permdock 0.4.0 → 0.5.0

package/dist/types-_sHy8BQf.d.ts

@@ -0,0 +1,65 @@
+import { fn as Approver } from "./policy-types-DzwivBgR.js";
+//#region src/approvals/access-reviews/types.d.ts
+type AccessReviewStatus = "open" | "closed";
+type AccessReviewItemStatus = "pending" | "kept" | "revoked";
+/**
+ * Access review v1: who holds `permissions` in one tenant, and who may
+ * confirm or revoke each holding. PermDock records the reviewer's decision
+ * and never changes the role or membership itself.
+ */
+type AccessReview = {
+  readonly v: 1;
+  readonly id: string;
+  readonly tenant: string;
+  readonly permissions: readonly string[];
+  readonly reviewers: Approver | readonly Approver[];
+  readonly createdBy: string;
+  readonly createdAt: string;
+  readonly dueAt: string;
+  readonly status: AccessReviewStatus;
+  /** `false` when the population can omit a holder, such as a global role. */
+  readonly complete: boolean;
+};
+/** One holding in a review. `via` names the roles the population attributed it to. */
+type AccessReviewItem = {
+  readonly v: 1;
+  readonly id: string;
+  readonly review: string;
+  readonly principal: string;
+  readonly permission: string;
+  readonly via: readonly string[];
+  readonly status: AccessReviewItemStatus;
+  readonly decidedBy?: string;
+  readonly decidedAt?: string;
+  readonly note?: string;
+  /** Set by the application after it revoked the holding at its source. */
+  readonly appliedAt?: string;
+};
+type AccessReviewItemQuery = {
+  readonly review: string;
+  readonly status?: AccessReviewItemStatus;
+  readonly limit?: number;
+  readonly cursor?: string;
+};
+type AccessReviewItemPage = {
+  readonly items: readonly AccessReviewItem[];
+  readonly next?: string;
+};
+type AccessReviewDecision = {
+  readonly status: "kept" | "revoked";
+  readonly decidedBy: string;
+  readonly decidedAt: string;
+  readonly note?: string;
+};
+type AccessReviewStore = {
+  /** Names the implementation in errors and events. */
+  readonly name?: string;
+  create(review: AccessReview, items: readonly AccessReviewItem[]): Promise<void> | void;
+  get(id: string): Promise<AccessReview | null> | AccessReview | null;
+  items(query: AccessReviewItemQuery): Promise<AccessReviewItemPage> | AccessReviewItemPage;
+  decide(reviewId: string, itemId: string, decision: AccessReviewDecision): Promise<AccessReviewItem> | AccessReviewItem;
+  markApplied(reviewId: string, itemId: string, at: string): Promise<AccessReviewItem> | AccessReviewItem;
+  close(id: string): Promise<AccessReview> | AccessReview;
+};
+//#endregion
+export { AccessReviewItemQuery as a, AccessReviewStore as c, AccessReviewItemPage as i, AccessReviewDecision as n, AccessReviewItemStatus as o, AccessReviewItem as r, AccessReviewStatus as s, AccessReview as t };

package/dist/{types-ByUo56un.d.ts → types-fbZ7JEXr.d.ts}

@@ -1,26 +1,18 @@
-import { an as Snapshot, ir as Decision, jt as PermDock, rr as ApprovalRequiredDecision, ur as GrantedDecision, ut as TokenVerifier } from "./policy-types-sp9P1iIV.js";
-import { d as Permission } from "./permission-types-Dg39z9Kv.js";
+import { Mn as ApprovalRequiredDecision, Nn as Decision, Vt as Snapshot, dt as TokenVerifier, zn as GrantedDecision } from "./policy-types-DzwivBgR.js";
+import { w as Permission } from "./vocabulary-D6lPdb4Z.js";
+import { r as PermDock } from "./permdock-D7eeLJER.js";
 import { t as PermissionBoundaryState } from "./boundary-BmHxVH1J.js";
-import { l as PermissionState, t as ClientStore, u as ProviderOptionsBase } from "./store-9KO4BlkB.js";
+import { l as PermissionState, m as ClientStore, u as ProviderOptionsBase } from "./types-BNORmDM8.js";
 import { Snippet } from "svelte";
 import { Readable } from "svelte/store";
-//#region src/svelte/boundary.d.ts
-type PermissionBoundaryProps = {
-  readonly children?: Snippet;
-  /** Rendered in place of the children when one throws `PermDockDeniedError`. */
-  readonly denied?: Snippet<[PermissionBoundaryState]>;
-  /** Rendered for `PermDockApprovalRequiredError`; defaults to `denied`. */
-  readonly approval?: Snippet<[PermissionBoundaryState]>;
-};
-//#endregion
 //#region src/client/views.d.ts
 /**
  * What `Protected` renders: `pending` while an endpoint answer is in flight,
- * `approval` for an approval-required decision, `fallback` for any other
+ * `approval` for an approval-required decision, `denied` for any other
  * denial.
  */
 type ProtectedView = (PermissionState & {
-  readonly slot: "pending" | "fallback";
+  readonly slot: "pending" | "denied";
 }) | {
   readonly allowed: false;
   readonly status: PermissionState["status"];
@@ -35,18 +27,27 @@ type ProtectedView = (PermissionState & {
 /** Provider-wide content for the `Protected` slots a component leaves out. */
 type SlotDefaults<P, F, A = F> = {
   readonly pending?: P;
-  readonly fallback?: F;
+  readonly denied?: F;
   readonly approval?: A;
 };
 /**
  * The content `Protected` renders for a non-default slot. Its own prop wins
- * over the provider default; `approval` falls back to `fallback`, first the
+ * over the provider default; `approval` falls back to `denied`, first the
  * component's, then the provider's.
  */
 declare function slotContent<P, F, A>(slot: "pending", own: SlotDefaults<P, F, A>, defaults: SlotDefaults<P, F, A> | undefined): P | undefined;
-declare function slotContent<P, F, A>(slot: "fallback", own: SlotDefaults<P, F, A>, defaults: SlotDefaults<P, F, A> | undefined): F | undefined;
+declare function slotContent<P, F, A>(slot: "denied", own: SlotDefaults<P, F, A>, defaults: SlotDefaults<P, F, A> | undefined): F | undefined;
 declare function slotContent<P, F, A>(slot: "approval", own: SlotDefaults<P, F, A>, defaults: SlotDefaults<P, F, A> | undefined): F | A | undefined;
 //#endregion
+//#region src/svelte/boundary.d.ts
+type PermissionBoundaryProps = {
+  readonly children?: Snippet;
+  /** Rendered in place of the children when one throws `PermDockDeniedError`. */
+  readonly denied?: Snippet<[PermissionBoundaryState]>;
+  /** Rendered for `PermDockApprovalRequiredError`; defaults to `denied`. */
+  readonly approval?: Snippet<[PermissionBoundaryState]>;
+};
+//#endregion
 //#region src/svelte/protected.d.ts
 type ProtectedProps = {
   readonly permission: Permission;
@@ -54,8 +55,8 @@ type ProtectedProps = {
   readonly tenant?: string;
   readonly children?: Snippet<[GrantedDecision]>;
   readonly pending?: Snippet;
-  readonly fallback?: Snippet<[Decision]>;
-  /** Rendered for an approval-required decision; defaults to `fallback`. */
+  readonly denied?: Snippet<[Decision]>;
+  /** Rendered for an approval-required decision; defaults to `denied`. */
   readonly approval?: Snippet<[ApprovalRequiredDecision]>;
 };
 /** The instance for `tenant`, built once per store change rather than once per check. */
@@ -63,7 +64,7 @@ declare function scopedFor(store: ClientStore, tenant: string | undefined, _gene
 declare function viewFor(store: ClientStore, reference: Permission, data: unknown, scoped: PermDock | undefined, _generation?: number): ProtectedView;
 //#endregion
 //#region src/svelte/types.d.ts
-type PermDockSvelteOptions = ProviderOptionsBase & {
+type SveltePermDockOptions = ProviderOptionsBase & {
   /**
    * A getter (`() => data.snapshot`) or a readable store re-hydrates the
    * store when it changes; a promise keeps the store `pending` until it
@@ -81,8 +82,8 @@ type PermDockSvelteOptions = ProviderOptionsBase & {
 /** Snippets for the `<Protected>` slots a component leaves out. */
 type PermDockDefaults = {
   readonly pending?: Snippet;
-  readonly fallback?: Snippet<[Decision]>;
+  readonly denied?: Snippet<[Decision]>;
   readonly approval?: Snippet<[ApprovalRequiredDecision]>;
 };
 //#endregion
-export { viewFor as a, scopedFor as i, PermDockSvelteOptions as n, slotContent as o, ProtectedProps as r, PermissionBoundaryProps as s, PermDockDefaults as t };
+export { viewFor as a, scopedFor as i, SveltePermDockOptions as n, PermissionBoundaryProps as o, ProtectedProps as r, slotContent as s, PermDockDefaults as t };

package/dist/{types-DHrmBJLH.d.ts → types-tIgIeIKJ.d.ts}

@@ -1,7 +1,7 @@
-import { an as Snapshot, ir as Decision, rr as ApprovalRequiredDecision, ur as GrantedDecision, ut as TokenVerifier } from "./policy-types-sp9P1iIV.js";
-import { d as Permission } from "./permission-types-Dg39z9Kv.js";
-import { n as DescribeMessages } from "./describe-C3ldA9os.js";
-import { n as ClientStoreOptions } from "./store-9KO4BlkB.js";
+import { Mn as ApprovalRequiredDecision, Nn as Decision, Vt as Snapshot, dt as TokenVerifier, zn as GrantedDecision } from "./policy-types-DzwivBgR.js";
+import { w as Permission } from "./vocabulary-D6lPdb4Z.js";
+import { n as DescribeMessages } from "./describe-BZUsixiL.js";
+import { h as ClientStoreOptions } from "./types-BNORmDM8.js";
 import { ReactNode } from "react";
 //#region src/react/types.d.ts
 type PermDockProviderProps = ({
@@ -49,7 +49,7 @@ type PermDockProviderProps = ({
 /** Provider-wide content for the `<Protected>` slots a component leaves out. */
 type PermDockDefaults = {
   readonly pending?: ReactNode;
-  readonly fallback?: ReactNode | ((decision: Decision) => ReactNode);
+  readonly denied?: ReactNode | ((decision: Decision) => ReactNode);
   readonly approval?: ReactNode | ((decision: ApprovalRequiredDecision) => ReactNode);
 };
 type ProtectedProps = {
@@ -57,8 +57,8 @@ type ProtectedProps = {
   readonly data?: unknown;
   readonly tenant?: string;
   readonly pending?: ReactNode;
-  readonly fallback?: ReactNode | ((decision: Decision) => ReactNode);
-  /** Rendered for an approval-required decision; defaults to `fallback`. */
+  readonly denied?: ReactNode | ((decision: Decision) => ReactNode);
+  /** Rendered for an approval-required decision; defaults to `denied`. */
   readonly approval?: ReactNode | ((decision: ApprovalRequiredDecision) => ReactNode);
   readonly children: ReactNode | ((decision: GrantedDecision) => ReactNode);
 };

package/dist/unplugin/index.d.ts

@@ -1,4 +1,4 @@
-import { a as PermDockPluginOptions } from "../types-7rJVLWe5.js";
+import { a as PermDockPluginOptions } from "../types-5Ut_pbKy.js";
 import { createUnplugin } from "unplugin";
 //#region src/unplugin/index.d.ts
 type CreateUnplugin = typeof createUnplugin<PermDockPluginOptions | undefined>;

package/dist/unplugin/index.js

@@ -1,5 +1,5 @@
-import { n as createCollectScheduler, r as report } from "../watch-zeucB7eF.js";
-import { t as peerHint } from "../peer-BOr_kJE1.js";
+import { n as createCollectScheduler, r as report } from "../watch-CszoTJMq.js";
+import { r as peerHint } from "../peer-C8swJ2GH.js";
 import { createRequire } from "node:module";
 //#region src/unplugin/index.ts
 function loadCreateUnplugin() {

package/dist/usage-CHOtwL19.js

@@ -0,0 +1 @@
+export { t as runUsage } from "./usage-T5mXq98v.js";

package/dist/usage-DHtE8j4E.js

@@ -0,0 +1,32 @@
+import { t as defineLeaf } from "./command-L8EstFNm.js";
+import { a as failOnFlag } from "./flags-C3DktBDY.js";
+//#region src/cli/commands/usage.ts
+const usage = defineLeaf({
+	flags: {
+		...failOnFlag,
+		ignore: {
+			type: "string",
+			repeatable: true,
+			description: "Permission keys or globs to skip",
+			valueHint: "glob"
+		},
+		"dynamic-as-used": {
+			type: "boolean",
+			description: "Count computed permission references as uses"
+		}
+	},
+	async run(ctx, { flags }) {
+		return (await import("./usage-CHOtwL19.js")).runUsage({
+			cwd: ctx.cwd,
+			config: ctx.config,
+			ignore: flags.ignore,
+			strict: flags["fail-on"] === "warning",
+			json: ctx.json,
+			dynamicAsUsed: flags["dynamic-as-used"],
+			now: ctx.now,
+			io: ctx.io
+		});
+	}
+});
+//#endregion
+export { usage };

package/dist/{usage-CG9nOYZw.js → usage-T5mXq98v.js}

@@ -1,10 +1,13 @@
-import { a as getResource } from "./permission-registry-BsblpB-z.js";
-import { o as usageResult } from "./errors-CWfoNg9N.js";
+import { a as getResource } from "./permission-registry-Br4jSNVi.js";
+import { u as usageResult } from "./errors-CWTY6uih.js";
 import { a as rel, r as listSourceFiles } from "./files-D_JIzUrP.js";
-import { a as USAGE_REPORT_SCHEMA } from "./version-BEogC-rB.js";
-import { o as jsonSchemaOf } from "./catalog-doc-DWtg0gGR.js";
-import { a as loadModule, n as asPolicy, s as pickNamed } from "./load-C3_oTHyO.js";
-import { r as runCollect } from "./collect-2SrB7lfk.js";
+import { o as USAGE_REPORT_SCHEMA } from "./version-CEbQ5UeM.js";
+import { s as jsonSchemaOf } from "./catalog-doc-C9wjsfNY.js";
+import { a as loadModule, n as asPolicy, s as pickNamed } from "./load-DFS_ry0W.js";
+import { r as runCollect } from "./collect-CrZJJnEF.js";
+import { t as beforeFirst } from "./text-BMFRfBqc.js";
+import { t as DOCS_BASE } from "./manifest-CtKR3GXL.js";
+import { r as findingOf } from "./output-Dyw8fyPF.js";
 import { existsSync, readFileSync, realpathSync } from "node:fs";
 import { dirname, resolve } from "node:path";
 import { fileURLToPath, pathToFileURL } from "node:url";
@@ -15,20 +18,26 @@ import { isBuiltin } from "node:module";
 /** Entries a client file must not import; `tests/cli/doctor-entries.test.ts` keeps it in step with `exports`. */
 const SERVER_SPECIFIERS = [
 	"permdock/a2a",
+	"permdock/agent",
 	"permdock/ai-sdk",
 	"permdock/approvals",
+	"permdock/astro",
 	"permdock/authzen",
 	"permdock/better-auth",
 	"permdock/better-supabase",
+	"permdock/chat",
+	"permdock/chat-sdk",
 	"permdock/claude-agent",
 	"permdock/clerk",
 	"permdock/cloud",
 	"permdock/convex",
+	"permdock/delivery",
 	"permdock/drizzle",
 	"permdock/elysia",
 	"permdock/eve",
 	"permdock/express",
 	"permdock/fastify",
+	"permdock/h3",
 	"permdock/hono",
 	"permdock/jwt",
 	"permdock/kysely",
@@ -42,24 +51,35 @@ const SERVER_SPECIFIERS = [
 	"permdock/otel",
 	"permdock/pdp",
 	"permdock/prisma",
+	"permdock/resend",
 	"permdock/scim",
 	"permdock/server",
+	"permdock/solid-start",
 	"permdock/ssf",
 	"permdock/supabase",
 	"permdock/supabase/middleware",
+	"permdock/sveltekit",
+	"permdock/tanstack-start",
 	"permdock/terminal",
-	"permdock/trpc"
+	"permdock/trpc",
+	"permdock/workflow",
+	"permdock/workflow-sdk"
 ];
 /** Entries that feed request, tool or model data into a check. */
 const ADAPTER_SPECIFIERS = [
 	"permdock/a2a",
+	"permdock/agent",
 	"permdock/ai-sdk",
+	"permdock/astro",
 	"permdock/authzen",
+	"permdock/chat",
+	"permdock/chat-sdk",
 	"permdock/claude-agent",
 	"permdock/elysia",
 	"permdock/eve",
 	"permdock/express",
 	"permdock/fastify",
+	"permdock/h3",
 	"permdock/hono",
 	"permdock/mcp",
 	"permdock/nest",
@@ -68,7 +88,10 @@ const ADAPTER_SPECIFIERS = [
 	"permdock/openai",
 	"permdock/orpc",
 	"permdock/server",
+	"permdock/solid-start",
 	"permdock/supabase/middleware",
+	"permdock/sveltekit",
+	"permdock/tanstack-start",
 	"permdock/terminal",
 	"permdock/trpc",
 	"permdock/webmcp"
@@ -241,6 +264,12 @@ function stringValue(node) {
 	if (value?.type === "Literal") return typeof value.value === "string" ? value.value : void 0;
 	return value?.type === "TemplateLiteral" ? value.quasis[0]?.value.cooked ?? void 0 : void 0;
 }
+/** Their `jwks` holds Standard Webhooks `v1a` keys, not a token issuer's. */
+const WEBHOOK_VERIFIERS = /* @__PURE__ */ new Set([
+	"cloudApprovalWaiter",
+	"verifyWebhook",
+	"webhookVerifier"
+]);
 function isPermDockSpecifier(value) {
 	return value === "permdock" || value.startsWith("permdock/");
 }
@@ -254,7 +283,8 @@ function permdockOptionObjects(source) {
 		ImportDeclaration(node) {
 			if (node.importKind === "type" || !isPermDockSpecifier(node.source.value)) return;
 			for (const specifier of node.specifiers) if (specifier.type === "ImportNamespaceSpecifier") namespaces.add(specifier.local.name);
-			else if (specifier.type === "ImportDefaultSpecifier" || specifier.importKind !== "type") functions.add(specifier.local.name);
+			else if (specifier.type === "ImportDefaultSpecifier") functions.add(specifier.local.name);
+			else if (specifier.importKind !== "type" && !WEBHOOK_VERIFIERS.has(specifier.imported.type === "Identifier" ? specifier.imported.name : specifier.imported.value)) functions.add(specifier.local.name);
 		},
 		VariableDeclarator(node) {
 			const init = unwrapped(node.init);
@@ -373,7 +403,7 @@ function pd038(sources, tenantClaim, fallback) {
 			code: "PD038",
 			severity: "warning",
 			message: `${source.file}:${line} reads the tenant from '${read}', but rls.tenantClaim is '${tenantClaim}'`,
-			fix: `pass tenant: '${tenantClaim}' or set rls.tenantClaim to '${read}'`
+			fix: `pass claims: { tenant: '${tenantClaim}' } or set rls.tenantClaim to '${read}'`
 		});
 	}
 	return findings;
@@ -534,7 +564,20 @@ async function runUsage(input) {
 	};
 	return {
 		code: report.errors > 0 || input.strict && report.warnings > 0 ? 1 : 0,
-		output: input.json ? `${JSON.stringify(report, null, 2)}\n` : formatUsage(report)
+		output: input.json ? `${JSON.stringify(report, null, 2)}\n` : formatUsage(report),
+		findings: [
+			...unused,
+			...ungranted,
+			...noRole,
+			...dynamic,
+			...undeclared,
+			...outsideInclude
+		].map((item) => findingOf({
+			code: item.kind,
+			severity: item.kind === "no-role" ? "error" : "warning",
+			message: `${item.key === "*" ? "" : `${item.key}: `}${item.detail}`,
+			docs: `${DOCS_BASE}/usage`
+		}))
 	};
 }
 async function usagePolicy(cwd, policyRel, loaded) {
@@ -587,7 +630,7 @@ function declaredFields(policy, resource) {
 function conditionFields(condition, out) {
 	if (condition === void 0) return;
 	const add = (field) => {
-		out.add(field.split(".")[0] ?? field);
+		out.add(beforeFirst(field, "."));
 	};
 	switch (condition.op) {
 		case "eq":

package/dist/{validation-error-BSSw0l_8.d.ts → validation-error-Bg5Tpluk.d.ts}

@@ -1,4 +1,4 @@
-import { a as ProblemDetails } from "./errors-OD_4c__H.js";
+import { a as ProblemDetails } from "./errors-C2PXIv4c.js";
 import { StandardSchemaV1 } from "@standard-schema/spec";
 //#region src/core/validation-error.d.ts
 /** The base of every Problem Details `type` URI; defined here so a validation error does not pull in the Problem Details builders. */

package/dist/{validity-dVrUEPJt.js → validity-CZ7-y0Cj.js}

@@ -1,5 +1,6 @@
 import { n as freezeDeep } from "./freeze-CrU8nQeX.js";
-import { c as ownKeys, o as isForbiddenKey, s as ownGet } from "./thenable-QSmvt-vZ.js";
+import { i as ownKeys, n as isForbiddenKey, r as ownGet } from "./paths-DXSHAMIa.js";
+import { c as instantOf, g as secondsOf, m as rfc3339 } from "./time-DkWjdL98.js";
 //#region src/core/fields.ts
 function sanitizeFields(fields) {
 	if (fields === void 0) return;
@@ -25,17 +26,6 @@ function sanitizeContext(value) {
 //#endregion
 //#region src/core/validity.ts
 /**
-* An instant as Unix seconds: a finite number is taken as seconds already, a
-* string must parse as RFC 3339. Anything else is `undefined`, and the caller
-* decides whether that is "absent" or an error.
-*/
-function instantOf(input) {
-	if (typeof input === "number") return Number.isFinite(input) ? Math.floor(input) : void 0;
-	if (typeof input !== "string" || input.trim() === "") return;
-	const millis = Date.parse(input);
-	return Number.isFinite(millis) ? Math.floor(millis / 1e3) : void 0;
-}
-/**
 * The normalised validity of a grant, or `undefined` when neither bound is
 * set. Fail-closed at definition time: a bound that does not parse, or a
 * window that ends before it starts, throws so a typo never widens a grant.
@@ -43,8 +33,8 @@ function instantOf(input) {
 function normalizeValidity(options, permissionKey) {
 	const from = options.validFrom === void 0 ? void 0 : instantOf(options.validFrom);
 	const until = options.validUntil === void 0 ? void 0 : instantOf(options.validUntil);
-	if (options.validFrom !== void 0 && from === void 0) throw new Error(`PermDock: validFrom on '${permissionKey}' must be an RFC 3339 string or Unix seconds`);
-	if (options.validUntil !== void 0 && until === void 0) throw new Error(`PermDock: validUntil on '${permissionKey}' must be an RFC 3339 string or Unix seconds`);
+	if (options.validFrom !== void 0 && from === void 0) throw new Error(`PermDock: validFrom on '${permissionKey}' must be an RFC 3339 string or an Instant`);
+	if (options.validUntil !== void 0 && until === void 0) throw new Error(`PermDock: validUntil on '${permissionKey}' must be an RFC 3339 string or an Instant`);
 	if (from !== void 0 && until !== void 0 && until <= from) throw new Error(`PermDock: validUntil on '${permissionKey}' must be after validFrom`);
 	if (from === void 0 && until === void 0) return;
 	return Object.freeze({
@@ -58,5 +48,32 @@ function isActive(validity, now) {
 	if (validity.from !== void 0 && now < validity.from) return false;
 	return validity.until === void 0 || now < validity.until;
 }
+function wireValidity(validity) {
+	if (validity === void 0) return;
+	return Object.freeze({
+		...validity.from === void 0 ? {} : { from: rfc3339(validity.from) },
+		...validity.until === void 0 ? {} : { until: rfc3339(validity.until) }
+	});
+}
+/**
+* The validity of a wire grant. A malformed window fails closed for the
+* grant's effect: an allow never applies (`{ from: +∞ }`), a deny always
+* does (no window), so a corrupt bound can never lift a deny.
+*/
+function readWireValidity(value, effect = "allow") {
+	if (value === void 0) return;
+	const malformed = effect === "deny" ? void 0 : NEVER;
+	if (typeof value !== "object" || value === null) return malformed;
+	const from = "from" in value ? value.from : void 0;
+	const until = "until" in value ? value.until : void 0;
+	const start = from === void 0 ? void 0 : secondsOf(from);
+	const end = until === void 0 ? void 0 : secondsOf(until);
+	if (from !== void 0 && start === void 0 || until !== void 0 && end === void 0) return malformed;
+	return Object.freeze({
+		...start === void 0 ? {} : { from: start },
+		...end === void 0 ? {} : { until: end }
+	});
+}
+const NEVER = Object.freeze({ from: Number.POSITIVE_INFINITY });
 //#endregion
-export { sanitizeContext as a, pickVisible as i, normalizeValidity as n, sanitizeFields as o, grantCoversField as r, isActive as t };
+export { grantCoversField as a, sanitizeFields as c, wireValidity as i, normalizeValidity as n, pickVisible as o, readWireValidity as r, sanitizeContext as s, isActive as t };

package/dist/{verifier-DMr_Zmb_.js → verifier-DHuh-okk.js}

@@ -1,6 +1,7 @@
 import { n as isReadonlyArray, t as compact } from "./compact-CAf557ZB.js";
-import { o as isForbiddenKey, u as splitPath } from "./thenable-QSmvt-vZ.js";
-import { t as loadJose } from "./load-jose-BL6LH4bL.js";
+import { n as isForbiddenKey, s as splitPath } from "./paths-DXSHAMIa.js";
+import { p as nowSeconds } from "./time-DkWjdL98.js";
+import { t as loadJose } from "./load-jose-DZ4dnjri.js";
 //#region src/jwt/header.ts
 function compactParts(token) {
 	return token.split(".");
@@ -90,10 +91,11 @@ function assertSafeClaimPaths(claims) {
 		claims.roles,
 		claims.groups,
 		claims.entitlements,
+		claims.plans,
 		claims.tenant,
 		claims.memberships,
 		claims.session
-	].filter((path) => path !== void 0);
+	].filter((path) => typeof path === "string");
 	if (typeof claims.assurance === "string") paths.push(claims.assurance);
 	else if (claims.assurance !== void 0) paths.push(...[
 		claims.assurance.acr,
@@ -128,11 +130,12 @@ function assertVerifierConfig(options) {
 }
 function assertSubjectConfig(options) {
 	if (options.verifier === void 0) {
-		assertVerifierConfig(options);
+		assertVerifierConfig(verifierOptions(options));
 		if (options.jwks !== void 0 && !isSecretJwks(options.jwks) && options.issuer === void 0) throw new Error("PermDock: issuer is required with jwks.");
 	}
 	assertSafeClaimPaths(options.claims);
 	if (options.profile === "fapi2" && options.sender === "none") throw new Error("PermDock: profile 'fapi2' requires a sender constraint.");
+	if (options.verifier === void 0 && options.audience === void 0) throw new Error("PermDock: audience is required; pass audience: false to accept a token minted for any audience.");
 }
 function secretBits(secret) {
 	if (typeof secret === "string") return secret.length * 8;
@@ -142,6 +145,14 @@ function secretBytes(secret) {
 	if (typeof secret === "string") return new TextEncoder().encode(secret);
 	return secret;
 }
+/** The verifier options of a subject config: `audience: false` means none is checked. */
+function verifierOptions(options) {
+	const { audience, ...rest } = options;
+	return audience === false || audience === void 0 ? rest : {
+		...rest,
+		audience
+	};
+}
 //#endregion
 //#region src/jwt/cache.ts
 function clampTtl(seconds, minTtl, maxTtl) {
@@ -297,7 +308,7 @@ function createKeyCache(options) {
 		}
 	};
 	const resolve = async (force, nowInput) => {
-		const now = nowInput ?? Math.floor(Date.now() / 1e3);
+		const now = nowInput ?? nowSeconds();
 		if (options.jwks instanceof URL) return loadJwks(options.jwks.href, now, force);
 		if (typeof options.jwks === "string") return loadJwks(options.jwks, now, force);
 		if (options.jwks !== void 0 && typeof options.jwks === "object" && "keys" in options.jwks) return {
@@ -317,7 +328,7 @@ function createKeyCache(options) {
 			return resolve(false, now);
 		},
 		refetchJwks(now) {
-			const current = now ?? Math.floor(Date.now() / 1e3);
+			const current = now ?? nowSeconds();
 			if (current < cooldownUntil) return resolve(false, current);
 			cooldownUntil = current + cooldown;
 			return resolve(true, current);
@@ -499,4 +510,4 @@ function joseTokenVerifier(options) {
 	}
 }
 //#endregion
-export { decodeHeader as a, issuerFromDiscovery as i, assertSubjectConfig as n, normalizeTyp as o, fail as r, joseTokenVerifier as t };
+export { verifierOptions as a, issuerFromDiscovery as i, assertSubjectConfig as n, decodeHeader as o, fail as r, normalizeTyp as s, joseTokenVerifier as t };