permdock 0.3.1 → 0.5.0

package/dist/grantee-Cn1HyUsI.js

@@ -0,0 +1,254 @@
+import { t as compact } from "./compact-CAf557ZB.js";
+import { n as freezeDeep, t as freezeCopy } from "./freeze-CrU8nQeX.js";
+import { i as ownKeys, n as isForbiddenKey, t as assertSafeKey } from "./paths-DXSHAMIa.js";
+import { c as listPermissions, o as isPermission } from "./permission-registry-Br4jSNVi.js";
+import { i as readAppData, r as parseAppData, t as assertAppData } from "./app-data-MuyzVqX8.js";
+//#region src/core/vocabulary.ts
+const ROLE_KIND = "role";
+const PLAN_KIND = "plan";
+const TREE_X_SCHEMA = Symbol.for("permdock.x-schema");
+function leafMeta(kind, key, meta, schema) {
+	if (meta === void 0) return freezeDeep({});
+	assertAppData(meta, `meta of ${kind} '${key}'`);
+	if (meta.x === void 0) return freezeDeep({ ...meta });
+	return freezeDeep({
+		...meta,
+		x: parseAppData(schema, meta.x, `meta.x of ${kind} '${key}'`)
+	});
+}
+function makeRole(key, init, schema) {
+	assertSafeKey(key, "role");
+	const on = init.on;
+	const leaf = {
+		key,
+		assignable: init.assignable ?? on !== void 0,
+		meta: leafMeta("role", key, init.meta, schema)
+	};
+	if (on !== void 0) Object.assign(leaf, { on });
+	Object.defineProperty(leaf, "kind", {
+		value: ROLE_KIND,
+		enumerable: false,
+		writable: false,
+		configurable: false
+	});
+	return Object.freeze(leaf);
+}
+function makePlan(key, init, schema) {
+	assertSafeKey(key, "plan");
+	const leaf = {
+		key,
+		meta: leafMeta("plan", key, init.meta, schema)
+	};
+	Object.defineProperty(leaf, "kind", {
+		value: PLAN_KIND,
+		enumerable: false,
+		writable: false,
+		configurable: false
+	});
+	return Object.freeze(leaf);
+}
+function isRole(value) {
+	return value !== null && typeof value === "object" && "key" in value && typeof value.key === "string" && value.kind === "role";
+}
+function isPlan(value) {
+	return value !== null && typeof value === "object" && "key" in value && typeof value.key === "string" && value.kind === "plan";
+}
+function attachSchema(tree, schema) {
+	if (schema !== void 0) Object.defineProperty(tree, TREE_X_SCHEMA, {
+		value: schema,
+		enumerable: false,
+		writable: false,
+		configurable: false
+	});
+}
+/** The `x` schema a `defineRoles` or `definePlans` tree was built with. */
+function treeXSchema(tree) {
+	if (tree === void 0 || !Object.hasOwn(tree, TREE_X_SCHEMA)) return;
+	return Reflect.get(tree, TREE_X_SCHEMA);
+}
+function defineRoles(input, options) {
+	const tree = {};
+	for (const key of Object.keys(input)) {
+		if (isForbiddenKey(key)) throw new Error(`PermDock: forbidden role key '${key}'`);
+		tree[key] = makeRole(key, input[key] ?? {}, options?.x);
+	}
+	attachSchema(tree, options?.x);
+	return freezeDeep(tree);
+}
+function definePlans(input, options) {
+	const tree = {};
+	for (const key of Object.keys(input)) {
+		if (isForbiddenKey(key)) throw new Error(`PermDock: forbidden plan key '${key}'`);
+		tree[key] = makePlan(key, input[key] ?? {}, options?.x);
+	}
+	attachSchema(tree, options?.x);
+	return freezeDeep(tree);
+}
+function listRoles(tree) {
+	if (tree === void 0) return [];
+	return ownKeys(tree).flatMap((key) => {
+		const leaf = tree[key];
+		return leaf === void 0 ? [] : [leaf];
+	});
+}
+function listPlans(tree) {
+	if (tree === void 0) return [];
+	return ownKeys(tree).flatMap((key) => {
+		const leaf = tree[key];
+		return leaf === void 0 ? [] : [leaf];
+	});
+}
+function findRole(tree, key) {
+	if (tree === void 0 || isForbiddenKey(key)) return;
+	return tree[key];
+}
+/**
+* The meta of a role a source returned (a stored custom role): known string
+* fields kept, `x` checked by the schema. Never throws; anything invalid is
+* left out, and the role itself is never dropped for it.
+*/
+function sourceRoleMeta(meta, schema) {
+	if (meta === null || typeof meta !== "object" || Array.isArray(meta)) return;
+	const text = (field) => {
+		const value = Object.hasOwn(meta, field) ? Reflect.get(meta, field) : void 0;
+		return typeof value === "string" ? value : void 0;
+	};
+	const rawX = Object.hasOwn(meta, "x") ? Reflect.get(meta, "x") : void 0;
+	const out = {};
+	for (const field of [
+		"title",
+		"description",
+		"audience"
+	]) {
+		const value = text(field);
+		if (value !== void 0) out[field] = value;
+	}
+	if (rawX !== void 0) {
+		const x = readAppData(schema, rawX);
+		if (x !== void 0) out.x = x;
+	}
+	return Object.keys(out).length === 0 ? void 0 : freezeCopy(out);
+}
+function synthesiseRole(key, options) {
+	const on = options?.on;
+	const assignable = options?.assignable ?? false;
+	const meta = options?.meta;
+	if (on === void 0) return makeRole(key, meta === void 0 ? { assignable } : {
+		assignable,
+		meta
+	});
+	return makeRole(key, meta === void 0 ? {
+		on,
+		assignable
+	} : {
+		on,
+		assignable,
+		meta
+	});
+}
+function isGrantee(value) {
+	return value !== null && typeof value === "object" && "kind" in value && typeof value.kind === "string";
+}
+function anyone() {
+	return freezeDeep({ kind: "anyone" });
+}
+function authenticated() {
+	return freezeDeep({ kind: "authenticated" });
+}
+function relation(resource, name, options) {
+	const resourceName = listPermissions(resource)[0]?.resource;
+	if (resourceName === void 0) throw new Error("PermDock: relation() requires a resource tree");
+	const through = options?.through;
+	if (Array.isArray(through)) {
+		if (through.length === 0) throw new Error("PermDock: relation() through needs at least one link");
+		for (const link of through) if (typeof link !== "string" || link === "" || link === "parent") throw new Error("PermDock: relation() through lists link names; walk parents with through: 'parent' or depth");
+	} else if (through !== void 0 && through !== "parent") throw new Error(`PermDock: relation() through must be 'parent' or a list of link names (got '${String(through)}')`);
+	const depth = options?.depth;
+	if (depth !== void 0) {
+		if (through === void 0) throw new Error("PermDock: relation() depth needs through: 'parent' or a link list");
+		const hops = Array.isArray(through) ? through.length : 0;
+		if (!Number.isInteger(depth) || depth < 0 || depth + hops > 32) throw new Error(`PermDock: relation() depth must be an integer from 0 to 32, counting each link`);
+	}
+	return freezeDeep(compact({
+		kind: "relation",
+		resource: resourceName,
+		relation: name,
+		through: through === void 0 || through === "parent" ? through : [...through],
+		depth
+	}));
+}
+function inherit(permission, options) {
+	if (!isPermission(permission) || permission.kind === "collection") throw new Error("PermDock: inherit() takes an instance permission leaf");
+	const through = options.through;
+	const links = Array.isArray(through) ? through : void 0;
+	if (through !== "parent" && (links === void 0 || links.length === 0 || !links.every((link) => typeof link === "string" && link !== "" && link !== "parent"))) throw new Error("PermDock: inherit() through must be 'parent' or a non-empty list of link names");
+	return freezeDeep({
+		kind: "inherit",
+		permission: permission.key,
+		resource: permission.resource,
+		through: links === void 0 ? "parent" : links.map(String)
+	});
+}
+function plan(name) {
+	return freezeDeep({
+		kind: "plan",
+		plan: typeof name === "string" ? name : name.key
+	});
+}
+function actor(kind) {
+	return freezeDeep({
+		kind: "actor",
+		actor: kind
+	});
+}
+function assurance(options) {
+	const acr = options.acr === void 0 ? void 0 : typeof options.acr === "string" ? [options.acr] : options.acr;
+	const amr = options.amr === void 0 ? void 0 : typeof options.amr === "string" ? [options.amr] : options.amr;
+	return freezeDeep(compact({
+		kind: "assurance",
+		acr,
+		amr,
+		maxAge: options.maxAge
+	}));
+}
+function resolveRoleScope(on) {
+	return typeof on === "string" ? on : "global";
+}
+function asGrantee(input) {
+	if (Array.isArray(input)) {
+		const items = [];
+		for (const item of input) items.push(...flattenGrantee(asGrantee(item)));
+		return items;
+	}
+	if (typeof input === "string") return freezeDeep({
+		kind: "role",
+		role: input,
+		scope: "global"
+	});
+	if (isRole(input)) return freezeDeep({
+		kind: "role",
+		role: input.key,
+		scope: resolveRoleScope(input.on)
+	});
+	if (isPlan(input)) return freezeDeep({
+		kind: "plan",
+		plan: input.key
+	});
+	if (isGrantee(input)) return input;
+	throw new Error("PermDock: invalid grantee");
+}
+function flattenGrantee(input) {
+	if (input === void 0) return [];
+	if (Array.isArray(input)) return input;
+	return [input];
+}
+function roleNameOf(to) {
+	for (const item of flattenGrantee(to)) if (item.kind === "role") return item.role;
+	return null;
+}
+function roleScopeOf(to, fallback = "global") {
+	for (const item of flattenGrantee(to)) if (item.kind === "role") return item.scope;
+	return fallback;
+}
+//#endregion
+export { listPlans as _, authenticated as a, synthesiseRole as b, plan as c, roleScopeOf as d, definePlans as f, isRole as g, isPlan as h, assurance as i, relation as l, findRole as m, anyone as n, flattenGrantee as o, defineRoles as p, asGrantee as r, inherit as s, actor as t, roleNameOf as u, listRoles as v, treeXSchema as x, sourceRoleMeta as y };

package/dist/grantee-conditions-CcXf8hMM.js

@@ -0,0 +1,271 @@
+import { a as sole, t as compact } from "./compact-CAf557ZB.js";
+import { a as expandRelation, c as isEdgeRelation, d as isSelfParented, l as isFieldRelation, m as restrictedStops, p as restrictedFor, s as isComputedRelation, u as isPrincipalRelation } from "./resource-relations-D_jw0BFx.js";
+import { d as isoNow } from "./time-DkWjdL98.js";
+import { c as rootScope, d as scopeList, o as resolveScope } from "./scopes-CUPSjo9q.js";
+//#region src/core/grantee-conditions.ts
+/**
+* Where a graph relation starts on the row: its own id when the relation is
+* on the row's resource, the parent field when it is on the parent resource.
+* `undefined` when `through` cannot reach the relation's resource.
+*/
+function relationStart(grantee, resource, target) {
+	if (resource === void 0 || target === void 0 || Array.isArray(grantee.through)) return;
+	const walks = grantee.through === "parent" && isSelfParented(target);
+	const requested = grantee.depth ?? 16;
+	const depth = walks ? Number.isInteger(requested) ? Math.min(Math.max(requested, 0), 32) : 0 : 0;
+	if (target.name === resource.name) return {
+		field: resource.id,
+		parent: false,
+		depth
+	};
+	if (grantee.through === "parent" && resource.parent?.resource === target.name) return {
+		field: resource.parent.field,
+		parent: true,
+		depth
+	};
+}
+/**
+* A resource role held on self-parented `membershipResource` instances
+* (`ids`) reaches rows below them: the row itself when it is of that
+* resource, its parent field when its parent is, walked up to the default
+* depth. `undefined` when the row is not on such a chain.
+*/
+function resourceRoleCondition(resource, membershipResource, ids, resources) {
+	if (resource === void 0 || !isSelfParented(resources.get(membershipResource))) return;
+	const start = resource.name === membershipResource ? {
+		field: resource.id,
+		parent: false
+	} : resource.parent?.resource === membershipResource ? {
+		field: resource.parent.field,
+		parent: true
+	} : void 0;
+	if (start === void 0) return;
+	return compact({
+		op: "related",
+		resource: membershipResource,
+		relation: "",
+		ids: [...new Set(ids)].toSorted(),
+		field: start.field,
+		depth: 16,
+		parent: start.parent ? true : void 0,
+		restricted: restrictedFor(resource, "parent"),
+		passRestricted: passesRestricted(resources.get(membershipResource))
+	});
+}
+function passesRestricted(node) {
+	return node?.restricted !== void 0 && !restrictedStops(node, "parent") ? true : void 0;
+}
+function linkStop(resource, link) {
+	const restricted = restrictedFor(resource, link);
+	if (restricted === void 0) return {};
+	const parent = resource.parent;
+	if (parent === void 0 || !isSelfParented(resource)) return { restricted };
+	return {
+		restricted,
+		restrictedAncestors: {
+			resource: resource.name,
+			id: resource.id,
+			parent: parent.field,
+			field: restricted,
+			depth: 32
+		}
+	};
+}
+/**
+* The link path from the row to the grantee's resource: the row field of
+* the first link and each hop. `undefined` when a link is not declared or
+* the path ends on another resource.
+*/
+function relationHops(grantee, resource, resources) {
+	const through = grantee.through;
+	if (!Array.isArray(through) || resource === void 0) return;
+	const hops = [];
+	let current = resource;
+	let field;
+	for (const link of through) {
+		const spec = current !== void 0 && Object.hasOwn(current.links, link) ? current.links[link] : void 0;
+		if (spec === void 0) return;
+		field ??= spec.field;
+		hops.push({
+			link,
+			resource: spec.resource
+		});
+		current = resources?.get(spec.resource);
+	}
+	if (field === void 0 || current === void 0 || current.name !== grantee.resource) return;
+	const depth = grantee.depth ?? 0;
+	if (depth > 0 && !isSelfParented(current)) return;
+	return {
+		field,
+		hops,
+		depth
+	};
+}
+/**
+* Whether the grantee needs the relation graph: a `through` walk, an edge
+* table, or an `includes` that reaches one.
+*/
+function isGraphRelation(grantee, resources) {
+	if (grantee.through !== void 0) return true;
+	const node = resources?.get(grantee.resource);
+	return expandRelation(node, grantee.relation).some((name) => isEdgeRelation(node?.relations[name]));
+}
+function periodConditions(spec, now) {
+	const out = [];
+	const startsAt = spec.period?.startsAt;
+	if (startsAt !== void 0) out.push({
+		op: "or",
+		conditions: [{
+			op: "isNull",
+			field: startsAt,
+			value: true
+		}, {
+			op: "lte",
+			field: startsAt,
+			value: now
+		}]
+	});
+	const expiresAt = spec.period?.expiresAt;
+	if (expiresAt !== void 0) out.push({
+		op: "or",
+		conditions: [{
+			op: "isNull",
+			field: expiresAt,
+			value: true
+		}, {
+			op: "gt",
+			field: expiresAt,
+			value: now
+		}]
+	});
+	return out;
+}
+function relationCondition(grantee, resource, scopes = scopeList(void 0), options = {}) {
+	const target = grantee.resource === resource?.name ? resource : options.resources?.get(grantee.resource);
+	if (isGraphRelation(grantee, options.resources ?? targetMap(target))) {
+		const spec = target?.relations[grantee.relation];
+		if (spec === void 0 || isFieldRelation(spec) && spec.memberOf !== void 0) return;
+		if (Array.isArray(grantee.through)) {
+			const path = relationHops(grantee, resource, options.resources);
+			if (path === void 0 || target === void 0) return;
+			return compact({
+				op: "related",
+				resource: target.name,
+				relation: grantee.relation,
+				field: path.field,
+				depth: path.depth,
+				hops: path.hops,
+				...resource === void 0 ? {} : linkStop(resource, firstLink(path)),
+				passRestricted: path.depth > 0 ? passesRestricted(target) : void 0
+			});
+		}
+		const start = relationStart(grantee, resource, target);
+		if (start === void 0 || target === void 0) return;
+		return compact({
+			op: "related",
+			resource: target.name,
+			relation: grantee.relation,
+			field: start.field,
+			depth: start.depth,
+			parent: start.parent ? true : void 0,
+			restricted: start.parent || start.depth > 0 ? restrictedFor(resource, "parent") : void 0,
+			passRestricted: start.depth > 0 ? passesRestricted(target) : void 0
+		});
+	}
+	const spec = resource?.relations?.[grantee.relation];
+	if (spec === void 0 || isEdgeRelation(spec)) return;
+	if (spec.includes !== void 0 && options.includes !== false) {
+		const parts = expandRelation(resource, grantee.relation).flatMap((name) => {
+			const part = relationCondition({
+				...grantee,
+				relation: name
+			}, resource, scopes, {
+				...options,
+				includes: false
+			});
+			return part === void 0 ? [] : [part];
+		});
+		return sole(parts) ?? {
+			op: "or",
+			conditions: parts
+		};
+	}
+	if (isComputedRelation(spec)) return;
+	if (isPrincipalRelation(spec)) {
+		const owner = {
+			op: "eq",
+			field: spec.principal,
+			value: { ref: "principal.id" }
+		};
+		const period = periodConditions(spec, options.now ?? { date: isoNow() });
+		return period.length === 0 ? owner : {
+			op: "and",
+			conditions: [owner, ...period]
+		};
+	}
+	if (spec.memberOf !== void 0) {
+		const scope = resolveScope(scopes, spec.memberOf);
+		if (scope === void 0) return {
+			op: "or",
+			conditions: []
+		};
+		if (scope === rootScope(scopes)) return {
+			op: "eq",
+			field: spec.field,
+			value: { ref: "principal.tenant" }
+		};
+		return {
+			op: "memberOf",
+			scope,
+			field: spec.field,
+			roles: []
+		};
+	}
+	return {
+		op: "eq",
+		field: spec.field,
+		value: { ref: "principal.id" }
+	};
+}
+function inheritCondition(grantee, resource, resources) {
+	if (resource === void 0) return;
+	if (grantee.through === "parent") {
+		const parent = resource.parent;
+		if (parent === void 0 || parent.resource !== grantee.resource) return;
+		return compact({
+			op: "related",
+			resource: grantee.resource,
+			relation: "",
+			permission: grantee.permission,
+			field: parent.field,
+			depth: 0,
+			parent: true,
+			restricted: restrictedFor(resource, "parent")
+		});
+	}
+	const path = relationHops({
+		kind: "relation",
+		resource: grantee.resource,
+		relation: "",
+		through: grantee.through
+	}, resource, resources);
+	if (path === void 0) return;
+	return compact({
+		op: "related",
+		resource: grantee.resource,
+		relation: "",
+		permission: grantee.permission,
+		field: path.field,
+		depth: 0,
+		hops: path.hops,
+		...linkStop(resource, firstLink(path))
+	});
+}
+function firstLink(path) {
+	return path.hops[0]?.link ?? "";
+}
+function targetMap(target) {
+	return target === void 0 ? void 0 : /* @__PURE__ */ new Map([[target.name, target]]);
+}
+//#endregion
+export { relationStart as a, relationHops as i, isGraphRelation as n, resourceRoleCondition as o, relationCondition as r, inheritCondition as t };

package/dist/grantee-match-DHArqY82.js

@@ -0,0 +1,142 @@
+import { t as compact } from "./compact-CAf557ZB.js";
+import { u as isoAt } from "./time-DkWjdL98.js";
+import { d as scopeList, t as activeFor } from "./scopes-CUPSjo9q.js";
+import { o as flattenGrantee } from "./grantee-Cn1HyUsI.js";
+import { r as relationCondition, t as inheritCondition } from "./grantee-conditions-CcXf8hMM.js";
+//#region src/core/grantee-match.ts
+function combineWhere(left, right) {
+	if (left === void 0) return right;
+	if (right === void 0) return left;
+	return {
+		op: "and",
+		conditions: [left, right]
+	};
+}
+/** Seats (`Membership.entitlements`) held through memberships that apply under the active tenant. */
+function seatsInTenant(subject, scopes) {
+	const principal = subject.principal;
+	if (principal === null) return [];
+	const list = scopeList(scopes);
+	return (principal.memberships ?? []).flatMap((membership) => membership.entitlements !== void 0 && activeFor(membership, list, principal.tenant) ? membership.entitlements : []);
+}
+function matchOne(grantee, subject, now, resource, scopes, resources) {
+	switch (grantee.kind) {
+		case "anyone": return { matched: true };
+		case "authenticated": return subject.principal === null ? {
+			matched: false,
+			reason: "anonymous"
+		} : { matched: true };
+		case "plan":
+			if (subject.principal === null) return {
+				matched: false,
+				reason: "anonymous"
+			};
+			return (subject.principal.plans ?? []).includes(grantee.plan) || seatsInTenant(subject, scopes).includes(grantee.plan) ? { matched: true } : {
+				matched: false,
+				reason: "not-entitled"
+			};
+		case "actor":
+			if (subject.actor === void 0) return {
+				matched: false,
+				reason: "no-grant"
+			};
+			return subject.actor.kind === grantee.actor ? { matched: true } : {
+				matched: false,
+				reason: "no-grant"
+			};
+		case "assurance": {
+			if (subject.principal === null) return {
+				matched: false,
+				reason: "anonymous"
+			};
+			const principalAssurance = subject.principal.assurance;
+			if (grantee.acr !== void 0 && grantee.acr.length > 0) {
+				const acr = principalAssurance?.acr;
+				if (acr === void 0 || !grantee.acr.includes(acr)) return {
+					matched: false,
+					reason: "insufficient-user-authentication"
+				};
+			}
+			if (grantee.amr !== void 0 && grantee.amr.length > 0) {
+				const amr = principalAssurance?.amr ?? [];
+				if (!grantee.amr.every((method) => amr.includes(method))) return {
+					matched: false,
+					reason: "insufficient-user-authentication"
+				};
+			}
+			if (grantee.maxAge !== void 0) {
+				const authTime = principalAssurance?.authTime;
+				if (authTime === void 0 || now - authTime > grantee.maxAge) return {
+					matched: false,
+					reason: "insufficient-user-authentication"
+				};
+			}
+			return { matched: true };
+		}
+		case "relation": {
+			if (subject.principal === null) return {
+				matched: false,
+				reason: "anonymous"
+			};
+			const where = relationCondition(grantee, resource, scopes, {
+				resources,
+				now: { date: isoAt(now * 1e3) }
+			});
+			if (where === void 0 && resource !== void 0) return {
+				matched: false,
+				reason: "condition"
+			};
+			return compact({
+				matched: true,
+				where
+			});
+		}
+		case "inherit": {
+			const where = inheritCondition(grantee, resource, resources);
+			return where === void 0 ? {
+				matched: false,
+				reason: "condition"
+			} : {
+				matched: true,
+				where
+			};
+		}
+		case "role":
+			if (subject.principal === null) return {
+				matched: false,
+				reason: "anonymous"
+			};
+			return { matched: true };
+		default: return unknownGrantee(grantee);
+	}
+}
+/** A kind this build does not know, from a forged snapshot or a newer document, never matches. */
+function unknownGrantee(_grantee) {
+	return {
+		matched: false,
+		reason: "no-grant",
+		unknown: true
+	};
+}
+function matchGrantee(to, subject, now, resource, scopes, resources, unknownMatches = false) {
+	const items = flattenGrantee(to);
+	if (items.length === 0) return {
+		matched: false,
+		reason: "no-grant"
+	};
+	let where;
+	for (const item of items) {
+		const result = matchOne(item, subject, now, resource, scopes, resources);
+		if (!result.matched) {
+			if (unknownMatches && result.unknown === true) continue;
+			return result;
+		}
+		where = combineWhere(where, result.where);
+	}
+	return compact({
+		matched: true,
+		where
+	});
+}
+//#endregion
+export { matchGrantee as n, combineWhere as t };

package/dist/h3/index.d.ts

@@ -0,0 +1,37 @@
+import { T as Policy, Vt as Snapshot, j as PolicyVocabulary, rr as Principal } from "../policy-types-DzwivBgR.js";
+import { r as PermDock } from "../permdock-D7eeLJER.js";
+import { D as ConnectionOptions, T as Connection, f as InvalidSignatureError, i as OpenApiHooks, u as SnapshotQuery, v as discoverViaSignatureAgent, x as webBotAuthVerifier } from "../server-types-BLd4MnBX.js";
+import { a as ProtectTarget, n as FetchAdapterOptions, r as FetchProtect, t as ContextReader } from "../fetch-adapter-qKJBuRqy.js";
+import { EventHandler, H3Event, H3EventContext, Middleware } from "h3";
+//#region src/h3/create.d.ts
+type H3PermDockOptions<TUser = unknown> = FetchAdapterOptions<H3Event, TUser>;
+/** `event.context` once `middleware()` or `protect` ran: the instance and the loaded row. */
+type H3PermDockContext<TData = unknown, V extends PolicyVocabulary = PolicyVocabulary> = H3EventContext & {
+  readonly permdock: PermDock<V>;
+  readonly permdockData: TData;
+};
+/** The event `withPermDock` hands its handler. */
+type H3PermDockEvent<TData = unknown, V extends PolicyVocabulary = PolicyVocabulary> = H3Event & {
+  readonly context: H3PermDockContext<TData, V>;
+};
+type H3PermDock<V extends PolicyVocabulary = PolicyVocabulary> = {
+  /** Global or route middleware that sets `event.context.permdock`. */
+  readonly middleware: () => Middleware;
+  /** Route middleware: a refusal short-circuits with Problem Details. */
+  readonly protect: FetchProtect<H3Event, Middleware>;
+  readonly getPermDock: (event: H3Event) => Promise<PermDock<V>>;
+  readonly getSnapshot: (event: H3Event, query?: SnapshotQuery) => Promise<Snapshot>;
+  /**
+   * Types `event.context.permdock` and `permdockData` for the handler, builds
+   * the instance when no middleware set it, and answers a thrown PermDock
+   * error with Problem Details.
+   */
+  readonly withPermDock: <TData = unknown>(handler: (event: H3PermDockEvent<TData, V>) => unknown) => EventHandler;
+  readonly connection: (event: H3Event, connectionOptions?: ConnectionOptions) => Promise<Connection>;
+  /** The decision endpoint: `app.all('/api/permdock', permdockHandler())`. */
+  readonly permdockHandler: () => EventHandler;
+  readonly openapi: OpenApiHooks;
+};
+export declare function createPermDock<TUser, TPrincipal extends Principal = Principal, V extends PolicyVocabulary = PolicyVocabulary>(policy: Policy<TUser, TPrincipal, V>, options: H3PermDockOptions<TUser>): H3PermDock<V>;
+//#endregion
+export { type ContextReader, type H3PermDock, type H3PermDockContext, type H3PermDockEvent, type H3PermDockOptions, InvalidSignatureError, type ProtectTarget, discoverViaSignatureAgent, webBotAuthVerifier };