permdock 0.4.0 → 0.5.0

package/dist/standard-webhooks-DgFFD-Ga.js

@@ -0,0 +1,228 @@
+import { m as rfc3339, p as nowSeconds } from "./time-DkWjdL98.js";
+import { n as readBodyText } from "./body-text-QcXok_SI.js";
+//#region src/server/standard-webhooks.ts
+const DEFAULT_TOLERANCE = 300;
+const JWKS_TTL_SECONDS = 300;
+const encoder = /* @__PURE__ */ new TextEncoder();
+function decodeBase64(value) {
+	if (!/^[A-Za-z0-9+/]*={0,2}$/u.test(value) || value.length % 4 !== 0) return;
+	try {
+		const binary = atob(value);
+		const bytes = new Uint8Array(binary.length);
+		for (let index = 0; index < binary.length; index += 1) bytes[index] = binary.codePointAt(index) ?? 0;
+		return bytes;
+	} catch {
+		return;
+	}
+}
+function encodeBase64(bytes) {
+	let binary = "";
+	for (const byte of new Uint8Array(bytes)) binary += String.fromCodePoint(byte);
+	return btoa(binary);
+}
+function secretBytes(secret) {
+	const bytes = decodeBase64(secret.startsWith("whsec_") ? secret.slice(6) : secret);
+	if (bytes === void 0 || bytes.length < 24 || bytes.length > 64) throw new TypeError("PermDock: a v1 webhook secret is whsec_ followed by 24 to 64 bytes in base64");
+	return bytes;
+}
+function hmacKey(secret, usage) {
+	return crypto.subtle.importKey("raw", secretBytes(secret), {
+		name: "HMAC",
+		hash: "SHA-256"
+	}, false, [usage]);
+}
+function isEd25519(jwk) {
+	return jwk.kty === "OKP" && jwk.crv === "Ed25519" && typeof jwk.x === "string";
+}
+function signedContent(id, timestamp, body) {
+	return encoder.encode(`${id}.${timestamp}.${body}`);
+}
+function validId(id) {
+	return id.length > 0 && id.length <= 256 && !/\s/u.test(id);
+}
+/**
+* Signs Standard Webhooks deliveries: `v1` HMAC-SHA256 with a `whsec_`
+* secret, `v1a` Ed25519 with a private JWK. Throws on an invalid key or id,
+* because both come from the sender's own configuration.
+*/
+function webhookSigner(options) {
+	if (options.keys.length === 0) throw new TypeError("PermDock: webhookSigner() needs at least one key");
+	const keys = options.keys.map(async (key) => {
+		switch (key.alg) {
+			case "v1": return {
+				alg: key.alg,
+				key: await hmacKey(key.secret, "sign")
+			};
+			case "v1a":
+				if (!isEd25519(key.privateKey) || typeof key.privateKey.d !== "string") throw new TypeError("PermDock: a v1a webhook key is an Ed25519 private JWK");
+				return {
+					alg: key.alg,
+					key: await importEd25519(key.privateKey, "sign")
+				};
+			default: return key;
+		}
+	});
+	for (const pending of keys) pending.catch(() => void 0);
+	return { async sign(message) {
+		if (!validId(message.id)) throw new TypeError("PermDock: a webhook id is 1 to 256 characters without whitespace");
+		const timestamp = String(nowSeconds(message.now));
+		const content = signedContent(message.id, timestamp, message.body);
+		const signatures = await Promise.all(keys.map(async (pending) => {
+			const { alg, key } = await pending;
+			return `${alg},${encodeBase64(await crypto.subtle.sign(alg === "v1" ? "HMAC" : "Ed25519", key, content))}`;
+		}));
+		return {
+			"webhook-id": message.id,
+			"webhook-timestamp": timestamp,
+			"webhook-signature": signatures.join(" ")
+		};
+	} };
+}
+function header(input, name) {
+	const headers = input.headers;
+	if (headers instanceof Headers) return headers.get(name) ?? void 0;
+	return Object.hasOwn(headers, name) ? headers[name] : void 0;
+}
+async function bodyOf(input) {
+	if (input instanceof Request) {
+		const read = await readBodyText(input);
+		return read.ok ? read.text : void 0;
+	}
+	return input.body;
+}
+function parseSignatures(value) {
+	const parsed = [];
+	for (const entry of value.split(" ")) {
+		const comma = entry.indexOf(",");
+		const alg = entry.slice(0, comma);
+		if (comma <= 0 || alg !== "v1" && alg !== "v1a") continue;
+		const bytes = decodeBase64(entry.slice(comma + 1));
+		if (bytes?.length === (alg === "v1" ? 32 : 64)) parsed.push({
+			alg,
+			bytes
+		});
+	}
+	return parsed;
+}
+function importEd25519(jwk, usage) {
+	const material = usage === "sign" ? {
+		kty: "OKP",
+		crv: "Ed25519",
+		x: jwk.x,
+		d: jwk.d
+	} : {
+		kty: "OKP",
+		crv: "Ed25519",
+		x: jwk.x
+	};
+	return crypto.subtle.importKey("jwk", material, "Ed25519", false, [usage]);
+}
+async function publicKeys(jwks) {
+	return (await Promise.all(jwks.keys.filter(isEd25519).map((jwk) => importEd25519(jwk, "verify").catch(() => void 0)))).filter((key) => key !== void 0);
+}
+async function anyVerifies(algorithm, keys, signatures, content) {
+	return (await Promise.all(keys.flatMap((key) => signatures.map((signature) => crypto.subtle.verify(algorithm, key, signature.bytes, content))))).includes(true);
+}
+function isJwks(value) {
+	return typeof value === "object" && value !== null && "keys" in value && Array.isArray(value.keys);
+}
+/**
+* Verifies Standard Webhooks deliveries signed `v1` with one of `secret` or
+* `v1a` with a key from `jwks`, within `tolerance` seconds, and records each
+* `webhook-id` in `replay`. Throws only on an invalid `secret`.
+*/
+function webhookVerifier(options) {
+	const secrets = options.secret === void 0 ? [] : typeof options.secret === "string" ? [options.secret] : options.secret;
+	for (const secret of secrets) secretBytes(secret);
+	const hmacKeys = Promise.all(secrets.map((secret) => hmacKey(secret, "verify")));
+	const tolerance = options.tolerance ?? DEFAULT_TOLERANCE;
+	const jwks = options.jwks;
+	let cached;
+	async function ed25519Keys(now) {
+		if (jwks === void 0) return [];
+		if (isJwks(jwks)) {
+			cached ??= {
+				keys: await publicKeys(jwks),
+				until: Number.POSITIVE_INFINITY
+			};
+			return cached.keys;
+		}
+		if (cached !== void 0 && cached.until > now) return cached.keys;
+		try {
+			const response = await (options.fetch ?? fetch)(String(jwks), { headers: { accept: "application/jwk-set+json, application/json" } });
+			const parsed = response.ok ? await response.json() : void 0;
+			if (!isJwks(parsed)) return;
+			cached = {
+				keys: await publicKeys(parsed),
+				until: now + JWKS_TTL_SECONDS
+			};
+			return cached.keys;
+		} catch {
+			return;
+		}
+	}
+	async function signatureValid(signatures, content, now) {
+		const v1 = signatures.filter((signature) => signature.alg === "v1");
+		const v1a = signatures.filter((signature) => signature.alg === "v1a");
+		if (v1.length > 0 && await anyVerifies("HMAC", await hmacKeys, v1, content)) return;
+		if (v1a.length === 0) return "invalid-signature";
+		const keys = await ed25519Keys(now);
+		if (keys === void 0) return "keys-unavailable";
+		if (await anyVerifies("Ed25519", keys, v1a, content)) return;
+		return "invalid-signature";
+	}
+	async function claim(id, expiresAt) {
+		const key = `webhook:${id}`;
+		try {
+			if (options.replay.claim !== void 0) return await options.replay.claim(key, expiresAt);
+			if (await options.replay.seen(key)) return false;
+			await options.replay.remember(key, expiresAt);
+			return true;
+		} catch {
+			return false;
+		}
+	}
+	return { async verify(input) {
+		const id = header(input, "webhook-id");
+		const timestamp = header(input, "webhook-timestamp");
+		const signature = header(input, "webhook-signature");
+		if (id === void 0 || timestamp === void 0 || signature === void 0) return {
+			ok: false,
+			cause: "missing-headers"
+		};
+		const body = await bodyOf(input);
+		const signatures = parseSignatures(signature);
+		if (body === void 0 || !validId(id) || !/^\d{1,12}$/u.test(timestamp) || signatures.length === 0) return {
+			ok: false,
+			cause: "malformed"
+		};
+		const now = nowSeconds(options.now?.());
+		const sent = Number(timestamp);
+		if (Math.abs(now - sent) > tolerance) return {
+			ok: false,
+			cause: "timestamp-out-of-range"
+		};
+		let failure;
+		try {
+			failure = await signatureValid(signatures, signedContent(id, timestamp, body), now);
+		} catch {
+			failure = "invalid-signature";
+		}
+		if (failure !== void 0) return {
+			ok: false,
+			cause: failure
+		};
+		if (!await claim(id, sent + tolerance)) return {
+			ok: false,
+			cause: "replayed"
+		};
+		return {
+			ok: true,
+			id,
+			timestamp: rfc3339(sent),
+			body
+		};
+	} };
+}
+//#endregion
+export { webhookVerifier as n, webhookSigner as t };

package/dist/storage-C2bWdvJH.js

@@ -0,0 +1,132 @@
+import { r as isRecord, t as compact } from "./compact-CAf557ZB.js";
+import { mkdirSync, readFileSync, statSync, unlinkSync, writeFileSync } from "node:fs";
+import path from "node:path";
+import { homedir } from "node:os";
+//#region src/terminal/storage.ts
+const FILE_MODE = 384;
+const DIR_MODE = 448;
+const GROUP_OR_WORLD = 63;
+function credentialsPath(service, runtime) {
+	if (runtime.configDir !== void 0) return path.join(runtime.configDir, "credentials.json");
+	const home = runtime.homedir ?? homedir;
+	const env = runtime.env ?? process.env;
+	if ((runtime.platform ?? process.platform) === "win32") {
+		const appData = env["APPDATA"] ?? path.join(home(), "AppData", "Roaming");
+		return path.join(appData, service, "credentials.json");
+	}
+	const xdg = env["XDG_CONFIG_HOME"] ?? path.join(home(), ".config");
+	return path.join(xdg, service, "credentials.json");
+}
+function parseCredential(value) {
+	if (!isRecord(value) || typeof value["access_token"] !== "string") return null;
+	return compact({
+		access_token: value["access_token"],
+		refresh_token: typeof value["refresh_token"] === "string" ? value["refresh_token"] : void 0,
+		expires_at: typeof value["expires_at"] === "number" ? value["expires_at"] : void 0,
+		token_type: typeof value["token_type"] === "string" ? value["token_type"] : void 0,
+		scope: typeof value["scope"] === "string" ? value["scope"] : void 0
+	});
+}
+function keyringEntry(storage, profile) {
+	if (storage.keyring === void 0) return null;
+	try {
+		return new storage.keyring(storage.service, profile);
+	} catch {
+		return null;
+	}
+}
+function readKeyring(storage, profile) {
+	const entry = keyringEntry(storage, profile);
+	if (entry === null) return null;
+	try {
+		const raw = entry.getPassword();
+		return typeof raw === "string" ? parseCredential(JSON.parse(raw)) : null;
+	} catch {
+		return null;
+	}
+}
+function readCredentials(storage, profile, runtime) {
+	return readKeyring(storage, profile) ?? readFile(storage.service, profile, runtime);
+}
+function readFile(service, profile, runtime) {
+	const file = credentialsPath(service, runtime);
+	let raw;
+	try {
+		const stat = statSync(file);
+		if ((runtime.platform ?? process.platform) !== "win32" && (stat.mode & GROUP_OR_WORLD) !== 0) return null;
+		raw = readFileSync(file, "utf8");
+	} catch {
+		return null;
+	}
+	try {
+		const parsed = JSON.parse(raw);
+		if (!isRecord(parsed) || !isRecord(parsed["profiles"])) return null;
+		return parseCredential(parsed["profiles"][profile]);
+	} catch {
+		return null;
+	}
+}
+/**
+* The OS keychain when `storage.keyring` is set and works; otherwise the
+* mode-0600 file. Answers the store it wrote.
+*/
+function writeCredentials(storage, profile, credential, runtime) {
+	const entry = keyringEntry(storage, profile);
+	if (entry !== null) try {
+		entry.setPassword(JSON.stringify(credential));
+		deleteFile(storage.service, profile, runtime);
+		return "keychain";
+	} catch {}
+	writeFile(storage.service, profile, credential, runtime);
+	return "file";
+}
+function writeFile(service, profile, credential, runtime) {
+	const file = credentialsPath(service, runtime);
+	mkdirSync(path.dirname(file), {
+		recursive: true,
+		mode: DIR_MODE
+	});
+	let profiles = {};
+	try {
+		const existing = JSON.parse(readFileSync(file, "utf8"));
+		if (isRecord(existing) && isRecord(existing["profiles"])) profiles = existing["profiles"];
+	} catch {
+		profiles = {};
+	}
+	profiles[profile] = credential;
+	writeFileSync(file, `${JSON.stringify({ profiles }, null, 2)}\n`, {
+		encoding: "utf8",
+		mode: FILE_MODE
+	});
+}
+function deleteCredentials(storage, profile, runtime) {
+	const entry = keyringEntry(storage, profile);
+	if (entry !== null) try {
+		entry.deletePassword();
+	} catch {}
+	deleteFile(storage.service, profile, runtime);
+}
+function deleteFile(service, profile, runtime) {
+	const file = credentialsPath(service, runtime);
+	let parsed;
+	try {
+		parsed = JSON.parse(readFileSync(file, "utf8"));
+	} catch {
+		return;
+	}
+	if (!isRecord(parsed) || !isRecord(parsed["profiles"])) return;
+	const profiles = {};
+	for (const key of Object.keys(parsed["profiles"])) if (key !== profile) profiles[key] = parsed["profiles"][key];
+	if (Object.keys(profiles).length === 0) {
+		try {
+			unlinkSync(file);
+		} catch {}
+		return;
+	}
+	writeFileSync(file, `${JSON.stringify({ profiles }, null, 2)}\n`, {
+		encoding: "utf8",
+		mode: FILE_MODE
+	});
+}
+//#endregion
+export { writeCredentials as i, deleteCredentials as n, readCredentials as r, credentialsPath as t };

package/dist/{store-ILkLUj_o.js → store-4u_hxjWa.js}

@@ -1,46 +1,10 @@
 import { t as compact } from "./compact-CAf557ZB.js";
 import { n as freezeDeep } from "./freeze-CrU8nQeX.js";
 import { i as flattenApprovers } from "./approvers-CqPOLD-o.js";
-import { s as rootMembershipId } from "./scopes-tvpa34ep.js";
-import { t as parseDuration } from "./duration-xK2jGFVc.js";
-import { n as matchGrantee } from "./grantee-match-fxYp9Nmt.js";
-import { t as ApprovalError } from "./errors-DRnGZHzF.js";
-//#region src/approvals/types.ts
-const APPROVAL_HEADER = "PermDock-Approval";
-const DEFAULT_APPROVAL_TTL_MS = 36e5;
-/** The approvals a request needs in total: `approvers.quorum` (or 1), or the sum of its stages' quorums. */
-function approvalQuorum(request) {
-	const stages = request.approvers?.stages;
-	if (stages !== void 0) return stages.reduce((sum, stage) => sum + (stage.quorum ?? 1), 0);
-	return request.approvers?.quorum ?? 1;
-}
-/**
-* The instant from which `approvers.escalation.to` may approve, in epoch
-* milliseconds, or `undefined` when the request has no escalation or its
-* `after` does not parse (then nobody escalates: fail-closed).
-*/
-function escalationOpenAt(request) {
-	const after = request.approvers?.escalation?.after;
-	const seconds = parseDuration(after);
-	if (seconds === void 0) return;
-	return Date.parse(request.createdAt) + seconds * 1e3;
-}
-/** The instant from which a stage's own `escalation.to` may approve it, in epoch milliseconds; `undefined` when it has none or `after` does not parse. */
-function stageEscalationOpenAt(request, stage) {
-	const seconds = parseDuration(stage.escalation?.after);
-	if (seconds === void 0) return;
-	return Date.parse(request.createdAt) + seconds * 1e3;
-}
-/** The key a verdict's `relations` lists a relation approver under. */
-function approverRelationKey(item) {
-	return JSON.stringify([
-		item.resource,
-		item.relation,
-		item.through ?? null,
-		item.depth ?? null
-	]);
-}
-//#endregion
+import { a as durationOf, i as dateAt } from "./time-DkWjdL98.js";
+import { s as rootMembershipId } from "./scopes-CUPSjo9q.js";
+import { n as matchGrantee } from "./grantee-match-DHArqY82.js";
+import { a as escalationOpenAt, i as approverRelationKey, o as stageEscalationOpenAt, r as approvalQuorum, s as ApprovalError } from "./types-DqzsnlSA.js";
 //#region src/approvals/page.ts
 const DEFAULT_PAGE_SIZE = 50;
 const MAX_PAGE_SIZE = 200;
@@ -187,12 +151,14 @@ function matchesFilter(request, filter) {
 function assertSeparateApprover(request, by, requireDistinctApprover) {
 	const principal = by.principal;
 	if (principal === null) throw new ApprovalError("approver-unauthenticated", "approver must be authenticated");
+	if (principal.kind === "link" || principal.kind === "feed" || principal.kind === "contact") throw new ApprovalError("approver-not-eligible", "a link, a feed or a contact cannot approve");
+	if (by.actor?.kind === "support") throw new ApprovalError("approver-not-eligible", "a support session cannot approve");
 	if (request.subject.actor !== void 0 && principal.id === request.subject.actor.id) throw new ApprovalError("approver-is-actor", "approver is the actor of this request");
 	if ((requireDistinctApprover || request.approvers?.distinct !== false) && request.subject.principal !== null && principal.id === request.subject.principal.id) throw new ApprovalError("approver-is-principal", "approver is the principal of this request");
 	return principal;
 }
 function assertNotRepeated(request, id) {
-	if ((request.approvals ?? []).some((item) => item.by === id)) throw new ApprovalError("approver-repeated", "approver has already approved this request");
+	if ((request.approvals ?? []).some((item) => item.by === id || item.onBehalfOf === id)) throw new ApprovalError("approver-repeated", "approver has already approved this request");
 }
 function vouchedRule(verdict) {
 	return typeof verdict.vouched === "string" && verdict.vouched !== "" ? verdict.vouched : void 0;
@@ -207,7 +173,8 @@ function vouchedRule(verdict) {
 * two stages. `relations` are the relation approvers `by` holds on the
 * request's resource (see `ApprovalVerdict.relations`).
 */
-function assertApprover(request, by, requireDistinctApprover, now = /* @__PURE__ */ new Date(), relations = [], permissions = []) {
+function assertApprover(request, by, requireDistinctApprover, at, relations = [], permissions = []) {
+	const now = dateAt(at);
 	const principal = assertSeparateApprover(request, by, requireDistinctApprover);
 	const tenant = request.subject.principal?.tenant;
 	if (tenant !== void 0 && !belongsToTenant(by, tenant)) throw new ApprovalError("approver-not-eligible", "approver does not belong to the request tenant");
@@ -251,13 +218,24 @@ function isSystemSubject(by) {
 * should write the result only when the stored row is still pending with the
 * same number of approvals, so two approvers racing both count.
 */
-function applyApprovalVerdict(request, verdict, now = /* @__PURE__ */ new Date()) {
+function applyApprovalVerdict(request, verdict, at) {
+	const now = dateAt(at);
 	const principal = verdict.by.principal;
 	if (principal === null) throw new ApprovalError("approver-unauthenticated", "approver must be authenticated");
 	if (request.status !== "pending") throw new ApprovalError("approval-not-pending", "approval is not pending");
 	if (Date.parse(request.expiresAt) <= now.getTime()) throw new ApprovalError("approval-expired", "approval has expired");
 	const vouched = vouchedRule(verdict);
-	const stage = verdict.status === "rejected" && isSystemSubject(verdict.by) || vouched !== void 0 ? void 0 : assertApprover(request, verdict.by, false, now, verdict.relations, verdict.permissions);
+	const behalf = vouched === void 0 ? verdict.onBehalfOf : void 0;
+	let stage;
+	if (verdict.status === "rejected" && isSystemSubject(verdict.by) || vouched !== void 0) stage = void 0;
+	else if (behalf === void 0) stage = assertApprover(request, verdict.by, false, { epochMilliseconds: now.getTime() }, verdict.relations, verdict.permissions);
+	else {
+		const delegate = assertSeparateApprover(request, verdict.by, false);
+		const tenant = request.subject.principal?.tenant;
+		if (tenant !== void 0 && !belongsToTenant(verdict.by, tenant)) throw new ApprovalError("approver-not-eligible", "approver does not belong to the request tenant");
+		assertNotRepeated(request, delegate.id);
+		stage = assertApprover(request, behalf.subject, false, { epochMilliseconds: now.getTime() }, behalf.relations ?? [], behalf.permissions ?? []);
+	}
 	if (vouched !== void 0) assertNotRepeated(request, assertSeparateApprover(request, verdict.by, false).id);
 	if (verdict.status === "rejected") return freezeDeep(compact({
 		...request,
@@ -271,7 +249,9 @@ function applyApprovalVerdict(request, verdict, now = /* @__PURE__ */ new Date()
 		by: principal.id,
 		at: now.toISOString(),
 		stage,
-		vouched
+		vouched,
+		onBehalfOf: behalf === void 0 ? void 0 : behalf.subject.principal?.id,
+		delegation: behalf?.delegation
 	})];
 	if (vouched === void 0 && !isComplete(request, approvals)) return freezeDeep(compact({
 		...request,
@@ -302,26 +282,32 @@ function isStale(request, now) {
 	return request.status === "expired" || Date.parse(request.expiresAt) <= now.getTime();
 }
 function memoryApprovalStore(options = {}) {
-	const ttl = options.ttl ?? 36e5;
+	if (options.ttl !== void 0 && durationOf(options.ttl) === void 0) throw new RangeError(`PermDock: memoryApprovalStore ttl must be a whole number of seconds above 0, got ${String(options.ttl)}`);
+	const ttl = options.ttl ?? 3600;
 	const records = /* @__PURE__ */ new Map();
+	const clock = (at) => dateAt(at ?? options.now?.());
 	return {
 		ttl,
 		create(request) {
 			const current = records.get(request.token);
-			if (current !== void 0 && !isStale(current, /* @__PURE__ */ new Date())) return;
+			if (current !== void 0 && !isStale(current, clock())) return;
 			records.set(request.token, freezeDeep(request));
 		},
 		get(token) {
 			return records.get(token) ?? null;
 		},
+		getById(id) {
+			return records.values().find((request) => request.id === id) ?? null;
+		},
 		resolve(token, verdict) {
 			const current = records.get(token);
 			if (current === void 0) throw new ApprovalError("approval-not-found", "approval was not found");
-			const next = applyApprovalVerdict(current, verdict, /* @__PURE__ */ new Date());
+			const next = applyApprovalVerdict(current, verdict);
 			records.set(token, next);
 			return next;
 		},
-		consume(token, now = /* @__PURE__ */ new Date()) {
+		consume(token, at) {
+			const now = clock(at);
 			const current = records.get(token);
 			if (current?.status !== "approved" || current.consumedAt !== void 0 || Date.parse(current.expiresAt) <= now.getTime()) return null;
 			const next = freezeDeep({
@@ -336,12 +322,13 @@ function memoryApprovalStore(options = {}) {
 			for (const request of records.values()) if (matchesFilter(request, query)) matching.push(request);
 			return pageApprovals(matching, query);
 		},
-		expire(now = /* @__PURE__ */ new Date()) {
+		expire(at) {
+			const now = clock(at);
 			let count = 0;
 			const instant = now.getTime();
 			for (const [token, request] of records) {
 				const deadline = Date.parse(request.expiresAt);
-				if (request.status !== "pending" && deadline + ttl <= instant) {
+				if (request.status !== "pending" && deadline + ttl * 1e3 <= instant) {
 					records.delete(token);
 					continue;
 				}
@@ -356,7 +343,7 @@ function memoryApprovalStore(options = {}) {
 			return count;
 		},
 		cancel(filter, meta) {
-			const now = /* @__PURE__ */ new Date();
+			const now = clock();
 			let count = 0;
 			for (const [token, request] of records) {
 				if (request.status !== "pending" || !matchesFilter(request, filter)) continue;
@@ -368,4 +355,4 @@ function memoryApprovalStore(options = {}) {
 	};
 }
 //#endregion
-export { decodeApprovalCursor as a, pageApprovals as c, approvalQuorum as d, approverRelationKey as f, approvalPageSize as i, APPROVAL_HEADER as l, assertApprover as n, encodeApprovalCursor as o, escalationOpenAt as p, memoryApprovalStore as r, listAllApprovals as s, applyApprovalVerdict as t, DEFAULT_APPROVAL_TTL_MS as u };
+export { approvalPageSize as a, listAllApprovals as c, memoryApprovalStore as i, pageApprovals as l, assertApprover as n, decodeApprovalCursor as o, matchesApprovers as r, encodeApprovalCursor as s, applyApprovalVerdict as t };

package/dist/{store-options-CbUHDoSe.js → store-options-BqEakYRa.js}

@@ -1,9 +1,22 @@
 import { t as compact } from "./compact-CAf557ZB.js";
-import { f as rowIdOf, n as parseSnapshot } from "./snapshot-Dc9CHPME.js";
-import { c as nowSeconds } from "./tenancy-DshjqY0n.js";
-import { n as payloadDigest } from "./token-Bx9qy30p.js";
-import { n as fromSnapshot, t as emptySnapshot } from "./from-snapshot-7REQZe0H.js";
+import { g as secondsOf } from "./time-DkWjdL98.js";
+import { c as rowIdOf } from "./delegation-DaXVdDhM.js";
+import { c as nowSeconds } from "./tenancy-DN2QAx9z.js";
+import { n as payloadDigest } from "./token-BLZcjQgt.js";
+import { n as parseSnapshot } from "./snapshot-CXUWfsNy.js";
+import { s as snapshotClaim } from "./where-scope-Dv-WTP-w.js";
+import { n as fromSnapshot, t as emptySnapshot } from "./from-snapshot-D2lZt4Dd.js";
 import { t as timeoutSignal } from "./timeout-D51niuQP.js";
+//#region src/client/source.ts
+/** A compact JWS: three non-empty dot-separated parts. */
+function isJws(value) {
+	const parts = value.split(".");
+	return parts.length === 3 && parts.every((part) => part.length > 0);
+}
+function isPromiseLike(value) {
+	return typeof value === "object" && value !== null && "then" in value && typeof value.then === "function";
+}
+//#endregion
 //#region src/client/approvals.ts
 /** Ceiling for the approval poll backoff after a failed status request. */
 const APPROVAL_BACKOFF_CAP_MS = 6e4;
@@ -237,16 +250,6 @@ function storeRequest(fetchImpl, headers) {
 	});
 }
 //#endregion
-//#region src/client/source.ts
-/** A compact JWS: three non-empty dot-separated parts. */
-function isJws(value) {
-	const parts = value.split(".");
-	return parts.length === 3 && parts.every((part) => part.length > 0);
-}
-function isPromiseLike(value) {
-	return typeof value === "object" && value !== null && "then" in value && typeof value.then === "function";
-}
-//#endregion
 //#region src/client/store.ts
 function withTenant(source, tenant) {
 	if (tenant === void 0) return source;
@@ -380,11 +383,13 @@ function createClientStore(options) {
 		return "ready";
 	};
 	const isStale = () => {
-		const maxAge = snapshot.issuedAt > 0 ? options.maxAge : void 0;
-		if (snapshot.expiresAt === void 0 && maxAge === void 0) return false;
+		const issuedAt = secondsOf(snapshot.issuedAt) ?? 0;
+		const expiresAt = secondsOf(snapshot.expiresAt);
+		const maxAge = issuedAt > 0 ? options.maxAge : void 0;
+		if (expiresAt === void 0 && maxAge === void 0) return false;
 		const now = nowSeconds();
-		if (snapshot.expiresAt !== void 0 && snapshot.expiresAt <= now) return true;
-		return maxAge !== void 0 && now - snapshot.issuedAt > maxAge;
+		if (expiresAt !== void 0 && expiresAt <= now) return true;
+		return maxAge !== void 0 && now - issuedAt > maxAge;
 	};
 	const serverOnly = () => {
 		hydrate(emptySnapshot());
@@ -401,8 +406,8 @@ function createClientStore(options) {
 	const verifyJws = async (raw) => {
 		if (options.verifier === void 0) return;
 		try {
-			const verified = await options.verifier.verify(raw, { typ: "permdock-snapshot+jwt" });
-			return verified.ok ? verified.claims["snapshot"] : void 0;
+			const verified = await options.verifier.verify(raw, { typ: "vnd.permdock.snapshot+jwt" });
+			return verified.ok ? snapshotClaim(verified.claims) : void 0;
 		} catch {
 			return;
 		}
@@ -565,7 +570,7 @@ function createClientStore(options) {
 					signed = body;
 					body = await verifyJws(body);
 					ok = body !== void 0;
-				}
+				} else if (ok && options.verifier !== void 0) ok = false;
 				refreshing -= 1;
 				if (started !== generation || seq !== refreshSeq) {
 					emit();

package/dist/{stores-BHXdSbw9.js → stores-BbsD4fAR.js}

@@ -1,5 +1,5 @@
-import { a as permissionSet, d as tenantView, i as livePermDock, n as describeWith, r as filterResult, s as rolesView, t as approvalHandle, u as subjectView } from "./views-CJsrBS1f.js";
-import { n as getUi, r as providePermDock, t as getStore } from "./context-DieZVJXu.js";
+import { a as livePermDock, c as rolesView, d as subjectView, f as tenantView, n as describeWith, o as permissionSet, r as filterResult, t as approvalHandle } from "./views-DTIIO-oQ.js";
+import { n as getUi, r as providePermDock, t as getStore } from "./context-bbFHR-0D.js";
 import { readable, toStore } from "svelte/store";
 //#region src/svelte/stores.ts
 function fromStore(store, compute) {

package/dist/{stores-Cxz_80g-.d.ts → stores-ClZUgeoP.d.ts}

@@ -1,12 +1,11 @@
-import { Dr as Membership, ir as Decision } from "./policy-types-sp9P1iIV.js";
-import { d as Permission } from "./permission-types-Dg39z9Kv.js";
-import { r as Role } from "./vocabulary-hhEFLFoL.js";
-import { r as DescribeOptions, t as DecisionDescription } from "./describe-C3ldA9os.js";
-import { a as ClientPermDock, c as PermissionSet, d as SubjectView, f as TenantView, l as PermissionState, p as UseRolesOptions, r as ApprovalHandle, s as FilterResult } from "./store-9KO4BlkB.js";
-import { n as PermDockSvelteOptions } from "./types-ByUo56un.js";
+import { Nn as Decision, nr as Membership } from "./policy-types-DzwivBgR.js";
+import { r as Role, w as Permission } from "./vocabulary-D6lPdb4Z.js";
+import { r as DescribeOptions, t as DecisionDescription } from "./describe-BZUsixiL.js";
+import { a as FilterResult, c as PermissionSet, d as RolesOptions, f as SubjectView, l as PermissionState, p as TenantView, r as ClientPermDock, t as ApprovalHandle } from "./types-BNORmDM8.js";
+import { n as SveltePermDockOptions } from "./types-fbZ7JEXr.js";
 import { Readable } from "svelte/store";
 //#region src/svelte/stores.d.ts
-declare function setPermDock(options: PermDockSvelteOptions): ClientPermDock;
+declare function setPermDock(options: SveltePermDockOptions): ClientPermDock;
 declare function getPermDock(): ClientPermDock;
 /** `describe` with the provider's `messages`; a call's own `messages` win. Call it during component init. */
 declare function getDescribe(): (decision: Decision, options?: DescribeOptions) => DecisionDescription;
@@ -15,7 +14,7 @@ declare function permissions(references: () => readonly Permission[], data?: ()
 declare function filtered<T>(reference: Permission<string, T, "instance">, rows: () => readonly T[]): Readable<FilterResult<T>>;
 declare function tenant(): Readable<TenantView>;
 declare function memberships(): Readable<readonly Membership[]>;
-declare function roles(options?: () => UseRolesOptions): Readable<{
+declare function roles(options?: () => RolesOptions): Readable<{
   readonly roles: readonly Role[];
 }>;
 declare function assignable(): Readable<readonly Role[]>;

package/dist/{stream-Dwsg6WwE.d.ts → stream-7-xmnf3U.d.ts}

@@ -1,5 +1,5 @@
-import { d as Permission } from "./permission-types-Dg39z9Kv.js";
-import { o as ProtectOptions } from "./server-types-DdqBwZN_.js";
+import { w as Permission } from "./vocabulary-D6lPdb4Z.js";
+import { o as ProtectOptions } from "./server-types-BLd4MnBX.js";
 //#region src/server/stream.d.ts
 type StreamProtectOptions = ProtectOptions & {
   /**