permdock 0.3.1 → 0.5.0

package/dist/h3/index.js

@@ -0,0 +1,35 @@
+import { d as discoverViaSignatureAgent, m as webBotAuthVerifier, u as InvalidSignatureError } from "../evaluations-DZ2CbV5k.js";
+import { i as decorate } from "../bind-CZzhx-Vj.js";
+import { t as fetchAdapter } from "../fetch-adapter-g0ypLkID.js";
+//#region src/h3/create.ts
+function createPermDock(policy, options) {
+	const adapter = fetchAdapter(policy, options, "h3", (event) => event.req);
+	const middleware = () => async (event, next) => {
+		const attached = await adapter.ensure(event.context, event);
+		if (!attached.ok) return attached.response;
+		return adapter.mapErrors(event, next);
+	};
+	const protect = ((target, data, protectOptions) => async (event, next) => {
+		const guard = await adapter.guard(target, data, event, protectOptions);
+		if (!guard.ok) return guard.response;
+		decorate(event.context, guard.permdock, guard.data);
+		return adapter.mapErrors(event, next);
+	});
+	const withPermDock = (handler) => async (event) => {
+		const attached = await adapter.ensure(event.context, event);
+		if (!attached.ok) return attached.response;
+		return adapter.mapErrors(event, () => handler(event));
+	};
+	return {
+		middleware,
+		protect,
+		getPermDock: adapter.getPermDock,
+		getSnapshot: adapter.getSnapshot,
+		withPermDock,
+		connection: adapter.connection,
+		permdockHandler: () => adapter.handler(),
+		openapi: adapter.kernel.openapi
+	};
+}
+//#endregion
+export { InvalidSignatureError, createPermDock, discoverViaSignatureAgent, webBotAuthVerifier };

package/dist/headers-BIjfMaoC.js

@@ -0,0 +1,8 @@
+import { t as approvalHeaderValue } from "./approval-header-CJACtHkv.js";
+//#region src/client/headers.ts
+/** The `PermDock-Approval` header for a resume; a `TypeError` for a token that is not an RFC 9651 sf-token. */
+function approvalHeaders(token) {
+	return { "PermDock-Approval": approvalHeaderValue(token) };
+}
+//#endregion
+export { approvalHeaders as t };

package/dist/headers-CIbDTUTK.d.ts

@@ -0,0 +1,7 @@
+//#region src/client/headers.d.ts
+/** The `PermDock-Approval` header for a resume; a `TypeError` for a token that is not an RFC 9651 sf-token. */
+declare function approvalHeaders(token: string): {
+  readonly "PermDock-Approval": string;
+};
+//#endregion
+export { approvalHeaders as t };

package/dist/{helpers-H_KARDVC.js → helpers-DTcZOzhF.js}

@@ -1,12 +1,16 @@
-import { t as compact } from "./compact-y6vfu2_f.js";
+import { t as compact } from "./compact-CAf557ZB.js";
 import { n as freezeDeep } from "./freeze-CrU8nQeX.js";
-import { i as findPermission, s as getRegistry } from "./permissions-DVoF6dMt.js";
-import { r as approverLeaves } from "./approvers-DT4AVyIg.js";
-import { t as describe } from "./describe-B_gVZEVi.js";
-import { t as parseDuration } from "./duration-xK2jGFVc.js";
-import { i as relationReader, n as pendingRelations, o as resolveRelated } from "./relations-cjOL01hZ.js";
-import { t as ApprovalError } from "./errors-DRnGZHzF.js";
-import { f as approverRelationKey, l as APPROVAL_HEADER, n as assertApprover, s as listAllApprovals } from "./store-DMAWwAJV.js";
+import { r as approverLeaves } from "./approvers-CqPOLD-o.js";
+import { t as describe } from "./describe-BybMRY7A.js";
+import { i as getRegistry, n as findPermission } from "./permission-registry-Br4jSNVi.js";
+import { t as assertAppData } from "./app-data-MuyzVqX8.js";
+import { a as durationOf, i as dateAt, u as isoAt } from "./time-DkWjdL98.js";
+import { r as relationReader, t as pendingRelations } from "./relations-BnCWnJGI.js";
+import { n as resolveRelated } from "./relation-walk-3OyDBF0S.js";
+import { n as toWireDelegation } from "./wire-delegation-Cv3W2eaM.js";
+import { i as approverRelationKey, s as ApprovalError, t as APPROVAL_HEADER } from "./types-DqzsnlSA.js";
+import { c as listAllApprovals, n as assertApprover } from "./store-4u_hxjWa.js";
+import { n as parseApprovalHeader } from "./approval-header-CJACtHkv.js";
 //#region src/approvals/relations.ts
 const DEFAULT_PARENT_DEPTH = 16;
 /** Every approver a request names: `by`, each stage and its escalation, and `escalation.to`, inside `anyOf` groups too. */
@@ -70,7 +74,7 @@ async function approverRelations(request, subject, options) {
 	const registry = getRegistry(options.permissions);
 	const cache = /* @__PURE__ */ new Map();
 	const reader = relationReader(options.relations, cache, registry);
-	const now = (options.now ?? /* @__PURE__ */ new Date()).getTime() / 1e3;
+	const now = dateAt(options.now).getTime() / 1e3;
 	const holds = async (item) => {
 		const start = await startOf(item, request.resource.type, id, reader, cache, registry);
 		if (start === void 0) return false;
@@ -132,7 +136,7 @@ function permissionMeta(permission) {
 		resource: permission.resource
 	};
 }
-function summariseSubject(subject) {
+function summarizeSubject(subject) {
 	const principal = subject.principal;
 	return compact({
 		principal: principal === null ? null : compact({
@@ -145,10 +149,10 @@ function summariseSubject(subject) {
 			kind: subject.actor.kind
 		},
 		session: subject.session,
-		delegation: subject.delegation === void 0 ? void 0 : compact({
+		delegation: toWireDelegation(subject.delegation === void 0 ? void 0 : compact({
 			scopes: subject.delegation.scopes,
 			authorizationDetails: subject.delegation.authorizationDetails
-		})
+		}))
 	});
 }
 /**
@@ -157,13 +161,14 @@ function summariseSubject(subject) {
 * extends it.
 */
 function approvalTtl(storeTtl, approval) {
-	if (storeTtl !== void 0 && (!Number.isSafeInteger(storeTtl) || storeTtl <= 0)) throw new RangeError(`PermDock: approval ttl must be a positive whole number of milliseconds, got ${String(storeTtl)}`);
-	const base = storeTtl ?? 36e5;
-	const grant = approval === void 0 || approval === "human" ? void 0 : parseDuration(approval.ttl);
-	return grant === void 0 ? base : Math.min(base, grant * 1e3);
+	if (storeTtl !== void 0 && durationOf(storeTtl) === void 0) throw new RangeError(`PermDock: approval ttl must be a whole number of seconds above 0, got ${String(storeTtl)}`);
+	const base = storeTtl ?? 3600;
+	const grant = approval === void 0 || approval === "human" ? void 0 : durationOf(approval.ttl);
+	return grant === void 0 ? base : Math.min(base, grant);
 }
 async function requestApproval(store, decision, meta) {
-	const now = meta.now ?? /* @__PURE__ */ new Date();
+	if (meta.x !== void 0) assertAppData(meta.x, "x of an approval request");
+	const now = dateAt(meta.now);
 	const leaf = permissionMeta(meta.permission);
 	const approval = decision.grant.approval;
 	const approvers = approval === void 0 || approval === "human" ? void 0 : compact({
@@ -178,18 +183,20 @@ async function requestApproval(store, decision, meta) {
 	const ttl = approvalTtl(meta.ttl ?? store.ttl, approval);
 	const request = freezeDeep(compact({
 		v: 1,
+		id: globalThis.crypto.randomUUID(),
 		token: decision.token,
 		permission: leaf.key,
 		scope: leaf.scope,
 		resource: meta.resource ?? { type: leaf.resource },
-		subject: summariseSubject(meta.subject),
+		subject: summarizeSubject(meta.subject),
 		membership: meta.membership,
 		approvers,
 		detail: meta.detail ?? describe(decision).detail,
 		adapter: meta.adapter,
 		createdAt: now.toISOString(),
-		expiresAt: new Date(now.getTime() + ttl).toISOString(),
-		status: "pending"
+		expiresAt: isoAt(now.getTime() + ttl * 1e3),
+		status: "pending",
+		x: meta.x
 	}));
 	await store.create(request);
 	return request;
@@ -219,28 +226,29 @@ async function vouchApproval(store, token, verdict) {
 		vouched: verdict.rule
 	}));
 }
-async function inspectApproval(store, token, now = /* @__PURE__ */ new Date()) {
-	await store.expire(now);
+async function inspectApproval(store, token, at) {
+	const now = dateAt(at).getTime();
+	await store.expire({ epochMilliseconds: now });
 	const request = await store.get(token);
 	if (request === null) return {
 		ok: false,
-		detail: "approval-not-found"
+		cause: "approval-not-found"
 	};
 	if (request.status === "pending") return {
 		ok: false,
-		detail: "approval-pending"
+		cause: "approval-pending"
 	};
 	if (request.status === "rejected") return {
 		ok: false,
-		detail: "approval-rejected"
+		cause: "approval-rejected"
 	};
 	if (request.consumedAt !== void 0) return {
 		ok: false,
-		detail: "approval-consumed"
+		cause: "approval-consumed"
 	};
-	if (request.status === "expired" || Date.parse(request.expiresAt) <= now.getTime()) return {
+	if (request.status === "expired" || Date.parse(request.expiresAt) <= now) return {
 		ok: false,
-		detail: "approval-expired"
+		cause: "approval-expired"
 	};
 	return {
 		ok: true,
@@ -248,17 +256,18 @@ async function inspectApproval(store, token, now = /* @__PURE__ */ new Date()) {
 	};
 }
 /** Inspects `token` and, when it is approved, consumes it so it resumes once. */
-async function consumeApproval(store, token, now = /* @__PURE__ */ new Date()) {
+async function consumeApproval(store, token, at) {
+	const now = { epochMilliseconds: dateAt(at).getTime() };
 	const inspected = await inspectApproval(store, token, now);
 	if (!inspected.ok) return inspected;
 	if (typeof store.consume !== "function") return {
 		ok: false,
-		detail: "approval-not-found"
+		cause: "approval-not-found"
 	};
 	const consumed = await store.consume(token, now);
 	if (consumed === null) return {
 		ok: false,
-		detail: "approval-consumed"
+		cause: "approval-consumed"
 	};
 	return {
 		ok: true,
@@ -331,13 +340,13 @@ async function resumeDecision(input) {
 		inspected = await inspectApproval(store, token, input.now);
 		if (inspected.ok) {
 			const { request } = inspected;
-			if (request.permission !== input.permission.key || request.resource.id !== void 0 && request.resource.id !== input.resource.id) return approvalDenied("approval-mismatch");
+			if (request.permission !== input.permission.key || request.resource.id !== void 0 && request.resource.id !== input.resource.id || request.subject.principal?.id !== input.subject.principal?.id) return approvalDenied("approval-mismatch");
 			if (input.consume !== false) inspected = await consumeApproval(store, token, input.now);
 		}
 	} catch {
 		return approvalDenied("approval-not-found");
 	}
-	if (!inspected.ok) return approvalDenied(inspected.detail);
+	if (!inspected.ok) return approvalDenied(inspected.cause);
 	const principal = input.subject.principal;
 	if (principal === null) return approvalDenied("approval-mismatch");
 	return {
@@ -382,16 +391,15 @@ async function cancelApprovals(store, filter, meta) {
 		}
 	}))).filter(Boolean).length;
 }
+/** The token of a `PermDock-Approval` field: one RFC 9651 sf-token Item with no parameters, else `undefined`. */
 function readApprovalHeader(headers) {
-	const value = headers.get(APPROVAL_HEADER);
-	if (value === null || value.trim() === "") return;
-	return value.trim();
+	return parseApprovalHeader(headers.get(APPROVAL_HEADER));
 }
 function resumeFromHeader(store, headers, now) {
 	const token = readApprovalHeader(headers);
 	if (token === void 0) return Promise.resolve({
 		ok: false,
-		detail: "approval-not-found"
+		cause: "approval-not-found"
 	});
 	return inspectApproval(store, token, now);
 }
@@ -408,7 +416,7 @@ function resumeFromHeader(store, headers, now) {
 */
 async function storedApprovalToken(store, decision, options = {}) {
 	if (store === void 0 || decision.outcome !== "approval-required") return;
-	const now = (options.now ?? /* @__PURE__ */ new Date()).getTime();
+	const now = dateAt(options.now).getTime();
 	try {
 		const record = await store.get(decision.token);
 		if (record === null || record.status === "pending" && options.denyPending !== true || record.status === "expired" || Date.parse(record.expiresAt) <= now) return;
@@ -418,4 +426,4 @@ async function storedApprovalToken(store, decision, options = {}) {
 	}
 }
 //#endregion
-export { requestApproval as a, resumeFromHeader as c, vouchApproval as d, approverPermissions as f, readApprovalHeader as i, storedApprovalToken as l, approverRelations as m, consumeApproval as n, resolveApproval as o, heldPermissions as p, inspectApproval as r, resumeDecision as s, cancelApprovals as t, summariseSubject as u };
+export { requestApproval as a, resumeFromHeader as c, vouchApproval as d, approverPermissions as f, readApprovalHeader as i, storedApprovalToken as l, approverRelations as m, consumeApproval as n, resolveApproval as o, heldPermissions as p, inspectApproval as r, resumeDecision as s, cancelApprovals as t, summarizeSubject as u };

package/dist/hono/index.d.ts

@@ -1,8 +1,9 @@
-import { C as Policy, D as PolicyVocabulary, Nr as Principal, ln as PermDock } from "../policy-IB6yxpC3.js";
-import { f as Permission } from "../permissions-DttnqqxC.js";
-import { n as RevocationFeed } from "../revocations-Cy06JNx2.js";
-import { A as ConnectionOptions, O as Connection, h as InvalidSignatureError, i as ProtectOptions, n as OpenApiHooks, w as verifyWebBotAuth, x as discoverViaSignatureAgent } from "../create-B1d519XK.js";
-import { t as ServerAdapterOptions } from "../bind-C_ob3LKa.js";
+import { T as Policy, j as PolicyVocabulary, rr as Principal } from "../policy-types-DzwivBgR.js";
+import { w as Permission } from "../vocabulary-D6lPdb4Z.js";
+import { r as PermDock } from "../permdock-D7eeLJER.js";
+import { n as RevocationFeed } from "../revocations-R07lFBnX.js";
+import { D as ConnectionOptions, T as Connection, f as InvalidSignatureError, i as OpenApiHooks, o as ProtectOptions, v as discoverViaSignatureAgent, x as webBotAuthVerifier } from "../server-types-BLd4MnBX.js";
+import { t as ServerAdapterOptions } from "../bind--9EFVYWF.js";
 import { Context, Hono, MiddlewareHandler } from "hono";
 import { SSEMessage, SSEStreamingApi } from "hono/streaming";
 import { WSEvents } from "hono/ws";
@@ -12,15 +13,17 @@ type HonoPermDockOptions<TUser = unknown> = ServerAdapterOptions<Context, TUser>
   readonly revocations?: RevocationFeed;
 };
 /** The `Variables` both middlewares set; Hono merges them into the route's Env. */
-type PermDockEnv<TData = unknown, V extends PolicyVocabulary = PolicyVocabulary> = {
+type HonoPermDockEnv<TData = unknown, V extends PolicyVocabulary = PolicyVocabulary> = {
   readonly Variables: {
     readonly permdock: PermDock<V>;
     readonly permdockData: TData;
   };
 };
 type HonoPermDock<V extends PolicyVocabulary = PolicyVocabulary> = {
-  readonly permdock: () => MiddlewareHandler<PermDockEnv<unknown, V>>;
-  readonly protect: <TData = unknown>(permission: Permission | null, loadData?: (c: Context) => TData | Promise<TData>, protectOptions?: ProtectOptions) => MiddlewareHandler<PermDockEnv<NonNullable<TData>, V>>;
+  /** The `PermDock` for one request, for code the middleware does not run before. */
+  readonly getPermDock: (c: Context) => Promise<PermDock<V>>;
+  readonly middleware: () => MiddlewareHandler<HonoPermDockEnv<unknown, V>>;
+  readonly protect: <TData = unknown>(permission: Permission | null, data?: (c: Context) => TData | Promise<TData>, protectOptions?: ProtectOptions) => MiddlewareHandler<HonoPermDockEnv<NonNullable<TData>, V>>;
   /** A long-lived connection for the request behind `c`. */
   readonly connection: (c: Context, connectionOptions?: ConnectionOptions) => Promise<Connection>;
   /** `upgradeWebSocket` events that close with `1008` when the connection aborts. */
@@ -45,4 +48,4 @@ type SseOptions<T> = {
 };
 export declare function createPermDock<TUser, TPrincipal extends Principal = Principal, V extends PolicyVocabulary = PolicyVocabulary>(policy: Policy<TUser, TPrincipal, V>, options: HonoPermDockOptions<TUser>): HonoPermDock<V>;
 //#endregion
-export { type HonoPermDock, type HonoPermDockOptions, InvalidSignatureError, type PermDockEnv, type SseOptions, discoverViaSignatureAgent, verifyWebBotAuth };
+export { type HonoPermDock, type HonoPermDockEnv, type HonoPermDockOptions, InvalidSignatureError, type SseOptions, discoverViaSignatureAgent, webBotAuthVerifier };

package/dist/hono/index.js

@@ -1,9 +1,9 @@
-import { t as compact } from "../compact-y6vfu2_f.js";
-import { r as PermDockRevokedError } from "../errors-Cz5zn0mW.js";
-import { i as discoverViaSignatureAgent, r as InvalidSignatureError, s as verifyWebBotAuth } from "../evaluations-tz6D9A2G.js";
-import { t as problemFromError } from "../map-error-pgUWNNtG.js";
-import { r as bindKernel } from "../bind-CuzGytRf.js";
-import { i as onRevoked, n as guardIterable, t as POLICY_VIOLATION } from "../stream-DDpvynSB.js";
+import { t as compact } from "../compact-CAf557ZB.js";
+import { r as PermDockRevokedError } from "../errors-BKy0EfhN.js";
+import { d as discoverViaSignatureAgent, m as webBotAuthVerifier, u as InvalidSignatureError } from "../evaluations-DZ2CbV5k.js";
+import { t as problemFromError } from "../map-error-TCAdw-eW.js";
+import { r as bindKernel } from "../bind-CZzhx-Vj.js";
+import { a as onRevoked, n as closeReason, r as guardIterable, t as POLICY_VIOLATION } from "../stream-CvdUS9V1.js";
 import { Hono } from "hono";
 //#region src/hono/create.ts
 function socket(connection, events) {
@@ -11,7 +11,7 @@ function socket(connection, events) {
 		...events,
 		onOpen: (evt, ws) => {
 			onRevoked(connection, (problem) => {
-				ws.close(POLICY_VIOLATION, problem.type);
+				ws.close(POLICY_VIOLATION, closeReason(problem));
 			});
 			if (!connection.signal.aborted) events.onOpen?.(evt, ws);
 		},
@@ -61,16 +61,16 @@ function mapDownstream(c) {
 	}
 }
 function createPermDock(policy, options) {
-	const { kernel, bind, scopeOf, handlerScope, attach } = bindKernel(policy, options, "hono", (c) => c.req.raw);
-	const permdock = () => async (c, next) => {
+	const { kernel, bind, scopeOf, handlerScope, getPermDock, attach, guard: runGuard } = bindKernel(policy, options, "hono", (c) => c.req.raw);
+	const middleware = () => async (c, next) => {
 		const attached = await attach(c);
 		if (!attached.ok) return attached.response;
 		c.set("permdock", attached.permdock);
 		await next();
 		mapDownstream(c);
 	};
-	const protect = (permission, loadData, protectOptions) => async (c, next) => {
-		const guard = await kernel.protect(permission, loadData === void 0 ? void 0 : () => loadData(c), protectOptions)(bind(c), await scopeOf(c));
+	const protect = (permission, data, protectOptions) => async (c, next) => {
+		const guard = await runGuard(permission, data, c, protectOptions);
 		if (!guard.ok) return guard.response;
 		c.set("permdock", guard.permdock);
 		c.set("permdockData", guard.data);
@@ -86,7 +86,8 @@ function createPermDock(policy, options) {
 		return app;
 	};
 	return {
-		permdock,
+		getPermDock,
+		middleware,
 		protect,
 		connection,
 		socket,
@@ -96,4 +97,4 @@ function createPermDock(policy, options) {
 	};
 }
 //#endregion
-export { InvalidSignatureError, createPermDock, discoverViaSignatureAgent, verifyWebBotAuth };
+export { InvalidSignatureError, createPermDock, discoverViaSignatureAgent, webBotAuthVerifier };

package/dist/{hosted-DJQw46hn.js → hosted-BZIAYvon.js}

@@ -1,10 +1,13 @@
-import { t as compact } from "./compact-y6vfu2_f.js";
+import { r as isRecord, t as compact } from "./compact-CAf557ZB.js";
 import { n as freezeDeep } from "./freeze-CrU8nQeX.js";
-import { T as isForbiddenKey, c as getResource, g as isSelfParented, i as findPermission, k as splitPath } from "./permissions-DVoF6dMt.js";
-import { c as indexPolicy, i as declaredRoleNames, m as role, o as deny, r as completeGrant, t as allow, v as normalizeWhere } from "./policy-xyWg7QdR.js";
-import { t as parseDuration } from "./duration-xK2jGFVc.js";
-import { S as findRole, T as listPlans, s as flattenGrantee } from "./grantee-Cv5Sogfv.js";
-import { n as sha256, t as bytesToBase64Url } from "./sha256-BO0swRXL.js";
+import { n as isForbiddenKey, s as splitPath } from "./paths-DXSHAMIa.js";
+import { a as deny, i as completeGrant, n as role, p as normalizeWhere, r as allow } from "./role-builder-CXbis5-X.js";
+import { a as getResource, n as findPermission } from "./permission-registry-Br4jSNVi.js";
+import { d as isSelfParented } from "./resource-relations-D_jw0BFx.js";
+import { a as durationOf, l as isRfc3339, m as rfc3339 } from "./time-DkWjdL98.js";
+import { r as sha256Digest } from "./sha256-D9ihqmvd.js";
+import { _ as listPlans, m as findRole, o as flattenGrantee } from "./grantee-Cn1HyUsI.js";
+import { i as indexPolicy, t as declaredRoleNames } from "./policy-DLZJ5gAp.js";
 //#region src/core/hosted.ts
 function memoryPolicySource(document = null) {
 	const current = document === null ? null : parsePolicyDocument(document);
@@ -13,9 +16,6 @@ function memoryPolicySource(document = null) {
 		refresh: () => Promise.resolve()
 	});
 }
-function isRecord(value) {
-	return value !== null && typeof value === "object" && !Array.isArray(value);
-}
 function rejectUnsafe(value) {
 	if (value === null || typeof value !== "object") return;
 	if (Array.isArray(value)) {
@@ -34,9 +34,21 @@ function parsePolicyDocument(json) {
 	const copy = JSON.parse(JSON.stringify(input));
 	rejectUnsafe(copy);
 	if (copy["v"] !== 1) throw new Error(`PermDock: unsupported policy document version '${String(copy["v"])}'`);
-	if (typeof copy["id"] !== "string" || typeof copy["fingerprint"] !== "string" || typeof copy["catalog"] !== "string" || typeof copy["issuedAt"] !== "number" || !Array.isArray(copy["grants"])) throw new TypeError("PermDock: malformed policy document");
+	if (typeof copy["id"] !== "string" || typeof copy["fingerprint"] !== "string" || typeof copy["catalog"] !== "string" || !isRfc3339(copy["issuedAt"]) || !Array.isArray(copy["grants"])) throw new TypeError("PermDock: malformed policy document");
 	return freezeDeep(copy);
 }
+/** The document verified `vnd.permdock.policy+jwt` claims carry: `policy`, with `jti` as `id` and `iat` as `issuedAt`. Throws like `parsePolicyDocument`. */
+function policyDocumentFromClaims(claims) {
+	const claim = claims["policy"];
+	const jti = claims["jti"];
+	const iat = claims["iat"];
+	if (!isRecord(claim) || typeof jti !== "string" || typeof iat !== "number") throw new TypeError("PermDock: malformed policy document");
+	return parsePolicyDocument({
+		...claim,
+		id: jti,
+		issuedAt: rfc3339(iat)
+	});
+}
 const COMPARISONS = /* @__PURE__ */ new Set([
 	"eq",
 	"ne",
@@ -89,7 +101,7 @@ function approvalRank(approval) {
 		distinct: approval.distinct !== false,
 		stale: approval.staleOn === "resource-change",
 		quorum: approval.quorum ?? 1,
-		ttl: parseDuration(approval.ttl) ?? Number.POSITIVE_INFINITY,
+		ttl: durationOf(approval.ttl) ?? Number.POSITIVE_INFINITY,
 		escalates: approval.escalation !== void 0
 	};
 }
@@ -133,9 +145,9 @@ function approvalAcceptable(policy, approval, permissionResource) {
 	if (approval["distinct"] !== void 0 && typeof approval["distinct"] !== "boolean") return false;
 	if (approval["staleOn"] !== void 0 && (approval["staleOn"] !== "resource-change" || getResource(policy.permissions, permissionResource)?.version === void 0)) return false;
 	if (approval["quorum"] !== void 0 && (!Number.isInteger(approval["quorum"]) || approval["quorum"] < 1)) return false;
-	if (approval["ttl"] !== void 0 && (typeof approval["ttl"] !== "string" || parseDuration(approval["ttl"]) === void 0)) return false;
+	if (approval["ttl"] !== void 0 && durationOf(approval["ttl"]) === void 0) return false;
 	const escalation = approval["escalation"];
-	if (escalation !== void 0 && (!isRecord(escalation) || typeof escalation["after"] !== "string" || parseDuration(escalation["after"]) === void 0 || !granteesAcceptable(policy, escalation["to"], permissionResource))) return false;
+	if (escalation !== void 0 && (!isRecord(escalation) || durationOf(escalation["after"]) === void 0 || !granteesAcceptable(policy, escalation["to"], permissionResource))) return false;
 	if (approval["by"] === void 0) return true;
 	return granteesAcceptable(policy, approval["by"], permissionResource);
 }
@@ -222,6 +234,18 @@ function buildGrant(policy, document, raw) {
 		})
 	};
 }
+/** The grants of `document` that `policy` drops, in document order; `permdock/catalog` turns them into drift findings. */
+function hostedGrantDrops(policy, document) {
+	return document.grants.flatMap((raw) => {
+		const result = buildGrant(policy, document, raw);
+		if (result.ok) return [];
+		return [freezeDeep({
+			grant: isRecord(raw) && typeof raw.id === "string" ? raw.id : "",
+			permission: isRecord(raw) && typeof raw.permission === "string" ? raw.permission : "",
+			reason: result.reason
+		})];
+	});
+}
 /**
 * The code policy plus the hosted grants that pass every rule. Hosted
 * allows OR with code allows and any deny still wins, so a hosted grant can
@@ -257,10 +281,35 @@ function mergeHostedGrants(policy, document) {
 			...policy,
 			grants,
 			index: indexPolicy(policy.roles, grants, policy.vocabulary),
-			fingerprint: bytesToBase64Url(sha256(`${policy.fingerprint}:${document.fingerprint}`))
+			fingerprint: sha256Digest(`${policy.fingerprint}:${document.fingerprint}`)
 		}),
 		dropped
 	};
 }
+function hostedPolicies(source) {
+	return Object.freeze({
+		feature: "hosted-policies",
+		apply(policy) {
+			if (policy.hostable.length === 0) return {
+				policy,
+				errors: []
+			};
+			let document;
+			try {
+				document = source.current();
+			} catch (error) {
+				return {
+					policy,
+					errors: [error]
+				};
+			}
+			const merged = mergeHostedGrants(policy, document);
+			return {
+				policy: merged.policy,
+				errors: merged.dropped
+			};
+		}
+	});
+}
 //#endregion
-export { parsePolicyDocument as i, memoryPolicySource as n, mergeHostedGrants as r, isPortableCondition as t };
+export { mergeHostedGrants as a, memoryPolicySource as i, hostedPolicies as n, parsePolicyDocument as o, isPortableCondition as r, policyDocumentFromClaims as s, hostedGrantDrops as t };

package/dist/hosted-DBDX0M-P.d.ts

@@ -0,0 +1,78 @@
+import { T as Policy, a as ApprovalRequirement, bn as Grantee, lr as Condition } from "./policy-types-DzwivBgR.js";
+//#region src/core/hosted.d.ts
+/** One grant authored in PermDock Cloud; its grantee is a declared role, plan or relation. */
+type HostedGrant = {
+  readonly id: string;
+  readonly permission: string;
+  readonly effect?: "allow" | "deny";
+  readonly to: Grantee | readonly Grantee[];
+  readonly where?: Condition;
+  readonly check?: Condition;
+  readonly approval?: "human" | ApprovalRequirement;
+  readonly fields?: readonly string[];
+};
+/**
+ * PolicyDocument v1. Signed as a `vnd.permdock.policy+jwt`, the `policy`
+ * claim carries every field but `id` and `issuedAt`, which are the token's
+ * `jti` and `iat` (`policyDocumentFromClaims`).
+ */
+type PolicyDocument = {
+  readonly v: 1;
+  readonly id: string;
+  readonly fingerprint: string;
+  /** The catalog fingerprint the document was authored against. */
+  readonly catalog: string;
+  /** RFC 3339. */
+  readonly issuedAt: string;
+  readonly grants: readonly HostedGrant[];
+};
+/**
+ * The channel for hosted grants. `getPermDock` reads `current()` once;
+ * the application calls `refresh()` on its own schedule, never a check.
+ */
+type PolicySource = {
+  /** Names the implementation in errors and events. */
+  readonly name?: string;
+  current(): PolicyDocument | null;
+  refresh(): Promise<void>;
+};
+type HostedGrantDropReason = "not-hostable" | "unknown-permission" | "unknown-grantee" | "non-portable" | "weaker-approval" | "invalid";
+/** Reported through `on('error')` when a hosted grant is not merged; never thrown. */
+type HostedGrantDropped = {
+  readonly kind: "hosted-grant-dropped";
+  readonly document: string;
+  readonly grant: string;
+  readonly reason: HostedGrantDropReason;
+};
+declare function memoryPolicySource(document?: PolicyDocument | null): PolicySource;
+/** Validates the document envelope; per-grant checks happen at merge time. */
+declare function parsePolicyDocument(json: unknown): PolicyDocument;
+/** The document verified `vnd.permdock.policy+jwt` claims carry: `policy`, with `jti` as `id` and `iat` as `issuedAt`. Throws like `parsePolicyDocument`. */
+declare function policyDocumentFromClaims(claims: Readonly<Record<string, unknown>>): PolicyDocument;
+/** True for the portable subset only: no `opaque`, no `sqlFunction`, no unknown op. */
+declare function isPortableCondition(value: unknown): value is Condition;
+/**
+ * The code policy plus the hosted grants that pass every rule. Hosted
+ * allows OR with code allows and any deny still wins, so a hosted grant can
+ * never override a code deny; one that fails a rule is dropped, not thrown.
+ */
+declare function mergeHostedGrants(policy: Policy, document: PolicyDocument | null): {
+  readonly policy: Policy;
+  readonly dropped: readonly HostedGrantDropped[];
+};
+/**
+ * Hosted grants as an instance option: `policies: hostedPolicies(source)`.
+ * The merge code ships only with an app that imports this function.
+ * `source.current()` is read once per instance; a throw keeps the code
+ * policy and is reported as an error event.
+ */
+type HostedPolicies = {
+  readonly feature: "hosted-policies";
+  readonly apply: (policy: Policy) => {
+    readonly policy: Policy;
+    readonly errors: readonly unknown[];
+  };
+};
+declare function hostedPolicies(source: PolicySource): HostedPolicies;
+//#endregion
+export { PolicyDocument as a, isPortableCondition as c, parsePolicyDocument as d, policyDocumentFromClaims as f, HostedPolicies as i, memoryPolicySource as l, HostedGrantDropReason as n, PolicySource as o, HostedGrantDropped as r, hostedPolicies as s, HostedGrant as t, mergeHostedGrants as u };

package/dist/{http-SO7qGttf.js → http-BBoKefeS.js}

@@ -26,6 +26,39 @@ function parsedBody(body, headers) {
 	if (!headers.has("content-type")) headers.set("content-type", "application/json");
 	return JSON.stringify(body);
 }
+/**
+* A Fetch `Request` for a framework request. A `GET` or `HEAD` carries no
+* body; otherwise the body the framework parsed, or else `stream()`.
+*/
+function fetchRequest(url, method, headers, body, stream) {
+	if (method === "GET" || method === "HEAD") return new Request(url, {
+		method,
+		headers
+	});
+	const parsed = parsedBody(body, headers);
+	if (parsed !== void 0) return new Request(url, {
+		method,
+		headers,
+		body: parsed
+	});
+	if (stream === void 0) return new Request(url, {
+		method,
+		headers
+	});
+	const init = {
+		method,
+		headers,
+		body: stream(),
+		duplex: "half"
+	};
+	return new Request(url, init);
+}
+/** Writes `response` to a Fastify-style reply. */
+async function writeReply(reply, response) {
+	reply.code(response.status);
+	for (const [key, value] of response.headers.entries()) reply.header(key, value);
+	await reply.send(await response.text());
+}
 /** The Fetch `Request` an RPC context carries as `request` or `req`. */
 function requestFromContext(context) {
 	if ("request" in context && context.request instanceof Request) return context.request;
@@ -33,7 +66,7 @@ function requestFromContext(context) {
 }
 /** Whether the caller sent credentials, which turns a `401` into a `WWW-Authenticate` challenge. */
 function hasCredentials(request) {
-	return request.headers.has("authorization");
+	return request instanceof Request ? request.headers.has("authorization") : request.headers.authorization !== void 0;
 }
 /** The Problem Details `detail` of `cause`, or `fallback` when it has none. */
 function problemMessage(cause, fallback) {
@@ -41,4 +74,4 @@ function problemMessage(cause, fallback) {
 	return fallback;
 }
 //#endregion
-export { problemMessage as a, parsedBody as i, hasCredentials as n, requestFromContext as o, headersFrom as r, firstHeader as t };
+export { parsedBody as a, writeReply as c, headersFrom as i, firstHeader as n, problemMessage as o, hasCredentials as r, requestFromContext as s, fetchRequest as t };

package/dist/{http-DPuDaChb.d.ts → http-B_LphE5Y.d.ts}

@@ -7,7 +7,6 @@ type NodeRequest = IncomingMessage & {
 };
 declare function toRequest(req: NodeRequest, stream?: IncomingMessage | null): Request;
 declare function sendResponse(res: ServerResponse, response: Response): Promise<void>;
-declare const fromResponse: typeof sendResponse;
 declare function isServerResponse(value: unknown): value is ServerResponse;
 //#endregion
-export { toRequest as a, sendResponse as i, fromResponse as n, isServerResponse as r, NodeRequest as t };
+export { toRequest as i, isServerResponse as n, sendResponse as r, NodeRequest as t };