permdock 0.4.0 → 0.5.0

package/dist/sink-Bj_lDUDq.d.ts

@@ -0,0 +1,225 @@
+import { Ct as Credential, Jt as AutomationEvent, Kt as AccessEvent, Yt as CredentialEvent, gt as SupportSession, nn as MembershipEvent, q as DecisionSink, rn as SinkEvent, ut as TokenSigner } from "./policy-types-DzwivBgR.js";
+import { V as AppData } from "./vocabulary-D6lPdb4Z.js";
+import { u as OperationRisk } from "./operations-CxybZErY.js";
+import { t as Automation } from "./automation-BMZPIVUM.js";
+//#region src/core/sink.d.ts
+/**
+ * The closed list of CloudEvents `type` values, `com.permdock.<family>` or
+ * `com.permdock.<family>.<operation>`. `RESERVED_CLOUD_EVENT_TYPES` are named
+ * for later releases and nothing emits them yet.
+ */
+declare const CLOUD_EVENT_TYPES: {
+  readonly decision: "com.permdock.decision";
+  readonly approvalRequested: "com.permdock.approval.requested";
+  readonly approvalResolved: "com.permdock.approval.resolved";
+  readonly approvalExpired: "com.permdock.approval.expired";
+  readonly approvalCancelled: "com.permdock.approval.cancelled";
+  readonly membershipAdded: "com.permdock.membership.added";
+  readonly membershipRemoved: "com.permdock.membership.removed";
+  readonly membershipChanged: "com.permdock.membership.changed";
+  readonly credentialCreated: "com.permdock.credential.created";
+  readonly credentialUsed: "com.permdock.credential.used";
+  readonly credentialRotated: "com.permdock.credential.rotated";
+  readonly credentialRevoked: "com.permdock.credential.revoked";
+  readonly directoryCreated: "com.permdock.directory.created";
+  readonly directoryReplaced: "com.permdock.directory.replaced";
+  readonly directoryPatched: "com.permdock.directory.patched";
+  readonly directoryDeleted: "com.permdock.directory.deleted";
+  readonly catalogPublished: "com.permdock.catalog.published";
+  readonly catalogDrifted: "com.permdock.catalog.drifted";
+  readonly supportSessionStarted: "com.permdock.support-session.started";
+  readonly supportSessionEnded: "com.permdock.support-session.ended";
+  readonly automationPublished: "com.permdock.automation.published";
+  readonly automationChanged: "com.permdock.automation.changed";
+  readonly automationRevoked: "com.permdock.automation.revoked";
+  readonly automationRun: "com.permdock.automation.run";
+  readonly deliverySent: "com.permdock.delivery.sent";
+  readonly deliveryDelivered: "com.permdock.delivery.delivered";
+  readonly deliveryBounced: "com.permdock.delivery.bounced";
+  readonly deliveryComplained: "com.permdock.delivery.complained";
+  readonly deliveryFailed: "com.permdock.delivery.failed";
+};
+type CloudEventType = (typeof CLOUD_EVENT_TYPES)[keyof typeof CLOUD_EVENT_TYPES];
+/** Types named for a later release; a receiver refuses them until then. None are reserved now. */
+declare const RESERVED_CLOUD_EVENT_TYPES: readonly CloudEventType[];
+/** The CloudEvents JSON format media type for one event (structured mode). */
+declare const CLOUDEVENTS_CONTENT_TYPE = "application/cloudevents+json";
+/** The CloudEvents JSON batch format media type: a JSON array of events. */
+declare const CLOUDEVENTS_BATCH_CONTENT_TYPE = "application/cloudevents-batch+json";
+/**
+ * Why a published catalog drifted. The first four broke a live hosted grant,
+ * which the Cloud then suspends; the `operation-*` codes only report.
+ */
+type CatalogFindingCode = "permission-removed" | "not-hostable" | "grantee-removed" | "approval-tightened" | "operation-risk-raised" | "operation-approval-removed";
+/** One drift finding: the permission key and, when one broke, the hosted grant id. */
+type CatalogFinding = {
+  readonly code: CatalogFindingCode;
+  readonly permission: string;
+  readonly grant?: string;
+  /** The operation name, on the `operation-*` codes. */
+  readonly operation?: string;
+  /** `meta.risk` before the publish, on `operation-risk-raised`; an unset risk is `low`. */
+  readonly previous?: OperationRisk;
+  /** `meta.risk` after the publish, on `operation-risk-raised`. */
+  readonly risk?: OperationRisk;
+};
+/** `data` of a `com.permdock.catalog.*` event: a `permdock cloud push` or a drift against live hosted grants. */
+type CatalogEventData = {
+  readonly kind: "publish" | "drift";
+  /** The catalog fingerprint after the publish, or the one drift was measured against. */
+  readonly fingerprint: string;
+  readonly previous?: string;
+  readonly findings?: readonly CatalogFinding[];
+};
+/** A CloudEvents 1.0 event in the JSON format, with the distributed-tracing extension. */
+type CloudEvent = {
+  readonly specversion: "1.0";
+  readonly type: CloudEventType;
+  /** An absolute URI naming the producer. */
+  readonly source: string;
+  readonly subject?: string;
+  readonly id: string;
+  /** An RFC 3339 instant: the sink event's `at`. */
+  readonly time: string;
+  readonly datacontenttype: "application/json";
+  /** The published JSON Schema of `data`, `https://permdock.com/schemas/<family>-event-v1.json`. */
+  readonly dataschema: string;
+  /** W3C Trace Context `traceparent`, the CloudEvents distributed-tracing extension. */
+  readonly traceparent?: string;
+  readonly tracestate?: string;
+  readonly data: SinkEvent | CatalogEventData;
+};
+type CloudEventOptions = {
+  /** An absolute URI naming the producer, such as the app's origin. */
+  readonly source: string;
+  /** Defaults to a random UUID. */
+  readonly id?: string;
+  readonly traceparent?: string;
+  readonly tracestate?: string;
+};
+type SignDecisionBatchOptions = {
+  readonly audience?: string | readonly string[];
+  /** An absolute URI naming the producer, the `source` of every CloudEvent. */
+  readonly source: string;
+};
+type MemoryDecisionSinkOptions = {
+  readonly capacity?: number;
+} & ({
+  readonly signer?: undefined;
+  readonly audience?: undefined;
+  readonly source?: undefined;
+} | {
+  /** Signs each write as an evidence export of CloudEvents. */
+  readonly signer: TokenSigner;
+  readonly audience?: string | readonly string[];
+  /** An absolute URI naming the producer, the `source` of every CloudEvent. */
+  readonly source: string;
+});
+type MemoryDecisionSink = DecisionSink & {
+  readonly events: () => readonly SinkEvent[];
+  readonly batches: () => readonly string[];
+};
+/**
+ * The CloudEvents `type` of a sink event. A support access event maps onto the
+ * `support-session` family, and a consent the tenant pulls early (`revoked`)
+ * ends the session like a lapse; `data.operation` keeps the difference.
+ */
+declare function cloudEventType(event: SinkEvent): CloudEventType;
+/**
+ * An `automation` sink event for `automation`. `run` carries the run id and
+ * belongs on `run` events only.
+ */
+declare function automationEvent(input: {
+  readonly operation: AutomationEvent["operation"];
+  readonly automation: Automation;
+  readonly run?: string;
+  readonly source?: string;
+  readonly by?: AutomationEvent["by"];
+  /** An RFC 3339 instant; defaults to now. */
+  readonly at?: string;
+  /** The application's own data; plain JSON, checked here. */
+  readonly x?: AppData;
+}): AutomationEvent;
+/**
+ * The `access` event of a `SupportSession`: `started` when it begins,
+ * `ended` when it lapses, `revoked` when it is ended early. `principal` is
+ * the staff member, as for a support membership.
+ */
+declare function supportSessionEvent(input: {
+  readonly operation: AccessEvent["operation"];
+  readonly session: SupportSession;
+  readonly source?: string;
+  /** An RFC 3339 instant; defaults to now. */
+  readonly at?: string;
+  /** The application's own data; plain JSON, checked here. */
+  readonly x?: AppData;
+}): AccessEvent;
+/**
+ * A `credential` sink event for `credential`. `sample` belongs on `used`
+ * events only and must be in `(0, 1]`.
+ */
+declare function credentialEvent(input: {
+  readonly operation: CredentialEvent["operation"];
+  readonly credential: Credential;
+  readonly source?: string;
+  readonly by?: CredentialEvent["by"];
+  readonly sample?: number;
+  /** An RFC 3339 instant; defaults to now. */
+  readonly at?: string;
+  /** The application's own data; plain JSON, checked here. */
+  readonly x?: AppData;
+}): CredentialEvent;
+declare function membershipEvent(input: {
+  readonly source: string;
+  readonly operation: MembershipEvent["operation"];
+  readonly principal: MembershipEvent["principal"];
+  readonly scope?: string;
+  readonly id?: string;
+  readonly within?: MembershipEvent["within"];
+  readonly via?: string;
+  /** An RFC 3339 instant, or NumericDate seconds as a `Membership` holds them. */
+  readonly expiresAt?: string | number;
+  readonly roles: MembershipEvent["roles"];
+  readonly by?: MembershipEvent["by"];
+  /** An RFC 3339 instant; defaults to now. */
+  readonly at?: string;
+  /** The application's own data; plain JSON, checked here. */
+  readonly x?: AppData;
+}): MembershipEvent;
+/**
+ * A support-access lifecycle event. `started` on consent, `ended` when the
+ * session lapses, `revoked` when the tenant pulls consent early. It never
+ * decides; the app writes and revokes the membership.
+ */
+declare function accessEvent(input: {
+  readonly source: string;
+  readonly operation: AccessEvent["operation"];
+  readonly tenant: string;
+  readonly principal: AccessEvent["principal"];
+  readonly via?: string;
+  readonly roles: readonly string[];
+  readonly member?: AccessEvent["member"];
+  /** An RFC 3339 instant, or NumericDate seconds as a `Membership` holds them. */
+  readonly expiresAt?: string | number;
+  readonly grantedBy?: string;
+  readonly reason?: string;
+  readonly actor?: AccessEvent["actor"];
+  /** An RFC 3339 instant; defaults to now. */
+  readonly at?: string;
+  /** The application's own data; plain JSON, checked here. */
+  readonly x?: AppData;
+}): AccessEvent;
+/**
+ * Wraps a sink event in a CloudEvents 1.0 envelope. Throws a `TypeError` when
+ * `source` is not an absolute URI or `traceparent` is not W3C Trace Context.
+ */
+declare function toCloudEvent(event: SinkEvent, options: CloudEventOptions): CloudEvent;
+/**
+ * Signs sink events as an offline evidence export: a compact JWS with
+ * `typ: vnd.permdock.evidence+jwt` whose `events` claim holds CloudEvents.
+ * Live deliveries use Standard Webhooks instead.
+ */
+declare function signDecisionBatch(events: readonly SinkEvent[], signer: TokenSigner, options: SignDecisionBatchOptions): Promise<string>;
+declare function memoryDecisionSink(options?: MemoryDecisionSinkOptions): MemoryDecisionSink;
+//#endregion
+export { toCloudEvent as S, credentialEvent as _, CatalogFinding as a, signDecisionBatch as b, CloudEventOptions as c, MemoryDecisionSinkOptions as d, RESERVED_CLOUD_EVENT_TYPES as f, cloudEventType as g, automationEvent as h, CatalogEventData as i, CloudEventType as l, accessEvent as m, CLOUDEVENTS_CONTENT_TYPE as n, CatalogFindingCode as o, SignDecisionBatchOptions as p, CLOUD_EVENT_TYPES as r, CloudEvent as s, CLOUDEVENTS_BATCH_CONTENT_TYPE as t, MemoryDecisionSink as u, membershipEvent as v, supportSessionEvent as x, memoryDecisionSink as y };

package/dist/{skills-BZdRQkxs.js → skills-B6lVdD_W.js}

@@ -1,6 +1,7 @@
 import { t as byCodePoint } from "./compare-pfyVnBjE.js";
 import { i as readJsonFile } from "./files-D_JIzUrP.js";
-import { t as packageRoot } from "./package-root-DtNnpmUd.js";
+import { t as packageRoot } from "./package-root-Dk_ETdkp.js";
+import { t as didYouMean } from "./args-IIolxxKA.js";
 import { cpSync, existsSync, lstatSync, mkdirSync, readFileSync, readdirSync, readlinkSync, realpathSync, writeFileSync } from "node:fs";
 import { basename, dirname, join, relative, resolve } from "node:path";
 import { createRequire } from "node:module";
@@ -20,13 +21,22 @@ const AGENT_FOLDERS = {
 	claude: ".claude/skills",
 	cursor: ".cursor/skills"
 };
-/** The `--agent` names `skills install` knows, with the folder each writes. */
+/** The `--for` names `skills install` knows, with the folder each writes. */
 const SKILL_AGENTS = AGENT_FOLDERS;
 /** Agents whose config folder (`.claude`, `.cursor`, `.agents`) the project already has. */
 function detectedAgents(cwd) {
 	return Object.entries(AGENT_FOLDERS).filter(([, folder]) => existsSync(join(cwd, dirname(folder)))).map(([agent]) => agent);
 }
 function runSkills(input) {
+	const names = /* @__PURE__ */ new Set([...Object.keys(AGENT_FOLDERS), "agent"]);
+	const unknown = input.agents.find((agent) => !names.has(agent));
+	if (unknown !== void 0) {
+		const suggestion = didYouMean(unknown, Object.keys(AGENT_FOLDERS));
+		return {
+			code: 2,
+			output: `skills: unknown --for '${unknown}'.${suggestion === void 0 ? "" : ` Did you mean ${suggestion}?`} Use ${Object.keys(AGENT_FOLDERS).join(", ")}.`
+		};
+	}
 	switch (input.action) {
 		case void 0:
 		case "install":
@@ -169,10 +179,7 @@ function listSkills(cwd) {
 }
 function resolveTargets(agents) {
 	if (agents.length === 0) return Object.values(AGENT_FOLDERS);
-	return agents.map((agent) => {
-		const key = agent === "agent" ? "agents" : agent;
-		return AGENT_FOLDERS[key] ?? `.${key}/skills`;
-	});
+	return agents.map((agent) => AGENT_FOLDERS[agent === "agent" ? "agents" : agent] ?? ".agents/skills");
 }
 function resolveSkillsRoot(cwd, bundled) {
 	try {

package/dist/skills-CTYwkl44.js

@@ -0,0 +1,51 @@
+import { t as defineLeaf } from "./command-L8EstFNm.js";
+import { t as checkFlag } from "./flags-C3DktBDY.js";
+import { r as pick, t as CANCELLED } from "./prompt-DfZLJLIn.js";
+import { n as detectedAgents, r as runSkills, t as SKILL_AGENTS } from "./skills-B6lVdD_W.js";
+//#region src/cli/commands/skills.ts
+const forFlag = { for: {
+	type: "string",
+	repeatable: true,
+	description: "Agent folders to write: agents, claude or cursor",
+	valueHint: "name",
+	complete: () => Object.keys(SKILL_AGENTS)
+} };
+async function installTo(ctx, action, clients, check) {
+	let agents = clients;
+	if (ctx.interactive && !ctx.yes && !check && agents.length === 0) {
+		const detected = detectedAgents(ctx.cwd);
+		const picked = await pick("Which agents should get the PermDock skills?", Object.entries(SKILL_AGENTS).map(([value, hint]) => ({
+			value,
+			hint
+		})), detected.length > 0 ? detected : Object.keys(SKILL_AGENTS));
+		if (picked === void 0) return CANCELLED;
+		agents = picked;
+	}
+	return runSkills({
+		cwd: ctx.cwd,
+		action,
+		agents,
+		check
+	});
+}
+const install = defineLeaf({
+	flags: {
+		...forFlag,
+		...checkFlag
+	},
+	run: (ctx, { flags }) => installTo(ctx, "install", flags.for, flags.check)
+});
+const update = defineLeaf({
+	flags: { ...forFlag },
+	run: (ctx, { flags }) => installTo(ctx, "update", flags.for, false)
+});
+const list = defineLeaf({
+	flags: {},
+	run: (ctx) => runSkills({
+		cwd: ctx.cwd,
+		action: "list",
+		agents: []
+	})
+});
+//#endregion
+export { install, list, update };

package/dist/snapshot-CXUWfsNy.js

@@ -0,0 +1,269 @@
+import { t as compact } from "./compact-CAf557ZB.js";
+import { n as freezeDeep } from "./freeze-CrU8nQeX.js";
+import { n as isForbiddenKey } from "./paths-DXSHAMIa.js";
+import { c as isConditionRef, i as resolveConditionRef } from "./refs-K6eWUJ0H.js";
+import { l as isRfc3339, m as rfc3339, p as nowSeconds } from "./time-DkWjdL98.js";
+import { d as scopeList } from "./scopes-CUPSjo9q.js";
+import { _ as listPlans, v as listRoles } from "./grantee-Cn1HyUsI.js";
+import { i as wireValidity } from "./validity-CZ7-y0Cj.js";
+import { m as tenantsOf } from "./tenancy-DN2QAx9z.js";
+import { n as toWireDelegation } from "./wire-delegation-Cv3W2eaM.js";
+//#region src/conditions/bind.ts
+function isPrimitive(value) {
+	return typeof value === "string" || typeof value === "number" || typeof value === "boolean";
+}
+const ALWAYS = {
+	op: "eq",
+	field: "_",
+	value: true
+};
+const NEVER = {
+	op: "or",
+	conditions: []
+};
+function bindValue(value, subject, only) {
+	if (isConditionRef(value) && only !== void 0 && !only(value.ref)) return value;
+	if (isConditionRef(value)) {
+		const resolved = resolveConditionRef(value.ref, subject);
+		if (Array.isArray(resolved)) return resolved.filter((item) => isPrimitive(item));
+		return isPrimitive(resolved) ? resolved : null;
+	}
+	if (Array.isArray(value)) return value.map((item) => bindValue(item, subject, only));
+	return value;
+}
+function bindArg(arg, subject, only) {
+	return arg !== null && typeof arg === "object" && "field" in arg && !isConditionRef(arg) ? arg : bindValue(arg, subject, only);
+}
+/**
+* Replaces every `principal.*` / `context.*` ref with the subject's value, and
+* a `liveSession` node with a constant, so a `where()` result compiles the
+* same without the subject. A ref the subject
+* does not hold binds to `null` (or `[]` in a list), which never matches, as
+* in `evaluateCondition`. With `only`, refs it rejects stay refs.
+*/
+function bindConditionRefs(condition, subject, only) {
+	switch (condition.op) {
+		case "and":
+		case "or": return {
+			op: condition.op,
+			conditions: condition.conditions.map((child) => bindConditionRefs(child, subject, only))
+		};
+		case "not": return {
+			op: "not",
+			condition: bindConditionRefs(condition.condition, subject, only)
+		};
+		case "in":
+		case "notIn": {
+			const value = condition.value;
+			if (isConditionRef(value) && only !== void 0 && !only(value.ref)) return condition;
+			const bound = bindValue(value, subject, only);
+			return {
+				...condition,
+				value: Array.isArray(bound) ? bound : []
+			};
+		}
+		case "eq":
+		case "ne":
+		case "gt":
+		case "gte":
+		case "lt":
+		case "lte":
+		case "contains": return {
+			...condition,
+			value: bindValue(condition.value, subject, only)
+		};
+		case "sqlFunction": return {
+			...condition,
+			args: condition.args.map((arg) => bindArg(arg, subject, only)),
+			twin: bindConditionRefs(condition.twin, subject, only)
+		};
+		case "liveSession": return subject.liveSession === true ? ALWAYS : NEVER;
+		case "isNull":
+		case "memberOf":
+		case "related":
+		case "opaque": return condition;
+		default: return condition;
+	}
+}
+//#endregion
+//#region src/core/snapshot.ts
+function plainPermission(leaf) {
+	return {
+		key: leaf.key,
+		scope: leaf.scope,
+		resource: leaf.resource,
+		action: leaf.action,
+		meta: leaf.meta,
+		kind: leaf.kind
+	};
+}
+function plainRole(leaf) {
+	return compact({
+		key: leaf.key,
+		on: leaf.on,
+		assignable: leaf.assignable,
+		meta: leaf.meta,
+		kind: leaf.kind
+	});
+}
+function plainPlan(leaf) {
+	return {
+		key: leaf.key,
+		meta: leaf.meta,
+		kind: leaf.kind
+	};
+}
+function snapshotGrant(grant, membership) {
+	const scope = grant.scope === "global" ? void 0 : typeof grant.scope === "string" ? grant.scope : { resource: grant.scope.resource };
+	const entry = compact({
+		permission: grant.permission.key,
+		effect: grant.effect,
+		role: grant.role,
+		to: grant.to,
+		where: grant.portable ? grant.where : void 0,
+		check: grant.portable ? grant.check : void 0,
+		approval: grant.approval,
+		scope,
+		membership,
+		portable: grant.portable ? void 0 : false,
+		fields: grant.fields,
+		validity: wireValidity(grant.validity),
+		name: grant.name,
+		meta: grant.meta,
+		obligations: grant.obligations
+	});
+	return freezeDeep(entry);
+}
+const CARRIED = /* @__PURE__ */ new Set([
+	"id",
+	"roles",
+	"plans",
+	"tenant",
+	"memberships"
+]);
+/** Principal refs the snapshot principal does not carry (`claims`, `teamIds`, …) are bound to the subject's values. */
+function isClaimRef(ref) {
+	const [root, head] = ref.split(".", 2);
+	return root === "principal" && !CARRIED.has(String(head));
+}
+function bindClaims(grant, subject) {
+	if (grant.where === void 0 && grant.check === void 0) return grant;
+	return freezeDeep(compact({
+		...grant,
+		where: grant.where === void 0 ? void 0 : bindConditionRefs(grant.where, subject, isClaimRef),
+		check: grant.check === void 0 ? void 0 : bindConditionRefs(grant.check, subject, isClaimRef)
+	}));
+}
+function notEntitledOf(items) {
+	const seen = /* @__PURE__ */ new Map();
+	for (const { grant } of items) {
+		const key = `${grant.permission.key}\u0000${grant.role ?? ""}`;
+		if (!seen.has(key)) seen.set(key, {
+			permission: grant.permission.key,
+			role: grant.role,
+			to: grant.to
+		});
+	}
+	return seen.size === 0 ? void 0 : [...seen.values()];
+}
+function buildSnapshot(input) {
+	const now = input.now ?? nowSeconds();
+	const principal = input.subject.principal;
+	const allTenants = tenantsOf(principal, scopeList(input.scopes));
+	const tenants = input.tenants === "all" ? allTenants : principal?.tenant === void 0 ? [] : [principal.tenant];
+	const include = input.include;
+	const included = (permission) => include === void 0 || include.length === 0 || include.some((prefix) => permission.key === prefix || permission.key.startsWith(`${prefix}.`) || permission.resource === prefix);
+	const grants = input.grants.filter((item) => included(item.grant.permission)).map((item) => bindClaims(snapshotGrant(item.grant, item.membership), input.subject));
+	const ids = {};
+	for (const item of input.grants) {
+		const name = item.grant.permission.resource;
+		const field = input.idOf?.(name);
+		if (field !== void 0 && field !== "id" && included(item.grant.permission)) ids[name] = field;
+	}
+	const assignableFor = input.assignable;
+	const assignable = assignableFor === void 0 ? [] : tenants.map((tenant) => {
+		const entry = assignableFor(tenant);
+		const permissions = entry.permissions.filter(included).map(plainPermission);
+		if (entry.levels === void 0) return {
+			...entry,
+			permissions
+		};
+		const keys = new Set(permissions.map((leaf) => leaf.key));
+		const levels = Object.fromEntries(Object.entries(entry.levels).filter(([key]) => keys.has(key)));
+		return compact({
+			...entry,
+			permissions,
+			levels: Object.keys(levels).length === 0 ? void 0 : levels
+		});
+	});
+	return freezeDeep(compact({
+		v: 1,
+		issuedAt: rfc3339(now),
+		subject: compact({
+			principal: principal === null ? null : compact({
+				id: principal.id,
+				roles: principal.roles ?? [],
+				plans: principal.plans,
+				tenant: principal.tenant,
+				memberships: principal.memberships
+			}),
+			delegation: toWireDelegation(snapshotDelegation(input.subject, input.delegated !== void 0)),
+			context: input.subject.context
+		}),
+		roles: input.roles,
+		audiences: input.audiences,
+		grants,
+		tenants,
+		include,
+		simulated: input.simulated === true ? true : void 0,
+		expiresAt: input.subject.expiresAt === void 0 ? void 0 : rfc3339(input.subject.expiresAt),
+		scopes: input.scopes,
+		ids: Object.keys(ids).length === 0 ? void 0 : ids,
+		assignable: assignable.length > 0 ? assignable : void 0,
+		delegated: input.delegated === void 0 ? void 0 : [...input.delegated].toSorted(),
+		notEntitled: notEntitledOf((input.notEntitled ?? []).filter((item) => included(item.grant.permission))),
+		vocabulary: input.vocabulary === void 0 ? void 0 : compact({
+			roles: listRoles(input.vocabulary.roles).length === 0 ? void 0 : Object.fromEntries(listRoles(input.vocabulary.roles).map((leaf) => [leaf.key, plainRole(leaf)])),
+			plans: listPlans(input.vocabulary.plans).length === 0 ? void 0 : Object.fromEntries(listPlans(input.vocabulary.plans).map((leaf) => [leaf.key, plainPlan(leaf)]))
+		})
+	}));
+}
+/**
+* The token delegation as the client sees it. An actor with no token
+* delegation gets an empty `scopes` list so the client ceiling agrees with
+* `no-delegation`, unless a policy delegation applies (`delegated`), which
+* then is the ceiling.
+*/
+function snapshotDelegation(subject, delegated) {
+	const delegation = subject.delegation;
+	if (subject.actor === void 0 || delegated) return delegation;
+	if (delegation?.scopes === void 0 && delegation?.authorizationDetails === void 0 && delegation?.access === void 0) return {
+		...delegation,
+		scopes: []
+	};
+	return delegation;
+}
+function rejectUnsafe(value, path) {
+	if (value === null || typeof value !== "object") return;
+	if (Array.isArray(value)) {
+		for (const [index, item] of value.entries()) rejectUnsafe(item, `${path}[${index}]`);
+		return;
+	}
+	for (const key of Object.keys(value)) {
+		if (isForbiddenKey(key)) throw new Error(`PermDock: unsafe snapshot key '${key}' at ${path}`);
+		rejectUnsafe(value[key], `${path}.${key}`);
+	}
+}
+function parseSnapshot(json) {
+	const input = typeof json === "string" ? JSON.parse(json) : json;
+	if (input === null || typeof input !== "object" || Array.isArray(input)) throw new Error("PermDock: snapshot must be an object");
+	const value = typeof json === "string" || Object.isFrozen(input) ? input : JSON.parse(JSON.stringify(input));
+	rejectUnsafe(value, "$");
+	const record = value;
+	const version = record["v"];
+	if (version !== 1) throw new Error(`PermDock: unsupported snapshot version '${String(version)}'`);
+	if (!isRfc3339(record["issuedAt"]) || record["expiresAt"] !== void 0 && !isRfc3339(record["expiresAt"])) throw new Error("PermDock: snapshot times must be RFC 3339");
+	return freezeDeep(value);
+}
+//#endregion
+export { bindConditionRefs as i, parseSnapshot as n, snapshotGrant as r, buildSnapshot as t };

package/dist/{snapshot-cache-Cod40D-X.js → snapshot-cache-DZHQ0KF6.js}

@@ -1,5 +1,10 @@
-import { n as payloadDigest } from "./token-Bx9qy30p.js";
+import { g as secondsOf, p as nowSeconds } from "./time-DkWjdL98.js";
+import { n as payloadDigest } from "./token-BLZcjQgt.js";
 //#region src/core/snapshot-cache.ts
+/** Seconds since the epoch of a NumericDate or an RFC 3339 instant. */
+function epochSeconds(value) {
+	return typeof value === "number" ? value : secondsOf(value);
+}
 /**
 * `{ stale }` in seconds: `max` when the value never expires, otherwise the seconds left, clamped
 * to `[min, max]`. A value with less than `min` seconds left gets its real remainder, so Next.js
@@ -8,10 +13,11 @@ import { n as payloadDigest } from "./token-Bx9qy30p.js";
 function cacheLifeFor(value, options = {}) {
 	const min = options.min ?? 30;
 	const max = Math.max(options.max ?? 300, min);
-	const expiresAt = value?.expiresAt;
-	if (expiresAt === void 0 || expiresAt === null) return { stale: max };
-	const issuedAt = value?.issuedAt !== void 0 && value.issuedAt > 0 ? value.issuedAt : void 0;
-	const now = options.now ?? issuedAt ?? Math.floor(Date.now() / 1e3);
+	const expiresAt = epochSeconds(value?.expiresAt);
+	if (expiresAt === void 0) return { stale: max };
+	const issued = epochSeconds(value?.issuedAt);
+	const issuedAt = issued !== void 0 && issued > 0 ? issued : void 0;
+	const now = options.now === void 0 ? issuedAt ?? nowSeconds() : nowSeconds(options.now);
 	const remaining = Math.floor(expiresAt - now);
 	if (remaining < min) return { stale: Math.max(0, remaining) };
 	return { stale: Math.min(max, remaining) };

package/dist/{snapshot-cache-J5T7t_vD.d.ts → snapshot-cache-DqK9eDmM.d.ts}

@@ -1,12 +1,12 @@
-import { an as Snapshot } from "./policy-types-sp9P1iIV.js";
+import { Rt as Instant, Vt as Snapshot } from "./policy-types-DzwivBgR.js";
 //#region src/core/snapshot-cache.d.ts
 type CacheLifeForOptions = {
   /** Lower bound in seconds. Next.js includes a private entry in per-link prefetches from 30. */
   readonly min?: number;
   /** Upper bound in seconds. Next.js keeps a per-session App Shell entry from 300. */
   readonly max?: number;
-  /** Seconds since the epoch; defaults to the snapshot's `issuedAt`, then the clock. */
-  readonly now?: number;
+  /** Defaults to the snapshot's `issuedAt`, then the clock. */
+  readonly now?: Instant;
 };
 /**
  * `{ stale }` in seconds: `max` when the value never expires, otherwise the seconds left, clamped
@@ -14,8 +14,10 @@ type CacheLifeForOptions = {
  * leaves it out of prefetches and an HTTP cache does not serve it past `expiresAt`.
  */
 declare function cacheLifeFor(value: {
-  readonly expiresAt?: number | null;
-  readonly issuedAt?: number;
+  /** RFC 3339, or a NumericDate. */
+  readonly expiresAt?: number | string | null;
+  /** RFC 3339, or a NumericDate. */
+  readonly issuedAt?: number | string;
 } | null, options?: CacheLifeForOptions): {
   readonly stale: number;
 };