permdock 0.3.1 → 0.5.0

package/dist/types-_sHy8BQf.d.ts

@@ -0,0 +1,65 @@
+import { fn as Approver } from "./policy-types-DzwivBgR.js";
+//#region src/approvals/access-reviews/types.d.ts
+type AccessReviewStatus = "open" | "closed";
+type AccessReviewItemStatus = "pending" | "kept" | "revoked";
+/**
+ * Access review v1: who holds `permissions` in one tenant, and who may
+ * confirm or revoke each holding. PermDock records the reviewer's decision
+ * and never changes the role or membership itself.
+ */
+type AccessReview = {
+  readonly v: 1;
+  readonly id: string;
+  readonly tenant: string;
+  readonly permissions: readonly string[];
+  readonly reviewers: Approver | readonly Approver[];
+  readonly createdBy: string;
+  readonly createdAt: string;
+  readonly dueAt: string;
+  readonly status: AccessReviewStatus;
+  /** `false` when the population can omit a holder, such as a global role. */
+  readonly complete: boolean;
+};
+/** One holding in a review. `via` names the roles the population attributed it to. */
+type AccessReviewItem = {
+  readonly v: 1;
+  readonly id: string;
+  readonly review: string;
+  readonly principal: string;
+  readonly permission: string;
+  readonly via: readonly string[];
+  readonly status: AccessReviewItemStatus;
+  readonly decidedBy?: string;
+  readonly decidedAt?: string;
+  readonly note?: string;
+  /** Set by the application after it revoked the holding at its source. */
+  readonly appliedAt?: string;
+};
+type AccessReviewItemQuery = {
+  readonly review: string;
+  readonly status?: AccessReviewItemStatus;
+  readonly limit?: number;
+  readonly cursor?: string;
+};
+type AccessReviewItemPage = {
+  readonly items: readonly AccessReviewItem[];
+  readonly next?: string;
+};
+type AccessReviewDecision = {
+  readonly status: "kept" | "revoked";
+  readonly decidedBy: string;
+  readonly decidedAt: string;
+  readonly note?: string;
+};
+type AccessReviewStore = {
+  /** Names the implementation in errors and events. */
+  readonly name?: string;
+  create(review: AccessReview, items: readonly AccessReviewItem[]): Promise<void> | void;
+  get(id: string): Promise<AccessReview | null> | AccessReview | null;
+  items(query: AccessReviewItemQuery): Promise<AccessReviewItemPage> | AccessReviewItemPage;
+  decide(reviewId: string, itemId: string, decision: AccessReviewDecision): Promise<AccessReviewItem> | AccessReviewItem;
+  markApplied(reviewId: string, itemId: string, at: string): Promise<AccessReviewItem> | AccessReviewItem;
+  close(id: string): Promise<AccessReview> | AccessReview;
+};
+//#endregion
+export { AccessReviewItemQuery as a, AccessReviewStore as c, AccessReviewItemPage as i, AccessReviewDecision as n, AccessReviewItemStatus as o, AccessReviewItem as r, AccessReviewStatus as s, AccessReview as t };

package/dist/types-fbZ7JEXr.d.ts

@@ -0,0 +1,89 @@
+import { Mn as ApprovalRequiredDecision, Nn as Decision, Vt as Snapshot, dt as TokenVerifier, zn as GrantedDecision } from "./policy-types-DzwivBgR.js";
+import { w as Permission } from "./vocabulary-D6lPdb4Z.js";
+import { r as PermDock } from "./permdock-D7eeLJER.js";
+import { t as PermissionBoundaryState } from "./boundary-BmHxVH1J.js";
+import { l as PermissionState, m as ClientStore, u as ProviderOptionsBase } from "./types-BNORmDM8.js";
+import { Snippet } from "svelte";
+import { Readable } from "svelte/store";
+//#region src/client/views.d.ts
+/**
+ * What `Protected` renders: `pending` while an endpoint answer is in flight,
+ * `approval` for an approval-required decision, `denied` for any other
+ * denial.
+ */
+type ProtectedView = (PermissionState & {
+  readonly slot: "pending" | "denied";
+}) | {
+  readonly allowed: false;
+  readonly status: PermissionState["status"];
+  readonly decision: ApprovalRequiredDecision;
+  readonly slot: "approval";
+} | {
+  readonly allowed: true;
+  readonly status: PermissionState["status"];
+  readonly decision: GrantedDecision;
+  readonly slot: "default";
+};
+/** Provider-wide content for the `Protected` slots a component leaves out. */
+type SlotDefaults<P, F, A = F> = {
+  readonly pending?: P;
+  readonly denied?: F;
+  readonly approval?: A;
+};
+/**
+ * The content `Protected` renders for a non-default slot. Its own prop wins
+ * over the provider default; `approval` falls back to `denied`, first the
+ * component's, then the provider's.
+ */
+declare function slotContent<P, F, A>(slot: "pending", own: SlotDefaults<P, F, A>, defaults: SlotDefaults<P, F, A> | undefined): P | undefined;
+declare function slotContent<P, F, A>(slot: "denied", own: SlotDefaults<P, F, A>, defaults: SlotDefaults<P, F, A> | undefined): F | undefined;
+declare function slotContent<P, F, A>(slot: "approval", own: SlotDefaults<P, F, A>, defaults: SlotDefaults<P, F, A> | undefined): F | A | undefined;
+//#endregion
+//#region src/svelte/boundary.d.ts
+type PermissionBoundaryProps = {
+  readonly children?: Snippet;
+  /** Rendered in place of the children when one throws `PermDockDeniedError`. */
+  readonly denied?: Snippet<[PermissionBoundaryState]>;
+  /** Rendered for `PermDockApprovalRequiredError`; defaults to `denied`. */
+  readonly approval?: Snippet<[PermissionBoundaryState]>;
+};
+//#endregion
+//#region src/svelte/protected.d.ts
+type ProtectedProps = {
+  readonly permission: Permission;
+  readonly data?: unknown;
+  readonly tenant?: string;
+  readonly children?: Snippet<[GrantedDecision]>;
+  readonly pending?: Snippet;
+  readonly denied?: Snippet<[Decision]>;
+  /** Rendered for an approval-required decision; defaults to `denied`. */
+  readonly approval?: Snippet<[ApprovalRequiredDecision]>;
+};
+/** The instance for `tenant`, built once per store change rather than once per check. */
+declare function scopedFor(store: ClientStore, tenant: string | undefined, _generation?: number): PermDock | undefined;
+declare function viewFor(store: ClientStore, reference: Permission, data: unknown, scoped: PermDock | undefined, _generation?: number): ProtectedView;
+//#endregion
+//#region src/svelte/types.d.ts
+type SveltePermDockOptions = ProviderOptionsBase & {
+  /**
+   * A getter (`() => data.snapshot`) or a readable store re-hydrates the
+   * store when it changes; a promise keeps the store `pending` until it
+   * settles (render the same promise with `{#await}`).
+   */
+  readonly snapshot: Snapshot | string | (() => Snapshot | string) | Readable<Snapshot | string> | PromiseLike<Snapshot | string>;
+  /** A getter (`() => page.params.org`) switches the active tenant (`refresh({ tenant })`) when it changes. */
+  readonly tenant?: string | (() => string | undefined);
+  /** A getter is read on every request, so a rotated token applies without a new store. */
+  readonly headers?: Readonly<Record<string, string>> | (() => Readonly<Record<string, string>> | undefined);
+  readonly verifier?: TokenVerifier;
+  /** What every `<Protected>` renders for a snippet it leaves out. */
+  readonly defaults?: PermDockDefaults;
+};
+/** Snippets for the `<Protected>` slots a component leaves out. */
+type PermDockDefaults = {
+  readonly pending?: Snippet;
+  readonly denied?: Snippet<[Decision]>;
+  readonly approval?: Snippet<[ApprovalRequiredDecision]>;
+};
+//#endregion
+export { viewFor as a, scopedFor as i, SveltePermDockOptions as n, PermissionBoundaryProps as o, ProtectedProps as r, slotContent as s, PermDockDefaults as t };

package/dist/types-tIgIeIKJ.d.ts

@@ -0,0 +1,66 @@
+import { Mn as ApprovalRequiredDecision, Nn as Decision, Vt as Snapshot, dt as TokenVerifier, zn as GrantedDecision } from "./policy-types-DzwivBgR.js";
+import { w as Permission } from "./vocabulary-D6lPdb4Z.js";
+import { n as DescribeMessages } from "./describe-BZUsixiL.js";
+import { h as ClientStoreOptions } from "./types-BNORmDM8.js";
+import { ReactNode } from "react";
+//#region src/react/types.d.ts
+type PermDockProviderProps = ({
+  readonly snapshot: Snapshot | string;
+  readonly snapshotPromise?: never;
+} | {
+  /**
+   * An unawaited snapshot from a Server Component. Hooks never suspend on it: until it
+   * resolves they deny with `status: 'pending'`, then re-render. A rejection fails closed
+   * (`server-only`). Set `suspend` to suspend readers through `use()` instead.
+   */
+  readonly snapshotPromise: PromiseLike<Snapshot | string>;
+  readonly snapshot?: never;
+}) & {
+  /**
+   * With `snapshotPromise`: `true` suspends every hook to the nearest Suspense boundary until it
+   * resolves, and a rejection reaches the nearest error boundary. Defaults to `false`.
+   */
+  readonly suspend?: boolean;
+  /**
+   * The AuthZEN evaluations endpoint for checks the snapshot cannot answer. `false` never
+   * fetches: those checks answer `denied` with reason `server-only`.
+   */
+  readonly endpoint?: string | false;
+  /** Where `refresh()` fetches a fresh snapshot. Defaults to `endpoint`. */
+  readonly snapshotUrl?: string;
+  readonly approvals?: string;
+  readonly tenant?: string;
+  readonly fetch?: typeof fetch;
+  readonly headers?: Readonly<Record<string, string>>;
+  readonly maxAge?: number;
+  readonly verifier?: TokenVerifier;
+  /** What every `<Protected>` below renders for a slot it leaves out. */
+  readonly defaults?: PermDockDefaults;
+  /** Localised text for `useDescribe()`. */
+  readonly messages?: DescribeMessages;
+  /** Called with each snapshot the store accepts; the latest prop is called. */
+  readonly onSnapshot?: NonNullable<ClientStoreOptions["onSnapshot"]>;
+  /** Called when the store drops its snapshot; the latest prop is called. */
+  readonly onClear?: () => void;
+  /** Milliseconds between approval status polls. Defaults to 2000. */
+  readonly approvalInterval?: number;
+  readonly children: ReactNode;
+};
+/** Provider-wide content for the `<Protected>` slots a component leaves out. */
+type PermDockDefaults = {
+  readonly pending?: ReactNode;
+  readonly denied?: ReactNode | ((decision: Decision) => ReactNode);
+  readonly approval?: ReactNode | ((decision: ApprovalRequiredDecision) => ReactNode);
+};
+type ProtectedProps = {
+  readonly permission: Permission;
+  readonly data?: unknown;
+  readonly tenant?: string;
+  readonly pending?: ReactNode;
+  readonly denied?: ReactNode | ((decision: Decision) => ReactNode);
+  /** Rendered for an approval-required decision; defaults to `denied`. */
+  readonly approval?: ReactNode | ((decision: ApprovalRequiredDecision) => ReactNode);
+  readonly children: ReactNode | ((decision: GrantedDecision) => ReactNode);
+};
+//#endregion
+export { PermDockProviderProps as n, ProtectedProps as r, PermDockDefaults as t };

package/dist/unplugin/index.d.ts

@@ -1,4 +1,4 @@
-import { a as PermDockPluginOptions } from "../types-DbjRN55U.js";
+import { a as PermDockPluginOptions } from "../types-5Ut_pbKy.js";
 import { createUnplugin } from "unplugin";
 //#region src/unplugin/index.d.ts
 type CreateUnplugin = typeof createUnplugin<PermDockPluginOptions | undefined>;

package/dist/unplugin/index.js

@@ -1,5 +1,5 @@
-import { n as createCollectScheduler, r as report } from "../watch-DVBJ9cBq.js";
-import { t as peerHint } from "../peer-BOr_kJE1.js";
+import { n as createCollectScheduler, r as report } from "../watch-CszoTJMq.js";
+import { r as peerHint } from "../peer-C8swJ2GH.js";
 import { createRequire } from "node:module";
 //#region src/unplugin/index.ts
 function loadCreateUnplugin() {

package/dist/usage-CHOtwL19.js

@@ -0,0 +1 @@
+export { t as runUsage } from "./usage-T5mXq98v.js";

package/dist/usage-DHtE8j4E.js

@@ -0,0 +1,32 @@
+import { t as defineLeaf } from "./command-L8EstFNm.js";
+import { a as failOnFlag } from "./flags-C3DktBDY.js";
+//#region src/cli/commands/usage.ts
+const usage = defineLeaf({
+	flags: {
+		...failOnFlag,
+		ignore: {
+			type: "string",
+			repeatable: true,
+			description: "Permission keys or globs to skip",
+			valueHint: "glob"
+		},
+		"dynamic-as-used": {
+			type: "boolean",
+			description: "Count computed permission references as uses"
+		}
+	},
+	async run(ctx, { flags }) {
+		return (await import("./usage-CHOtwL19.js")).runUsage({
+			cwd: ctx.cwd,
+			config: ctx.config,
+			ignore: flags.ignore,
+			strict: flags["fail-on"] === "warning",
+			json: ctx.json,
+			dynamicAsUsed: flags["dynamic-as-used"],
+			now: ctx.now,
+			io: ctx.io
+		});
+	}
+});
+//#endregion
+export { usage };

package/dist/{usage-ItS7nLcl.js → usage-T5mXq98v.js}

@@ -1,34 +1,43 @@
-import { c as getResource } from "./permissions-DVoF6dMt.js";
-import { o as usageResult } from "./errors-CWfoNg9N.js";
-import { a as USAGE_REPORT_SCHEMA } from "./version-BvacVTZR.js";
-import { o as jsonSchemaOf } from "./catalog-doc-DdGm82XT.js";
-import { i as rel, r as listSourceFiles } from "./files-DWUN9PzI.js";
-import { a as loadModule, n as asPolicy, o as pickNamed } from "./load-DhWEB9P1.js";
-import { r as runCollect } from "./collect-DSTE3ml9.js";
+import { a as getResource } from "./permission-registry-Br4jSNVi.js";
+import { u as usageResult } from "./errors-CWTY6uih.js";
+import { a as rel, r as listSourceFiles } from "./files-D_JIzUrP.js";
+import { o as USAGE_REPORT_SCHEMA } from "./version-CEbQ5UeM.js";
+import { s as jsonSchemaOf } from "./catalog-doc-C9wjsfNY.js";
+import { a as loadModule, n as asPolicy, s as pickNamed } from "./load-DFS_ry0W.js";
+import { r as runCollect } from "./collect-CrZJJnEF.js";
+import { t as beforeFirst } from "./text-BMFRfBqc.js";
+import { t as DOCS_BASE } from "./manifest-CtKR3GXL.js";
+import { r as findingOf } from "./output-Dyw8fyPF.js";
 import { existsSync, readFileSync, realpathSync } from "node:fs";
 import { dirname, resolve } from "node:path";
 import { fileURLToPath, pathToFileURL } from "node:url";
 import { createJiti } from "jiti";
 import { Visitor, parseSync } from "oxc-parser";
 import { isBuiltin } from "node:module";
-//#region src/cli/doctor-source.ts
+//#region src/cli/doctor/source.ts
 /** Entries a client file must not import; `tests/cli/doctor-entries.test.ts` keeps it in step with `exports`. */
 const SERVER_SPECIFIERS = [
 	"permdock/a2a",
+	"permdock/agent",
 	"permdock/ai-sdk",
 	"permdock/approvals",
+	"permdock/astro",
 	"permdock/authzen",
 	"permdock/better-auth",
 	"permdock/better-supabase",
+	"permdock/chat",
+	"permdock/chat-sdk",
 	"permdock/claude-agent",
 	"permdock/clerk",
 	"permdock/cloud",
 	"permdock/convex",
+	"permdock/delivery",
 	"permdock/drizzle",
 	"permdock/elysia",
 	"permdock/eve",
 	"permdock/express",
 	"permdock/fastify",
+	"permdock/h3",
 	"permdock/hono",
 	"permdock/jwt",
 	"permdock/kysely",
@@ -42,24 +51,35 @@ const SERVER_SPECIFIERS = [
 	"permdock/otel",
 	"permdock/pdp",
 	"permdock/prisma",
+	"permdock/resend",
 	"permdock/scim",
 	"permdock/server",
+	"permdock/solid-start",
 	"permdock/ssf",
 	"permdock/supabase",
 	"permdock/supabase/middleware",
+	"permdock/sveltekit",
+	"permdock/tanstack-start",
 	"permdock/terminal",
-	"permdock/trpc"
+	"permdock/trpc",
+	"permdock/workflow",
+	"permdock/workflow-sdk"
 ];
 /** Entries that feed request, tool or model data into a check. */
 const ADAPTER_SPECIFIERS = [
 	"permdock/a2a",
+	"permdock/agent",
 	"permdock/ai-sdk",
+	"permdock/astro",
 	"permdock/authzen",
+	"permdock/chat",
+	"permdock/chat-sdk",
 	"permdock/claude-agent",
 	"permdock/elysia",
 	"permdock/eve",
 	"permdock/express",
 	"permdock/fastify",
+	"permdock/h3",
 	"permdock/hono",
 	"permdock/mcp",
 	"permdock/nest",
@@ -68,7 +88,10 @@ const ADAPTER_SPECIFIERS = [
 	"permdock/openai",
 	"permdock/orpc",
 	"permdock/server",
+	"permdock/solid-start",
 	"permdock/supabase/middleware",
+	"permdock/sveltekit",
+	"permdock/tanstack-start",
 	"permdock/terminal",
 	"permdock/trpc",
 	"permdock/webmcp"
@@ -241,6 +264,12 @@ function stringValue(node) {
 	if (value?.type === "Literal") return typeof value.value === "string" ? value.value : void 0;
 	return value?.type === "TemplateLiteral" ? value.quasis[0]?.value.cooked ?? void 0 : void 0;
 }
+/** Their `jwks` holds Standard Webhooks `v1a` keys, not a token issuer's. */
+const WEBHOOK_VERIFIERS = /* @__PURE__ */ new Set([
+	"cloudApprovalWaiter",
+	"verifyWebhook",
+	"webhookVerifier"
+]);
 function isPermDockSpecifier(value) {
 	return value === "permdock" || value.startsWith("permdock/");
 }
@@ -254,7 +283,8 @@ function permdockOptionObjects(source) {
 		ImportDeclaration(node) {
 			if (node.importKind === "type" || !isPermDockSpecifier(node.source.value)) return;
 			for (const specifier of node.specifiers) if (specifier.type === "ImportNamespaceSpecifier") namespaces.add(specifier.local.name);
-			else if (specifier.type === "ImportDefaultSpecifier" || specifier.importKind !== "type") functions.add(specifier.local.name);
+			else if (specifier.type === "ImportDefaultSpecifier") functions.add(specifier.local.name);
+			else if (specifier.importKind !== "type" && !WEBHOOK_VERIFIERS.has(specifier.imported.type === "Identifier" ? specifier.imported.name : specifier.imported.value)) functions.add(specifier.local.name);
 		},
 		VariableDeclarator(node) {
 			const init = unwrapped(node.init);
@@ -373,7 +403,7 @@ function pd038(sources, tenantClaim, fallback) {
 			code: "PD038",
 			severity: "warning",
 			message: `${source.file}:${line} reads the tenant from '${read}', but rls.tenantClaim is '${tenantClaim}'`,
-			fix: `pass tenant: '${tenantClaim}' or set rls.tenantClaim to '${read}'`
+			fix: `pass claims: { tenant: '${tenantClaim}' } or set rls.tenantClaim to '${read}'`
 		});
 	}
 	return findings;
@@ -534,7 +564,20 @@ async function runUsage(input) {
 	};
 	return {
 		code: report.errors > 0 || input.strict && report.warnings > 0 ? 1 : 0,
-		output: input.json ? `${JSON.stringify(report, null, 2)}\n` : formatUsage(report)
+		output: input.json ? `${JSON.stringify(report, null, 2)}\n` : formatUsage(report),
+		findings: [
+			...unused,
+			...ungranted,
+			...noRole,
+			...dynamic,
+			...undeclared,
+			...outsideInclude
+		].map((item) => findingOf({
+			code: item.kind,
+			severity: item.kind === "no-role" ? "error" : "warning",
+			message: `${item.key === "*" ? "" : `${item.key}: `}${item.detail}`,
+			docs: `${DOCS_BASE}/usage`
+		}))
 	};
 }
 async function usagePolicy(cwd, policyRel, loaded) {
@@ -587,7 +630,7 @@ function declaredFields(policy, resource) {
 function conditionFields(condition, out) {
 	if (condition === void 0) return;
 	const add = (field) => {
-		out.add(field.split(".")[0] ?? field);
+		out.add(beforeFirst(field, "."));
 	};
 	switch (condition.op) {
 		case "eq":

package/dist/{validation-error-Ba264OaJ.d.ts → validation-error-Bg5Tpluk.d.ts}

@@ -1,4 +1,4 @@
-import { a as ProblemDetails } from "./errors-DPdqI50v.js";
+import { a as ProblemDetails } from "./errors-C2PXIv4c.js";
 import { StandardSchemaV1 } from "@standard-schema/spec";
 //#region src/core/validation-error.d.ts
 /** The base of every Problem Details `type` URI; defined here so a validation error does not pull in the Problem Details builders. */

package/dist/{validation-error-CnjZ4t92.js → validation-error-ZfUHbKvf.js}

@@ -1,4 +1,4 @@
-import { t as compact } from "./compact-y6vfu2_f.js";
+import { t as compact } from "./compact-CAf557ZB.js";
 //#region src/core/validation-error.ts
 /** The base of every Problem Details `type` URI; defined here so a validation error does not pull in the Problem Details builders. */
 const PROBLEM_BASE = "https://permdock.com/problems";

package/dist/validity-CZ7-y0Cj.js

@@ -0,0 +1,79 @@
+import { n as freezeDeep } from "./freeze-CrU8nQeX.js";
+import { i as ownKeys, n as isForbiddenKey, r as ownGet } from "./paths-DXSHAMIa.js";
+import { c as instantOf, g as secondsOf, m as rfc3339 } from "./time-DkWjdL98.js";
+//#region src/core/fields.ts
+function sanitizeFields(fields) {
+	if (fields === void 0) return;
+	return fields.filter((field) => field.length > 0 && !isForbiddenKey(field));
+}
+function grantCoversField(fields, field, effect) {
+	if (fields === void 0) return true;
+	if (fields.length === 0) return false;
+	if (field === void 0) return effect === "allow";
+	return fields.includes(field);
+}
+function pickVisible(row, canField) {
+	const out = {};
+	for (const key of ownKeys(row)) if (canField(key)) out[key] = ownGet(row, key);
+	return freezeDeep(out);
+}
+function sanitizeContext(value) {
+	if (value === null || typeof value !== "object" || Array.isArray(value)) return {};
+	const out = {};
+	for (const key of ownKeys(value)) out[key] = ownGet(value, key);
+	return out;
+}
+//#endregion
+//#region src/core/validity.ts
+/**
+* The normalised validity of a grant, or `undefined` when neither bound is
+* set. Fail-closed at definition time: a bound that does not parse, or a
+* window that ends before it starts, throws so a typo never widens a grant.
+*/
+function normalizeValidity(options, permissionKey) {
+	const from = options.validFrom === void 0 ? void 0 : instantOf(options.validFrom);
+	const until = options.validUntil === void 0 ? void 0 : instantOf(options.validUntil);
+	if (options.validFrom !== void 0 && from === void 0) throw new Error(`PermDock: validFrom on '${permissionKey}' must be an RFC 3339 string or an Instant`);
+	if (options.validUntil !== void 0 && until === void 0) throw new Error(`PermDock: validUntil on '${permissionKey}' must be an RFC 3339 string or an Instant`);
+	if (from !== void 0 && until !== void 0 && until <= from) throw new Error(`PermDock: validUntil on '${permissionKey}' must be after validFrom`);
+	if (from === void 0 && until === void 0) return;
+	return Object.freeze({
+		...from === void 0 ? {} : { from },
+		...until === void 0 ? {} : { until }
+	});
+}
+/** Whether a grant with this validity applies at `now` (Unix seconds); no validity always applies. */
+function isActive(validity, now) {
+	if (validity === void 0) return true;
+	if (validity.from !== void 0 && now < validity.from) return false;
+	return validity.until === void 0 || now < validity.until;
+}
+function wireValidity(validity) {
+	if (validity === void 0) return;
+	return Object.freeze({
+		...validity.from === void 0 ? {} : { from: rfc3339(validity.from) },
+		...validity.until === void 0 ? {} : { until: rfc3339(validity.until) }
+	});
+}
+/**
+* The validity of a wire grant. A malformed window fails closed for the
+* grant's effect: an allow never applies (`{ from: +∞ }`), a deny always
+* does (no window), so a corrupt bound can never lift a deny.
+*/
+function readWireValidity(value, effect = "allow") {
+	if (value === void 0) return;
+	const malformed = effect === "deny" ? void 0 : NEVER;
+	if (typeof value !== "object" || value === null) return malformed;
+	const from = "from" in value ? value.from : void 0;
+	const until = "until" in value ? value.until : void 0;
+	const start = from === void 0 ? void 0 : secondsOf(from);
+	const end = until === void 0 ? void 0 : secondsOf(until);
+	if (from !== void 0 && start === void 0 || until !== void 0 && end === void 0) return malformed;
+	return Object.freeze({
+		...start === void 0 ? {} : { from: start },
+		...end === void 0 ? {} : { until: end }
+	});
+}
+const NEVER = Object.freeze({ from: Number.POSITIVE_INFINITY });
+//#endregion
+export { grantCoversField as a, sanitizeFields as c, wireValidity as i, normalizeValidity as n, pickVisible as o, readWireValidity as r, sanitizeContext as s, isActive as t };