permdock 0.3.1 → 0.5.0

package/dist/sql-xdg5f4Fi.js

@@ -1,27 +0,0 @@
-//#region src/core/sql.ts
-/** A bare Postgres identifier PermDock emits unquoted-safe: letters, digits and `_`, not starting with a digit. */
-const SQL_IDENT = /^[A-Za-z_][A-Za-z0-9_]*$/u;
-/** A validated, double-quoted identifier; anything outside `SQL_IDENT` throws. */
-function quoteSqlIdent(name, prefix = "PermDock") {
-	if (!SQL_IDENT.test(name)) throw new TypeError(`${prefix}: unsafe SQL identifier '${name}'`);
-	return `"${name}"`;
-}
-/** A schema-qualified name, each part validated by `quoteSqlIdent`. */
-function quoteSqlTable(name, prefix = "PermDock") {
-	return name.split(".").map((part) => quoteSqlIdent(part, prefix)).join(".");
-}
-/** A single-quoted string literal with embedded quotes doubled. */
-function quoteSqlLiteral(value) {
-	return `'${value.replaceAll("'", "''")}'`;
-}
-/** A double-quoted identifier read back from a database, embedded quotes doubled rather than refused. */
-function escapeSqlIdent(name) {
-	return `"${name.replaceAll("\"", "\"\"")}"`;
-}
-const PLAIN_IDENT = /^[a-z_][a-z0-9_]*$/u;
-/** An identifier left bare when it is already lower snake case, otherwise quoted by `escapeSqlIdent`. */
-function sqlIdent(name) {
-	return PLAIN_IDENT.test(name) ? name : escapeSqlIdent(name);
-}
-//#endregion
-export { quoteSqlTable as a, quoteSqlLiteral as i, escapeSqlIdent as n, sqlIdent as o, quoteSqlIdent as r, SQL_IDENT as t };

package/dist/src-BDwEZWrZ.js

@@ -1,568 +0,0 @@
-import { t as compact } from "./compact-y6vfu2_f.js";
-import { n as freezeDeep } from "./freeze-CrU8nQeX.js";
-import { i as findPermission } from "./permissions-DVoF6dMt.js";
-import { b as assertSqlFunctionArg, i as declaredRoleNames, s as grantList, u as levelNames, v as normalizeWhere, x as assertSqlFunctionName, y as assertPortableTwin } from "./policy-xyWg7QdR.js";
-import { d as scopeList, m as tenantOf } from "./scopes-CVdPrWN-.js";
-import { r as snapshotGrant, t as buildSnapshot } from "./snapshot-Enxd0n-s.js";
-import { T as listPlans, s as flattenGrantee } from "./grantee-Cv5Sogfv.js";
-import { t as canonicalJson } from "./canonical-json-DemiK4Vp.js";
-import { n as sha256, t as bytesToBase64Url } from "./sha256-BO0swRXL.js";
-import { g as tenantsOf } from "./validity-uOp8UpYn.js";
-import { n as isThenable } from "./thenable-okc2xDsj.js";
-import { a as collectSnapshotGrants, c as rankRoles, l as usesAssigns, m as ceilingGrants, n as resolveSubject, o as snapshotOf, s as snapshotScopes, u as declaredRoleNames$1, y as resolveCustomRole } from "./permdock-CbgvLnuo.js";
-import { n as LOCAL_CUSTOM_ROLE } from "./parse-local-manifest-BrMozJCo.js";
-//#region src/conditions/sql-function.ts
-function sqlFunction(name, options) {
-	assertSqlFunctionName(name);
-	const args = options.args ?? [];
-	for (const arg of args) assertSqlFunctionArg(arg);
-	const twin = normalizeWhere(options.twin);
-	assertPortableTwin(twin);
-	return freezeDeep({
-		op: "sqlFunction",
-		name,
-		args,
-		twin
-	});
-}
-//#endregion
-//#region src/core/interfaces.ts
-function memoryEntitlementSource(entries) {
-	return { entitlementsFor(_principal, options) {
-		return options.tenant === void 0 ? [] : [...entries[options.tenant] ?? []];
-	} };
-}
-function memorySettings(settings) {
-	const byTenant = new Map(Object.entries(settings));
-	return Object.freeze({ settingsFor(tenant) {
-		return byTenant.get(tenant);
-	} });
-}
-/** Memberships keyed by principal id; `tenant` is not a filter, as for a database source. */
-function memoryMembershipSource(entries) {
-	const byPrincipal = new Map(Object.entries(entries));
-	return Object.freeze({
-		membershipsFor(principal) {
-			return [...byPrincipal.get(principal.id) ?? []];
-		},
-		list(query) {
-			const members = [];
-			for (const [id, memberships] of byPrincipal) for (const membership of memberships) if (membership.scope === query.scope && membership.id === query.id) members.push({
-				principal: { id },
-				membership
-			});
-			return members;
-		}
-	});
-}
-/** A snapshot held in memory; `set` replaces it and notifies every subscriber. */
-function memorySnapshotSource(initial) {
-	let current = initial;
-	const listeners = /* @__PURE__ */ new Set();
-	return Object.freeze({
-		get: () => current,
-		subscribe(listener) {
-			listeners.add(listener);
-			return () => {
-				listeners.delete(listener);
-			};
-		},
-		set(snapshot) {
-			current = snapshot;
-			for (const listener of listeners) listener();
-		}
-	});
-}
-function memoryRoleSource(customRoles) {
-	const byTenant = /* @__PURE__ */ new Map();
-	const global = [];
-	for (const role of customRoles) {
-		if (role.tenant === void 0) {
-			global.push(role);
-			continue;
-		}
-		const list = byTenant.get(role.tenant) ?? [];
-		list.push(role);
-		byTenant.set(role.tenant, list);
-	}
-	return {
-		rolesFor(tenant) {
-			return [...byTenant.get(tenant) ?? []];
-		},
-		globalRoles() {
-			return [...global];
-		}
-	};
-}
-//#endregion
-//#region src/core/stripe-entitlements.ts
-const PAGE = 100;
-const MAX_PAGES = 10;
-/**
-* Plan names from Stripe Entitlements: the `lookup_key` of every active
-* entitlement of the tenant's Stripe customer. `customer` maps the active
-* tenant to its customer id; no tenant or no customer means no entitlements.
-* Pass it as `entitlements`, and grant with `plan('<lookup_key>')`.
-*/
-function fromStripeEntitlements(options) {
-	return { async entitlementsFor(principal, query) {
-		if (query.tenant === void 0) return [];
-		const customer = await options.customer(query.tenant, principal);
-		if (customer === void 0 || customer === "") return [];
-		const keys = /* @__PURE__ */ new Set();
-		let after;
-		for (let page = 0; page < MAX_PAGES; page += 1) {
-			const result = await options.stripe.entitlements.activeEntitlements.list(after === void 0 ? {
-				customer,
-				limit: PAGE
-			} : {
-				customer,
-				limit: PAGE,
-				starting_after: after
-			});
-			for (const item of result.data) if (typeof item.lookup_key === "string" && item.lookup_key !== "") keys.add(item.lookup_key);
-			const last = result.data.at(-1);
-			if (!result.has_more || last === void 0) break;
-			after = last.id;
-		}
-		return [...keys].toSorted();
-	} };
-}
-//#endregion
-//#region src/core/local-manifest.ts
-/** A relation grantee needs the relation graph, which a device does not hold: the grant decides on the server only. */
-function localGrant(grant) {
-	const relational = flattenGrantee(grant.to).some((item) => item.kind === "relation");
-	return snapshotGrant(relational ? {
-		...grant,
-		portable: false
-	} : grant, void 0);
-}
-function customTable(policy, scope, roles) {
-	const keys = [...new Set(ceilingGrants(policy, scope).map((grant) => grant.permission.key))];
-	if (keys.length === 0) return;
-	const resolve = (body) => resolveCustomRole(policy, scope === "global" ? {
-		name: LOCAL_CUSTOM_ROLE,
-		scope: "global",
-		...body
-	} : {
-		name: LOCAL_CUSTOM_ROLE,
-		tenant: LOCAL_CUSTOM_ROLE,
-		scope,
-		...body
-	}).grants.map(localGrant);
-	const permissions = {};
-	for (const key of keys) {
-		const leaf = findPermission(policy.permissions, key);
-		const names = leaf?.kind === "instance" ? levelNames(policy, leaf.resource) : [];
-		permissions[key] = compact({
-			all: resolve({ grants: [{ permission: key }] }),
-			levels: names.length === 0 ? void 0 : Object.fromEntries(names.map((level) => [level, resolve({ grants: [{
-				permission: key,
-				level
-			}] })]))
-		});
-	}
-	const includes = {};
-	for (const role of roles) {
-		const grants = resolve({ includes: [role] });
-		if (grants.length > 0) includes[role] = grants;
-	}
-	return {
-		permissions,
-		includes
-	};
-}
-/**
-* What the policy grants, as JSON a device turns into snapshots from its own
-* membership rows (`localSnapshot` in `permdock/react-native`). Write it at
-* build time; the policy itself never ships to the client.
-*/
-function localSnapshotManifest(policy) {
-	const roles = [...declaredRoleNames(policy)].toSorted();
-	const custom = {};
-	for (const scope of [...scopeList(policy.scopes).map((item) => item.name), "global"]) {
-		const table = customTable(policy, scope, roles);
-		if (table !== void 0) custom[scope] = table;
-	}
-	const scopes = snapshotScopes(policy);
-	const { vocabulary } = buildSnapshot({
-		subject: {
-			principal: null,
-			context: {}
-		},
-		roles: [],
-		grants: [],
-		vocabulary: policy.vocabulary
-	});
-	return freezeDeep(compact({
-		v: 1,
-		scopes,
-		vocabulary,
-		roles,
-		rank: usesAssigns(policy) ? rankRoles(policy, roles) : void 0,
-		grants: grantList(policy).map(localGrant),
-		custom
-	}));
-}
-//#endregion
-//#region src/core/may-access.ts
-function policyPlans(policy) {
-	const names = new Set(listPlans(policy.vocabulary?.plans).map((p) => p.key));
-	for (const grant of grantList(policy)) for (const item of flattenGrantee(grant.to)) if (item.kind === "plan") names.add(item.plan);
-	return [...names];
-}
-function heldRoleNames(principal) {
-	return [...principal.roles ?? [], ...(principal.memberships ?? []).flatMap((item) => item.roles)];
-}
-/**
-* An optimistic routing hint for a proxy or middleware, never a decision.
-* `false` only when the subject's declared roles provably lack `permission`;
-* `true` whenever custom roles, plans, memberships the claims do not carry or
-* row conditions could still grant it. Synchronous, no network, never throws.
-* Pages, Server Actions and RLS remain the enforcement points.
-*/
-function mayAccess(policy, user, permission, options = {}) {
-	try {
-		const resolved = resolveSubject(policy, user, compact({ tenant: options.tenant }), []);
-		if (isThenable(resolved)) return true;
-		const principal = resolved.principal;
-		const relevant = policy.index.grantsByKey.get(permission.key) ?? [];
-		if (principal !== null) {
-			const declared = declaredRoleNames$1(policy);
-			if (heldRoleNames(principal).some((name) => !declared.has(name))) return true;
-			if ((principal.memberships ?? []).length === 0 && relevant.some((grant) => grant.scope !== "global")) return true;
-		}
-		const tenant = options.tenant;
-		const subject = principal === null ? resolved : {
-			...resolved,
-			principal: {
-				...principal,
-				plans: policyPlans(policy),
-				memberships: (principal.memberships ?? []).filter((item) => {
-					const owner = tenantOf(item, scopeList(policy.scopes));
-					return tenant === void 0 || owner === void 0 || owner === tenant;
-				})
-			}
-		};
-		const matched = collectSnapshotGrants(policy, subject, []).filter((item) => item.grant.permission.key === permission.key);
-		if (matched.some((item) => item.grant.effect === "deny" && item.grant.where === void 0 && item.grant.check === void 0 && item.grant.portable)) return false;
-		return matched.some((item) => item.grant.effect === "allow");
-	} catch {
-		return true;
-	}
-}
-//#endregion
-//#region src/core/custom-role-source.ts
-function ofTenant(tenant, roles) {
-	return Array.isArray(roles) ? roles.filter((role) => role !== null && typeof role === "object" && Reflect.get(role, "tenant") === tenant) : [];
-}
-/**
-* A `RoleSource` over a reader that returns every custom role of a tenant.
-* It keeps only the roles of the requested tenant. With `read: 'held'` it
-* skips a tenant's read, and `globalRoles`, when the subject holds only
-* declared roles there.
-*/
-function customRoleSource(reader, options = {}) {
-	const declared = options.read === "held" ? declaredRoleNames(options.policy) : void 0;
-	return Object.freeze({
-		rolesFor(tenant, context) {
-			if (declared !== void 0 && context?.held.every((name) => declared.has(name)) === true) return [];
-			const roles = reader.rolesOf(tenant);
-			return isThenable(roles) ? roles.then((list) => ofTenant(tenant, list)) : ofTenant(tenant, roles);
-		},
-		...reader.assignable === void 0 ? {} : { assignable: (tenant) => reader.assignable?.(tenant) ?? [] },
-		...reader.globalRoles === void 0 ? {} : { globalRoles: (context) => declared !== void 0 && context?.held.every((name) => declared.has(name)) === true ? [] : reader.globalRoles?.() ?? [] }
-	});
-}
-//#endregion
-//#region src/core/snapshot-for.ts
-function withPlans(subject, plans) {
-	if (plans === void 0 || subject.principal === null) return subject;
-	return freezeDeep(compact({
-		...subject,
-		principal: compact({
-			...subject.principal,
-			plans: [...plans]
-		})
-	}));
-}
-/**
-* Builds the serializable access snapshot for a subject without a request,
-* a network call or a cache directive: call it inside the app's own
-* `'use cache: private'` function. Synchronous; the policy's `subject` and
-* `context` mappers must be synchronous too.
-*/
-function snapshotFor(policy, user, options = {}) {
-	const auth = [];
-	const memberships = options.memberships;
-	const resolved = resolveSubject(policy, user, compact({
-		tenant: options.tenant,
-		memberships: memberships === void 0 ? void 0 : { membershipsFor: () => [...memberships] }
-	}), auth);
-	if (isThenable(resolved)) throw new TypeError("PermDock: snapshotFor() needs synchronous subject and context mappers. Resolve async data first and pass it as a Subject, or use createPermDock(...).snapshot().");
-	const subject = withPlans(resolved, options.plans);
-	const tenants = new Set(tenantsOf(subject.principal, scopeList(policy.scopes)));
-	const customRoles = (options.customRoles ?? []).filter((item) => item.scope === "global" || item.tenant !== void 0 && tenants.has(item.tenant));
-	const names = options.assignable;
-	const assignable = names === void 0 ? void 0 : new Map([...tenants].map((tenant) => [tenant, Object.hasOwn(names, tenant) ? names[tenant] ?? [] : []]));
-	return snapshotOf(policy, subject, compact({
-		customRoles,
-		assignable,
-		include: options.include,
-		tenants: options.tenants,
-		now: options.now
-	}));
-}
-//#endregion
-//#region src/core/presets.ts
-const CRUD_ACTIONS = {
-	read: { readOnly: true },
-	update: {},
-	delete: { destructive: true }
-};
-const CRUD_COLLECTION = {
-	create: {},
-	list: { readOnly: true }
-};
-const READABLE_ACTIONS = { read: { readOnly: true } };
-const READABLE_COLLECTION = { list: { readOnly: true } };
-const WRITABLE_ACTIONS = {
-	read: { readOnly: true },
-	update: {}
-};
-const WRITABLE_COLLECTION = {};
-function isNameList(list) {
-	return Array.isArray(list);
-}
-function toRecord(list) {
-	if (list === void 0) return {};
-	if (isNameList(list)) {
-		const out = {};
-		for (const name of list) out[name] = {};
-		return out;
-	}
-	return { ...list };
-}
-function mergeMeta(base, extra) {
-	return compact({
-		title: extra.title ?? base.title,
-		description: extra.description ?? base.description,
-		tags: extra.tags ?? base.tags,
-		readOnly: extra.readOnly ?? base.readOnly,
-		destructive: extra.destructive ?? base.destructive,
-		idempotent: extra.idempotent ?? base.idempotent
-	});
-}
-function mergeActionLists(base, extra) {
-	const extraRecord = toRecord(extra);
-	const out = {};
-	for (const [name, baseMeta] of Object.entries(base)) {
-		const extraMeta = extraRecord[name];
-		out[name] = extraMeta === void 0 ? baseMeta : mergeMeta(baseMeta, extraMeta);
-	}
-	for (const [name, extraMeta] of Object.entries(extraRecord)) {
-		if (Object.hasOwn(out, name)) continue;
-		out[name] = extraMeta;
-	}
-	return freezeDeep(out);
-}
-function finishPreset(baseActions, baseCollection, options) {
-	const actions = mergeActionLists(baseActions, options?.actions);
-	const collection = mergeActionLists(baseCollection, options?.collection);
-	return compact({
-		id: options?.id,
-		parent: options?.parent,
-		relations: options?.relations,
-		restricted: options?.restricted,
-		disclosure: options?.disclosure,
-		actions,
-		collection: Object.keys(collection).length === 0 ? void 0 : collection
-	});
-}
-function crud(options) {
-	return finishPreset(CRUD_ACTIONS, CRUD_COLLECTION, options);
-}
-function readable(options) {
-	return finishPreset(READABLE_ACTIONS, READABLE_COLLECTION, options);
-}
-function writable(options) {
-	return finishPreset(WRITABLE_ACTIONS, WRITABLE_COLLECTION, options);
-}
-//#endregion
-//#region src/core/ocsf.ts
-/** The OCSF schema version `toOcsf` emits. */
-const OCSF_VERSION = "1.3.0";
-function status(outcome) {
-	switch (outcome) {
-		case "granted": return {
-			status_id: 1,
-			status: "Success"
-		};
-		case "denied": return {
-			status_id: 2,
-			status: "Failure"
-		};
-		case "approval-required": return {
-			status_id: 99,
-			status: "Other"
-		};
-		default: return unknownStatus(outcome);
-	}
-}
-/** An outcome this build does not know, from a newer producer, is reported as OCSF Unknown. */
-function unknownStatus(_outcome) {
-	return {
-		status_id: 0,
-		status: "Unknown"
-	};
-}
-/** Projects a decision or approval event onto OCSF Authorize Session; the event itself is unchanged. */
-function toOcsf(event) {
-	const principal = event.subject.principal;
-	const actor = event.subject.actor;
-	const breakGlass = event.matched?.breakGlass === true;
-	const detail = event.outcome === "approval-required" ? "approval-required" : event.denials?.map((denial) => denial.reason).join(",");
-	const time = Date.parse(event.at);
-	return compact({
-		class_uid: 3003,
-		category_uid: 3,
-		activity_id: 1,
-		type_uid: 300301,
-		severity_id: breakGlass ? 4 : 1,
-		time: Number.isNaN(time) ? 0 : time,
-		...status(event.outcome),
-		status_detail: detail === "" ? void 0 : detail,
-		message: `${event.permission} ${event.outcome}`,
-		privileges: [event.permission],
-		user: principal === null ? { name: "anonymous" } : { uid: principal.id },
-		actor: actor === void 0 ? void 0 : compact({
-			user: principal === null ? void 0 : { uid: principal.id },
-			app_name: actor.id
-		}),
-		metadata: compact({
-			version: OCSF_VERSION,
-			product: compact({
-				name: "PermDock",
-				vendor_name: "PermDock",
-				feature: event.adapter === void 0 ? void 0 : { name: event.adapter }
-			}),
-			tenant_uid: event.tenant,
-			correlation_uid: event.token
-		}),
-		unmapped: compact({
-			outcome: event.outcome,
-			scope: event.scope,
-			resource: event.resource,
-			source: event.source,
-			phase: event.phase,
-			role: event.matched?.role,
-			via: event.via,
-			breakGlass: breakGlass ? true : void 0,
-			purpose: event.purpose,
-			reason: event.reason
-		})
-	});
-}
-function accessToOcsf(event) {
-	const time = Date.parse(event.at);
-	const enable = event.operation === "started";
-	return compact({
-		class_uid: 3001,
-		category_uid: 3,
-		activity_id: enable ? 2 : 5,
-		type_uid: enable ? 300102 : 300105,
-		severity_id: 4,
-		time: Number.isNaN(time) ? 0 : time,
-		message: `support access ${event.operation}`,
-		user: { uid: event.principal.id },
-		actor: event.actor === void 0 ? void 0 : { user: { uid: event.actor.id } },
-		metadata: {
-			version: OCSF_VERSION,
-			product: {
-				name: "PermDock",
-				vendor_name: "PermDock"
-			},
-			tenant_uid: event.tenant
-		},
-		unmapped: compact({
-			operation: event.operation,
-			via: event.via,
-			roles: event.roles,
-			member: event.member,
-			grantedBy: event.grantedBy,
-			reason: event.reason
-		})
-	});
-}
-//#endregion
-//#region src/core/csv.ts
-/** The CSV export columns, in order; the header row of every CSV file. */
-const CSV_COLUMNS = Object.freeze([
-	"time",
-	"principal",
-	"actor",
-	"tenant",
-	"permission",
-	"outcome",
-	"matched.role",
-	"via",
-	"denials.reason",
-	"token"
-]);
-function field(value) {
-	const text = value ?? "";
-	return /[",\r\n]/u.test(text) ? `"${text.replaceAll("\"", "\"\"")}"` : text;
-}
-/**
-* One RFC 4180 row for a decision or approval event, without a line
-* terminator; join rows with CRLF under a `CSV_COLUMNS` header.
-*/
-function toCsvRow(event) {
-	return [
-		event.at,
-		event.subject.principal?.id,
-		event.subject.actor?.id,
-		event.tenant,
-		event.permission,
-		event.outcome,
-		event.matched?.role,
-		event.via,
-		event.denials?.map((denial) => denial.reason).join(";"),
-		event.token
-	].map(field).join(",");
-}
-//#endregion
-//#region src/core/catalog-fingerprint.ts
-const OMITTED_TOP_LEVEL = /* @__PURE__ */ new Set([
-	"generatedAt",
-	"generator",
-	"fingerprint"
-]);
-function isRecord(value) {
-	return value !== null && typeof value === "object" && !Array.isArray(value);
-}
-function fingerprintInput(catalog) {
-	const out = {};
-	for (const [key, value] of Object.entries(catalog)) {
-		if (OMITTED_TOP_LEVEL.has(key)) continue;
-		out[key] = key === "permissions" && Array.isArray(value) ? value.map((permission) => {
-			if (!isRecord(permission)) return permission;
-			const { usages: _usages, ...rest } = permission;
-			return rest;
-		}) : value;
-	}
-	return out;
-}
-/**
-* The catalog v1 fingerprint: base64url SHA-256 of canonical JSON (keys
-* sorted, no whitespace) without `generatedAt`, `generator`, `fingerprint`
-* and every `permissions[].usages`, so neither the CLI version, the clock nor
-* call sites change it.
-*/
-function catalogFingerprint(catalog) {
-	if (!isRecord(catalog)) throw new TypeError("PermDock: a catalog must be an object");
-	return bytesToBase64Url(sha256(canonicalJson(fingerprintInput(catalog))));
-}
-//#endregion
-export { memoryRoleSource as _, accessToOcsf as a, sqlFunction as b, readable as c, customRoleSource as d, mayAccess as f, memoryMembershipSource as g, memoryEntitlementSource as h, OCSF_VERSION as i, writable as l, fromStripeEntitlements as m, CSV_COLUMNS as n, toOcsf as o, localSnapshotManifest as p, toCsvRow as r, crud as s, catalogFingerprint as t, snapshotFor as u, memorySettings as v, memorySnapshotSource as y };

package/dist/store-jOBYpiXC.d.ts

@@ -1,36 +0,0 @@
-import { Tt as Snapshot, Yn as Decision } from "./policy-IB6yxpC3.js";
-import { f as Permission } from "./permissions-DttnqqxC.js";
-import { n as ApprovalState, r as ClientPermDock, s as PermissionState } from "./types-CKNSyIf_.js";
-//#region src/client/store.d.ts
-type ClientStore = {
-  get(): ClientPermDock;
-  subscribe(listener: () => void): () => void;
-  permissionState(permission: Permission, data?: unknown): PermissionState;
-  requestApproval(decision: Decision, note?: string): Promise<void>;
-  /** Hydrate from a pushed snapshot; a compact JWS goes through the verifier. */
-  replace(value: unknown): void;
-  /** Stay `pending` until `value` settles, then hydrate; a rejection fails closed. */
-  follow(value: PromiseLike<Snapshot | string>): void;
-  /**
-   * `follow()` once per `value`, without suspending. A thenable React already
-   * settled (`status: 'fulfilled'`) hydrates at once.
-   */
-  track(value: PromiseLike<Snapshot | string>): void;
-  /**
-   * The approval state for a decision. While something subscribes, an
-   * `approval-required` decision is polled at `<approvals>/<token>`.
-   */
-  approvalState(decision: Decision): ApprovalState;
-  /**
-   * Hydrate from a resolved `snapshotPromise` during render. Idempotent per `source`;
-   * subscribers are notified in a microtask, never synchronously inside render.
-   */
-  adopt(value: Snapshot | string, source: object): void;
-  snapshot(): Snapshot;
-  /** The tenant the store currently answers for. */
-  tenant(): string | undefined;
-  /** Stops polls, drops in-flight results and persistence; the store keeps answering from its last snapshot. */
-  dispose(): void;
-};
-//#endregion
-export { ClientStore as t };

package/dist/stores-C0IMQrGI.d.ts

@@ -1,52 +0,0 @@
-import { Ft as TokenVerifier, Mr as Membership, Tt as Snapshot, Yn as Decision } from "./policy-IB6yxpC3.js";
-import { f as Permission } from "./permissions-DttnqqxC.js";
-import { r as Role } from "./vocabulary-DA8a8zif.js";
-import { a as FilterResult, c as SubjectView, l as TenantView, o as PermissionSet, r as ClientPermDock, s as PermissionState, t as ApprovalHandle, u as UseRolesOptions } from "./types-CKNSyIf_.js";
-import { Readable } from "svelte/store";
-//#region src/svelte/types.d.ts
-type PermDockSvelteOptions = {
-  /**
-   * A getter (`() => data.snapshot`) or a readable store re-hydrates the
-   * store when it changes; a promise keeps the store `pending` until it
-   * settles (render the same promise with `{#await}`).
-   */
-  readonly snapshot: Snapshot | string | (() => Snapshot | string) | Readable<Snapshot | string> | PromiseLike<Snapshot | string>;
-  /**
-   * The AuthZEN evaluations endpoint for checks the snapshot cannot answer.
-   * `false` never calls one: such a check is denied with reason `server-only`.
-   */
-  readonly endpoint?: string | false;
-  /** Where `refresh()` fetches a fresh snapshot. Defaults to `endpoint`. */
-  readonly snapshotUrl?: string;
-  readonly approvals?: string;
-  /** A getter (`() => page.params.org`) switches the active tenant (`refresh({ tenant })`) when it changes. */
-  readonly tenant?: string | (() => string | undefined);
-  readonly fetch?: typeof fetch;
-  /** A getter is read on every request, so a rotated token applies without a new store. */
-  readonly headers?: Readonly<Record<string, string>> | (() => Readonly<Record<string, string>> | undefined);
-  readonly maxAge?: number;
-  readonly verifier?: TokenVerifier;
-};
-//#endregion
-//#region src/svelte/stores.d.ts
-declare function setPermDock(options: PermDockSvelteOptions): ClientPermDock;
-declare function getPermDock(): ClientPermDock;
-declare function permission(reference: Permission, data?: () => unknown): Readable<PermissionState>;
-declare function permissions(references: () => readonly Permission[], data?: () => unknown): Readable<PermissionSet>;
-declare function filtered<T>(reference: Permission<string, T, "instance">, rows: () => readonly T[]): Readable<FilterResult<T>>;
-declare function tenant(): Readable<TenantView>;
-declare function memberships(): Readable<readonly Membership[]>;
-declare function roles(options?: () => UseRolesOptions): Readable<{
-  readonly roles: readonly Role[];
-}>;
-declare function assignable(): Readable<readonly Role[]>;
-type AssignableOptions = {
-  readonly tenant?: string;
-} | (() => {
-  readonly tenant?: string;
-});
-declare function assignablePermissions(options?: AssignableOptions): Readable<readonly Permission[]>;
-declare function subject(): Readable<SubjectView>;
-declare function approval(decision: () => Decision): Readable<ApprovalHandle>;
-//#endregion
-export { getPermDock as a, permissions as c, subject as d, tenant as f, filtered as i, roles as l, assignable as n, memberships as o, PermDockSvelteOptions as p, assignablePermissions as r, permission as s, approval as t, setPermDock as u };