xm.js";
-import { t as getStore } from "../context-CKEAabd7.js";
-import { t as protectedView } from "../runtime-DP9ttFh1.js";
-import { a as getPermDock, c as permissions, d as subject, f as tenant, i as filtered, l as roles, n as assignable, o as memberships, r as assignablePermissions, s as permission, t as approval, u as setPermDock } from "../stores-CkG2HrSg.js";
+import { r as requiredPlans } from "../problem-details-_AMOYz-w.js";
+import { t as describe } from "../describe-B_gVZEVi.js";
+import { t as approvalHeaders } from "../headers-BZSDieNT.js";
+import { n as boundaryFallback, t as boundaryDigest } from "../boundary-BM8a_P6E.js";
+import { t as getStore } from "../context-Ttp0ekMT.js";
+import { n as viewFor, t as scopedFor } from "../runtime-CB8gQFvS.js";
+import { a as getPermDock, c as permissions, d as subject, f as tenant, i as filtered, l as roles, n as assignable, o as memberships, r as assignablePermissions, s as permission, t as approval, u as setPermDock } from "../stores-4_sqiOA1.js";
 import "svelte/internal/disclose-version";
 import * as $ from "svelte/internal/client";
 import { onDestroy } from "svelte";
+//#region src/svelte/PermissionBoundary.svelte
+function PermissionBoundary$1($$anchor, $$props) {
+	$.push($$props, true);
+	let refused = $.state(null);
+	function onerror(error, reset) {
+		const digest = boundaryDigest(error);
+		if (digest === null) throw error;
+		$.set(refused, {
+			...digest,
+			retry: () => {
+				$.set(refused, null);
+				reset();
+			}
+		}, true);
+	}
+	var fragment = $.comment();
+	var node = $.first_child(fragment);
+	{
+		const failed = ($$anchor) => {
+			var fragment_1 = $.comment();
+			var node_1 = $.first_child(fragment_1);
+			var consequent = ($$anchor) => {
+				const fallback = $.derived(() => boundaryFallback($.get(refused), {
+					denied: $$props.denied,
+					approval: $$props.approval
+				}));
+				var fragment_2 = $.comment();
+				var node_2 = $.first_child(fragment_2);
+				$.snippet(node_2, () => $.get(fallback) ?? $.noop, () => $.get(refused));
+				$.append($$anchor, fragment_2);
+			};
+			$.if(node_1, ($$render) => {
+				if ($.get(refused) !== null) $$render(consequent);
+			});
+			$.append($$anchor, fragment_1);
+		};
+		$.boundary(node, {
+			onerror,
+			failed
+		}, ($$anchor) => {
+			var fragment_3 = $.comment();
+			var node_3 = $.first_child(fragment_3);
+			$.snippet(node_3, () => $$props.children ?? $.noop);
+			$.append($$anchor, fragment_3);
+		});
+	}
+	$.append($$anchor, fragment);
+	$.pop();
+}
+//#endregion
 //#region src/svelte/Protected.svelte
 function Protected$1($$anchor, $$props) {
 	$.push($$props, true);
@@ -14,9 +66,10 @@ function Protected$1($$anchor, $$props) {
 	onDestroy(store.subscribe(() => {
 		$.set(tick, $.get(tick) + 1);
 	}));
+	const scoped = $.derived(() => scopedFor(store, $$props.tenant, $.get(tick)));
 	const view = $.derived(() => {
 		const generation = $.get(tick);
-		return protectedView(store, $$props.permission, $$props.data, $$props.tenant, generation);
+		return viewFor(store, $$props.permission, $$props.data, $.get(scoped), generation);
 	});
 	var fragment = $.comment();
 	var node = $.first_child(fragment);
@@ -49,5 +102,6 @@ function Protected$1($$anchor, $$props) {
 //#endregion
 //#region src/svelte/index.ts
 const Protected = Protected$1;
+const PermissionBoundary = PermissionBoundary$1;
 //#endregion
-export { Protected, approval, approvalHeaders, assignable, assignablePermissions, describe, filtered, getPermDock, memberships, permission, permissions, requiredPlans, roles, setPermDock, subject, tenant };
+export { PermissionBoundary, Protected, approval, approvalHeaders, assignable, assignablePermissions, describe, filtered, getPermDock, memberships, permission, permissions, requiredPlans, roles, setPermDock, subject, tenant };

package/dist/svelte/runtime.d.ts

@@ -1,6 +1,7 @@
-import { t as ClientStore } from "../store-Bq90395i.js";
-import { n as protectedView, t as ProtectedProps } from "../protected-wY7nXhY9.js";
+import { n as boundaryDigest, r as boundaryFallback, t as PermissionBoundaryState } from "../boundary-BmHxVH1J.js";
+import { t as ClientStore } from "../store-D_pjn91-.js";
+import { i as PermissionBoundaryProps, n as scopedFor, r as viewFor, t as ProtectedProps } from "../protected-bZs6rbT1.js";
 //#region src/svelte/context.d.ts
 export declare function getStore(): ClientStore;
 //#endregion
-export { type ProtectedProps, protectedView };
+export { type PermissionBoundaryProps, type PermissionBoundaryState, type ProtectedProps, boundaryDigest, boundaryFallback, scopedFor, viewFor };

package/dist/svelte/runtime.js

@@ -1,3 +1,4 @@
-import { t as getStore } from "../context-CKEAabd7.js";
-import { t as protectedView } from "../runtime-DP9ttFh1.js";
-export { getStore, protectedView };
+import { n as boundaryFallback, t as boundaryDigest } from "../boundary-BM8a_P6E.js";
+import { t as getStore } from "../context-Ttp0ekMT.js";
+import { n as viewFor, t as scopedFor } from "../runtime-CB8gQFvS.js";
+export { boundaryDigest, boundaryFallback, getStore, scopedFor, viewFor };

package/dist/svelte/source.d.ts

@@ -1,10 +1,13 @@
-import { i as describe } from "../describe-DernyItf.js";
-import { t as approvalHeaders } from "../headers-C8SHQccD.js";
-import { a as FilterResult, c as PermissionState, d as TenantView, f as UseRolesOptions, i as ClientStatus, n as ApprovalState, r as ClientPermDock, s as PermissionSet, t as ApprovalHandle, u as SubjectView } from "../types-DbWdEfcm.js";
-import { a as getPermDock, c as permissions, d as subject, f as tenant, i as filtered, l as roles, n as assignable, o as memberships, p as PermDockSvelteOptions, r as assignablePermissions, s as permission, t as approval, u as setPermDock } from "../stores-CvOnu_2T.js";
-import { t as ProtectedProps } from "../protected-wY7nXhY9.js";
+import { n as requiredPlans } from "../problem-details-CkL50EEf.js";
+import { i as describe } from "../describe-PdoqESvg.js";
+import { t as PermissionBoundaryState } from "../boundary-BmHxVH1J.js";
+import { t as approvalHeaders } from "../headers-Cf-zWvsO.js";
+import { a as FilterResult, c as SubjectView, i as ClientStatus, l as TenantView, n as ApprovalState, o as PermissionSet, r as ClientPermDock, s as PermissionState, t as ApprovalHandle, u as UseRolesOptions } from "../types-kxznc7cn.js";
+import { i as PermissionBoundaryProps, t as ProtectedProps } from "../protected-bZs6rbT1.js";
+import { a as getPermDock, c as permissions, d as subject, f as tenant, i as filtered, l as roles, n as assignable, o as memberships, p as PermDockSvelteOptions, r as assignablePermissions, s as permission, t as approval, u as setPermDock } from "../stores-DVR5NHLE.js";
 import { Component } from "svelte";
 //#region src/svelte/source.d.ts
 export declare const Protected: Component<ProtectedProps>;
+export declare const PermissionBoundary: Component<PermissionBoundaryProps>;
 //#endregion
-export { type ApprovalHandle, type ApprovalState, type ClientPermDock, type ClientStatus, type FilterResult, type PermDockSvelteOptions, type PermissionSet, type PermissionState, type ProtectedProps, type SubjectView, type TenantView, type UseRolesOptions, approval, approvalHeaders, assignable, assignablePermissions, describe, filtered, getPermDock, memberships, permission, permissions, roles, setPermDock, subject, tenant };
+export { type ApprovalHandle, type ApprovalState, type ClientPermDock, type ClientStatus, type FilterResult, type PermDockSvelteOptions, type PermissionBoundaryProps, type PermissionBoundaryState, type PermissionSet, type PermissionState, type ProtectedProps, type SubjectView, type TenantView, type UseRolesOptions, approval, approvalHeaders, assignable, assignablePermissions, describe, filtered, getPermDock, memberships, permission, permissions, requiredPlans, roles, setPermDock, subject, tenant };

package/dist/svelte/source.js

@@ -1,8 +1,11 @@
-import { t as describe } from "../describe-Bt1YD5uS.js";
-import { t as approvalHeaders } from "../headers-B5RRv3Xm.js";
-import { a as getPermDock, c as permissions, d as subject, f as tenant, i as filtered, l as roles, n as assignable, o as memberships, r as assignablePermissions, s as permission, t as approval, u as setPermDock } from "../stores-CkG2HrSg.js";
+import { r as requiredPlans } from "../problem-details-_AMOYz-w.js";
+import { t as describe } from "../describe-B_gVZEVi.js";
+import { t as approvalHeaders } from "../headers-BZSDieNT.js";
+import { a as getPermDock, c as permissions, d as subject, f as tenant, i as filtered, l as roles, n as assignable, o as memberships, r as assignablePermissions, s as permission, t as approval, u as setPermDock } from "../stores-4_sqiOA1.js";
+import PermissionBoundaryComponent from "./PermissionBoundary.svelte";
 import ProtectedComponent from "./Protected.svelte";
 //#region src/svelte/source.ts
 const Protected = ProtectedComponent;
+const PermissionBoundary = PermissionBoundaryComponent;
 //#endregion
-export { Protected, approval, approvalHeaders, assignable, assignablePermissions, describe, filtered, getPermDock, memberships, permission, permissions, roles, setPermDock, subject, tenant };
+export { PermissionBoundary, Protected, approval, approvalHeaders, assignable, assignablePermissions, describe, filtered, getPermDock, memberships, permission, permissions, requiredPlans, roles, setPermDock, subject, tenant };

package/dist/terminal/index.d.ts

@@ -1,7 +1,8 @@
-import { $ as DecisionSink, C as Policy, E as PolicyVocabulary, Mn as Decision, Zt as PermDock, at as LimitStore, ct as MembershipSource, ft as RelationSource, hr as Subject, mr as Principal, pt as RoleSource, sn as PolicySource, tt as EntitlementSource } from "../policy-CInmNGkM.js";
-import { d as Permission } from "../permissions-B4apnahQ.js";
-import { f as ApprovalStore } from "../types-B8w5PFtS.js";
-import { o as ProblemDetails, t as ApprovalHint } from "../errors-DbZ1YOnb.js";
+import { C as Policy, D as PolicyVocabulary, Nr as Principal, Pr as Subject, Yn as Decision, ln as PermDock } from "../policy-CFZAr_Al.js";
+import { f as Permission } from "../permissions-DttnqqxC.js";
+import { f as ApprovalStore } from "../types-vKyAMtcX.js";
+import { a as ProblemDetails, t as ApprovalHint } from "../errors-DAqevpNk.js";
+import { t as InstanceOptions } from "../instance-options-BK_rNOSC.js";
 //#region src/terminal/types.d.ts
 type TokenSourceName = "device" | "keychain" | "env" | "ci-oidc";
 type TokenSource = TokenSourceName | {
@@ -78,20 +79,11 @@ type TerminalStorageOptions = {
    */
   readonly keyring?: new (service: string, account: string) => KeyringEntry;
 };
-type TerminalPermDockOptions<TUser = unknown> = {
+type TerminalPermDockOptions<TUser = unknown> = InstanceOptions & {
   readonly subject: (context: TokenContext) => TUser | Promise<TUser>;
   readonly actor?: (context: TokenContext) => unknown;
   readonly tenant?: string;
-  readonly memberships?: MembershipSource | readonly MembershipSource[];
-  /** The object graph for relation grants that walk a parent chain; without it they deny. */
-  readonly relations?: RelationSource;
-  readonly entitlements?: EntitlementSource;
-  readonly customRoles?: RoleSource;
-  /** Hosted grants, read once per instance; see `PolicySource`. */
-  readonly policies?: PolicySource;
   readonly store?: ApprovalStore;
-  readonly sink?: DecisionSink;
-  readonly limits?: LimitStore;
   readonly storage?: TerminalStorageOptions;
   readonly device?: DeviceFlowOptions;
   readonly interactive?: boolean | {

package/dist/terminal/index.js

@@ -1,9 +1,11 @@
 import { t as compact } from "../compact-y6vfu2_f.js";
-import { a as approvalMessage, n as PermDockDeniedError, o as deniedMessage, t as PermDockApprovalRequiredError } from "../errors-Iy71s7Oj.js";
-import { t as createPermDock$1 } from "../permdock-yoZ7EjxX.js";
+import { a as deniedMessage, i as approvalMessage, n as PermDockDeniedError, t as PermDockApprovalRequiredError } from "../errors-Cz5zn0mW.js";
+import { t as createPermDock$1 } from "../permdock-CzqXjCpU.js";
+import { n as resourceRef } from "../resource-ref-CaS9yVPi.js";
 import { i as isSubject } from "../subject-C6dLxqHU.js";
-import { l as storedApprovalToken, s as resumeDecision } from "../helpers-DnSOrhB9.js";
+import { l as storedApprovalToken, s as resumeDecision } from "../helpers-H_KARDVC.js";
 import { t as timeoutSignal } from "../timeout-D51niuQP.js";
+import { t as instanceOptions } from "../instance-options-Dhhcnm3y.js";
 import { mkdirSync, readFileSync, statSync, unlinkSync, writeFileSync } from "node:fs";
 import path from "node:path";
 import { createInterface } from "node:readline";
@@ -492,6 +494,15 @@ async function resolveToken(sources, options) {
 }
 //#endregion
 //#region src/terminal/create.ts
+/** A thrown subject, loader or decision, or an instance check without a row. */
+const FAILED_CLOSED = {
+	outcome: "denied",
+	denials: [{
+		role: null,
+		reason: "validation"
+	}],
+	alternatives: []
+};
 function writeOf(options) {
 	return options.runtime?.write ?? ((text) => {
 		process.stderr.write(text);
@@ -542,16 +553,6 @@ function actorFromResolved(value) {
 	if (typeof value === "object" && value !== null && "id" in value && "kind" in value && typeof value.id === "string" && typeof value.kind === "string") return { actor: value };
 	return {};
 }
-function resourceRef(permission, data) {
-	if (data !== null && typeof data === "object" && "id" in data) {
-		const id = data.id;
-		if (typeof id === "string" || typeof id === "number") return {
-			type: permission.resource,
-			id: String(id)
-		};
-	}
-	return { type: permission.resource };
-}
 function defaultConfirm(input) {
 	const rl = createInterface({
 		input: process.stdin,
@@ -625,13 +626,7 @@ function createPermDock(policy, options) {
 			tenant: options.tenant,
 			actor,
 			delegation,
-			memberships: options.memberships,
-			relations: options.relations,
-			entitlements: options.entitlements,
-			customRoles: options.customRoles,
-			policies: options.policies,
-			sink: options.sink,
-			limits: options.limits
+			...instanceOptions(options)
 		}));
 		last = built;
 		return built;
@@ -652,18 +647,35 @@ function createPermDock(policy, options) {
 		return filterCommandEntries(next.permdock ?? last, entries, next);
 	};
 	const protect = (permission, load) => (action) => async (...args) => {
-		const instance = await permdock();
-		let data;
-		if (load !== void 0) data = await load(...args);
-		const decide = instance.decide;
 		const dryRun = flag(options, options.dryRun, ["--dry-run"]);
-		const first = decide(permission, data, dryRun ? {
-			source: "simulate",
-			adapter: "terminal"
-		} : {
-			source: "adapter",
-			adapter: "terminal"
-		});
+		let instance;
+		let data;
+		let decide;
+		let first;
+		try {
+			instance = await permdock();
+			if (load !== void 0) {
+				data = await load(...args);
+				if (permission.kind === "instance" && (data === null || data === void 0)) {
+					write(format(FAILED_CLOSED, {
+						permission,
+						subject: instance.subject
+					}));
+					return exit(exitCode(FAILED_CLOSED));
+				}
+			}
+			decide = instance.decide;
+			first = decide(permission, data, dryRun ? {
+				source: "simulate",
+				adapter: "terminal"
+			} : {
+				source: "adapter",
+				adapter: "terminal"
+			});
+		} catch {
+			write(format(FAILED_CLOSED, { permission }));
+			return exit(exitCode(FAILED_CLOSED));
+		}
 		if (dryRun) {
 			write(first.outcome === "granted" ? jsonOutput(options) ? `${JSON.stringify({
 				outcome: "granted",
@@ -766,7 +778,7 @@ function createPermDock(policy, options) {
 				store: options.store,
 				resource: resourceRef(permission, data),
 				adapter: "terminal",
-				token: await storedApprovalToken(options.store, first, false)
+				token: await storedApprovalToken(options.store, first)
 			});
 			if (resumed.outcome !== "granted") {
 				write(format(resumed, {