permdock 0.1.0 → 0.3.0

package/dist/{validity-D0uRmJKJ.js → validity-uOp8UpYn.js}

@@ -1,35 +1,13 @@
-import { n as freezeDeep } from "./freeze-y1_jQL4v.js";
-import { C as ownGet, S as isForbiddenKey, d as isFieldRelation, w as ownKeys } from "./permissions-DC7GROPA.js";
-import { a as resolveScope, c as scopeChain, f as tenantOf, l as scopeIdOf, r as findScope, s as rootScope, t as activeFor } from "./scopes-cKVp_WTw.js";
-//#region src/core/fields.ts
-function sanitizeFields(fields) {
-	if (fields === void 0) return;
-	return fields.filter((field) => field.length > 0 && !isForbiddenKey(field));
-}
-function grantCoversField(fields, field, effect) {
-	if (fields === void 0) return true;
-	if (fields.length === 0) return false;
-	if (field === void 0) return effect === "allow";
-	return fields.includes(field);
-}
-function pickVisible(row, canField) {
-	const out = {};
-	for (const key of ownKeys(row)) if (canField(key)) out[key] = ownGet(row, key);
-	return freezeDeep(out);
-}
-function sanitizeContext(value) {
-	if (value === null || typeof value !== "object" || Array.isArray(value)) return {};
-	const out = {};
-	for (const key of ownKeys(value)) out[key] = ownGet(value, key);
-	return out;
-}
-//#endregion
+import { f as isFieldRelation } from "./permissions-DVoF6dMt.js";
+import { t as expiredAt } from "./expiry-BoBJ8Tvc.js";
+import { n as sameId } from "./ids-DC4V4CFu.js";
+import { c as rootScope, l as scopeChain, m as tenantOf, o as resolveScope, r as findScope, t as activeFor, u as scopeIdOf } from "./scopes-CVdPrWN-.js";
 //#region src/core/tenancy.ts
 function nowSeconds(now) {
 	return now ?? Date.now() / 1e3;
 }
 function isMembershipExpired(membership, now) {
-	return membership.expiresAt !== void 0 && membership.expiresAt <= (now ?? nowSeconds());
+	return expiredAt(membership, now ?? nowSeconds());
 }
 /** The instances of the first scope the subject holds a live membership in. */
 function tenantsOf(principal, scopes, now) {
@@ -42,6 +20,11 @@ function tenantsOf(principal, scopes, now) {
 	}
 	return [...tenants];
 }
+function heldRoleNamesIn(principal, scopes, tenant, now) {
+	const names = /* @__PURE__ */ new Set();
+	for (const membership of principal?.memberships ?? []) if (!isMembershipExpired(membership, now) && membership.keep === void 0 && tenantOf(membership, scopes) === tenant) for (const name of membership.roles) names.add(name);
+	return [...names];
+}
 /** `requested` when a live membership sits in that instance of the first scope; never a default. */
 function resolveActiveTenant(principal, requested, scopes, now) {
 	if (requested === void 0) return principal.tenant;
@@ -62,9 +45,30 @@ function relatesTo(resource, field, scope, scopes) {
 	if (resource === void 0) return false;
 	return Object.values(resource.relations).some((relation) => isFieldRelation(relation) && relation.field === field && relation.memberOf !== void 0 && resolveScope(scopes, relation.memberOf) === scope);
 }
-/** The scopes whose key partitions `resource`, from its `memberOf` relations. */
+/** The fields of `resource`'s `memberOf` relations to `scope`. */
+function memberOfFields(resource, scope, scopes) {
+	return [...new Set(Object.values(resource.relations).flatMap((relation) => isFieldRelation(relation) && relation.memberOf !== void 0 && resolveScope(scopes, relation.memberOf) === scope ? [relation.field] : []))];
+}
+/**
+* The field of `resource` that holds `scope`'s instance id: the scope's
+* `key` when one of the resource's `memberOf` relations names it, otherwise
+* the field of its one `memberOf` relation to the scope. A table whose own
+* id is the instance (`organizations.id`) declares
+* `{ self: { field: 'id', memberOf: 'organization' } }`.
+*/
+function scopeField(resource, scope, scopes) {
+	const key = findScope(scopes, scope)?.key;
+	if (resource === void 0) return key;
+	const fields = memberOfFields(resource, scope, scopes);
+	if (key !== void 0 && fields.includes(key)) return key;
+	return fields.length === 1 ? fields[0] : key;
+}
+/** The scopes that partition `resource`, from its `memberOf` relations. */
 function partitionsOf(resource, scopes) {
-	return scopes.filter((scope) => scope.key !== void 0 && relatesTo(resource, scope.key, scope.name, scopes)).map((scope) => scope.name);
+	return scopes.filter((scope) => {
+		const field = scopeField(resource, scope.name, scopes);
+		return field !== void 0 && relatesTo(resource, field, scope.name, scopes);
+	}).map((scope) => scope.name);
 }
 /**
 * Whether `row` lies inside a named membership's instance: for the scope and
@@ -72,23 +76,36 @@ function partitionsOf(resource, scopes) {
 * resource declares it) must hold the membership's id for it. There is no
 * cascade: the membership's own scope is checked, never a scope below it.
 */
-function rowInScope(membership, scopes, row, partitioned) {
+function rowInScope(membership, scopes, row, partitioned, fieldOf) {
 	if (membership.scope === void 0 || row === null || typeof row !== "object") return { ok: true };
 	const root = rootScope(scopes);
 	const chain = scopeChain(scopes, membership.scope).toReversed();
 	for (const name of chain) {
-		const key = findScope(scopes, name)?.key;
+		const key = fieldOf?.(name) ?? findScope(scopes, name)?.key;
 		if (key === void 0) continue;
 		const value = Object.hasOwn(row, key) ? row[key] : void 0;
-		if ((value !== void 0 || partitioned(name, key)) && value !== scopeIdOf(membership, name)) return {
+		if ((value !== void 0 || partitioned(name, key)) && !sameId(value, scopeIdOf(membership, name))) return {
 			ok: false,
 			reason: name === root ? "tenant-mismatch" : "scope"
 		};
 	}
 	return { ok: true };
 }
-function matchScopedMembership(subject, scope, roleName, row, scopes, resource, resources, now, rolesOf = (membership) => membership.roles, team, walk) {
+/**
+* Whether a membership answers an instance check for `row`: any membership
+* with a row object, otherwise only the first scope or the instance of the
+* second scope that `team(id)` selected.
+*/
+function nestedAppliesWithoutRow(membership, scopes, row, team) {
+	if (row !== null && typeof row === "object") return true;
+	return membership.scope === rootScope(scopes) || team !== void 0 && membership.scope === scopes[1]?.name;
+}
+function matchScopedMembership(subject, scope, roleName, row, scopes, resource, resources, now, rolesOf = (membership) => membership.roles, team, walk, instance = false, only) {
 	if (scope === "global") return { ok: true };
+	if (only !== void 0 && scope !== only) return {
+		ok: false,
+		reason: "scope"
+	};
 	const principal = subject.principal;
 	if (principal === null) return {
 		ok: false,
@@ -108,7 +125,11 @@ function matchScopedMembership(subject, scope, roleName, row, scopes, resource,
 		}
 		if (typeof scope === "string") {
 			if (findScope(scopes, scope) === void 0 || membership.scope !== scope || !inTeam(membership, scopes, team) || !activeFor(membership, scopes, principal.tenant)) continue;
-			const inside = rowInScope(membership, scopes, row, (name, key) => relatesTo(resource, key, name, scopes));
+			if (instance && !nestedAppliesWithoutRow(membership, scopes, row, team)) {
+				sawWrongScope = true;
+				continue;
+			}
+			const inside = rowInScope(membership, scopes, row, (name, key) => relatesTo(resource, key, name, scopes), (name) => scopeField(resource, name, scopes));
 			if (!inside.ok) {
 				if (inside.reason === "tenant-mismatch") sawTenantMismatch = true;
 				else sawWrongScope = true;
@@ -165,7 +186,7 @@ function matchResourceMembership(membership, roleResource, row, resource, resour
 	if (row === null || typeof row !== "object") return false;
 	if (on.resource !== roleResource && membershipField(resources.get(roleResource), on.resource, resources) === void 0) return false;
 	const field = membershipField(resource, on.resource, resources);
-	return field !== void 0 && row[field] === on.id;
+	return field !== void 0 && sameId(row[field], on.id);
 }
 /**
 * The row field that holds the id of a `membershipResource` membership: the
@@ -221,4 +242,4 @@ function isActive(validity, now) {
 	return validity.until === void 0 || now < validity.until;
 }
 //#endregion
-export { matchScopedMembership as a, partitionsOf as c, rowInScope as d, tenantsOf as f, sanitizeFields as g, sanitizeContext as h, isMembershipExpired as i, relatesTo as l, pickVisible as m, normalizeValidity as n, membershipField as o, grantCoversField as p, inTeam as r, nowSeconds as s, isActive as t, resolveActiveTenant as u };
+export { isMembershipExpired as a, membershipField as c, partitionsOf as d, relatesTo as f, tenantsOf as g, scopeField as h, inTeam as i, nestedAppliesWithoutRow as l, rowInScope as m, normalizeValidity as n, matchScopedMembership as o, resolveActiveTenant as p, heldRoleNamesIn as r, memberOfFields as s, isActive as t, nowSeconds as u };

package/dist/{verifier-B90agnhl.js → verifier-BxBo6I44.js}

@@ -1,5 +1,5 @@
 import { n as isReadonlyArray, t as compact } from "./compact-y6vfu2_f.js";
-import { E as splitPath, S as isForbiddenKey } from "./permissions-DC7GROPA.js";
+import { T as isForbiddenKey, k as splitPath } from "./permissions-DVoF6dMt.js";
 import { t as loadJose } from "./load-jose-BL6LH4bL.js";
 //#region src/jwt/header.ts
 function compactParts(token) {
@@ -173,7 +173,9 @@ function createKeyCache(options) {
 	const jwksInFlight = /* @__PURE__ */ new Map();
 	let discoveryInFlight;
 	let discoveryCache;
+	/** Keyed by `jwks_uri`: keys cached for one URI never answer for another. */
 	let jwksCache;
+	const cachedJwks = (href, now) => jwksCache?.href === href && jwksCache.expiresAt > now ? jwksCache.value : void 0;
 	let cooldownUntil = 0;
 	let discoveryCause;
 	const readDiscovery = async (href, issuer, now) => {
@@ -251,9 +253,10 @@ function createKeyCache(options) {
 		};
 	};
 	const loadJwks = (href, now, force) => {
-		if (!force && jwksCache !== void 0 && jwksCache.expiresAt > now) return Promise.resolve({
+		const cached = force ? void 0 : cachedJwks(href, now);
+		if (cached !== void 0) return Promise.resolve({
 			ok: true,
-			jwks: jwksCache.value
+			jwks: cached
 		});
 		const pending = jwksInFlight.get(href);
 		if (pending !== void 0) return pending;
@@ -273,6 +276,7 @@ function createKeyCache(options) {
 			const body = await response.json();
 			if (!Array.isArray(body.keys) || body.keys.length === 0) throw new Error("empty jwks");
 			jwksCache = {
+				href,
 				value: body,
 				expiresAt: now + clampTtl(cacheControlMaxAge(response.headers.get("cache-control")) ?? maxTtl, minTtl, maxTtl)
 			};
@@ -281,9 +285,10 @@ function createKeyCache(options) {
 				jwks: body
 			};
 		} catch {
-			if (jwksCache !== void 0 && jwksCache.expiresAt > now) return {
+			const stale = cachedJwks(href, now);
+			if (stale !== void 0) return {
 				ok: true,
-				jwks: jwksCache.value
+				jwks: stale
 			};
 			return {
 				ok: false,

package/dist/version-BvacVTZR.js

@@ -0,0 +1,17 @@
+import { t as packageRoot } from "./package-root-zGkxO3oN.js";
+import { readFileSync } from "node:fs";
+import { join } from "node:path";
+//#region src/cli/version.ts
+function cliVersion() {
+	return JSON.parse(readFileSync(join(packageRoot(), "package.json"), "utf8")).version;
+}
+function generatorBanner() {
+	return `permdock@${cliVersion()}`;
+}
+const CATALOG_SCHEMA = "https://permdock.com/schemas/catalog-v1.json";
+const SUPABASE_MANIFEST_SCHEMA = "https://permdock.com/schemas/supabase-manifest-v1.json";
+const USAGE_REPORT_SCHEMA = "https://permdock.com/schemas/usage-report-v1.json";
+const DOCTOR_REPORT_SCHEMA = "https://permdock.com/schemas/doctor-report-v1.json";
+const CONFIG_REPORT_SCHEMA = "https://permdock.com/schemas/config-report-v1.json";
+//#endregion
+export { USAGE_REPORT_SCHEMA as a, SUPABASE_MANIFEST_SCHEMA as i, CONFIG_REPORT_SCHEMA as n, cliVersion as o, DOCTOR_REPORT_SCHEMA as r, generatorBanner as s, CATALOG_SCHEMA as t };

package/dist/views-Soe7bGSC.js

@@ -0,0 +1,95 @@
+//#region src/client/views.ts
+function permissionSet(store, permissions, data) {
+	const granted = [];
+	const byKey = {};
+	for (const permission of permissions) {
+		const state = store.permissionState(permission, data);
+		byKey[permission.key] = state;
+		if (state.allowed) granted.push(permission);
+	}
+	return new Proxy({
+		granted,
+		get(permission) {
+			return byKey[permission.key];
+		}
+	}, { get(target, prop, receiver) {
+		if (typeof prop === "string" && Object.hasOwn(byKey, prop)) return byKey[prop];
+		return Reflect.get(target, prop, receiver);
+	} });
+}
+function filterResult(permdock, permission, rows) {
+	const result = permdock.filter(permission, rows);
+	result.partial = permdock.where(permission).partial;
+	return result;
+}
+function tenantView(permdock) {
+	return {
+		tenant: permdock.subject.principal?.tenant ?? null,
+		tenants: permdock.tenants(),
+		switchTo: (id) => permdock.refresh({ tenant: id }),
+		status: permdock.status()
+	};
+}
+function rolesView(permdock, options) {
+	return { roles: (options.team === void 0 ? permdock : permdock.team(options.team)).heldRoles(options.tenant === void 0 ? void 0 : { tenant: options.tenant }) };
+}
+function subjectView(permdock) {
+	const snapshot = permdock.snapshot();
+	return {
+		principal: permdock.subject.principal,
+		actor: permdock.subject.actor,
+		delegation: permdock.subject.delegation,
+		expiresAt: permdock.subject.expiresAt,
+		simulated: typeof snapshot === "object" && snapshot !== null && "simulated" in snapshot && snapshot.simulated === true
+	};
+}
+/** The root's view of another tenant for a `Protected` with a `tenant` prop; `undefined` answers the active one. */
+function scopedTenant(root, tenant) {
+	return tenant === void 0 ? void 0 : root.tenant(tenant);
+}
+/** An instance whose every read answers from `current()`, so a held reference follows the store. */
+function livePermDock(current) {
+	return new Proxy({}, { get(_target, prop, _receiver) {
+		return Reflect.get(current(), prop);
+	} });
+}
+/**
+* `local` answers the active tenant; `scoped`, the root's view of another
+* tenant, is decided on the spot and shares the root's `pending` and `stale`.
+*/
+function protectedView(local, root, permission, data, scoped) {
+	const state = scoped === void 0 ? local : decideIn(root, scoped, permission, data);
+	if (state.status === "pending") return {
+		...state,
+		slot: "pending"
+	};
+	const decision = state.decision;
+	if (!state.allowed || decision.outcome !== "granted") return {
+		...state,
+		slot: "fallback"
+	};
+	return {
+		allowed: true,
+		status: state.status,
+		decision,
+		slot: "default"
+	};
+}
+function decideIn(root, scoped, permission, data) {
+	const decision = scoped.decide(permission, data);
+	const status = root.status();
+	return {
+		allowed: decision.outcome === "granted",
+		status: status === "pending" || status === "stale" ? status : "ready",
+		decision
+	};
+}
+function approvalHandle(store, decision) {
+	return {
+		state: store.approvalState(decision),
+		token: decision.outcome === "approval-required" ? decision.token : void 0,
+		request: (note) => store.requestApproval(decision, note)
+	};
+}
+//#endregion
+export { protectedView as a, subjectView as c, permissionSet as i, tenantView as l, filterResult as n, rolesView as o, livePermDock as r, scopedTenant as s, approvalHandle as t };

package/dist/{vocabulary-Dk0fs-Jk.d.ts → vocabulary-DA8a8zif.d.ts}

@@ -1,4 +1,4 @@
-import { n as ActionMeta } from "./permissions-B4apnahQ.js";
+import { n as ActionMeta } from "./permissions-DttnqqxC.js";
 //#region src/core/vocabulary.d.ts
 declare const ROLE_KIND: "role";
 declare const PLAN_KIND: "plan";

package/dist/vue/index.d.ts

@@ -1,9 +1,11 @@
-import { Et as TokenVerifier, Mn as Decision, gt as Snapshot, pr as Membership } from "../policy-CInmNGkM.js";
-import { d as Permission } from "../permissions-B4apnahQ.js";
-import { r as Role } from "../vocabulary-Dk0fs-Jk.js";
-import { a as requiredPlans, i as describe } from "../describe-DernyItf.js";
-import { t as approvalHeaders } from "../headers-C8SHQccD.js";
-import { a as FilterResult, c as PermissionState, d as TenantView, f as UseRolesOptions, i as ClientStatus, n as ApprovalState, r as ClientPermDock, s as PermissionSet, t as ApprovalHandle, u as SubjectView } from "../types-DbWdEfcm.js";
+import { Ft as TokenVerifier, Mr as Membership, Tt as Snapshot, Yn as Decision } from "../policy-IB6yxpC3.js";
+import { f as Permission } from "../permissions-DttnqqxC.js";
+import { r as Role } from "../vocabulary-DA8a8zif.js";
+import { n as requiredPlans } from "../problem-details-DX075l9V.js";
+import { i as describe } from "../describe-DMYiCjJV.js";
+import { t as PermissionBoundaryState } from "../boundary-BmHxVH1J.js";
+import { t as approvalHeaders } from "../headers-Cf-zWvsO.js";
+import { a as FilterResult, c as SubjectView, i as ClientStatus, l as TenantView, n as ApprovalState, o as PermissionSet, r as ClientPermDock, s as PermissionState, t as ApprovalHandle, u as UseRolesOptions } from "../types-CKNSyIf_.js";
 import { ComputedRef, DefineComponent, MaybeRefOrGetter, Plugin } from "vue";
 //#region src/vue/types.d.ts
 type PermDockPluginOptions = {
@@ -13,13 +15,22 @@ type PermDockPluginOptions = {
    * `setup` under `<Suspense>`).
    */
   readonly snapshot: MaybeRefOrGetter<Snapshot | string> | PromiseLike<Snapshot | string>;
-  readonly endpoint?: string;
+  /**
+   * The AuthZEN evaluations endpoint for checks the snapshot cannot answer.
+   * `false` never calls one: such a check is denied with reason `server-only`.
+   */
+  readonly endpoint?: string | false;
+  /** Where `refresh()` fetches a fresh snapshot. Defaults to `endpoint`. */
+  readonly snapshotUrl?: string;
   readonly approvals?: string;
-  readonly tenant?: string;
+  /** A ref or getter switches the active tenant (`refresh({ tenant })`) when it changes. */
+  readonly tenant?: MaybeRefOrGetter<string | undefined>;
   readonly fetch?: typeof fetch;
-  readonly headers?: Readonly<Record<string, string>>;
+  /** Read on every request: a ref or getter carries a rotated token without rebuilding the store. */
+  readonly headers?: MaybeRefOrGetter<Readonly<Record<string, string>> | undefined>;
   readonly maxAge?: number;
-  readonly verifier?: TokenVerifier;
+  /** Read on every verification; set it at install to verify signed snapshots. */
+  readonly verifier?: MaybeRefOrGetter<TokenVerifier | undefined>;
 };
 //#endregion
 //#region src/vue/composables.d.ts
@@ -37,12 +48,23 @@ export declare function useRoles(options?: MaybeRefOrGetter<UseRolesOptions>): C
   readonly roles: readonly Role[];
 }>;
 export declare function useAssignableRoles(): ComputedRef<readonly Role[]>;
-export declare function useAssignablePermissions(options?: {
+export declare function useAssignablePermissions(options?: MaybeRefOrGetter<{
   readonly tenant?: string;
-}): ComputedRef<readonly Permission[]>;
+}>): ComputedRef<readonly Permission[]>;
 export declare function useSubject(): ComputedRef<SubjectView>;
 export declare function useApproval(decision: MaybeRefOrGetter<Decision>): ComputedRef<ApprovalHandle>;
 //#endregion
+//#region src/vue/boundary.d.ts
+/**
+ * Catches `PermDockDeniedError` and `PermDockApprovalRequiredError` thrown
+ * by a descendant and renders the `denied` slot, or the `approval` slot for
+ * an approval request (default `denied`). The slots receive the refused
+ * permission and `retry()`. Any other error propagates.
+ */
+export declare const PermissionBoundary: DefineComponent;
+/** Inside a `PermissionBoundary`: what was refused and `retry()`, or `null` while the children render. */
+export declare function usePermissionBoundary(): PermissionBoundaryState | null;
+//#endregion
 //#region src/vue/plugin.d.ts
 export declare const permdockPlugin: Plugin<PermDockPluginOptions>;
 //#endregion
@@ -54,4 +76,4 @@ type ProtectedProps = {
 };
 export declare const Protected: DefineComponent<ProtectedProps>;
 //#endregion
-export { type ApprovalHandle, type ApprovalState, type ClientPermDock, type ClientStatus, type FilterResult, type PermDockPluginOptions, type PermissionSet, type PermissionState, type SubjectView, type TenantView, type UseRolesOptions, approvalHeaders, describe, requiredPlans };
+export { type ApprovalHandle, type ApprovalState, type ClientPermDock, type ClientStatus, type FilterResult, type PermDockPluginOptions, type PermissionBoundaryState, type PermissionSet, type PermissionState, type ProtectedProps, type SubjectView, type TenantView, type UseRolesOptions, approvalHeaders, describe, requiredPlans };

package/dist/vue/index.js

@@ -1,10 +1,11 @@
-import { t as compact } from "../compact-y6vfu2_f.js";
-import { n as requiredPlans, t as describe } from "../describe-Bt1YD5uS.js";
-import { t as emptySnapshot } from "../from-snapshot-BMGnhmgv.js";
-import { t as approvalHeaders } from "../headers-B5RRv3Xm.js";
-import { t as createClientStore } from "../store-C6hFW6ta.js";
-import { t as isPromiseLike } from "../source-DoBBYJi2.js";
-import { computed, defineComponent, effectScope, inject, isRef, onScopeDispose, shallowRef, toValue, watch } from "vue";
+import { r as requiredPlans } from "../problem-details-_AMOYz-w.js";
+import { t as describe } from "../describe-B_gVZEVi.js";
+import { t as approvalHeaders } from "../headers-BZSDieNT.js";
+import { i as isPromiseLike } from "../store-options-ByhZq1jV.js";
+import { a as protectedView, c as subjectView, i as permissionSet, l as tenantView, n as filterResult, o as rolesView, r as livePermDock, s as scopedTenant, t as approvalHandle } from "../views-Soe7bGSC.js";
+import { n as boundaryFallback, t as boundaryDigest } from "../boundary-BM8a_P6E.js";
+import { n as switchTenant, t as providerStore } from "../provider-store-Cfbvo4DE.js";
+import { computed, defineComponent, effectScope, getCurrentScope, inject, isRef, onErrorCaptured, onScopeDispose, provide, shallowRef, toValue, watch } from "vue";
 //#region src/vue/context.ts
 const permDockKey = Symbol("permdock");
 //#endregion
@@ -15,6 +16,7 @@ function useStore() {
 	return store;
 }
 function useTick(store) {
+	if (getCurrentScope() === void 0) throw new Error("PermDock: call composables in setup() or an effectScope, which removes their store subscription.");
 	const tick = shallowRef(0);
 	onScopeDispose(store.subscribe(() => {
 		tick.value += 1;
@@ -26,9 +28,7 @@ function useTick(store) {
 }
 function usePermDock() {
 	const permdock = useTick(useStore());
-	return new Proxy({}, { get(_target, prop, _receiver) {
-		return Reflect.get(permdock.value, prop);
-	} });
+	return livePermDock(() => permdock.value);
 }
 function usePermission(permission, data) {
 	const store = useStore();
@@ -48,40 +48,16 @@ function usePermissions(permissions, data) {
 	const permdock = useTick(store);
 	return computed(() => {
 		permdock.value;
-		const granted = [];
-		const byKey = {};
-		for (const permission of toValue(permissions)) {
-			const next = store.permissionState(permission, toValue(data));
-			byKey[permission.key] = next;
-			if (next.allowed) granted.push(permission);
-		}
-		return new Proxy({
-			granted,
-			get(permission) {
-				return byKey[permission.key];
-			}
-		}, { get(target, prop, receiver) {
-			if (typeof prop === "string" && Object.hasOwn(byKey, prop)) return byKey[prop];
-			return Reflect.get(target, prop, receiver);
-		} });
+		return permissionSet(store, toValue(permissions), toValue(data));
 	});
 }
 function useFilter(permission, rows) {
 	const permdock = useTick(useStore());
-	return computed(() => {
-		const result = [...permdock.value.filter(permission, toValue(rows))];
-		result.partial = permdock.value.where(permission).partial;
-		return result;
-	});
+	return computed(() => filterResult(permdock.value, permission, toValue(rows)));
 }
 function useTenant() {
 	const permdock = useTick(useStore());
-	return computed(() => ({
-		tenant: permdock.value.subject.principal?.tenant ?? null,
-		tenants: permdock.value.tenants(),
-		switchTo: (id) => permdock.value.refresh({ tenant: id }),
-		status: permdock.value.status()
-	}));
+	return computed(() => tenantView(permdock.value));
 }
 function useMemberships() {
 	const permdock = useTick(useStore());
@@ -89,10 +65,7 @@ function useMemberships() {
 }
 function useRoles(options = {}) {
 	const permdock = useTick(useStore());
-	return computed(() => {
-		const next = toValue(options);
-		return { roles: (next.team === void 0 ? permdock.value : permdock.value.team(next.team)).heldRoles(next.tenant === void 0 ? void 0 : { tenant: next.tenant }) };
-	});
+	return computed(() => rolesView(permdock.value, toValue(options)));
 }
 function useAssignableRoles() {
 	const permdock = useTick(useStore());
@@ -100,62 +73,86 @@ function useAssignableRoles() {
 }
 function useAssignablePermissions(options = {}) {
 	const permdock = useTick(useStore());
-	return computed(() => permdock.value.assignablePermissions(options));
+	return computed(() => permdock.value.assignablePermissions(toValue(options)));
 }
 function useSubject() {
 	const permdock = useTick(useStore());
-	return computed(() => {
-		const snapshot = permdock.value.snapshot();
-		const simulated = typeof snapshot === "object" && snapshot !== null && "simulated" in snapshot && snapshot.simulated === true;
-		return {
-			principal: permdock.value.subject.principal,
-			actor: permdock.value.subject.actor,
-			delegation: permdock.value.subject.delegation,
-			expiresAt: permdock.value.subject.expiresAt,
-			simulated
-		};
-	});
+	return computed(() => subjectView(permdock.value));
 }
 function useApproval(decision) {
 	const store = useStore();
 	const permdock = useTick(store);
 	return computed(() => {
 		permdock.value;
-		const next = toValue(decision);
-		return {
-			state: store.approvalState(next),
-			token: next.outcome === "approval-required" ? next.token : void 0,
-			request: (note) => store.requestApproval(next, note)
-		};
+		return approvalHandle(store, toValue(decision));
 	});
 }
 //#endregion
+//#region src/vue/boundary.ts
+const boundaryKey = Symbol("permdock-boundary");
+/**
+* Catches `PermDockDeniedError` and `PermDockApprovalRequiredError` thrown
+* by a descendant and renders the `denied` slot, or the `approval` slot for
+* an approval request (default `denied`). The slots receive the refused
+* permission and `retry()`. Any other error propagates.
+*/
+const PermissionBoundary = defineComponent({
+	name: "PermissionBoundary",
+	setup(_props, { slots }) {
+		const state = shallowRef(null);
+		provide(boundaryKey, state);
+		onErrorCaptured((error) => {
+			const digest = boundaryDigest(error);
+			if (digest === null) return;
+			state.value = {
+				...digest,
+				retry: () => {
+					state.value = null;
+				}
+			};
+			return false;
+		});
+		return () => {
+			const current = state.value;
+			if (current === null) return slots["default"]?.() ?? null;
+			return boundaryFallback(current, {
+				denied: slots["denied"],
+				approval: slots["approval"]
+			})?.(current) ?? null;
+		};
+	}
+});
+/** Inside a `PermissionBoundary`: what was refused and `retry()`, or `null` while the children render. */
+function usePermissionBoundary() {
+	return inject(boundaryKey, null)?.value ?? null;
+}
+//#endregion
 //#region src/vue/plugin.ts
 const permdockPlugin = { install(app, options) {
 	const source = options.snapshot;
 	const promised = isPromiseLike(source);
-	const store = createClientStore(compact({
-		snapshot: promised ? emptySnapshot() : toValue(source),
-		endpoint: options.endpoint,
-		approvals: options.approvals,
-		tenant: options.tenant,
+	const store = providerStore({
+		...options,
+		tenant: toValue(options.tenant)
+	}, () => ({
+		headers: toValue(options.headers),
 		fetch: options.fetch,
-		headers: options.headers,
-		maxAge: options.maxAge,
-		verifier: options.verifier
-	}));
-	if (promised) store.follow(source);
-	else if (isRef(source) || typeof source === "function") {
-		const scope = effectScope(true);
-		scope.run(() => {
-			watch(() => toValue(source), (next) => {
-				store.replace(next);
-			});
+		verifier: toValue(options.verifier)
+	}), promised ? source : toValue(source));
+	const scope = effectScope(true);
+	scope.run(() => {
+		if (!promised && (isRef(source) || typeof source === "function")) watch(() => toValue(source), (next) => {
+			store.replace(next);
 		});
-		app.onUnmount(() => {
-			scope.stop();
+		const tenant = options.tenant;
+		if (isRef(tenant) || typeof tenant === "function") watch(() => toValue(tenant), (next) => {
+			switchTenant(store, next);
 		});
-	}
+	});
+	app.onUnmount(() => {
+		scope.stop();
+		store.dispose();
+	});
 	app.provide(permDockKey, store);
 } };
 //#endregion
@@ -168,7 +165,7 @@ const Protected = defineComponent({
 			required: true
 		},
 		data: {
-			type: Object,
+			type: null,
 			required: false
 		},
 		tenant: {
@@ -179,25 +176,21 @@ const Protected = defineComponent({
 	setup(props, { slots }) {
 		const local = usePermission(() => props.permission, () => props.data);
 		const root = usePermDock();
+		const scoped = computed(() => scopedTenant(root, props.tenant));
 		return () => {
-			const scoped = props.tenant === void 0 ? {
+			const view = protectedView({
 				allowed: local.allowed.value,
 				status: local.status.value,
 				decision: local.decision.value
-			} : tenantView(root.tenant(props.tenant), props.permission, props.data);
-			if (scoped.status === "pending") return slots["pending"]?.() ?? null;
-			if (!scoped.allowed || scoped.decision.outcome !== "granted") return slots["fallback"]?.({ decision: scoped.decision }) ?? null;
-			return slots["default"]?.({ decision: scoped.decision }) ?? null;
+			}, root, props.permission, props.data, scoped.value);
+			switch (view.slot) {
+				case "pending": return slots["pending"]?.() ?? null;
+				case "fallback": return slots["fallback"]?.({ decision: view.decision }) ?? null;
+				case "default": return slots["default"]?.({ decision: view.decision }) ?? null;
+				default: return view;
+			}
 		};
 	}
 });
-function tenantView(permdock, permission, data) {
-	const decision = permdock.decide(permission, data);
-	return {
-		allowed: decision.outcome === "granted",
-		status: "ready",
-		decision
-	};
-}
 //#endregion
-export { Protected, approvalHeaders, describe, permdockPlugin, requiredPlans, useApproval, useAssignablePermissions, useAssignableRoles, useFilter, useMemberships, usePermDock, usePermission, usePermissions, useRoles, useSubject, useTenant };
+export { PermissionBoundary, Protected, approvalHeaders, describe, permdockPlugin, requiredPlans, useApproval, useAssignablePermissions, useAssignableRoles, useFilter, useMemberships, usePermDock, usePermission, usePermissionBoundary, usePermissions, useRoles, useSubject, useTenant };