permdock 0.3.0 → 0.4.0

package/dist/{src-BDwEZWrZ.js → src-Bb7no-hS.js}

@@ -1,16 +1,19 @@
-import { t as compact } from "./compact-y6vfu2_f.js";
+import { r as isRecord, t as compact } from "./compact-CAf557ZB.js";
 import { n as freezeDeep } from "./freeze-CrU8nQeX.js";
-import { i as findPermission } from "./permissions-DVoF6dMt.js";
-import { b as assertSqlFunctionArg, i as declaredRoleNames, s as grantList, u as levelNames, v as normalizeWhere, x as assertSqlFunctionName, y as assertPortableTwin } from "./policy-xyWg7QdR.js";
-import { d as scopeList, m as tenantOf } from "./scopes-CVdPrWN-.js";
-import { r as snapshotGrant, t as buildSnapshot } from "./snapshot-Enxd0n-s.js";
-import { T as listPlans, s as flattenGrantee } from "./grantee-Cv5Sogfv.js";
-import { t as canonicalJson } from "./canonical-json-DemiK4Vp.js";
+import { n as isThenable, s as ownGet } from "./thenable-QSmvt-vZ.js";
+import { _ as assertSqlFunctionName, g as assertSqlFunctionArg, h as assertPortableTwin, m as normalizeWhere } from "./role-builder-B4GbKM-i.js";
+import { d as scopeList, m as tenantOf } from "./scopes-tvpa34ep.js";
+import { r as snapshotGrant, t as buildSnapshot } from "./snapshot-Dc9CHPME.js";
+import { d as attachRegistry, i as getRegistry, n as findPermission, p as walk, r as formerByKey, t as assertKeys } from "./permission-registry-BsblpB-z.js";
+import { c as isEdgeRelation, m as restrictedStops, o as groupEntries, r as assertGraphTargets, s as isComputedRelation, u as isPrincipalRelation } from "./resource-relations-D1Un3pcz.js";
+import { _ as listPlans, o as flattenGrantee } from "./grantee-CXY-0C87.js";
+import { t as canonicalJson } from "./canonical-json-CFKyFOke.js";
+import { m as tenantsOf } from "./tenancy-DshjqY0n.js";
+import { a as declaredRoleNames, l as levelNames, s as grantList } from "./hosted-CBHgkzDl.js";
 import { n as sha256, t as bytesToBase64Url } from "./sha256-BO0swRXL.js";
-import { g as tenantsOf } from "./validity-uOp8UpYn.js";
-import { n as isThenable } from "./thenable-okc2xDsj.js";
-import { a as collectSnapshotGrants, c as rankRoles, l as usesAssigns, m as ceilingGrants, n as resolveSubject, o as snapshotOf, s as snapshotScopes, u as declaredRoleNames$1, y as resolveCustomRole } from "./permdock-CbgvLnuo.js";
-import { n as LOCAL_CUSTOM_ROLE } from "./parse-local-manifest-BrMozJCo.js";
+import { c as collectSnapshotGrants, l as rankRoles, m as ceilingGrants, n as resolveSubject, o as snapshotOf, s as snapshotScopes, u as usesAssigns, y as resolveCustomRole } from "./permdock-L26udHSk.js";
+import { n as relationId } from "./relations-CvmSpG67.js";
+import { n as LOCAL_CUSTOM_ROLE } from "./parse-local-manifest-C-q02Pal.js";
 //#region src/conditions/sql-function.ts
 function sqlFunction(name, options) {
 	assertSqlFunctionName(name);
@@ -26,7 +29,7 @@ function sqlFunction(name, options) {
 	});
 }
 //#endregion
-//#region src/core/interfaces.ts
+//#region src/core/memory-sources.ts
 function memoryEntitlementSource(entries) {
 	return { entitlementsFor(_principal, options) {
 		return options.tenant === void 0 ? [] : [...entries[options.tenant] ?? []];
@@ -129,6 +132,169 @@ function fromStripeEntitlements(options) {
 	} };
 }
 //#endregion
+//#region src/core/memory-relations.ts
+/** The holders one edge-table row names for `spec`: none when the row does not belong to it. */
+function tableHolders(resourceName, spec, row, id) {
+	if (relationId(ownGet(row, spec.object ?? `${resourceName}_id`)) !== id) return [];
+	for (const [column, value] of Object.entries(spec.match ?? {})) if (ownGet(row, column) !== value) return [];
+	const expiresAt = spec.expiresAt === void 0 ? void 0 : seconds(ownGet(row, spec.expiresAt));
+	const period = expiresAt === void 0 ? {} : { expiresAt };
+	const groups = spec.groups;
+	const direct = relationId(ownGet(row, spec.subject ?? "user_id"));
+	if (groups === void 0) return direct === void 0 ? [] : [{
+		principal: { id: direct },
+		...period
+	}];
+	if (groups.column === void 0) {
+		const out = direct === void 0 ? [] : [{
+			principal: { id: direct },
+			...period
+		}];
+		for (const group of groupEntries(spec)) {
+			const groupId = relationId(ownGet(row, group.subject));
+			if (groupId !== void 0) out.push({
+				group: {
+					resource: group.resource,
+					id: groupId,
+					relation: group.relation
+				},
+				...period
+			});
+		}
+		return out;
+	}
+	const kind = ownGet(row, groups.column);
+	if (kind === null || kind === void 0 || kind === groups.direct) return direct === void 0 ? [] : [{
+		principal: { id: direct },
+		...period
+	}];
+	const group = groupEntries(spec).find((entry) => entry.resource === kind);
+	const groupId = group === void 0 ? void 0 : relationId(ownGet(row, group.subject));
+	return group === void 0 || groupId === void 0 ? [] : [{
+		group: {
+			resource: group.resource,
+			id: groupId,
+			relation: group.relation
+		},
+		...period
+	}];
+}
+function seconds(value) {
+	if (value instanceof Date) {
+		const time = value.getTime();
+		return Number.isNaN(time) ? void 0 : time / 1e3;
+	}
+	if (typeof value === "number" && Number.isFinite(value)) return value;
+	if (typeof value === "string") {
+		const parsed = Date.parse(value);
+		return Number.isNaN(parsed) ? void 0 : parsed / 1e3;
+	}
+}
+function restrictedOf(node, row) {
+	return node.restricted !== void 0 && row !== void 0 && ownGet(row, node.restricted) === true;
+}
+function edgeHolder(edge) {
+	const holder = { principal: { id: edge.principal } };
+	if (edge.startsAt !== void 0) holder.startsAt = edge.startsAt;
+	if (edge.expiresAt !== void 0) holder.expiresAt = edge.expiresAt;
+	return holder;
+}
+/**
+* An in-process `RelationSource` over plain rows and edges, read against the
+* resource definitions in `permissions`. For tests, fixtures and small apps.
+*/
+function memoryRelations(permissions, data = {}) {
+	const registry = getRegistry(permissions);
+	const byId = /* @__PURE__ */ new Map();
+	for (const [name, rows] of Object.entries(data.rows ?? {})) {
+		const node = registry.get(name);
+		const index = /* @__PURE__ */ new Map();
+		for (const row of rows) {
+			const id = relationId(ownGet(row, node?.id ?? "id"));
+			if (id !== void 0) index.set(id, row);
+		}
+		byId.set(name, index);
+	}
+	const rowOf = (resource, id) => byId.get(resource)?.get(id);
+	return {
+		row({ resource, id }) {
+			return rowOf(resource, id) ?? null;
+		},
+		ancestors({ resource, id, depth, through }) {
+			const node = registry.get(resource);
+			const start = rowOf(resource, id);
+			if (node === void 0 || start === void 0) return { ancestors: [] };
+			if (through !== "parent") {
+				const link = Object.hasOwn(node.links, through) ? node.links[through] : void 0;
+				const next = link === void 0 ? void 0 : relationId(ownGet(start, link.field));
+				if (next === void 0 || depth < 1) return { ancestors: [] };
+				return { ancestors: [{ id: next }] };
+			}
+			const restricted = restrictedOf(node, start);
+			const stops = restrictedStops(node, "parent");
+			if (restricted && stops || node.parent === void 0 || node.parent.resource !== resource) return restricted ? {
+				restricted: true,
+				ancestors: []
+			} : { ancestors: [] };
+			const field = node.parent.field;
+			const seen = /* @__PURE__ */ new Set([id]);
+			const ancestors = [];
+			let next = relationId(ownGet(start, field));
+			while (next !== void 0 && ancestors.length < depth) {
+				const row = rowOf(resource, next);
+				if (row === void 0) {
+					next = void 0;
+					break;
+				}
+				const hidden = restrictedOf(node, row);
+				ancestors.push(hidden ? {
+					id: next,
+					restricted: true
+				} : { id: next });
+				if (seen.has(next) || hidden && stops) {
+					next = void 0;
+					break;
+				}
+				seen.add(next);
+				next = relationId(ownGet(row, field));
+			}
+			const chain = restricted ? {
+				restricted: true,
+				ancestors
+			} : { ancestors };
+			return next === void 0 || rowOf(resource, next) === void 0 ? chain : {
+				...chain,
+				truncated: true
+			};
+		},
+		related({ resource, id, relation }) {
+			const spec = registry.get(resource)?.relations[relation];
+			if (spec === void 0 || isComputedRelation(spec)) return [];
+			if (isEdgeRelation(spec)) {
+				const table = data.tables?.[spec.edge];
+				if (table !== void 0) return table.flatMap((row) => tableHolders(resource, spec, row, id));
+				return (data.edges?.[resource]?.[relation] ?? []).filter((edge) => edge.id === id).map(edgeHolder);
+			}
+			const row = rowOf(resource, id);
+			if (row === void 0) return [];
+			if (isPrincipalRelation(spec)) {
+				const holder = relationId(ownGet(row, spec.principal));
+				if (holder === void 0) return [];
+				const startsAt = spec.period?.startsAt === void 0 ? void 0 : seconds(ownGet(row, spec.period.startsAt));
+				const expiresAt = spec.period?.expiresAt === void 0 ? void 0 : seconds(ownGet(row, spec.period.expiresAt));
+				return [{
+					principal: { id: holder },
+					...startsAt === void 0 ? {} : { startsAt },
+					...expiresAt === void 0 ? {} : { expiresAt }
+				}];
+			}
+			if (spec.memberOf !== void 0) return [];
+			const holder = relationId(ownGet(row, spec.field));
+			return holder === void 0 ? [] : [{ principal: { id: holder } }];
+		}
+	};
+}
+//#endregion
 //#region src/core/local-manifest.ts
 /** A relation grantee needs the relation graph, which a device does not hold: the grant decides on the server only. */
 function localGrant(grant) {
@@ -229,7 +395,7 @@ function mayAccess(policy, user, permission, options = {}) {
 		const principal = resolved.principal;
 		const relevant = policy.index.grantsByKey.get(permission.key) ?? [];
 		if (principal !== null) {
-			const declared = declaredRoleNames$1(policy);
+			const declared = declaredRoleNames(policy);
 			if (heldRoleNames(principal).some((name) => !declared.has(name))) return true;
 			if ((principal.memberships ?? []).length === 0 && relevant.some((grant) => grant.scope !== "global")) return true;
 		}
@@ -315,6 +481,20 @@ function snapshotFor(policy, user, options = {}) {
 	}));
 }
 //#endregion
+//#region src/core/permissions.ts
+function definePermissions(input, options) {
+	const registry = /* @__PURE__ */ new Map();
+	const leaves = [];
+	const former = formerByKey(options?.renamed);
+	const tree = walk(input, [], registry, leaves, 0, {
+		former,
+		x: options?.x
+	});
+	assertKeys(leaves, former);
+	assertGraphTargets(registry);
+	return freezeDeep(attachRegistry(tree, registry, leaves));
+}
+//#endregion
 //#region src/core/presets.ts
 const CRUD_ACTIONS = {
 	read: { readOnly: true },
@@ -390,112 +570,6 @@ function writable(options) {
 	return finishPreset(WRITABLE_ACTIONS, WRITABLE_COLLECTION, options);
 }
 //#endregion
-//#region src/core/ocsf.ts
-/** The OCSF schema version `toOcsf` emits. */
-const OCSF_VERSION = "1.3.0";
-function status(outcome) {
-	switch (outcome) {
-		case "granted": return {
-			status_id: 1,
-			status: "Success"
-		};
-		case "denied": return {
-			status_id: 2,
-			status: "Failure"
-		};
-		case "approval-required": return {
-			status_id: 99,
-			status: "Other"
-		};
-		default: return unknownStatus(outcome);
-	}
-}
-/** An outcome this build does not know, from a newer producer, is reported as OCSF Unknown. */
-function unknownStatus(_outcome) {
-	return {
-		status_id: 0,
-		status: "Unknown"
-	};
-}
-/** Projects a decision or approval event onto OCSF Authorize Session; the event itself is unchanged. */
-function toOcsf(event) {
-	const principal = event.subject.principal;
-	const actor = event.subject.actor;
-	const breakGlass = event.matched?.breakGlass === true;
-	const detail = event.outcome === "approval-required" ? "approval-required" : event.denials?.map((denial) => denial.reason).join(",");
-	const time = Date.parse(event.at);
-	return compact({
-		class_uid: 3003,
-		category_uid: 3,
-		activity_id: 1,
-		type_uid: 300301,
-		severity_id: breakGlass ? 4 : 1,
-		time: Number.isNaN(time) ? 0 : time,
-		...status(event.outcome),
-		status_detail: detail === "" ? void 0 : detail,
-		message: `${event.permission} ${event.outcome}`,
-		privileges: [event.permission],
-		user: principal === null ? { name: "anonymous" } : { uid: principal.id },
-		actor: actor === void 0 ? void 0 : compact({
-			user: principal === null ? void 0 : { uid: principal.id },
-			app_name: actor.id
-		}),
-		metadata: compact({
-			version: OCSF_VERSION,
-			product: compact({
-				name: "PermDock",
-				vendor_name: "PermDock",
-				feature: event.adapter === void 0 ? void 0 : { name: event.adapter }
-			}),
-			tenant_uid: event.tenant,
-			correlation_uid: event.token
-		}),
-		unmapped: compact({
-			outcome: event.outcome,
-			scope: event.scope,
-			resource: event.resource,
-			source: event.source,
-			phase: event.phase,
-			role: event.matched?.role,
-			via: event.via,
-			breakGlass: breakGlass ? true : void 0,
-			purpose: event.purpose,
-			reason: event.reason
-		})
-	});
-}
-function accessToOcsf(event) {
-	const time = Date.parse(event.at);
-	const enable = event.operation === "started";
-	return compact({
-		class_uid: 3001,
-		category_uid: 3,
-		activity_id: enable ? 2 : 5,
-		type_uid: enable ? 300102 : 300105,
-		severity_id: 4,
-		time: Number.isNaN(time) ? 0 : time,
-		message: `support access ${event.operation}`,
-		user: { uid: event.principal.id },
-		actor: event.actor === void 0 ? void 0 : { user: { uid: event.actor.id } },
-		metadata: {
-			version: OCSF_VERSION,
-			product: {
-				name: "PermDock",
-				vendor_name: "PermDock"
-			},
-			tenant_uid: event.tenant
-		},
-		unmapped: compact({
-			operation: event.operation,
-			via: event.via,
-			roles: event.roles,
-			member: event.member,
-			grantedBy: event.grantedBy,
-			reason: event.reason
-		})
-	});
-}
-//#endregion
 //#region src/core/csv.ts
 /** The CSV export columns, in order; the header row of every CSV file. */
 const CSV_COLUMNS = Object.freeze([
@@ -539,9 +613,6 @@ const OMITTED_TOP_LEVEL = /* @__PURE__ */ new Set([
 	"generator",
 	"fingerprint"
 ]);
-function isRecord(value) {
-	return value !== null && typeof value === "object" && !Array.isArray(value);
-}
 function fingerprintInput(catalog) {
 	const out = {};
 	for (const [key, value] of Object.entries(catalog)) {
@@ -565,4 +636,4 @@ function catalogFingerprint(catalog) {
 	return bytesToBase64Url(sha256(canonicalJson(fingerprintInput(catalog))));
 }
 //#endregion
-export { memoryRoleSource as _, accessToOcsf as a, sqlFunction as b, readable as c, customRoleSource as d, mayAccess as f, memoryMembershipSource as g, memoryEntitlementSource as h, OCSF_VERSION as i, writable as l, fromStripeEntitlements as m, CSV_COLUMNS as n, toOcsf as o, localSnapshotManifest as p, toCsvRow as r, crud as s, catalogFingerprint as t, snapshotFor as u, memorySettings as v, memorySnapshotSource as y };
+export { memorySettings as _, readable as a, snapshotFor as c, localSnapshotManifest as d, memoryRelations as f, memoryRoleSource as g, memoryMembershipSource as h, crud as i, customRoleSource as l, memoryEntitlementSource as m, CSV_COLUMNS as n, writable as o, fromStripeEntitlements as p, toCsvRow as r, definePermissions as s, catalogFingerprint as t, mayAccess as u, memorySnapshotSource as v, sqlFunction as y };

package/dist/ssf/index.d.ts

@@ -1,4 +1,4 @@
-import { C as SsfPermDock, D as SsfSubjectMapper, E as SsfSubject, S as SsfOnEvent, T as SsfReceiver, _ as SetSubject, b as SsfEventInput, f as CaepEventName, g as ReplayStore, h as PollResult, m as PollOptions, p as PollHandle, v as SsfAuditEvent, w as SsfPermDockOptions, x as SsfEventListener, y as SsfEventHandler } from "../types-Cq_H8N_X.js";
-import { t as memoryReplayStore } from "../replay-CYyiLiwO.js";
-import { t as createPermDock } from "../index-0nNqHspG.js";
+import { C as SsfPermDock, D as SsfSubjectMapper, E as SsfSubject, S as SsfOnEvent, T as SsfReceiver, _ as SetSubject, b as SsfEventInput, f as CaepEventName, g as ReplayStore, h as PollResult, m as PollOptions, p as PollHandle, v as SsfAuditEvent, w as SsfPermDockOptions, x as SsfEventListener, y as SsfEventHandler } from "../types-C0dee0Qf.js";
+import { t as memoryReplayStore } from "../replay-COpmZUfx.js";
+import { t as createPermDock } from "../index-DgM7w96K.js";
 export { type CaepEventName, type PollHandle, type PollOptions, type PollResult, type ReplayStore, type SetSubject, type SsfAuditEvent, type SsfEventHandler, type SsfEventInput, type SsfEventListener, type SsfOnEvent, type SsfPermDock, type SsfPermDockOptions, type SsfReceiver, type SsfSubject, type SsfSubjectMapper, createPermDock, memoryReplayStore };

package/dist/ssf/index.js

@@ -1,66 +1,8 @@
-import { t as compact } from "../compact-y6vfu2_f.js";
-import { t as cancelApprovals } from "../helpers-H_KARDVC.js";
-import { i as issuerFromDiscovery, t as joseTokenVerifier } from "../verifier-BxBo6I44.js";
+import { r as isRecord, t as compact } from "../compact-CAf557ZB.js";
+import { t as cancelApprovals } from "../helpers-C9YmyBIa.js";
+import { i as issuerFromDiscovery, t as joseTokenVerifier } from "../verifier-DMr_Zmb_.js";
 import { t as memoryReplayStore } from "../replay-BsOyTrdV.js";
 import { t as timeoutSignal } from "../timeout-D51niuQP.js";
-//#region src/ssf/wire.ts
-const SET_TYP = "secevent+jwt";
-const LOGOUT_TYP = "logout+jwt";
-function jsonResponse(status, body) {
-	return new Response(JSON.stringify(body), {
-		status,
-		headers: { "content-type": "application/json" }
-	});
-}
-function rfc8935(status, err, description) {
-	return jsonResponse(status, {
-		err,
-		description
-	});
-}
-function errForCause(cause) {
-	switch (cause) {
-		case "invalid-signature":
-		case "unknown-kid":
-		case "alg-not-allowed":
-		case "alg-none": return "invalid_key";
-		case "wrong-issuer": return "invalid_issuer";
-		case "wrong-audience": return "invalid_audience";
-		case "expired":
-		case "not-yet-valid":
-		case "wrong-token-type":
-		case "malformed":
-		case "encrypted-token":
-		case "dpop-proof-invalid":
-		case "mtls-binding-mismatch":
-		case "sender-constraint-required":
-		case "token-in-query":
-		case "invalid-claims":
-		case "invalid-chain":
-		case "jwks-unavailable":
-		case "discovery-unavailable":
-		case "discovery-mismatch": return "invalid_request";
-		default: return cause;
-	}
-}
-function isRecord(value) {
-	return value !== null && typeof value === "object" && !Array.isArray(value);
-}
-function contentType(request) {
-	return (request.headers.get("content-type") ?? "").split(";", 1)[0]?.trim().toLowerCase() ?? "";
-}
-function parseEvery(every) {
-	if (typeof every === "number") {
-		if (!Number.isFinite(every) || every <= 0) throw new TypeError("PermDock: poll every must be a positive interval.");
-		return every;
-	}
-	const match = /^(\d+)(ms|s|m)$/u.exec(every);
-	if (match?.[2] === void 0) throw new TypeError(`PermDock: invalid poll interval '${every}'.`);
-	const unit = match[2];
-	const scale = unit === "ms" ? 1 : unit === "s" ? 1e3 : 6e4;
-	return Number(match[1]) * scale;
-}
-//#endregion
 //#region src/ssf/claims.ts
 function asSubject(mapped, session, issuer) {
 	if (typeof mapped === "string") return compact({
@@ -180,6 +122,61 @@ async function pollOnce(input) {
 	return processed;
 }
 //#endregion
+//#region src/ssf/wire.ts
+const SET_TYP = "secevent+jwt";
+const LOGOUT_TYP = "logout+jwt";
+function jsonResponse(status, body) {
+	return new Response(JSON.stringify(body), {
+		status,
+		headers: { "content-type": "application/json" }
+	});
+}
+function rfc8935(status, err, description) {
+	return jsonResponse(status, {
+		err,
+		description
+	});
+}
+function errForCause(cause) {
+	switch (cause) {
+		case "invalid-signature":
+		case "unknown-kid":
+		case "alg-not-allowed":
+		case "alg-none": return "invalid_key";
+		case "wrong-issuer": return "invalid_issuer";
+		case "wrong-audience": return "invalid_audience";
+		case "expired":
+		case "not-yet-valid":
+		case "wrong-token-type":
+		case "malformed":
+		case "encrypted-token":
+		case "dpop-proof-invalid":
+		case "mtls-binding-mismatch":
+		case "sender-constraint-required":
+		case "token-in-query":
+		case "invalid-claims":
+		case "invalid-chain":
+		case "jwks-unavailable":
+		case "discovery-unavailable":
+		case "discovery-mismatch": return "invalid_request";
+		default: return cause;
+	}
+}
+function contentType(request) {
+	return (request.headers.get("content-type") ?? "").split(";", 1)[0]?.trim().toLowerCase() ?? "";
+}
+function parseEvery(every) {
+	if (typeof every === "number") {
+		if (!Number.isFinite(every) || every <= 0) throw new TypeError("PermDock: poll every must be a positive interval.");
+		return every;
+	}
+	const match = /^(\d+)(ms|s|m)$/u.exec(every);
+	if (match?.[2] === void 0) throw new TypeError(`PermDock: invalid poll interval '${every}'.`);
+	const unit = match[2];
+	const scale = unit === "ms" ? 1 : unit === "s" ? 1e3 : 6e4;
+	return Number(match[1]) * scale;
+}
+//#endregion
 //#region src/ssf/receiver.ts
 const CHANGED_EVENTS = /* @__PURE__ */ new Set([
 	"credential-change",

package/dist/store-9KO4BlkB.d.ts

@@ -0,0 +1,147 @@
+import { Or as Principal, an as Snapshot, ir as Decision, j as PolicyVocabulary, jt as PermDock, ut as TokenVerifier, vr as Actor, wr as Delegation } from "./policy-types-sp9P1iIV.js";
+import { d as Permission } from "./permission-types-Dg39z9Kv.js";
+import { n as DescribeMessages } from "./describe-C3ldA9os.js";
+//#region src/client/types.d.ts
+type ClientStatus = "ready" | "pending" | "stale" | "server-only";
+type PermissionState = {
+  readonly allowed: boolean;
+  readonly status: ClientStatus;
+  readonly decision: Decision;
+};
+type PermissionSet = {
+  readonly granted: readonly Permission[];
+  get(permission: Permission): PermissionState | undefined;
+};
+type ClientPermDock<V extends PolicyVocabulary = PolicyVocabulary> = PermDock<V> & {
+  status(permission?: Permission, data?: unknown): ClientStatus;
+  invalidate(ref: Permission | {
+    readonly [key: string]: unknown;
+  }): void;
+  refresh(options?: {
+    readonly tenant?: string;
+  }): Promise<void>;
+  clear(): void;
+  subscribe(listener: () => void): () => void;
+};
+type ApprovalState = "not-needed" | "required" | "pending" | "approved" | "rejected" | "expired";
+type ApprovalHandle = {
+  readonly state: ApprovalState;
+  readonly token: string | undefined;
+  readonly request: (note?: string) => Promise<void>;
+};
+type SubjectView = {
+  readonly principal: Principal | null;
+  readonly actor: Actor | undefined;
+  readonly delegation: Delegation | undefined;
+  readonly expiresAt: number | undefined;
+  readonly simulated: boolean;
+};
+type TenantView = {
+  readonly tenant: string | null;
+  readonly tenants: readonly string[];
+  readonly switchTo: (id: string) => Promise<void>;
+  readonly status: ClientStatus;
+};
+type FilterResult<T> = readonly T[] & {
+  readonly partial: boolean;
+};
+type UseRolesOptions = {
+  readonly tenant?: string;
+  readonly team?: string;
+};
+/** The provider options Vue, Svelte and Solid share; each adds its own reactive `snapshot`, `tenant`, `headers`, `verifier` and `defaults`. */
+type ProviderOptionsBase = {
+  /**
+   * The AuthZEN evaluations endpoint for checks the snapshot cannot answer.
+   * `false` never calls one: such a check is denied with reason `server-only`.
+   */
+  readonly endpoint?: string | false;
+  /** Where `refresh()` fetches a fresh snapshot. Defaults to `endpoint`. */
+  readonly snapshotUrl?: string;
+  readonly approvals?: string;
+  /** Read on every request, so a new `fetch` applies without a new store. */
+  readonly fetch?: typeof fetch;
+  readonly maxAge?: number;
+  /** Localised text for the describe helper. */
+  readonly messages?: DescribeMessages;
+  /** Called with each snapshot the store accepts. */
+  readonly onSnapshot?: NonNullable<ClientStoreOptions["onSnapshot"]>;
+  /** Called when the store drops its snapshot. */
+  readonly onClear?: () => void;
+  /** Milliseconds between approval status polls. Defaults to 2000. */
+  readonly approvalInterval?: number;
+};
+//#endregion
+//#region src/client/request.d.ts
+type StoreHeaders = Readonly<Record<string, string>>;
+//#endregion
+//#region src/client/store.d.ts
+type ClientStoreOptions = {
+  readonly snapshot: Snapshot | string;
+  readonly endpoint?: string;
+  readonly snapshotUrl?: string;
+  readonly approvals?: string;
+  readonly tenant?: string;
+  readonly fetch?: typeof fetch;
+  /** Request headers, or a getter read on every request so a rotated token needs no new store. */
+  readonly headers?: StoreHeaders | (() => StoreHeaders | undefined);
+  readonly maxAge?: number;
+  readonly verifier?: TokenVerifier;
+  /** `raw` is the compact JWS the snapshot was verified from, so a signed snapshot can be persisted signed. */
+  readonly onSnapshot?: (snapshot: Snapshot, tenant: string | undefined, raw: string | undefined) => void;
+  readonly onClear?: () => void;
+  /** Called once per key the snapshot cannot answer when there is no `endpoint` to ask. */
+  readonly onServerOnly?: (permission: Permission) => void;
+  /**
+   * `true` while rendering on the server: endpoint checks answer `pending`
+   * without a request. Defaults to `typeof window === 'undefined'`.
+   */
+  readonly server?: boolean;
+  /** Milliseconds between approval status polls. Defaults to 2000. */
+  readonly approvalInterval?: number;
+  /** Start `pending`: the snapshot arrives later through `track()`. */
+  readonly awaiting?: boolean;
+  /**
+   * The first snapshot that hydrates with a principal is a persisted copy:
+   * `stale` until a refresh or a `replace()` lands.
+   */
+  readonly stale?: boolean;
+  /**
+   * Reuse decisions for the same row object until the next microtask. Only for
+   * renderers that do not track the fields a check reads (React): Vue, Svelte
+   * and Solid would stop re-running when a reactive row changes in place.
+   */
+  readonly passCache?: boolean;
+};
+type ClientStore = {
+  get(): ClientPermDock;
+  subscribe(listener: () => void): () => void;
+  permissionState(permission: Permission, data?: unknown): PermissionState;
+  requestApproval(decision: Decision, note?: string): Promise<void>;
+  /** Hydrate from a pushed snapshot; a compact JWS goes through the verifier. */
+  replace(value: unknown): void;
+  /** Stay `pending` until `value` settles, then hydrate; a rejection fails closed. */
+  follow(value: PromiseLike<Snapshot | string>): void;
+  /**
+   * `follow()` once per `value`, without suspending. A thenable React already
+   * settled (`status: 'fulfilled'`) hydrates at once.
+   */
+  track(value: PromiseLike<Snapshot | string>): void;
+  /**
+   * The approval state for a decision. While something subscribes, an
+   * `approval-required` decision is polled at `<approvals>/<token>`.
+   */
+  approvalState(decision: Decision): ApprovalState;
+  /**
+   * Hydrate from a resolved `snapshotPromise` during render. Idempotent per `source`;
+   * subscribers are notified in a microtask, never synchronously inside render.
+   */
+  adopt(value: Snapshot | string, source: object): void;
+  snapshot(): Snapshot;
+  /** The tenant the store currently answers for. */
+  tenant(): string | undefined;
+  /** Stops polls, drops in-flight results and persistence; the store keeps answering from its last snapshot. */
+  dispose(): void;
+};
+//#endregion
+export { ClientPermDock as a, PermissionSet as c, SubjectView as d, TenantView as f, ApprovalState as i, PermissionState as l, ClientStoreOptions as n, ClientStatus as o, UseRolesOptions as p, ApprovalHandle as r, FilterResult as s, ClientStore as t, ProviderOptionsBase as u };

package/dist/{store-DMAWwAJV.js → store-ILkLUj_o.js}

@@ -1,9 +1,9 @@
-import { t as compact } from "./compact-y6vfu2_f.js";
+import { t as compact } from "./compact-CAf557ZB.js";
 import { n as freezeDeep } from "./freeze-CrU8nQeX.js";
-import { i as flattenApprovers } from "./approvers-DT4AVyIg.js";
-import { s as rootMembershipId } from "./scopes-CVdPrWN-.js";
+import { i as flattenApprovers } from "./approvers-CqPOLD-o.js";
+import { s as rootMembershipId } from "./scopes-tvpa34ep.js";
 import { t as parseDuration } from "./duration-xK2jGFVc.js";
-import { d as matchGrantee } from "./grantee-Cv5Sogfv.js";
+import { n as matchGrantee } from "./grantee-match-fxYp9Nmt.js";
 import { t as ApprovalError } from "./errors-DRnGZHzF.js";
 //#region src/approvals/types.ts
 const APPROVAL_HEADER = "PermDock-Approval";