permdock 0.1.0 → 0.3.0

package/dist/{types-BBK-exvJ.d.ts → types-Dnemwd77.d.ts}

@@ -1,4 +1,4 @@
-import { b as ResourceRelation } from "./permissions-B4apnahQ.js";
+import { S as ResourceRelation } from "./permissions-DttnqqxC.js";
 //#region src/catalog/types.d.ts
 type CatalogUsage = {
   readonly file: string;
@@ -15,6 +15,8 @@ type CatalogPermission = {
   readonly usages: readonly CatalogUsage[];
   /** Keys the permission was renamed from (`definePermissions` `renamed`), sorted; absent when none. */
   readonly renamedFrom?: readonly string[];
+  /** Level names a custom role may pick for the permission (`resource(…, { levels })`); absent when none. */
+  readonly levels?: readonly string[];
   /** Present only when the policy lists the permission in `hostable`. */
   readonly hostable?: true;
   /**
@@ -61,6 +63,7 @@ type CatalogResource = {
   readonly version?: string;
   /** The boolean column that keeps ancestor grants out of a row. */
   readonly restricted?: string;
+  readonly restrictedStops?: readonly string[];
 };
 type CatalogRole = {
   readonly key: string;
@@ -134,6 +137,8 @@ type CatalogGrant = {
   readonly validity?: CatalogValidity;
   readonly name?: string;
   readonly purpose?: readonly string[];
+  /** The permission key the subject must also hold through a role on the row's scope instance (`requires`). */
+  readonly requires?: string | readonly string[];
   readonly limit?: {
     readonly count: number;
     readonly per: string;
@@ -169,6 +174,7 @@ type CatalogDelegation = {
   readonly to: {
     readonly kind: string;
     readonly id?: string;
+    readonly client?: string;
   };
   readonly permissions: readonly string[];
   readonly validity?: CatalogValidity;

package/dist/{types-BvBk1wgn.d.ts → types-DxiCGmmd.d.ts}

@@ -1,5 +1,5 @@
-import { C as Policy, Cn as ArazzoPlan, E as PolicyVocabulary, In as ExplainedDecision, Mn as Decision, Qt as PermDockOptions, Xt as DecideOptions, Zt as PermDock, en as SimulateOptions, hr as Subject, mr as Principal, pr as Membership, tn as WhereResult, wn as ArazzoSimulateInput } from "./policy-CInmNGkM.js";
-import { d as Permission, p as PermissionTree } from "./permissions-B4apnahQ.js";
+import { $n as ExplainedDecision, C as Policy, D as PolicyVocabulary, In as ArazzoPlan, Ln as ArazzoSimulateInput, Mr as Membership, Nr as Principal, Pr as Subject, Yn as Decision, cn as DeriveOptions, fn as SimulateOptions, ln as PermDock, mn as WhereResult, sn as DecideOptions, un as PermDockOptions } from "./policy-IB6yxpC3.js";
+import { f as Permission, m as PermissionTree } from "./permissions-DttnqqxC.js";
 //#region src/pdp/types.d.ts
 type RemotePdpAuth = {
   readonly bearer: string | (() => string | Promise<string>);
@@ -84,7 +84,9 @@ type SpiceDbOptions = {
   readonly cache?: RemotePdpCache;
   readonly fetch?: typeof fetch;
 };
-type PdpPermDock<V extends PolicyVocabulary = PolicyVocabulary> = Omit<PermDock<V>, "can" | "decide" | "assert" | "explain" | "filter" | "where" | "simulate" | "tenant" | "team"> & {
+type PdpPermDock<V extends PolicyVocabulary = PolicyVocabulary> = Omit<PermDock<V>, "can" | "decide" | "assert" | "explain" | "filter" | "where" | "simulate" | "tenant" | "team" | "derive"> & {
+  /** `permdock.derive` with the same providers: the result asks the PDP too. */
+  readonly derive: (options: DeriveOptions) => PdpPermDock<V> | Promise<PdpPermDock<V>>;
   /**
    * For a delegated permission whose provider lists ids, an `in` over them
    * (AND the local condition when local grants exist); otherwise the local

package/dist/{types-B9dmiiab.d.ts → types-QCuYJh4q.d.ts}

@@ -1,4 +1,4 @@
-import { E as PolicyVocabulary, Z as DecisionEvent, Zt as PermDock } from "./policy-CInmNGkM.js";
+import { D as PolicyVocabulary, ln as PermDock, rt as DecisionEvent } from "./policy-IB6yxpC3.js";
 //#region src/otel/types.d.ts
 declare const GENAI_SEMCONV_PIN = "1.37.0";
 declare const GEN_AI_TOOL_NAME = "gen_ai.tool.name";

package/dist/{types-B8w5PFtS.d.ts → types-aqOHTHcp.d.ts}

@@ -1,4 +1,4 @@
-import { U as Approver, hr as Subject, o as ApprovalStage, pr as Membership, qn as RelationGrantee, r as ApprovalMode } from "./policy-CInmNGkM.js";
+import { G as Approver, Mr as Membership, Pr as Subject, dr as RelationGrantee, o as ApprovalStage, r as ApprovalMode } from "./policy-IB6yxpC3.js";
 //#region src/approvals/types.d.ts
 type ApprovalStatus = "pending" | "approved" | "rejected" | "expired";
 type ApprovalApprovers = {
@@ -24,6 +24,7 @@ type ApprovalSignature = {
   readonly by: string;
   readonly at: string;
   readonly stage?: number;
+  readonly vouched?: string;
 };
 type ApprovalSubjectSummary = {
   readonly principal: {
@@ -63,6 +64,7 @@ type ApprovalRequest = {
   readonly resolvedAt?: string;
   /** The approver whose verdict resolved the request (the last of `approvals` on a quorum), or `system:<by>` for a cancellation. */
   readonly resolvedBy?: string;
+  readonly vouched?: string;
   readonly note?: string;
   readonly consumedAt?: string;
 };
@@ -77,6 +79,14 @@ type ApprovalVerdict = {
    * none, so relation approvers match nobody.
    */
   readonly relations?: readonly string[];
+  /**
+   * The `holder(permission)` approvers (by permission key) that `by` holds
+   * in the request's tenant, as `approverPermissions` read them from the
+   * approver's own instance. Server-side input, never from the request body.
+   * Absent means none, so permission approvers match nobody.
+   */
+  readonly permissions?: readonly string[];
+  readonly vouched?: string;
 };
 type ApprovalListFilter = {
   readonly status?: ApprovalStatus;
@@ -104,6 +114,12 @@ type ApprovalCancelMeta = {
   readonly note?: string;
 };
 type ApprovalStore = {
+  /**
+   * How long a request opened against this store stays open, in
+   * milliseconds, when the caller sets no `ttl`; absent means
+   * `DEFAULT_APPROVAL_TTL_MS`. A grant's `approval.ttl` still caps it.
+   */
+  readonly ttl?: number;
   create(request: ApprovalRequest): Promise<void> | void;
   get(token: string): Promise<ApprovalRequest | null> | ApprovalRequest | null;
   resolve(token: string, verdict: ApprovalVerdict): Promise<ApprovalRequest> | ApprovalRequest;

package/dist/unplugin/index.d.ts

@@ -1,4 +1,4 @@
-import { a as PermDockPluginOptions } from "../types-D6Z6-rKJ.js";
+import { a as PermDockPluginOptions } from "../types-DbjRN55U.js";
 import { createUnplugin } from "unplugin";
 //#region src/unplugin/index.d.ts
 type CreateUnplugin = typeof createUnplugin<PermDockPluginOptions | undefined>;

package/dist/unplugin/index.js

@@ -1,4 +1,4 @@
-import { n as runPluginCollect } from "../plugin-4gr7IxFJ.js";
+import { n as createCollectScheduler, r as report } from "../watch-DVBJ9cBq.js";
 import { t as peerHint } from "../peer-BOr_kJE1.js";
 import { createRequire } from "node:module";
 //#region src/unplugin/index.ts
@@ -9,19 +9,20 @@ function loadCreateUnplugin() {
 		throw new Error(peerHint("unplugin", "permdock/unplugin"));
 	}
 }
-function report(message) {
-	if (message !== void 0) process.stderr.write(`permdock: ${message}\n`);
-}
 function collectPlugin(options) {
+	const schedulers = /* @__PURE__ */ new Map();
+	function schedulerFor(cwd) {
+		const scheduler = schedulers.get(cwd) ?? createCollectScheduler(cwd, options);
+		schedulers.set(cwd, scheduler);
+		return scheduler;
+	}
 	return {
 		name: "permdock-collect",
 		async buildStart() {
-			report(await runPluginCollect(process.cwd(), options, options?.check === true));
+			report(await schedulerFor(process.cwd()).run(options?.check === true));
 		},
-		watchChange() {
-			runPluginCollect(process.cwd(), options, false).then(report, (error) => {
-				report(error instanceof Error ? error.message : String(error));
-			});
+		watchChange(id) {
+			schedulerFor(process.cwd()).changed(id);
 		}
 	};
 }

package/dist/usage-DorAJiU_.js

@@ -0,0 +1,2 @@
+import { t as runUsage } from "./usage-ItS7nLcl.js";
+export { runUsage };

package/dist/{usage-1ozMubLY.js → usage-GTixvDDU.js}

@@ -1,4 +1,4 @@
-import { a as listArg, i as globalArgs, t as COMMAND_DESCRIPTIONS } from "./commands-BMh_Etm2.js";
+import { a as listArg, i as globalArgs, t as COMMAND_DESCRIPTIONS } from "./commands-DSxCqG9A.js";
 import { defineCommand } from "citty";
 //#region src/cli/commands/usage.ts
 function usage(ctx) {
@@ -24,7 +24,7 @@ function usage(ctx) {
 			}
 		},
 		async run({ args: parsed, rawArgs }) {
-			const result = await (await import("./usage-PyEor6GA.js")).runUsage({
+			const result = await (await import("./usage-DorAJiU_.js")).runUsage({
 				cwd: ctx.cwd,
 				config: ctx.config,
 				ignore: listArg(rawArgs, "ignore"),

package/dist/{usage-CUnK6Ou9.js → usage-ItS7nLcl.js}

@@ -1,40 +1,77 @@
-import { c as getResource } from "./permissions-DC7GROPA.js";
-import { i as USAGE_REPORT_SCHEMA } from "./version-CnSh33Fj.js";
-import { o as jsonSchemaOf } from "./catalog-doc-BSo_Q_-6.js";
-import { n as listSourceFiles, r as rel } from "./files-B_wAGYmt.js";
-import { a as loadModule, n as asPolicy, o as pickNamed } from "./load-BZ24CpZP.js";
-import { t as runCollect } from "./collect-O-tOtbnk.js";
-import { a as usageResult } from "./errors-DSMnAVNa.js";
-import { existsSync, readFileSync } from "node:fs";
-import { resolve } from "node:path";
-import { parseSync } from "oxc-parser";
+import { c as getResource } from "./permissions-DVoF6dMt.js";
+import { o as usageResult } from "./errors-CWfoNg9N.js";
+import { a as USAGE_REPORT_SCHEMA } from "./version-BvacVTZR.js";
+import { o as jsonSchemaOf } from "./catalog-doc-DdGm82XT.js";
+import { i as rel, r as listSourceFiles } from "./files-DWUN9PzI.js";
+import { a as loadModule, n as asPolicy, o as pickNamed } from "./load-DhWEB9P1.js";
+import { r as runCollect } from "./collect-DSTE3ml9.js";
+import { existsSync, readFileSync, realpathSync } from "node:fs";
+import { dirname, resolve } from "node:path";
+import { fileURLToPath, pathToFileURL } from "node:url";
+import { createJiti } from "jiti";
+import { Visitor, parseSync } from "oxc-parser";
+import { isBuiltin } from "node:module";
 //#region src/cli/doctor-source.ts
+/** Entries a client file must not import; `tests/cli/doctor-entries.test.ts` keeps it in step with `exports`. */
 const SERVER_SPECIFIERS = [
-	"permdock/server",
-	"permdock/next",
-	"permdock/hono",
-	"permdock/mcp",
+	"permdock/a2a",
+	"permdock/ai-sdk",
 	"permdock/approvals",
-	"permdock/jwt",
-	"permdock/supabase",
-	"permdock/ssf",
+	"permdock/authzen",
 	"permdock/better-auth",
+	"permdock/better-supabase",
+	"permdock/claude-agent",
 	"permdock/clerk",
+	"permdock/cloud",
 	"permdock/convex",
-	"permdock/pdp",
-	"permdock/ai-sdk",
-	"permdock/claude-agent",
+	"permdock/drizzle",
+	"permdock/elysia",
 	"permdock/eve",
-	"permdock/openai"
-];
-const ADAPTER_SPECIFIERS = [
+	"permdock/express",
+	"permdock/fastify",
 	"permdock/hono",
-	"permdock/next",
+	"permdock/jwt",
+	"permdock/kysely",
 	"permdock/mcp",
+	"permdock/nest",
+	"permdock/next",
+	"permdock/node",
+	"permdock/openai",
+	"permdock/openapi",
+	"permdock/orpc",
+	"permdock/otel",
+	"permdock/pdp",
+	"permdock/prisma",
+	"permdock/scim",
+	"permdock/server",
+	"permdock/ssf",
+	"permdock/supabase",
+	"permdock/supabase/middleware",
+	"permdock/terminal",
+	"permdock/trpc"
+];
+/** Entries that feed request, tool or model data into a check. */
+const ADAPTER_SPECIFIERS = [
+	"permdock/a2a",
 	"permdock/ai-sdk",
+	"permdock/authzen",
 	"permdock/claude-agent",
+	"permdock/elysia",
+	"permdock/eve",
 	"permdock/express",
-	"permdock/fastify"
+	"permdock/fastify",
+	"permdock/hono",
+	"permdock/mcp",
+	"permdock/nest",
+	"permdock/next",
+	"permdock/node",
+	"permdock/openai",
+	"permdock/orpc",
+	"permdock/server",
+	"permdock/supabase/middleware",
+	"permdock/terminal",
+	"permdock/trpc",
+	"permdock/webmcp"
 ];
 const UNTRUSTED_CLAIMS = [
 	"user_metadata",
@@ -43,7 +80,6 @@ const UNTRUSTED_CLAIMS = [
 	"clientMetadata",
 	"preferred_username"
 ];
-const JWKS_OPTION = /(?<!\b(?:const|let|var)\s+)\bjwks\s*:/u;
 function withoutComments(source) {
 	const { comments } = parseSync(source.file, source.text);
 	let text = source.text;
@@ -53,10 +89,62 @@ function withoutComments(source) {
 function isClientSource(source, clientEntries) {
 	return clientEntries.has(source.file) || source.text.includes("'use client'") || source.text.includes("\"use client\"") || source.file.includes(".client.");
 }
-function pd001(sources, clientEntries = /* @__PURE__ */ new Set()) {
+/** Specifiers a module loads at runtime: value imports, re-exports and literal dynamic imports. */
+function runtimeSpecifiers(source) {
+	const { module } = parseSync(source.file, source.text);
+	const out = /* @__PURE__ */ new Set();
+	for (const item of module.staticImports) if (item.entries.length === 0 || item.entries.some((entry) => !entry.isType)) out.add(item.moduleRequest.value);
+	for (const item of module.staticExports) for (const entry of item.entries) if (entry.moduleRequest !== null && !entry.isType) out.add(entry.moduleRequest.value);
+	for (const item of module.dynamicImports) {
+		const literal = /^\s*(['"`])([^'"`$]+)\1\s*$/u.exec(source.text.slice(item.moduleRequest.start, item.moduleRequest.end));
+		if (literal?.[2] !== void 0) out.add(literal[2]);
+	}
+	return [...out];
+}
+function realFile(path) {
+	try {
+		return realpathSync(path);
+	} catch {
+		return path;
+	}
+}
+/**
+* A resolver for imports of `file`, the way the bundler resolves them:
+* relative paths with or without an extension, the `paths` of the nearest
+* `tsconfig.json`, and package names through `node_modules` and each
+* package's `exports`. An unresolvable specifier gives `undefined`.
+*/
+function resolverFor(file) {
+	const jiti = createJiti(file, { tsconfigPaths: dirname(file) });
+	const parentURL = pathToFileURL(file);
+	return (specifier) => {
+		if (specifier === "" || isBuiltin(specifier)) return;
+		try {
+			const url = jiti.esmResolve(specifier, {
+				parentURL,
+				try: true
+			});
+			const path = url?.startsWith("file:") === true ? fileURLToPath(url) : void 0;
+			return path !== void 0 && existsSync(path) ? realFile(path) : void 0;
+		} catch {
+			return;
+		}
+	};
+}
+function pd001(sources, clientEntries = /* @__PURE__ */ new Set(), policy) {
 	const findings = [];
+	const policyFile = policy === void 0 ? void 0 : realFile(resolve(policy.cwd, policy.path));
 	for (const source of sources) {
 		if (!isClientSource(source, clientEntries)) continue;
+		if (policy !== void 0 && policyFile !== void 0) {
+			const resolveImport = resolverFor(resolve(policy.cwd, source.file));
+			for (const specifier of runtimeSpecifiers(source)) if (specifier !== "permdock" && !specifier.startsWith("permdock/") && resolveImport(specifier) === policyFile) findings.push({
+				code: "PD001",
+				severity: "error",
+				message: `${source.file} imports the policy module through ${specifier}`,
+				fix: "decide on the server and pass a snapshot to the client ('permdock/react'); never import the policy into a client entry"
+			});
+		}
 		for (const spec of SERVER_SPECIFIERS) if (source.text.includes(`'${spec}'`) || source.text.includes(`"${spec}"`)) findings.push({
 			code: "PD001",
 			severity: "error",
@@ -137,29 +225,92 @@ function pd013(sources) {
 	}
 	return findings;
 }
+function unwrapped(node) {
+	let current = node ?? void 0;
+	while (current?.type === "TSAsExpression" || current?.type === "TSSatisfiesExpression" || current?.type === "ParenthesizedExpression") current = current.expression;
+	return current;
+}
+function propertyName(property) {
+	if (property.computed) return;
+	const key = property.key;
+	if (key.type === "Identifier") return key.name;
+	return key.type === "Literal" && typeof key.value === "string" ? key.value : void 0;
+}
+function stringValue(node) {
+	const value = unwrapped(node);
+	if (value?.type === "Literal") return typeof value.value === "string" ? value.value : void 0;
+	return value?.type === "TemplateLiteral" ? value.quasis[0]?.value.cooked ?? void 0 : void 0;
+}
+function isPermDockSpecifier(value) {
+	return value === "permdock" || value.startsWith("permdock/");
+}
+function permdockOptionObjects(source) {
+	const { program } = parseSync(source.file, source.text);
+	const functions = /* @__PURE__ */ new Set();
+	const namespaces = /* @__PURE__ */ new Set();
+	const constants = /* @__PURE__ */ new Map();
+	const calls = [];
+	new Visitor({
+		ImportDeclaration(node) {
+			if (node.importKind === "type" || !isPermDockSpecifier(node.source.value)) return;
+			for (const specifier of node.specifiers) if (specifier.type === "ImportNamespaceSpecifier") namespaces.add(specifier.local.name);
+			else if (specifier.type === "ImportDefaultSpecifier" || specifier.importKind !== "type") functions.add(specifier.local.name);
+		},
+		VariableDeclarator(node) {
+			const init = unwrapped(node.init);
+			if (node.id.type === "Identifier" && init?.type === "ObjectExpression") constants.set(node.id.name, init);
+		},
+		CallExpression(node) {
+			calls.push(node);
+		}
+	}).visit(program);
+	const objects = [];
+	const collect = (node) => {
+		const value = unwrapped(node);
+		const target = value?.type === "Identifier" ? constants.get(value.name) : value;
+		if (target?.type !== "ObjectExpression" || objects.includes(target)) return;
+		objects.push(target);
+		for (const property of target.properties) if (property.type === "Property") collect(property.value);
+	};
+	for (const call of calls) {
+		const callee = call.callee;
+		if (callee.type === "Identifier" && functions.has(callee.name) || callee.type === "MemberExpression" && callee.object.type === "Identifier" && namespaces.has(callee.object.name)) for (const argument of call.arguments) collect(argument);
+	}
+	return objects;
+}
 function pd014(sources) {
 	const findings = [];
 	for (const source of sources) {
-		const text = withoutComments(source);
-		if (/discovery:\s*['"]http:/u.test(text)) findings.push({
-			code: "PD014",
-			severity: "error",
-			message: `${source.file} uses a plain-HTTP discovery URL`,
-			fix: "use an https: issuer"
-		});
-		const setsJwks = JWKS_OPTION.test(text);
-		if (/discovery\s*:/u.test(text) && setsJwks) findings.push({
-			code: "PD014",
-			severity: "error",
-			message: `${source.file} sets discovery together with jwks or issuer`,
-			fix: "use discovery alone, or jwks plus issuer"
-		});
-		if (setsJwks && !/\bissuer\s*[:,}]/u.test(text) && !/discovery\s*:/u.test(text)) findings.push({
-			code: "PD014",
-			severity: "error",
-			message: `${source.file} sets jwks without issuer`,
-			fix: "set issuer with jwks, or switch to discovery"
-		});
+		if (!source.text.includes("permdock")) continue;
+		for (const object of permdockOptionObjects(source)) {
+			const keys = /* @__PURE__ */ new Map();
+			for (const property of object.properties) {
+				if (property.type !== "Property") continue;
+				const name = propertyName(property);
+				if (name !== void 0) keys.set(name, property.value);
+			}
+			const discovery = keys.get("discovery");
+			const setsDiscovery = keys.has("discovery");
+			const setsJwks = keys.has("jwks");
+			if (stringValue(discovery)?.startsWith("http:") === true) findings.push({
+				code: "PD014",
+				severity: "error",
+				message: `${source.file} uses a plain-HTTP discovery URL`,
+				fix: "use an https: issuer"
+			});
+			if (setsDiscovery && (setsJwks || keys.has("issuer"))) findings.push({
+				code: "PD014",
+				severity: "error",
+				message: `${source.file} sets discovery together with jwks or issuer`,
+				fix: "use discovery alone, or jwks plus issuer"
+			});
+			if (setsJwks && !setsDiscovery && !keys.has("issuer")) findings.push({
+				code: "PD014",
+				severity: "error",
+				message: `${source.file} sets jwks without issuer`,
+				fix: "set issuer with jwks, or switch to discovery"
+			});
+		}
 	}
 	return findings;
 }
@@ -288,7 +439,7 @@ function pd036(sources) {
 		for (const match of source.text.matchAll(PROTECT_CALL)) {
 			const open = match.index + match[0].length - 1;
 			const args = callArguments(source.text, open);
-			if (args?.length !== 1) continue;
+			if (args?.length !== 1 || args[0]?.trim() === "null") continue;
 			const route = idRouteOf(source, match.index);
 			if (route === void 0) continue;
 			const line = source.text.slice(0, match.index).split("\n").length;
@@ -305,14 +456,14 @@ function pd036(sources) {
 //#endregion
 //#region src/cli/usage.ts
 async function runUsage(input) {
-	const collected = await runCollect({
+	const collected = input.collected === void 0 ? await runCollect({
 		cwd: input.cwd,
 		config: input.config,
 		collect: input.config.collect ?? {},
 		check: true,
 		now: input.now,
 		io: input.io
-	});
+	}) : await input.collected();
 	if (collected.document === void 0 || collected.scan === void 0) return {
 		code: 2,
 		output: collected.message
@@ -322,17 +473,8 @@ async function runUsage(input) {
 		code: 2,
 		output: "usage: set policy in permdock.config.ts"
 	};
-	const policyAbs = resolve(input.cwd, policyRel);
-	if (!existsSync(policyAbs)) return {
-		code: 2,
-		output: `PermDock CLI: policy module not found: ${policyRel}`
-	};
-	let policy;
-	try {
-		policy = asPolicy(pickNamed(await loadModule(policyAbs), ["policy"]));
-	} catch (error) {
-		return usageResult(error);
-	}
+	const policy = await usagePolicy(input.cwd, policyRel, input.policy);
+	if (!("roles" in policy)) return policy;
 	const granted = /* @__PURE__ */ new Set();
 	const mergedRoles = /* @__PURE__ */ new Set();
 	for (const role of policy.roles) {
@@ -395,6 +537,22 @@ async function runUsage(input) {
 		output: input.json ? `${JSON.stringify(report, null, 2)}\n` : formatUsage(report)
 	};
 }
+async function usagePolicy(cwd, policyRel, loaded) {
+	if (loaded !== void 0) return await loaded() ?? {
+		code: 2,
+		output: `PermDock CLI: policy module failed to load: ${policyRel}`
+	};
+	const policyAbs = resolve(cwd, policyRel);
+	if (!existsSync(policyAbs)) return {
+		code: 2,
+		output: `PermDock CLI: policy module not found: ${policyRel}`
+	};
+	try {
+		return asPolicy(pickNamed(await loadModule(policyAbs), ["policy"]));
+	} catch (error) {
+		return usageResult(error);
+	}
+}
 const CLIENT_CALLS = /* @__PURE__ */ new Set([
 	"usePermission",
 	"can",
@@ -462,8 +620,13 @@ function conditionFields(condition, out) {
 		case "related":
 			add(condition.field);
 			if (condition.restricted !== void 0) add(condition.restricted);
+			if (condition.restrictedAncestors !== void 0) {
+				add(condition.restrictedAncestors.id);
+				add(condition.restrictedAncestors.parent);
+			}
 			break;
-		case "opaque": break;
+		case "opaque":
+		case "liveSession": break;
 		default: throw new Error(`unknown condition ${String(condition)}`);
 	}
 }

package/dist/validation-error-Ba264OaJ.d.ts

@@ -0,0 +1,26 @@
+import { a as ProblemDetails } from "./errors-DPdqI50v.js";
+import { StandardSchemaV1 } from "@standard-schema/spec";
+//#region src/core/validation-error.d.ts
+/** The base of every Problem Details `type` URI; defined here so a validation error does not pull in the Problem Details builders. */
+declare const PROBLEM_BASE = "https://permdock.com/problems";
+declare class PermDockValidationError extends Error {
+  override readonly name: "PermDockValidationError";
+  readonly code: "invalid-data" | "async-schema" | "no-schema" | "non-portable-condition";
+  readonly permission: string;
+  readonly resource: string;
+  readonly issues: readonly StandardSchemaV1.Issue[];
+  readonly boundary: string;
+  constructor(input: {
+    readonly code: "invalid-data" | "async-schema" | "no-schema" | "non-portable-condition";
+    readonly permission: string;
+    readonly resource: string;
+    readonly issues?: readonly StandardSchemaV1.Issue[];
+    readonly boundary: string;
+    readonly message: string;
+  });
+  toProblemDetails(options?: {
+    readonly instance?: string;
+  }): ProblemDetails;
+}
+//#endregion
+export { PermDockValidationError as n, PROBLEM_BASE as t };

package/dist/validation-error-CnjZ4t92.js

@@ -0,0 +1,33 @@
+import { t as compact } from "./compact-y6vfu2_f.js";
+//#region src/core/validation-error.ts
+/** The base of every Problem Details `type` URI; defined here so a validation error does not pull in the Problem Details builders. */
+const PROBLEM_BASE = "https://permdock.com/problems";
+var PermDockValidationError = class extends Error {
+	name = "PermDockValidationError";
+	code;
+	permission;
+	resource;
+	issues;
+	boundary;
+	constructor(input) {
+		super(input.message);
+		this.code = input.code;
+		this.permission = input.permission;
+		this.resource = input.resource;
+		this.issues = input.issues ?? [];
+		this.boundary = input.boundary;
+	}
+	toProblemDetails(options) {
+		return compact({
+			type: `${PROBLEM_BASE}/validation`,
+			title: "Invalid resource data",
+			status: 400,
+			detail: this.message,
+			instance: options?.instance,
+			permission: this.permission,
+			issues: this.issues
+		});
+	}
+};
+//#endregion
+export { PermDockValidationError as n, PROBLEM_BASE as t };