permdock 0.4.0 → 0.5.0

package/dist/support-session-C6xJQYut.js

@@ -0,0 +1,158 @@
+import { t as compact } from "./compact-CAf557ZB.js";
+import { n as freezeDeep } from "./freeze-CrU8nQeX.js";
+import { a as ownRecord } from "./paths-DXSHAMIa.js";
+import { a as isId, r as idList } from "./expiry-D4_YKRKD.js";
+import { n as internalsOf } from "./internals-Dk8A8fX3.js";
+import { c as listPermissions, m as annotationsFor, n as findPermission } from "./permission-registry-Br4jSNVi.js";
+import { g as secondsOf, l as isRfc3339, m as rfc3339, p as nowSeconds } from "./time-DkWjdL98.js";
+import { t as canonicalJson } from "./canonical-json-BC8_nMTw.js";
+import { r as sha256Digest } from "./sha256-D9ihqmvd.js";
+//#region src/core/support-session.ts
+const DEFAULT_TTL = 3600;
+const MAX_TTL = 86400;
+const MAX_REASON = 1e3;
+function isReason(value) {
+	return typeof value === "string" && value.trim().length > 0 && value.length <= MAX_REASON;
+}
+/**
+* Validates an untrusted support-session record and returns a frozen copy
+* with only the v1 fields, or `undefined`.
+*/
+function parseSupportSession(input) {
+	const value = ownRecord(input);
+	if (value === void 0 || value["v"] !== 1 || !isId(value["id"]) || !isId(value["principal"]) || !isId(value["actor"]) || value["principal"] === value["actor"] || !isId(value["tenant"]) || !isReason(value["reason"]) || !isRfc3339(value["startedAt"]) || !isRfc3339(value["expiresAt"])) return;
+	const permissions = idList(value["permissions"]);
+	const { approvedBy, reference } = value;
+	if (permissions === void 0 || (secondsOf(value["expiresAt"]) ?? 0) <= (secondsOf(value["startedAt"]) ?? 0) || approvedBy !== void 0 && (!isId(approvedBy) || approvedBy === value["actor"]) || reference !== void 0 && !isId(reference)) return;
+	return freezeDeep(compact({
+		v: 1,
+		id: value["id"],
+		principal: value["principal"],
+		actor: value["actor"],
+		tenant: value["tenant"],
+		reason: value["reason"],
+		permissions,
+		startedAt: value["startedAt"],
+		expiresAt: value["expiresAt"],
+		approvedBy,
+		reference
+	}));
+}
+function denied(reason, detail) {
+	return freezeDeep({
+		outcome: "denied",
+		denials: [compact({
+			role: null,
+			reason,
+			detail
+		})]
+	});
+}
+function sessionToken(request, actor, tenant, permissions, ttl) {
+	return sha256Digest(canonicalJson({
+		t: "support-session",
+		id: request.id,
+		principal: request.principal,
+		actor,
+		tenant,
+		reason: request.reason,
+		permissions,
+		ttl,
+		reference: request.reference ?? null
+	}));
+}
+/**
+* Decides whether the subject of `permdock` may start the support session
+* in `request`. The actor must be a signed-in person acting for themselves
+* (`exceeds-creator` otherwise), give a `reason` (`reason-required`), be a
+* member of the tenant (`tenant-mismatch`) and be able to use every
+* permission (`exceeds-creator`). Without `permissions` the session gets the
+* actor's read-only permissions. The tenant's `supportSessions` policy then
+* applies, and the result is `approval-required` until `approved` carries
+* its token and `approvedBy` names someone other than the actor.
+*/
+/**
+* Decides whether the subject of `permdock` may start the support session
+* in `request` and returns the record to sign: a stated reason, membership
+* of the tenant, the actor's own reach, the tenant's `supportSessions`
+* policy and approval by someone else. An instance built from a snapshot
+* denies with `unsupported`.
+*/
+function decideSupportSession(permdock, request, options = {}) {
+	const internals = internalsOf(permdock);
+	if (internals === void 0) return Promise.resolve(freezeDeep({
+		outcome: "denied",
+		denials: [{
+			role: null,
+			reason: "unsupported"
+		}]
+	}));
+	const settings = options.settings ?? internals.env.settings;
+	return decideSupportSessionWith(internals.instance, request, settings === void 0 ? options : {
+		...options,
+		settings
+	});
+}
+async function decideSupportSessionWith(permdock, request, options) {
+	const actor = permdock.subject.principal;
+	if (actor === null) return denied("anonymous");
+	if (actor.kind !== void 0 && actor.kind !== "user") return denied("exceeds-creator", { creator: actor.kind });
+	if ("credential" in actor || "runTicket" in actor) return denied("exceeds-creator", { creator: "credential" in actor ? "credential" : "run" });
+	if (permdock.subject.actor !== void 0) return denied("exceeds-creator", { creator: "actor" });
+	if (!isReason(request.reason)) return denied("reason-required");
+	const ttl = request.expiresIn ?? DEFAULT_TTL;
+	if (!isId(request.id) || !isId(request.principal) || request.principal === actor.id || !Number.isSafeInteger(ttl) || ttl <= 0 || ttl > MAX_TTL || request.reference !== void 0 && !isId(request.reference)) return denied("validation");
+	const tenant = request.tenant ?? actor.tenant;
+	if (tenant === void 0) return denied("validation");
+	if (!permdock.tenants().includes(tenant)) return denied("tenant-mismatch", { tenant });
+	let policy;
+	if (options.settings !== void 0) try {
+		policy = (await options.settings.settingsFor(tenant))?.supportSessions;
+	} catch {
+		return denied("unsupported", { rule: "unavailable" });
+	}
+	if (policy?.disabled === true) return denied("unsupported", { rule: "disabled" });
+	if (policy?.maxTtl !== void 0 && ttl > policy.maxTtl) return denied("validation", { rule: "ttl" });
+	const leaves = request.permissions === void 0 ? listPermissions(permdock.permissions).filter((leaf) => annotationsFor(leaf).readOnlyHint && permdock.mayUse(leaf)) : request.permissions.map((permission) => findPermission(permdock.permissions, permission.key));
+	const keys = [];
+	for (const leaf of leaves) {
+		if (leaf === void 0) return denied("validation");
+		if (!permdock.mayUse(leaf)) return denied("exceeds-creator", { permission: leaf.key });
+		if (policy?.readOnly === true && !annotationsFor(leaf).readOnlyHint) return denied("not-delegated", {
+			permission: leaf.key,
+			rule: "read-only"
+		});
+		if (!keys.includes(leaf.key)) keys.push(leaf.key);
+	}
+	if (keys.length === 0) return denied("no-grant");
+	const token = sessionToken(request, actor.id, tenant, keys, ttl);
+	const approval = options.approval !== false;
+	const approved = approval && options.approved === token;
+	if (approved && (options.approvedBy === void 0 || options.approvedBy === actor.id)) return denied("approval", "approver-not-distinct");
+	const startedAt = nowSeconds(options.now);
+	const session = parseSupportSession(compact({
+		v: 1,
+		id: request.id,
+		principal: request.principal,
+		actor: actor.id,
+		tenant,
+		reason: request.reason,
+		permissions: keys,
+		startedAt: rfc3339(startedAt),
+		expiresAt: rfc3339(startedAt + ttl),
+		approvedBy: approved ? options.approvedBy : void 0,
+		reference: request.reference
+	}));
+	if (session === void 0) return denied("validation");
+	if (approval && !approved) return freezeDeep({
+		outcome: "approval-required",
+		session,
+		token
+	});
+	return freezeDeep({
+		outcome: "granted",
+		session
+	});
+}
+//#endregion
+export { parseSupportSession as n, decideSupportSession as t };

package/dist/svelte/Protected.svelte

@@ -16,7 +16,7 @@
     tenant,
     children,
     pending,
-    fallback,
+    denied,
     approval,
   }: ProtectedProps = $props();
 
@@ -33,15 +33,15 @@
     const generation = tick;
     return viewFor(store, permission, data, scoped, generation);
   });
-  const own = $derived({ pending, fallback, approval });
+  const own = $derived({ pending, denied, approval });
 </script>
 
 {#if view.slot === 'pending'}
   {@render slotContent('pending', own, defaults)?.()}
 {:else if view.slot === 'approval'}
   {@render slotContent('approval', own, defaults)?.(view.decision)}
-{:else if view.slot === 'fallback'}
-  {@render slotContent('fallback', own, defaults)?.(view.decision)}
+{:else if view.slot === 'denied'}
+  {@render slotContent('denied', own, defaults)?.(view.decision)}
 {:else}
   {@render children?.(view.decision)}
 {/if}

package/dist/svelte/index.d.ts

@@ -1,13 +1,13 @@
-import { n as requiredPlans } from "../problem-details-rIIo8B2C.js";
-import { i as describe } from "../describe-C3ldA9os.js";
+import { n as requiredPlans } from "../problem-details-DXlt-vks.js";
+import { i as describe } from "../describe-BZUsixiL.js";
 import { t as PermissionBoundaryState } from "../boundary-BmHxVH1J.js";
-import { t as approvalHeaders } from "../headers-Cf-zWvsO.js";
-import { a as ClientPermDock, c as PermissionSet, d as SubjectView, f as TenantView, i as ApprovalState, l as PermissionState, o as ClientStatus, p as UseRolesOptions, r as ApprovalHandle, s as FilterResult } from "../store-9KO4BlkB.js";
-import { n as PermDockSvelteOptions, r as ProtectedProps, s as PermissionBoundaryProps, t as PermDockDefaults } from "../types-ByUo56un.js";
-import { a as getDescribe, c as permission, d as setPermDock, f as subject, i as filtered, l as permissions, n as assignable, o as getPermDock, p as tenant, r as assignablePermissions, s as memberships, t as approval, u as roles } from "../stores-Cxz_80g-.js";
+import { t as approvalHeaders } from "../headers-CIbDTUTK.js";
+import { a as FilterResult, c as PermissionSet, d as RolesOptions, f as SubjectView, i as ClientStatus, l as PermissionState, n as ApprovalState, p as TenantView, r as ClientPermDock, t as ApprovalHandle } from "../types-BNORmDM8.js";
+import { n as SveltePermDockOptions, o as PermissionBoundaryProps, r as ProtectedProps, t as PermDockDefaults } from "../types-fbZ7JEXr.js";
+import { a as getDescribe, c as permission, d as setPermDock, f as subject, i as filtered, l as permissions, n as assignable, o as getPermDock, p as tenant, r as assignablePermissions, s as memberships, t as approval, u as roles } from "../stores-ClZUgeoP.js";
 import { Component } from "svelte";
 //#region src/svelte/index.d.ts
 export declare const Protected: Component<ProtectedProps>;
 export declare const PermissionBoundary: Component<PermissionBoundaryProps>;
 //#endregion
-export { type ApprovalHandle, type ApprovalState, type ClientPermDock, type ClientStatus, type FilterResult, type PermDockDefaults, type PermDockSvelteOptions, type PermissionBoundaryProps, type PermissionBoundaryState, type PermissionSet, type PermissionState, type ProtectedProps, type SubjectView, type TenantView, type UseRolesOptions, approval, approvalHeaders, assignable, assignablePermissions, describe, filtered, getDescribe, getPermDock, memberships, permission, permissions, requiredPlans, roles, setPermDock, subject, tenant };
+export { type ApprovalHandle, type ApprovalState, type ClientPermDock, type ClientStatus, type FilterResult, type PermDockDefaults, type PermissionBoundaryProps, type PermissionBoundaryState, type PermissionSet, type PermissionState, type ProtectedProps, type RolesOptions, type SubjectView, type SveltePermDockOptions, type TenantView, approval, approvalHeaders, assignable, assignablePermissions, describe, filtered, getDescribe, getPermDock, memberships, permission, permissions, requiredPlans, roles, setPermDock, subject, tenant };

package/dist/svelte/index.js

@@ -1,11 +1,11 @@
-import { r as requiredPlans } from "../problem-details-DECUnXAn.js";
-import { t as describe } from "../describe-Cgkp7eP0.js";
-import { t as approvalHeaders } from "../headers-BZSDieNT.js";
-import { l as slotContent } from "../views-CJsrBS1f.js";
+import { r as requiredPlans } from "../problem-details-cn5X30gZ.js";
+import { t as describe } from "../describe-BybMRY7A.js";
 import { n as boundaryFallback, t as boundaryDigest } from "../boundary-BM8a_P6E.js";
-import { n as getUi, t as getStore } from "../context-DieZVJXu.js";
-import { n as viewFor, t as scopedFor } from "../runtime-D_tMXnsq.js";
-import { a as getDescribe, c as permission, d as setPermDock, f as subject, i as filtered, l as permissions, n as assignable, o as getPermDock, p as tenant, r as assignablePermissions, s as memberships, t as approval, u as roles } from "../stores-BHXdSbw9.js";
+import { t as approvalHeaders } from "../headers-BIjfMaoC.js";
+import { u as slotContent } from "../views-DTIIO-oQ.js";
+import { n as getUi, t as getStore } from "../context-bbFHR-0D.js";
+import { n as viewFor, t as scopedFor } from "../runtime-D3VTAiCA.js";
+import { a as getDescribe, c as permission, d as setPermDock, f as subject, i as filtered, l as permissions, n as assignable, o as getPermDock, p as tenant, r as assignablePermissions, s as memberships, t as approval, u as roles } from "../stores-BbsD4fAR.js";
 import "svelte/internal/disclose-version";
 import * as $ from "svelte/internal/client";
 import { onDestroy } from "svelte";
@@ -75,7 +75,7 @@ function Protected$1($$anchor, $$props) {
 	});
 	const own = $.derived(() => ({
 		pending: $$props.pending,
-		fallback: $$props.fallback,
+		denied: $$props.denied,
 		approval: $$props.approval
 	}));
 	var fragment = $.comment();
@@ -95,7 +95,7 @@ function Protected$1($$anchor, $$props) {
 	var consequent_2 = ($$anchor) => {
 		var fragment_3 = $.comment();
 		var node_3 = $.first_child(fragment_3);
-		$.snippet(node_3, () => slotContent("fallback", $.get(own), defaults) ?? $.noop, () => $.get(view).decision);
+		$.snippet(node_3, () => slotContent("denied", $.get(own), defaults) ?? $.noop, () => $.get(view).decision);
 		$.append($$anchor, fragment_3);
 	};
 	var alternate = ($$anchor) => {
@@ -107,7 +107,7 @@ function Protected$1($$anchor, $$props) {
 	$.if(node, ($$render) => {
 		if ($.get(view).slot === "pending") $$render(consequent);
 		else if ($.get(view).slot === "approval") $$render(consequent_1, 1);
-		else if ($.get(view).slot === "fallback") $$render(consequent_2, 2);
+		else if ($.get(view).slot === "denied") $$render(consequent_2, 2);
 		else $$render(alternate, -1);
 	});
 	$.append($$anchor, fragment);

package/dist/svelte/runtime.d.ts

@@ -1,7 +1,7 @@
-import { n as DescribeMessages } from "../describe-C3ldA9os.js";
+import { n as DescribeMessages } from "../describe-BZUsixiL.js";
 import { n as boundaryDigest, r as boundaryFallback, t as PermissionBoundaryState } from "../boundary-BmHxVH1J.js";
-import { t as ClientStore } from "../store-9KO4BlkB.js";
-import { a as viewFor, i as scopedFor, o as slotContent, r as ProtectedProps, s as PermissionBoundaryProps, t as PermDockDefaults } from "../types-ByUo56un.js";
+import { m as ClientStore } from "../types-BNORmDM8.js";
+import { a as viewFor, i as scopedFor, o as PermissionBoundaryProps, r as ProtectedProps, s as slotContent, t as PermDockDefaults } from "../types-fbZ7JEXr.js";
 //#region src/svelte/context.d.ts
 /** The provider's `defaults` and `messages`. */
 type PermDockUi = {

package/dist/svelte/runtime.js

@@ -1,5 +1,5 @@
-import { l as slotContent } from "../views-CJsrBS1f.js";
 import { n as boundaryFallback, t as boundaryDigest } from "../boundary-BM8a_P6E.js";
-import { n as getUi, t as getStore } from "../context-DieZVJXu.js";
-import { n as viewFor, t as scopedFor } from "../runtime-D_tMXnsq.js";
+import { u as slotContent } from "../views-DTIIO-oQ.js";
+import { n as getUi, t as getStore } from "../context-bbFHR-0D.js";
+import { n as viewFor, t as scopedFor } from "../runtime-D3VTAiCA.js";
 export { boundaryDigest, boundaryFallback, getStore, getUi, scopedFor, slotContent, viewFor };

package/dist/svelte/source.d.ts

@@ -1,13 +1,13 @@
-import { n as requiredPlans } from "../problem-details-rIIo8B2C.js";
-import { i as describe } from "../describe-C3ldA9os.js";
+import { n as requiredPlans } from "../problem-details-DXlt-vks.js";
+import { i as describe } from "../describe-BZUsixiL.js";
 import { t as PermissionBoundaryState } from "../boundary-BmHxVH1J.js";
-import { t as approvalHeaders } from "../headers-Cf-zWvsO.js";
-import { a as ClientPermDock, c as PermissionSet, d as SubjectView, f as TenantView, i as ApprovalState, l as PermissionState, o as ClientStatus, p as UseRolesOptions, r as ApprovalHandle, s as FilterResult } from "../store-9KO4BlkB.js";
-import { n as PermDockSvelteOptions, r as ProtectedProps, s as PermissionBoundaryProps, t as PermDockDefaults } from "../types-ByUo56un.js";
-import { a as getDescribe, c as permission, d as setPermDock, f as subject, i as filtered, l as permissions, n as assignable, o as getPermDock, p as tenant, r as assignablePermissions, s as memberships, t as approval, u as roles } from "../stores-Cxz_80g-.js";
+import { t as approvalHeaders } from "../headers-CIbDTUTK.js";
+import { a as FilterResult, c as PermissionSet, d as RolesOptions, f as SubjectView, i as ClientStatus, l as PermissionState, n as ApprovalState, p as TenantView, r as ClientPermDock, t as ApprovalHandle } from "../types-BNORmDM8.js";
+import { n as SveltePermDockOptions, o as PermissionBoundaryProps, r as ProtectedProps, t as PermDockDefaults } from "../types-fbZ7JEXr.js";
+import { a as getDescribe, c as permission, d as setPermDock, f as subject, i as filtered, l as permissions, n as assignable, o as getPermDock, p as tenant, r as assignablePermissions, s as memberships, t as approval, u as roles } from "../stores-ClZUgeoP.js";
 import { Component } from "svelte";
 //#region src/svelte/source.d.ts
 export declare const Protected: Component<ProtectedProps>;
 export declare const PermissionBoundary: Component<PermissionBoundaryProps>;
 //#endregion
-export { type ApprovalHandle, type ApprovalState, type ClientPermDock, type ClientStatus, type FilterResult, type PermDockDefaults, type PermDockSvelteOptions, type PermissionBoundaryProps, type PermissionBoundaryState, type PermissionSet, type PermissionState, type ProtectedProps, type SubjectView, type TenantView, type UseRolesOptions, approval, approvalHeaders, assignable, assignablePermissions, describe, filtered, getDescribe, getPermDock, memberships, permission, permissions, requiredPlans, roles, setPermDock, subject, tenant };
+export { type ApprovalHandle, type ApprovalState, type ClientPermDock, type ClientStatus, type FilterResult, type PermDockDefaults, type PermissionBoundaryProps, type PermissionBoundaryState, type PermissionSet, type PermissionState, type ProtectedProps, type RolesOptions, type SubjectView, type SveltePermDockOptions, type TenantView, approval, approvalHeaders, assignable, assignablePermissions, describe, filtered, getDescribe, getPermDock, memberships, permission, permissions, requiredPlans, roles, setPermDock, subject, tenant };

package/dist/svelte/source.js

@@ -1,7 +1,7 @@
-import { r as requiredPlans } from "../problem-details-DECUnXAn.js";
-import { t as describe } from "../describe-Cgkp7eP0.js";
-import { t as approvalHeaders } from "../headers-BZSDieNT.js";
-import { a as getDescribe, c as permission, d as setPermDock, f as subject, i as filtered, l as permissions, n as assignable, o as getPermDock, p as tenant, r as assignablePermissions, s as memberships, t as approval, u as roles } from "../stores-BHXdSbw9.js";
+import { r as requiredPlans } from "../problem-details-cn5X30gZ.js";
+import { t as describe } from "../describe-BybMRY7A.js";
+import { t as approvalHeaders } from "../headers-BIjfMaoC.js";
+import { a as getDescribe, c as permission, d as setPermDock, f as subject, i as filtered, l as permissions, n as assignable, o as getPermDock, p as tenant, r as assignablePermissions, s as memberships, t as approval, u as roles } from "../stores-BbsD4fAR.js";
 import PermissionBoundaryComponent from "./PermissionBoundary.svelte";
 import ProtectedComponent from "./Protected.svelte";
 //#region src/svelte/source.ts

package/dist/sveltekit/index.d.ts

@@ -0,0 +1,51 @@
+import { T as Policy, Vt as Snapshot, j as PolicyVocabulary, rr as Principal } from "../policy-types-DzwivBgR.js";
+import { w as Permission } from "../vocabulary-D6lPdb4Z.js";
+import { a as OperationInput, t as Operation } from "../operations-CxybZErY.js";
+import { r as PermDock } from "../permdock-D7eeLJER.js";
+import { D as ConnectionOptions, T as Connection, f as InvalidSignatureError, i as OpenApiHooks, o as ProtectOptions, u as SnapshotQuery, v as discoverViaSignatureAgent, x as webBotAuthVerifier } from "../server-types-BLd4MnBX.js";
+import { a as ProtectTarget, i as PermDockHandlers, n as FetchAdapterOptions, t as ContextReader } from "../fetch-adapter-qKJBuRqy.js";
+import { RequestEvent } from "@sveltejs/kit";
+//#region src/sveltekit/create.d.ts
+/**
+ * A `handle` hook. SvelteKit 2 exports `Handle` from `@sveltejs/kit` and
+ * SvelteKit 3 from `@sveltejs/kit/hooks`; this shape is assignable to both.
+ */
+type SvelteKitHandle = (input: {
+  readonly event: RequestEvent;
+  readonly resolve: (event: RequestEvent) => Promise<Response>;
+}) => Promise<Response>;
+type SvelteKitPermDockOptions<TUser = unknown> = FetchAdapterOptions<RequestEvent, TUser>;
+/** What the adapter sets on `event.locals`. */
+type SvelteKitPermDockLocals<TData = unknown, V extends PolicyVocabulary = PolicyVocabulary> = {
+  readonly permdock: PermDock<V>;
+  readonly permdockData: TData;
+};
+/** The event a wrapped handler receives: the route's own event with typed `locals`. */
+type SvelteKitPermDockEvent<TEvent extends RequestEvent = RequestEvent, TData = unknown, V extends PolicyVocabulary = PolicyVocabulary> = TEvent & {
+  readonly locals: SvelteKitPermDockLocals<TData, V>;
+};
+/** Wraps a `+server.ts` handler; the route keeps its generated `RequestEvent` type. */
+type SvelteKitGuarded<TData, V extends PolicyVocabulary = PolicyVocabulary> = <TEvent extends RequestEvent, R = Response>(handler: (event: SvelteKitPermDockEvent<TEvent, TData, V>) => R | Promise<R>) => (event: TEvent) => Promise<R | Response>;
+type SvelteKitProtect<V extends PolicyVocabulary = PolicyVocabulary> = {
+  <T = unknown>(permission: Permission | null, data?: ContextReader<RequestEvent, T | null | undefined>, protectOptions?: ProtectOptions): SvelteKitGuarded<NonNullable<T>, V>;
+  <TOperation extends Operation>(operation: TOperation, input?: ContextReader<RequestEvent, OperationInput<TOperation>>, protectOptions?: ProtectOptions): SvelteKitGuarded<unknown, V>;
+};
+type SvelteKitPermDock<V extends PolicyVocabulary = PolicyVocabulary> = {
+  /** The `handle` hook: sets `event.locals.permdock`; a bad Web Bot Auth signature is a `401`. */
+  readonly middleware: () => SvelteKitHandle;
+  /** `export const DELETE = protect(permissions.post.delete, loadPost)(handler)`. */
+  readonly protect: SvelteKitProtect<V>;
+  /** Types `event.locals.permdock` for a handler and answers a thrown PermDock error with Problem Details. */
+  readonly withPermDock: SvelteKitGuarded<unknown, V>;
+  /** The instance for a `load` function, an action or a handler. */
+  readonly getPermDock: (event: RequestEvent) => Promise<PermDock<V>>;
+  /** The snapshot a layout `load` returns for `permdock/svelte`. */
+  readonly getSnapshot: (event: RequestEvent, query?: SnapshotQuery) => Promise<Snapshot>;
+  readonly connection: (event: RequestEvent, connectionOptions?: ConnectionOptions) => Promise<Connection>;
+  /** `export const { GET, POST } = permdockHandler()` in `src/routes/api/permdock/+server.ts`. */
+  readonly permdockHandler: () => PermDockHandlers<RequestEvent>;
+  readonly openapi: OpenApiHooks;
+};
+export declare function createPermDock<TUser, TPrincipal extends Principal = Principal, V extends PolicyVocabulary = PolicyVocabulary>(policy: Policy<TUser, TPrincipal, V>, options: SvelteKitPermDockOptions<TUser>): SvelteKitPermDock<V>;
+//#endregion
+export { type ContextReader, InvalidSignatureError, type PermDockHandlers, type ProtectTarget, type SvelteKitGuarded, type SvelteKitHandle, type SvelteKitPermDock, type SvelteKitPermDockEvent, type SvelteKitPermDockLocals, type SvelteKitPermDockOptions, type SvelteKitProtect, discoverViaSignatureAgent, webBotAuthVerifier };

package/dist/sveltekit/index.js

@@ -0,0 +1,27 @@
+import { d as discoverViaSignatureAgent, m as webBotAuthVerifier, u as InvalidSignatureError } from "../evaluations-DZ2CbV5k.js";
+import { n as guardedRoute, r as instanceRoute, t as fetchAdapter } from "../fetch-adapter-g0ypLkID.js";
+//#region src/sveltekit/create.ts
+const route = {
+	context: (event) => event,
+	locals: (event) => event.locals
+};
+function createPermDock(policy, options) {
+	const adapter = fetchAdapter(policy, options, "sveltekit", (event) => event.request);
+	const middleware = () => async ({ event, resolve }) => {
+		const attached = await adapter.ensure(event.locals, event);
+		return attached.ok ? resolve(event) : attached.response;
+	};
+	const protect = ((target, data, protectOptions) => guardedRoute(adapter, route, target, data, protectOptions));
+	return {
+		middleware,
+		protect,
+		withPermDock: instanceRoute(adapter, route),
+		getPermDock: adapter.getPermDock,
+		getSnapshot: adapter.getSnapshot,
+		connection: adapter.connection,
+		permdockHandler: adapter.handlers,
+		openapi: adapter.kernel.openapi
+	};
+}
+//#endregion
+export { InvalidSignatureError, createPermDock, discoverViaSignatureAgent, webBotAuthVerifier };

package/dist/tanstack-start/index.d.ts

@@ -0,0 +1,51 @@
+import { T as Policy, Vt as Snapshot, j as PolicyVocabulary, rr as Principal } from "../policy-types-DzwivBgR.js";
+import { w as Permission } from "../vocabulary-D6lPdb4Z.js";
+import { a as OperationInput, t as Operation } from "../operations-CxybZErY.js";
+import { r as PermDock } from "../permdock-D7eeLJER.js";
+import { D as ConnectionOptions, T as Connection, f as InvalidSignatureError, i as OpenApiHooks, o as ProtectOptions, u as SnapshotQuery, v as discoverViaSignatureAgent, x as webBotAuthVerifier } from "../server-types-BLd4MnBX.js";
+import { a as ProtectTarget, n as FetchAdapterOptions, t as ContextReader } from "../fetch-adapter-qKJBuRqy.js";
+import { RequestMiddleware, RequestMiddlewareAfterServer, createMiddleware } from "@tanstack/react-start";
+//#region src/tanstack-start/create.d.ts
+type TanStackStartPermDockOptions<TUser = unknown> = FetchAdapterOptions<Request, TUser>;
+/** The server context `middleware()` adds for later middleware, server functions and server routes. */
+type TanStackStartPermDockContext<V extends PolicyVocabulary = PolicyVocabulary> = {
+  readonly permdock: PermDock<V>;
+};
+/** The server context `protect` adds: the instance and the loaded row. */
+type TanStackStartGuardedContext<TData = unknown, V extends PolicyVocabulary = PolicyVocabulary> = TanStackStartPermDockContext<V> & {
+  readonly permdockData: TData;
+};
+/** A request middleware for `createStart`'s `requestMiddleware`, a server route's `server.middleware` or a server function's `.middleware([...])`. */
+type TanStackStartMiddleware<TContext> = RequestMiddlewareAfterServer<StartRegister, undefined, TContext>;
+/** The register `createMiddleware` builds with; Start's middleware types are invariant in it. */
+type StartRegister = ReturnType<typeof createMiddleware> extends RequestMiddleware<infer TRegister> ? TRegister : never;
+type TanStackStartProtect<V extends PolicyVocabulary = PolicyVocabulary> = {
+  <T = unknown>(permission: Permission | null, data?: ContextReader<Request, T | null | undefined>, protectOptions?: ProtectOptions): TanStackStartMiddleware<TanStackStartGuardedContext<NonNullable<T>, V>>;
+  <TOperation extends Operation>(operation: TOperation, input?: ContextReader<Request, OperationInput<TOperation>>, protectOptions?: ProtectOptions): TanStackStartMiddleware<TanStackStartGuardedContext<unknown, V>>;
+};
+/** A server route handler: `server: { handlers: { GET } }`. */
+type TanStackStartRouteHandler = (context: {
+  readonly request: Request;
+}) => Promise<Response>;
+/** The decision endpoint, one server route handler per method. */
+type TanStackStartPermDockHandlers = {
+  readonly GET: TanStackStartRouteHandler;
+  readonly POST: TanStackStartRouteHandler;
+};
+type TanStackStartPermDock<V extends PolicyVocabulary = PolicyVocabulary> = {
+  /** Adds `context.permdock`; a bad Web Bot Auth signature is a `401`. */
+  readonly middleware: () => TanStackStartMiddleware<TanStackStartPermDockContext<V>>;
+  /** A refusal ends the request with Problem Details; a grant adds `context.permdock` and `context.permdockData`. */
+  readonly protect: TanStackStartProtect<V>;
+  /** The instance for a server function: `getPermDock(getRequest())`. */
+  readonly getPermDock: (request: Request) => Promise<PermDock<V>>;
+  /** The snapshot a route `loader` returns for `permdock/react`. */
+  readonly getSnapshot: (request: Request, query?: SnapshotQuery) => Promise<Snapshot>;
+  readonly connection: (request: Request, connectionOptions?: ConnectionOptions) => Promise<Connection>;
+  /** `server: { handlers: permdockHandler() }` on the `/api/permdock` route. */
+  readonly permdockHandler: () => TanStackStartPermDockHandlers;
+  readonly openapi: OpenApiHooks;
+};
+export declare function createPermDock<TUser, TPrincipal extends Principal = Principal, V extends PolicyVocabulary = PolicyVocabulary>(policy: Policy<TUser, TPrincipal, V>, options: TanStackStartPermDockOptions<TUser>): TanStackStartPermDock<V>;
+//#endregion
+export { type ContextReader, InvalidSignatureError, type ProtectTarget, type TanStackStartGuardedContext, type TanStackStartMiddleware, type TanStackStartPermDock, type TanStackStartPermDockContext, type TanStackStartPermDockHandlers, type TanStackStartPermDockOptions, type TanStackStartProtect, type TanStackStartRouteHandler, discoverViaSignatureAgent, webBotAuthVerifier };

package/dist/tanstack-start/index.js

@@ -0,0 +1,40 @@
+import { d as discoverViaSignatureAgent, m as webBotAuthVerifier, u as InvalidSignatureError } from "../evaluations-DZ2CbV5k.js";
+import { t as fetchAdapter } from "../fetch-adapter-g0ypLkID.js";
+import { createMiddleware } from "@tanstack/react-start";
+//#region src/tanstack-start/create.ts
+function createPermDock(policy, options) {
+	const adapter = fetchAdapter(policy, options, "tanstack-start", (request) => request);
+	const middleware = () => createMiddleware().server(async ({ request, next }) => {
+		const attached = await adapter.attach(request);
+		if (!attached.ok) return attached.response;
+		const context = { permdock: attached.permdock };
+		return adapter.mapErrors(request, () => next({ context }));
+	});
+	const protect = ((target, data, protectOptions) => createMiddleware().server(async ({ request, next }) => {
+		const guard = await adapter.guard(target, data, request, protectOptions);
+		if (!guard.ok) return guard.response;
+		const context = {
+			permdock: guard.permdock,
+			permdockData: guard.data
+		};
+		return adapter.mapErrors(request, () => next({ context }));
+	}));
+	const handlers = () => {
+		const { GET, POST } = adapter.handlers();
+		return {
+			GET: ({ request }) => GET(request),
+			POST: ({ request }) => POST(request)
+		};
+	};
+	return {
+		middleware,
+		protect,
+		getPermDock: adapter.getPermDock,
+		getSnapshot: adapter.getSnapshot,
+		connection: adapter.connection,
+		permdockHandler: handlers,
+		openapi: adapter.kernel.openapi
+	};
+}
+//#endregion
+export { InvalidSignatureError, createPermDock, discoverViaSignatureAgent, webBotAuthVerifier };

package/dist/target-Bw37TFNA.js

@@ -0,0 +1,51 @@
+import { a as ownRecord } from "./paths-DXSHAMIa.js";
+import { n as sha256, t as bytesToBase64Url } from "./sha256-D9ihqmvd.js";
+//#region src/delivery/target.ts
+/**
+* Whether `value` is a target the router checked for `channel`: a non-empty
+* address and a granted decision. A transport calls it first and refuses
+* anything else, so a hand-built recipient never reaches a provider.
+*/
+function isDeliveryTarget(value, channel) {
+	const record = ownRecord(value);
+	const address = record?.["address"];
+	return record?.["channel"] === channel && typeof address === "string" && address !== "" && ownRecord(record["decision"])?.["outcome"] === "granted";
+}
+/**
+* The idempotency key for one recipient of delivery `id`: `pdd_` and the
+* base64url SHA-256 of the delivery id, channel and recipient. It fits the
+* tag and header charsets of every provider, `[A-Za-z0-9_-]`.
+*/
+function idempotencyKeyFor(id, channel, recipient) {
+	return `pdd_${bytesToBase64Url(sha256(JSON.stringify([
+		id,
+		channel,
+		recipient
+	])))}`;
+}
+const ATOM = "[A-Za-z0-9!#$%&'*+/=?^_`{|}~-]+";
+const ADDR_SPEC = /* @__PURE__ */ new RegExp(`^${ATOM}(?:\\.${ATOM})*@(?:[A-Za-z0-9](?:[A-Za-z0-9-]{0,61}[A-Za-z0-9])?\\.)+[A-Za-z0-9](?:[A-Za-z0-9-]{0,61}[A-Za-z0-9])?$`, "u");
+/**
+* An RFC 5322 `addr-spec` in dot-atom form with a DNS domain, at most 254
+* characters (RFC 5321 path limit). Quoted local parts, comments and
+* domain literals are refused.
+*/
+function isAddrSpec(value) {
+	return value.length <= 254 && ADDR_SPEC.test(value);
+}
+/** A chat platform user id: printable, no whitespace, at most 256 characters. */
+function isChatAddress(value) {
+	return /^[!-~]{1,256}$/u.test(value);
+}
+/** An absolute https URL with no credentials. */
+function isWebhookAddress(value) {
+	let url;
+	try {
+		url = new URL(value);
+	} catch {
+		return false;
+	}
+	return url.protocol === "https:" && url.username === "" && url.password === "";
+}
+//#endregion
+export { isWebhookAddress as a, isDeliveryTarget as i, isAddrSpec as n, isChatAddress as r, idempotencyKeyFor as t };

package/dist/{tenancy-DshjqY0n.js → tenancy-DN2QAx9z.js}

@@ -1,10 +1,10 @@
-import { t as expiredAt } from "./expiry-BoBJ8Tvc.js";
-import { n as sameId } from "./ids-DC4V4CFu.js";
-import { c as rootScope, l as scopeChain, m as tenantOf, o as resolveScope, r as findScope, t as activeFor, u as scopeIdOf } from "./scopes-tvpa34ep.js";
-import { l as isFieldRelation } from "./resource-relations-D1Un3pcz.js";
+import { o as sameId, t as expiredAt } from "./expiry-D4_YKRKD.js";
+import { l as isFieldRelation } from "./resource-relations-D_jw0BFx.js";
+import { o as epochSeconds } from "./time-DkWjdL98.js";
+import { c as rootScope, l as scopeChain, m as tenantOf, o as resolveScope, r as findScope, t as activeFor, u as scopeIdOf } from "./scopes-CUPSjo9q.js";
 //#region src/core/tenancy.ts
 function nowSeconds(now) {
-	return now ?? Date.now() / 1e3;
+	return now ?? epochSeconds();
 }
 function isMembershipExpired(membership, now) {
 	return expiredAt(membership, now ?? nowSeconds());

package/dist/terminal/index.d.ts

@@ -1,8 +1,9 @@
-import { E as Policy, Or as Principal, ir as Decision, j as PolicyVocabulary, jt as PermDock, kr as Subject } from "../policy-types-sp9P1iIV.js";
-import { d as Permission } from "../permission-types-Dg39z9Kv.js";
-import { f as ApprovalStore } from "../types-Br9IXUBG.js";
-import { a as ProblemDetails, t as ApprovalHint } from "../errors-OD_4c__H.js";
-import { t as InstanceOptions } from "../instance-options-plkrsAog.js";
+import { Nn as Decision, Rt as Instant, T as Policy, ir as Subject, j as PolicyVocabulary, rr as Principal } from "../policy-types-DzwivBgR.js";
+import { w as Permission } from "../vocabulary-D6lPdb4Z.js";
+import { r as PermDock } from "../permdock-D7eeLJER.js";
+import { m as ApprovalStore } from "../types-CCpc2Dcv.js";
+import { a as ProblemDetails, t as ApprovalHint } from "../errors-C2PXIv4c.js";
+import { t as InstanceOptions } from "../instance-options-Omfd793B.js";
 //#region src/terminal/types.d.ts
 type TokenSourceName = "device" | "keychain" | "env" | "ci-oidc";
 type TokenSource = TokenSourceName | {
@@ -55,7 +56,8 @@ type TerminalRuntime = {
   readonly env?: Readonly<Record<string, string | undefined>>;
   readonly stdoutIsTTY?: boolean;
   readonly platform?: string;
-  readonly now?: () => number;
+  /** The clock; defaults to the system clock. */
+  readonly now?: () => Instant;
   readonly write?: (text: string) => void;
   readonly exit?: (code: number) => never;
   readonly fetch?: typeof fetch;
@@ -130,8 +132,8 @@ type ProtectContext<T = unknown, V extends PolicyVocabulary = PolicyVocabulary>
   }>;
 };
 type TerminalPermDock<V extends PolicyVocabulary = PolicyVocabulary> = {
-  readonly permdock: (options?: PermDockResolveOptions) => Promise<PermDock<V>>;
-  readonly protect: <TArgs extends readonly unknown[], TData = unknown>(permission: Permission, load?: (...args: TArgs) => TData | Promise<TData>) => (action: (context: ProtectContext<TData, V>, ...args: TArgs) => unknown) => (...args: TArgs) => Promise<unknown>;
+  readonly getPermDock: (options?: PermDockResolveOptions) => Promise<PermDock<V>>;
+  readonly protect: <TArgs extends readonly unknown[], TData = unknown>(permission: Permission, data?: (...args: TArgs) => TData | Promise<TData>) => (action: (context: ProtectContext<TData, V>, ...args: TArgs) => unknown) => (...args: TArgs) => Promise<unknown>;
   readonly filterCommands: (entries: readonly CommandEntry[], options?: FilterCommandsOptions) => readonly CommandEntry[];
   readonly format: (decision: Decision, options?: FormatOptions) => string;
   readonly exitCode: (decision: Decision) => number;
@@ -139,7 +141,7 @@ type TerminalPermDock<V extends PolicyVocabulary = PolicyVocabulary> = {
 };
 //#endregion
 //#region src/terminal/create.d.ts
-export declare function createPermDock<TUser, TPrincipal extends Principal = Principal, V extends PolicyVocabulary = PolicyVocabulary>(policy: Policy<TUser, TPrincipal, V>, options: TerminalPermDockOptions<TUser>): TerminalPermDock<V>;
+export declare function createPermDock<TUser, TPrincipal extends Principal = Principal, V extends PolicyVocabulary = PolicyVocabulary>(policy: Policy<TUser, TPrincipal, V>, given: TerminalPermDockOptions<TUser>): TerminalPermDock<V>;
 //#endregion
 //#region src/terminal/exit.d.ts
 export declare const EX_OK = 0;