permdock 0.4.0 → 0.6.0

package/dist/supabase-hook-CCw5m35C.js

@@ -0,0 +1 @@
+export { i as runSupabase } from "./supabase-hook-BMoEhZir.js";

package/dist/{supabase-C1TWlnYt.js → supabase-x5JtR2tc.js}

@@ -1,13 +1,14 @@
 import { r as isRecord, t as compact } from "./compact-CAf557ZB.js";
-import { t as canonicalJson } from "./canonical-json-CFKyFOke.js";
-import { o as parseCapability } from "./capability-txATtKV4.js";
-import { t as ApprovalError } from "./errors-DRnGZHzF.js";
-import { a as decodeApprovalCursor, i as approvalPageSize, o as encodeApprovalCursor, t as applyApprovalVerdict } from "./store-ILkLUj_o.js";
-import { t as loadJose } from "./load-jose-BL6LH4bL.js";
+import { d as isoNow, i as dateAt, p as nowSeconds, u as isoAt } from "./time-DkWjdL98.js";
+import { t as canonicalJson } from "./canonical-json-BC8_nMTw.js";
+import { s as ApprovalError } from "./types-DqzsnlSA.js";
+import { a as approvalPageSize, o as decodeApprovalCursor, s as encodeApprovalCursor, t as applyApprovalVerdict } from "./store-BDutJkDL.js";
+import { a as parseCapability } from "./capability-N1K9IpqS.js";
+import { t as loadJose } from "./load-jose-DZ4dnjri.js";
 import "./budget-NbEtbJC_.js";
-import { a as quoteSqlIdent, i as quoteQualifiedTable, l as sqlTextArray, o as quoteSqlLiteral, r as qualifySqlTable, s as quoteSqlTable } from "./sql-t8teWOfo.js";
-import { c as hookApiNames, d as keptKeys, l as roleColumn } from "./sources-B1-b-R0t.js";
-import { i as readMemberships } from "./manifest-BngWKryL.js";
+import { a as quoteQualifiedTable, c as quoteSqlTable, i as qualifySqlTable, o as quoteSqlIdent, s as quoteSqlLiteral, u as sqlTextArray } from "./sql-B5T1IL83.js";
+import { d as keptKeys, l as roleColumn } from "./sources-vs5dGOsS.js";
+import { t as callRpc } from "./postgrest-DAjUkF9w.js";
 //#region src/supabase/capability.ts
 const DEFAULT_TTL = 300;
 const MAX_TTL = 3600;
@@ -29,15 +30,19 @@ async function exchangeCapability(subject, options) {
 	if (principal === null || principal.kind !== "link") return;
 	const capability = parseCapability(principal["capability"]);
 	if (capability?.holder !== "link" || capability.id !== principal.id) return;
-	const now = Math.floor(options.now ?? Date.now() / 1e3);
+	const now = nowSeconds(options.now);
 	const ttl = Math.min(Math.max(1, options.ttl ?? DEFAULT_TTL), MAX_TTL);
 	const exp = Math.min(now + ttl, Math.floor(capability.expiresAt));
 	if (exp <= now) return;
+	const { id: _id, expiresAt: _expiresAt, cnf: _cnf, ...claim } = capability;
 	const jose = await loadJose();
 	const key = isSecret(options.key) ? new TextEncoder().encode(options.key.secret) : await jose.importJWK(options.key, alg);
 	const jwt = new jose.SignJWT({
 		role: "anon",
-		capability
+		capability: {
+			...claim,
+			expires_at: exp
+		}
 	}).setProtectedHeader(secret ? {
 		alg: "HS256",
 		typ: "JWT"
@@ -93,14 +98,14 @@ function checkMembership(item, path, issues) {
 		"tenant",
 		"team",
 		"via",
-		"grantedBy",
+		"granted_by",
 		"reason"
 	]) optional(item, key, path, issues, isString, "a string");
 	optional(item, "within", path, issues, (value) => isRecord(value) && Object.values(value).every((id) => typeof id === "string"), "an object of string ids");
 	optional(item, "on", path, issues, (value) => isRecord(value) && typeof own(value, "resource") === "string" && typeof own(value, "id") === "string", "an object with string resource and id");
-	optional(item, "expiresAt", path, issues, (value) => typeof value === "number" && Number.isFinite(value), "a number of seconds since the epoch");
+	optional(item, "expires_at", path, issues, (value) => typeof value === "number" && Number.isFinite(value), "a number of seconds since the epoch");
 	optional(item, "member", path, issues, (value) => isRecord(value) && typeof own(value, "group") === "string" && own(value, "group") !== "", "an object with a non-empty string group");
-	optional(item, "managedBy", path, issues, (value) => value === "idp", "'idp'");
+	optional(item, "managed_by", path, issues, (value) => value === "idp", "'idp'");
 	optional(item, "entitlements", path, issues, isStrings, "an array of strings");
 	optional(item, "keep", path, issues, isStrings, "an array of strings");
 	optional(item, "grants", path, issues, isRecord, "an object");
@@ -123,14 +128,20 @@ function checkPermDockClaims(record, tenantClaim, path, issues) {
 	optional(record, "attrs", path, issues, isRecord, "an object");
 	optional(record, "authz_ver", path, issues, (value) => Number.isInteger(value), "an integer");
 }
-/** The outer level's `kind`: none, `support` with a `session_id`, or `impersonation`. */
+/** The outer level's `kind`: none, `support` with a `session_id`, `impersonation`, or `agent` with optional `tools` and `read_only` and no `session_id`. */
 function checkActKind(level, path, issues) {
 	const marked = own(level, "kind");
 	const kind = marked === void 0 && own(level, "session_id") !== void 0 ? "support" : marked;
 	optional(level, "reason", path, issues, isString, "a string");
 	if (kind === void 0 || kind === "impersonation") return;
+	if (kind === "agent") {
+		if (own(level, "session_id") !== void 0) issue(issues, [...path, "session_id"], "Expected no session_id on an agent level");
+		optional(level, "tools", path, issues, (value) => isStrings(value) && value.every((tool) => tool !== ""), "an array of non-empty strings");
+		optional(level, "read_only", path, issues, (value) => typeof value === "boolean", "a boolean");
+		return;
+	}
 	if (kind !== "support") {
-		issue(issues, [...path, "kind"], "Expected 'support' or 'impersonation'");
+		issue(issues, [...path, "kind"], "Expected 'support', 'impersonation' or 'agent'");
 		return;
 	}
 	const session = own(level, "session_id");
@@ -222,187 +233,6 @@ function supabaseClaims(options = {}) {
 	});
 }
 //#endregion
-//#region src/supabase/postgrest.ts
-function callRpc(client, schema, fn, args) {
-	return client.schema(schema).rpc(fn, args);
-}
-function strings(value) {
-	return Array.isArray(value) ? value.filter((item) => typeof item === "string") : [];
-}
-function grantOf(value) {
-	if (!isRecord(value) || typeof value["permission"] !== "string") return;
-	return compact({
-		permission: value["permission"],
-		effect: value["effect"] === "deny" ? "deny" : "allow",
-		level: typeof value["level"] === "string" ? value["level"] : void 0
-	});
-}
-function customRoleOf(value) {
-	if (!isRecord(value) || typeof value["name"] !== "string") return;
-	const grants = Array.isArray(value["grants"]) ? value["grants"].flatMap((item) => {
-		const grant = grantOf(item);
-		return grant === void 0 ? [] : [grant];
-	}) : [];
-	const includes = strings(value["includes"]);
-	const body = {
-		name: value["name"],
-		grants,
-		...includes.length === 0 ? {} : { includes }
-	};
-	if (value["scope"] === "global") return value["tenant"] === void 0 ? {
-		...body,
-		scope: "global"
-	} : void 0;
-	if (typeof value["tenant"] !== "string") return;
-	return compact({
-		...body,
-		tenant: value["tenant"],
-		scope: typeof value["scope"] === "string" ? value["scope"] : void 0,
-		id: typeof value["id"] === "string" ? value["id"] : void 0
-	});
-}
-function readMemberEntries(value) {
-	if (!Array.isArray(value)) return [];
-	return value.flatMap((item) => {
-		if (!isRecord(item) || !isRecord(item["principal"])) return [];
-		const id = item["principal"]["id"];
-		const [membership] = readMemberships([item["membership"]]).memberships;
-		return typeof id === "string" && id !== "" && membership !== void 0 ? [{
-			principal: { id },
-			membership
-		}] : [];
-	});
-}
-function versionOf(value) {
-	const version = typeof value === "string" ? Number(value) : value;
-	return typeof version === "number" && Number.isFinite(version) ? version : void 0;
-}
-/** Reads `subject_for`'s JSON; anything it cannot read is left out, and a malformed record is no record. */
-function readSubjectRecord(value) {
-	if (!isRecord(value) || typeof value["id"] !== "string") return;
-	if (value["active"] !== true) return {
-		id: value["id"],
-		active: false,
-		roles: [],
-		memberships: [],
-		customRoles: []
-	};
-	const version = value["authzVersion"];
-	return compact({
-		id: value["id"],
-		active: true,
-		roles: strings(value["roles"]),
-		memberships: readMemberships(value["memberships"]).memberships,
-		customRoles: Array.isArray(value["customRoles"]) ? value["customRoles"].flatMap((item) => {
-			const role = customRoleOf(item);
-			return role === void 0 ? [] : [role];
-		}) : [],
-		authzVersion: typeof version === "number" && Number.isFinite(version) ? version : void 0
-	});
-}
-/**
-* Membership, custom-role and subject sources over the `subject_for(p_user)`,
-* `authz_version_for(p_user)` and `members_of(p_scope, p_id)` functions
-* `permdock supabase hook generate` writes, for a backend that reaches
-* Postgres only through PostgREST. `memberships.version` reads only the
-* version, so `claimsFirst` with `onStale: 'reread'` reads the full subject
-* only for a stale token; when the version function is missing it falls back
-* to `subject_for`. With `policy`, a token that claims a custom role has its
-* subject read in one `subject_for` call instead, and custom roles are read
-* only for a subject that holds one. Each user and each instance is read once per
-* `postgrestSources` call, so create it per request or per job.
-*/
-function postgrestSources(client, options = {}) {
-	const api = options.api;
-	const names = api === void 0 ? void 0 : hookApiNames(api.prefix);
-	const schema = options.schema ?? (api === void 0 ? "permdock" : api.schema ?? "public");
-	const fn = options.fn ?? names?.subjectFor ?? "subject_for";
-	const membersFn = options.membersFn ?? names?.membersOf ?? "members_of";
-	const versionFn = options.versionFn ?? names?.authzVersionFor ?? "authz_version_for";
-	const declared = options.policy === void 0 ? void 0 : options.policy.index.declaredRoles;
-	const onlyDeclared = (held) => declared !== void 0 && held?.every((name) => declared.has(name)) === true;
-	const loaded = /* @__PURE__ */ new Map();
-	const versions = /* @__PURE__ */ new Map();
-	const listed = /* @__PURE__ */ new Map();
-	const list = (query) => {
-		const key = JSON.stringify([query.scope, query.id]);
-		const cached = listed.get(key);
-		if (cached !== void 0) return cached.then((entries) => [...entries]);
-		const pending = Promise.resolve(callRpc(client, schema, membersFn, {
-			p_scope: query.scope,
-			p_id: query.id
-		})).then((result) => {
-			if (result.error !== null) throw new Error(`PermDock: ${schema}.${membersFn} failed: ${result.error.message}`);
-			return readMemberEntries(result.data);
-		});
-		listed.set(key, pending);
-		return pending.then((entries) => [...entries]);
-	};
-	const record = (userId) => {
-		const cached = loaded.get(userId);
-		if (cached !== void 0) return cached;
-		const pending = Promise.resolve(callRpc(client, schema, fn, { p_user: userId })).then((result) => {
-			if (result.error !== null) throw new Error(`PermDock: ${schema}.${fn} failed: ${result.error.message}`);
-			return readSubjectRecord(result.data);
-		});
-		loaded.set(userId, pending);
-		return pending;
-	};
-	const version = (userId) => {
-		const read = loaded.get(userId);
-		if (read !== void 0) return read.then((found) => found?.authzVersion);
-		const cached = versions.get(userId);
-		if (cached !== void 0) return cached;
-		const pending = Promise.resolve(callRpc(client, schema, versionFn, { p_user: userId })).then((result) => result.error === null ? versionOf(result.data) : record(userId).then((found) => found?.authzVersion));
-		versions.set(userId, pending);
-		return pending;
-	};
-	const live = async (userId) => {
-		const found = await record(userId);
-		return found?.active === true ? found : void 0;
-	};
-	return {
-		memberships: {
-			async membershipsFor(principal) {
-				return [...(await live(principal.id))?.memberships ?? []];
-			},
-			version(principal) {
-				return declared !== void 0 && !onlyDeclared([...principal.roles ?? [], ...(principal.memberships ?? []).flatMap((membership) => membership.roles)]) ? record(principal.id).then((found) => found?.authzVersion) : version(principal.id);
-			},
-			list
-		},
-		customRoles(principal) {
-			return {
-				async rolesFor(tenant, context) {
-					if (onlyDeclared(context?.held)) return [];
-					return ((await live(principal.id))?.customRoles ?? []).filter((role) => role.tenant === tenant);
-				},
-				async globalRoles(context) {
-					if (onlyDeclared(context?.held)) return [];
-					return ((await live(principal.id))?.customRoles ?? []).filter((role) => role.scope === "global");
-				}
-			};
-		},
-		async subject(userId) {
-			const found = await live(userId);
-			if (found === void 0) return {
-				principal: null,
-				context: {}
-			};
-			return {
-				principal: compact({
-					id: found.id,
-					roles: found.roles,
-					memberships: found.memberships,
-					authzVersion: found.authzVersion
-				}),
-				context: {}
-			};
-		},
-		record
-	};
-}
-//#endregion
 //#region src/supabase/approval-store.ts
 /** A stored body as the request it is; the store wrote it from an `ApprovalRequest`. */
 function requestOf(value) {
@@ -456,10 +286,10 @@ function supabaseApprovalStore(client, options = {}) {
 			if (written === null) throw new ApprovalError("approval-not-pending", "approval is not pending");
 			return written;
 		},
-		async consume(token, now = /* @__PURE__ */ new Date()) {
+		async consume(token, now) {
 			return requestOf(await call("permdock_approval_consume", {
 				p_token: token,
-				p_now: now.toISOString()
+				p_now: dateAt(now).toISOString()
 			}));
 		},
 		async list(query) {
@@ -483,8 +313,8 @@ function supabaseApprovalStore(client, options = {}) {
 				next: encodeApprovalCursor(last)
 			} : { items };
 		},
-		async expire(now = /* @__PURE__ */ new Date()) {
-			const count = await call("permdock_approval_expire", { p_now: now.toISOString() });
+		async expire(now) {
+			const count = await call("permdock_approval_expire", { p_now: dateAt(now).toISOString() });
 			return typeof count === "number" ? count : 0;
 		},
 		async cancel(filter, meta) {
@@ -492,13 +322,76 @@ function supabaseApprovalStore(client, options = {}) {
 				p_filter: filterOf(filter),
 				p_by: meta.by,
 				p_note: meta.note ?? null,
-				p_now: (/* @__PURE__ */ new Date()).toISOString()
+				p_now: isoNow()
 			});
 			return typeof count === "number" ? count : 0;
 		}
 	};
 }
 //#endregion
+//#region src/supabase/approval-delegations.ts
+function rowsOf(result) {
+	return Array.isArray(result) ? result : result.rows;
+}
+function instant(value) {
+	if (value instanceof Date) return Number.isNaN(value.getTime()) ? void 0 : value.toISOString();
+	if (typeof value !== "string") return;
+	const ms = Date.parse(value);
+	return Number.isNaN(ms) ? void 0 : isoAt(ms);
+}
+function list(value) {
+	if (value === null || value === void 0) return;
+	if (!Array.isArray(value)) return false;
+	const items = [];
+	for (const item of value) {
+		if (typeof item !== "string") return false;
+		items.push(item);
+	}
+	return items;
+}
+function delegationOf(row) {
+	const { id, delegator, delegate, tenant } = row;
+	const from = instant(row["from"]);
+	const until = instant(row["until"]);
+	const permissions = list(row["permissions"]);
+	const resources = list(row["resources"]);
+	if (typeof id !== "string" || typeof delegator !== "string" || typeof delegate !== "string" || tenant !== null && typeof tenant !== "string" || from === void 0 || until === void 0 || permissions === false || resources === false) return;
+	return {
+		id,
+		delegator,
+		delegate,
+		...typeof tenant === "string" ? { tenant } : {},
+		...permissions === void 0 ? {} : { permissions },
+		...resources === void 0 ? {} : { resources },
+		from,
+		until
+	};
+}
+/**
+* Approval delegations (out-of-office covers) from the table
+* `rls.approvals.delegations` generates, so `approvalsHandler` and
+* `permdock_is_approver` read the same rows. A cover without a tenant
+* applies everywhere; a malformed row is skipped.
+*/
+function tableApprovalDelegationSource(options) {
+	const table = quoteQualifiedTable(options.table ?? "permdock.approval_delegations");
+	return {
+		name: "table",
+		async delegationsFor(query) {
+			const values = [query.delegate, query.at];
+			let tenant = "d.tenant is null";
+			if (query.tenant !== void 0) {
+				values.push(query.tenant);
+				tenant = "(d.tenant is null or d.tenant = $3)";
+			}
+			return rowsOf(await options.query(`select d.id::text as id, d.delegator::text as delegator, d.delegate::text as delegate, d.tenant::text as tenant, d.permissions, d.resources, d."from", d."until" from ${table} d where d.delegate::text = $1 and d."from" <= $2::timestamptz and $2::timestamptz < d."until" and ${tenant} order by d.id`, values)).flatMap((row) => {
+				const entry = delegationOf(row);
+				return entry === void 0 ? [] : [entry];
+			});
+		}
+	};
+}
+//#endregion
 //#region src/supabase/rls.ts
 function isTable(value) {
 	return value !== null && typeof value === "object" && "table" in value && typeof value.table === "string";
@@ -585,7 +478,7 @@ function claimKept(suspension) {
 }
 function customDatabaseBranch(q, scope, memberships, declared, levels, suspension) {
 	const role = tenantRole(memberships);
-	const match = `c.tenant_id::text = requested_tenant and c.scope = ${literal(scope)} and c.scope_id is null and c.role = ${role.sql}`;
+	const match = `case when ${q("permdock_is_shared_role")}(${literal(scope)}, ${role.sql}) then c.tenant_id is null else c.tenant_id::text = requested_tenant end and c.scope = ${literal(scope)} and c.scope_id is null and c.role = ${role.sql}`;
 	const rows = (source, value, extra) => `array(select c.${value} from ${q(source)} c where ${match}${extra})`;
 	return ` or exists (
       select 1
@@ -656,9 +549,9 @@ ${tenantBranch}
     and not ${global("deny")};
 end;`;
 }
-/** A claim membership whose `expiresAt` (epoch seconds) has passed no longer holds its roles. */
-const CLAIM_UNEXPIRED = `case jsonb_typeof(m -> 'expiresAt')
-          when 'number' then (m ->> 'expiresAt')::numeric > extract(epoch from now())
+/** A claim membership whose `expires_at` (epoch seconds) has passed no longer holds its roles. */
+const CLAIM_UNEXPIRED = `case jsonb_typeof(m -> 'expires_at')
+          when 'number' then (m ->> 'expires_at')::numeric > extract(epoch from now())
           else true
         end`;
 function jwtBody(q, scope, custom, suspension) {
@@ -757,4 +650,4 @@ grant execute on function ${signature} to authenticated;
 `;
 }
 //#endregion
-export { readSubjectRecord as a, postgrestSources as i, supabaseRls as n, supabaseClaims as o, supabaseApprovalStore as r, exchangeCapability as s, authorizeSql as t };
+export { supabaseClaims as a, supabaseApprovalStore as i, supabaseRls as n, exchangeCapability as o, tableApprovalDelegationSource as r, authorizeSql as t };

package/dist/support-session-C6xJQYut.js

@@ -0,0 +1,158 @@
+import { t as compact } from "./compact-CAf557ZB.js";
+import { n as freezeDeep } from "./freeze-CrU8nQeX.js";
+import { a as ownRecord } from "./paths-DXSHAMIa.js";
+import { a as isId, r as idList } from "./expiry-D4_YKRKD.js";
+import { n as internalsOf } from "./internals-Dk8A8fX3.js";
+import { c as listPermissions, m as annotationsFor, n as findPermission } from "./permission-registry-Br4jSNVi.js";
+import { g as secondsOf, l as isRfc3339, m as rfc3339, p as nowSeconds } from "./time-DkWjdL98.js";
+import { t as canonicalJson } from "./canonical-json-BC8_nMTw.js";
+import { r as sha256Digest } from "./sha256-D9ihqmvd.js";
+//#region src/core/support-session.ts
+const DEFAULT_TTL = 3600;
+const MAX_TTL = 86400;
+const MAX_REASON = 1e3;
+function isReason(value) {
+	return typeof value === "string" && value.trim().length > 0 && value.length <= MAX_REASON;
+}
+/**
+* Validates an untrusted support-session record and returns a frozen copy
+* with only the v1 fields, or `undefined`.
+*/
+function parseSupportSession(input) {
+	const value = ownRecord(input);
+	if (value === void 0 || value["v"] !== 1 || !isId(value["id"]) || !isId(value["principal"]) || !isId(value["actor"]) || value["principal"] === value["actor"] || !isId(value["tenant"]) || !isReason(value["reason"]) || !isRfc3339(value["startedAt"]) || !isRfc3339(value["expiresAt"])) return;
+	const permissions = idList(value["permissions"]);
+	const { approvedBy, reference } = value;
+	if (permissions === void 0 || (secondsOf(value["expiresAt"]) ?? 0) <= (secondsOf(value["startedAt"]) ?? 0) || approvedBy !== void 0 && (!isId(approvedBy) || approvedBy === value["actor"]) || reference !== void 0 && !isId(reference)) return;
+	return freezeDeep(compact({
+		v: 1,
+		id: value["id"],
+		principal: value["principal"],
+		actor: value["actor"],
+		tenant: value["tenant"],
+		reason: value["reason"],
+		permissions,
+		startedAt: value["startedAt"],
+		expiresAt: value["expiresAt"],
+		approvedBy,
+		reference
+	}));
+}
+function denied(reason, detail) {
+	return freezeDeep({
+		outcome: "denied",
+		denials: [compact({
+			role: null,
+			reason,
+			detail
+		})]
+	});
+}
+function sessionToken(request, actor, tenant, permissions, ttl) {
+	return sha256Digest(canonicalJson({
+		t: "support-session",
+		id: request.id,
+		principal: request.principal,
+		actor,
+		tenant,
+		reason: request.reason,
+		permissions,
+		ttl,
+		reference: request.reference ?? null
+	}));
+}
+/**
+* Decides whether the subject of `permdock` may start the support session
+* in `request`. The actor must be a signed-in person acting for themselves
+* (`exceeds-creator` otherwise), give a `reason` (`reason-required`), be a
+* member of the tenant (`tenant-mismatch`) and be able to use every
+* permission (`exceeds-creator`). Without `permissions` the session gets the
+* actor's read-only permissions. The tenant's `supportSessions` policy then
+* applies, and the result is `approval-required` until `approved` carries
+* its token and `approvedBy` names someone other than the actor.
+*/
+/**
+* Decides whether the subject of `permdock` may start the support session
+* in `request` and returns the record to sign: a stated reason, membership
+* of the tenant, the actor's own reach, the tenant's `supportSessions`
+* policy and approval by someone else. An instance built from a snapshot
+* denies with `unsupported`.
+*/
+function decideSupportSession(permdock, request, options = {}) {
+	const internals = internalsOf(permdock);
+	if (internals === void 0) return Promise.resolve(freezeDeep({
+		outcome: "denied",
+		denials: [{
+			role: null,
+			reason: "unsupported"
+		}]
+	}));
+	const settings = options.settings ?? internals.env.settings;
+	return decideSupportSessionWith(internals.instance, request, settings === void 0 ? options : {
+		...options,
+		settings
+	});
+}
+async function decideSupportSessionWith(permdock, request, options) {
+	const actor = permdock.subject.principal;
+	if (actor === null) return denied("anonymous");
+	if (actor.kind !== void 0 && actor.kind !== "user") return denied("exceeds-creator", { creator: actor.kind });
+	if ("credential" in actor || "runTicket" in actor) return denied("exceeds-creator", { creator: "credential" in actor ? "credential" : "run" });
+	if (permdock.subject.actor !== void 0) return denied("exceeds-creator", { creator: "actor" });
+	if (!isReason(request.reason)) return denied("reason-required");
+	const ttl = request.expiresIn ?? DEFAULT_TTL;
+	if (!isId(request.id) || !isId(request.principal) || request.principal === actor.id || !Number.isSafeInteger(ttl) || ttl <= 0 || ttl > MAX_TTL || request.reference !== void 0 && !isId(request.reference)) return denied("validation");
+	const tenant = request.tenant ?? actor.tenant;
+	if (tenant === void 0) return denied("validation");
+	if (!permdock.tenants().includes(tenant)) return denied("tenant-mismatch", { tenant });
+	let policy;
+	if (options.settings !== void 0) try {
+		policy = (await options.settings.settingsFor(tenant))?.supportSessions;
+	} catch {
+		return denied("unsupported", { rule: "unavailable" });
+	}
+	if (policy?.disabled === true) return denied("unsupported", { rule: "disabled" });
+	if (policy?.maxTtl !== void 0 && ttl > policy.maxTtl) return denied("validation", { rule: "ttl" });
+	const leaves = request.permissions === void 0 ? listPermissions(permdock.permissions).filter((leaf) => annotationsFor(leaf).readOnlyHint && permdock.mayUse(leaf)) : request.permissions.map((permission) => findPermission(permdock.permissions, permission.key));
+	const keys = [];
+	for (const leaf of leaves) {
+		if (leaf === void 0) return denied("validation");
+		if (!permdock.mayUse(leaf)) return denied("exceeds-creator", { permission: leaf.key });
+		if (policy?.readOnly === true && !annotationsFor(leaf).readOnlyHint) return denied("not-delegated", {
+			permission: leaf.key,
+			rule: "read-only"
+		});
+		if (!keys.includes(leaf.key)) keys.push(leaf.key);
+	}
+	if (keys.length === 0) return denied("no-grant");
+	const token = sessionToken(request, actor.id, tenant, keys, ttl);
+	const approval = options.approval !== false;
+	const approved = approval && options.approved === token;
+	if (approved && (options.approvedBy === void 0 || options.approvedBy === actor.id)) return denied("approval", "approver-not-distinct");
+	const startedAt = nowSeconds(options.now);
+	const session = parseSupportSession(compact({
+		v: 1,
+		id: request.id,
+		principal: request.principal,
+		actor: actor.id,
+		tenant,
+		reason: request.reason,
+		permissions: keys,
+		startedAt: rfc3339(startedAt),
+		expiresAt: rfc3339(startedAt + ttl),
+		approvedBy: approved ? options.approvedBy : void 0,
+		reference: request.reference
+	}));
+	if (session === void 0) return denied("validation");
+	if (approval && !approved) return freezeDeep({
+		outcome: "approval-required",
+		session,
+		token
+	});
+	return freezeDeep({
+		outcome: "granted",
+		session
+	});
+}
+//#endregion
+export { parseSupportSession as n, decideSupportSession as t };

package/dist/svelte/Protected.svelte

@@ -16,7 +16,7 @@
     tenant,
     children,
     pending,
-    fallback,
+    denied,
     approval,
   }: ProtectedProps = $props();
 
@@ -33,15 +33,15 @@
     const generation = tick;
     return viewFor(store, permission, data, scoped, generation);
   });
-  const own = $derived({ pending, fallback, approval });
+  const own = $derived({ pending, denied, approval });
 </script>
 
 {#if view.slot === 'pending'}
   {@render slotContent('pending', own, defaults)?.()}
 {:else if view.slot === 'approval'}
   {@render slotContent('approval', own, defaults)?.(view.decision)}
-{:else if view.slot === 'fallback'}
-  {@render slotContent('fallback', own, defaults)?.(view.decision)}
+{:else if view.slot === 'denied'}
+  {@render slotContent('denied', own, defaults)?.(view.decision)}
 {:else}
   {@render children?.(view.decision)}
 {/if}

package/dist/svelte/index.d.ts

@@ -1,13 +1,13 @@
-import { n as requiredPlans } from "../problem-details-rIIo8B2C.js";
-import { i as describe } from "../describe-C3ldA9os.js";
+import { n as requiredPlans } from "../problem-details-B45V5d2b.js";
+import { i as describe } from "../describe-B5qgDvEW.js";
 import { t as PermissionBoundaryState } from "../boundary-BmHxVH1J.js";
-import { t as approvalHeaders } from "../headers-Cf-zWvsO.js";
-import { a as ClientPermDock, c as PermissionSet, d as SubjectView, f as TenantView, i as ApprovalState, l as PermissionState, o as ClientStatus, p as UseRolesOptions, r as ApprovalHandle, s as FilterResult } from "../store-9KO4BlkB.js";
-import { n as PermDockSvelteOptions, r as ProtectedProps, s as PermissionBoundaryProps, t as PermDockDefaults } from "../types-ByUo56un.js";
-import { a as getDescribe, c as permission, d as setPermDock, f as subject, i as filtered, l as permissions, n as assignable, o as getPermDock, p as tenant, r as assignablePermissions, s as memberships, t as approval, u as roles } from "../stores-Cxz_80g-.js";
+import { t as approvalHeaders } from "../headers-CIbDTUTK.js";
+import { a as FilterResult, c as PermissionSet, d as RolesOptions, f as SubjectView, i as ClientStatus, l as PermissionState, n as ApprovalState, p as TenantView, r as ClientPermDock, t as ApprovalHandle } from "../types-B3_ooZgZ.js";
+import { n as SveltePermDockOptions, o as PermissionBoundaryProps, r as ProtectedProps, t as PermDockDefaults } from "../types-CVZSNocA.js";
+import { a as getDescribe, c as permission, d as setPermDock, f as subject, i as filtered, l as permissions, n as assignable, o as getPermDock, p as tenant, r as assignablePermissions, s as memberships, t as approval, u as roles } from "../stores-BUGNbJTt.js";
 import { Component } from "svelte";
 //#region src/svelte/index.d.ts
 export declare const Protected: Component<ProtectedProps>;
 export declare const PermissionBoundary: Component<PermissionBoundaryProps>;
 //#endregion
-export { type ApprovalHandle, type ApprovalState, type ClientPermDock, type ClientStatus, type FilterResult, type PermDockDefaults, type PermDockSvelteOptions, type PermissionBoundaryProps, type PermissionBoundaryState, type PermissionSet, type PermissionState, type ProtectedProps, type SubjectView, type TenantView, type UseRolesOptions, approval, approvalHeaders, assignable, assignablePermissions, describe, filtered, getDescribe, getPermDock, memberships, permission, permissions, requiredPlans, roles, setPermDock, subject, tenant };
+export { type ApprovalHandle, type ApprovalState, type ClientPermDock, type ClientStatus, type FilterResult, type PermDockDefaults, type PermissionBoundaryProps, type PermissionBoundaryState, type PermissionSet, type PermissionState, type ProtectedProps, type RolesOptions, type SubjectView, type SveltePermDockOptions, type TenantView, approval, approvalHeaders, assignable, assignablePermissions, describe, filtered, getDescribe, getPermDock, memberships, permission, permissions, requiredPlans, roles, setPermDock, subject, tenant };

package/dist/svelte/index.js

@@ -1,11 +1,11 @@
-import { r as requiredPlans } from "../problem-details-DECUnXAn.js";
-import { t as describe } from "../describe-Cgkp7eP0.js";
-import { t as approvalHeaders } from "../headers-BZSDieNT.js";
-import { l as slotContent } from "../views-CJsrBS1f.js";
+import { r as requiredPlans } from "../problem-details-cn5X30gZ.js";
+import { t as describe } from "../describe-BybMRY7A.js";
 import { n as boundaryFallback, t as boundaryDigest } from "../boundary-BM8a_P6E.js";
-import { n as getUi, t as getStore } from "../context-DieZVJXu.js";
-import { n as viewFor, t as scopedFor } from "../runtime-D_tMXnsq.js";
-import { a as getDescribe, c as permission, d as setPermDock, f as subject, i as filtered, l as permissions, n as assignable, o as getPermDock, p as tenant, r as assignablePermissions, s as memberships, t as approval, u as roles } from "../stores-BHXdSbw9.js";
+import { t as approvalHeaders } from "../headers-BIjfMaoC.js";
+import { u as slotContent } from "../views-DTIIO-oQ.js";
+import { n as getUi, t as getStore } from "../context-B_u3_bDJ.js";
+import { n as viewFor, t as scopedFor } from "../runtime-D3VTAiCA.js";
+import { a as getDescribe, c as permission, d as setPermDock, f as subject, i as filtered, l as permissions, n as assignable, o as getPermDock, p as tenant, r as assignablePermissions, s as memberships, t as approval, u as roles } from "../stores-CGhM8BN_.js";
 import "svelte/internal/disclose-version";
 import * as $ from "svelte/internal/client";
 import { onDestroy } from "svelte";
@@ -75,7 +75,7 @@ function Protected$1($$anchor, $$props) {
 	});
 	const own = $.derived(() => ({
 		pending: $$props.pending,
-		fallback: $$props.fallback,
+		denied: $$props.denied,
 		approval: $$props.approval
 	}));
 	var fragment = $.comment();
@@ -95,7 +95,7 @@ function Protected$1($$anchor, $$props) {
 	var consequent_2 = ($$anchor) => {
 		var fragment_3 = $.comment();
 		var node_3 = $.first_child(fragment_3);
-		$.snippet(node_3, () => slotContent("fallback", $.get(own), defaults) ?? $.noop, () => $.get(view).decision);
+		$.snippet(node_3, () => slotContent("denied", $.get(own), defaults) ?? $.noop, () => $.get(view).decision);
 		$.append($$anchor, fragment_3);
 	};
 	var alternate = ($$anchor) => {
@@ -107,7 +107,7 @@ function Protected$1($$anchor, $$props) {
 	$.if(node, ($$render) => {
 		if ($.get(view).slot === "pending") $$render(consequent);
 		else if ($.get(view).slot === "approval") $$render(consequent_1, 1);
-		else if ($.get(view).slot === "fallback") $$render(consequent_2, 2);
+		else if ($.get(view).slot === "denied") $$render(consequent_2, 2);
 		else $$render(alternate, -1);
 	});
 	$.append($$anchor, fragment);