permdock 0.4.0 → 0.6.0

package/dist/types-C791HFu9.d.ts

@@ -0,0 +1,332 @@
+import { Y as JwtClaims, ar as Subject, dt as TokenVerifier, et as MembershipSource, lt as TokenFailureCause, qn as Actor, qt as AuthEvent, rr as Principal } from "./policy-types-n0uRTsW8.js";
+import { m as ApprovalStore } from "./types-BdtSDbBO.js";
+import { n as RevocationFeed } from "./revocations-R07lFBnX.js";
+import { t as ClaimsMap } from "./claims-map-Ca-QX8C6.js";
+import { t as ClientNames } from "./clients-C7zLFuWT.js";
+import { StandardSchemaV1 } from "@standard-schema/spec";
+//#region src/jwt/types.d.ts
+type JwtAlgorithm = "ES256" | "PS256" | "Ed25519" | "RS256" | "HS256" | "EdDSA";
+type JwtProfile = "fapi2";
+type JsonWebKeySet = {
+  readonly keys: readonly Record<string, unknown>[];
+};
+type JwtJwks = URL | string | JsonWebKeySet | {
+  readonly secret: Uint8Array | string;
+};
+type DiscoveryInput = string | {
+  readonly issuer: string;
+  readonly metadata?: {
+    readonly issuer?: string;
+    readonly jwks_uri?: string;
+  };
+};
+type JwksCacheOptions = {
+  readonly minTtl?: number;
+  readonly maxTtl?: number;
+  readonly cooldown?: number;
+  /** Milliseconds a discovery or JWKS request may take before it counts as failed. Default 5000. */
+  readonly timeout?: number;
+};
+type JoseTokenVerifierOptions = {
+  readonly jwks?: JwtJwks;
+  readonly discovery?: DiscoveryInput;
+  readonly issuer?: string;
+  readonly algorithms?: readonly JwtAlgorithm[];
+  readonly typ?: string | readonly string[];
+  readonly audience?: string | readonly string[];
+  readonly clockTolerance?: number;
+  readonly decryptionKeys?: JsonWebKeySet | Record<string, unknown>;
+  readonly decryptionAlgorithms?: readonly string[];
+  readonly profile?: JwtProfile;
+  readonly jwksCache?: JwksCacheOptions;
+  readonly fetch?: typeof fetch;
+};
+type JoseTokenSignerOptions = {
+  readonly key: Record<string, unknown> | Uint8Array;
+  readonly alg: JwtAlgorithm;
+  readonly kid: string;
+  /** `iss` of every output; required. */
+  readonly issuer: string;
+  /** `aud` for an output whose `sign` call names none; without either, `sign` rejects. */
+  readonly audience?: string | readonly string[];
+};
+type JwtDelegationPaths = {
+  readonly scopes?: string;
+  readonly authorizationDetails?: string;
+  readonly access?: string;
+};
+type JwtSubjectOptions = Omit<JoseTokenVerifierOptions, "audience"> & {
+  /**
+   * The `aud` this resource server accepts. Required unless a `verifier` is
+   * passed: `false` accepts any audience and must be a deliberate choice.
+   */
+  readonly audience?: string | readonly string[] | false;
+  readonly accept?: "access-token" | "id-token";
+  readonly claims?: ClaimsMap;
+  readonly groupRoles?: Readonly<Record<string, readonly string[]>>;
+  readonly schema?: StandardSchemaV1;
+  readonly delegation?: JwtDelegationPaths;
+  readonly actor?: {
+    readonly from?: "act";
+    readonly kind?: string;
+    /** Names for client ids (`ClientNames`): the actor gets `client` set to the name of `act.sub`. */
+    readonly clients?: ClientNames;
+  } | ((claims: JwtClaims) => Actor | undefined);
+  readonly sender?: "none" | "dpop" | "mtls";
+  /** With `sender: "dpop"`, rejects a proof `jti` already used by the same key within 60 seconds. */
+  readonly replay?: ReplayStore;
+  readonly memberships?: MembershipSource;
+  readonly verifier?: TokenVerifier;
+  readonly certificateThumbprint?: string;
+  readonly onAuth?: (event: AuthEvent) => void;
+  readonly requestId?: string;
+};
+type JwtPrincipal = Principal & {
+  readonly issuer?: string;
+  readonly claims?: Readonly<Record<string, unknown>>;
+};
+type DpopProofResult = {
+  readonly ok: true;
+} | {
+  readonly ok: false;
+  readonly cause: TokenFailureCause;
+};
+/** The principal `subjectFromIntrospection` maps an RFC 7662 response to. */
+type IntrospectionPrincipal = JwtPrincipal;
+type MappedSubject = Subject<JwtPrincipal>;
+//#endregion
+//#region src/ssf/types.d.ts
+/** Every CAEP 1.0 event type, by the last segment of its URI. */
+type CaepEventName = "session-revoked" | "credential-change" | "assurance-level-change" | "token-claims-change" | "device-compliance-change" | "session-established" | "session-presented" | "risk-level-change";
+/** The RISC 1.0 event types PermDock treats as a revocation of every session. */
+type RiscEventName = "account-disabled" | "account-purged" | "credential-compromise";
+type SsfEventName = CaepEventName | RiscEventName;
+/** An SSF 1.0 stream `verification` event: the `state` the receiver asked the transmitter to echo. */
+type SsfVerification = {
+  readonly state?: string;
+  readonly jti: string;
+  readonly issuer?: string;
+};
+type SetSubject = {
+  readonly format: string;
+  readonly [key: string]: unknown;
+};
+type SsfSubject = {
+  readonly id: string;
+  readonly session?: string;
+  readonly issuer?: string;
+};
+type SsfSubjectResolver = (setSubject: SetSubject, meta?: {
+  readonly session?: string;
+  readonly issuer?: string;
+}) => string | SsfSubject | null | undefined | Promise<string | SsfSubject | null | undefined>;
+type SsfEventInput = {
+  readonly subject: SsfSubject;
+  readonly event: Readonly<Record<string, unknown>>;
+  readonly event_timestamp?: number;
+  readonly jti: string;
+  readonly type: string;
+};
+type SsfEventHandler = (input: SsfEventInput) => void | Promise<void>;
+type SsfOnEvent = { readonly [K in SsfEventName]?: SsfEventHandler; } & {
+  readonly "*"?: SsfEventHandler;
+  /** SSF 1.0 section 8.1.4.1 stream verification; it names a stream, never a subject. */
+  readonly verification?: (input: SsfVerification) => void | Promise<void>;
+};
+/**
+ * Keys are opaque strings namespaced by issuer. A store that implements both
+ * `claim` and `release` makes concurrent deliveries of one SET dispatch once;
+ * one with only `seen` and `remember` is checked and recorded non-atomically.
+ */
+type ReplayStore = {
+  /** Names the implementation in errors and events. */
+  readonly name?: string;
+  seen(key: string): boolean | Promise<boolean>;
+  remember(key: string, expiresAt?: number): void | Promise<void>;
+  /** Records `key` and returns `true` only if it was not already recorded. */
+  claim?(key: string, expiresAt?: number): boolean | Promise<boolean>;
+  /** Forgets a claimed `key` so a failed delivery can be retried. */
+  release?(key: string): void | Promise<void>;
+};
+type SsfAuditEvent = {
+  readonly type: string;
+  readonly subject?: SsfSubject;
+  readonly transmitter?: string;
+  readonly jti?: string;
+  readonly replayed?: true;
+  readonly cancelled?: number;
+  readonly unknown?: "event" | "subject";
+  /** The `state` of a stream `verification` event. */
+  readonly state?: string;
+  readonly err?: string;
+  readonly cause?: TokenFailureCause;
+};
+type SsfEventListener = (event: SsfAuditEvent) => void;
+type PollOptions = {
+  readonly endpoint: string;
+  readonly every?: number | string;
+  readonly token?: string;
+  readonly fetch?: typeof fetch;
+  readonly signal?: AbortSignal;
+};
+type PollHandle = {
+  readonly stop: () => void;
+};
+type PollResult = {
+  readonly acked: readonly string[];
+};
+type SsfPermDockOptions = {
+  readonly issuer?: string;
+  readonly audience: string | readonly string[];
+  readonly jwks?: JwtJwks | string;
+  readonly discovery?: DiscoveryInput;
+  readonly verifier?: TokenVerifier;
+  readonly subject: SsfSubjectResolver;
+  readonly onEvent?: SsfOnEvent;
+  readonly replay?: ReplayStore;
+  readonly approvals?: ApprovalStore;
+  /**
+   * Publishes `session-revoked` for a revoked session and `changed` for
+   * credential, assurance and claims changes, so open connections end or
+   * revalidate.
+   */
+  readonly revocations?: RevocationFeed;
+  readonly clockTolerance?: number;
+  /**
+   * Seconds a SET without `exp` is accepted after its `iat`; default one
+   * day. The replay record is kept at least that long, so a replayed SET
+   * is refused for as long as its signature would verify.
+   */
+  readonly maxTokenAge?: number;
+};
+type SsfReceiver = {
+  push(request: Request): Promise<Response>;
+  logout(request: Request): Promise<Response>;
+  poll(options: PollOptions): Promise<PollResult> | PollHandle;
+  on(event: "event", handler: SsfEventListener): () => void;
+};
+type SsfPermDock = {
+  readonly receiver: SsfReceiver;
+};
+/** One event of a SET: the event-type URI, the RFC 9493 subject and the event's own claims. */
+type SetEvent = {
+  readonly type: string;
+  readonly subject: SetSubject;
+  readonly payload: Readonly<Record<string, unknown>>;
+};
+/** `initiating_entity` (CAEP 1.0 section 2). */
+type CaepInitiatingEntity = "admin" | "user" | "policy" | "system";
+/** A reason as text, or a map of language tag to text (CAEP 1.0 section 2). */
+type CaepReason = string | Readonly<Record<string, string>>;
+/** The CAEP 1.0 common claims every event builder accepts. */
+type CaepCommon = {
+  readonly subject: SetSubject;
+  /** NumericDate seconds the event happened at; the signing time when absent. */
+  readonly eventTimestamp?: number;
+  readonly initiatingEntity?: CaepInitiatingEntity;
+  readonly reasonAdmin?: CaepReason;
+  readonly reasonUser?: CaepReason;
+};
+type SignSetOptions = {
+  /** `aud`: the receiver the stream delivers to. */
+  readonly audience: string | readonly string[];
+  /** `jti`; a fresh UUID when absent. */
+  readonly jti?: string;
+  /** `txn` (RFC 8417 section 2.2): ties SETs from one transaction together. */
+  readonly txn?: string;
+  /** `iat`, NumericDate seconds; the signer's clock when absent. */
+  readonly issuedAt?: number;
+};
+/** Why `pushSet` did not deliver: the RFC 8935 `err` code in kebab case, or a transport failure. */
+type SetDeliveryFailureCause = "invalid-request" | "invalid-key" | "invalid-issuer" | "invalid-audience" | "authentication-failed" | "access-denied" | "unavailable";
+type SetDelivery = {
+  readonly ok: true;
+} | {
+  readonly ok: false;
+  readonly cause: SetDeliveryFailureCause;
+  readonly description?: string;
+  /** `true` when the same SET may be pushed again: a network failure, a timeout or a `5xx`. */
+  readonly retry: boolean;
+};
+type PushSetOptions = {
+  /** The receiver's RFC 8935 push endpoint, the stream's `delivery.endpoint_url`. */
+  readonly endpoint: string;
+  /** The `Authorization` header value, the stream's `delivery.authorization_header`. */
+  readonly authorization?: string;
+  readonly fetch?: typeof fetch;
+  readonly signal?: AbortSignal;
+};
+/** A receiver's report that one SET failed (RFC 8936 section 2.4 `setErrs`). */
+type SetError = {
+  readonly err: string;
+  readonly description: string;
+};
+/**
+ * The SETs a transmitter holds for RFC 8936 poll delivery, per stream. A SET
+ * stays pending until the receiver acknowledges it or reports it failed.
+ */
+type SetQueue = {
+  /** Names the implementation in errors and events. */
+  readonly name?: string;
+  enqueue(stream: string, jti: string, set: string): void | Promise<void>;
+  /** Up to `max` pending SETs, oldest first. */
+  pending(stream: string, max: number): readonly {
+    readonly jti: string;
+    readonly set: string;
+  }[] | Promise<readonly {
+    readonly jti: string;
+    readonly set: string;
+  }[]>;
+  ack(stream: string, jti: string): void | Promise<void>;
+  fail(stream: string, jti: string, error: SetError): void | Promise<void>;
+};
+type SetPollHandlerOptions = {
+  readonly queue: SetQueue;
+  /** The stream id the request's credentials may poll, or `null` to refuse it with `401`. */
+  readonly authorize: (request: Request) => string | null | Promise<string | null>;
+  /** The largest `maxEvents` honoured; default 100. */
+  readonly maxEvents?: number;
+};
+/** SSF 1.0 section 7.1: the document at `/.well-known/ssf-configuration`. */
+type SsfTransmitterConfiguration = {
+  readonly spec_version?: string;
+  readonly issuer: string;
+  readonly jwks_uri?: string;
+  readonly delivery_methods_supported?: readonly string[];
+  readonly configuration_endpoint?: string;
+  readonly status_endpoint?: string;
+  readonly add_subject_endpoint?: string;
+  readonly remove_subject_endpoint?: string;
+  readonly verification_endpoint?: string;
+  readonly critical_subject_members?: readonly string[];
+  readonly authorization_schemes?: readonly {
+    readonly spec_urn: string;
+  }[];
+  readonly default_subjects?: "ALL" | "NONE";
+};
+/** SSF 1.0 section 8.1.1: one stream as the configuration endpoint returns it. */
+type SsfStreamConfiguration = {
+  readonly stream_id: string;
+  readonly iss: string;
+  readonly aud: string | readonly string[];
+  readonly events_supported?: readonly string[];
+  readonly events_requested?: readonly string[];
+  readonly events_delivered?: readonly string[];
+  readonly delivery: {
+    /** `urn:ietf:rfc:8935` (push) or `urn:ietf:rfc:8936` (poll). */
+    readonly method: string;
+    readonly endpoint_url?: string;
+    readonly authorization_header?: string;
+  };
+  readonly min_verification_interval?: number;
+  readonly inactivity_timeout?: number;
+  readonly description?: string;
+};
+/** SSF 1.0 section 8.1.2: a stream's status. */
+type SsfStreamStatus = {
+  readonly stream_id: string;
+  readonly status: "enabled" | "paused" | "disabled";
+  readonly reason?: string;
+};
+//#endregion
+export { SsfSubject as A, JwtAlgorithm as B, SsfEventName as C, SsfReceiver as D, SsfPermDockOptions as E, DpopProofResult as F, JwtPrincipal as H, IntrospectionPrincipal as I, JoseTokenSignerOptions as L, SsfTransmitterConfiguration as M, SsfVerification as N, SsfStreamConfiguration as O, DiscoveryInput as P, JoseTokenVerifierOptions as R, SsfEventListener as S, SsfPermDock as T, JwtSubjectOptions as U, JwtJwks as V, MappedSubject as W, SetSubject as _, PollHandle as a, SsfEventHandler as b, PushSetOptions as c, SetDelivery as d, SetDeliveryFailureCause as f, SetQueue as g, SetPollHandlerOptions as h, CaepReason as i, SsfSubjectResolver as j, SsfStreamStatus as k, ReplayStore as l, SetEvent as m, CaepEventName as n, PollOptions as o, SetError as p, CaepInitiatingEntity as r, PollResult as s, CaepCommon as t, RiscEventName as u, SignSetOptions as v, SsfOnEvent as w, SsfEventInput as x, SsfAuditEvent as y, JsonWebKeySet as z };

package/dist/types-C863OQiR.d.ts

@@ -0,0 +1,57 @@
+import { Vt as Snapshot, dt as TokenVerifier, ot as SnapshotSource } from "./policy-types-n0uRTsW8.js";
+import { n as DescribeMessages } from "./describe-B5qgDvEW.js";
+import { h as ClientStoreOptions } from "./types-B3_ooZgZ.js";
+import { t as PermDockDefaults } from "./types-CX7AvRqP.js";
+import { ReactNode } from "react";
+//#region src/react-native/types.d.ts
+type SnapshotStorage = {
+  /** Names the implementation in errors and events. */
+  readonly name?: string;
+  getItem(key: string): string | null | Promise<string | null>;
+  setItem(key: string, value: string): void | Promise<void>;
+  removeItem(key: string): void | Promise<void>;
+};
+type NativeRevalidate = "launch" | "focus" | number;
+/**
+ * Calls `listener` when the app changes state; `active` is `false` when it
+ * goes to the background. A listener called without an argument counts as
+ * a return to the foreground.
+ */
+type SubscribeForeground = (listener: (active?: boolean) => void) => () => void;
+/** Calls `listener` with `false` when the device loses connectivity and `true` when it returns. */
+type SubscribeOnline = (listener: (online: boolean) => void) => () => void;
+type ReactNativePermDockProviderProps = {
+  readonly storage: SnapshotStorage;
+  /**
+   * The signed-in principal's id, or `null` when nobody is signed in. Only a
+   * persisted snapshot for this id is read or written; `null` clears storage.
+   */
+  readonly subjectId: string | null;
+  readonly snapshot?: Snapshot | string;
+  readonly snapshotUrl?: string;
+  /** Hydrates from the device's own rows (`localSnapshot`); with `snapshotUrl` too, the latest answer wins. */
+  readonly source?: SnapshotSource;
+  readonly endpoint?: string;
+  readonly approvals?: string;
+  readonly tenant?: string;
+  readonly revalidate?: NativeRevalidate;
+  readonly subscribeForeground?: SubscribeForeground;
+  readonly subscribeOnline?: SubscribeOnline;
+  readonly fetch?: typeof fetch;
+  readonly headers?: Readonly<Record<string, string>>;
+  readonly maxAge?: number;
+  readonly verifier?: TokenVerifier;
+  /** What every `<Protected>` below renders for a slot it leaves out. */
+  readonly defaults?: PermDockDefaults;
+  /** Localised text for `useDescribe()`. */
+  readonly messages?: DescribeMessages;
+  /** Called with each snapshot the store accepts, after it is persisted. */
+  readonly onSnapshot?: NonNullable<ClientStoreOptions["onSnapshot"]>;
+  /** Called when the store drops its snapshot, after storage is cleared. */
+  readonly onClear?: () => void;
+  /** Milliseconds between approval status polls. Defaults to 2000. */
+  readonly approvalInterval?: number;
+  readonly children: ReactNode;
+};
+//#endregion
+export { SubscribeOnline as a, SubscribeForeground as i, ReactNativePermDockProviderProps as n, SnapshotStorage as r, NativeRevalidate as t };

package/dist/{types-ByUo56un.d.ts → types-CVZSNocA.d.ts}

@@ -1,26 +1,18 @@
-import { an as Snapshot, ir as Decision, jt as PermDock, rr as ApprovalRequiredDecision, ur as GrantedDecision, ut as TokenVerifier } from "./policy-types-sp9P1iIV.js";
-import { d as Permission } from "./permission-types-Dg39z9Kv.js";
+import { Mn as ApprovalRequiredDecision, Nn as Decision, Vt as Snapshot, dt as TokenVerifier, zn as GrantedDecision } from "./policy-types-n0uRTsW8.js";
+import { w as Permission } from "./vocabulary-CN8H_9UF.js";
+import { r as PermDock } from "./permdock-SV8ZINYT.js";
 import { t as PermissionBoundaryState } from "./boundary-BmHxVH1J.js";
-import { l as PermissionState, t as ClientStore, u as ProviderOptionsBase } from "./store-9KO4BlkB.js";
+import { l as PermissionState, m as ClientStore, u as ProviderOptionsBase } from "./types-B3_ooZgZ.js";
 import { Snippet } from "svelte";
 import { Readable } from "svelte/store";
-//#region src/svelte/boundary.d.ts
-type PermissionBoundaryProps = {
-  readonly children?: Snippet;
-  /** Rendered in place of the children when one throws `PermDockDeniedError`. */
-  readonly denied?: Snippet<[PermissionBoundaryState]>;
-  /** Rendered for `PermDockApprovalRequiredError`; defaults to `denied`. */
-  readonly approval?: Snippet<[PermissionBoundaryState]>;
-};
-//#endregion
 //#region src/client/views.d.ts
 /**
  * What `Protected` renders: `pending` while an endpoint answer is in flight,
- * `approval` for an approval-required decision, `fallback` for any other
+ * `approval` for an approval-required decision, `denied` for any other
  * denial.
  */
 type ProtectedView = (PermissionState & {
-  readonly slot: "pending" | "fallback";
+  readonly slot: "pending" | "denied";
 }) | {
   readonly allowed: false;
   readonly status: PermissionState["status"];
@@ -35,18 +27,27 @@ type ProtectedView = (PermissionState & {
 /** Provider-wide content for the `Protected` slots a component leaves out. */
 type SlotDefaults<P, F, A = F> = {
   readonly pending?: P;
-  readonly fallback?: F;
+  readonly denied?: F;
   readonly approval?: A;
 };
 /**
  * The content `Protected` renders for a non-default slot. Its own prop wins
- * over the provider default; `approval` falls back to `fallback`, first the
+ * over the provider default; `approval` falls back to `denied`, first the
  * component's, then the provider's.
  */
 declare function slotContent<P, F, A>(slot: "pending", own: SlotDefaults<P, F, A>, defaults: SlotDefaults<P, F, A> | undefined): P | undefined;
-declare function slotContent<P, F, A>(slot: "fallback", own: SlotDefaults<P, F, A>, defaults: SlotDefaults<P, F, A> | undefined): F | undefined;
+declare function slotContent<P, F, A>(slot: "denied", own: SlotDefaults<P, F, A>, defaults: SlotDefaults<P, F, A> | undefined): F | undefined;
 declare function slotContent<P, F, A>(slot: "approval", own: SlotDefaults<P, F, A>, defaults: SlotDefaults<P, F, A> | undefined): F | A | undefined;
 //#endregion
+//#region src/svelte/boundary.d.ts
+type PermissionBoundaryProps = {
+  readonly children?: Snippet;
+  /** Rendered in place of the children when one throws `PermDockDeniedError`. */
+  readonly denied?: Snippet<[PermissionBoundaryState]>;
+  /** Rendered for `PermDockApprovalRequiredError`; defaults to `denied`. */
+  readonly approval?: Snippet<[PermissionBoundaryState]>;
+};
+//#endregion
 //#region src/svelte/protected.d.ts
 type ProtectedProps = {
   readonly permission: Permission;
@@ -54,8 +55,8 @@ type ProtectedProps = {
   readonly tenant?: string;
   readonly children?: Snippet<[GrantedDecision]>;
   readonly pending?: Snippet;
-  readonly fallback?: Snippet<[Decision]>;
-  /** Rendered for an approval-required decision; defaults to `fallback`. */
+  readonly denied?: Snippet<[Decision]>;
+  /** Rendered for an approval-required decision; defaults to `denied`. */
   readonly approval?: Snippet<[ApprovalRequiredDecision]>;
 };
 /** The instance for `tenant`, built once per store change rather than once per check. */
@@ -63,7 +64,7 @@ declare function scopedFor(store: ClientStore, tenant: string | undefined, _gene
 declare function viewFor(store: ClientStore, reference: Permission, data: unknown, scoped: PermDock | undefined, _generation?: number): ProtectedView;
 //#endregion
 //#region src/svelte/types.d.ts
-type PermDockSvelteOptions = ProviderOptionsBase & {
+type SveltePermDockOptions = ProviderOptionsBase & {
   /**
    * A getter (`() => data.snapshot`) or a readable store re-hydrates the
    * store when it changes; a promise keeps the store `pending` until it
@@ -81,8 +82,8 @@ type PermDockSvelteOptions = ProviderOptionsBase & {
 /** Snippets for the `<Protected>` slots a component leaves out. */
 type PermDockDefaults = {
   readonly pending?: Snippet;
-  readonly fallback?: Snippet<[Decision]>;
+  readonly denied?: Snippet<[Decision]>;
   readonly approval?: Snippet<[ApprovalRequiredDecision]>;
 };
 //#endregion
-export { viewFor as a, scopedFor as i, PermDockSvelteOptions as n, slotContent as o, ProtectedProps as r, PermissionBoundaryProps as s, PermDockDefaults as t };
+export { viewFor as a, scopedFor as i, SveltePermDockOptions as n, PermissionBoundaryProps as o, ProtectedProps as r, slotContent as s, PermDockDefaults as t };

package/dist/{types-DHrmBJLH.d.ts → types-CX7AvRqP.d.ts}

@@ -1,7 +1,7 @@
-import { an as Snapshot, ir as Decision, rr as ApprovalRequiredDecision, ur as GrantedDecision, ut as TokenVerifier } from "./policy-types-sp9P1iIV.js";
-import { d as Permission } from "./permission-types-Dg39z9Kv.js";
-import { n as DescribeMessages } from "./describe-C3ldA9os.js";
-import { n as ClientStoreOptions } from "./store-9KO4BlkB.js";
+import { Mn as ApprovalRequiredDecision, Nn as Decision, Vt as Snapshot, dt as TokenVerifier, zn as GrantedDecision } from "./policy-types-n0uRTsW8.js";
+import { w as Permission } from "./vocabulary-CN8H_9UF.js";
+import { n as DescribeMessages } from "./describe-B5qgDvEW.js";
+import { h as ClientStoreOptions } from "./types-B3_ooZgZ.js";
 import { ReactNode } from "react";
 //#region src/react/types.d.ts
 type PermDockProviderProps = ({
@@ -49,7 +49,7 @@ type PermDockProviderProps = ({
 /** Provider-wide content for the `<Protected>` slots a component leaves out. */
 type PermDockDefaults = {
   readonly pending?: ReactNode;
-  readonly fallback?: ReactNode | ((decision: Decision) => ReactNode);
+  readonly denied?: ReactNode | ((decision: Decision) => ReactNode);
   readonly approval?: ReactNode | ((decision: ApprovalRequiredDecision) => ReactNode);
 };
 type ProtectedProps = {
@@ -57,8 +57,8 @@ type ProtectedProps = {
   readonly data?: unknown;
   readonly tenant?: string;
   readonly pending?: ReactNode;
-  readonly fallback?: ReactNode | ((decision: Decision) => ReactNode);
-  /** Rendered for an approval-required decision; defaults to `fallback`. */
+  readonly denied?: ReactNode | ((decision: Decision) => ReactNode);
+  /** Rendered for an approval-required decision; defaults to `denied`. */
   readonly approval?: ReactNode | ((decision: ApprovalRequiredDecision) => ReactNode);
   readonly children: ReactNode | ((decision: GrantedDecision) => ReactNode);
 };

package/dist/types-C_IiEs64.d.ts

@@ -0,0 +1,65 @@
+import { fn as Approver } from "./policy-types-n0uRTsW8.js";
+//#region src/approvals/access-reviews/types.d.ts
+type AccessReviewStatus = "open" | "closed";
+type AccessReviewItemStatus = "pending" | "kept" | "revoked";
+/**
+ * Access review v1: who holds `permissions` in one tenant, and who may
+ * confirm or revoke each holding. PermDock records the reviewer's decision
+ * and never changes the role or membership itself.
+ */
+type AccessReview = {
+  readonly v: 1;
+  readonly id: string;
+  readonly tenant: string;
+  readonly permissions: readonly string[];
+  readonly reviewers: Approver | readonly Approver[];
+  readonly createdBy: string;
+  readonly createdAt: string;
+  readonly dueAt: string;
+  readonly status: AccessReviewStatus;
+  /** `false` when the population can omit a holder, such as a global role. */
+  readonly complete: boolean;
+};
+/** One holding in a review. `via` names the roles the population attributed it to. */
+type AccessReviewItem = {
+  readonly v: 1;
+  readonly id: string;
+  readonly review: string;
+  readonly principal: string;
+  readonly permission: string;
+  readonly via: readonly string[];
+  readonly status: AccessReviewItemStatus;
+  readonly decidedBy?: string;
+  readonly decidedAt?: string;
+  readonly note?: string;
+  /** Set by the application after it revoked the holding at its source. */
+  readonly appliedAt?: string;
+};
+type AccessReviewItemQuery = {
+  readonly review: string;
+  readonly status?: AccessReviewItemStatus;
+  readonly limit?: number;
+  readonly cursor?: string;
+};
+type AccessReviewItemPage = {
+  readonly items: readonly AccessReviewItem[];
+  readonly next?: string;
+};
+type AccessReviewDecision = {
+  readonly status: "kept" | "revoked";
+  readonly decidedBy: string;
+  readonly decidedAt: string;
+  readonly note?: string;
+};
+type AccessReviewStore = {
+  /** Names the implementation in errors and events. */
+  readonly name?: string;
+  create(review: AccessReview, items: readonly AccessReviewItem[]): Promise<void> | void;
+  get(id: string): Promise<AccessReview | null> | AccessReview | null;
+  items(query: AccessReviewItemQuery): Promise<AccessReviewItemPage> | AccessReviewItemPage;
+  decide(reviewId: string, itemId: string, decision: AccessReviewDecision): Promise<AccessReviewItem> | AccessReviewItem;
+  markApplied(reviewId: string, itemId: string, at: string): Promise<AccessReviewItem> | AccessReviewItem;
+  close(id: string): Promise<AccessReview> | AccessReview;
+};
+//#endregion
+export { AccessReviewItemQuery as a, AccessReviewStore as c, AccessReviewItemPage as i, AccessReviewDecision as n, AccessReviewItemStatus as o, AccessReviewItem as r, AccessReviewStatus as s, AccessReview as t };