permdock 0.3.1 → 0.5.0

package/dist/{validity-uOp8UpYn.js → tenancy-DN2QAx9z.js}

@@ -1,10 +1,10 @@
-import { f as isFieldRelation } from "./permissions-DVoF6dMt.js";
-import { t as expiredAt } from "./expiry-BoBJ8Tvc.js";
-import { n as sameId } from "./ids-DC4V4CFu.js";
-import { c as rootScope, l as scopeChain, m as tenantOf, o as resolveScope, r as findScope, t as activeFor, u as scopeIdOf } from "./scopes-CVdPrWN-.js";
+import { o as sameId, t as expiredAt } from "./expiry-D4_YKRKD.js";
+import { l as isFieldRelation } from "./resource-relations-D_jw0BFx.js";
+import { o as epochSeconds } from "./time-DkWjdL98.js";
+import { c as rootScope, l as scopeChain, m as tenantOf, o as resolveScope, r as findScope, t as activeFor, u as scopeIdOf } from "./scopes-CUPSjo9q.js";
 //#region src/core/tenancy.ts
 function nowSeconds(now) {
-	return now ?? Date.now() / 1e3;
+	return now ?? epochSeconds();
 }
 function isMembershipExpired(membership, now) {
 	return expiredAt(membership, now ?? nowSeconds());
@@ -206,40 +206,4 @@ function membershipField(resource, membershipResource, resources) {
 	}
 }
 //#endregion
-//#region src/core/validity.ts
-/**
-* An instant as Unix seconds: a finite number is taken as seconds already, a
-* string must parse as RFC 3339. Anything else is `undefined`, and the caller
-* decides whether that is "absent" or an error.
-*/
-function instantOf(input) {
-	if (typeof input === "number") return Number.isFinite(input) ? Math.floor(input) : void 0;
-	if (typeof input !== "string" || input.trim() === "") return;
-	const millis = Date.parse(input);
-	return Number.isFinite(millis) ? Math.floor(millis / 1e3) : void 0;
-}
-/**
-* The normalised validity of a grant, or `undefined` when neither bound is
-* set. Fail-closed at definition time: a bound that does not parse, or a
-* window that ends before it starts, throws so a typo never widens a grant.
-*/
-function normalizeValidity(options, permissionKey) {
-	const from = options.validFrom === void 0 ? void 0 : instantOf(options.validFrom);
-	const until = options.validUntil === void 0 ? void 0 : instantOf(options.validUntil);
-	if (options.validFrom !== void 0 && from === void 0) throw new Error(`PermDock: validFrom on '${permissionKey}' must be an RFC 3339 string or Unix seconds`);
-	if (options.validUntil !== void 0 && until === void 0) throw new Error(`PermDock: validUntil on '${permissionKey}' must be an RFC 3339 string or Unix seconds`);
-	if (from !== void 0 && until !== void 0 && until <= from) throw new Error(`PermDock: validUntil on '${permissionKey}' must be after validFrom`);
-	if (from === void 0 && until === void 0) return;
-	return Object.freeze({
-		...from === void 0 ? {} : { from },
-		...until === void 0 ? {} : { until }
-	});
-}
-/** Whether a grant with this validity applies at `now` (Unix seconds); no validity always applies. */
-function isActive(validity, now) {
-	if (validity === void 0) return true;
-	if (validity.from !== void 0 && now < validity.from) return false;
-	return validity.until === void 0 || now < validity.until;
-}
-//#endregion
-export { isMembershipExpired as a, membershipField as c, partitionsOf as d, relatesTo as f, tenantsOf as g, scopeField as h, inTeam as i, nestedAppliesWithoutRow as l, rowInScope as m, normalizeValidity as n, matchScopedMembership as o, resolveActiveTenant as p, heldRoleNamesIn as r, memberOfFields as s, isActive as t, nowSeconds as u };
+export { memberOfFields as a, nowSeconds as c, resolveActiveTenant as d, rowInScope as f, matchScopedMembership as i, partitionsOf as l, tenantsOf as m, inTeam as n, membershipField as o, scopeField as p, isMembershipExpired as r, nestedAppliesWithoutRow as s, heldRoleNamesIn as t, relatesTo as u };

package/dist/terminal/index.d.ts

@@ -1,8 +1,9 @@
-import { C as Policy, D as PolicyVocabulary, Nr as Principal, Pr as Subject, Yn as Decision, ln as PermDock } from "../policy-IB6yxpC3.js";
-import { f as Permission } from "../permissions-DttnqqxC.js";
-import { f as ApprovalStore } from "../types-aqOHTHcp.js";
-import { a as ProblemDetails, t as ApprovalHint } from "../errors-DPdqI50v.js";
-import { t as InstanceOptions } from "../instance-options-jARdwfPN.js";
+import { Nn as Decision, Rt as Instant, T as Policy, ir as Subject, j as PolicyVocabulary, rr as Principal } from "../policy-types-DzwivBgR.js";
+import { w as Permission } from "../vocabulary-D6lPdb4Z.js";
+import { r as PermDock } from "../permdock-D7eeLJER.js";
+import { m as ApprovalStore } from "../types-CCpc2Dcv.js";
+import { a as ProblemDetails, t as ApprovalHint } from "../errors-C2PXIv4c.js";
+import { t as InstanceOptions } from "../instance-options-Omfd793B.js";
 //#region src/terminal/types.d.ts
 type TokenSourceName = "device" | "keychain" | "env" | "ci-oidc";
 type TokenSource = TokenSourceName | {
@@ -55,7 +56,8 @@ type TerminalRuntime = {
   readonly env?: Readonly<Record<string, string | undefined>>;
   readonly stdoutIsTTY?: boolean;
   readonly platform?: string;
-  readonly now?: () => number;
+  /** The clock; defaults to the system clock. */
+  readonly now?: () => Instant;
   readonly write?: (text: string) => void;
   readonly exit?: (code: number) => never;
   readonly fetch?: typeof fetch;
@@ -130,8 +132,8 @@ type ProtectContext<T = unknown, V extends PolicyVocabulary = PolicyVocabulary>
   }>;
 };
 type TerminalPermDock<V extends PolicyVocabulary = PolicyVocabulary> = {
-  readonly permdock: (options?: PermDockResolveOptions) => Promise<PermDock<V>>;
-  readonly protect: <TArgs extends readonly unknown[], TData = unknown>(permission: Permission, load?: (...args: TArgs) => TData | Promise<TData>) => (action: (context: ProtectContext<TData, V>, ...args: TArgs) => unknown) => (...args: TArgs) => Promise<unknown>;
+  readonly getPermDock: (options?: PermDockResolveOptions) => Promise<PermDock<V>>;
+  readonly protect: <TArgs extends readonly unknown[], TData = unknown>(permission: Permission, data?: (...args: TArgs) => TData | Promise<TData>) => (action: (context: ProtectContext<TData, V>, ...args: TArgs) => unknown) => (...args: TArgs) => Promise<unknown>;
   readonly filterCommands: (entries: readonly CommandEntry[], options?: FilterCommandsOptions) => readonly CommandEntry[];
   readonly format: (decision: Decision, options?: FormatOptions) => string;
   readonly exitCode: (decision: Decision) => number;
@@ -139,7 +141,7 @@ type TerminalPermDock<V extends PolicyVocabulary = PolicyVocabulary> = {
 };
 //#endregion
 //#region src/terminal/create.d.ts
-export declare function createPermDock<TUser, TPrincipal extends Principal = Principal, V extends PolicyVocabulary = PolicyVocabulary>(policy: Policy<TUser, TPrincipal, V>, options: TerminalPermDockOptions<TUser>): TerminalPermDock<V>;
+export declare function createPermDock<TUser, TPrincipal extends Principal = Principal, V extends PolicyVocabulary = PolicyVocabulary>(policy: Policy<TUser, TPrincipal, V>, given: TerminalPermDockOptions<TUser>): TerminalPermDock<V>;
 //#endregion
 //#region src/terminal/exit.d.ts
 export declare const EX_OK = 0;

package/dist/terminal/index.js

@@ -1,165 +1,16 @@
-import { t as compact } from "../compact-y6vfu2_f.js";
-import { a as deniedMessage, i as approvalMessage, n as PermDockDeniedError, t as PermDockApprovalRequiredError } from "../errors-Cz5zn0mW.js";
-import { t as createPermDock$1 } from "../permdock-CbgvLnuo.js";
+import { t as compact } from "../compact-CAf557ZB.js";
+import { a as deniedMessage, i as approvalMessage, n as PermDockDeniedError, t as PermDockApprovalRequiredError } from "../errors-BKy0EfhN.js";
+import { h as secondsAt } from "../time-DkWjdL98.js";
 import { n as resourceRef } from "../resource-ref-CaS9yVPi.js";
-import { i as isSubject } from "../subject-C6dLxqHU.js";
-import { l as storedApprovalToken, s as resumeDecision } from "../helpers-H_KARDVC.js";
+import { c as withApp } from "../permdock-B9JxkBwC.js";
+import { r as isSubject } from "../subject-BGoM5o8B.js";
+import { n as readBodyText } from "../body-text-QcXok_SI.js";
+import { l as storedApprovalToken, s as resumeDecision } from "../helpers-DTcZOzhF.js";
 import { t as timeoutSignal } from "../timeout-D51niuQP.js";
-import { t as instanceOptions } from "../instance-options-Dhhcnm3y.js";
-import { mkdirSync, readFileSync, statSync, unlinkSync, writeFileSync } from "node:fs";
-import path from "node:path";
+import { n as resolveOrNull, t as buildInstance } from "../build-instance-BMnAudHn.js";
+import { a as refreshCredential, o as revokeCredential, s as runDeviceFlow, t as TERMINAL_TIMEOUT_MS } from "../device-BARQ8eYG.js";
+import { i as writeCredentials, n as deleteCredentials, r as readCredentials } from "../storage-C2bWdvJH.js";
 import { createInterface } from "node:readline";
-import { homedir } from "node:os";
-//#region src/terminal/device.ts
-/** Milliseconds an authorization server request may take. */
-const TERMINAL_TIMEOUT_MS = 1e4;
-function isRecord$1(value) {
-	return value !== null && typeof value === "object" && !Array.isArray(value);
-}
-async function readJson(response) {
-	try {
-		const body = await response.json();
-		return isRecord$1(body) ? body : null;
-	} catch {
-		return null;
-	}
-}
-/** POSTs a form and reads a JSON object back; any network or parse failure is `null`. */
-async function postForm(runtime, url, fields) {
-	const fetchImpl = runtime.fetch ?? fetch;
-	try {
-		return await readJson(await fetchImpl(url, {
-			method: "POST",
-			headers: { "content-type": "application/x-www-form-urlencoded" },
-			body: new URLSearchParams(fields),
-			signal: timeoutSignal(TERMINAL_TIMEOUT_MS)
-		}));
-	} catch {
-		return null;
-	}
-}
-async function discoverDeviceEndpoints(issuer, runtime) {
-	const fetchImpl = runtime.fetch ?? fetch;
-	const url = issuer.endsWith("/") ? `${issuer}.well-known/oauth-authorization-server` : `${issuer}/.well-known/oauth-authorization-server`;
-	try {
-		const body = await readJson(await fetchImpl(url, { signal: timeoutSignal(TERMINAL_TIMEOUT_MS) }));
-		if (body === null) return {};
-		return compact({
-			authorizationEndpoint: typeof body["device_authorization_endpoint"] === "string" ? body["device_authorization_endpoint"] : void 0,
-			tokenEndpoint: typeof body["token_endpoint"] === "string" ? body["token_endpoint"] : void 0,
-			revocationEndpoint: typeof body["revocation_endpoint"] === "string" ? body["revocation_endpoint"] : void 0
-		});
-	} catch {
-		return {};
-	}
-}
-function parseAuthorization(body) {
-	if (typeof body["device_code"] !== "string" || typeof body["user_code"] !== "string" || typeof body["verification_uri"] !== "string" || typeof body["expires_in"] !== "number") return null;
-	return compact({
-		device_code: body["device_code"],
-		user_code: body["user_code"],
-		verification_uri: body["verification_uri"],
-		verification_uri_complete: typeof body["verification_uri_complete"] === "string" ? body["verification_uri_complete"] : void 0,
-		expires_in: body["expires_in"],
-		interval: typeof body["interval"] === "number" ? body["interval"] : void 0
-	});
-}
-function parseToken(body, now) {
-	if (typeof body["error"] === "string") return {
-		ok: false,
-		error: body["error"]
-	};
-	if (typeof body["access_token"] !== "string") return {
-		ok: false,
-		error: "invalid-token"
-	};
-	return {
-		ok: true,
-		credential: compact({
-			access_token: body["access_token"],
-			refresh_token: typeof body["refresh_token"] === "string" ? body["refresh_token"] : void 0,
-			expires_at: typeof body["expires_in"] === "number" ? now + body["expires_in"] : void 0,
-			token_type: typeof body["token_type"] === "string" ? body["token_type"] : void 0
-		})
-	};
-}
-async function runDeviceFlow(device, runtime, write) {
-	const sleep = runtime.sleep ?? defaultSleep;
-	const now = runtime.now ?? (() => Math.floor(Date.now() / 1e3));
-	let authorizationEndpoint = device.authorizationEndpoint;
-	let tokenEndpoint = device.tokenEndpoint;
-	if ((authorizationEndpoint === void 0 || tokenEndpoint === void 0) && device.issuer !== void 0) {
-		const discovered = await discoverDeviceEndpoints(device.issuer, runtime);
-		authorizationEndpoint = authorizationEndpoint ?? discovered.authorizationEndpoint;
-		tokenEndpoint = tokenEndpoint ?? discovered.tokenEndpoint;
-	}
-	if (authorizationEndpoint === void 0 || tokenEndpoint === void 0) return null;
-	const startedBody = await postForm(runtime, authorizationEndpoint, {
-		client_id: device.clientId,
-		scope: device.scope ?? ""
-	});
-	const authorization = startedBody === null ? null : parseAuthorization(startedBody);
-	if (authorization === null) return null;
-	device.onPrompt?.(compact({
-		user_code: authorization.user_code,
-		verification_uri: authorization.verification_uri,
-		verification_uri_complete: authorization.verification_uri_complete
-	}));
-	write(`Visit ${authorization.verification_uri} and enter ${authorization.user_code}\n`);
-	if (authorization.verification_uri_complete !== void 0) device.open?.(authorization.verification_uri_complete);
-	let interval = authorization.interval ?? 5;
-	const deadline = now() + authorization.expires_in;
-	while (now() < deadline) {
-		await sleep(interval * 1e3);
-		const polledBody = await postForm(runtime, tokenEndpoint, {
-			grant_type: "urn:ietf:params:oauth:grant-type:device_code",
-			device_code: authorization.device_code,
-			client_id: device.clientId
-		});
-		if (polledBody === null) return null;
-		const token = parseToken(polledBody, now());
-		if (token.ok) return token.credential;
-		if (token.error === "slow_down") {
-			interval += 5;
-			continue;
-		}
-		if (token.error === "authorization_pending") continue;
-		return null;
-	}
-	return null;
-}
-async function refreshCredential(device, credential, runtime) {
-	if (credential.refresh_token === void 0) return null;
-	const now = runtime.now ?? (() => Math.floor(Date.now() / 1e3));
-	let tokenEndpoint = device.tokenEndpoint;
-	if (tokenEndpoint === void 0 && device.issuer !== void 0) tokenEndpoint = (await discoverDeviceEndpoints(device.issuer, runtime)).tokenEndpoint;
-	if (tokenEndpoint === void 0) return null;
-	const body = await postForm(runtime, tokenEndpoint, {
-		grant_type: "refresh_token",
-		refresh_token: credential.refresh_token,
-		client_id: device.clientId
-	});
-	if (body === null) return null;
-	const token = parseToken(body, now());
-	return token.ok ? token.credential : null;
-}
-async function revokeCredential(device, credential, runtime) {
-	if (device === void 0 || credential.refresh_token === void 0) return;
-	let revocationEndpoint = device.revocationEndpoint;
-	if (revocationEndpoint === void 0 && device.issuer !== void 0) revocationEndpoint = (await discoverDeviceEndpoints(device.issuer, runtime)).revocationEndpoint;
-	if (revocationEndpoint === void 0) return;
-	await postForm(runtime, revocationEndpoint, {
-		token: credential.refresh_token,
-		token_type_hint: "refresh_token",
-		client_id: device.clientId
-	});
-}
-function defaultSleep(ms) {
-	return new Promise((resolve) => {
-		setTimeout(resolve, ms);
-	});
-}
-//#endregion
 //#region src/terminal/exit.ts
 const EX_OK = 0;
 const EX_USAGE = 64;
@@ -273,131 +124,6 @@ function formatDecision(decision, options = {}) {
 	return `${details.detail}\n`;
 }
 //#endregion
-//#region src/terminal/storage.ts
-const FILE_MODE = 384;
-const DIR_MODE = 448;
-const GROUP_OR_WORLD = 63;
-function credentialsPath(service, runtime) {
-	if (runtime.configDir !== void 0) return path.join(runtime.configDir, "credentials.json");
-	const home = runtime.homedir ?? homedir;
-	const env = runtime.env ?? process.env;
-	if ((runtime.platform ?? process.platform) === "win32") {
-		const appData = env["APPDATA"] ?? path.join(home(), "AppData", "Roaming");
-		return path.join(appData, service, "credentials.json");
-	}
-	const xdg = env["XDG_CONFIG_HOME"] ?? path.join(home(), ".config");
-	return path.join(xdg, service, "credentials.json");
-}
-function isRecord(value) {
-	return value !== null && typeof value === "object" && !Array.isArray(value);
-}
-function parseCredential(value) {
-	if (!isRecord(value) || typeof value["access_token"] !== "string") return null;
-	return compact({
-		access_token: value["access_token"],
-		refresh_token: typeof value["refresh_token"] === "string" ? value["refresh_token"] : void 0,
-		expires_at: typeof value["expires_at"] === "number" ? value["expires_at"] : void 0,
-		token_type: typeof value["token_type"] === "string" ? value["token_type"] : void 0
-	});
-}
-function keyringEntry(storage, profile) {
-	if (storage.keyring === void 0) return null;
-	try {
-		return new storage.keyring(storage.service, profile);
-	} catch {
-		return null;
-	}
-}
-function readKeyring(storage, profile) {
-	const entry = keyringEntry(storage, profile);
-	if (entry === null) return null;
-	try {
-		const raw = entry.getPassword();
-		return typeof raw === "string" ? parseCredential(JSON.parse(raw)) : null;
-	} catch {
-		return null;
-	}
-}
-function readCredentials(storage, profile, runtime) {
-	return readKeyring(storage, profile) ?? readFile(storage.service, profile, runtime);
-}
-function readFile(service, profile, runtime) {
-	const file = credentialsPath(service, runtime);
-	let raw;
-	try {
-		const stat = statSync(file);
-		if ((runtime.platform ?? process.platform) !== "win32" && (stat.mode & GROUP_OR_WORLD) !== 0) return null;
-		raw = readFileSync(file, "utf8");
-	} catch {
-		return null;
-	}
-	try {
-		const parsed = JSON.parse(raw);
-		if (!isRecord(parsed) || !isRecord(parsed["profiles"])) return null;
-		return parseCredential(parsed["profiles"][profile]);
-	} catch {
-		return null;
-	}
-}
-/** The OS keychain when `storage.keyring` is set and works; otherwise the mode-0600 file. */
-function writeCredentials(storage, profile, credential, runtime) {
-	const entry = keyringEntry(storage, profile);
-	if (entry !== null) try {
-		entry.setPassword(JSON.stringify(credential));
-		deleteFile(storage.service, profile, runtime);
-		return;
-	} catch {}
-	writeFile(storage.service, profile, credential, runtime);
-}
-function writeFile(service, profile, credential, runtime) {
-	const file = credentialsPath(service, runtime);
-	mkdirSync(path.dirname(file), {
-		recursive: true,
-		mode: DIR_MODE
-	});
-	let profiles = {};
-	try {
-		const existing = JSON.parse(readFileSync(file, "utf8"));
-		if (isRecord(existing) && isRecord(existing["profiles"])) profiles = existing["profiles"];
-	} catch {
-		profiles = {};
-	}
-	profiles[profile] = credential;
-	writeFileSync(file, `${JSON.stringify({ profiles }, null, 2)}\n`, {
-		encoding: "utf8",
-		mode: FILE_MODE
-	});
-}
-function deleteCredentials(storage, profile, runtime) {
-	const entry = keyringEntry(storage, profile);
-	if (entry !== null) try {
-		entry.deletePassword();
-	} catch {}
-	deleteFile(storage.service, profile, runtime);
-}
-function deleteFile(service, profile, runtime) {
-	const file = credentialsPath(service, runtime);
-	let parsed;
-	try {
-		parsed = JSON.parse(readFileSync(file, "utf8"));
-	} catch {
-		return;
-	}
-	if (!isRecord(parsed) || !isRecord(parsed["profiles"])) return;
-	const profiles = {};
-	for (const key of Object.keys(parsed["profiles"])) if (key !== profile) profiles[key] = parsed["profiles"][key];
-	if (Object.keys(profiles).length === 0) {
-		try {
-			unlinkSync(file);
-		} catch {}
-		return;
-	}
-	writeFileSync(file, `${JSON.stringify({ profiles }, null, 2)}\n`, {
-		encoding: "utf8",
-		mode: FILE_MODE
-	});
-}
-//#endregion
 //#region src/terminal/token.ts
 const JWT_PART = /^[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+$/u;
 function looksLikeJwt(value) {
@@ -437,10 +163,12 @@ async function fromCiOidc(runtime, source) {
 	if (typeof env["ACTIONS_ID_TOKEN_REQUEST_URL"] === "string" && typeof env["ACTIONS_ID_TOKEN_REQUEST_TOKEN"] === "string") try {
 		const url = new URL(env["ACTIONS_ID_TOKEN_REQUEST_URL"]);
 		if (audience !== void 0) url.searchParams.set("audience", audience);
-		const body = await (await fetchImpl(url, {
+		const response = await fetchImpl(url, {
 			headers: { Authorization: `Bearer ${env["ACTIONS_ID_TOKEN_REQUEST_TOKEN"]}` },
 			signal: timeoutSignal(TERMINAL_TIMEOUT_MS)
-		})).json();
+		});
+		const text = await readBodyText(response);
+		const body = text.ok ? JSON.parse(text.text) : null;
 		if (body !== null && typeof body === "object" && "value" in body && typeof body.value === "string") return body.value;
 	} catch {
 		return null;
@@ -449,7 +177,7 @@ async function fromCiOidc(runtime, source) {
 }
 async function resolveToken(sources, options) {
 	const walk = options.force === void 0 ? sources : [options.force];
-	const now = options.runtime.now ?? (() => Math.floor(Date.now() / 1e3));
+	const now = () => secondsAt(options.runtime.now?.());
 	for (const source of walk) {
 		const name = sourceName(source);
 		switch (name) {
@@ -580,7 +308,8 @@ const defaultTyped = (input) => {
 		});
 	});
 };
-function createPermDock(policy, options) {
+function createPermDock(policy, given) {
+	const options = withApp(policy, given);
 	const write = writeOf(options);
 	const exit = options.runtime?.exit ?? defaultExit;
 	const runtime = compact({
@@ -606,32 +335,23 @@ function createPermDock(policy, options) {
 			token: tokenFor(profile, resolveOptions.source),
 			profile
 		};
-		let user = null;
-		try {
-			user = await options.subject(context);
-		} catch {
-			user = null;
-		}
-		let actor;
-		let delegation;
-		if (options.actor !== void 0) try {
-			const resolved = actorFromResolved(await options.actor(context));
-			actor = resolved.actor;
-			delegation = resolved.delegation;
-		} catch {
-			actor = void 0;
-			delegation = void 0;
-		}
-		const built = await createPermDock$1(policy, user, compact({
-			tenant: options.tenant,
-			actor,
-			delegation,
-			...instanceOptions(options)
-		}));
+		const user = await resolveOrNull(() => options.subject(context));
+		const resolveActor = options.actor;
+		const resolved = resolveActor === void 0 ? null : await resolveOrNull(async () => actorFromResolved(await resolveActor(context)));
+		const { permdock: built } = await buildInstance({
+			policy,
+			user,
+			sources: options,
+			scope: {
+				tenant: options.tenant,
+				actor: resolved?.actor,
+				delegation: resolved?.delegation
+			}
+		});
 		last = built;
 		return built;
 	};
-	const permdock = (resolveOptions = {}) => {
+	const getPermDock = (resolveOptions = {}) => {
 		if (resolveOptions.refresh === true || cached === void 0) cached = resolve(resolveOptions);
 		return cached;
 	};
@@ -653,7 +373,7 @@ function createPermDock(policy, options) {
 		let decide;
 		let first;
 		try {
-			instance = await permdock();
+			instance = await getPermDock();
 			if (load !== void 0) {
 				data = await load(...args);
 				if (permission.kind === "instance" && (data === null || data === void 0)) {
@@ -666,10 +386,10 @@ function createPermDock(policy, options) {
 			}
 			decide = instance.decide;
 			first = decide(permission, data, dryRun ? {
-				source: "simulate",
+				call: "simulate",
 				adapter: "terminal"
 			} : {
-				source: "adapter",
+				call: "adapter",
 				adapter: "terminal"
 			});
 		} catch {
@@ -726,7 +446,7 @@ function createPermDock(policy, options) {
 				return exit(77);
 			}
 			const again = decide(permission, data, compact({
-				source: "adapter",
+				call: "adapter",
 				adapter: "terminal"
 			}));
 			if (again.outcome === "denied") {
@@ -821,7 +541,7 @@ function createPermDock(policy, options) {
 		last = void 0;
 	};
 	return {
-		permdock,
+		getPermDock,
 		protect,
 		filterCommands,
 		format,