permdock 0.3.1 → 0.5.0

package/dist/types-BNORmDM8.d.ts

@@ -0,0 +1,172 @@
+import { $n as Delegation, Nn as Decision, Vt as Snapshot, dt as TokenVerifier, j as PolicyVocabulary, qn as Actor, rr as Principal } from "./policy-types-DzwivBgR.js";
+import { w as Permission } from "./vocabulary-D6lPdb4Z.js";
+import { r as PermDock } from "./permdock-D7eeLJER.js";
+import { n as DescribeMessages, t as DecisionDescription } from "./describe-BZUsixiL.js";
+//#region src/client/request.d.ts
+type StoreHeaders = Readonly<Record<string, string>>;
+//#endregion
+//#region src/client/store.d.ts
+type ClientStoreOptions = {
+  readonly snapshot: Snapshot | string;
+  readonly endpoint?: string;
+  readonly snapshotUrl?: string;
+  readonly approvals?: string;
+  readonly tenant?: string;
+  readonly fetch?: typeof fetch;
+  /** Request headers, or a getter read on every request so a rotated token needs no new store. */
+  readonly headers?: StoreHeaders | (() => StoreHeaders | undefined);
+  readonly maxAge?: number;
+  readonly verifier?: TokenVerifier;
+  /** `raw` is the compact JWS the snapshot was verified from, so a signed snapshot can be persisted signed. */
+  readonly onSnapshot?: (snapshot: Snapshot, tenant: string | undefined, raw: string | undefined) => void;
+  readonly onClear?: () => void;
+  /** Called once per key the snapshot cannot answer when there is no `endpoint` to ask. */
+  readonly onServerOnly?: (permission: Permission) => void;
+  /**
+   * `true` while rendering on the server: endpoint checks answer `pending`
+   * without a request. Defaults to `typeof window === 'undefined'`.
+   */
+  readonly server?: boolean;
+  /** Milliseconds between approval status polls. Defaults to 2000. */
+  readonly approvalInterval?: number;
+  /** Start `pending`: the snapshot arrives later through `track()`. */
+  readonly awaiting?: boolean;
+  /**
+   * The first snapshot that hydrates with a principal is a persisted copy:
+   * `stale` until a refresh or a `replace()` lands.
+   */
+  readonly stale?: boolean;
+  /**
+   * Reuse decisions for the same row object until the next microtask. Only for
+   * renderers that do not track the fields a check reads (React): Vue, Svelte
+   * and Solid would stop re-running when a reactive row changes in place.
+   */
+  readonly passCache?: boolean;
+};
+type ClientStore = {
+  get(): ClientPermDock;
+  subscribe(listener: () => void): () => void;
+  permissionState(permission: Permission, data?: unknown): PermissionState;
+  requestApproval(decision: Decision, note?: string): Promise<void>;
+  /** Hydrate from a pushed snapshot; a compact JWS goes through the verifier. */
+  replace(value: unknown): void;
+  /** Stay `pending` until `value` settles, then hydrate; a rejection fails closed. */
+  follow(value: PromiseLike<Snapshot | string>): void;
+  /**
+   * `follow()` once per `value`, without suspending. A thenable React already
+   * settled (`status: 'fulfilled'`) hydrates at once.
+   */
+  track(value: PromiseLike<Snapshot | string>): void;
+  /**
+   * The approval state for a decision. While something subscribes, an
+   * `approval-required` decision is polled at `<approvals>/<token>`.
+   */
+  approvalState(decision: Decision): ApprovalState;
+  /**
+   * Hydrate from a resolved `snapshotPromise` during render. Idempotent per `source`;
+   * subscribers are notified in a microtask, never synchronously inside render.
+   */
+  adopt(value: Snapshot | string, source: object): void;
+  snapshot(): Snapshot;
+  /** The tenant the store currently answers for. */
+  tenant(): string | undefined;
+  /** Stops polls, drops in-flight results and persistence; the store keeps answering from its last snapshot. */
+  dispose(): void;
+};
+//#endregion
+//#region src/client/types.d.ts
+type ClientStatus = "ready" | "pending" | "stale" | "server-only";
+type PermissionState = {
+  readonly allowed: boolean;
+  readonly status: ClientStatus;
+  readonly decision: Decision;
+};
+type PermissionSet = {
+  readonly granted: readonly Permission[];
+  get(permission: Permission): PermissionState | undefined;
+};
+type ClientPermDock<V extends PolicyVocabulary = PolicyVocabulary> = PermDock<V> & {
+  status(permission?: Permission, data?: unknown): ClientStatus;
+  invalidate(ref: Permission | {
+    readonly [key: string]: unknown;
+  }): void;
+  refresh(options?: {
+    readonly tenant?: string;
+  }): Promise<void>;
+  clear(): void;
+  subscribe(listener: () => void): () => void;
+};
+type ApprovalState = "not-needed" | "required" | "pending" | "approved" | "rejected" | "expired";
+type ApprovalHandle = {
+  readonly state: ApprovalState;
+  readonly token: string | undefined;
+  readonly request: (note?: string) => Promise<void>;
+};
+type SubjectView = {
+  readonly principal: Principal | null;
+  readonly actor: Actor | undefined;
+  readonly delegation: Delegation | undefined;
+  readonly expiresAt: number | undefined;
+  readonly simulated: boolean;
+};
+type TenantView = {
+  readonly tenant: string | null;
+  readonly tenants: readonly string[];
+  readonly switchTo: (id: string) => Promise<void>;
+  readonly status: ClientStatus;
+};
+type FilterResult<T> = readonly T[] & {
+  readonly partial: boolean;
+};
+type RolesOptions = {
+  readonly tenant?: string;
+  readonly team?: string;
+};
+/** The provider options Vue, Svelte and Solid share; each adds its own reactive `snapshot`, `tenant`, `headers`, `verifier` and `defaults`. */
+type ProviderOptionsBase = {
+  /**
+   * The AuthZEN evaluations endpoint for checks the snapshot cannot answer.
+   * `false` never calls one: such a check is denied with reason `server-only`.
+   */
+  readonly endpoint?: string | false;
+  /** Where `refresh()` fetches a fresh snapshot. Defaults to `endpoint`. */
+  readonly snapshotUrl?: string;
+  readonly approvals?: string;
+  /** Read on every request, so a new `fetch` applies without a new store. */
+  readonly fetch?: typeof fetch;
+  readonly maxAge?: number;
+  /** Localised text for the describe helper. */
+  readonly messages?: DescribeMessages;
+  /** Called with each snapshot the store accepts. */
+  readonly onSnapshot?: NonNullable<ClientStoreOptions["onSnapshot"]>;
+  /** Called when the store drops its snapshot. */
+  readonly onClear?: () => void;
+  /** Milliseconds between approval status polls. Defaults to 2000. */
+  readonly approvalInterval?: number;
+};
+/** How a control shows a permission it cannot use: hidden, or disabled with a reason. */
+type GateMode = "hide" | "disable";
+/**
+ * Everything a permission-gated control renders from, in one value: a
+ * button, a menu item or a link reads these fields and decides nothing
+ * itself. The client is a hint; the server checks again.
+ */
+type GateView = {
+  /** The decision granted the action. */
+  readonly allowed: boolean;
+  /** The snapshot is loading; render the control disabled, not hidden. */
+  readonly pending: boolean;
+  /** `mode: "hide"` and the action is not available: render nothing. */
+  readonly hidden: boolean;
+  /** The control cannot run the action now (denied, pending or awaiting approval). */
+  readonly disabled: boolean;
+  /** The decision needs a person's approval first; offer to request it. */
+  readonly needsApproval: boolean;
+  /** The plans that would grant the action, for an upgrade prompt; empty otherwise. */
+  readonly upgrade: readonly string[];
+  /** Title and detail for a tooltip or an accessible description. */
+  readonly reason: DecisionDescription;
+  readonly decision: Decision;
+};
+//#endregion
+export { FilterResult as a, PermissionSet as c, RolesOptions as d, SubjectView as f, ClientStoreOptions as h, ClientStatus as i, PermissionState as l, ClientStore as m, ApprovalState as n, GateMode as o, TenantView as p, ClientPermDock as r, GateView as s, ApprovalHandle as t, ProviderOptionsBase as u };

package/dist/types-BjV-fqcA.d.ts

@@ -0,0 +1,57 @@
+import { Vt as Snapshot, dt as TokenVerifier, ot as SnapshotSource } from "./policy-types-DzwivBgR.js";
+import { n as DescribeMessages } from "./describe-BZUsixiL.js";
+import { h as ClientStoreOptions } from "./types-BNORmDM8.js";
+import { t as PermDockDefaults } from "./types-tIgIeIKJ.js";
+import { ReactNode } from "react";
+//#region src/react-native/types.d.ts
+type SnapshotStorage = {
+  /** Names the implementation in errors and events. */
+  readonly name?: string;
+  getItem(key: string): string | null | Promise<string | null>;
+  setItem(key: string, value: string): void | Promise<void>;
+  removeItem(key: string): void | Promise<void>;
+};
+type NativeRevalidate = "launch" | "focus" | number;
+/**
+ * Calls `listener` when the app changes state; `active` is `false` when it
+ * goes to the background. A listener called without an argument counts as
+ * a return to the foreground.
+ */
+type SubscribeForeground = (listener: (active?: boolean) => void) => () => void;
+/** Calls `listener` with `false` when the device loses connectivity and `true` when it returns. */
+type SubscribeOnline = (listener: (online: boolean) => void) => () => void;
+type ReactNativePermDockProviderProps = {
+  readonly storage: SnapshotStorage;
+  /**
+   * The signed-in principal's id, or `null` when nobody is signed in. Only a
+   * persisted snapshot for this id is read or written; `null` clears storage.
+   */
+  readonly subjectId: string | null;
+  readonly snapshot?: Snapshot | string;
+  readonly snapshotUrl?: string;
+  /** Hydrates from the device's own rows (`localSnapshot`); with `snapshotUrl` too, the latest answer wins. */
+  readonly source?: SnapshotSource;
+  readonly endpoint?: string;
+  readonly approvals?: string;
+  readonly tenant?: string;
+  readonly revalidate?: NativeRevalidate;
+  readonly subscribeForeground?: SubscribeForeground;
+  readonly subscribeOnline?: SubscribeOnline;
+  readonly fetch?: typeof fetch;
+  readonly headers?: Readonly<Record<string, string>>;
+  readonly maxAge?: number;
+  readonly verifier?: TokenVerifier;
+  /** What every `<Protected>` below renders for a slot it leaves out. */
+  readonly defaults?: PermDockDefaults;
+  /** Localised text for `useDescribe()`. */
+  readonly messages?: DescribeMessages;
+  /** Called with each snapshot the store accepts, after it is persisted. */
+  readonly onSnapshot?: NonNullable<ClientStoreOptions["onSnapshot"]>;
+  /** Called when the store drops its snapshot, after storage is cleared. */
+  readonly onClear?: () => void;
+  /** Milliseconds between approval status polls. Defaults to 2000. */
+  readonly approvalInterval?: number;
+  readonly children: ReactNode;
+};
+//#endregion
+export { SubscribeOnline as a, SubscribeForeground as i, ReactNativePermDockProviderProps as n, SnapshotStorage as r, NativeRevalidate as t };

package/dist/{types-QCuYJh4q.d.ts → types-BqAKcRNW.d.ts}

@@ -1,4 +1,5 @@
-import { D as PolicyVocabulary, ln as PermDock, rt as DecisionEvent } from "./policy-IB6yxpC3.js";
+import { Xt as DecisionEvent, j as PolicyVocabulary } from "./policy-types-DzwivBgR.js";
+import { r as PermDock } from "./permdock-D7eeLJER.js";
 //#region src/otel/types.d.ts
 declare const GENAI_SEMCONV_PIN = "1.37.0";
 declare const GEN_AI_TOOL_NAME = "gen_ai.tool.name";

package/dist/types-C8-KNsFf.d.ts

@@ -0,0 +1,107 @@
+import { dt as TokenVerifier, ir as Subject, ot as SnapshotSource, q as DecisionSink, ut as TokenSigner } from "./policy-types-DzwivBgR.js";
+import { o as PolicySource } from "./hosted-DBDX0M-P.js";
+import { m as ApprovalStore, u as ApprovalRequest } from "./types-CCpc2Dcv.js";
+import { a as CatalogDocument } from "./types-CZTnPFzM.js";
+import { a as CatalogFinding } from "./sink-Bj_lDUDq.js";
+//#region src/cloud/types.d.ts
+type CloudEndpointOptions = {
+  readonly url?: string;
+  readonly environment?: string;
+};
+type CloudEndpoints = {
+  /** The environment URL, `<url>/v1/environments/<env>`: `iss` and `aud` of the policy document. */
+  readonly issuer: string;
+  /** The environment's JWK Set URL, for `joseTokenVerifier({ jwks })`. */
+  readonly jwks: string;
+};
+/** What every `permdock/cloud` client needs to reach one environment. */
+type CloudConnectionOptions = CloudEndpointOptions & {
+  /** The environment key; defaults to `PERMDOCK_CLOUD_KEY`. */
+  readonly key?: string;
+  readonly fetch?: typeof fetch;
+};
+/** Who signs the `PermDock-Approver` token `approvals.resolve` sends. */
+type CloudApproverOptions = {
+  /**
+   * Signs the token with a key the environment trusts as an issuer, such as
+   * `joseTokenSigner` over your own key. Never `cloudSigner`: a client key
+   * that could mint approver tokens could forge any approver.
+   */
+  readonly signer: TokenSigner;
+  /** `aud` of the token; defaults to `<issuer>/approvals`, the environment URL plus `/approvals`. */
+  readonly audience?: string | readonly string[];
+  /**
+   * The `holder(permission)` approvers of `request` that `approver` holds,
+   * typically `approverPermissions(request, permdockFor(approver))`. Signed
+   * into the token as `permissions`; without it the verdict's own
+   * `permissions` are signed. A throw signs none.
+   */
+  readonly permissions?: (request: ApprovalRequest, approver: Subject) => readonly string[] | Promise<readonly string[]>;
+  /**
+   * The relation approvers of `request` that `approver` holds, typically
+   * `approverRelations(request, approver, { relations, permissions })`.
+   * Signed into the token as `relations`; without it the verdict's own
+   * `relations` are signed. A throw signs none.
+   */
+  readonly relations?: (request: ApprovalRequest, approver: Subject) => readonly string[] | Promise<readonly string[]>;
+};
+type CloudOptions = CloudConnectionOptions & {
+  /**
+   * Proves the approver on `approvals.resolve`. Without it, every resolve but
+   * a `system` rejection throws `approver-unauthenticated` and sends nothing.
+   */
+  readonly approver?: CloudApproverOptions;
+  readonly flushAt?: number;
+  /** Most events the sink holds while the Cloud is unreachable (default 10 000); the oldest are dropped first. */
+  readonly capacity?: number;
+  readonly waitUntil?: (task: Promise<void>) => void;
+  /** The CloudEvents `source` of every event the sink sends, an absolute URI; defaults to the environment URL. */
+  readonly source?: string;
+  /**
+   * Verifies the environment's signed policy document, typically
+   * `joseTokenVerifier({ jwks: cloudEndpoints().jwks })`. Without one,
+   * `policies.current()` stays `null`: an unverifiable document is never applied.
+   */
+  readonly verifier?: TokenVerifier;
+};
+/**
+ * What `POST /catalog` answers: `201` with the new version and the drift
+ * findings against the previous one, or `200` with `unchanged: true` when
+ * the fingerprint is already published.
+ */
+type CloudCatalogPush = {
+  readonly version: number;
+  readonly fingerprint: string;
+  readonly findings: readonly CatalogFinding[];
+} | {
+  readonly version: number;
+  readonly fingerprint: string;
+  readonly unchanged: true;
+};
+type CloudCatalog = {
+  /**
+   * Posts the catalog, its `operations` included, to the environment.
+   * Throws when the Cloud refuses it or answers another shape. The Cloud
+   * shows and diffs it; it never decides with it.
+   */
+  push(catalog: CatalogDocument): Promise<CloudCatalogPush>;
+};
+type CloudClient = CloudEndpoints & {
+  readonly approvals: ApprovalStore;
+  readonly sink: DecisionSink;
+  /**
+   * A `SnapshotSource` for the subject `token` proves: an `at+jwt` the
+   * environment issued, or one a trusted issuer registered for `subject`
+   * signed. Sent as `PermDock-Subject`; the Cloud never takes a subject from
+   * anything else.
+   */
+  snapshotsFor(token: string): SnapshotSource;
+  readonly policies: PolicySource;
+  readonly catalog: CloudCatalog;
+};
+type CloudSignerOptions = CloudConnectionOptions & {
+  /** `aud` when a `sign` call names none; signing without either throws. */
+  readonly audience?: string | readonly string[];
+};
+//#endregion
+export { CloudConnectionOptions as a, CloudOptions as c, CloudClient as i, CloudSignerOptions as l, CloudCatalog as n, CloudEndpointOptions as o, CloudCatalogPush as r, CloudEndpoints as s, CloudApproverOptions as t };

package/dist/{types-aqOHTHcp.d.ts → types-CCpc2Dcv.d.ts}

@@ -1,4 +1,5 @@
-import { G as Approver, Mr as Membership, Pr as Subject, dr as RelationGrantee, o as ApprovalStage, r as ApprovalMode } from "./policy-IB6yxpC3.js";
+import { Cn as RelationGrantee, Rt as Instant, fn as Approver, ir as Subject, nr as Membership, o as ApprovalStage, on as WireDelegation, r as ApprovalMode, sr as AdapterId } from "./policy-types-DzwivBgR.js";
+import { V as AppData } from "./vocabulary-D6lPdb4Z.js";
 //#region src/approvals/types.d.ts
 type ApprovalStatus = "pending" | "approved" | "rejected" | "expired";
 type ApprovalApprovers = {
@@ -13,9 +14,9 @@ type ApprovalApprovers = {
   readonly staleOn?: "resource-change";
   /** Distinct approvers of `by` needed before `status` becomes `approved`; absent means 1. */
   readonly quorum?: number;
-  /** Who else may approve once the request has waited `after` (a duration such as `'4h'`) since `createdAt`. */
+  /** Who else may approve once the request has waited `after` seconds since `createdAt`. */
   readonly escalation?: {
-    readonly after: string;
+    readonly after: number;
     readonly to: Approver | readonly Approver[];
   };
 };
@@ -25,6 +26,43 @@ type ApprovalSignature = {
   readonly at: string;
   readonly stage?: number;
   readonly vouched?: string;
+  /** The principal `by` approved for, when `by` acted under an `ApprovalDelegation`. */
+  readonly onBehalfOf?: string;
+  /** The `ApprovalDelegation` id `onBehalfOf` was read from. */
+  readonly delegation?: string;
+};
+/**
+ * One out-of-office delegation: `delegate` may approve what `delegator`
+ * could approve, from `from` until `until`. Both instants are required, so
+ * a delegation cannot be open-ended. `permissions` and `resources` narrow
+ * it; absent, it covers every request. `tenant` holds it to one tenant.
+ */
+type ApprovalDelegation = {
+  readonly id: string;
+  readonly delegator: string;
+  readonly delegate: string;
+  readonly tenant?: string;
+  readonly permissions?: readonly string[];
+  readonly resources?: readonly string[];
+  /** RFC 3339. Inclusive. */
+  readonly from: string;
+  /** RFC 3339. Exclusive. */
+  readonly until: string;
+};
+/**
+ * Active approval delegations for one delegate, a subject input the handler
+ * reads when the caller is not an approver on their own. A throw matches
+ * nobody. One hop: the handler never reads the delegator's own delegations.
+ */
+type ApprovalDelegationSource = {
+  /** Names the implementation in errors and events. */
+  readonly name?: string;
+  delegationsFor(query: {
+    readonly delegate: string;
+    readonly tenant?: string;
+    /** RFC 3339. The source returns delegations active at this instant. */
+    readonly at: string;
+  }): readonly ApprovalDelegation[] | Promise<readonly ApprovalDelegation[]>;
 };
 type ApprovalSubjectSummary = {
   readonly principal: {
@@ -37,13 +75,13 @@ type ApprovalSubjectSummary = {
     readonly kind: string;
   };
   readonly session?: string;
-  readonly delegation?: {
-    readonly scopes?: readonly string[];
-    readonly authorizationDetails?: readonly unknown[];
-  };
+  /** OAuth `scope` (space-separated) and RFC 9396 `authorization_details`. */
+  readonly delegation?: WireDelegation;
 };
 type ApprovalRequest = {
   readonly v: 1;
+  /** The request id: the signature's `jti`. */
+  readonly id: string;
   readonly token: string;
   readonly permission: string;
   readonly scope: string;
@@ -55,7 +93,7 @@ type ApprovalRequest = {
   readonly membership?: Membership;
   readonly approvers?: ApprovalApprovers;
   readonly detail: string;
-  readonly adapter?: string;
+  readonly adapter?: AdapterId;
   readonly createdAt: string;
   readonly expiresAt: string;
   readonly status: ApprovalStatus;
@@ -67,6 +105,8 @@ type ApprovalRequest = {
   readonly vouched?: string;
   readonly note?: string;
   readonly consumedAt?: string;
+  /** The application's own data, set when the request opens; plain JSON, never read by a decision. */
+  readonly x?: AppData;
 };
 type ApprovalVerdict = {
   readonly status: "approved" | "rejected";
@@ -87,6 +127,18 @@ type ApprovalVerdict = {
    */
   readonly permissions?: readonly string[];
   readonly vouched?: string;
+  /**
+   * Set when `by` is not an approver and acts for this principal under an
+   * `ApprovalDelegation`. Server-side input: the handler resolves the
+   * delegator, and `applyApprovalVerdict` checks them again. `relations`
+   * and `permissions` are that principal's facts, never the delegate's.
+   */
+  readonly onBehalfOf?: {
+    readonly subject: Subject;
+    readonly delegation: string;
+    readonly relations?: readonly string[];
+    readonly permissions?: readonly string[];
+  };
 };
 type ApprovalListFilter = {
   readonly status?: ApprovalStatus;
@@ -114,35 +166,43 @@ type ApprovalCancelMeta = {
   readonly note?: string;
 };
 type ApprovalStore = {
+  /** Names the implementation in errors and events. */
+  readonly name?: string;
   /**
-   * How long a request opened against this store stays open, in
-   * milliseconds, when the caller sets no `ttl`; absent means
-   * `DEFAULT_APPROVAL_TTL_MS`. A grant's `approval.ttl` still caps it.
+   * Seconds a request opened against this store stays open when the
+   * caller sets no `ttl`; absent means `DEFAULT_APPROVAL_TTL`. A grant's
+   * `approval.ttl` still caps it.
    */
   readonly ttl?: number;
   create(request: ApprovalRequest): Promise<void> | void;
   get(token: string): Promise<ApprovalRequest | null> | ApprovalRequest | null;
+  /**
+   * The request with this `id`, for `approvalsHandler`, which routes by id.
+   * Without it the handler pages through `list` to find the id.
+   */
+  getById?(id: string): Promise<ApprovalRequest | null> | ApprovalRequest | null;
   resolve(token: string, verdict: ApprovalVerdict): Promise<ApprovalRequest> | ApprovalRequest;
   list(query: ApprovalListQuery): Promise<ApprovalPage> | ApprovalPage;
-  expire(now?: Date): Promise<number> | number;
+  expire(now?: Instant): Promise<number> | number;
   /**
    * Marks an approved, unexpired, unconsumed request consumed and returns it;
    * returns `null` otherwise. Must be atomic: two concurrent calls for one
    * token never both return the request.
    */
-  consume(token: string, now?: Date): Promise<ApprovalRequest | null> | ApprovalRequest | null;
+  consume(token: string, now?: Instant): Promise<ApprovalRequest | null> | ApprovalRequest | null;
   cancel?(filter: ApprovalListFilter, meta: ApprovalCancelMeta): Promise<number> | number;
 };
-type ApprovalResumeFailure = "approval-not-found" | "approval-pending" | "approval-rejected" | "approval-expired" | "approval-consumed";
+type ApprovalResumeFailureCause = "approval-not-found" | "approval-pending" | "approval-rejected" | "approval-expired" | "approval-consumed";
 type ApprovalInspectResult = {
   readonly ok: true;
   readonly request: ApprovalRequest;
 } | {
   readonly ok: false;
-  readonly detail: ApprovalResumeFailure;
+  readonly cause: ApprovalResumeFailureCause;
 };
 declare const APPROVAL_HEADER: "PermDock-Approval";
-declare const DEFAULT_APPROVAL_TTL_MS: number;
+/** Seconds a request stays open when neither the store nor the call sets a `ttl`. */
+declare const DEFAULT_APPROVAL_TTL: number;
 /** The approvals a request needs in total: `approvers.quorum` (or 1), or the sum of its stages' quorums. */
 declare function approvalQuorum(request: ApprovalRequest): number;
 /**
@@ -154,4 +214,4 @@ declare function escalationOpenAt(request: ApprovalRequest): number | undefined;
 /** The key a verdict's `relations` lists a relation approver under. */
 declare function approverRelationKey(item: RelationGrantee): string;
 //#endregion
-export { approverRelationKey as _, ApprovalListFilter as a, ApprovalRequest as c, ApprovalStatus as d, ApprovalStore as f, approvalQuorum as g, DEFAULT_APPROVAL_TTL_MS as h, ApprovalInspectResult as i, ApprovalResumeFailure as l, ApprovalVerdict as m, ApprovalApprovers as n, ApprovalListQuery as o, ApprovalSubjectSummary as p, ApprovalCancelMeta as r, ApprovalPage as s, APPROVAL_HEADER as t, ApprovalSignature as u, escalationOpenAt as v };
+export { DEFAULT_APPROVAL_TTL as _, ApprovalDelegationSource as a, escalationOpenAt as b, ApprovalListQuery as c, ApprovalResumeFailureCause as d, ApprovalSignature as f, ApprovalVerdict as g, ApprovalSubjectSummary as h, ApprovalDelegation as i, ApprovalPage as l, ApprovalStore as m, ApprovalApprovers as n, ApprovalInspectResult as o, ApprovalStatus as p, ApprovalCancelMeta as r, ApprovalListFilter as s, APPROVAL_HEADER as t, ApprovalRequest as u, approvalQuorum as v, approverRelationKey as y };

package/dist/{types-Dnemwd77.d.ts → types-CZTnPFzM.d.ts}

@@ -1,4 +1,5 @@
-import { S as ResourceRelation } from "./permissions-DttnqqxC.js";
+import { I as ResourceRelation } from "./vocabulary-D6lPdb4Z.js";
+import { s as OperationMeta } from "./operations-CxybZErY.js";
 //#region src/catalog/types.d.ts
 type CatalogUsage = {
   readonly file: string;
@@ -35,7 +36,8 @@ type CatalogBreakGlass = {
   readonly overrides: readonly string[];
   readonly purpose?: readonly string[];
   readonly reason: boolean;
-  readonly maxDuration?: string;
+  /** Seconds. */
+  readonly maxDuration?: number;
   readonly obligations: readonly string[];
 };
 type CatalogApproval = "human" | {
@@ -48,9 +50,11 @@ type CatalogApproval = "human" | {
   readonly distinct?: boolean;
   readonly staleOn?: "resource-change";
   readonly quorum?: number;
-  readonly ttl?: string;
+  /** Seconds. */
+  readonly ttl?: number;
+  /** `after` is seconds from the request's creation. */
   readonly escalation?: {
-    readonly after: string;
+    readonly after: number;
     readonly to: unknown;
   };
 };
@@ -58,12 +62,26 @@ type CatalogResource = {
   readonly id: string;
   readonly schema: unknown;
   readonly definedIn?: string;
+  /** `resource(…, { parent })`: the row field that holds the parent row's id. */
+  readonly parent?: {
+    readonly field: string;
+    readonly resource: string;
+  };
+  /** `resource(…, { links })`: to-one links `through` walks; absent when none. */
+  readonly links?: Readonly<Record<string, {
+    readonly field: string;
+    readonly resource: string;
+  }>>;
+  /** `'hide'` answers a denied check on a loaded row as if the row did not exist; absent for `'reveal'`. */
+  readonly disclosure?: "hide";
   readonly relations?: Readonly<Record<string, ResourceRelation>>;
   /** The row field an `approval: { staleOn: 'resource-change' }` binds to. */
   readonly version?: string;
   /** The boolean column that keeps ancestor grants out of a row. */
   readonly restricted?: string;
   readonly restrictedStops?: readonly string[];
+  /** `resource(…, { meta })`: titles plus the app's own `x`; absent when empty. */
+  readonly meta?: Readonly<Record<string, unknown>>;
 };
 type CatalogRole = {
   readonly key: string;
@@ -86,7 +104,8 @@ type CatalogRole = {
 };
 /** A role activation as the catalog carries it. */
 type CatalogActivation = {
-  readonly maxDuration?: string;
+  /** Seconds. */
+  readonly maxDuration?: number;
   readonly justification: "required" | "optional";
   readonly approval?: boolean;
   readonly assurance?: {
@@ -99,7 +118,8 @@ type CatalogActivation = {
 type CatalogSupportAccess = {
   readonly actorRequired: boolean;
   readonly group: string;
-  readonly durations: readonly string[];
+  /** Seconds. */
+  readonly durations: readonly number[];
 };
 /** One declared scope, in declaration order. */
 type CatalogScope = {
@@ -107,10 +127,10 @@ type CatalogScope = {
   readonly key: string;
   readonly within?: string;
 };
-/** A grant's `validFrom` / `validUntil` window in Unix seconds. */
+/** A grant's `validFrom` / `validUntil` window in RFC 3339. */
 type CatalogValidity = {
-  readonly from?: number;
-  readonly until?: number;
+  readonly from?: string;
+  readonly until?: string;
 };
 /**
  * One code grant as the catalog carries it: the normalised shape
@@ -141,11 +161,14 @@ type CatalogGrant = {
   readonly requires?: string | readonly string[];
   readonly limit?: {
     readonly count: number;
-    readonly per: string;
+    /** Seconds. */
+    readonly per: number;
     readonly mode?: "hard" | "soft";
   };
   /** Present when the grant is a closure, reads the relation graph or is opaque; `where` and `check` are then omitted. */
   readonly portable?: false;
+  /** The grant's `meta`: a description plus the app's own `x`; absent when empty. */
+  readonly meta?: Readonly<Record<string, unknown>>;
 };
 /** `permissions.catalog.json`, validated by `schemas/catalog-v1.json`. */
 type CatalogDocument = {
@@ -167,6 +190,22 @@ type CatalogDocument = {
   readonly grants?: readonly CatalogGrant[];
   /** The policy's standing delegations, canonically ordered; present when the policy declares any. */
   readonly delegations?: readonly CatalogDelegation[];
+  /** The `defineOperations` map in definition order; present when the config names an `operations` module. */
+  readonly operations?: readonly CatalogOperation[];
+  /** The policy's coarse OAuth scopes, sorted by scope; present when the policy declares any. */
+  readonly oauthScopes?: readonly CatalogOAuthScope[];
+};
+/** One `definePolicy({ oauthScopes })` entry: the coarse scope an authorization server issues and the permission keys it covers, sorted by code point. */
+type CatalogOAuthScope = {
+  readonly scope: string;
+  readonly permissions: readonly string[];
+};
+/** One `defineOperations` entry: its name, the permission keys it is bound to, and its meta. */
+type CatalogOperation = {
+  readonly name: string;
+  readonly permission: string;
+  readonly results?: string;
+  readonly meta: OperationMeta;
 };
 /** One `definePolicy({ delegations })` entry: who hands over, to which actor, which permission keys, and when. */
 type CatalogDelegation = {
@@ -180,4 +219,4 @@ type CatalogDelegation = {
   readonly validity?: CatalogValidity;
 };
 //#endregion
-export { CatalogDocument as a, CatalogResource as c, CatalogSupportAccess as d, CatalogUsage as f, CatalogDelegation as i, CatalogRole as l, CatalogApproval as n, CatalogGrant as o, CatalogValidity as p, CatalogBreakGlass as r, CatalogPermission as s, CatalogActivation as t, CatalogScope as u };
+export { CatalogDocument as a, CatalogOperation as c, CatalogRole as d, CatalogScope as f, CatalogValidity as h, CatalogDelegation as i, CatalogPermission as l, CatalogUsage as m, CatalogApproval as n, CatalogGrant as o, CatalogSupportAccess as p, CatalogBreakGlass as r, CatalogOAuthScope as s, CatalogActivation as t, CatalogResource as u };