permdock 0.16.0 → 0.18.0

package/dist/{src-C_pi2Rnh.js → src-Brzq_0in.js}

@@ -1,29 +1,32 @@
 import { n as isReadonlyArray, r as isRecord, t as compact } from "./compact-CAf557ZB.js";
 import { n as freezeDeep } from "./freeze-jjan0lCv.js";
-import { n as isForbiddenKey, r as ownGet } from "./paths-CUvURzHp.js";
-import { f as normalizeApproval, g as assertSqlFunctionName, h as assertSqlFunctionArg, m as assertPortableTwin, p as normalizeWhere, u as assertApprovalRelations } from "./role-builder-BK2-T6oD.js";
+import { r as ownGet } from "./paths-CUvURzHp.js";
+import { d as assertSqlFunctionArg, f as assertSqlFunctionName, l as normalizeWhere, u as assertPortableTwin } from "./role-builder-CMW4wWzn.js";
 import { n as PermDockDeniedError } from "./errors-B6R_lg2a.js";
 import { o as sameId } from "./expiry-6XByK0dm.js";
 import { n as internalsOf } from "./internals-B3IgHrvo.js";
-import { c as listPermissions, i as getRegistry, n as findPermission, o as isPermission } from "./permission-registry-B8tYxPIt.js";
+import { c as listPermissions, i as getRegistry, n as findPermission } from "./permission-registry-B8tYxPIt.js";
 import { n as isThenable$1 } from "./thenable-BNSM1U2R.js";
 import { c as isEdgeRelation, m as restrictedStops, o as groupEntries, s as isComputedRelation, u as isPrincipalRelation } from "./resource-relations-8-pCScBO.js";
 import { a as durationOf, f as nowMillis, g as secondsOf, m as rfc3339, p as nowSeconds } from "./time-nR1JesoH.js";
-import { a as normalizeMembership$1, d as scopeIdOf, f as scopeList, h as tenantOf, l as rootScope, o as normalizeMemberships$1, s as resolveScope$1, u as scopeChain } from "./scopes-0Up_UA2t.js";
-import { u as evaluateCondition } from "./delegation-CDB6_keF.js";
+import { t as canonicalJson } from "./canonical-json-DwilZ1iB.js";
+import { a as normalizeMembership$1, c as rootScope, d as scopeList, l as scopeChain, o as normalizeMemberships$1, p as tenantOf, s as resolveScope$1, u as scopeIdOf } from "./scopes-BSdYaGHs.js";
+import { u as evaluateCondition } from "./delegation-aK4T_5WU.js";
 import { _ as listPlans, a as authenticated, m as findRole, o as flattenGrantee } from "./grantee-Dke-9rd1.js";
-import { m as tenantsOf, r as isMembershipExpired } from "./tenancy-5d1zVBvK.js";
-import { c as levelNames, i as grantList, n as declaredRoleNames } from "./policy-CLQ8__GF.js";
-import { o as isPortableCondition } from "./hosted-D0IzESu_.js";
-import { n as OPERATION_RISKS, r as isOperationRisk } from "./permissions-CVXmRILq.js";
-import { C as tenantCustomRoles, S as roleAllowKeys, f as customRoleId, l as ceilingGrants, m as customRoleScope, p as customRoleOf, x as resolveCustomRole } from "./evaluate-BAmf_AQd.js";
-import { a as heldLevels, f as bindingOf, h as usesAssigns, m as roleMeta, n as snapshotScopes, o as collectSnapshotGrants, p as rankRoles, r as assignableCandidates, t as snapshotOf } from "./instance-snapshot-DuWf1cT3.js";
+import { a as normalizeApproval, r as assertApprovalRelations } from "./approval-normalize-CUjgSsOl.js";
+import { m as tenantsOf, r as isMembershipExpired } from "./tenancy-DvOHHk3-.js";
+import { c as levelNames, i as grantList, n as declaredRoleNames } from "./policy-cV_wwPb8.js";
+import { o as isPortableCondition } from "./hosted-waouw2V-.js";
+import { n as isOperationRisk } from "./operation-risks-BKOcTv8J.js";
+import { n as isOperationEffect } from "./operations-Bm9HFecz.js";
+import { C as tenantCustomRoles, S as roleAllowKeys, f as customRoleId, l as ceilingGrants, m as customRoleScope, p as customRoleOf, x as resolveCustomRole } from "./evaluate-Czbj7thS.js";
+import { a as heldLevels, f as bindingOf, h as usesAssigns, m as roleMeta, n as snapshotScopes, o as collectSnapshotGrants, p as rankRoles, r as assignableCandidates, t as snapshotOf } from "./instance-snapshot-BWa71my8.js";
 import { n as relationId } from "./relations-BxvRvDHK.js";
-import { i as snapshotGrant, r as plainPermission, t as buildSnapshot } from "./snapshot-CXlzi69u.js";
-import { n as LOCAL_CUSTOM_ROLE } from "./parse-local-manifest-DEiCF4ah.js";
-import { c as APP, r as resolveSubject } from "./permdock-BvjivVb9.js";
-import { i as memoryApprovalStore } from "./store-RNFvaJJv.js";
-import { n as wrapPermDock } from "./wrap-B2wziJI_.js";
+import { i as snapshotGrant, r as plainPermission, t as buildSnapshot } from "./snapshot-DN_8J27z.js";
+import { n as LOCAL_CUSTOM_ROLE } from "./parse-local-manifest-CxcSMQgl.js";
+import { c as APP, r as resolveSubject } from "./permdock-D-_WrdKu.js";
+import { i as memoryApprovalStore } from "./store-DmVqy74I.js";
+import { n as wrapPermDock } from "./wrap-C5PWzgkq.js";
 //#region src/conditions/sql-function.ts
 function sqlFunction(name, options) {
 	assertSqlFunctionName(name);
@@ -119,91 +122,6 @@ function memoryCustomRoleSource(customRoles) {
 	};
 }
 //#endregion
-//#region src/core/operations.ts
-const OPERATION_EFFECTS = Object.freeze([
-	"read",
-	"write",
-	"delete",
-	"send",
-	"spend",
-	"external"
-]);
-/**
-* MCP tool-name characters (MCP 2025-11-25, Tools: Tool names), so a name works
-* as a tool name unchanged.
-*/
-const NAME = /^[A-Za-z0-9_.-]{1,128}$/u;
-const META_KEYS = /* @__PURE__ */ new Set([
-	"risk",
-	"effects",
-	"title"
-]);
-function isOperationEffect(value) {
-	return OPERATION_EFFECTS.some((effect) => effect === value);
-}
-function readMeta(name, value) {
-	if (value === void 0) return Object.freeze({});
-	if (value === null || typeof value !== "object" || Array.isArray(value)) throw new TypeError(`Operation "${name}": meta must be an object.`);
-	for (const key of Object.keys(value)) if (!META_KEYS.has(key)) throw new TypeError(`Operation "${name}": meta.${key} is not one of risk, effects, title.`);
-	const meta = {};
-	const risk = Reflect.get(value, "risk");
-	if (risk !== void 0) {
-		if (!isOperationRisk(risk)) throw new TypeError(`Operation "${name}": meta.risk must be one of ${OPERATION_RISKS.join(", ")}.`);
-		meta.risk = risk;
-	}
-	const effects = Reflect.get(value, "effects");
-	if (effects !== void 0) {
-		if (!Array.isArray(effects) || !effects.every(isOperationEffect) || new Set(effects).size !== effects.length) throw new TypeError(`Operation "${name}": meta.effects must list distinct values of ${OPERATION_EFFECTS.join(", ")}.`);
-		meta.effects = Object.freeze([...effects]);
-	}
-	const title = Reflect.get(value, "title");
-	if (title !== void 0) {
-		if (typeof title !== "string" || title.trim() === "") throw new TypeError(`Operation "${name}": meta.title must be a non-empty string.`);
-		meta.title = title;
-	}
-	return Object.freeze(meta);
-}
-function treeLeaf(keys, name, field, value) {
-	if (!isPermission(value)) throw new TypeError(`Operation "${name}": ${field} must be a permission from the tree.`);
-	if (!keys.has(value.key)) throw new TypeError(`Operation "${name}": ${field} ${value.key} is not a permission of the tree passed to defineOperations.`);
-	return value;
-}
-/**
-* Binds each named operation to a permission of `permissions`. Throws at
-* definition time for a permission or `results` outside the tree, a name that
-* is not 1 to 128 of `A-Z a-z 0-9 _ . -` or repeats another case-insensitively,
-* a `data` that is not a function, or meta outside the closed lists.
-*/
-function defineOperations(permissions, definitions) {
-	const keys = new Map(listPermissions(permissions).map((leaf) => [leaf.key, leaf]));
-	const seen = /* @__PURE__ */ new Map();
-	const out = {};
-	for (const name of Object.keys(definitions)) {
-		if (!NAME.test(name) || isForbiddenKey(name)) throw new TypeError(`Operation name "${name}" must be 1 to 128 of A-Z a-z 0-9 _ . -.`);
-		const folded = name.toLowerCase();
-		const previous = seen.get(folded);
-		if (previous !== void 0) throw new TypeError(`Operation name "${name}" is a duplicate of "${previous}".`);
-		seen.set(folded, name);
-		const definition = definitions[name];
-		if (definition === null || typeof definition !== "object" || Array.isArray(definition)) throw new TypeError(`Operation "${name}" must be an object.`);
-		const permission = treeLeaf(keys, name, "permission", Reflect.get(definition, "permission"));
-		const value = Reflect.get(definition, "data");
-		if (value !== void 0 && typeof value !== "function") throw new TypeError(`Operation "${name}": data must be a function.`);
-		const data = value;
-		const resultsValue = Reflect.get(definition, "results");
-		const results = resultsValue === void 0 ? void 0 : treeLeaf(keys, name, "results", resultsValue);
-		const meta = readMeta(name, Reflect.get(definition, "meta"));
-		out[name] = Object.freeze({
-			name,
-			permission,
-			...data === void 0 ? {} : { data },
-			...results === void 0 ? {} : { results },
-			meta
-		});
-	}
-	return Object.freeze(out);
-}
-//#endregion
 //#region src/core/approval-policies.ts
 /**
 * The denial detail when an `ApprovalPolicySource` fails: every call an allow
@@ -395,8 +313,8 @@ function shorter(a, b) {
 /**
 * `code` with every matching entry added as further stages: the result needs
 * all of them (`'sequential'` when any part is ordered), keeps the code's
-* escalation, the shortest `ttl`, and `distinct` unless every part opts out.
-* Without a matching entry, `code` unchanged.
+* escalation, the shortest `ttl`, and `'authorize'` unless every part is
+* `'confirm'`. Without a matching entry, `code` unchanged.
 */
 function tightenApproval(code, entries, input) {
 	const extra = entries.filter((entry) => (entry.permission === void 0 || entry.permission === input.permission) && metaMatches(entry, input.operation) && matches(entry, input.tenant, input.subject, input.current, input.next, input.now, input.scopes));
@@ -405,7 +323,7 @@ function tightenApproval(code, entries, input) {
 	const stages = [];
 	const seen = /* @__PURE__ */ new Set();
 	let sequential = false;
-	let distinct = false;
+	let authorize = false;
 	let staleOn;
 	let ttl;
 	for (const [index, part] of parts.entries()) {
@@ -418,18 +336,18 @@ function tightenApproval(code, entries, input) {
 			}
 		}
 		if (part === "human") {
-			distinct = true;
+			authorize = true;
 			continue;
 		}
-		sequential ||= part.mode === "sequential";
-		distinct ||= part.distinct !== false;
+		sequential ||= part.combine === "sequential";
+		authorize ||= part.mode !== "confirm";
 		staleOn ??= part.staleOn;
 		ttl = shorter(ttl, part.ttl);
 	}
 	return compact({
-		mode: sequential ? "sequential" : "all",
+		combine: sequential ? "sequential" : "all",
 		stages,
-		distinct: distinct ? void 0 : false,
+		mode: authorize ? void 0 : "confirm",
 		staleOn,
 		ttl,
 		escalation: code === void 0 || code === "human" ? void 0 : code.escalation
@@ -819,6 +737,153 @@ function signPolicyDocument(document, signer, options) {
 	});
 }
 //#endregion
+//#region src/core/instance-cache.ts
+const MAX_AGE_CEILING_MS = 6e4;
+const DEFAULT_MAX_AGE_MS = 5e3;
+const DEFAULT_MAX_ENTRIES$1 = 1e4;
+function roleKey(method, args) {
+	return `roles:${canonicalJson([method, ...args])}`;
+}
+function withoutMemo(context) {
+	if (context === void 0) return null;
+	const { memo: _memo, ...rest } = context;
+	return rest;
+}
+/**
+* An in-process `InstanceCache`: a bounded LRU that shares builds in flight.
+* Create it once at module scope and pass it as `instances` to every adapter of
+* the app; adapters with the same sources and policy share entries.
+*/
+function instanceCache(options = {}) {
+	const maxAgeMs = Math.min(Math.max(Math.floor(options.maxAgeMs ?? DEFAULT_MAX_AGE_MS), 0), MAX_AGE_CEILING_MS);
+	const maxEntries = Math.max(Math.floor(options.maxEntries ?? DEFAULT_MAX_ENTRIES$1), 1);
+	const now = options.now ?? Date.now;
+	const entries = /* @__PURE__ */ new Map();
+	const inFlight = /* @__PURE__ */ new Map();
+	const byPrincipal = /* @__PURE__ */ new Map();
+	const ownerIds = /* @__PURE__ */ new WeakMap();
+	let nextOwner = 0;
+	const counts = {
+		builds: 0,
+		shared: 0,
+		hits: 0,
+		evictions: 0
+	};
+	const ownerId = (owner) => {
+		const known = ownerIds.get(owner);
+		if (known !== void 0) return known;
+		nextOwner += 1;
+		const id = nextOwner;
+		ownerIds.set(owner, id);
+		return id;
+	};
+	const forget = (id) => {
+		const entry = entries.get(id);
+		entries.delete(id);
+		if (entry?.principal !== void 0) byPrincipal.get(entry.principal)?.delete(id);
+	};
+	const store = (id, entry) => {
+		entries.delete(id);
+		entries.set(id, entry);
+		if (entry.principal !== void 0) {
+			const keys = byPrincipal.get(entry.principal) ?? /* @__PURE__ */ new Set();
+			keys.add(id);
+			byPrincipal.set(entry.principal, keys);
+		}
+		if (entries.size > maxEntries) {
+			const oldest = entries.keys().next();
+			if (oldest.done !== true) forget(oldest.value);
+		}
+	};
+	const through = (id, principal, build) => {
+		const at = now();
+		const entry = entries.get(id);
+		if (entry !== void 0 && at - entry.at <= maxAgeMs) {
+			counts.hits += 1;
+			store(id, entry);
+			return entry.value;
+		}
+		if (entry !== void 0) forget(id);
+		const pending = inFlight.get(id);
+		if (pending !== void 0) {
+			counts.shared += 1;
+			return pending;
+		}
+		counts.builds += 1;
+		const answer = build();
+		if (!isThenable$1(answer)) {
+			if (maxAgeMs > 0) store(id, {
+				value: answer,
+				at,
+				principal
+			});
+			return answer;
+		}
+		const started = Promise.resolve(answer).then((value) => {
+			if (inFlight.get(id) === started && maxAgeMs > 0) store(id, {
+				value,
+				at,
+				principal
+			});
+			return value;
+		});
+		inFlight.set(id, started);
+		const settle = () => {
+			if (inFlight.get(id) === started) inFlight.delete(id);
+		};
+		started.then(settle, settle);
+		return started;
+	};
+	return Object.freeze({
+		name: "memory",
+		maxAgeMs,
+		instance(key, owners, build) {
+			const id = `instance:${owners.map((owner) => typeof owner === "object" && owner !== null || typeof owner === "function" ? ownerId(owner) : 0).join(",")}:${canonicalJson([
+				key.principal,
+				key.version,
+				key.tenant ?? null,
+				key.intent,
+				key.parts
+			])}`;
+			return Promise.resolve(through(id, key.principal, build));
+		},
+		customRoles(source, of) {
+			const sourceId = of === void 0 ? String(ownerId(source)) : `${String(ownerId(of.owner))}:${canonicalJson(of.principal)}`;
+			const principal = of?.principal;
+			const { globalRoles, sharedRoles, assignable } = source;
+			return Object.freeze({
+				...source.name === void 0 ? {} : { name: source.name },
+				rolesFor: (tenant, context) => through(roleKey(`${sourceId}:rolesFor`, [tenant, withoutMemo(context)]), principal, () => source.rolesFor(tenant, context)),
+				...assignable === void 0 ? {} : { assignable: (tenant) => through(roleKey(`${sourceId}:assignable`, [tenant]), principal, () => assignable.call(source, tenant)) },
+				...globalRoles === void 0 ? {} : { globalRoles: (context) => through(roleKey(`${sourceId}:globalRoles`, [withoutMemo(context)]), principal, () => globalRoles.call(source, context)) },
+				...sharedRoles === void 0 ? {} : { sharedRoles: (context) => through(roleKey(`${sourceId}:sharedRoles`, [withoutMemo(context)]), principal, () => sharedRoles.call(source, context)) }
+			});
+		},
+		entitlements(source) {
+			const sourceId = ownerId(source);
+			return Object.freeze({
+				...source.name === void 0 ? {} : { name: source.name },
+				entitlementsFor: (principal, scope) => through(`entitlements:${sourceId}:${canonicalJson([principal.id, scope.tenant ?? null])}`, principal.id, () => source.entitlementsFor(principal, scope))
+			});
+		},
+		evict(principal) {
+			counts.evictions += 1;
+			const keys = byPrincipal.get(principal);
+			byPrincipal.delete(principal);
+			for (const id of keys ?? []) {
+				entries.delete(id);
+				inFlight.delete(id);
+			}
+		},
+		stats() {
+			return {
+				...counts,
+				size: entries.size
+			};
+		}
+	});
+}
+//#endregion
 //#region src/core/version-cache.ts
 const MAX_STALE_CEILING_MS = 6e4;
 const DEFAULT_MAX_ENTRIES = 1e4;
@@ -847,23 +912,6 @@ function memoryVersionCache(options) {
 			if (oldest.done !== true) entries.delete(oldest.value);
 		}
 	};
-	const observe = (principal, at) => {
-		const claimed = principal.authzVersion;
-		if (typeof claimed !== "number") return;
-		const issued = typeof principal.issuedAt === "number" ? principal.issuedAt * 1e3 : void 0;
-		const entry = entries.get(principal.id);
-		if (entry === void 0) {
-			if (issued !== void 0 && issued <= at && at - issued <= maxStaleMs) store(principal.id, {
-				version: claimed,
-				at: issued
-			});
-			return;
-		}
-		if (claimed > entry.version) store(principal.id, {
-			version: claimed,
-			at: issued === void 0 ? entry.at : Math.max(entry.at, issued)
-		});
-	};
 	const start = (id, read, at) => {
 		counts.reads += 1;
 		const keep = (version) => {
@@ -892,7 +940,6 @@ function memoryVersionCache(options) {
 		current(principal, read, { live }) {
 			const at = now();
 			if (live) return start(principal.id, read, at);
-			observe(principal, at);
 			const entry = entries.get(principal.id);
 			if (entry !== void 0 && at - entry.at <= maxStaleMs) {
 				counts.hits += 1;
@@ -906,6 +953,24 @@ function memoryVersionCache(options) {
 			}
 			return start(principal.id, read, at);
 		},
+		seed(principal, version, at) {
+			if (!Number.isFinite(version)) return;
+			const current = now();
+			const dated = at === void 0 ? current : nowMillis(at);
+			if (dated > current) return;
+			const entry = entries.get(principal);
+			if (entry === void 0) {
+				if (current - dated <= maxStaleMs) store(principal, {
+					version,
+					at: dated
+				});
+				return;
+			}
+			if (version > entry.version || version === entry.version && dated > entry.at) store(principal, {
+				version,
+				at: Math.max(entry.at, dated)
+			});
+		},
 		evict(principal) {
 			counts.evictions += 1;
 			entries.delete(principal);
@@ -2140,4 +2205,4 @@ function toCsvRow(event) {
 	].map(field).join(",");
 }
 //#endregion
-export { isOperationEffect as A, memoryLimitStore as C, memoryApprovalPolicySource as D, approvalPoliciesFor as E, memorySnapshotSource as F, sqlFunction as I, memoryEntitlementSource as M, memoryMembershipSource as N, validateApprovalPolicy as O, memorySettingsSource as P, limits as S, approvalPolicies as T, arazzoFindings as _, normalizeMembership as a, signPolicyDocument as b, crud as c, snapshotFor as d, customRoleSource as f, localSnapshotManifest as g, defineApp as h, decideRoleChange as i, memoryCustomRoleSource as j, defineOperations as k, readable as l, shadowMode as m, toCsvRow as n, normalizeMemberships as o, mayAccess as p, checkRoleChange as r, resolveScope as s, CSV_COLUMNS as t, writable as u, simulateArazzo as v, stripeEntitlementSource as w, memoryRelationSource as x, memoryVersionCache as y };
+export { memoryCustomRoleSource as A, limits as C, approvalPoliciesFor as D, approvalPolicies as E, sqlFunction as F, memoryMembershipSource as M, memorySettingsSource as N, memoryApprovalPolicySource as O, memorySnapshotSource as P, memoryRelationSource as S, stripeEntitlementSource as T, arazzoFindings as _, normalizeMembership as a, instanceCache as b, crud as c, snapshotFor as d, customRoleSource as f, localSnapshotManifest as g, defineApp as h, decideRoleChange as i, memoryEntitlementSource as j, validateApprovalPolicy as k, readable as l, shadowMode as m, toCsvRow as n, normalizeMemberships as o, mayAccess as p, checkRoleChange as r, resolveScope as s, CSV_COLUMNS as t, writable as u, simulateArazzo as v, memoryLimitStore as w, signPolicyDocument as x, memoryVersionCache as y };

package/dist/ssf/index.d.ts

@@ -1,4 +1,4 @@
-import { A as SsfSubject, C as SsfEventName, D as SsfReceiver, E as SsfPermDockOptions, M as SsfTransmitterConfiguration, N as SsfVerification, O as SsfStreamConfiguration, S as SsfEventListener, T as SsfPermDock, _ as SetSubject, a as PollHandle, b as SsfEventHandler, c as PushSetOptions, d as SetDelivery, f as SetDeliveryFailureCause, g as SetQueue, h as SetPollHandlerOptions, i as CaepReason, j as SsfSubjectResolver, k as SsfStreamStatus, l as ReplayStore, m as SetEvent, n as CaepEventName, o as PollOptions, p as SetError, r as CaepInitiatingEntity, s as PollResult, t as CaepCommon, u as RiscEventName, v as SignSetOptions, w as SsfOnEvent, x as SsfEventInput, y as SsfAuditEvent } from "../types-DsHGPtkR.js";
-import { t as memoryReplayStore } from "../replay-Bs9Df2fQ.js";
-import { A as createPermDock, C as memorySsfStreamStore, D as PollSetsResult, E as PollSetsOptions, O as PolledSet, S as SsfStreamStore, T as setPollHandler, _ as SsfFanOut, a as CaepTokenClaimsChange, b as ssfTransmitter, c as RiscEvents, d as caepEvents, f as pushSet, g as FanOutSetOptions, h as streamVerificationEvent, i as CaepEvents, k as pollSets, l as SSF_POLL_DELIVERY, m as signSet, n as CaepCredentialChange, o as RiscAccountDisabled, p as riscEvents, r as CaepDeviceComplianceChange, s as RiscCredentialCompromise, t as CaepAssuranceLevelChange, u as SSF_PUSH_DELIVERY, v as SsfTransmitterOptions, w as memorySetQueue, x as SsfStream, y as fanOutSet } from "../index-BinlXeU-.js";
+import { A as SsfSubject, C as SsfEventName, D as SsfReceiver, E as SsfPermDockOptions, M as SsfTransmitterConfiguration, N as SsfVerification, O as SsfStreamConfiguration, S as SsfEventListener, T as SsfPermDock, _ as SetSubject, a as PollHandle, b as SsfEventHandler, c as PushSetOptions, d as SetDelivery, f as SetDeliveryFailureCause, g as SetQueue, h as SetPollHandlerOptions, i as CaepReason, j as SsfSubjectResolver, k as SsfStreamStatus, l as ReplayStore, m as SetEvent, n as CaepEventName, o as PollOptions, p as SetError, r as CaepInitiatingEntity, s as PollResult, t as CaepCommon, u as RiscEventName, v as SignSetOptions, w as SsfOnEvent, x as SsfEventInput, y as SsfAuditEvent } from "../types-Ck1KOfug.js";
+import { t as memoryReplayStore } from "../replay-E5X9E1lC.js";
+import { A as createPermDock, C as memorySsfStreamStore, D as PollSetsResult, E as PollSetsOptions, O as PolledSet, S as SsfStreamStore, T as setPollHandler, _ as SsfFanOut, a as CaepTokenClaimsChange, b as ssfTransmitter, c as RiscEvents, d as caepEvents, f as pushSet, g as FanOutSetOptions, h as streamVerificationEvent, i as CaepEvents, k as pollSets, l as SSF_POLL_DELIVERY, m as signSet, n as CaepCredentialChange, o as RiscAccountDisabled, p as riscEvents, r as CaepDeviceComplianceChange, s as RiscCredentialCompromise, t as CaepAssuranceLevelChange, u as SSF_PUSH_DELIVERY, v as SsfTransmitterOptions, w as memorySetQueue, x as SsfStream, y as fanOutSet } from "../index-BhnOOnp9.js";
 export { type CaepAssuranceLevelChange, type CaepCommon, type CaepCredentialChange, type CaepDeviceComplianceChange, type CaepEventName, type CaepEvents, type CaepInitiatingEntity, type CaepReason, type CaepTokenClaimsChange, type FanOutSetOptions, type PollHandle, type PollOptions, type PollResult, type PollSetsOptions, type PollSetsResult, type PolledSet, type PushSetOptions, type ReplayStore, type RiscAccountDisabled, type RiscCredentialCompromise, type RiscEventName, type RiscEvents, SSF_POLL_DELIVERY, SSF_PUSH_DELIVERY, type SetDelivery, type SetDeliveryFailureCause, type SetError, type SetEvent, type SetPollHandlerOptions, type SetQueue, type SetSubject, type SignSetOptions, type SsfAuditEvent, type SsfEventHandler, type SsfEventInput, type SsfEventListener, type SsfEventName, type SsfFanOut, type SsfOnEvent, type SsfPermDock, type SsfPermDockOptions, type SsfReceiver, type SsfStream, type SsfStreamConfiguration, type SsfStreamStatus, type SsfStreamStore, type SsfSubject, type SsfSubjectResolver, type SsfTransmitterConfiguration, type SsfTransmitterOptions, type SsfVerification, caepEvents, createPermDock, fanOutSet, memoryReplayStore, memorySetQueue, memorySsfStreamStore, pollSets, pushSet, riscEvents, setPollHandler, signSet, ssfTransmitter, streamVerificationEvent };

package/dist/ssf/index.js

@@ -3,7 +3,7 @@ import { o as statusProblem } from "../problem-details-CLDgX1KV.js";
 import { o as epochSeconds } from "../time-nR1JesoH.js";
 import { n as readBodyText } from "../body-text-DQhcmqdY.js";
 import { f as validationProblem, l as problemResponse, o as methodNotAllowed, s as notFoundProblem } from "../problem-BVLHFK33.js";
-import { t as cancelApprovals } from "../helpers-DJicaG6f.js";
+import { t as cancelApprovals } from "../helpers-DmqGy63f.js";
 import { i as issuerFromDiscovery, t as joseTokenVerifier } from "../verifier-DUV6pLqZ.js";
 import { t as memoryReplayStore } from "../replay-BU09ad4L.js";
 import { t as timeoutSignal } from "../timeout-D51niuQP.js";

package/dist/{standard-webhooks-DOYEuOLx.d.ts → standard-webhooks-BfPaZ6T1.d.ts}

@@ -1,5 +1,5 @@
-import { Wt as Instant, dr as JsonWebKeyLike } from "./policy-types-DGIO_gxq.js";
-import { l as ReplayStore } from "./types-DsHGPtkR.js";
+import { Kt as Instant, hr as JsonWebKeyLike } from "./policy-types-D-GwfQTc.js";
+import { l as ReplayStore } from "./types-Ck1KOfug.js";
 //#region src/server/standard-webhooks.d.ts
 /** The three Standard Webhooks headers a delivery carries. */
 type WebhookHeaders = {