permdock 0.6.0 → 0.8.0

package/dist/{helpers-CBYVMjwh.js → helpers-DJicaG6f.js}

@@ -1,19 +1,22 @@
 import { t as compact } from "./compact-CAf557ZB.js";
-import { n as freezeDeep } from "./freeze-CrU8nQeX.js";
-import { r as approverLeaves } from "./approvers-CqPOLD-o.js";
-import { t as describe } from "./describe-BybMRY7A.js";
-import { i as getRegistry, n as findPermission } from "./permission-registry-Br4jSNVi.js";
-import { t as assertAppData } from "./app-data-MuyzVqX8.js";
-import { a as durationOf, i as dateAt, u as isoAt } from "./time-DkWjdL98.js";
-import { r as relationReader, t as pendingRelations } from "./relations-BnCWnJGI.js";
-import { n as resolveRelated } from "./relation-walk-3OyDBF0S.js";
+import { n as freezeDeep } from "./freeze-jjan0lCv.js";
+import { r as approverLeaves } from "./approvers-B4r0N_Uz.js";
+import { n as describe } from "./describe-Bb4hGK5d.js";
+import { i as getRegistry, n as findPermission } from "./permission-registry-B8tYxPIt.js";
+import { t as assertAppData } from "./app-data-UNNm07jV.js";
+import { a as durationOf, i as dateAt, u as isoAt } from "./time-nR1JesoH.js";
+import { r as relationReader, t as pendingRelations } from "./relations-BxvRvDHK.js";
+import { n as resolveRelated } from "./relation-walk-DK_gkgL7.js";
 import { n as toWireDelegation } from "./wire-delegation-Cv3W2eaM.js";
-import { i as approverRelationKey, s as ApprovalError, t as APPROVAL_HEADER } from "./types-DqzsnlSA.js";
-import { c as listAllApprovals, n as assertApprover } from "./store-BDutJkDL.js";
-import { n as parseApprovalHeader } from "./approval-header-CJACtHkv.js";
+import { i as approverRelationKey, s as ApprovalError, t as APPROVAL_HEADER } from "./types-CcUXciSj.js";
+import { n as assertApprover, u as listAllApprovals } from "./store-RNFvaJJv.js";
+import { n as parseApprovalHeader } from "./approval-header-8QV6MU4H.js";
 //#region src/approvals/relations.ts
 const DEFAULT_PARENT_DEPTH = 16;
-/** Every approver a request names: `by`, each stage and its escalation, and `escalation.to`, inside `anyOf` groups too. */
+/**
+* Every approver a request names: `by`, each stage and its escalation, and
+* `escalation.to`, inside `anyOf` groups too.
+*/
 function requestApprovers(approvers) {
 	return [
 		...approverLeaves(approvers.by),
@@ -31,7 +34,10 @@ async function settled(read, unread, cache) {
 		await Promise.all(pending);
 	}
 }
-/** The id of `item.resource` the walk starts from, after following `through` links. */
+/**
+* The id of `item.resource` the walk starts from, after following `through`
+* links.
+*/
 async function startOf(item, resource, id, reader, cache, registry) {
 	if (!Array.isArray(item.through)) return resource === item.resource ? id : void 0;
 	let current = resource;
@@ -61,8 +67,8 @@ function depthOf(item) {
 /**
 * The relation approvers of `request` that `subject` holds on its resource,
 * keyed by `approverRelationKey`, for `ApprovalVerdict.relations`. Reads go
-* through `relations` by the request's resource id; a request without an id,
-* a missing source or a read that fails holds nothing.
+* through `relations` by the request's resource id; a request without an id, a
+* missing source or a read that fails holds nothing.
 */
 async function approverRelations(request, subject, options) {
 	const approvers = request.approvers;
@@ -118,7 +124,10 @@ function approverPermissions(request, approver) {
 		}
 	});
 }
-/** The permission approvers `subject` holds on `request`, read through `permdockFor`. */
+/**
+* The permission approvers `subject` holds on `request`, read through
+* `permdockFor`.
+*/
 async function heldPermissions(request, subject, permdockFor) {
 	if (permdockFor === void 0 || request.approvers === void 0) return [];
 	try {
@@ -156,9 +165,9 @@ function summarizeSubject(subject) {
 	});
 }
 /**
-* The window (`meta.ttl`, else the store's `ttl`, else the default) capped by the grant's
-* `approval.ttl`: a grant shortens how long a request stays open, never
-* extends it.
+* The window (`meta.ttl`, else the store's `ttl`, else the default) capped by
+* the grant's `approval.ttl`: a grant shortens how long a request stays open,
+* never extends it.
 */
 function approvalTtl(storeTtl, approval) {
 	if (storeTtl !== void 0 && durationOf(storeTtl) === void 0) throw new RangeError(`PermDock: approval ttl must be a whole number of seconds above 0, got ${String(storeTtl)}`);
@@ -391,7 +400,10 @@ async function cancelApprovals(store, filter, meta) {
 		}
 	}))).filter(Boolean).length;
 }
-/** The token of a `PermDock-Approval` field: one RFC 9651 sf-token Item with no parameters, else `undefined`. */
+/**
+* The token of a `PermDock-Approval` field: one RFC 9651 sf-token Item with no
+* parameters, else `undefined`.
+*/
 function readApprovalHeader(headers) {
 	return parseApprovalHeader(headers.get(APPROVAL_HEADER));
 }
@@ -405,14 +417,14 @@ function resumeFromHeader(store, headers, now) {
 }
 /**
 * The token to resume `decision` with when the caller carries none: the
-* decision's own token when the store holds an approved or rejected request
-* for it, so `resumeDecision` resumes (or denies) the call without the
-* caller passing the token back. The token already binds permission,
-* resource (or the call's data when there is no row id), subject and actor.
-* A pending request counts only with `denyPending: true`, which makes the
-* call deny with `approval-pending` instead of asking again. `undefined` when
-* the decision needs no approval, there is no store, or the store has no
-* unexpired request for the token; a store that throws counts as none.
+* decision's own token when the store holds an approved or rejected request for
+* it, so `resumeDecision` resumes (or denies) the call without the caller
+* passing the token back. The token already binds permission, resource (or the
+* call's data when there is no row id), subject and actor. A pending request
+* counts only with `denyPending: true`, which makes the call deny with
+* `approval-pending` instead of asking again. `undefined` when the decision
+* needs no approval, there is no store, or the store has no unexpired request
+* for the token; a store that throws counts as none.
 */
 async function storedApprovalToken(store, decision, options = {}) {
 	if (store === void 0 || decision.outcome !== "approval-required") return;

package/dist/hono/index.d.ts

@@ -1,9 +1,9 @@
-import { T as Policy, j as PolicyVocabulary, rr as Principal } from "../policy-types-n0uRTsW8.js";
-import { w as Permission } from "../vocabulary-CN8H_9UF.js";
-import { r as PermDock } from "../permdock-SV8ZINYT.js";
-import { n as RevocationFeed } from "../revocations-R07lFBnX.js";
-import { D as ConnectionOptions, T as Connection, f as InvalidSignatureError, i as OpenApiHooks, o as ProtectOptions, v as discoverViaSignatureAgent, x as webBotAuthVerifier } from "../server-types-CKQiCnON.js";
-import { t as ServerAdapterOptions } from "../bind-DOyrv6zi.js";
+import { T as Policy, j as PolicyVocabulary, sr as Principal } from "../policy-types-CCiDRZBH.js";
+import { u as Permission } from "../permission-types-CAY-GU7e.js";
+import { a as PermDock } from "../permdock-B6Sf4T_S.js";
+import { n as RevocationFeed } from "../revocations-BaUXHM1N.js";
+import { D as ConnectionOptions, T as Connection, f as InvalidSignatureError, i as OpenApiHooks, o as ProtectOptions, v as discoverViaSignatureAgent, x as webBotAuthVerifier } from "../server-types-CIlpSA2G.js";
+import { t as ServerAdapterOptions } from "../bind-Cp2hBHzP.js";
 import { Context, Hono, MiddlewareHandler } from "hono";
 import { SSEMessage, SSEStreamingApi } from "hono/streaming";
 import { WSEvents } from "hono/ws";
@@ -20,19 +20,25 @@ type HonoPermDockEnv<TData = unknown, V extends PolicyVocabulary = PolicyVocabul
   };
 };
 type HonoPermDock<V extends PolicyVocabulary = PolicyVocabulary> = {
-  /** The `PermDock` for one request, for code the middleware does not run before. */
+  /**
+   * The `PermDock` for one request, for code the middleware does not run
+   * before.
+   */
   readonly getPermDock: (c: Context) => Promise<PermDock<V>>;
   readonly middleware: () => MiddlewareHandler<HonoPermDockEnv<unknown, V>>;
   readonly protect: <TData = unknown>(permission: Permission | null, data?: (c: Context) => TData | Promise<TData>, protectOptions?: ProtectOptions) => MiddlewareHandler<HonoPermDockEnv<NonNullable<TData>, V>>;
   /** A long-lived connection for the request behind `c`. */
   readonly connection: (c: Context, connectionOptions?: ConnectionOptions) => Promise<Connection>;
-  /** `upgradeWebSocket` events that close with `1008` when the connection aborts. */
+  /**
+   * `upgradeWebSocket` events that close with `1008` when the connection
+   * aborts.
+   */
   readonly socket: <T = unknown>(connection: Connection, events: WSEvents<T>) => WSEvents<T>;
   /**
    * Writes `source` to a `streamSSE` stream, dropping items the subscriber
    * cannot read, and resolves when it ends: after an `event: permdock` frame
-   * when the connection aborts, when the client disconnects, or when the
-   * source is done. Await it as the last statement of the callback.
+   * when the connection aborts, when the client disconnects, or when the source
+   * is done. Await it as the last statement of the callback.
    */
   readonly sse: <T>(connection: Connection, stream: SSEStreamingApi, source: AsyncIterable<T>, options?: SseOptions<T>) => Promise<void>;
   readonly permdockHandler: () => Hono;

package/dist/hono/index.js

@@ -1,9 +1,9 @@
 import { t as compact } from "../compact-CAf557ZB.js";
-import { r as PermDockRevokedError } from "../errors-BKy0EfhN.js";
-import { d as discoverViaSignatureAgent, m as webBotAuthVerifier, u as InvalidSignatureError } from "../evaluations-beAooV0n.js";
-import { t as problemFromError } from "../map-error-Dr70oA_3.js";
-import { r as bindKernel } from "../bind-CAvgUuKs.js";
-import { a as onRevoked, n as closeReason, r as guardIterable, t as POLICY_VIOLATION } from "../stream-CvdUS9V1.js";
+import { r as PermDockRevokedError } from "../errors-B6R_lg2a.js";
+import { l as InvalidSignatureError, p as webBotAuthVerifier, u as discoverViaSignatureAgent } from "../evaluations-IBceAeKT.js";
+import { t as problemFromError } from "../map-error-pasIGqMT.js";
+import { r as bindKernel } from "../bind-D_sZSVA3.js";
+import { a as onRevoked, n as closeReason, r as guardIterable, t as POLICY_VIOLATION } from "../stream-CDvF0sJm.js";
 import { Hono } from "hono";
 //#region src/hono/create.ts
 function socket(connection, events) {

package/dist/{hosted-BPk51-kX.d.ts → hosted-Cmtxogd0.d.ts}

@@ -1,6 +1,9 @@
-import { T as Policy, a as ApprovalRequirement, bn as Grantee, ur as Condition } from "./policy-types-n0uRTsW8.js";
+import { T as Policy, a as ApprovalRequirement, mr as Condition, wn as Grantee } from "./policy-types-CCiDRZBH.js";
 //#region src/core/hosted.d.ts
-/** One grant authored in PermDock Cloud; its grantee is a declared role, plan or relation. */
+/**
+ * One grant authored in PermDock Cloud; its grantee is a declared role, plan or
+ * relation.
+ */
 type HostedGrant = {
   readonly id: string;
   readonly permission: string;
@@ -12,9 +15,9 @@ type HostedGrant = {
   readonly fields?: readonly string[];
 };
 /**
- * PolicyDocument v1. Signed as a `vnd.permdock.policy+jwt`, the `policy`
- * claim carries every field but `id` and `issuedAt`, which are the token's
- * `jti` and `iat` (`policyDocumentFromClaims`).
+ * PolicyDocument v1. Signed as a `vnd.permdock.policy+jwt`, the `policy` claim
+ * carries every field but `id` and `issuedAt`, which are the token's `jti` and
+ * `iat` (`policyDocumentFromClaims`).
  */
 type PolicyDocument = {
   readonly v: 1;
@@ -27,17 +30,20 @@ type PolicyDocument = {
   readonly grants: readonly HostedGrant[];
 };
 /**
- * The channel for hosted grants. `getPermDock` reads `current()` once;
- * the application calls `refresh()` on its own schedule, never a check.
+ * The channel for hosted grants. `getPermDock` reads `current()` once; the
+ * application calls `refresh()` on its own schedule, never a check.
  */
 type PolicySource = {
   /** Names the implementation in errors and events. */
   readonly name?: string;
-  current(): PolicyDocument | null;
-  refresh(): Promise<void>;
+  current: () => PolicyDocument | null;
+  refresh: () => Promise<void>;
 };
 type HostedGrantDropReason = "not-hostable" | "unknown-permission" | "unknown-grantee" | "non-portable" | "weaker-approval" | "invalid";
-/** Reported through `on('error')` when a hosted grant is not merged; never thrown. */
+/**
+ * Reported through `on('error')` when a hosted grant is not merged; never
+ * thrown.
+ */
 type HostedGrantDropped = {
   readonly kind: "hosted-grant-dropped";
   readonly document: string;
@@ -47,24 +53,42 @@ type HostedGrantDropped = {
 declare function memoryPolicySource(document?: PolicyDocument | null): PolicySource;
 /** Validates the document envelope; per-grant checks happen at merge time. */
 declare function parsePolicyDocument(json: unknown): PolicyDocument;
-/** The document verified `vnd.permdock.policy+jwt` claims carry: `policy`, with `jti` as `id` and `iat` as `issuedAt`. Throws like `parsePolicyDocument`. */
+/**
+ * The document verified `vnd.permdock.policy+jwt` claims carry: `policy`, with
+ * `jti` as `id` and `iat` as `issuedAt`. Throws like `parsePolicyDocument`.
+ */
 declare function policyDocumentFromClaims(claims: Readonly<Record<string, unknown>>): PolicyDocument;
-/** True for the portable subset only: no `opaque`, no `sqlFunction`, no unknown op. */
+/**
+ * True for the portable subset only: no `opaque`, no `sqlFunction`, no unknown
+ * op.
+ */
 declare function isPortableCondition(value: unknown): value is Condition;
+type HostedGrantCheck = {
+  readonly ok: true;
+} | {
+  readonly ok: false;
+  readonly reason: HostedGrantDropReason;
+};
+/**
+ * Whether `mergeHostedGrants` would keep one candidate hosted grant, and the
+ * drop reason it would report when not. Needs no `PolicyDocument`, so a grant
+ * form can check a grant before it publishes one.
+ */
+declare function checkHostedGrant(policy: Policy, grant: unknown): HostedGrantCheck;
 /**
- * The code policy plus the hosted grants that pass every rule. Hosted
- * allows OR with code allows and any deny still wins, so a hosted grant can
- * never override a code deny; one that fails a rule is dropped, not thrown.
+ * The code policy plus the hosted grants that pass every rule. Hosted allows OR
+ * with code allows and any deny still wins, so a hosted grant can never
+ * override a code deny; one that fails a rule is dropped, not thrown.
  */
 declare function mergeHostedGrants(policy: Policy, document: PolicyDocument | null): {
   readonly policy: Policy;
   readonly dropped: readonly HostedGrantDropped[];
 };
 /**
- * Hosted grants as an instance option: `policies: hostedPolicies(source)`.
- * The merge code ships only with an app that imports this function.
- * `source.current()` is read once per instance; a throw keeps the code
- * policy and is reported as an error event.
+ * Hosted grants as an instance option: `policies: hostedPolicies(source)`. The
+ * merge code ships only with an app that imports this function.
+ * `source.current()` is read once per instance; a throw keeps the code policy
+ * and is reported as an error event.
  */
 type HostedPolicies = {
   readonly feature: "hosted-policies";
@@ -75,4 +99,4 @@ type HostedPolicies = {
 };
 declare function hostedPolicies(source: PolicySource): HostedPolicies;
 //#endregion
-export { PolicyDocument as a, isPortableCondition as c, parsePolicyDocument as d, policyDocumentFromClaims as f, HostedPolicies as i, memoryPolicySource as l, HostedGrantDropReason as n, PolicySource as o, HostedGrantDropped as r, hostedPolicies as s, HostedGrant as t, mergeHostedGrants as u };
+export { HostedPolicies as a, checkHostedGrant as c, memoryPolicySource as d, mergeHostedGrants as f, HostedGrantDropped as i, hostedPolicies as l, policyDocumentFromClaims as m, HostedGrantCheck as n, PolicyDocument as o, parsePolicyDocument as p, HostedGrantDropReason as r, PolicySource as s, HostedGrant as t, isPortableCondition as u };

package/dist/{hosted-B46-5LYE.js → hosted-D0IzESu_.js}

@@ -1,13 +1,13 @@
 import { r as isRecord, t as compact } from "./compact-CAf557ZB.js";
-import { n as freezeDeep } from "./freeze-CrU8nQeX.js";
-import { n as isForbiddenKey, s as splitPath } from "./paths-DXSHAMIa.js";
-import { a as deny, i as completeGrant, n as role, p as normalizeWhere, r as allow } from "./role-builder-uWQZ4v84.js";
-import { a as getResource, n as findPermission } from "./permission-registry-Br4jSNVi.js";
-import { d as isSelfParented } from "./resource-relations-D_jw0BFx.js";
-import { a as durationOf, l as isRfc3339, m as rfc3339 } from "./time-DkWjdL98.js";
-import { r as sha256Digest } from "./sha256-D9ihqmvd.js";
-import { _ as listPlans, m as findRole, o as flattenGrantee } from "./grantee-hxrUsbpM.js";
-import { i as indexPolicy, t as declaredRoleNames } from "./policy-DbM5YYtV.js";
+import { n as freezeDeep } from "./freeze-jjan0lCv.js";
+import { n as isForbiddenKey, s as splitPath } from "./paths-CUvURzHp.js";
+import { a as deny, i as completeGrant, n as role, p as normalizeWhere, r as allow } from "./role-builder-BK2-T6oD.js";
+import { a as getResource, n as findPermission } from "./permission-registry-B8tYxPIt.js";
+import { d as isSelfParented } from "./resource-relations-8-pCScBO.js";
+import { a as durationOf, l as isRfc3339, m as rfc3339 } from "./time-nR1JesoH.js";
+import { r as sha256Digest } from "./sha256-C-4WXKIu.js";
+import { _ as listPlans, m as findRole, o as flattenGrantee } from "./grantee-Dke-9rd1.js";
+import { a as indexPolicy, n as declaredRoleNames } from "./policy-CLQ8__GF.js";
 //#region src/core/hosted.ts
 function memoryPolicySource(document = null) {
 	const current = document === null ? null : parsePolicyDocument(document);
@@ -37,7 +37,10 @@ function parsePolicyDocument(json) {
 	if (typeof copy["id"] !== "string" || typeof copy["fingerprint"] !== "string" || typeof copy["catalog"] !== "string" || !isRfc3339(copy["issuedAt"]) || !Array.isArray(copy["grants"])) throw new TypeError("PermDock: malformed policy document");
 	return freezeDeep(copy);
 }
-/** The document verified `vnd.permdock.policy+jwt` claims carry: `policy`, with `jti` as `id` and `iat` as `issuedAt`. Throws like `parsePolicyDocument`. */
+/**
+* The document verified `vnd.permdock.policy+jwt` claims carry: `policy`, with
+* `jti` as `id` and `iat` as `issuedAt`. Throws like `parsePolicyDocument`.
+*/
 function policyDocumentFromClaims(claims) {
 	const claim = claims["policy"];
 	const jti = claims["jti"];
@@ -71,7 +74,10 @@ function portableValue(value) {
 	if (keys[0] === "ref") return safePath(value["ref"]);
 	return keys[0] === "date" && typeof value["date"] === "string";
 }
-/** True for the portable subset only: no `opaque`, no `sqlFunction`, no unknown op. */
+/**
+* True for the portable subset only: no `opaque`, no `sqlFunction`, no unknown
+* op.
+*/
 function isPortableCondition(value) {
 	if (!isRecord(value) || typeof value["op"] !== "string") return false;
 	const op = value["op"];
@@ -105,7 +111,10 @@ function approvalRank(approval) {
 		escalates: approval.escalation !== void 0
 	};
 }
-/** A hosted approval must meet every approval a code allow requires on the permission. */
+/**
+* A hosted approval must meet every approval a code allow requires on the
+* permission.
+*/
 function approvalAtLeast(hosted, code) {
 	const mine = approvalRank(hosted);
 	for (const required of code) {
@@ -120,10 +129,17 @@ function approvalAtLeast(hosted, code) {
 	}
 	return true;
 }
-/** A grantee kind this build does not know is never declared, so the hosted grant is dropped. */
+/**
+* A grantee kind this build does not know is never declared, so the hosted
+* grant is dropped.
+*/
 function undeclaredKind(_grantee) {
 	return false;
 }
+/**
+* Whether a hosted grant may name `grantee` on a permission of
+* `permissionResource`.
+*/
 function declaredGrantee(policy, grantee, permissionResource) {
 	switch (grantee.kind) {
 		case "role": return declaredRoleNames(policy).has(grantee.role);
@@ -156,6 +172,13 @@ function granteesAcceptable(policy, raw, permissionResource) {
 	const items = flattenGrantee(raw);
 	return items.length > 0 && items.every((item) => isRecord(item) && item.kind !== "relation" && (item.kind === "authenticated" || declaredGrantee(policy, item, permissionResource)));
 }
+/**
+* The approvals the code allows on `key` carry; a hosted allow must meet each
+* one.
+*/
+function codeApprovals(policy, key) {
+	return policy.grants.filter((grant) => grant.effect === "allow" && grant.hosted === void 0 && grant.permission.key === key).map((grant) => grant.approval);
+}
 function buildGrant(policy, document, raw) {
 	if (!isRecord(raw) || typeof raw["id"] !== "string" || typeof raw["permission"] !== "string" || raw["effect"] !== void 0 && raw["effect"] !== "allow" && raw["effect"] !== "deny" || raw["to"] === void 0) return {
 		ok: false,
@@ -216,13 +239,10 @@ function buildGrant(policy, document, raw) {
 			reason: "invalid"
 		};
 	}
-	if (effect === "allow") {
-		const codeApprovals = policy.grants.filter((grant) => grant.effect === "allow" && grant.hosted === void 0 && grant.permission.key === permission.key).map((grant) => grant.approval);
-		if (!approvalAtLeast(built.approval, codeApprovals)) return {
-			ok: false,
-			reason: "weaker-approval"
-		};
-	}
+	if (effect === "allow" && !approvalAtLeast(built.approval, codeApprovals(policy, permission.key))) return {
+		ok: false,
+		reason: "weaker-approval"
+	};
 	return {
 		ok: true,
 		grant: freezeDeep({
@@ -234,7 +254,30 @@ function buildGrant(policy, document, raw) {
 		})
 	};
 }
-/** The grants of `document` that `policy` drops, in document order; `permdock/catalog` turns them into drift findings. */
+const CHECKED_DOCUMENT = Object.freeze({
+	v: 1,
+	id: "",
+	fingerprint: "",
+	catalog: "",
+	issuedAt: "",
+	grants: Object.freeze([])
+});
+/**
+* Whether `mergeHostedGrants` would keep one candidate hosted grant, and the
+* drop reason it would report when not. Needs no `PolicyDocument`, so a grant
+* form can check a grant before it publishes one.
+*/
+function checkHostedGrant(policy, grant) {
+	const result = buildGrant(policy, CHECKED_DOCUMENT, grant);
+	return result.ok ? { ok: true } : {
+		ok: false,
+		reason: result.reason
+	};
+}
+/**
+* The grants of `document` that `policy` drops, in document order;
+* `permdock/catalog` turns them into drift findings.
+*/
 function hostedGrantDrops(policy, document) {
 	return document.grants.flatMap((raw) => {
 		const result = buildGrant(policy, document, raw);
@@ -247,9 +290,9 @@ function hostedGrantDrops(policy, document) {
 	});
 }
 /**
-* The code policy plus the hosted grants that pass every rule. Hosted
-* allows OR with code allows and any deny still wins, so a hosted grant can
-* never override a code deny; one that fails a rule is dropped, not thrown.
+* The code policy plus the hosted grants that pass every rule. Hosted allows OR
+* with code allows and any deny still wins, so a hosted grant can never
+* override a code deny; one that fails a rule is dropped, not thrown.
 */
 function mergeHostedGrants(policy, document) {
 	if (document === null || document.grants.length === 0) return {
@@ -312,4 +355,4 @@ function hostedPolicies(source) {
 	});
 }
 //#endregion
-export { mergeHostedGrants as a, memoryPolicySource as i, hostedPolicies as n, parsePolicyDocument as o, isPortableCondition as r, policyDocumentFromClaims as s, hostedGrantDrops as t };
+export { hostedPolicies as a, mergeHostedGrants as c, hostedGrantDrops as i, parsePolicyDocument as l, codeApprovals as n, isPortableCondition as o, declaredGrantee as r, memoryPolicySource as s, checkHostedGrant as t, policyDocumentFromClaims as u };

package/dist/{http-ujKm0JXE.js → http-DH94eh6f.js}

@@ -1,4 +1,4 @@
-import { i as headersFrom, n as firstHeader, t as fetchRequest } from "./http-BBoKefeS.js";
+import { i as headersFrom, n as firstHeader, t as fetchRequest } from "./http-DKLXrFGk.js";
 //#region src/node/http.ts
 function toRequest(req, stream = req) {
 	const host = firstHeader(req.headers.host) ?? "localhost";
@@ -9,9 +9,9 @@ function chunkOf(chunk) {
 	return typeof chunk === "string" ? Buffer.from(chunk) : new Uint8Array(chunk);
 }
 /**
-* Pull-based with `highWaterMark: 0`: nothing is read from `req` until the
-* Web body is consumed, so a later body parser (multer, `express.json()`)
-* still sees the whole stream.
+* Pull-based with `highWaterMark: 0`: nothing is read from `req` until the Web
+* body is consumed, so a later body parser (multer, `express.json()`) still
+* sees the whole stream.
 */
 function incomingBody(req) {
 	return new ReadableStream({ pull(controller) {

package/dist/{http-BBoKefeS.js → http-DKLXrFGk.js}

@@ -1,5 +1,8 @@
 //#region src/server/http.ts
-/** Node-style headers (`IncomingHttpHeaders`, Fastify's) as Fetch `Headers`; repeated values stay separate. */
+/**
+* Node-style headers (`IncomingHttpHeaders`, Fastify's) as Fetch `Headers`;
+* repeated values stay separate.
+*/
 function headersFrom(source) {
 	const headers = new Headers();
 	for (const [key, value] of Object.entries(source)) {
@@ -16,9 +19,9 @@ function firstHeader(value) {
 	return value?.[0];
 }
 /**
-* A body a framework already parsed, as the text a Fetch `Request` carries.
-* A non-string body is serialised as JSON and, without a `content-type`,
-* labelled `application/json` on `headers`.
+* A body a framework already parsed, as the text a Fetch `Request` carries. A
+* non-string body is serialised as JSON and, without a `content-type`, labelled
+* `application/json` on `headers`.
 */
 function parsedBody(body, headers) {
 	if (body === void 0) return;
@@ -27,8 +30,8 @@ function parsedBody(body, headers) {
 	return JSON.stringify(body);
 }
 /**
-* A Fetch `Request` for a framework request. A `GET` or `HEAD` carries no
-* body; otherwise the body the framework parsed, or else `stream()`.
+* A Fetch `Request` for a framework request. A `GET` or `HEAD` carries no body;
+* otherwise the body the framework parsed, or else `stream()`.
 */
 function fetchRequest(url, method, headers, body, stream) {
 	if (method === "GET" || method === "HEAD") return new Request(url, {
@@ -64,7 +67,10 @@ function requestFromContext(context) {
 	if ("request" in context && context.request instanceof Request) return context.request;
 	if ("req" in context && context.req instanceof Request) return context.req;
 }
-/** Whether the caller sent credentials, which turns a `401` into a `WWW-Authenticate` challenge. */
+/**
+* Whether the caller sent credentials, which turns a `401` into a
+* `WWW-Authenticate` challenge.
+*/
 function hasCredentials(request) {
 	return request instanceof Request ? request.headers.has("authorization") : request.headers.authorization !== void 0;
 }

package/dist/{http-DXJ37RDA.js → http-DOL33cO0.js}

@@ -1,15 +1,18 @@
 import { t as timeoutSignal } from "./timeout-D51niuQP.js";
-import { a as describeError, n as CliError } from "./errors-CWTY6uih.js";
-import { s as cliVersion } from "./version-CEbQ5UeM.js";
-import "./device-BARQ8eYG.js";
+import { a as describeError, n as CliError } from "./errors-Vpu6rKHl.js";
+import { s as cliVersion } from "./version-DMQ0dnN5.js";
+import "./device-BwbJNmb2.js";
 //#region src/cli/core/http.ts
-/** `permdock-cli/<version> node/<version> <platform>`, sent on every request the CLI makes. */
+/**
+* `permdock-cli/<version> node/<version> <platform>`, sent on every request the
+* CLI makes.
+*/
 function userAgent() {
 	return `permdock-cli/${cliVersion()} node/${process.versions.node} ${process.platform}`;
 }
 /**
-* Every outbound request: the user agent, a timeout joined to the run's
-* abort signal, and a `network_error` CLI error when nothing answers.
+* Every outbound request: the user agent, a timeout joined to the run's abort
+* signal, and a `network_error` CLI error when nothing answers.
 */
 async function httpRequest(io, request) {
 	const fetchImpl = io.fetch ?? globalThis.fetch.bind(globalThis);
@@ -31,8 +34,8 @@ async function httpRequest(io, request) {
 	}
 }
 /**
-* A 401 or 403 as an `auth_required` action: the credential is missing,
-* expired or lacks a scope, and `next` says how to get one.
+* A 401 or 403 as an `auth_required` action: the credential is missing, expired
+* or lacks a scope, and `next` says how to get one.
 */
 function authFailure(response, message, next) {
 	if (response.status !== 401 && response.status !== 403) return;