permdock 0.4.0 → 0.5.0

package/dist/{types-CqrjB9o6.d.ts → types-CdlxsYQh.d.ts}

@@ -1,4 +1,5 @@
-import { Or as Principal, yn as AuthEvent } from "./policy-types-sp9P1iIV.js";
+import { qt as AuthEvent, rr as Principal } from "./policy-types-DzwivBgR.js";
+import { t as ClaimsMap } from "./claims-map-Ca-QX8C6.js";
 import { t as ClientNames } from "./clients-C7zLFuWT.js";
 import { StandardSchemaV1 } from "@standard-schema/spec";
 //#region src/supabase/claims.d.ts
@@ -18,14 +19,14 @@ type SupabaseMembershipClaim = {
   readonly roles: readonly string[];
   readonly via?: string;
   /** Seconds since the epoch. */
-  readonly expiresAt?: number;
-  readonly grantedBy?: string;
+  readonly expires_at?: number;
+  readonly granted_by?: string;
   readonly reason?: string;
   /** The subgroup a membership source's `group` fills: a fixed name or a column. */
   readonly member?: {
     readonly group: string;
   };
-  readonly managedBy?: "idp";
+  readonly managed_by?: "idp";
   readonly entitlements?: readonly string[];
   /** The instance or an ancestor is suspended: the permission keys the membership still grants. */
   readonly keep?: readonly string[];
@@ -247,14 +248,17 @@ type SupabaseSessionLike = {
   readonly claims?: unknown;
 };
 type SupabaseSubjectOptions = {
-  readonly roles?: string;
-  readonly tenant?: string;
-  readonly memberships?: string;
+  /**
+   * Where the token carries roles (default `user_role`), the active tenant
+   * (default `tenant_id`), memberships (default `memberships`) and plan names
+   * per tenant id (no default; the active tenant's entry becomes
+   * `principal.plans`). A name is read at the top level, then in
+   * `app_metadata`.
+   */
+  readonly claims?: Pick<ClaimsMap, "roles" | "tenant" | "memberships" | "plans">;
   readonly schema?: StandardSchemaV1;
   readonly include?: readonly SupabaseInclude[];
   readonly declared?: readonly string[];
-  /** Claim holding plan names per tenant id; the active tenant's entry becomes `principal.plans`. */
-  readonly plans?: string;
   /** Names for OAuth client ids: an `oauth-client` actor gets `client` set to the name of its id, which a policy delegation matches with `to: { kind: 'oauth-client', client }`. */
   readonly clients?: ClientNames;
   /** `'deny'` maps a token with `is_anonymous: true` (`signInAnonymously()`) to the anonymous subject, as `rls.anonymousSignIns: 'deny'` does in RLS. */
@@ -271,8 +275,9 @@ type SupabaseSubjectOptions = {
 /**
  * Who acts for the user. `oauth-client`: a third-party app or an agent chain (`client_id`, or an
  * `act` without `kind`). `support`: a support session (`act.kind: "support"` with `session_id`).
- * `impersonation`: an admin acting as the user (`act.kind: "impersonation"`). `chain` is a copy of
- * the token's `act` claim when it has one.
+ * `impersonation`: an admin acting as the user (`act.kind: "impersonation"`). `agent`: an agent
+ * run better-supabase's `agentClaims` minted (`act.kind: "agent"`), with the `tools` it may call.
+ * `chain` is a copy of the token's `act` claim when it has one.
  */
 type SupabaseActor = {
   readonly id: string;
@@ -290,6 +295,13 @@ type SupabaseActor = {
   readonly kind: "impersonation";
   readonly reason?: string;
   readonly chain: SupabaseActClaim;
+} | {
+  readonly id: string;
+  readonly kind: "agent";
+  readonly tools?: readonly string[];
+  /** `act.read_only`, default `false`: a read-only agent never writes. */
+  readonly readOnly: boolean;
+  readonly chain: SupabaseActClaim;
 };
 /** `actorOf` output: `{ ok: false }` must deny. */
 type SupabaseActorResult = {

package/dist/{types-CIlTojhq.d.ts → types-ClZaWzfb.d.ts}

@@ -1,5 +1,6 @@
-import { At as DeriveOptions, Dr as Membership, E as Policy, It as WhereResult, Mn as ArazzoSimulateInput, Mt as PermDockOptions, Or as Principal, Pt as SimulateOptions, ir as Decision, j as PolicyVocabulary, jn as ArazzoPlan, jt as PermDock, kr as Subject, kt as DecideOptions, lr as ExplainedDecision } from "./policy-types-sp9P1iIV.js";
-import { d as Permission, p as PermissionTree } from "./permission-types-Dg39z9Kv.js";
+import { Nn as Decision, Rn as ExplainedDecision, T as Policy, ir as Subject, j as PolicyVocabulary, nr as Membership, rr as Principal } from "./policy-types-DzwivBgR.js";
+import { E as PermissionTree, w as Permission } from "./vocabulary-D6lPdb4Z.js";
+import { c as WhereResult, i as PermDockOptions, n as DeriveOptions, o as SimulateOptions, r as PermDock, t as DecideOptions } from "./permdock-D7eeLJER.js";
 //#region src/pdp/types.d.ts
 type RemotePdpAuth = {
   readonly bearer: string | (() => string | Promise<string>);
@@ -25,7 +26,8 @@ type RemotePdpEndpoints = {
   readonly searchResource?: string;
 };
 type RemotePdpCache = {
-  readonly ttl: number | `${number}s` | `${number}ms`;
+  /** Seconds, at most 30. */
+  readonly ttl: number;
 };
 type RemotePdpOptions = {
   readonly url: string;
@@ -84,9 +86,9 @@ type SpiceDbOptions = {
   readonly cache?: RemotePdpCache;
   readonly fetch?: typeof fetch;
 };
-type PdpPermDock<V extends PolicyVocabulary = PolicyVocabulary> = Omit<PermDock<V>, "can" | "decide" | "assert" | "explain" | "filter" | "where" | "simulate" | "tenant" | "team" | "derive"> & {
+type PdpPermDock<V extends PolicyVocabulary = PolicyVocabulary> = Omit<PermDock<V>, "can" | "decide" | "decideEach" | "assert" | "explain" | "filter" | "where" | "simulate" | "tenant" | "team" | "derive"> & {
   /** `permdock.derive` with the same providers: the result asks the PDP too. */
-  readonly derive: (options: DeriveOptions) => PdpPermDock<V> | Promise<PdpPermDock<V>>;
+  readonly derive: (options: DeriveOptions) => Promise<PdpPermDock<V>>;
   /**
    * For a delegated permission whose provider lists ids, an `in` over them
    * (AND the local condition when local grants exist); otherwise the local
@@ -95,6 +97,8 @@ type PdpPermDock<V extends PolicyVocabulary = PolicyVocabulary> = Omit<PermDock<
   readonly where: (permission: Permission) => Promise<WhereResult>;
   readonly can: (permission: Permission, data?: unknown, options?: DecideOptions) => Promise<boolean>;
   readonly decide: (permission: Permission, data?: unknown, options?: DecideOptions) => Promise<Decision>;
+  /** `decide` for each row, in row order, asking the PDP per row. */
+  readonly decideEach: (permission: Permission, rows: readonly unknown[], options?: DecideOptions) => Promise<readonly Decision[]>;
   readonly assert: (permission: Permission, data?: unknown, options?: DecideOptions) => Promise<Extract<Decision, {
     readonly outcome: "granted";
   }>>;
@@ -103,7 +107,6 @@ type PdpPermDock<V extends PolicyVocabulary = PolicyVocabulary> = Omit<PermDock<
   readonly filter: <T>(permission: Permission<string, T, "instance">, rows: readonly T[], options?: DecideOptions) => Promise<T[]>;
   readonly simulate: {
     (checks: readonly (readonly [Permission, unknown?])[], options?: SimulateOptions): Promise<readonly Decision[]>;
-    (plan: ArazzoSimulateInput): ArazzoPlan;
     (preview: {
       readonly roles?: readonly (string | {
         readonly key: string;

package/dist/types-DX0LaKTb.d.ts

@@ -0,0 +1,157 @@
+import { $t as DeliveryFailureCause, Qt as DeliveryEvent, Zt as DeliveryChannel, tn as EmailCategory, zn as GrantedDecision } from "./policy-types-DzwivBgR.js";
+import { s as CloudEvent } from "./sink-Bj_lDUDq.js";
+import { t as ApprovalPrompt } from "./approval-prompt-Djo_PyZc.js";
+//#region src/delivery/types.d.ts
+/**
+ * Who a delivery goes to. `{ principal }` names an app principal and the
+ * address the server loaded for it on `channel`. `{ address }` alone is an
+ * email or chat identity that resolves through
+ * `PrincipalSource.principalByIdentity`; with no principal linked it is
+ * refused unless `trusted` is set for an address the server loaded itself,
+ * such as a customer's billing email, and then the sender must hold the
+ * permission.
+ */
+type Recipient = {
+  readonly principal: string;
+  readonly channel: DeliveryChannel;
+  /** An RFC 5322 `addr-spec`, a chat platform user id, or an https webhook endpoint. */
+  readonly address: string;
+  /** The chat platform (`slack`, `teams`, …). */
+  readonly provider?: string;
+  readonly workspace?: string;
+} | {
+  readonly principal?: undefined;
+  readonly channel: "email" | "chat";
+  readonly address: string;
+  /** The chat platform; required for a chat address. */
+  readonly provider?: string;
+  readonly workspace?: string;
+  /** `true` only for an address the server loaded itself, never one from a request. */
+  readonly trusted?: boolean;
+};
+/** One-click unsubscribe (RFC 8058): an https URL, plus an optional `mailto:` address. */
+type EmailUnsubscribe = {
+  readonly url: string;
+  readonly mailto?: string;
+};
+type EmailMessage = {
+  /** Defaults to the router's `from`. A name-addr (`Acme <billing@acme.test>`) is allowed here. */
+  readonly from?: string;
+  readonly replyTo?: string;
+  readonly subject: string;
+  readonly text: string;
+  readonly html?: string;
+  /** Extra headers. `Auto-Submitted` and the `List-Unsubscribe` pair are the router's. */
+  readonly headers?: Readonly<Record<string, string>>;
+  readonly category: EmailCategory;
+  /** Required on `notification`, ignored on every other category. */
+  readonly unsubscribe?: EmailUnsubscribe | ((target: DeliveryTarget<"email">) => EmailUnsubscribe);
+};
+/** An email as a transport receives it: `from` set and the standards headers added. */
+type OutgoingEmail = Omit<EmailMessage, "from" | "unsubscribe" | "headers"> & {
+  readonly from: string;
+  readonly headers: Readonly<Record<string, string>>;
+};
+type ChatMessage = {
+  readonly text: string;
+  /** Rendered by the transport as its approval card, linking to `url`. */
+  readonly approval?: {
+    readonly prompt: ApprovalPrompt;
+    readonly url: string;
+  };
+};
+/** A CloudEvents 1.0 event, posted as `application/cloudevents+json`. */
+type WebhookMessage = {
+  readonly event: CloudEvent;
+};
+type DeliveryMessages = {
+  readonly email: EmailMessage;
+  readonly chat: ChatMessage;
+  readonly webhook: WebhookMessage;
+};
+/** What a transport of channel `C` receives. */
+type TransportMessages = {
+  readonly email: OutgoingEmail;
+  readonly chat: ChatMessage;
+  readonly webhook: WebhookMessage;
+};
+/**
+ * A recipient the router checked: the granted decision that let it through
+ * and the address in the form the channel compares. A transport refuses a
+ * target without a granted `decision` (`isDeliveryTarget`).
+ */
+type DeliveryTarget<C extends DeliveryChannel = DeliveryChannel> = {
+  readonly channel: C;
+  readonly address: string;
+  /** Absent for a trusted address no principal is linked to. */
+  readonly principal?: string;
+  readonly provider?: string;
+  readonly workspace?: string;
+  readonly trusted?: true;
+  readonly decision: GrantedDecision;
+};
+type TransportOptions = {
+  /** Stable for one delivery id and recipient: the provider's `Idempotency-Key` and the `webhook-id`. */
+  readonly idempotencyKey: string;
+  /** The delivery id every recipient of one `deliver` call shares. */
+  readonly delivery: string;
+};
+type DeliveryResult = {
+  readonly status: "sent";
+  readonly providerId?: string;
+} | {
+  readonly status: "failed";
+  readonly cause: DeliveryFailureCause;
+  /** Whether a retry with the same idempotency key may succeed. */
+  readonly retryable: boolean;
+  readonly reason?: string;
+};
+/** One delivery as a transport receives it. */
+type TransportItem<C extends DeliveryChannel = DeliveryChannel> = {
+  readonly target: DeliveryTarget<C>;
+  readonly message: TransportMessages[C];
+  readonly options: TransportOptions;
+};
+/**
+ * One channel's sender. `deliver` resolves to a result; a throw or a
+ * rejection counts as a retryable `unavailable` failure.
+ */
+type DeliveryTransport<C extends DeliveryChannel = DeliveryChannel> = {
+  readonly channel: C;
+  /** The provider name delivery events carry (`resend`, `chat-sdk`, `webhook`). */
+  readonly name: string;
+  deliver(target: DeliveryTarget<C>, message: TransportMessages[C], options: TransportOptions): DeliveryResult | Promise<DeliveryResult>;
+  /**
+   * Sends several deliveries in one provider call, one result per item in
+   * item order. The router uses it for two or more ready recipients.
+   */
+  deliverBatch?(items: readonly TransportItem<C>[]): readonly DeliveryResult[] | Promise<readonly DeliveryResult[]>;
+  /** The most items one `deliverBatch` call takes. Defaults to 100. */
+  readonly batchSize?: number;
+};
+type EmailTransport = DeliveryTransport<"email"> & {
+  /** The `from` of an email whose message and router set none. */
+  readonly from?: string;
+};
+type ChatTransport = DeliveryTransport<"chat">;
+type WebhookTransport = DeliveryTransport<"webhook">;
+type DeliveryTransports = {
+  readonly email?: EmailTransport;
+  readonly chat?: ChatTransport;
+  readonly webhook?: WebhookTransport;
+};
+type DeliverOptions = {
+  /** Keep it across retries so each recipient's idempotency key repeats. Defaults to `dlv_` and a random UUID. */
+  readonly id?: string;
+  /** The approval request id a prompt is delivered for, on every event. */
+  readonly approval?: string;
+};
+type DeliveryReport = {
+  readonly id: string;
+  /** One event per recipient, in recipient order. */
+  readonly events: readonly DeliveryEvent[];
+  readonly sent: number;
+  readonly failed: number;
+};
+//#endregion
+export { TransportOptions as _, DeliveryReport as a, DeliveryTransport as c, EmailTransport as d, EmailUnsubscribe as f, TransportMessages as g, TransportItem as h, DeliveryMessages as i, DeliveryTransports as l, Recipient as m, ChatTransport as n, DeliveryResult as o, OutgoingEmail as p, DeliverOptions as r, DeliveryTarget as s, ChatMessage as t, EmailMessage as u, WebhookMessage as v, WebhookTransport as y };

package/dist/types-DiQjupG2.d.ts

@@ -0,0 +1,332 @@
+import { Y as JwtClaims, dt as TokenVerifier, et as MembershipSource, ir as Subject, lt as TokenFailureCause, qn as Actor, qt as AuthEvent, rr as Principal } from "./policy-types-DzwivBgR.js";
+import { m as ApprovalStore } from "./types-CCpc2Dcv.js";
+import { n as RevocationFeed } from "./revocations-R07lFBnX.js";
+import { t as ClaimsMap } from "./claims-map-Ca-QX8C6.js";
+import { t as ClientNames } from "./clients-C7zLFuWT.js";
+import { StandardSchemaV1 } from "@standard-schema/spec";
+//#region src/jwt/types.d.ts
+type JwtAlgorithm = "ES256" | "PS256" | "Ed25519" | "RS256" | "HS256" | "EdDSA";
+type JwtProfile = "fapi2";
+type JsonWebKeySet = {
+  readonly keys: readonly Record<string, unknown>[];
+};
+type JwtJwks = URL | string | JsonWebKeySet | {
+  readonly secret: Uint8Array | string;
+};
+type DiscoveryInput = string | {
+  readonly issuer: string;
+  readonly metadata?: {
+    readonly issuer?: string;
+    readonly jwks_uri?: string;
+  };
+};
+type JwksCacheOptions = {
+  readonly minTtl?: number;
+  readonly maxTtl?: number;
+  readonly cooldown?: number;
+  /** Milliseconds a discovery or JWKS request may take before it counts as failed. Default 5000. */
+  readonly timeout?: number;
+};
+type JoseTokenVerifierOptions = {
+  readonly jwks?: JwtJwks;
+  readonly discovery?: DiscoveryInput;
+  readonly issuer?: string;
+  readonly algorithms?: readonly JwtAlgorithm[];
+  readonly typ?: string | readonly string[];
+  readonly audience?: string | readonly string[];
+  readonly clockTolerance?: number;
+  readonly decryptionKeys?: JsonWebKeySet | Record<string, unknown>;
+  readonly decryptionAlgorithms?: readonly string[];
+  readonly profile?: JwtProfile;
+  readonly jwksCache?: JwksCacheOptions;
+  readonly fetch?: typeof fetch;
+};
+type JoseTokenSignerOptions = {
+  readonly key: Record<string, unknown> | Uint8Array;
+  readonly alg: JwtAlgorithm;
+  readonly kid: string;
+  /** `iss` of every output; required. */
+  readonly issuer: string;
+  /** `aud` for an output whose `sign` call names none; without either, `sign` rejects. */
+  readonly audience?: string | readonly string[];
+};
+type JwtDelegationPaths = {
+  readonly scopes?: string;
+  readonly authorizationDetails?: string;
+  readonly access?: string;
+};
+type JwtSubjectOptions = Omit<JoseTokenVerifierOptions, "audience"> & {
+  /**
+   * The `aud` this resource server accepts. Required unless a `verifier` is
+   * passed: `false` accepts any audience and must be a deliberate choice.
+   */
+  readonly audience?: string | readonly string[] | false;
+  readonly accept?: "access-token" | "id-token";
+  readonly claims?: ClaimsMap;
+  readonly groupRoles?: Readonly<Record<string, readonly string[]>>;
+  readonly schema?: StandardSchemaV1;
+  readonly delegation?: JwtDelegationPaths;
+  readonly actor?: {
+    readonly from?: "act";
+    readonly kind?: string;
+    /** Names for client ids (`ClientNames`): the actor gets `client` set to the name of `act.sub`. */
+    readonly clients?: ClientNames;
+  } | ((claims: JwtClaims) => Actor | undefined);
+  readonly sender?: "none" | "dpop" | "mtls";
+  /** With `sender: "dpop"`, rejects a proof `jti` already used by the same key within 60 seconds. */
+  readonly replay?: ReplayStore;
+  readonly memberships?: MembershipSource;
+  readonly verifier?: TokenVerifier;
+  readonly certificateThumbprint?: string;
+  readonly onAuth?: (event: AuthEvent) => void;
+  readonly requestId?: string;
+};
+type JwtPrincipal = Principal & {
+  readonly issuer?: string;
+  readonly claims?: Readonly<Record<string, unknown>>;
+};
+type DpopProofResult = {
+  readonly ok: true;
+} | {
+  readonly ok: false;
+  readonly cause: TokenFailureCause;
+};
+/** The principal `subjectFromIntrospection` maps an RFC 7662 response to. */
+type IntrospectionPrincipal = JwtPrincipal;
+type MappedSubject = Subject<JwtPrincipal>;
+//#endregion
+//#region src/ssf/types.d.ts
+/** Every CAEP 1.0 event type, by the last segment of its URI. */
+type CaepEventName = "session-revoked" | "credential-change" | "assurance-level-change" | "token-claims-change" | "device-compliance-change" | "session-established" | "session-presented" | "risk-level-change";
+/** The RISC 1.0 event types PermDock treats as a revocation of every session. */
+type RiscEventName = "account-disabled" | "account-purged" | "credential-compromise";
+type SsfEventName = CaepEventName | RiscEventName;
+/** An SSF 1.0 stream `verification` event: the `state` the receiver asked the transmitter to echo. */
+type SsfVerification = {
+  readonly state?: string;
+  readonly jti: string;
+  readonly issuer?: string;
+};
+type SetSubject = {
+  readonly format: string;
+  readonly [key: string]: unknown;
+};
+type SsfSubject = {
+  readonly id: string;
+  readonly session?: string;
+  readonly issuer?: string;
+};
+type SsfSubjectResolver = (setSubject: SetSubject, meta?: {
+  readonly session?: string;
+  readonly issuer?: string;
+}) => string | SsfSubject | null | undefined | Promise<string | SsfSubject | null | undefined>;
+type SsfEventInput = {
+  readonly subject: SsfSubject;
+  readonly event: Readonly<Record<string, unknown>>;
+  readonly event_timestamp?: number;
+  readonly jti: string;
+  readonly type: string;
+};
+type SsfEventHandler = (input: SsfEventInput) => void | Promise<void>;
+type SsfOnEvent = { readonly [K in SsfEventName]?: SsfEventHandler; } & {
+  readonly "*"?: SsfEventHandler;
+  /** SSF 1.0 section 8.1.4.1 stream verification; it names a stream, never a subject. */
+  readonly verification?: (input: SsfVerification) => void | Promise<void>;
+};
+/**
+ * Keys are opaque strings namespaced by issuer. A store that implements both
+ * `claim` and `release` makes concurrent deliveries of one SET dispatch once;
+ * one with only `seen` and `remember` is checked and recorded non-atomically.
+ */
+type ReplayStore = {
+  /** Names the implementation in errors and events. */
+  readonly name?: string;
+  seen(key: string): boolean | Promise<boolean>;
+  remember(key: string, expiresAt?: number): void | Promise<void>;
+  /** Records `key` and returns `true` only if it was not already recorded. */
+  claim?(key: string, expiresAt?: number): boolean | Promise<boolean>;
+  /** Forgets a claimed `key` so a failed delivery can be retried. */
+  release?(key: string): void | Promise<void>;
+};
+type SsfAuditEvent = {
+  readonly type: string;
+  readonly subject?: SsfSubject;
+  readonly transmitter?: string;
+  readonly jti?: string;
+  readonly replayed?: true;
+  readonly cancelled?: number;
+  readonly unknown?: "event" | "subject";
+  /** The `state` of a stream `verification` event. */
+  readonly state?: string;
+  readonly err?: string;
+  readonly cause?: TokenFailureCause;
+};
+type SsfEventListener = (event: SsfAuditEvent) => void;
+type PollOptions = {
+  readonly endpoint: string;
+  readonly every?: number | string;
+  readonly token?: string;
+  readonly fetch?: typeof fetch;
+  readonly signal?: AbortSignal;
+};
+type PollHandle = {
+  readonly stop: () => void;
+};
+type PollResult = {
+  readonly acked: readonly string[];
+};
+type SsfPermDockOptions = {
+  readonly issuer?: string;
+  readonly audience: string | readonly string[];
+  readonly jwks?: JwtJwks | string;
+  readonly discovery?: DiscoveryInput;
+  readonly verifier?: TokenVerifier;
+  readonly subject: SsfSubjectResolver;
+  readonly onEvent?: SsfOnEvent;
+  readonly replay?: ReplayStore;
+  readonly approvals?: ApprovalStore;
+  /**
+   * Publishes `session-revoked` for a revoked session and `changed` for
+   * credential, assurance and claims changes, so open connections end or
+   * revalidate.
+   */
+  readonly revocations?: RevocationFeed;
+  readonly clockTolerance?: number;
+  /**
+   * Seconds a SET without `exp` is accepted after its `iat`; default one
+   * day. The replay record is kept at least that long, so a replayed SET
+   * is refused for as long as its signature would verify.
+   */
+  readonly maxTokenAge?: number;
+};
+type SsfReceiver = {
+  push(request: Request): Promise<Response>;
+  logout(request: Request): Promise<Response>;
+  poll(options: PollOptions): Promise<PollResult> | PollHandle;
+  on(event: "event", handler: SsfEventListener): () => void;
+};
+type SsfPermDock = {
+  readonly receiver: SsfReceiver;
+};
+/** One event of a SET: the event-type URI, the RFC 9493 subject and the event's own claims. */
+type SetEvent = {
+  readonly type: string;
+  readonly subject: SetSubject;
+  readonly payload: Readonly<Record<string, unknown>>;
+};
+/** `initiating_entity` (CAEP 1.0 section 2). */
+type CaepInitiatingEntity = "admin" | "user" | "policy" | "system";
+/** A reason as text, or a map of language tag to text (CAEP 1.0 section 2). */
+type CaepReason = string | Readonly<Record<string, string>>;
+/** The CAEP 1.0 common claims every event builder accepts. */
+type CaepCommon = {
+  readonly subject: SetSubject;
+  /** NumericDate seconds the event happened at; the signing time when absent. */
+  readonly eventTimestamp?: number;
+  readonly initiatingEntity?: CaepInitiatingEntity;
+  readonly reasonAdmin?: CaepReason;
+  readonly reasonUser?: CaepReason;
+};
+type SignSetOptions = {
+  /** `aud`: the receiver the stream delivers to. */
+  readonly audience: string | readonly string[];
+  /** `jti`; a fresh UUID when absent. */
+  readonly jti?: string;
+  /** `txn` (RFC 8417 section 2.2): ties SETs from one transaction together. */
+  readonly txn?: string;
+  /** `iat`, NumericDate seconds; the signer's clock when absent. */
+  readonly issuedAt?: number;
+};
+/** Why `pushSet` did not deliver: the RFC 8935 `err` code in kebab case, or a transport failure. */
+type SetDeliveryFailureCause = "invalid-request" | "invalid-key" | "invalid-issuer" | "invalid-audience" | "authentication-failed" | "access-denied" | "unavailable";
+type SetDelivery = {
+  readonly ok: true;
+} | {
+  readonly ok: false;
+  readonly cause: SetDeliveryFailureCause;
+  readonly description?: string;
+  /** `true` when the same SET may be pushed again: a network failure, a timeout or a `5xx`. */
+  readonly retry: boolean;
+};
+type PushSetOptions = {
+  /** The receiver's RFC 8935 push endpoint, the stream's `delivery.endpoint_url`. */
+  readonly endpoint: string;
+  /** The `Authorization` header value, the stream's `delivery.authorization_header`. */
+  readonly authorization?: string;
+  readonly fetch?: typeof fetch;
+  readonly signal?: AbortSignal;
+};
+/** A receiver's report that one SET failed (RFC 8936 section 2.4 `setErrs`). */
+type SetError = {
+  readonly err: string;
+  readonly description: string;
+};
+/**
+ * The SETs a transmitter holds for RFC 8936 poll delivery, per stream. A SET
+ * stays pending until the receiver acknowledges it or reports it failed.
+ */
+type SetQueue = {
+  /** Names the implementation in errors and events. */
+  readonly name?: string;
+  enqueue(stream: string, jti: string, set: string): void | Promise<void>;
+  /** Up to `max` pending SETs, oldest first. */
+  pending(stream: string, max: number): readonly {
+    readonly jti: string;
+    readonly set: string;
+  }[] | Promise<readonly {
+    readonly jti: string;
+    readonly set: string;
+  }[]>;
+  ack(stream: string, jti: string): void | Promise<void>;
+  fail(stream: string, jti: string, error: SetError): void | Promise<void>;
+};
+type SetPollHandlerOptions = {
+  readonly queue: SetQueue;
+  /** The stream id the request's credentials may poll, or `null` to refuse it with `401`. */
+  readonly authorize: (request: Request) => string | null | Promise<string | null>;
+  /** The largest `maxEvents` honoured; default 100. */
+  readonly maxEvents?: number;
+};
+/** SSF 1.0 section 7.1: the document at `/.well-known/ssf-configuration`. */
+type SsfTransmitterConfiguration = {
+  readonly spec_version?: string;
+  readonly issuer: string;
+  readonly jwks_uri?: string;
+  readonly delivery_methods_supported?: readonly string[];
+  readonly configuration_endpoint?: string;
+  readonly status_endpoint?: string;
+  readonly add_subject_endpoint?: string;
+  readonly remove_subject_endpoint?: string;
+  readonly verification_endpoint?: string;
+  readonly critical_subject_members?: readonly string[];
+  readonly authorization_schemes?: readonly {
+    readonly spec_urn: string;
+  }[];
+  readonly default_subjects?: "ALL" | "NONE";
+};
+/** SSF 1.0 section 8.1.1: one stream as the configuration endpoint returns it. */
+type SsfStreamConfiguration = {
+  readonly stream_id: string;
+  readonly iss: string;
+  readonly aud: string | readonly string[];
+  readonly events_supported?: readonly string[];
+  readonly events_requested?: readonly string[];
+  readonly events_delivered?: readonly string[];
+  readonly delivery: {
+    /** `urn:ietf:rfc:8935` (push) or `urn:ietf:rfc:8936` (poll). */
+    readonly method: string;
+    readonly endpoint_url?: string;
+    readonly authorization_header?: string;
+  };
+  readonly min_verification_interval?: number;
+  readonly inactivity_timeout?: number;
+  readonly description?: string;
+};
+/** SSF 1.0 section 8.1.2: a stream's status. */
+type SsfStreamStatus = {
+  readonly stream_id: string;
+  readonly status: "enabled" | "paused" | "disabled";
+  readonly reason?: string;
+};
+//#endregion
+export { SsfSubject as A, JwtAlgorithm as B, SsfEventName as C, SsfReceiver as D, SsfPermDockOptions as E, DpopProofResult as F, JwtPrincipal as H, IntrospectionPrincipal as I, JoseTokenSignerOptions as L, SsfTransmitterConfiguration as M, SsfVerification as N, SsfStreamConfiguration as O, DiscoveryInput as P, JoseTokenVerifierOptions as R, SsfEventListener as S, SsfPermDock as T, JwtSubjectOptions as U, JwtJwks as V, MappedSubject as W, SetSubject as _, PollHandle as a, SsfEventHandler as b, PushSetOptions as c, SetDelivery as d, SetDeliveryFailureCause as f, SetQueue as g, SetPollHandlerOptions as h, CaepReason as i, SsfSubjectResolver as j, SsfStreamStatus as k, ReplayStore as l, SetEvent as m, CaepEventName as n, PollOptions as o, SetError as p, CaepInitiatingEntity as r, PollResult as s, CaepCommon as t, RiscEventName as u, SignSetOptions as v, SsfOnEvent as w, SsfEventInput as x, SsfAuditEvent as y, JsonWebKeySet as z };

package/dist/types-DqzsnlSA.js

@@ -0,0 +1,67 @@
+import { a as durationOf } from "./time-DkWjdL98.js";
+//#region src/approvals/errors.ts
+var ApprovalError = class extends Error {
+	name = "ApprovalError";
+	code;
+	constructor(code, message) {
+		super(message);
+		this.code = code;
+	}
+};
+const CODES = /* @__PURE__ */ new Set([
+	"approval-not-found",
+	"approval-not-pending",
+	"approval-expired",
+	"approver-unauthenticated",
+	"approver-is-actor",
+	"approver-is-principal",
+	"approver-not-eligible",
+	"approver-repeated"
+]);
+function isApprovalErrorCode(value) {
+	return typeof value === "string" && CODES.has(value);
+}
+/** Matches by `name` and `code`, so an error from another copy of the module still maps. */
+function isApprovalError(value) {
+	if (!(value instanceof Error) || value.name !== "ApprovalError") return false;
+	const code = Reflect.get(value, "code");
+	return typeof code === "string" && CODES.has(code);
+}
+//#endregion
+//#region src/approvals/types.ts
+const APPROVAL_HEADER = "PermDock-Approval";
+/** Seconds a request stays open when neither the store nor the call sets a `ttl`. */
+const DEFAULT_APPROVAL_TTL = 3600;
+/** The approvals a request needs in total: `approvers.quorum` (or 1), or the sum of its stages' quorums. */
+function approvalQuorum(request) {
+	const stages = request.approvers?.stages;
+	if (stages !== void 0) return stages.reduce((sum, stage) => sum + (stage.quorum ?? 1), 0);
+	return request.approvers?.quorum ?? 1;
+}
+/**
+* The instant from which `approvers.escalation.to` may approve, in epoch
+* milliseconds, or `undefined` when the request has no escalation or its
+* `after` does not parse (then nobody escalates: fail-closed).
+*/
+function escalationOpenAt(request) {
+	const seconds = durationOf(request.approvers?.escalation?.after);
+	if (seconds === void 0) return;
+	return Date.parse(request.createdAt) + seconds * 1e3;
+}
+/** The instant from which a stage's own `escalation.to` may approve it, in epoch milliseconds; `undefined` when it has none or `after` does not parse. */
+function stageEscalationOpenAt(request, stage) {
+	const seconds = durationOf(stage.escalation?.after);
+	if (seconds === void 0) return;
+	return Date.parse(request.createdAt) + seconds * 1e3;
+}
+/** The key a verdict's `relations` lists a relation approver under. */
+function approverRelationKey(item) {
+	return JSON.stringify([
+		item.resource,
+		item.relation,
+		item.through ?? null,
+		item.depth ?? null
+	]);
+}
+//#endregion
+export { escalationOpenAt as a, isApprovalError as c, approverRelationKey as i, isApprovalErrorCode as l, DEFAULT_APPROVAL_TTL as n, stageEscalationOpenAt as o, approvalQuorum as r, ApprovalError as s, APPROVAL_HEADER as t };