permdock 0.3.1 → 0.4.0

package/dist/testing/saas/index.d.ts

@@ -1,7 +1,7 @@
-import { Cr as Actor, Dr as CustomRole, Mr as Membership, Nr as Principal, Pr as Subject, bt as RelationSource, dt as LimitStore, kr as Delegation, un as PermDockOptions } from "../../policy-IB6yxpC3.js";
-import { f as Permission } from "../../permissions-DttnqqxC.js";
-import { a as SaasProject, c as saasPlans, i as SaasFolderSchema, l as saasRoles, n as SaasDocSchema, o as SaasProjectSchema, r as SaasFolder, s as saasPermissions, t as SaasDoc, u as saasTenantRoleNames } from "../../permissions-CDgvKG5L.js";
-import { n as saasPolicy, t as SAAS_API_KEY_LIMIT } from "../../policy-D2W7uv19.js";
+import { Dr as Membership, Mt as PermDockOptions, Or as Principal, Sr as CustomRole, Y as LimitStore, kr as Subject, tt as RelationSource, vr as Actor, wr as Delegation } from "../../policy-types-sp9P1iIV.js";
+import { d as Permission } from "../../permission-types-Dg39z9Kv.js";
+import { a as SaasProject, c as saasPlans, i as SaasFolderSchema, l as saasRoles, n as SaasDocSchema, o as SaasProjectSchema, r as SaasFolder, s as saasPermissions, t as SaasDoc, u as saasTenantRoleNames } from "../../permissions-COH-KRgT.js";
+import { n as saasPolicy, t as SAAS_API_KEY_LIMIT } from "../../policy-ur0BBK_e.js";
 import { StandardSchemaV1 } from "@standard-schema/spec";
 //#region src/testing/saas/schema.d.ts
 type FieldKind = "string" | "boolean" | "nullable-string";

package/dist/testing/saas/index.js

@@ -1,3 +1,3 @@
-import { a as saasPlans, c as rowSchema, i as saasPermissions, n as SaasFolderSchema, o as saasRoles, r as SaasProjectSchema, s as saasTenantRoleNames, t as SaasDocSchema } from "../../permissions-RJrovw98.js";
-import { C as saasOrg, D as saasUsers, E as saasSeed, O as SAAS_API_KEY_LIMIT, S as saasMemberships, T as saasRelations, _ as verifySaasToken, a as saasProject, b as SAAS_EXPIRED_AT, c as saasUser, d as saasIssuer, f as saasJwks, g as verifySaasSession, h as signSaasToken, i as saasLimitStore, k as saasPolicy, l as SAAS_TOKEN_TTL_SECONDS, m as saasPublicJwk, n as saasFolder, o as saasScenarioOptions, p as saasPrivateJwk, r as saasFolderScenarios, s as saasScenarios, t as saasDoc, u as saasAudience, v as saasSchemaSql, w as saasPrincipal, x as saasCustomRoles, y as saasSeedSql } from "../../saas-DhpJjnBA.js";
+import { a as saasPlans, c as rowSchema, i as saasPermissions, n as SaasFolderSchema, o as saasRoles, r as SaasProjectSchema, s as saasTenantRoleNames, t as SaasDocSchema } from "../../permissions-CCJ6lmxB.js";
+import { C as saasOrg, D as saasUsers, E as saasSeed, O as SAAS_API_KEY_LIMIT, S as saasMemberships, T as saasRelations, _ as verifySaasToken, a as saasProject, b as SAAS_EXPIRED_AT, c as saasUser, d as saasIssuer, f as saasJwks, g as verifySaasSession, h as signSaasToken, i as saasLimitStore, k as saasPolicy, l as SAAS_TOKEN_TTL_SECONDS, m as saasPublicJwk, n as saasFolder, o as saasScenarioOptions, p as saasPrivateJwk, r as saasFolderScenarios, s as saasScenarios, t as saasDoc, u as saasAudience, v as saasSchemaSql, w as saasPrincipal, x as saasCustomRoles, y as saasSeedSql } from "../../saas-DtaA4JuW.js";
 export { SAAS_API_KEY_LIMIT, SAAS_EXPIRED_AT, SAAS_TOKEN_TTL_SECONDS, SaasDocSchema, SaasFolderSchema, SaasProjectSchema, rowSchema, saasAudience, saasCustomRoles, saasDoc, saasFolder, saasFolderScenarios, saasIssuer, saasJwks, saasLimitStore, saasMemberships, saasOrg, saasPermissions, saasPlans, saasPolicy, saasPrincipal, saasPrivateJwk, saasProject, saasPublicJwk, saasRelations, saasRoles, saasScenarioOptions, saasScenarios, saasSchemaSql, saasSeed, saasSeedSql, saasTenantRoleNames, saasUser, saasUsers, signSaasToken, verifySaasSession, verifySaasToken };

package/dist/testing/saas/permissions.d.ts

@@ -1,2 +1,2 @@
-import { a as SaasProject, c as saasPlans, i as SaasFolderSchema, l as saasRoles, n as SaasDocSchema, o as SaasProjectSchema, r as SaasFolder, s as saasPermissions, t as SaasDoc, u as saasTenantRoleNames } from "../../permissions-CDgvKG5L.js";
+import { a as SaasProject, c as saasPlans, i as SaasFolderSchema, l as saasRoles, n as SaasDocSchema, o as SaasProjectSchema, r as SaasFolder, s as saasPermissions, t as SaasDoc, u as saasTenantRoleNames } from "../../permissions-COH-KRgT.js";
 export { SaasDoc, SaasDocSchema, SaasFolder, SaasFolderSchema, SaasProject, SaasProjectSchema, saasPermissions, saasPlans, saasRoles, saasTenantRoleNames };

package/dist/testing/saas/permissions.js

@@ -1,2 +1,2 @@
-import { a as saasPlans, i as saasPermissions, n as SaasFolderSchema, o as saasRoles, r as SaasProjectSchema, s as saasTenantRoleNames, t as SaasDocSchema } from "../../permissions-RJrovw98.js";
+import { a as saasPlans, i as saasPermissions, n as SaasFolderSchema, o as saasRoles, r as SaasProjectSchema, s as saasTenantRoleNames, t as SaasDocSchema } from "../../permissions-CCJ6lmxB.js";
 export { SaasDocSchema, SaasFolderSchema, SaasProjectSchema, saasPermissions, saasPlans, saasRoles, saasTenantRoleNames };

package/dist/thenable-QSmvt-vZ.js

@@ -0,0 +1,65 @@
+import { r as isRecord } from "./compact-CAf557ZB.js";
+//#region src/core/paths.ts
+const FORBIDDEN_KEYS = /* @__PURE__ */ new Set([
+	"__proto__",
+	"constructor",
+	"prototype"
+]);
+function isForbiddenKey(key) {
+	return FORBIDDEN_KEYS.has(key);
+}
+function assertSafeKey(key, context) {
+	if (key.length === 0 || key.split(".").some(isForbiddenKey)) throw new Error(`PermDock: forbidden ${context} key '${key}'`);
+}
+function ownGet(object, key) {
+	if (isForbiddenKey(key)) return;
+	if (!Object.hasOwn(object, key)) return;
+	return object[key];
+}
+function ownKeys(object) {
+	return Object.keys(object).filter((key) => !isForbiddenKey(key));
+}
+function splitPath(path) {
+	return path.split(".").filter((segment) => segment.length > 0);
+}
+function readPath(root, path) {
+	const segments = splitPath(path);
+	let current = root;
+	for (const segment of segments) {
+		if (isForbiddenKey(segment)) return;
+		if (current === null || current === void 0 || typeof current !== "object") return;
+		current = ownGet(current, segment);
+	}
+	return current;
+}
+//#endregion
+//#region src/core/thenable.ts
+function isThenable(value) {
+	return value !== null && typeof value === "object" && "then" in value && typeof value.then === "function";
+}
+/** Settles a promise nobody awaits, so its rejection is not reported as unhandled. */
+function ignoreRejection(value) {
+	Promise.resolve(value).then(void 0, () => void 0);
+}
+/** Runs a Standard Schema that must answer synchronously; an asynchronous answer fails. */
+function validateSync(schema, value) {
+	const result = schema["~standard"].validate(value);
+	if (isThenable(result)) {
+		ignoreRejection(result);
+		return { ok: false };
+	}
+	return result.issues === void 0 ? {
+		ok: true,
+		value: result.value
+	} : {
+		ok: false,
+		issues: result.issues
+	};
+}
+/** `validateSync` for a schema whose output must be an object; anything else is `undefined`. */
+function validateRecord(schema, value) {
+	const validated = validateSync(schema, value);
+	return validated.ok && isRecord(validated.value) ? validated.value : void 0;
+}
+//#endregion
+export { assertSafeKey as a, ownKeys as c, validateSync as i, readPath as l, isThenable as n, isForbiddenKey as o, validateRecord as r, ownGet as s, ignoreRejection as t, splitPath as u };

package/dist/{token-CIWxJOCh.js → token-Bx9qy30p.js}

@@ -1,4 +1,4 @@
-import { t as canonicalJson } from "./canonical-json-DemiK4Vp.js";
+import { t as canonicalJson } from "./canonical-json-CFKyFOke.js";
 import { n as sha256, t as bytesToBase64Url } from "./sha256-BO0swRXL.js";
 //#region src/core/token.ts
 /**

package/dist/tool-refusal-CQ7OEia9.js

@@ -0,0 +1,41 @@
+import { a as wireDenials } from "./problem-details-DECUnXAn.js";
+import { t as describe } from "./describe-Cgkp7eP0.js";
+//#region src/core/tool-refusal.ts
+function deniedToolRefusal(decision, permission, resource) {
+	const alternatives = decision.alternatives.map((leaf) => leaf.key);
+	return {
+		text: `Denied: ${resource.id === void 0 ? permission.key : `${permission.key} on ${resource.id}`}.${alternatives.length === 0 ? "" : ` You may: ${alternatives.join(", ")}.`}`,
+		structured: {
+			outcome: "denied",
+			permission: permission.key,
+			resource,
+			denials: wireDenials(decision.denials),
+			alternatives,
+			detail: describe(decision).detail
+		}
+	};
+}
+function approvalToolRefusal(decision, permission, resource) {
+	return {
+		text: describe(decision).detail,
+		structured: {
+			outcome: "approval-required",
+			permission: permission.key,
+			resource,
+			token: decision.token
+		}
+	};
+}
+/** An MCP `CallToolResult` with `isError` set, as MCP and WebMCP clients read it. */
+function toolErrorResult(refusal) {
+	return {
+		isError: true,
+		content: [{
+			type: "text",
+			text: refusal.text
+		}],
+		structuredContent: refusal.structured
+	};
+}
+//#endregion
+export { deniedToolRefusal as n, toolErrorResult as r, approvalToolRefusal as t };

package/dist/trpc/index.d.ts

@@ -1,9 +1,9 @@
-import { C as Policy, Nr as Principal } from "../policy-IB6yxpC3.js";
-import { f as Permission } from "../permissions-DttnqqxC.js";
+import { E as Policy, Or as Principal } from "../policy-types-sp9P1iIV.js";
+import { d as Permission } from "../permission-types-Dg39z9Kv.js";
 import { n as RevocationFeed } from "../revocations-Cy06JNx2.js";
-import { A as ConnectionOptions, O as Connection, n as OpenApiHooks } from "../create-B1d519XK.js";
-import { t as ServerAdapterOptions } from "../bind-C_ob3LKa.js";
-import { t as StreamProtectOptions } from "../stream-D1RXubw2.js";
+import { A as ConnectionOptions, O as Connection, i as OpenApiHooks } from "../server-types-DdqBwZN_.js";
+import { t as ServerAdapterOptions } from "../bind-BzqG8SMb.js";
+import { t as StreamProtectOptions } from "../stream-Dwsg6WwE.js";
 import { AnyTRPCMiddlewareFunction } from "@trpc/server";
 //#region src/trpc/create.d.ts
 type TrpcMiddlewareOpts<TCtx = object, TInput = unknown> = {

package/dist/trpc/index.js

@@ -1,8 +1,8 @@
-import { a as problemMessage } from "../http-SO7qGttf.js";
-import { t as problemFromError } from "../map-error-pgUWNNtG.js";
-import { n as attached } from "../bind-CuzGytRf.js";
-import { a as reloadAfter, r as isAsyncIterable } from "../stream-DDpvynSB.js";
-import { i as rpcCode, n as guardStream, r as problemBody, t as bindRpcKernel } from "../rpc-DL9Sqvb1.js";
+import { o as problemMessage } from "../http-BBoKefeS.js";
+import { t as problemFromError } from "../map-error-BE27PYkE.js";
+import { n as attached } from "../bind-kk-uyCwH.js";
+import { a as reloadAfter, r as isAsyncIterable } from "../stream-BMui98KK.js";
+import { i as rpcCode, n as guardStream, r as problemBody, t as bindRpcKernel } from "../rpc-nYC3cR_u.js";
 import { TRPCError, isTrackedEnvelope } from "@trpc/server";
 //#region src/trpc/create.ts
 const PROBLEM = Symbol.for("permdock.problem");
@@ -57,7 +57,7 @@ function errorFormatter(opts) {
 	};
 }
 function createPermDock(policy, options) {
-	const { kernel, bind, attach, scopeOf, connection, evaluate } = bindRpcKernel(policy, options, "trpc", (opts) => opts.ctx, (opts) => opts.path);
+	const { kernel, bind, attach, scopeOf, connection, evaluate, guard: runGuard } = bindRpcKernel(policy, options, "trpc", (opts) => opts.ctx, (opts) => opts.path);
 	const permdock = () => (async (opts) => {
 		const request = bind(opts);
 		const instance = await attached(async () => kernel.permdock(request, await scopeOf(opts)));
@@ -81,8 +81,7 @@ function createPermDock(policy, options) {
 		};
 	};
 	const protect = (permission, loadData, protectOptions) => (async (opts) => {
-		const request = bind(opts);
-		const guard = await kernel.protect(permission, loadData === void 0 ? void 0 : () => loadData(opts), protectOptions)(request, await scopeOf(opts));
+		const { request, guard } = await runGuard(permission, loadData, opts, protectOptions);
 		if (guard.ok) {
 			const nextCtx = {
 				...opts.ctx,

package/dist/{types-DbjRN55U.d.ts → types-7rJVLWe5.d.ts}

@@ -1,5 +1,5 @@
-import { n as RoleThrough } from "./types-C97IskBw.js";
-import { o as SqlMembershipSource } from "./sources-BdOYLw9j.js";
+import { n as RoleThrough } from "./types-CqrjB9o6.js";
+import { o as SqlMembershipSource } from "./sources-Dljy06zL.js";
 //#region src/cli/types.d.ts
 type CollectConfig = {
   readonly srcPath?: readonly string[];
@@ -140,9 +140,19 @@ type RlsConfig = {
   /**
    * Resolve tenant-defined custom roles in the helpers: `custom_role_permissions` and
    * `custom_role_includes` in `database` mode, the `memberships[].grants` claim in `jwt` mode,
-   * always intersected with the `permdock_ceiling` view. Off by default.
+   * always intersected with the `permdock_ceiling` view. Off by default. An
+   * object turns them on and names the application's existing role tables
+   * that `--backfill-out` copies from.
    */
-  readonly customRoles?: boolean;
+  readonly customRoles?: boolean | RlsCustomRolesConfig;
+  /**
+   * Triggers the application owns on tables `generate` creates, by table
+   * name without the schema (`custom_role_permissions`): written after the
+   * tables, each as `drop trigger if exists` and `create trigger`.
+   */
+  readonly triggers?: Readonly<Record<string, readonly RlsTrigger[]>>;
+  /** Register generated tables with an audit function, such as `better_supabase.audit`. */
+  readonly audit?: RlsAudit;
   /** How the generated custom-role write functions check the caller (`database` mode with `customRoles`). */
   readonly customRoleWrites?: {
     /**
@@ -350,6 +360,63 @@ type RlsCustomRoleTable = {
   /** A boolean column marking rows that are not custom roles (declared or system roles); those rows are skipped. */
   readonly skip?: string;
 };
+/** `rls.customRoles` as an object: custom roles on, plus where existing ones live. */
+type RlsCustomRolesConfig = {
+  /** The application's role tables `--backfill-out` copies into `custom_role_permissions` and `custom_role_includes`. */
+  readonly from?: RlsCustomRolesFrom;
+};
+/**
+ * Existing custom-role data. Each row's role is a row of
+ * `rls.customRoleWrites.roles`, which supplies its name, tenant, scope,
+ * instance and `skip` flag.
+ */
+type RlsCustomRolesFrom = {
+  readonly permissions: {
+    /** `table` or `schema.table`: one row per permission a role holds. */
+    readonly table: string;
+    /** The reference to the roles table: `{ through: 'roles', on: { role_id: 'id' }, column: 'key' }`. */
+    readonly role: RoleThrough;
+    /** The permission key column, or a reference to a permissions table that holds the key. */
+    readonly permission: string | RoleThrough;
+    /** A text column holding `allow` or `deny`. Without it every row allows. */
+    readonly effect?: string;
+    /** A text column holding the level of a leveled allow. */
+    readonly level?: string;
+  };
+  readonly includes?: {
+    readonly table: string;
+    /** The reference to the including role's row in the roles table. */
+    readonly role: RoleThrough;
+    /** The included role's key column, or a reference to the roles table. */
+    readonly include: string | RoleThrough;
+  };
+};
+/** One trigger the application owns on a generated table (`rls.triggers`). */
+type RlsTrigger = {
+  /** The trigger name; `permdock_` is reserved for generated triggers. */
+  readonly name: string;
+  readonly when: "before" | "after";
+  readonly events: readonly ("insert" | "update" | "delete" | "truncate")[];
+  /** Default `row`. */
+  readonly level?: "row" | "statement";
+  /** `schema.function`, a trigger function that already exists. */
+  readonly function: string;
+  /** String arguments passed to the trigger function. */
+  readonly args?: readonly string[];
+};
+/**
+ * `rls.audit`: one `select <function>('<schema>.<table>'::regclass, <args>)`
+ * per generated table, for an audit module that registers a table by
+ * creating its own trigger.
+ */
+type RlsAudit = {
+  /** `schema.function` taking the table as its first argument. */
+  readonly function: string;
+  /** Generated tables, without the schema. Default the custom-role tables and `user_roles`, those this run creates. */
+  readonly tables?: readonly string[];
+  /** Named text arguments: `{ tenant_column: 'tenant_id' }` passes `tenant_column => 'tenant_id'`. */
+  readonly args?: Readonly<Record<string, string>>;
+};
 /** `rls.shims`: where the legacy-named wrappers go. */
 type RlsShimsConfig = {
   /** Schema of the legacy helpers. Default `public`. */
@@ -381,6 +448,17 @@ type RlsMigrateConfig = {
   readonly globalScopes?: readonly string[];
   /** For `scoped` helpers, a scope literal's PermDock scope when the names differ. */
   readonly scopes?: Readonly<Record<string, string>>;
+  /**
+   * Materialised permission tables to retire, by `schema.table`: a table the
+   * application keeps in step with triggers and reads instead of the grants.
+   * `rls migrate --retire-out` drops it with its refresh triggers once
+   * nothing else reads it.
+   */
+  readonly tables?: Readonly<Record<string, RlsMigrateTable>>;
+};
+type RlsMigrateTable = {
+  /** The functions that keep the table in step. Default: every function in `--sql` whose body writes it, and every function that calls one. */
+  readonly refresh?: readonly string[];
 };
 /** Where global roles live: `table (user, role)`. Defaults `user_id` and `role`. */
 type GlobalRoles = {

package/dist/{types-aqOHTHcp.d.ts → types-Br9IXUBG.d.ts}

@@ -1,4 +1,4 @@
-import { G as Approver, Mr as Membership, Pr as Subject, dr as RelationGrantee, o as ApprovalStage, r as ApprovalMode } from "./policy-IB6yxpC3.js";
+import { Dr as Membership, Jn as RelationGrantee, Ln as Approver, kr as Subject, o as ApprovalStage, r as ApprovalMode } from "./policy-types-sp9P1iIV.js";
 //#region src/approvals/types.d.ts
 type ApprovalStatus = "pending" | "approved" | "rejected" | "expired";
 type ApprovalApprovers = {

package/dist/types-ByUo56un.d.ts

@@ -0,0 +1,88 @@
+import { an as Snapshot, ir as Decision, jt as PermDock, rr as ApprovalRequiredDecision, ur as GrantedDecision, ut as TokenVerifier } from "./policy-types-sp9P1iIV.js";
+import { d as Permission } from "./permission-types-Dg39z9Kv.js";
+import { t as PermissionBoundaryState } from "./boundary-BmHxVH1J.js";
+import { l as PermissionState, t as ClientStore, u as ProviderOptionsBase } from "./store-9KO4BlkB.js";
+import { Snippet } from "svelte";
+import { Readable } from "svelte/store";
+//#region src/svelte/boundary.d.ts
+type PermissionBoundaryProps = {
+  readonly children?: Snippet;
+  /** Rendered in place of the children when one throws `PermDockDeniedError`. */
+  readonly denied?: Snippet<[PermissionBoundaryState]>;
+  /** Rendered for `PermDockApprovalRequiredError`; defaults to `denied`. */
+  readonly approval?: Snippet<[PermissionBoundaryState]>;
+};
+//#endregion
+//#region src/client/views.d.ts
+/**
+ * What `Protected` renders: `pending` while an endpoint answer is in flight,
+ * `approval` for an approval-required decision, `fallback` for any other
+ * denial.
+ */
+type ProtectedView = (PermissionState & {
+  readonly slot: "pending" | "fallback";
+}) | {
+  readonly allowed: false;
+  readonly status: PermissionState["status"];
+  readonly decision: ApprovalRequiredDecision;
+  readonly slot: "approval";
+} | {
+  readonly allowed: true;
+  readonly status: PermissionState["status"];
+  readonly decision: GrantedDecision;
+  readonly slot: "default";
+};
+/** Provider-wide content for the `Protected` slots a component leaves out. */
+type SlotDefaults<P, F, A = F> = {
+  readonly pending?: P;
+  readonly fallback?: F;
+  readonly approval?: A;
+};
+/**
+ * The content `Protected` renders for a non-default slot. Its own prop wins
+ * over the provider default; `approval` falls back to `fallback`, first the
+ * component's, then the provider's.
+ */
+declare function slotContent<P, F, A>(slot: "pending", own: SlotDefaults<P, F, A>, defaults: SlotDefaults<P, F, A> | undefined): P | undefined;
+declare function slotContent<P, F, A>(slot: "fallback", own: SlotDefaults<P, F, A>, defaults: SlotDefaults<P, F, A> | undefined): F | undefined;
+declare function slotContent<P, F, A>(slot: "approval", own: SlotDefaults<P, F, A>, defaults: SlotDefaults<P, F, A> | undefined): F | A | undefined;
+//#endregion
+//#region src/svelte/protected.d.ts
+type ProtectedProps = {
+  readonly permission: Permission;
+  readonly data?: unknown;
+  readonly tenant?: string;
+  readonly children?: Snippet<[GrantedDecision]>;
+  readonly pending?: Snippet;
+  readonly fallback?: Snippet<[Decision]>;
+  /** Rendered for an approval-required decision; defaults to `fallback`. */
+  readonly approval?: Snippet<[ApprovalRequiredDecision]>;
+};
+/** The instance for `tenant`, built once per store change rather than once per check. */
+declare function scopedFor(store: ClientStore, tenant: string | undefined, _generation?: number): PermDock | undefined;
+declare function viewFor(store: ClientStore, reference: Permission, data: unknown, scoped: PermDock | undefined, _generation?: number): ProtectedView;
+//#endregion
+//#region src/svelte/types.d.ts
+type PermDockSvelteOptions = ProviderOptionsBase & {
+  /**
+   * A getter (`() => data.snapshot`) or a readable store re-hydrates the
+   * store when it changes; a promise keeps the store `pending` until it
+   * settles (render the same promise with `{#await}`).
+   */
+  readonly snapshot: Snapshot | string | (() => Snapshot | string) | Readable<Snapshot | string> | PromiseLike<Snapshot | string>;
+  /** A getter (`() => page.params.org`) switches the active tenant (`refresh({ tenant })`) when it changes. */
+  readonly tenant?: string | (() => string | undefined);
+  /** A getter is read on every request, so a rotated token applies without a new store. */
+  readonly headers?: Readonly<Record<string, string>> | (() => Readonly<Record<string, string>> | undefined);
+  readonly verifier?: TokenVerifier;
+  /** What every `<Protected>` renders for a snippet it leaves out. */
+  readonly defaults?: PermDockDefaults;
+};
+/** Snippets for the `<Protected>` slots a component leaves out. */
+type PermDockDefaults = {
+  readonly pending?: Snippet;
+  readonly fallback?: Snippet<[Decision]>;
+  readonly approval?: Snippet<[ApprovalRequiredDecision]>;
+};
+//#endregion
+export { viewFor as a, scopedFor as i, PermDockSvelteOptions as n, slotContent as o, ProtectedProps as r, PermissionBoundaryProps as s, PermDockDefaults as t };

package/dist/{types-Cq_H8N_X.d.ts → types-C0dee0Qf.d.ts}

@@ -1,5 +1,5 @@
-import { Cr as Actor, Ft as TokenVerifier, Nr as Principal, Nt as TokenFailureCause, Pr as Subject, ct as JwtClaims, et as AuthEvent, gt as MembershipSource } from "./policy-IB6yxpC3.js";
-import { f as ApprovalStore } from "./types-aqOHTHcp.js";
+import { K as JwtClaims, Or as Principal, Z as MembershipSource, ct as TokenFailureCause, kr as Subject, ut as TokenVerifier, vr as Actor, yn as AuthEvent } from "./policy-types-sp9P1iIV.js";
+import { f as ApprovalStore } from "./types-Br9IXUBG.js";
 import { t as ClientNames } from "./clients-C7zLFuWT.js";
 import { n as RevocationFeed } from "./revocations-Cy06JNx2.js";
 import { StandardSchemaV1 } from "@standard-schema/spec";

package/dist/{types-DxiCGmmd.d.ts → types-CIlTojhq.d.ts}

@@ -1,5 +1,5 @@
-import { $n as ExplainedDecision, C as Policy, D as PolicyVocabulary, In as ArazzoPlan, Ln as ArazzoSimulateInput, Mr as Membership, Nr as Principal, Pr as Subject, Yn as Decision, cn as DeriveOptions, fn as SimulateOptions, ln as PermDock, mn as WhereResult, sn as DecideOptions, un as PermDockOptions } from "./policy-IB6yxpC3.js";
-import { f as Permission, m as PermissionTree } from "./permissions-DttnqqxC.js";
+import { At as DeriveOptions, Dr as Membership, E as Policy, It as WhereResult, Mn as ArazzoSimulateInput, Mt as PermDockOptions, Or as Principal, Pt as SimulateOptions, ir as Decision, j as PolicyVocabulary, jn as ArazzoPlan, jt as PermDock, kr as Subject, kt as DecideOptions, lr as ExplainedDecision } from "./policy-types-sp9P1iIV.js";
+import { d as Permission, p as PermissionTree } from "./permission-types-Dg39z9Kv.js";
 //#region src/pdp/types.d.ts
 type RemotePdpAuth = {
   readonly bearer: string | (() => string | Promise<string>);

package/dist/{types-QCuYJh4q.d.ts → types-CUcFZfpU.d.ts}

@@ -1,4 +1,4 @@
-import { D as PolicyVocabulary, ln as PermDock, rt as DecisionEvent } from "./policy-IB6yxpC3.js";
+import { j as PolicyVocabulary, jt as PermDock, xn as DecisionEvent } from "./policy-types-sp9P1iIV.js";
 //#region src/otel/types.d.ts
 declare const GENAI_SEMCONV_PIN = "1.37.0";
 declare const GEN_AI_TOOL_NAME = "gen_ai.tool.name";

package/dist/{types-C97IskBw.d.ts → types-CqrjB9o6.d.ts}

@@ -1,4 +1,4 @@
-import { Nr as Principal, et as AuthEvent } from "./policy-IB6yxpC3.js";
+import { Or as Principal, yn as AuthEvent } from "./policy-types-sp9P1iIV.js";
 import { t as ClientNames } from "./clients-C7zLFuWT.js";
 import { StandardSchemaV1 } from "@standard-schema/spec";
 //#region src/supabase/claims.d.ts

package/dist/{types-BnIEz1sU.d.ts → types-DHrmBJLH.d.ts}

@@ -1,5 +1,7 @@
-import { Ft as TokenVerifier, Tt as Snapshot, Yn as Decision } from "./policy-IB6yxpC3.js";
-import { f as Permission } from "./permissions-DttnqqxC.js";
+import { an as Snapshot, ir as Decision, rr as ApprovalRequiredDecision, ur as GrantedDecision, ut as TokenVerifier } from "./policy-types-sp9P1iIV.js";
+import { d as Permission } from "./permission-types-Dg39z9Kv.js";
+import { n as DescribeMessages } from "./describe-C3ldA9os.js";
+import { n as ClientStoreOptions } from "./store-9KO4BlkB.js";
 import { ReactNode } from "react";
 //#region src/react/types.d.ts
 type PermDockProviderProps = ({
@@ -32,17 +34,33 @@ type PermDockProviderProps = ({
   readonly headers?: Readonly<Record<string, string>>;
   readonly maxAge?: number;
   readonly verifier?: TokenVerifier;
+  /** What every `<Protected>` below renders for a slot it leaves out. */
+  readonly defaults?: PermDockDefaults;
+  /** Localised text for `useDescribe()`. */
+  readonly messages?: DescribeMessages;
+  /** Called with each snapshot the store accepts; the latest prop is called. */
+  readonly onSnapshot?: NonNullable<ClientStoreOptions["onSnapshot"]>;
+  /** Called when the store drops its snapshot; the latest prop is called. */
+  readonly onClear?: () => void;
+  /** Milliseconds between approval status polls. Defaults to 2000. */
+  readonly approvalInterval?: number;
   readonly children: ReactNode;
 };
+/** Provider-wide content for the `<Protected>` slots a component leaves out. */
+type PermDockDefaults = {
+  readonly pending?: ReactNode;
+  readonly fallback?: ReactNode | ((decision: Decision) => ReactNode);
+  readonly approval?: ReactNode | ((decision: ApprovalRequiredDecision) => ReactNode);
+};
 type ProtectedProps = {
   readonly permission: Permission;
   readonly data?: unknown;
   readonly tenant?: string;
   readonly pending?: ReactNode;
   readonly fallback?: ReactNode | ((decision: Decision) => ReactNode);
-  readonly children: ReactNode | ((decision: Extract<Decision, {
-    readonly outcome: "granted";
-  }>) => ReactNode);
+  /** Rendered for an approval-required decision; defaults to `fallback`. */
+  readonly approval?: ReactNode | ((decision: ApprovalRequiredDecision) => ReactNode);
+  readonly children: ReactNode | ((decision: GrantedDecision) => ReactNode);
 };
 //#endregion
-export { ProtectedProps as n, PermDockProviderProps as t };
+export { PermDockProviderProps as n, ProtectedProps as r, PermDockDefaults as t };

package/dist/{types-Dnemwd77.d.ts → types-DpWfQdSh.d.ts}

@@ -1,4 +1,4 @@
-import { S as ResourceRelation } from "./permissions-DttnqqxC.js";
+import { S as ResourceRelation } from "./permission-types-Dg39z9Kv.js";
 //#region src/catalog/types.d.ts
 type CatalogUsage = {
   readonly file: string;
@@ -64,6 +64,8 @@ type CatalogResource = {
   /** The boolean column that keeps ancestor grants out of a row. */
   readonly restricted?: string;
   readonly restrictedStops?: readonly string[];
+  /** `resource(…, { meta })`: titles plus the app's own `x`; absent when empty. */
+  readonly meta?: Readonly<Record<string, unknown>>;
 };
 type CatalogRole = {
   readonly key: string;
@@ -146,6 +148,8 @@ type CatalogGrant = {
   };
   /** Present when the grant is a closure, reads the relation graph or is opaque; `where` and `check` are then omitted. */
   readonly portable?: false;
+  /** The grant's `meta`: a description plus the app's own `x`; absent when empty. */
+  readonly meta?: Readonly<Record<string, unknown>>;
 };
 /** `permissions.catalog.json`, validated by `schemas/catalog-v1.json`. */
 type CatalogDocument = {

package/dist/{types-Bvc4oWT6.d.ts → types-DvupZE0w.d.ts}

@@ -1,4 +1,4 @@
-import { f as Permission } from "./permissions-DttnqqxC.js";
+import { d as Permission } from "./permission-types-Dg39z9Kv.js";
 //#region src/agent/types.d.ts
 type ToolBinding = {
   readonly permission: Permission;

package/dist/unplugin/index.d.ts

@@ -1,4 +1,4 @@
-import { a as PermDockPluginOptions } from "../types-DbjRN55U.js";
+import { a as PermDockPluginOptions } from "../types-7rJVLWe5.js";
 import { createUnplugin } from "unplugin";
 //#region src/unplugin/index.d.ts
 type CreateUnplugin = typeof createUnplugin<PermDockPluginOptions | undefined>;

package/dist/unplugin/index.js

@@ -1,4 +1,4 @@
-import { n as createCollectScheduler, r as report } from "../watch-DVBJ9cBq.js";
+import { n as createCollectScheduler, r as report } from "../watch-zeucB7eF.js";
 import { t as peerHint } from "../peer-BOr_kJE1.js";
 import { createRequire } from "node:module";
 //#region src/unplugin/index.ts

package/dist/{usage-B0YuTQRO.js → usage-4G6t643F.js}

@@ -1,4 +1,4 @@
-import { a as listArg, i as globalArgs, t as COMMAND_DESCRIPTIONS } from "./commands-BeaGNj_o.js";
+import { a as listArg, i as globalArgs, t as COMMAND_DESCRIPTIONS } from "./commands-Cpip4ULx.js";
 import { defineCommand } from "citty";
 //#region src/cli/commands/usage.ts
 function usage(ctx) {
@@ -24,7 +24,7 @@ function usage(ctx) {
 			}
 		},
 		async run({ args: parsed, rawArgs }) {
-			const result = await (await import("./usage-DorAJiU_.js")).runUsage({
+			const result = await (await import("./usage-iFLJ0-rr.js")).runUsage({
 				cwd: ctx.cwd,
 				config: ctx.config,
 				ignore: listArg(rawArgs, "ignore"),

package/dist/{usage-ItS7nLcl.js → usage-CG9nOYZw.js}

@@ -1,17 +1,17 @@
-import { c as getResource } from "./permissions-DVoF6dMt.js";
+import { a as getResource } from "./permission-registry-BsblpB-z.js";
 import { o as usageResult } from "./errors-CWfoNg9N.js";
-import { a as USAGE_REPORT_SCHEMA } from "./version-BvacVTZR.js";
-import { o as jsonSchemaOf } from "./catalog-doc-DdGm82XT.js";
-import { i as rel, r as listSourceFiles } from "./files-DWUN9PzI.js";
-import { a as loadModule, n as asPolicy, o as pickNamed } from "./load-DhWEB9P1.js";
-import { r as runCollect } from "./collect-DSTE3ml9.js";
+import { a as rel, r as listSourceFiles } from "./files-D_JIzUrP.js";
+import { a as USAGE_REPORT_SCHEMA } from "./version-BEogC-rB.js";
+import { o as jsonSchemaOf } from "./catalog-doc-DWtg0gGR.js";
+import { a as loadModule, n as asPolicy, s as pickNamed } from "./load-C3_oTHyO.js";
+import { r as runCollect } from "./collect-2SrB7lfk.js";
 import { existsSync, readFileSync, realpathSync } from "node:fs";
 import { dirname, resolve } from "node:path";
 import { fileURLToPath, pathToFileURL } from "node:url";
 import { createJiti } from "jiti";
 import { Visitor, parseSync } from "oxc-parser";
 import { isBuiltin } from "node:module";
-//#region src/cli/doctor-source.ts
+//#region src/cli/doctor/source.ts
 /** Entries a client file must not import; `tests/cli/doctor-entries.test.ts` keeps it in step with `exports`. */
 const SERVER_SPECIFIERS = [
 	"permdock/a2a",

package/dist/usage-iFLJ0-rr.js

@@ -0,0 +1,2 @@
+import { t as runUsage } from "./usage-CG9nOYZw.js";
+export { runUsage };

package/dist/{validation-error-Ba264OaJ.d.ts → validation-error-BSSw0l_8.d.ts}

@@ -1,4 +1,4 @@
-import { a as ProblemDetails } from "./errors-DPdqI50v.js";
+import { a as ProblemDetails } from "./errors-OD_4c__H.js";
 import { StandardSchemaV1 } from "@standard-schema/spec";
 //#region src/core/validation-error.d.ts
 /** The base of every Problem Details `type` URI; defined here so a validation error does not pull in the Problem Details builders. */

package/dist/{validation-error-CnjZ4t92.js → validation-error-ZfUHbKvf.js}

@@ -1,4 +1,4 @@
-import { t as compact } from "./compact-y6vfu2_f.js";
+import { t as compact } from "./compact-CAf557ZB.js";
 //#region src/core/validation-error.ts
 /** The base of every Problem Details `type` URI; defined here so a validation error does not pull in the Problem Details builders. */
 const PROBLEM_BASE = "https://permdock.com/problems";