permdock 0.3.1 → 0.5.0

package/dist/{supautils-u8jXTGrt.js → supautils-B6HYL9eL.js}

@@ -1,5 +1,5 @@
-import { d as group, p as sqlStatements } from "./supabase-config-Bj3iDH2I.js";
-//#region src/cli/supautils.ts
+import { i as group, o as sqlStatements } from "./deciding-columns-Sq12mEA6.js";
+//#region src/cli/sql/supautils.ts
 /** `supautils.reserved_roles` of supabase/postgres 17.11.0.002 (supautils 3.4.4). */
 const RESERVED_ROLES = /* @__PURE__ */ new Set([
 	"supabase_admin",

package/dist/support-session-C6xJQYut.js

@@ -0,0 +1,158 @@
+import { t as compact } from "./compact-CAf557ZB.js";
+import { n as freezeDeep } from "./freeze-CrU8nQeX.js";
+import { a as ownRecord } from "./paths-DXSHAMIa.js";
+import { a as isId, r as idList } from "./expiry-D4_YKRKD.js";
+import { n as internalsOf } from "./internals-Dk8A8fX3.js";
+import { c as listPermissions, m as annotationsFor, n as findPermission } from "./permission-registry-Br4jSNVi.js";
+import { g as secondsOf, l as isRfc3339, m as rfc3339, p as nowSeconds } from "./time-DkWjdL98.js";
+import { t as canonicalJson } from "./canonical-json-BC8_nMTw.js";
+import { r as sha256Digest } from "./sha256-D9ihqmvd.js";
+//#region src/core/support-session.ts
+const DEFAULT_TTL = 3600;
+const MAX_TTL = 86400;
+const MAX_REASON = 1e3;
+function isReason(value) {
+	return typeof value === "string" && value.trim().length > 0 && value.length <= MAX_REASON;
+}
+/**
+* Validates an untrusted support-session record and returns a frozen copy
+* with only the v1 fields, or `undefined`.
+*/
+function parseSupportSession(input) {
+	const value = ownRecord(input);
+	if (value === void 0 || value["v"] !== 1 || !isId(value["id"]) || !isId(value["principal"]) || !isId(value["actor"]) || value["principal"] === value["actor"] || !isId(value["tenant"]) || !isReason(value["reason"]) || !isRfc3339(value["startedAt"]) || !isRfc3339(value["expiresAt"])) return;
+	const permissions = idList(value["permissions"]);
+	const { approvedBy, reference } = value;
+	if (permissions === void 0 || (secondsOf(value["expiresAt"]) ?? 0) <= (secondsOf(value["startedAt"]) ?? 0) || approvedBy !== void 0 && (!isId(approvedBy) || approvedBy === value["actor"]) || reference !== void 0 && !isId(reference)) return;
+	return freezeDeep(compact({
+		v: 1,
+		id: value["id"],
+		principal: value["principal"],
+		actor: value["actor"],
+		tenant: value["tenant"],
+		reason: value["reason"],
+		permissions,
+		startedAt: value["startedAt"],
+		expiresAt: value["expiresAt"],
+		approvedBy,
+		reference
+	}));
+}
+function denied(reason, detail) {
+	return freezeDeep({
+		outcome: "denied",
+		denials: [compact({
+			role: null,
+			reason,
+			detail
+		})]
+	});
+}
+function sessionToken(request, actor, tenant, permissions, ttl) {
+	return sha256Digest(canonicalJson({
+		t: "support-session",
+		id: request.id,
+		principal: request.principal,
+		actor,
+		tenant,
+		reason: request.reason,
+		permissions,
+		ttl,
+		reference: request.reference ?? null
+	}));
+}
+/**
+* Decides whether the subject of `permdock` may start the support session
+* in `request`. The actor must be a signed-in person acting for themselves
+* (`exceeds-creator` otherwise), give a `reason` (`reason-required`), be a
+* member of the tenant (`tenant-mismatch`) and be able to use every
+* permission (`exceeds-creator`). Without `permissions` the session gets the
+* actor's read-only permissions. The tenant's `supportSessions` policy then
+* applies, and the result is `approval-required` until `approved` carries
+* its token and `approvedBy` names someone other than the actor.
+*/
+/**
+* Decides whether the subject of `permdock` may start the support session
+* in `request` and returns the record to sign: a stated reason, membership
+* of the tenant, the actor's own reach, the tenant's `supportSessions`
+* policy and approval by someone else. An instance built from a snapshot
+* denies with `unsupported`.
+*/
+function decideSupportSession(permdock, request, options = {}) {
+	const internals = internalsOf(permdock);
+	if (internals === void 0) return Promise.resolve(freezeDeep({
+		outcome: "denied",
+		denials: [{
+			role: null,
+			reason: "unsupported"
+		}]
+	}));
+	const settings = options.settings ?? internals.env.settings;
+	return decideSupportSessionWith(internals.instance, request, settings === void 0 ? options : {
+		...options,
+		settings
+	});
+}
+async function decideSupportSessionWith(permdock, request, options) {
+	const actor = permdock.subject.principal;
+	if (actor === null) return denied("anonymous");
+	if (actor.kind !== void 0 && actor.kind !== "user") return denied("exceeds-creator", { creator: actor.kind });
+	if ("credential" in actor || "runTicket" in actor) return denied("exceeds-creator", { creator: "credential" in actor ? "credential" : "run" });
+	if (permdock.subject.actor !== void 0) return denied("exceeds-creator", { creator: "actor" });
+	if (!isReason(request.reason)) return denied("reason-required");
+	const ttl = request.expiresIn ?? DEFAULT_TTL;
+	if (!isId(request.id) || !isId(request.principal) || request.principal === actor.id || !Number.isSafeInteger(ttl) || ttl <= 0 || ttl > MAX_TTL || request.reference !== void 0 && !isId(request.reference)) return denied("validation");
+	const tenant = request.tenant ?? actor.tenant;
+	if (tenant === void 0) return denied("validation");
+	if (!permdock.tenants().includes(tenant)) return denied("tenant-mismatch", { tenant });
+	let policy;
+	if (options.settings !== void 0) try {
+		policy = (await options.settings.settingsFor(tenant))?.supportSessions;
+	} catch {
+		return denied("unsupported", { rule: "unavailable" });
+	}
+	if (policy?.disabled === true) return denied("unsupported", { rule: "disabled" });
+	if (policy?.maxTtl !== void 0 && ttl > policy.maxTtl) return denied("validation", { rule: "ttl" });
+	const leaves = request.permissions === void 0 ? listPermissions(permdock.permissions).filter((leaf) => annotationsFor(leaf).readOnlyHint && permdock.mayUse(leaf)) : request.permissions.map((permission) => findPermission(permdock.permissions, permission.key));
+	const keys = [];
+	for (const leaf of leaves) {
+		if (leaf === void 0) return denied("validation");
+		if (!permdock.mayUse(leaf)) return denied("exceeds-creator", { permission: leaf.key });
+		if (policy?.readOnly === true && !annotationsFor(leaf).readOnlyHint) return denied("not-delegated", {
+			permission: leaf.key,
+			rule: "read-only"
+		});
+		if (!keys.includes(leaf.key)) keys.push(leaf.key);
+	}
+	if (keys.length === 0) return denied("no-grant");
+	const token = sessionToken(request, actor.id, tenant, keys, ttl);
+	const approval = options.approval !== false;
+	const approved = approval && options.approved === token;
+	if (approved && (options.approvedBy === void 0 || options.approvedBy === actor.id)) return denied("approval", "approver-not-distinct");
+	const startedAt = nowSeconds(options.now);
+	const session = parseSupportSession(compact({
+		v: 1,
+		id: request.id,
+		principal: request.principal,
+		actor: actor.id,
+		tenant,
+		reason: request.reason,
+		permissions: keys,
+		startedAt: rfc3339(startedAt),
+		expiresAt: rfc3339(startedAt + ttl),
+		approvedBy: approved ? options.approvedBy : void 0,
+		reference: request.reference
+	}));
+	if (session === void 0) return denied("validation");
+	if (approval && !approved) return freezeDeep({
+		outcome: "approval-required",
+		session,
+		token
+	});
+	return freezeDeep({
+		outcome: "granted",
+		session
+	});
+}
+//#endregion
+export { parseSupportSession as n, decideSupportSession as t };

package/dist/svelte/Protected.svelte

@@ -3,7 +3,9 @@
 
   import {
     getStore,
+    getUi,
     scopedFor,
+    slotContent,
     viewFor,
     type ProtectedProps,
   } from './runtime.js';
@@ -14,10 +16,12 @@
     tenant,
     children,
     pending,
-    fallback,
+    denied,
+    approval,
   }: ProtectedProps = $props();
 
   const store = getStore();
+  const { defaults } = getUi();
   let tick = $state(0);
   onDestroy(
     store.subscribe(() => {
@@ -29,12 +33,15 @@
     const generation = tick;
     return viewFor(store, permission, data, scoped, generation);
   });
+  const own = $derived({ pending, denied, approval });
 </script>
 
 {#if view.slot === 'pending'}
-  {@render pending?.()}
-{:else if view.slot === 'fallback'}
-  {@render fallback?.(view.decision)}
+  {@render slotContent('pending', own, defaults)?.()}
+{:else if view.slot === 'approval'}
+  {@render slotContent('approval', own, defaults)?.(view.decision)}
+{:else if view.slot === 'denied'}
+  {@render slotContent('denied', own, defaults)?.(view.decision)}
 {:else}
   {@render children?.(view.decision)}
 {/if}

package/dist/svelte/index.d.ts

@@ -1,13 +1,13 @@
-import { n as requiredPlans } from "../problem-details-DX075l9V.js";
-import { i as describe } from "../describe-DMYiCjJV.js";
+import { n as requiredPlans } from "../problem-details-DXlt-vks.js";
+import { i as describe } from "../describe-BZUsixiL.js";
 import { t as PermissionBoundaryState } from "../boundary-BmHxVH1J.js";
-import { t as approvalHeaders } from "../headers-Cf-zWvsO.js";
-import { a as FilterResult, c as SubjectView, i as ClientStatus, l as TenantView, n as ApprovalState, o as PermissionSet, r as ClientPermDock, s as PermissionState, t as ApprovalHandle, u as UseRolesOptions } from "../types-CKNSyIf_.js";
-import { i as PermissionBoundaryProps, t as ProtectedProps } from "../protected-xAr24FEC.js";
-import { a as getPermDock, c as permissions, d as subject, f as tenant, i as filtered, l as roles, n as assignable, o as memberships, p as PermDockSvelteOptions, r as assignablePermissions, s as permission, t as approval, u as setPermDock } from "../stores-C0IMQrGI.js";
+import { t as approvalHeaders } from "../headers-CIbDTUTK.js";
+import { a as FilterResult, c as PermissionSet, d as RolesOptions, f as SubjectView, i as ClientStatus, l as PermissionState, n as ApprovalState, p as TenantView, r as ClientPermDock, t as ApprovalHandle } from "../types-BNORmDM8.js";
+import { n as SveltePermDockOptions, o as PermissionBoundaryProps, r as ProtectedProps, t as PermDockDefaults } from "../types-fbZ7JEXr.js";
+import { a as getDescribe, c as permission, d as setPermDock, f as subject, i as filtered, l as permissions, n as assignable, o as getPermDock, p as tenant, r as assignablePermissions, s as memberships, t as approval, u as roles } from "../stores-ClZUgeoP.js";
 import { Component } from "svelte";
 //#region src/svelte/index.d.ts
 export declare const Protected: Component<ProtectedProps>;
 export declare const PermissionBoundary: Component<PermissionBoundaryProps>;
 //#endregion
-export { type ApprovalHandle, type ApprovalState, type ClientPermDock, type ClientStatus, type FilterResult, type PermDockSvelteOptions, type PermissionBoundaryProps, type PermissionBoundaryState, type PermissionSet, type PermissionState, type ProtectedProps, type SubjectView, type TenantView, type UseRolesOptions, approval, approvalHeaders, assignable, assignablePermissions, describe, filtered, getPermDock, memberships, permission, permissions, requiredPlans, roles, setPermDock, subject, tenant };
+export { type ApprovalHandle, type ApprovalState, type ClientPermDock, type ClientStatus, type FilterResult, type PermDockDefaults, type PermissionBoundaryProps, type PermissionBoundaryState, type PermissionSet, type PermissionState, type ProtectedProps, type RolesOptions, type SubjectView, type SveltePermDockOptions, type TenantView, approval, approvalHeaders, assignable, assignablePermissions, describe, filtered, getDescribe, getPermDock, memberships, permission, permissions, requiredPlans, roles, setPermDock, subject, tenant };

package/dist/svelte/index.js

@@ -1,10 +1,11 @@
-import { r as requiredPlans } from "../problem-details-_AMOYz-w.js";
-import { t as describe } from "../describe-B_gVZEVi.js";
-import { t as approvalHeaders } from "../headers-BZSDieNT.js";
+import { r as requiredPlans } from "../problem-details-cn5X30gZ.js";
+import { t as describe } from "../describe-BybMRY7A.js";
 import { n as boundaryFallback, t as boundaryDigest } from "../boundary-BM8a_P6E.js";
-import { t as getStore } from "../context-Bcy85rGi.js";
-import { n as viewFor, t as scopedFor } from "../runtime-CB8gQFvS.js";
-import { a as getPermDock, c as permissions, d as subject, f as tenant, i as filtered, l as roles, n as assignable, o as memberships, r as assignablePermissions, s as permission, t as approval, u as setPermDock } from "../stores-BT2pSCub.js";
+import { t as approvalHeaders } from "../headers-BIjfMaoC.js";
+import { u as slotContent } from "../views-DTIIO-oQ.js";
+import { n as getUi, t as getStore } from "../context-bbFHR-0D.js";
+import { n as viewFor, t as scopedFor } from "../runtime-D3VTAiCA.js";
+import { a as getDescribe, c as permission, d as setPermDock, f as subject, i as filtered, l as permissions, n as assignable, o as getPermDock, p as tenant, r as assignablePermissions, s as memberships, t as approval, u as roles } from "../stores-BbsD4fAR.js";
 import "svelte/internal/disclose-version";
 import * as $ from "svelte/internal/client";
 import { onDestroy } from "svelte";
@@ -62,6 +63,7 @@ function PermissionBoundary$1($$anchor, $$props) {
 function Protected$1($$anchor, $$props) {
 	$.push($$props, true);
 	const store = getStore();
+	const { defaults } = getUi();
 	let tick = $.state(0);
 	onDestroy(store.subscribe(() => {
 		$.set(tick, $.get(tick) + 1);
@@ -71,29 +73,41 @@ function Protected$1($$anchor, $$props) {
 		const generation = $.get(tick);
 		return viewFor(store, $$props.permission, $$props.data, $.get(scoped), generation);
 	});
+	const own = $.derived(() => ({
+		pending: $$props.pending,
+		denied: $$props.denied,
+		approval: $$props.approval
+	}));
 	var fragment = $.comment();
 	var node = $.first_child(fragment);
 	var consequent = ($$anchor) => {
 		var fragment_1 = $.comment();
 		var node_1 = $.first_child(fragment_1);
-		$.snippet(node_1, () => $$props.pending ?? $.noop);
+		$.snippet(node_1, () => slotContent("pending", $.get(own), defaults) ?? $.noop);
 		$.append($$anchor, fragment_1);
 	};
 	var consequent_1 = ($$anchor) => {
 		var fragment_2 = $.comment();
 		var node_2 = $.first_child(fragment_2);
-		$.snippet(node_2, () => $$props.fallback ?? $.noop, () => $.get(view).decision);
+		$.snippet(node_2, () => slotContent("approval", $.get(own), defaults) ?? $.noop, () => $.get(view).decision);
 		$.append($$anchor, fragment_2);
 	};
-	var alternate = ($$anchor) => {
+	var consequent_2 = ($$anchor) => {
 		var fragment_3 = $.comment();
 		var node_3 = $.first_child(fragment_3);
-		$.snippet(node_3, () => $$props.children ?? $.noop, () => $.get(view).decision);
+		$.snippet(node_3, () => slotContent("denied", $.get(own), defaults) ?? $.noop, () => $.get(view).decision);
 		$.append($$anchor, fragment_3);
 	};
+	var alternate = ($$anchor) => {
+		var fragment_4 = $.comment();
+		var node_4 = $.first_child(fragment_4);
+		$.snippet(node_4, () => $$props.children ?? $.noop, () => $.get(view).decision);
+		$.append($$anchor, fragment_4);
+	};
 	$.if(node, ($$render) => {
 		if ($.get(view).slot === "pending") $$render(consequent);
-		else if ($.get(view).slot === "fallback") $$render(consequent_1, 1);
+		else if ($.get(view).slot === "approval") $$render(consequent_1, 1);
+		else if ($.get(view).slot === "denied") $$render(consequent_2, 2);
 		else $$render(alternate, -1);
 	});
 	$.append($$anchor, fragment);
@@ -104,4 +118,4 @@ function Protected$1($$anchor, $$props) {
 const Protected = Protected$1;
 const PermissionBoundary = PermissionBoundary$1;
 //#endregion
-export { PermissionBoundary, Protected, approval, approvalHeaders, assignable, assignablePermissions, describe, filtered, getPermDock, memberships, permission, permissions, requiredPlans, roles, setPermDock, subject, tenant };
+export { PermissionBoundary, Protected, approval, approvalHeaders, assignable, assignablePermissions, describe, filtered, getDescribe, getPermDock, memberships, permission, permissions, requiredPlans, roles, setPermDock, subject, tenant };

package/dist/svelte/runtime.d.ts

@@ -1,7 +1,14 @@
+import { n as DescribeMessages } from "../describe-BZUsixiL.js";
 import { n as boundaryDigest, r as boundaryFallback, t as PermissionBoundaryState } from "../boundary-BmHxVH1J.js";
-import { t as ClientStore } from "../store-jOBYpiXC.js";
-import { i as PermissionBoundaryProps, n as scopedFor, r as viewFor, t as ProtectedProps } from "../protected-xAr24FEC.js";
+import { m as ClientStore } from "../types-BNORmDM8.js";
+import { a as viewFor, i as scopedFor, o as PermissionBoundaryProps, r as ProtectedProps, s as slotContent, t as PermDockDefaults } from "../types-fbZ7JEXr.js";
 //#region src/svelte/context.d.ts
+/** The provider's `defaults` and `messages`. */
+type PermDockUi = {
+  readonly defaults?: PermDockDefaults | undefined;
+  readonly messages?: DescribeMessages | undefined;
+};
+export declare function getUi(): PermDockUi;
 export declare function getStore(): ClientStore;
 //#endregion
-export { type PermissionBoundaryProps, type PermissionBoundaryState, type ProtectedProps, boundaryDigest, boundaryFallback, scopedFor, viewFor };
+export { type PermissionBoundaryProps, type PermissionBoundaryState, type ProtectedProps, boundaryDigest, boundaryFallback, scopedFor, slotContent, viewFor };

package/dist/svelte/runtime.js

@@ -1,4 +1,5 @@
 import { n as boundaryFallback, t as boundaryDigest } from "../boundary-BM8a_P6E.js";
-import { t as getStore } from "../context-Bcy85rGi.js";
-import { n as viewFor, t as scopedFor } from "../runtime-CB8gQFvS.js";
-export { boundaryDigest, boundaryFallback, getStore, scopedFor, viewFor };
+import { u as slotContent } from "../views-DTIIO-oQ.js";
+import { n as getUi, t as getStore } from "../context-bbFHR-0D.js";
+import { n as viewFor, t as scopedFor } from "../runtime-D3VTAiCA.js";
+export { boundaryDigest, boundaryFallback, getStore, getUi, scopedFor, slotContent, viewFor };

package/dist/svelte/source.d.ts

@@ -1,13 +1,13 @@
-import { n as requiredPlans } from "../problem-details-DX075l9V.js";
-import { i as describe } from "../describe-DMYiCjJV.js";
+import { n as requiredPlans } from "../problem-details-DXlt-vks.js";
+import { i as describe } from "../describe-BZUsixiL.js";
 import { t as PermissionBoundaryState } from "../boundary-BmHxVH1J.js";
-import { t as approvalHeaders } from "../headers-Cf-zWvsO.js";
-import { a as FilterResult, c as SubjectView, i as ClientStatus, l as TenantView, n as ApprovalState, o as PermissionSet, r as ClientPermDock, s as PermissionState, t as ApprovalHandle, u as UseRolesOptions } from "../types-CKNSyIf_.js";
-import { i as PermissionBoundaryProps, t as ProtectedProps } from "../protected-xAr24FEC.js";
-import { a as getPermDock, c as permissions, d as subject, f as tenant, i as filtered, l as roles, n as assignable, o as memberships, p as PermDockSvelteOptions, r as assignablePermissions, s as permission, t as approval, u as setPermDock } from "../stores-C0IMQrGI.js";
+import { t as approvalHeaders } from "../headers-CIbDTUTK.js";
+import { a as FilterResult, c as PermissionSet, d as RolesOptions, f as SubjectView, i as ClientStatus, l as PermissionState, n as ApprovalState, p as TenantView, r as ClientPermDock, t as ApprovalHandle } from "../types-BNORmDM8.js";
+import { n as SveltePermDockOptions, o as PermissionBoundaryProps, r as ProtectedProps, t as PermDockDefaults } from "../types-fbZ7JEXr.js";
+import { a as getDescribe, c as permission, d as setPermDock, f as subject, i as filtered, l as permissions, n as assignable, o as getPermDock, p as tenant, r as assignablePermissions, s as memberships, t as approval, u as roles } from "../stores-ClZUgeoP.js";
 import { Component } from "svelte";
 //#region src/svelte/source.d.ts
 export declare const Protected: Component<ProtectedProps>;
 export declare const PermissionBoundary: Component<PermissionBoundaryProps>;
 //#endregion
-export { type ApprovalHandle, type ApprovalState, type ClientPermDock, type ClientStatus, type FilterResult, type PermDockSvelteOptions, type PermissionBoundaryProps, type PermissionBoundaryState, type PermissionSet, type PermissionState, type ProtectedProps, type SubjectView, type TenantView, type UseRolesOptions, approval, approvalHeaders, assignable, assignablePermissions, describe, filtered, getPermDock, memberships, permission, permissions, requiredPlans, roles, setPermDock, subject, tenant };
+export { type ApprovalHandle, type ApprovalState, type ClientPermDock, type ClientStatus, type FilterResult, type PermDockDefaults, type PermissionBoundaryProps, type PermissionBoundaryState, type PermissionSet, type PermissionState, type ProtectedProps, type RolesOptions, type SubjectView, type SveltePermDockOptions, type TenantView, approval, approvalHeaders, assignable, assignablePermissions, describe, filtered, getDescribe, getPermDock, memberships, permission, permissions, requiredPlans, roles, setPermDock, subject, tenant };

package/dist/svelte/source.js

@@ -1,11 +1,11 @@
-import { r as requiredPlans } from "../problem-details-_AMOYz-w.js";
-import { t as describe } from "../describe-B_gVZEVi.js";
-import { t as approvalHeaders } from "../headers-BZSDieNT.js";
-import { a as getPermDock, c as permissions, d as subject, f as tenant, i as filtered, l as roles, n as assignable, o as memberships, r as assignablePermissions, s as permission, t as approval, u as setPermDock } from "../stores-BT2pSCub.js";
+import { r as requiredPlans } from "../problem-details-cn5X30gZ.js";
+import { t as describe } from "../describe-BybMRY7A.js";
+import { t as approvalHeaders } from "../headers-BIjfMaoC.js";
+import { a as getDescribe, c as permission, d as setPermDock, f as subject, i as filtered, l as permissions, n as assignable, o as getPermDock, p as tenant, r as assignablePermissions, s as memberships, t as approval, u as roles } from "../stores-BbsD4fAR.js";
 import PermissionBoundaryComponent from "./PermissionBoundary.svelte";
 import ProtectedComponent from "./Protected.svelte";
 //#region src/svelte/source.ts
 const Protected = ProtectedComponent;
 const PermissionBoundary = PermissionBoundaryComponent;
 //#endregion
-export { PermissionBoundary, Protected, approval, approvalHeaders, assignable, assignablePermissions, describe, filtered, getPermDock, memberships, permission, permissions, requiredPlans, roles, setPermDock, subject, tenant };
+export { PermissionBoundary, Protected, approval, approvalHeaders, assignable, assignablePermissions, describe, filtered, getDescribe, getPermDock, memberships, permission, permissions, requiredPlans, roles, setPermDock, subject, tenant };

package/dist/sveltekit/index.d.ts

@@ -0,0 +1,51 @@
+import { T as Policy, Vt as Snapshot, j as PolicyVocabulary, rr as Principal } from "../policy-types-DzwivBgR.js";
+import { w as Permission } from "../vocabulary-D6lPdb4Z.js";
+import { a as OperationInput, t as Operation } from "../operations-CxybZErY.js";
+import { r as PermDock } from "../permdock-D7eeLJER.js";
+import { D as ConnectionOptions, T as Connection, f as InvalidSignatureError, i as OpenApiHooks, o as ProtectOptions, u as SnapshotQuery, v as discoverViaSignatureAgent, x as webBotAuthVerifier } from "../server-types-BLd4MnBX.js";
+import { a as ProtectTarget, i as PermDockHandlers, n as FetchAdapterOptions, t as ContextReader } from "../fetch-adapter-qKJBuRqy.js";
+import { RequestEvent } from "@sveltejs/kit";
+//#region src/sveltekit/create.d.ts
+/**
+ * A `handle` hook. SvelteKit 2 exports `Handle` from `@sveltejs/kit` and
+ * SvelteKit 3 from `@sveltejs/kit/hooks`; this shape is assignable to both.
+ */
+type SvelteKitHandle = (input: {
+  readonly event: RequestEvent;
+  readonly resolve: (event: RequestEvent) => Promise<Response>;
+}) => Promise<Response>;
+type SvelteKitPermDockOptions<TUser = unknown> = FetchAdapterOptions<RequestEvent, TUser>;
+/** What the adapter sets on `event.locals`. */
+type SvelteKitPermDockLocals<TData = unknown, V extends PolicyVocabulary = PolicyVocabulary> = {
+  readonly permdock: PermDock<V>;
+  readonly permdockData: TData;
+};
+/** The event a wrapped handler receives: the route's own event with typed `locals`. */
+type SvelteKitPermDockEvent<TEvent extends RequestEvent = RequestEvent, TData = unknown, V extends PolicyVocabulary = PolicyVocabulary> = TEvent & {
+  readonly locals: SvelteKitPermDockLocals<TData, V>;
+};
+/** Wraps a `+server.ts` handler; the route keeps its generated `RequestEvent` type. */
+type SvelteKitGuarded<TData, V extends PolicyVocabulary = PolicyVocabulary> = <TEvent extends RequestEvent, R = Response>(handler: (event: SvelteKitPermDockEvent<TEvent, TData, V>) => R | Promise<R>) => (event: TEvent) => Promise<R | Response>;
+type SvelteKitProtect<V extends PolicyVocabulary = PolicyVocabulary> = {
+  <T = unknown>(permission: Permission | null, data?: ContextReader<RequestEvent, T | null | undefined>, protectOptions?: ProtectOptions): SvelteKitGuarded<NonNullable<T>, V>;
+  <TOperation extends Operation>(operation: TOperation, input?: ContextReader<RequestEvent, OperationInput<TOperation>>, protectOptions?: ProtectOptions): SvelteKitGuarded<unknown, V>;
+};
+type SvelteKitPermDock<V extends PolicyVocabulary = PolicyVocabulary> = {
+  /** The `handle` hook: sets `event.locals.permdock`; a bad Web Bot Auth signature is a `401`. */
+  readonly middleware: () => SvelteKitHandle;
+  /** `export const DELETE = protect(permissions.post.delete, loadPost)(handler)`. */
+  readonly protect: SvelteKitProtect<V>;
+  /** Types `event.locals.permdock` for a handler and answers a thrown PermDock error with Problem Details. */
+  readonly withPermDock: SvelteKitGuarded<unknown, V>;
+  /** The instance for a `load` function, an action or a handler. */
+  readonly getPermDock: (event: RequestEvent) => Promise<PermDock<V>>;
+  /** The snapshot a layout `load` returns for `permdock/svelte`. */
+  readonly getSnapshot: (event: RequestEvent, query?: SnapshotQuery) => Promise<Snapshot>;
+  readonly connection: (event: RequestEvent, connectionOptions?: ConnectionOptions) => Promise<Connection>;
+  /** `export const { GET, POST } = permdockHandler()` in `src/routes/api/permdock/+server.ts`. */
+  readonly permdockHandler: () => PermDockHandlers<RequestEvent>;
+  readonly openapi: OpenApiHooks;
+};
+export declare function createPermDock<TUser, TPrincipal extends Principal = Principal, V extends PolicyVocabulary = PolicyVocabulary>(policy: Policy<TUser, TPrincipal, V>, options: SvelteKitPermDockOptions<TUser>): SvelteKitPermDock<V>;
+//#endregion
+export { type ContextReader, InvalidSignatureError, type PermDockHandlers, type ProtectTarget, type SvelteKitGuarded, type SvelteKitHandle, type SvelteKitPermDock, type SvelteKitPermDockEvent, type SvelteKitPermDockLocals, type SvelteKitPermDockOptions, type SvelteKitProtect, discoverViaSignatureAgent, webBotAuthVerifier };

package/dist/sveltekit/index.js

@@ -0,0 +1,27 @@
+import { d as discoverViaSignatureAgent, m as webBotAuthVerifier, u as InvalidSignatureError } from "../evaluations-DZ2CbV5k.js";
+import { n as guardedRoute, r as instanceRoute, t as fetchAdapter } from "../fetch-adapter-g0ypLkID.js";
+//#region src/sveltekit/create.ts
+const route = {
+	context: (event) => event,
+	locals: (event) => event.locals
+};
+function createPermDock(policy, options) {
+	const adapter = fetchAdapter(policy, options, "sveltekit", (event) => event.request);
+	const middleware = () => async ({ event, resolve }) => {
+		const attached = await adapter.ensure(event.locals, event);
+		return attached.ok ? resolve(event) : attached.response;
+	};
+	const protect = ((target, data, protectOptions) => guardedRoute(adapter, route, target, data, protectOptions));
+	return {
+		middleware,
+		protect,
+		withPermDock: instanceRoute(adapter, route),
+		getPermDock: adapter.getPermDock,
+		getSnapshot: adapter.getSnapshot,
+		connection: adapter.connection,
+		permdockHandler: adapter.handlers,
+		openapi: adapter.kernel.openapi
+	};
+}
+//#endregion
+export { InvalidSignatureError, createPermDock, discoverViaSignatureAgent, webBotAuthVerifier };

package/dist/tanstack-start/index.d.ts

@@ -0,0 +1,51 @@
+import { T as Policy, Vt as Snapshot, j as PolicyVocabulary, rr as Principal } from "../policy-types-DzwivBgR.js";
+import { w as Permission } from "../vocabulary-D6lPdb4Z.js";
+import { a as OperationInput, t as Operation } from "../operations-CxybZErY.js";
+import { r as PermDock } from "../permdock-D7eeLJER.js";
+import { D as ConnectionOptions, T as Connection, f as InvalidSignatureError, i as OpenApiHooks, o as ProtectOptions, u as SnapshotQuery, v as discoverViaSignatureAgent, x as webBotAuthVerifier } from "../server-types-BLd4MnBX.js";
+import { a as ProtectTarget, n as FetchAdapterOptions, t as ContextReader } from "../fetch-adapter-qKJBuRqy.js";
+import { RequestMiddleware, RequestMiddlewareAfterServer, createMiddleware } from "@tanstack/react-start";
+//#region src/tanstack-start/create.d.ts
+type TanStackStartPermDockOptions<TUser = unknown> = FetchAdapterOptions<Request, TUser>;
+/** The server context `middleware()` adds for later middleware, server functions and server routes. */
+type TanStackStartPermDockContext<V extends PolicyVocabulary = PolicyVocabulary> = {
+  readonly permdock: PermDock<V>;
+};
+/** The server context `protect` adds: the instance and the loaded row. */
+type TanStackStartGuardedContext<TData = unknown, V extends PolicyVocabulary = PolicyVocabulary> = TanStackStartPermDockContext<V> & {
+  readonly permdockData: TData;
+};
+/** A request middleware for `createStart`'s `requestMiddleware`, a server route's `server.middleware` or a server function's `.middleware([...])`. */
+type TanStackStartMiddleware<TContext> = RequestMiddlewareAfterServer<StartRegister, undefined, TContext>;
+/** The register `createMiddleware` builds with; Start's middleware types are invariant in it. */
+type StartRegister = ReturnType<typeof createMiddleware> extends RequestMiddleware<infer TRegister> ? TRegister : never;
+type TanStackStartProtect<V extends PolicyVocabulary = PolicyVocabulary> = {
+  <T = unknown>(permission: Permission | null, data?: ContextReader<Request, T | null | undefined>, protectOptions?: ProtectOptions): TanStackStartMiddleware<TanStackStartGuardedContext<NonNullable<T>, V>>;
+  <TOperation extends Operation>(operation: TOperation, input?: ContextReader<Request, OperationInput<TOperation>>, protectOptions?: ProtectOptions): TanStackStartMiddleware<TanStackStartGuardedContext<unknown, V>>;
+};
+/** A server route handler: `server: { handlers: { GET } }`. */
+type TanStackStartRouteHandler = (context: {
+  readonly request: Request;
+}) => Promise<Response>;
+/** The decision endpoint, one server route handler per method. */
+type TanStackStartPermDockHandlers = {
+  readonly GET: TanStackStartRouteHandler;
+  readonly POST: TanStackStartRouteHandler;
+};
+type TanStackStartPermDock<V extends PolicyVocabulary = PolicyVocabulary> = {
+  /** Adds `context.permdock`; a bad Web Bot Auth signature is a `401`. */
+  readonly middleware: () => TanStackStartMiddleware<TanStackStartPermDockContext<V>>;
+  /** A refusal ends the request with Problem Details; a grant adds `context.permdock` and `context.permdockData`. */
+  readonly protect: TanStackStartProtect<V>;
+  /** The instance for a server function: `getPermDock(getRequest())`. */
+  readonly getPermDock: (request: Request) => Promise<PermDock<V>>;
+  /** The snapshot a route `loader` returns for `permdock/react`. */
+  readonly getSnapshot: (request: Request, query?: SnapshotQuery) => Promise<Snapshot>;
+  readonly connection: (request: Request, connectionOptions?: ConnectionOptions) => Promise<Connection>;
+  /** `server: { handlers: permdockHandler() }` on the `/api/permdock` route. */
+  readonly permdockHandler: () => TanStackStartPermDockHandlers;
+  readonly openapi: OpenApiHooks;
+};
+export declare function createPermDock<TUser, TPrincipal extends Principal = Principal, V extends PolicyVocabulary = PolicyVocabulary>(policy: Policy<TUser, TPrincipal, V>, options: TanStackStartPermDockOptions<TUser>): TanStackStartPermDock<V>;
+//#endregion
+export { type ContextReader, InvalidSignatureError, type ProtectTarget, type TanStackStartGuardedContext, type TanStackStartMiddleware, type TanStackStartPermDock, type TanStackStartPermDockContext, type TanStackStartPermDockHandlers, type TanStackStartPermDockOptions, type TanStackStartProtect, type TanStackStartRouteHandler, discoverViaSignatureAgent, webBotAuthVerifier };

package/dist/tanstack-start/index.js

@@ -0,0 +1,40 @@
+import { d as discoverViaSignatureAgent, m as webBotAuthVerifier, u as InvalidSignatureError } from "../evaluations-DZ2CbV5k.js";
+import { t as fetchAdapter } from "../fetch-adapter-g0ypLkID.js";
+import { createMiddleware } from "@tanstack/react-start";
+//#region src/tanstack-start/create.ts
+function createPermDock(policy, options) {
+	const adapter = fetchAdapter(policy, options, "tanstack-start", (request) => request);
+	const middleware = () => createMiddleware().server(async ({ request, next }) => {
+		const attached = await adapter.attach(request);
+		if (!attached.ok) return attached.response;
+		const context = { permdock: attached.permdock };
+		return adapter.mapErrors(request, () => next({ context }));
+	});
+	const protect = ((target, data, protectOptions) => createMiddleware().server(async ({ request, next }) => {
+		const guard = await adapter.guard(target, data, request, protectOptions);
+		if (!guard.ok) return guard.response;
+		const context = {
+			permdock: guard.permdock,
+			permdockData: guard.data
+		};
+		return adapter.mapErrors(request, () => next({ context }));
+	}));
+	const handlers = () => {
+		const { GET, POST } = adapter.handlers();
+		return {
+			GET: ({ request }) => GET(request),
+			POST: ({ request }) => POST(request)
+		};
+	};
+	return {
+		middleware,
+		protect,
+		getPermDock: adapter.getPermDock,
+		getSnapshot: adapter.getSnapshot,
+		connection: adapter.connection,
+		permdockHandler: handlers,
+		openapi: adapter.kernel.openapi
+	};
+}
+//#endregion
+export { InvalidSignatureError, createPermDock, discoverViaSignatureAgent, webBotAuthVerifier };

package/dist/target-Bw37TFNA.js

@@ -0,0 +1,51 @@
+import { a as ownRecord } from "./paths-DXSHAMIa.js";
+import { n as sha256, t as bytesToBase64Url } from "./sha256-D9ihqmvd.js";
+//#region src/delivery/target.ts
+/**
+* Whether `value` is a target the router checked for `channel`: a non-empty
+* address and a granted decision. A transport calls it first and refuses
+* anything else, so a hand-built recipient never reaches a provider.
+*/
+function isDeliveryTarget(value, channel) {
+	const record = ownRecord(value);
+	const address = record?.["address"];
+	return record?.["channel"] === channel && typeof address === "string" && address !== "" && ownRecord(record["decision"])?.["outcome"] === "granted";
+}
+/**
+* The idempotency key for one recipient of delivery `id`: `pdd_` and the
+* base64url SHA-256 of the delivery id, channel and recipient. It fits the
+* tag and header charsets of every provider, `[A-Za-z0-9_-]`.
+*/
+function idempotencyKeyFor(id, channel, recipient) {
+	return `pdd_${bytesToBase64Url(sha256(JSON.stringify([
+		id,
+		channel,
+		recipient
+	])))}`;
+}
+const ATOM = "[A-Za-z0-9!#$%&'*+/=?^_`{|}~-]+";
+const ADDR_SPEC = /* @__PURE__ */ new RegExp(`^${ATOM}(?:\\.${ATOM})*@(?:[A-Za-z0-9](?:[A-Za-z0-9-]{0,61}[A-Za-z0-9])?\\.)+[A-Za-z0-9](?:[A-Za-z0-9-]{0,61}[A-Za-z0-9])?$`, "u");
+/**
+* An RFC 5322 `addr-spec` in dot-atom form with a DNS domain, at most 254
+* characters (RFC 5321 path limit). Quoted local parts, comments and
+* domain literals are refused.
+*/
+function isAddrSpec(value) {
+	return value.length <= 254 && ADDR_SPEC.test(value);
+}
+/** A chat platform user id: printable, no whitespace, at most 256 characters. */
+function isChatAddress(value) {
+	return /^[!-~]{1,256}$/u.test(value);
+}
+/** An absolute https URL with no credentials. */
+function isWebhookAddress(value) {
+	let url;
+	try {
+		url = new URL(value);
+	} catch {
+		return false;
+	}
+	return url.protocol === "https:" && url.username === "" && url.password === "";
+}
+//#endregion
+export { isWebhookAddress as a, isDeliveryTarget as i, isAddrSpec as n, isChatAddress as r, idempotencyKeyFor as t };