permdock 0.4.0 → 0.6.0

package/dist/{skills-BZdRQkxs.js → skills-B6lVdD_W.js}

@@ -1,6 +1,7 @@
 import { t as byCodePoint } from "./compare-pfyVnBjE.js";
 import { i as readJsonFile } from "./files-D_JIzUrP.js";
-import { t as packageRoot } from "./package-root-DtNnpmUd.js";
+import { t as packageRoot } from "./package-root-Dk_ETdkp.js";
+import { t as didYouMean } from "./args-IIolxxKA.js";
 import { cpSync, existsSync, lstatSync, mkdirSync, readFileSync, readdirSync, readlinkSync, realpathSync, writeFileSync } from "node:fs";
 import { basename, dirname, join, relative, resolve } from "node:path";
 import { createRequire } from "node:module";
@@ -20,13 +21,22 @@ const AGENT_FOLDERS = {
 	claude: ".claude/skills",
 	cursor: ".cursor/skills"
 };
-/** The `--agent` names `skills install` knows, with the folder each writes. */
+/** The `--for` names `skills install` knows, with the folder each writes. */
 const SKILL_AGENTS = AGENT_FOLDERS;
 /** Agents whose config folder (`.claude`, `.cursor`, `.agents`) the project already has. */
 function detectedAgents(cwd) {
 	return Object.entries(AGENT_FOLDERS).filter(([, folder]) => existsSync(join(cwd, dirname(folder)))).map(([agent]) => agent);
 }
 function runSkills(input) {
+	const names = /* @__PURE__ */ new Set([...Object.keys(AGENT_FOLDERS), "agent"]);
+	const unknown = input.agents.find((agent) => !names.has(agent));
+	if (unknown !== void 0) {
+		const suggestion = didYouMean(unknown, Object.keys(AGENT_FOLDERS));
+		return {
+			code: 2,
+			output: `skills: unknown --for '${unknown}'.${suggestion === void 0 ? "" : ` Did you mean ${suggestion}?`} Use ${Object.keys(AGENT_FOLDERS).join(", ")}.`
+		};
+	}
 	switch (input.action) {
 		case void 0:
 		case "install":
@@ -169,10 +179,7 @@ function listSkills(cwd) {
 }
 function resolveTargets(agents) {
 	if (agents.length === 0) return Object.values(AGENT_FOLDERS);
-	return agents.map((agent) => {
-		const key = agent === "agent" ? "agents" : agent;
-		return AGENT_FOLDERS[key] ?? `.${key}/skills`;
-	});
+	return agents.map((agent) => AGENT_FOLDERS[agent === "agent" ? "agents" : agent] ?? ".agents/skills");
 }
 function resolveSkillsRoot(cwd, bundled) {
 	try {

package/dist/skills-CTYwkl44.js

@@ -0,0 +1,51 @@
+import { t as defineLeaf } from "./command-L8EstFNm.js";
+import { t as checkFlag } from "./flags-C3DktBDY.js";
+import { r as pick, t as CANCELLED } from "./prompt-DfZLJLIn.js";
+import { n as detectedAgents, r as runSkills, t as SKILL_AGENTS } from "./skills-B6lVdD_W.js";
+//#region src/cli/commands/skills.ts
+const forFlag = { for: {
+	type: "string",
+	repeatable: true,
+	description: "Agent folders to write: agents, claude or cursor",
+	valueHint: "name",
+	complete: () => Object.keys(SKILL_AGENTS)
+} };
+async function installTo(ctx, action, clients, check) {
+	let agents = clients;
+	if (ctx.interactive && !ctx.yes && !check && agents.length === 0) {
+		const detected = detectedAgents(ctx.cwd);
+		const picked = await pick("Which agents should get the PermDock skills?", Object.entries(SKILL_AGENTS).map(([value, hint]) => ({
+			value,
+			hint
+		})), detected.length > 0 ? detected : Object.keys(SKILL_AGENTS));
+		if (picked === void 0) return CANCELLED;
+		agents = picked;
+	}
+	return runSkills({
+		cwd: ctx.cwd,
+		action,
+		agents,
+		check
+	});
+}
+const install = defineLeaf({
+	flags: {
+		...forFlag,
+		...checkFlag
+	},
+	run: (ctx, { flags }) => installTo(ctx, "install", flags.for, flags.check)
+});
+const update = defineLeaf({
+	flags: { ...forFlag },
+	run: (ctx, { flags }) => installTo(ctx, "update", flags.for, false)
+});
+const list = defineLeaf({
+	flags: {},
+	run: (ctx) => runSkills({
+		cwd: ctx.cwd,
+		action: "list",
+		agents: []
+	})
+});
+//#endregion
+export { install, list, update };

package/dist/snapshot-B7DkYg6g.js

@@ -0,0 +1,269 @@
+import { t as compact } from "./compact-CAf557ZB.js";
+import { n as freezeDeep } from "./freeze-CrU8nQeX.js";
+import { n as isForbiddenKey } from "./paths-DXSHAMIa.js";
+import { c as isConditionRef, i as resolveConditionRef } from "./refs-K6eWUJ0H.js";
+import { l as isRfc3339, m as rfc3339, p as nowSeconds } from "./time-DkWjdL98.js";
+import { d as scopeList } from "./scopes-CUPSjo9q.js";
+import { _ as listPlans, v as listRoles } from "./grantee-hxrUsbpM.js";
+import { i as wireValidity } from "./validity-CZ7-y0Cj.js";
+import { m as tenantsOf } from "./tenancy-DN2QAx9z.js";
+import { n as toWireDelegation } from "./wire-delegation-Cv3W2eaM.js";
+//#region src/conditions/bind.ts
+function isPrimitive(value) {
+	return typeof value === "string" || typeof value === "number" || typeof value === "boolean";
+}
+const ALWAYS = {
+	op: "eq",
+	field: "_",
+	value: true
+};
+const NEVER = {
+	op: "or",
+	conditions: []
+};
+function bindValue(value, subject, only) {
+	if (isConditionRef(value) && only !== void 0 && !only(value.ref)) return value;
+	if (isConditionRef(value)) {
+		const resolved = resolveConditionRef(value.ref, subject);
+		if (Array.isArray(resolved)) return resolved.filter((item) => isPrimitive(item));
+		return isPrimitive(resolved) ? resolved : null;
+	}
+	if (Array.isArray(value)) return value.map((item) => bindValue(item, subject, only));
+	return value;
+}
+function bindArg(arg, subject, only) {
+	return arg !== null && typeof arg === "object" && "field" in arg && !isConditionRef(arg) ? arg : bindValue(arg, subject, only);
+}
+/**
+* Replaces every `principal.*` / `context.*` ref with the subject's value, and
+* a `liveSession` node with a constant, so a `where()` result compiles the
+* same without the subject. A ref the subject
+* does not hold binds to `null` (or `[]` in a list), which never matches, as
+* in `evaluateCondition`. With `only`, refs it rejects stay refs.
+*/
+function bindConditionRefs(condition, subject, only) {
+	switch (condition.op) {
+		case "and":
+		case "or": return {
+			op: condition.op,
+			conditions: condition.conditions.map((child) => bindConditionRefs(child, subject, only))
+		};
+		case "not": return {
+			op: "not",
+			condition: bindConditionRefs(condition.condition, subject, only)
+		};
+		case "in":
+		case "notIn": {
+			const value = condition.value;
+			if (isConditionRef(value) && only !== void 0 && !only(value.ref)) return condition;
+			const bound = bindValue(value, subject, only);
+			return {
+				...condition,
+				value: Array.isArray(bound) ? bound : []
+			};
+		}
+		case "eq":
+		case "ne":
+		case "gt":
+		case "gte":
+		case "lt":
+		case "lte":
+		case "contains": return {
+			...condition,
+			value: bindValue(condition.value, subject, only)
+		};
+		case "sqlFunction": return {
+			...condition,
+			args: condition.args.map((arg) => bindArg(arg, subject, only)),
+			twin: bindConditionRefs(condition.twin, subject, only)
+		};
+		case "liveSession": return subject.liveSession === true ? ALWAYS : NEVER;
+		case "isNull":
+		case "memberOf":
+		case "related":
+		case "opaque": return condition;
+		default: return condition;
+	}
+}
+//#endregion
+//#region src/core/snapshot.ts
+function plainPermission(leaf) {
+	return {
+		key: leaf.key,
+		scope: leaf.scope,
+		resource: leaf.resource,
+		action: leaf.action,
+		meta: leaf.meta,
+		kind: leaf.kind
+	};
+}
+function plainRole(leaf) {
+	return compact({
+		key: leaf.key,
+		on: leaf.on,
+		assignable: leaf.assignable,
+		meta: leaf.meta,
+		kind: leaf.kind
+	});
+}
+function plainPlan(leaf) {
+	return {
+		key: leaf.key,
+		meta: leaf.meta,
+		kind: leaf.kind
+	};
+}
+function snapshotGrant(grant, membership) {
+	const scope = grant.scope === "global" ? void 0 : typeof grant.scope === "string" ? grant.scope : { resource: grant.scope.resource };
+	const entry = compact({
+		permission: grant.permission.key,
+		effect: grant.effect,
+		role: grant.role,
+		to: grant.to,
+		where: grant.portable ? grant.where : void 0,
+		check: grant.portable ? grant.check : void 0,
+		approval: grant.approval,
+		scope,
+		membership,
+		portable: grant.portable ? void 0 : false,
+		fields: grant.fields,
+		validity: wireValidity(grant.validity),
+		name: grant.name,
+		meta: grant.meta,
+		obligations: grant.obligations
+	});
+	return freezeDeep(entry);
+}
+const CARRIED = /* @__PURE__ */ new Set([
+	"id",
+	"roles",
+	"plans",
+	"tenant",
+	"memberships"
+]);
+/** Principal refs the snapshot principal does not carry (`claims`, `teamIds`, …) are bound to the subject's values. */
+function isClaimRef(ref) {
+	const [root, head] = ref.split(".", 2);
+	return root === "principal" && !CARRIED.has(String(head));
+}
+function bindClaims(grant, subject) {
+	if (grant.where === void 0 && grant.check === void 0) return grant;
+	return freezeDeep(compact({
+		...grant,
+		where: grant.where === void 0 ? void 0 : bindConditionRefs(grant.where, subject, isClaimRef),
+		check: grant.check === void 0 ? void 0 : bindConditionRefs(grant.check, subject, isClaimRef)
+	}));
+}
+function notEntitledOf(items) {
+	const seen = /* @__PURE__ */ new Map();
+	for (const { grant } of items) {
+		const key = `${grant.permission.key}\u0000${grant.role ?? ""}`;
+		if (!seen.has(key)) seen.set(key, {
+			permission: grant.permission.key,
+			role: grant.role,
+			to: grant.to
+		});
+	}
+	return seen.size === 0 ? void 0 : [...seen.values()];
+}
+function buildSnapshot(input) {
+	const now = input.now ?? nowSeconds();
+	const principal = input.subject.principal;
+	const allTenants = tenantsOf(principal, scopeList(input.scopes));
+	const tenants = input.tenants === "all" ? allTenants : principal?.tenant === void 0 ? [] : [principal.tenant];
+	const include = input.include;
+	const included = (permission) => include === void 0 || include.length === 0 || include.some((prefix) => permission.key === prefix || permission.key.startsWith(`${prefix}.`) || permission.resource === prefix);
+	const grants = input.grants.filter((item) => included(item.grant.permission)).map((item) => bindClaims(snapshotGrant(item.grant, item.membership), input.subject));
+	const ids = {};
+	for (const item of input.grants) {
+		const name = item.grant.permission.resource;
+		const field = input.idOf?.(name);
+		if (field !== void 0 && field !== "id" && included(item.grant.permission)) ids[name] = field;
+	}
+	const assignableFor = input.assignable;
+	const assignable = assignableFor === void 0 ? [] : tenants.map((tenant) => {
+		const entry = assignableFor(tenant);
+		const permissions = entry.permissions.filter(included).map(plainPermission);
+		if (entry.levels === void 0) return {
+			...entry,
+			permissions
+		};
+		const keys = new Set(permissions.map((leaf) => leaf.key));
+		const levels = Object.fromEntries(Object.entries(entry.levels).filter(([key]) => keys.has(key)));
+		return compact({
+			...entry,
+			permissions,
+			levels: Object.keys(levels).length === 0 ? void 0 : levels
+		});
+	});
+	return freezeDeep(compact({
+		v: 1,
+		issuedAt: rfc3339(now),
+		subject: compact({
+			principal: principal === null ? null : compact({
+				id: principal.id,
+				roles: principal.roles ?? [],
+				plans: principal.plans,
+				tenant: principal.tenant,
+				memberships: principal.memberships
+			}),
+			delegation: toWireDelegation(snapshotDelegation(input.subject, input.delegated !== void 0)),
+			context: input.subject.context
+		}),
+		roles: input.roles,
+		audiences: input.audiences,
+		grants,
+		tenants,
+		include,
+		simulated: input.simulated === true ? true : void 0,
+		expiresAt: input.subject.expiresAt === void 0 ? void 0 : rfc3339(input.subject.expiresAt),
+		scopes: input.scopes,
+		ids: Object.keys(ids).length === 0 ? void 0 : ids,
+		assignable: assignable.length > 0 ? assignable : void 0,
+		delegated: input.delegated === void 0 ? void 0 : [...input.delegated].toSorted(),
+		notEntitled: notEntitledOf((input.notEntitled ?? []).filter((item) => included(item.grant.permission))),
+		vocabulary: input.vocabulary === void 0 ? void 0 : compact({
+			roles: listRoles(input.vocabulary.roles).length === 0 ? void 0 : Object.fromEntries(listRoles(input.vocabulary.roles).map((leaf) => [leaf.key, plainRole(leaf)])),
+			plans: listPlans(input.vocabulary.plans).length === 0 ? void 0 : Object.fromEntries(listPlans(input.vocabulary.plans).map((leaf) => [leaf.key, plainPlan(leaf)]))
+		})
+	}));
+}
+/**
+* The token delegation as the client sees it. An actor with no token
+* delegation gets an empty `scopes` list so the client ceiling agrees with
+* `no-delegation`, unless a policy delegation applies (`delegated`), which
+* then is the ceiling.
+*/
+function snapshotDelegation(subject, delegated) {
+	const delegation = subject.delegation;
+	if (subject.actor === void 0 || delegated) return delegation;
+	if (delegation?.scopes === void 0 && delegation?.authorizationDetails === void 0 && delegation?.access === void 0) return {
+		...delegation,
+		scopes: []
+	};
+	return delegation;
+}
+function rejectUnsafe(value, path) {
+	if (value === null || typeof value !== "object") return;
+	if (Array.isArray(value)) {
+		for (const [index, item] of value.entries()) rejectUnsafe(item, `${path}[${index}]`);
+		return;
+	}
+	for (const key of Object.keys(value)) {
+		if (isForbiddenKey(key)) throw new Error(`PermDock: unsafe snapshot key '${key}' at ${path}`);
+		rejectUnsafe(value[key], `${path}.${key}`);
+	}
+}
+function parseSnapshot(json) {
+	const input = typeof json === "string" ? JSON.parse(json) : json;
+	if (input === null || typeof input !== "object" || Array.isArray(input)) throw new Error("PermDock: snapshot must be an object");
+	const value = typeof json === "string" || Object.isFrozen(input) ? input : JSON.parse(JSON.stringify(input));
+	rejectUnsafe(value, "$");
+	const record = value;
+	const version = record["v"];
+	if (version !== 1) throw new Error(`PermDock: unsupported snapshot version '${String(version)}'`);
+	if (!isRfc3339(record["issuedAt"]) || record["expiresAt"] !== void 0 && !isRfc3339(record["expiresAt"])) throw new Error("PermDock: snapshot times must be RFC 3339");
+	return freezeDeep(value);
+}
+//#endregion
+export { bindConditionRefs as i, parseSnapshot as n, snapshotGrant as r, buildSnapshot as t };

package/dist/{snapshot-cache-Cod40D-X.js → snapshot-cache-DZHQ0KF6.js}

@@ -1,5 +1,10 @@
-import { n as payloadDigest } from "./token-Bx9qy30p.js";
+import { g as secondsOf, p as nowSeconds } from "./time-DkWjdL98.js";
+import { n as payloadDigest } from "./token-BLZcjQgt.js";
 //#region src/core/snapshot-cache.ts
+/** Seconds since the epoch of a NumericDate or an RFC 3339 instant. */
+function epochSeconds(value) {
+	return typeof value === "number" ? value : secondsOf(value);
+}
 /**
 * `{ stale }` in seconds: `max` when the value never expires, otherwise the seconds left, clamped
 * to `[min, max]`. A value with less than `min` seconds left gets its real remainder, so Next.js
@@ -8,10 +13,11 @@ import { n as payloadDigest } from "./token-Bx9qy30p.js";
 function cacheLifeFor(value, options = {}) {
 	const min = options.min ?? 30;
 	const max = Math.max(options.max ?? 300, min);
-	const expiresAt = value?.expiresAt;
-	if (expiresAt === void 0 || expiresAt === null) return { stale: max };
-	const issuedAt = value?.issuedAt !== void 0 && value.issuedAt > 0 ? value.issuedAt : void 0;
-	const now = options.now ?? issuedAt ?? Math.floor(Date.now() / 1e3);
+	const expiresAt = epochSeconds(value?.expiresAt);
+	if (expiresAt === void 0) return { stale: max };
+	const issued = epochSeconds(value?.issuedAt);
+	const issuedAt = issued !== void 0 && issued > 0 ? issued : void 0;
+	const now = options.now === void 0 ? issuedAt ?? nowSeconds() : nowSeconds(options.now);
 	const remaining = Math.floor(expiresAt - now);
 	if (remaining < min) return { stale: Math.max(0, remaining) };
 	return { stale: Math.min(max, remaining) };

package/dist/{snapshot-cache-J5T7t_vD.d.ts → snapshot-cache-PXI-vGpY.d.ts}

@@ -1,12 +1,12 @@
-import { an as Snapshot } from "./policy-types-sp9P1iIV.js";
+import { Rt as Instant, Vt as Snapshot } from "./policy-types-n0uRTsW8.js";
 //#region src/core/snapshot-cache.d.ts
 type CacheLifeForOptions = {
   /** Lower bound in seconds. Next.js includes a private entry in per-link prefetches from 30. */
   readonly min?: number;
   /** Upper bound in seconds. Next.js keeps a per-session App Shell entry from 300. */
   readonly max?: number;
-  /** Seconds since the epoch; defaults to the snapshot's `issuedAt`, then the clock. */
-  readonly now?: number;
+  /** Defaults to the snapshot's `issuedAt`, then the clock. */
+  readonly now?: Instant;
 };
 /**
  * `{ stale }` in seconds: `max` when the value never expires, otherwise the seconds left, clamped
@@ -14,8 +14,10 @@ type CacheLifeForOptions = {
  * leaves it out of prefetches and an HTTP cache does not serve it past `expiresAt`.
  */
 declare function cacheLifeFor(value: {
-  readonly expiresAt?: number | null;
-  readonly issuedAt?: number;
+  /** RFC 3339, or a NumericDate. */
+  readonly expiresAt?: number | string | null;
+  /** RFC 3339, or a NumericDate. */
+  readonly issuedAt?: number | string;
 } | null, options?: CacheLifeForOptions): {
   readonly stale: number;
 };

package/dist/solid/index.d.ts

@@ -1,11 +1,10 @@
-import { Dr as Membership, an as Snapshot, ir as Decision, rr as ApprovalRequiredDecision, ur as GrantedDecision, ut as TokenVerifier } from "../policy-types-sp9P1iIV.js";
-import { d as Permission } from "../permission-types-Dg39z9Kv.js";
-import { r as Role } from "../vocabulary-hhEFLFoL.js";
-import { n as requiredPlans } from "../problem-details-rIIo8B2C.js";
-import { i as describe, r as DescribeOptions, t as DecisionDescription } from "../describe-C3ldA9os.js";
+import { Mn as ApprovalRequiredDecision, Nn as Decision, Vt as Snapshot, dt as TokenVerifier, nr as Membership, zn as GrantedDecision } from "../policy-types-n0uRTsW8.js";
+import { r as Role, w as Permission } from "../vocabulary-CN8H_9UF.js";
+import { n as requiredPlans } from "../problem-details-B45V5d2b.js";
+import { i as describe, r as DescribeOptions, t as DecisionDescription } from "../describe-B5qgDvEW.js";
 import { t as PermissionBoundaryState } from "../boundary-BmHxVH1J.js";
-import { t as approvalHeaders } from "../headers-Cf-zWvsO.js";
-import { a as ClientPermDock, c as PermissionSet, d as SubjectView, f as TenantView, i as ApprovalState, l as PermissionState, o as ClientStatus, p as UseRolesOptions, r as ApprovalHandle, s as FilterResult, u as ProviderOptionsBase } from "../store-9KO4BlkB.js";
+import { t as approvalHeaders } from "../headers-CIbDTUTK.js";
+import { a as FilterResult, c as PermissionSet, d as RolesOptions, f as SubjectView, i as ClientStatus, l as PermissionState, n as ApprovalState, p as TenantView, r as ClientPermDock, t as ApprovalHandle, u as ProviderOptionsBase } from "../types-B3_ooZgZ.js";
 import { Accessor, Accessor as Accessor$1, JSX } from "solid-js";
 //#region src/solid/types.d.ts
 /** Structural `JSX.Element`: text, a DOM node or a list of children. */
@@ -31,7 +30,7 @@ type PermDockProviderProps = ProviderOptionsBase & {
 /** Provider-wide content for the `<Protected>` slots a component leaves out. */
 type PermDockDefaults = {
   readonly pending?: SolidChild;
-  readonly fallback?: SolidChild | ((decision: Decision) => SolidChild);
+  readonly denied?: SolidChild | ((decision: Decision) => SolidChild);
   readonly approval?: SolidChild | ((decision: ApprovalRequiredDecision) => SolidChild);
 };
 type PermissionBoundaryProps = {
@@ -46,8 +45,8 @@ type ProtectedProps = {
   readonly data?: unknown;
   readonly tenant?: string;
   readonly pending?: SolidChild;
-  readonly fallback?: SolidChild | ((decision: Decision) => SolidChild);
-  /** Rendered for an approval-required decision; defaults to `fallback`. */
+  readonly denied?: SolidChild | ((decision: Decision) => SolidChild);
+  /** Rendered for an approval-required decision; defaults to `denied`. */
   readonly approval?: SolidChild | ((decision: ApprovalRequiredDecision) => SolidChild);
   readonly children: SolidChild | ((decision: GrantedDecision) => SolidChild);
 };
@@ -59,7 +58,7 @@ export declare function usePermissions(permissions: Accessor<readonly Permission
 export declare function useFilter<T>(permission: Permission<string, T, "instance">, rows: Accessor<readonly T[]>): Accessor<FilterResult<T>>;
 export declare function useTenant(): Accessor<TenantView>;
 export declare function useMemberships(): Accessor<readonly Membership[]>;
-export declare function useRoles(options?: Accessor<UseRolesOptions>): Accessor<{
+export declare function useRoles(options?: Accessor<RolesOptions>): Accessor<{
   readonly roles: readonly Role[];
 }>;
 export declare function useAssignableRoles(): Accessor<readonly Role[]>;
@@ -90,4 +89,4 @@ export declare function Protected(props: ProtectedProps): JSX.Element;
 //#region src/solid/provider.d.ts
 export declare function PermDockProvider(props: PermDockProviderProps): JSX.Element;
 //#endregion
-export { type ApprovalHandle, type ApprovalState, type ClientPermDock, type ClientStatus, type FilterResult, type PermDockDefaults, type PermDockProviderProps, type PermissionBoundaryProps, type PermissionBoundaryState, type PermissionSet, type PermissionState, type ProtectedProps, type SolidChild, type SubjectView, type TenantView, type UseRolesOptions, approvalHeaders, describe, requiredPlans };
+export { type ApprovalHandle, type ApprovalState, type ClientPermDock, type ClientStatus, type FilterResult, type PermDockDefaults, type PermDockProviderProps, type PermissionBoundaryProps, type PermissionBoundaryState, type PermissionSet, type PermissionState, type ProtectedProps, type RolesOptions, type SolidChild, type SubjectView, type TenantView, approvalHeaders, describe, requiredPlans };

package/dist/solid/index.js

@@ -1,11 +1,11 @@
 import { t as compact } from "../compact-CAf557ZB.js";
-import { r as requiredPlans } from "../problem-details-DECUnXAn.js";
-import { t as describe } from "../describe-Cgkp7eP0.js";
-import { t as approvalHeaders } from "../headers-BZSDieNT.js";
-import { i as isPromiseLike } from "../store-options-CbUHDoSe.js";
-import { a as permissionSet, c as scopedTenant, d as tenantView, i as livePermDock, l as slotContent, n as describeWith, o as protectedView, r as filterResult, s as rolesView, t as approvalHandle, u as subjectView } from "../views-CJsrBS1f.js";
+import { r as requiredPlans } from "../problem-details-cn5X30gZ.js";
+import { t as describe } from "../describe-BybMRY7A.js";
 import { n as boundaryFallback, t as boundaryDigest } from "../boundary-BM8a_P6E.js";
-import { n as switchTenant, t as providerStore } from "../provider-store-Ctt-81Ni.js";
+import { t as approvalHeaders } from "../headers-BIjfMaoC.js";
+import { i as isPromiseLike } from "../store-options-u0ycEe8s.js";
+import { n as switchTenant, t as providerStore } from "../provider-store-DM6DNcta.js";
+import { a as livePermDock, c as rolesView, d as subjectView, f as tenantView, l as scopedTenant, n as describeWith, o as permissionSet, r as filterResult, s as protectedView, t as approvalHandle, u as slotContent } from "../views-DTIIO-oQ.js";
 import { ErrorBoundary, createComponent, createComputed, createContext, createMemo, createSignal, getOwner, on, onCleanup, useContext } from "solid-js";
 //#region src/solid/context.ts
 const PermDockContext = createContext(void 0);
@@ -138,7 +138,7 @@ function Protected(props) {
 		const current = view();
 		switch (current.slot) {
 			case "pending": return slotContent("pending", props, ui.defaults) ?? null;
-			case "fallback": return content(slotContent("fallback", props, ui.defaults), current.decision);
+			case "denied": return content(slotContent("denied", props, ui.defaults), current.decision);
 			case "approval": return content(slotContent("approval", props, ui.defaults), current.decision);
 			case "default": return typeof props.children === "function" ? props.children(current.decision) : props.children;
 			default: return current;

package/dist/solid-start/index.d.ts

@@ -0,0 +1,52 @@
+import { T as Policy, Vt as Snapshot, j as PolicyVocabulary, rr as Principal } from "../policy-types-n0uRTsW8.js";
+import { w as Permission } from "../vocabulary-CN8H_9UF.js";
+import { a as OperationInput, t as Operation } from "../operations-X0VM7F3m.js";
+import { r as PermDock } from "../permdock-SV8ZINYT.js";
+import { D as ConnectionOptions, T as Connection, f as InvalidSignatureError, i as OpenApiHooks, o as ProtectOptions, u as SnapshotQuery, v as discoverViaSignatureAgent, x as webBotAuthVerifier } from "../server-types-CKQiCnON.js";
+import { a as ProtectTarget, n as FetchAdapterOptions, t as ContextReader } from "../fetch-adapter-Dw0MTS3D.js";
+import { APIEvent, FetchEvent } from "@solidjs/start/server";
+//#region src/solid-start/create.d.ts
+/** The h3 event under every SolidStart request; `subject` and `scope` read it. */
+type SolidStartNativeEvent = FetchEvent["nativeEvent"];
+/** An h3 middleware for `createMiddleware([...])` in `src/middleware.ts`. */
+type SolidStartMiddleware = (event: SolidStartNativeEvent, next: () => unknown) => Promise<unknown>;
+type SolidStartPermDockOptions<TUser = unknown> = FetchAdapterOptions<SolidStartNativeEvent, TUser>;
+/** What the adapter sets on `event.locals`. */
+type SolidStartPermDockLocals<TData = unknown, V extends PolicyVocabulary = PolicyVocabulary> = {
+  readonly permdock: PermDock<V>;
+  readonly permdockData: TData;
+};
+/** The event a wrapped API route receives: its own `APIEvent` with typed `locals`. */
+type SolidStartPermDockEvent<TEvent extends FetchEvent = APIEvent, TData = unknown, V extends PolicyVocabulary = PolicyVocabulary> = TEvent & {
+  readonly locals: SolidStartPermDockLocals<TData, V>;
+};
+/** Wraps an API route handler. */
+type SolidStartGuarded<TData, V extends PolicyVocabulary = PolicyVocabulary> = <TEvent extends FetchEvent = APIEvent, R = Response>(handler: (event: SolidStartPermDockEvent<TEvent, TData, V>) => R | Promise<R>) => (event: TEvent) => Promise<R | Response>;
+type SolidStartProtect<V extends PolicyVocabulary = PolicyVocabulary> = {
+  <T = unknown>(permission: Permission | null, data?: ContextReader<APIEvent, T | null | undefined>, protectOptions?: ProtectOptions): SolidStartGuarded<NonNullable<T>, V>;
+  <TOperation extends Operation>(operation: TOperation, input?: ContextReader<APIEvent, OperationInput<TOperation>>, protectOptions?: ProtectOptions): SolidStartGuarded<unknown, V>;
+};
+/** The decision endpoint, one API route handler per method. */
+type SolidStartPermDockHandlers = {
+  readonly GET: (event: FetchEvent) => Promise<Response>;
+  readonly POST: (event: FetchEvent) => Promise<Response>;
+};
+type SolidStartPermDock<V extends PolicyVocabulary = PolicyVocabulary> = {
+  /** Sets `event.context.permdock` on the h3 event; a bad Web Bot Auth signature is a `401`. */
+  readonly middleware: () => SolidStartMiddleware;
+  /** `export const DELETE = protect(permissions.post.delete, loadPost)(handler)`. */
+  readonly protect: SolidStartProtect<V>;
+  /** Types `event.locals.permdock` for an API route and answers a thrown PermDock error with Problem Details. */
+  readonly withPermDock: SolidStartGuarded<unknown, V>;
+  /** The instance for an API route, or a server function through `getRequestEvent()`. */
+  readonly getPermDock: (event: FetchEvent) => Promise<PermDock<V>>;
+  /** The snapshot a route `query` returns for `permdock/solid`. */
+  readonly getSnapshot: (event: FetchEvent, query?: SnapshotQuery) => Promise<Snapshot>;
+  readonly connection: (event: FetchEvent, connectionOptions?: ConnectionOptions) => Promise<Connection>;
+  /** `export const { GET, POST } = permdockHandler()` in `src/routes/api/permdock.ts`. */
+  readonly permdockHandler: () => SolidStartPermDockHandlers;
+  readonly openapi: OpenApiHooks;
+};
+export declare function createPermDock<TUser, TPrincipal extends Principal = Principal, V extends PolicyVocabulary = PolicyVocabulary>(policy: Policy<TUser, TPrincipal, V>, options: SolidStartPermDockOptions<TUser>): SolidStartPermDock<V>;
+//#endregion
+export { type ContextReader, InvalidSignatureError, type ProtectTarget, type SolidStartGuarded, type SolidStartMiddleware, type SolidStartNativeEvent, type SolidStartPermDock, type SolidStartPermDockEvent, type SolidStartPermDockHandlers, type SolidStartPermDockLocals, type SolidStartPermDockOptions, type SolidStartProtect, discoverViaSignatureAgent, webBotAuthVerifier };

package/dist/solid-start/index.js

@@ -0,0 +1,49 @@
+import { d as discoverViaSignatureAgent, m as webBotAuthVerifier, u as InvalidSignatureError } from "../evaluations-beAooV0n.js";
+import { i as decorate } from "../bind-CAvgUuKs.js";
+import { n as guardedRoute, t as fetchAdapter } from "../fetch-adapter-DD_gfmrC.js";
+//#region src/solid-start/create.ts
+/**
+* `event.locals`. Its type, `App.RequestEventLocals`, is declared by
+* `@solidjs/start/env`, which only an app's own `tsconfig` loads.
+*/
+function localsOf(event) {
+	return Reflect.get(event, "locals");
+}
+const route = {
+	context: (event) => event.nativeEvent,
+	locals: localsOf
+};
+function createPermDock(policy, options) {
+	const adapter = fetchAdapter(policy, options, "solid-start", (event) => event.req);
+	const middleware = () => async (event, next) => {
+		const attached = await adapter.ensure(event.context, event);
+		if (!attached.ok) return attached.response;
+		return adapter.mapErrors(event, next);
+	};
+	const protect = ((target, data, protectOptions) => guardedRoute(adapter, route, target, data, protectOptions));
+	const withPermDock = (handler) => async (event) => {
+		const attached = await adapter.ensure(event.nativeEvent.context, event.nativeEvent);
+		if (!attached.ok) return attached.response;
+		decorate(localsOf(event), attached.permdock);
+		return adapter.mapErrors(event.nativeEvent, () => handler(event));
+	};
+	const handlers = () => {
+		const { GET, POST } = adapter.handlers();
+		return {
+			GET: (event) => GET(event.nativeEvent),
+			POST: (event) => POST(event.nativeEvent)
+		};
+	};
+	return {
+		middleware,
+		protect,
+		withPermDock,
+		getPermDock: (event) => adapter.getPermDock(event.nativeEvent),
+		getSnapshot: (event, query) => adapter.getSnapshot(event.nativeEvent, query),
+		connection: (event, connectionOptions) => adapter.connection(event.nativeEvent, connectionOptions),
+		permdockHandler: handlers,
+		openapi: adapter.kernel.openapi
+	};
+}
+//#endregion
+export { InvalidSignatureError, createPermDock, discoverViaSignatureAgent, webBotAuthVerifier };

package/dist/{sources-Dljy06zL.d.ts → sources-Xc4zkszI.d.ts}

@@ -1,6 +1,6 @@
-import { Z as MembershipSource } from "./policy-types-sp9P1iIV.js";
-import { n as RoleThrough, y as SupabaseSuspension } from "./types-CqrjB9o6.js";
-import { o as SupabaseManifestMembership } from "./manifest-uDS9y5de.js";
+import { et as MembershipSource } from "./policy-types-n0uRTsW8.js";
+import { n as RoleThrough, y as SupabaseSuspension } from "./types-BzzaHxt3.js";
+import { o as SupabaseManifestMembership } from "./manifest-mx5ghSFM.js";
 //#region src/supabase/roles.d.ts
 /** A roles table a role column references, by `schema.table`. */
 type RoleKeys = {
@@ -163,26 +163,20 @@ type SqlMembershipSource = MembershipSource & {
 type SupabasePostgres = {
   readonly queryRaw: (text: string, params?: unknown[]) => Promise<readonly Record<string, unknown>[]>;
 };
-/**
- * `ctx.postgres` (from `withPostgresClient`) or `ctx.postgresAdmin` as a
- * `SqlQuery` for `fromTable`, `fromJunction` and `supabaseApprovalStore`.
- * `ctx.postgres` runs as the caller under RLS, so the membership tables must
- * be readable by `authenticated`; `ctx.postgresAdmin` bypasses RLS.
- */
-declare function fromSupabasePostgres(postgres: SupabasePostgres): SqlQuery;
+declare function supabasePostgresQuery(postgres: SupabasePostgres): SqlQuery;
 /**
  * Memberships from one table holding every scope: a row per user, scope,
  * instance and role (`user_id, scope, scope_id, role`), with optional
  * `within`, `via`, expiry, owner and seat columns. Rows of the same instance
  * merge into one membership.
  */
-declare function fromTable(options: MembershipTableOptions): SqlMembershipSource;
+declare function tableMembershipSource(options: MembershipTableOptions): SqlMembershipSource;
 /**
  * Memberships from a table of one scope (`customer_contacts`): every row is a
  * membership of `scope`, with roles from a column or fixed (`['contact']`), a
  * fixed `via`, and ancestor ids from `within` columns.
  */
-declare function fromJunction(options: MembershipJunctionOptions): SqlMembershipSource;
+declare function junctionMembershipSource(options: MembershipJunctionOptions): SqlMembershipSource;
 declare const AUTHZ_VERSION_TABLE = "permdock_authz_version";
 /**
  * Reads the authorization version `permdock supabase hook generate` keeps in
@@ -193,4 +187,4 @@ declare function authzVersion(options: {
   readonly schema?: string;
 }): NonNullable<MembershipSource["version"]>;
 //#endregion
-export { MembershipTableOptions as a, SupabasePostgres as c, fromSupabasePostgres as d, fromTable as f, MembershipSql as i, authzVersion as l, MembershipHolders as n, SqlMembershipSource as o, MembershipJunctionOptions as r, SqlQuery as s, AUTHZ_VERSION_TABLE as t, fromJunction as u };
+export { MembershipTableOptions as a, SupabasePostgres as c, supabasePostgresQuery as d, tableMembershipSource as f, MembershipSql as i, authzVersion as l, MembershipHolders as n, SqlMembershipSource as o, MembershipJunctionOptions as r, SqlQuery as s, AUTHZ_VERSION_TABLE as t, junctionMembershipSource as u };