permdock 0.5.0 → 0.7.0

package/dist/{index-Chrs5fQ-.d.ts → index-BSfRl0hZ.d.ts}

@@ -1,9 +1,9 @@
-import { Ct as Credential, Nn as Decision, St as ApiKeyPrincipal, T as Policy, Tt as CredentialKind, U as CredentialVerifier, at as SettingsSource, dt as TokenVerifier, gt as SupportSession, ir as Subject, j as PolicyVocabulary, lt as TokenFailureCause, q as DecisionSink, qt as AuthEvent, rr as Principal, ut as TokenSigner } from "./policy-types-DzwivBgR.js";
-import { E as PermissionTree, w as Permission } from "./vocabulary-D6lPdb4Z.js";
-import { p as PrincipalSource } from "./permdock-D7eeLJER.js";
-import { t as Disclosure } from "./problem-details-DXlt-vks.js";
-import { a as ProblemDetails, t as ApprovalHint } from "./errors-C2PXIv4c.js";
-import { c as ServerPermDock, l as ServerPermDockOptions } from "./server-types-BLd4MnBX.js";
+import { Ct as Credential, Ln as Decision, St as ApiKeyPrincipal, T as Policy, Tt as CredentialKind, U as CredentialVerifier, Zt as AuthEvent, at as SettingsSource, dt as TokenVerifier, gt as SupportSession, j as PolicyVocabulary, lr as Subject, lt as TokenFailureCause, q as DecisionSink, sr as Principal, ut as TokenSigner } from "./policy-types-B-F-qAZk.js";
+import { f as PermissionTree, u as Permission } from "./permission-types-DhNEmoRG.js";
+import { h as PrincipalSource } from "./permdock-Dco6dyCK.js";
+import { t as Disclosure } from "./problem-details-Tcfmj3bV.js";
+import { a as ProblemDetails, t as ApprovalHint } from "./errors-B_Qg9D3e.js";
+import { c as ServerPermDock, l as ServerPermDockOptions } from "./server-types-C4gZUEZy.js";
 //#region src/server/create.d.ts
 /**
  * The Fetch factory behind every HTTP adapter. The subject and actor are

package/dist/{index-DOVf7RJv.d.ts → index-BTkwrK7v.d.ts}

@@ -1,20 +1,27 @@
-import { $n as Delegation, Bt as LocalSnapshotManifest, C as MembershipFixture, D as PolicyDelegation, I as SeparationConflict, In as DenialReason, J as EntitlementSource, Kt as AccessEvent, Lt as InstanceHandle, N as RoleBinding, Nn as Decision, P as RoleOptions, Pn as Denial, Qt as DeliveryEvent, R as SupportAccessOptions, Rt as Instant, T as Policy, V as VocabularyFromInput, Vt as Snapshot, W as CustomRoleSource, Xt as DecisionEvent, Y as JwtClaims, Zn as CustomRole, at as SettingsSource, c as BreakGlassOptions, ct as TenantSettings, et as MembershipSource, g as GrantCondition, h as Grant, i as ApprovalOption, ir as Subject, it as RelationSource, j as PolicyVocabulary, k as PolicyOptions, mr as OpaqueCondition, nr as Membership, nt as RelationGroup, ot as SnapshotSource, rn as SinkEvent, rr as Principal, s as AssuranceRequirement, sn as PolicyScopesInput, ur as ConditionRef, ut as TokenSigner, vr as SqlFunctionArg, yr as SqlFunctionCondition } from "./policy-types-DzwivBgR.js";
-import { C as InferPermissionTree, D as PermissionsOptions, E as PermissionTree, F as ResourceParent, L as ResourceRelationInput, M as ResourceMeta, N as ResourceNode, P as ResourceOptions, R as ResourceRestricted, T as PermissionKind, g as ActionMeta, h as ActionList, k as ResourceInit, r as Role, w as Permission, z as ResourceXTree } from "./vocabulary-D6lPdb4Z.js";
-import { i as PermDockOptions, r as PermDock } from "./permdock-D7eeLJER.js";
-import { a as PolicyDocument } from "./hosted-DBDX0M-P.js";
-import { m as ApprovalStore } from "./types-CCpc2Dcv.js";
-import { t as InstanceOptions } from "./instance-options-Omfd793B.js";
-import { n as PermDockWrap } from "./wrap-Bd1Tejur.js";
+import { Bn as DenialReason, C as MembershipFixture, Cr as SqlFunctionArg, D as PolicyDelegation, Gt as Snapshot, I as SeparationConflict, J as EntitlementSource, Ln as Decision, Lt as InstanceHandle, N as RoleBinding, P as RoleOptions, R as SupportAccessOptions, Rn as Denial, Rt as Instant, T as Policy, Ut as LocalSnapshotManifest, V as VocabularyFromInput, W as CustomRoleSource, Xt as AccessEvent, Y as JwtClaims, at as SettingsSource, c as BreakGlassOptions, ct as TenantSettings, dn as PolicyScopesInput, en as DecisionEvent, et as MembershipSource, fn as Scope, g as GrantCondition, h as Grant, hr as ConditionRef, i as ApprovalOption, it as RelationSource, j as PolicyVocabulary, k as PolicyOptions, lr as Subject, nn as DeliveryEvent, nt as RelationGroup, or as Membership, ot as SnapshotSource, rr as Delegation, s as AssuranceRequirement, sn as SinkEvent, sr as Principal, tr as CustomRole, ut as TokenSigner, wr as SqlFunctionCondition, yr as OpaqueCondition } from "./policy-types-B-F-qAZk.js";
+import { E as ResourceXTree, S as ResourceParent, T as ResourceRestricted, b as ResourceNode, d as PermissionKind, f as PermissionTree, g as ResourceInit, m as PermissionsOptions, n as ActionMeta, p as PermissionsOf, t as ActionList, u as Permission, w as ResourceRelationInput, x as ResourceOptions, y as ResourceMeta } from "./permission-types-DhNEmoRG.js";
+import { a as RoleTree, r as Role } from "./vocabulary-Bg3eeT2H.js";
+import { a as PermDock, o as PermDockOptions } from "./permdock-Dco6dyCK.js";
+import { o as PolicyDocument } from "./hosted-BmjzxQhp.js";
+import { m as ApprovalStore } from "./types-DC44-hqb.js";
+import { t as InstanceOptions } from "./instance-options-CU0YQCLH.js";
+import { n as PermDockWrap } from "./wrap-B6R0cMRL.js";
 import { t as JsonSchemaNode } from "./json-schema-CN_iLFH2.js";
-import { i as CatalogEventData, s as CloudEvent } from "./sink-Bj_lDUDq.js";
+import { i as CatalogEventData, s as CloudEvent } from "./sink-Cp_Eot9W.js";
 import { StandardSchemaV1 } from "@standard-schema/spec";
 //#region src/conditions/refs.d.ts
-type KnownRefField = "id" | "issuer" | "kind" | "tenant" | "team" | "roles" | "plans" | "memberships" | "assurance" | "binding" | "session";
+type KnownRefField = "id" | "issuer" | "kind" | "tenant" | "team" | "roles" | "plans" | "memberships" | "assurance" | "binding" | "session" | "claims";
 type SubjectRef = ConditionRef & { readonly [K in KnownRefField]: SubjectRef; } & {
   readonly [key: string]: SubjectRef;
 };
 declare const principal: SubjectRef;
 declare const context: SubjectRef;
+/**
+ * `principal.claims.<path>` for a dot path such as `team_ids` or
+ * `attrs.region`, typed `SubjectRef` under `noUncheckedIndexedAccess` and
+ * `noPropertyAccessFromIndexSignature`.
+ */
+declare function claim(path: string): SubjectRef;
 //#endregion
 //#region src/core/custom-roles.d.ts
 type CustomRoleDropReason = "unknown-permission" | "outside-ceiling" | "condition-not-allowed" | "unknown-level";
@@ -27,6 +34,9 @@ type CustomRoleDrop = {
 } | {
   readonly role: string;
   readonly reason: "unknown-role";
+} | {
+  readonly role: string;
+  readonly reason: "name-taken";
 };
 /** A stored grant that named a permission by a key it was renamed from. */
 type CustomRoleRename = {
@@ -57,7 +67,29 @@ type CustomRoleValidation = {
  * together with the denies of the roles those grants belong to.
  */
 declare function resolveCustomRole(policy: Policy, role: CustomRole): ResolvedCustomRole;
-declare function validateCustomRole(policy: Policy, role: CustomRole): CustomRoleValidation;
+type ValidateCustomRoleOptions = {
+  /** The shared custom roles: a tenant role with one of their names is dropped as `name-taken`. */
+  readonly shared?: readonly CustomRole[];
+};
+declare function validateCustomRole(policy: Policy, role: CustomRole, options?: ValidateCustomRoleOptions): CustomRoleValidation;
+/** The outcome of one stored allow entry, `<permission>[@<level>]`. */
+type CustomRoleEntry = {
+  readonly ok: true;
+  /** The current key, after a `renamed` key resolves. */
+  readonly permission: string;
+  readonly level?: string;
+} | {
+  readonly ok: false;
+  readonly cause: "unknown-permission" | "outside-ceiling" | "unknown-level";
+};
+/**
+ * Checks one stored allow entry, `<permission>[@<level>]`, the way
+ * `permdock_custom_role_entry_problem` does in SQL. `scope` defaults to the
+ * first scope; its ceiling is the allows of that scope's assignable roles.
+ */
+declare function parseCustomRoleEntry(policy: Policy, entry: string, options?: {
+  readonly scope?: string;
+}): CustomRoleEntry;
 /**
  * The compact JWT form of custom roles for the `memberships[].grants` claim
  * RLS reads in `jwt` mode: role name to entries, where `key` allows, `-key`
@@ -81,6 +113,19 @@ declare function requiresApproval(approval: Grant["approval"] | undefined): bool
 //#endregion
 //#region src/core/policy.d.ts
 declare function definePolicy<TUser, TPrincipal extends Principal, const Input extends PermissionTree | PolicyVocabulary, const S extends PolicyScopesInput = PolicyScopesInput>(permissions: Input, options: PolicyOptions<TUser, TPrincipal, S>): Policy<TUser, TPrincipal, VocabularyFromInput<Input>>;
+/** The role names a policy declares: the keys of its `defineRoles` vocabulary, else `string`. */
+type RoleNameOf<P> = P extends {
+  readonly vocabulary: infer V;
+} ? V extends {
+  readonly roles: infer R extends RoleTree;
+} ? R[keyof R]["key"] : string : string;
+/**
+ * Whether `value` names a role the policy declares, for a role read as a
+ * string from a database or a token. A name it rejects is an unknown role,
+ * which grants nothing (`unknown-role`). A tenant's custom roles are not
+ * declared; `CustomRoleSource` resolves them.
+ */
+declare function isRoleName<P extends Policy<never>>(policy: P, value: unknown): value is RoleNameOf<P>;
 declare function separationConflicts(policy: Policy, memberships: readonly MembershipFixture[]): readonly SeparationConflict[];
 //#endregion
 //#region src/core/permission-registry.d.ts
@@ -284,11 +329,23 @@ type SignSnapshotOptions = {
   /** `aud`; a signer with no default audience refuses to sign without one. */
   readonly audience?: string | readonly string[];
 };
+/** The claims of a `vnd.permdock.snapshot+jwt` apart from `iss`, `aud` and `jti`. */
+type SnapshotClaims = {
+  readonly snapshot: Omit<Snapshot, "issuedAt" | "expiresAt">;
+  /** The principal's id; absent for an anonymous snapshot. */
+  readonly sub?: string;
+  /** `issuedAt` in NumericDate seconds; absent when it is not after the epoch. */
+  readonly iat?: number;
+  /** `expiresAt` in NumericDate seconds; absent when the snapshot has none, and the signer then sets its default. */
+  readonly exp?: number;
+};
 /**
- * Signs `snapshot` as a `vnd.permdock.snapshot+jwt`. `issuedAt` and
- * `expiresAt` become `iat` and `exp` and leave the `snapshot` claim, so the
- * registered claims are the only times a verifier reads.
+ * The claims `signSnapshot` signs for `snapshot`. `issuedAt` and `expiresAt`
+ * become `iat` and `exp` and leave the `snapshot` claim, so the registered
+ * claims are the only times a verifier reads.
  */
+declare function snapshotClaims(snapshot: Snapshot): SnapshotClaims;
+/** Signs `snapshot` as a `vnd.permdock.snapshot+jwt` with the claims `snapshotClaims` answers. */
 declare function signSnapshot(snapshot: Snapshot, signer: TokenSigner, options?: SignSnapshotOptions): Promise<string>;
 /**
  * The snapshot a verified `vnd.permdock.snapshot+jwt` carries, parsed as
@@ -433,6 +490,8 @@ type CustomRoleReader = {
   assignable?(tenant: string): string[] | Promise<string[]>;
   /** Platform custom roles (`scope: 'global'`). */
   globalRoles?(): CustomRole[] | Promise<CustomRole[]>;
+  /** Shared custom roles (`shared: true`), the same for every tenant. */
+  sharedRoles?(): CustomRole[] | Promise<CustomRole[]>;
 };
 type CustomRoleSourceOptions = {
   /** `'all'` (default): read every custom role of each tenant, so `assignableRoles` and `decideRoleChange` see them all. */
@@ -445,8 +504,8 @@ type CustomRoleSourceOptions = {
 /**
  * A `CustomRoleSource` over a reader that returns every custom role of a tenant.
  * It keeps only the roles of the requested tenant. With `read: 'held'` it
- * skips a tenant's read, and `globalRoles`, when the subject holds only
- * declared roles there.
+ * skips a tenant's read, and `globalRoles` and `sharedRoles`, when the
+ * subject holds only declared roles there.
  */
 declare function customRoleSource(reader: CustomRoleReader, options?: CustomRoleSourceOptions): CustomRoleSource;
 //#endregion
@@ -481,7 +540,7 @@ type SnapshotForOptions = {
 declare function snapshotFor<TUser, TPrincipal extends Principal = Principal, V extends PolicyVocabulary = PolicyVocabulary>(policy: Policy<TUser, TPrincipal, V>, user: TUser | Subject | null, options?: SnapshotForOptions): Snapshot;
 //#endregion
 //#region src/core/permissions.d.ts
-declare function definePermissions<const Input, PX = never, RX = never>(input: Input, options?: PermissionsOptions<PX, RX>): InferPermissionTree<Input, "", PX> & ResourceXTree<RX>;
+declare function definePermissions<const Input, PX = never, RX = never>(input: Input, options?: PermissionsOptions<PX, RX>): PermissionsOf<Input, PX, RX>;
 //#endregion
 //#region src/core/permission-leaf.d.ts
 /**
@@ -565,7 +624,15 @@ declare function normalizeAssurance(input: AssuranceRequirement | undefined): As
 //#endregion
 //#region src/core/grant-builders.d.ts
 declare function allow<T, K extends PermissionKind = PermissionKind>(permission: Permission<string, T, K> | readonly Permission<string, T, K>[], condition?: GrantCondition<T, K>): Omit<Grant, "role" | "scope"> | Omit<Grant, "role" | "scope">[];
+/**
+ * Every action of a resource (`permissions.post`), of several, or of the
+ * whole tree, unconditionally. Each grant is listed in the policy as if
+ * written out, and an action added to the resource later is granted too.
+ */
+declare function allow(permissions: PermissionTree | readonly (Permission | PermissionTree)[]): Omit<Grant, "role" | "scope"> | Omit<Grant, "role" | "scope">[];
 declare function deny<T, K extends PermissionKind = PermissionKind>(permission: Permission<string, T, K> | readonly Permission<string, T, K>[], condition?: GrantCondition<T, K>): Omit<Grant, "role" | "scope"> | Omit<Grant, "role" | "scope">[];
+/** Every action of a resource, of several, or of the whole tree, unconditionally. */
+declare function deny(permissions: PermissionTree | readonly (Permission | PermissionTree)[]): Omit<Grant, "role" | "scope"> | Omit<Grant, "role" | "scope">[];
 //#endregion
 //#region src/core/approval-normalize.d.ts
 declare function normalizeApproval(approval: ApprovalOption | undefined, permission?: string): Grant["approval"];
@@ -615,6 +682,22 @@ type ActivateInput = {
  */
 declare function activate(permdock: InstanceHandle, input: ActivateInput): Decision;
 //#endregion
+//#region src/core/scope-helpers.d.ts
+/**
+ * The canonical form PermDock evaluates one membership in, or `undefined`
+ * when it is malformed and grants nothing. `scopes` is the policy's or the
+ * catalog's scope list; absent or empty means the implicit `tenant` and
+ * `team` pair.
+ */
+declare function normalizeMembership(input: unknown, scopes?: readonly Scope[]): Membership | undefined;
+/** Every well-formed membership of `input` in canonical form; malformed entries are dropped. */
+declare function normalizeMemberships(input: unknown, scopes?: readonly Scope[]): readonly Membership[];
+/**
+ * The declared scope `name` stands for: the name itself, or the scope the
+ * `tenant` (first) or `team` (second) alias names. `undefined` otherwise.
+ */
+declare function resolveScope(scopes: readonly Scope[] | undefined, name: unknown): string | undefined;
+//#endregion
 //#region src/core/ownership.d.ts
 /** Who a role change is about: their principal id and their membership in the scope instance. */
 type RoleChangeTarget = {
@@ -667,6 +750,44 @@ type RoleChangeDecision = {
   readonly change: RoleChange;
   readonly denials: readonly Denial[];
 };
+/** The holder-count, membership-kind, exclusivity and `assigns` rules of one role, as the catalog lists them (`CatalogRole`). */
+type RoleRules = {
+  readonly key: string;
+  readonly min?: number;
+  readonly max?: number;
+  readonly transferOnly?: boolean;
+  readonly assigns?: readonly string[];
+  readonly for?: readonly string[];
+  readonly exclusiveWith?: readonly string[];
+};
+type RoleChangeCheckInput = {
+  readonly change: {
+    readonly kind: "assign" | "revoke" | "transfer";
+    readonly target: Pick<RoleChangeTarget, "via" | "roles">;
+  };
+  /** How many principals hold the role in the instance now; without it a role with `min`, `max` or `transferOnly` is denied. */
+  readonly holders?: number;
+  /** Every declared role: adds the `exclusiveWith` other roles declare against this one, and with `actorRoles` the `assigns` rule. */
+  readonly roles?: readonly RoleRules[];
+  /** The roles the actor holds at the instance, highest rank first. With `roles` naming any `assigns`, one of them must assign this role. */
+  readonly actorRoles?: readonly string[];
+};
+/** `by` names the actor role whose `assigns` allowed the change, `null` when the rule did not apply. */
+type RoleChangeCheck = {
+  readonly ok: true;
+  readonly by: string | null;
+} | {
+  readonly ok: false;
+  readonly denials: readonly Denial[];
+};
+/**
+ * The rules of a role change that need no subject: `assigns`, `for`,
+ * `exclusiveWith`, `min`, `max` and `transferOnly`, from holder counts and
+ * the target's roles alone. `decideRoleChange` runs the same function after
+ * its actor, tenant and ceiling checks; a service that holds only the
+ * catalog calls it with the `CatalogRole` entries.
+ */
+declare function checkRoleChange(role: RoleRules, input: RoleChangeCheckInput): RoleChangeCheck;
 type RoleChangeOptions = {
   /**
    * `true` when the application loaded `change.within` from its own store
@@ -879,6 +1000,23 @@ declare function toCsvRow(event: DecisionEvent): string;
  */
 declare function catalogFingerprint(catalog: unknown): string;
 //#endregion
+//#region src/core/canonical-json.d.ts
+/**
+ * RFC 8785 (JCS) output for I-JSON input: keys sorted by UTF-16 code units,
+ * ECMAScript number and string serialisation, no whitespace. `undefined`
+ * members are dropped. Outside I-JSON, Dates become ISO strings, bigints
+ * `"<n>n"`, and a repeated object on the current path `"[Circular]"`, so any
+ * validated row serialises.
+ */
+declare function canonicalJson(value: unknown): string;
+//#endregion
+//#region src/core/sha256.d.ts
+/**
+ * The one digest notation: `sha-256:` plus the unpadded base64url SHA-256
+ * of `text`. An RFC 9651 sf-token, so it fits a structured header as is.
+ */
+declare function sha256Digest(text: string): string;
+//#endregion
 //#region src/core/delegation.d.ts
 type DelegatedPermission = Pick<Permission, "scope" | "resource" | "action">;
 /**
@@ -897,4 +1035,4 @@ declare function coveredByDelegation(permission: DelegatedPermission, delegation
  */
 declare function delegatedPermissions(delegations: readonly PolicyDelegation[] | undefined, subject: Subject, heldRoles: ReadonlySet<string>, now: number): ReadonlySet<string> | undefined;
 //#endregion
-export { ShadowMismatch as $, CustomRoleValidation as $t, decideRoleChange as A, isExternallyManaged as At, crud as B, getResource as Bt, parseCloudEventBatch as C, MemoryRelationSourceData as Ct, RoleChangeDecision as D, claimsFirst as Dt, RoleChange as E, stripeEntitlementSource as Et, normalizeApproval as F, memorySettingsSource as Ft, definePermissions as G, separationConflicts as Gt, writable as H, listPermissions as Ht, allow as I, memorySnapshotSource as It, CustomRoleReader as J, fromSnapshot as Jt, SnapshotForOptions as K, requiresApproval as Kt, deny as L, sqlFunction as Lt, activate as M, memoryCustomRoleSource as Mt, breakGlass as N, memoryEntitlementSource as Nt, RoleChangeOptions as O, composeMemberships as Ot, supportAccess as P, memoryMembershipSource as Pt, LegacyCheck as Q, CustomRoleRename as Qt, normalizeAssurance as R, opaque as Rt, parseCloudEvent as S, MemoryEdge as St, parseSinkEvents as T, StripeEntitlementsClient as Tt, formerKeys as U, mergePermissions as Ut, readable as V, isPermission as Vt, resource as W, definePolicy as Wt, customRoleSource as X, CustomRoleDrop as Xt, CustomRoleSourceOptions as Y, parseSnapshot as Yt, mayAccess as Z, CustomRoleDropReason as Zt, DIRECTORY_EVENT_SCHEMA as _, signPolicyDocument as _t, toCsvRow as a, principal as an, localSnapshotManifest as at, SINK_EVENT_SCHEMAS as b, WhoCan as bt, OcsfUserManagement as c, ArazzoSimulateInput as ct, ACCESS_EVENT_SCHEMA as d, simulateArazzo as dt, ResolvedCustomRole as en, ShadowOptions as et, AUTOMATION_EVENT_SCHEMA as f, deliveryEvent as ft, DELIVERY_EVENT_SCHEMA as g, SignPolicyDocumentOptions as gt, DECISION_EVENT_SCHEMA as h, snapshotFromClaims as ht, CSV_COLUMNS as i, context as in, AppProfile as it, ActivateInput as j, APPROVAL_POLICY_UNAVAILABLE as jt, RoleChangeTarget as k, countHolders as kt, accessToOcsf as l, ArazzoStepResult as lt, CREDENTIAL_EVENT_SCHEMA as m, signSnapshot as mt, delegatedPermissions as n, resolveCustomRole as nn, defineApp as nt, OCSF_VERSION as o, ArazzoFinding as ot, CATALOG_EVENT_SCHEMA as p, SignSnapshotOptions as pt, snapshotFor as q, emptySnapshot as qt, catalogFingerprint as r, validateCustomRole as rn, AppOptions as rt, OcsfAuthorizeSession as s, ArazzoPlan as st, coveredByDelegation as t, customRoleClaim as tn, shadowMode as tt, toOcsf as u, arazzoFindings as ut, EVENT_SCHEMA_IDS as v, Holder as vt, parseSinkEvent as w, memoryRelationSource as wt, parseCatalogEventData as x, whoCan as xt, MEMBERSHIP_EVENT_SCHEMA as y, HoldingVia as yt, role as z, findPermission as zt };
+export { resource as $, listPermissions as $t, RoleChangeCheckInput as A, HoldingVia as At, ActivateInput as B, countHolders as Bt, parseCatalogEventData as C, SnapshotClaims as Ct, parseSinkEvents as D, SignPolicyDocumentOptions as Dt, parseSinkEvent as E, snapshotFromClaims as Et, checkRoleChange as F, memoryRelationSource as Ft, allow as G, memoryMembershipSource as Gt, breakGlass as H, APPROVAL_POLICY_UNAVAILABLE as Ht, decideRoleChange as I, StripeEntitlementsClient as It, role as J, sqlFunction as Jt, deny as K, memorySettingsSource as Kt, normalizeMembership as L, stripeEntitlementSource as Lt, RoleChangeOptions as M, whoCan as Mt, RoleChangeTarget as N, MemoryEdge as Nt, RoleChange as O, signPolicyDocument as Ot, RoleRules as P, MemoryRelationSourceData as Pt, formerKeys as Q, isPermission as Qt, normalizeMemberships as R, claimsFirst as Rt, SINK_EVENT_SCHEMAS as S, principal as Sn, SignSnapshotOptions as St, parseCloudEventBatch as T, snapshotClaims as Tt, supportAccess as U, memoryCustomRoleSource as Ut, activate as V, isExternallyManaged as Vt, normalizeApproval as W, memoryEntitlementSource as Wt, readable as X, findPermission as Xt, crud as Y, opaque as Yt, writable as Z, getResource as Zt, DECISION_EVENT_SCHEMA as _, parseCustomRoleEntry as _n, ArazzoSimulateInput as _t, catalogFingerprint as a, requiresApproval as an, customRoleSource as at, EVENT_SCHEMA_IDS as b, claim as bn, simulateArazzo as bt, OCSF_VERSION as c, parseSnapshot as cn, ShadowMismatch as ct, accessToOcsf as d, CustomRoleEntry as dn, defineApp as dt, mergePermissions as en, definePermissions as et, toOcsf as f, CustomRoleRename as fn, AppOptions as ft, CREDENTIAL_EVENT_SCHEMA as g, customRoleClaim as gn, ArazzoPlan as gt, CATALOG_EVENT_SCHEMA as h, ValidateCustomRoleOptions as hn, ArazzoFinding as ht, canonicalJson as i, separationConflicts as in, CustomRoleSourceOptions as it, RoleChangeDecision as j, WhoCan as jt, RoleChangeCheck as k, Holder as kt, OcsfAuthorizeSession as l, CustomRoleDrop as ln, ShadowOptions as lt, AUTOMATION_EVENT_SCHEMA as m, ResolvedCustomRole as mn, localSnapshotManifest as mt, delegatedPermissions as n, definePolicy as nn, snapshotFor as nt, CSV_COLUMNS as o, emptySnapshot as on, mayAccess as ot, ACCESS_EVENT_SCHEMA as p, CustomRoleValidation as pn, AppProfile as pt, normalizeAssurance as q, memorySnapshotSource as qt, sha256Digest as r, isRoleName as rn, CustomRoleReader as rt, toCsvRow as s, fromSnapshot as sn, LegacyCheck as st, coveredByDelegation as t, RoleNameOf as tn, SnapshotForOptions as tt, OcsfUserManagement as u, CustomRoleDropReason as un, shadowMode as ut, DELIVERY_EVENT_SCHEMA as v, resolveCustomRole as vn, ArazzoStepResult as vt, parseCloudEvent as w, signSnapshot as wt, MEMBERSHIP_EVENT_SCHEMA as x, context as xn, deliveryEvent as xt, DIRECTORY_EVENT_SCHEMA as y, validateCustomRole as yn, arazzoFindings as yt, resolveScope as z, composeMemberships as zt };

package/dist/index-CMiPH2Tv.d.ts

@@ -0,0 +1,206 @@
+import { T as Policy, sr as Principal, ut as TokenSigner } from "./policy-types-B-F-qAZk.js";
+import { E as SsfPermDockOptions, O as SsfStreamConfiguration, T as SsfPermDock, _ as SetSubject, c as PushSetOptions, d as SetDelivery, g as SetQueue, h as SetPollHandlerOptions, k as SsfStreamStatus, m as SetEvent, p as SetError, t as CaepCommon, v as SignSetOptions } from "./types-cTos-H7p.js";
+//#region src/ssf/create.d.ts
+declare function createPermDock<TUser, TPrincipal extends Principal = Principal>(policy: Policy<TUser, TPrincipal>, options: SsfPermDockOptions): SsfPermDock;
+//#endregion
+//#region src/ssf/poll-client.d.ts
+type PollSetsOptions = {
+  /** The transmitter's RFC 8936 poll endpoint, the stream's `delivery.endpoint_url`. */
+  readonly endpoint: string;
+  /** The `Authorization` header value. */
+  readonly authorization?: string;
+  /** `jti` values of SETs the receiver accepted. */
+  readonly acks?: readonly string[];
+  /** SETs the receiver refused, by `jti`. */
+  readonly setErrs?: Readonly<Record<string, SetError>>;
+  /** At most this many SETs in the response; default 100. `0` only acknowledges. */
+  readonly maxEvents?: number;
+  /** Default `true`: answer at once rather than wait for a SET. */
+  readonly returnImmediately?: boolean;
+  readonly fetch?: typeof fetch;
+  readonly signal?: AbortSignal;
+};
+/** One SET from a poll response: its `jti` and the compact JWS, not yet verified. */
+type PolledSet = {
+  readonly jti: string;
+  readonly set: string;
+};
+type PollSetsResult = {
+  readonly ok: true;
+  readonly sets: readonly PolledSet[];
+  readonly moreAvailable: boolean;
+} | Extract<SetDelivery, {
+  readonly ok: false;
+}>;
+/**
+ * One RFC 8936 poll request: sends `acks` and `setErrs` and answers the SETs
+ * the transmitter returns, unverified. A failure maps as `pushSet`'s does; a
+ * `2xx` body without a `sets` object is `invalid-request`. Never throws.
+ */
+declare function pollSets(options: PollSetsOptions): Promise<PollSetsResult>;
+//#endregion
+//#region src/ssf/set-queue.d.ts
+/**
+ * An in-process `SetQueue`: pending SETs per stream in insertion order. A
+ * process restart loses them; a deployment with more than one instance needs
+ * a shared queue.
+ */
+declare function memorySetQueue(): SetQueue;
+/**
+ * The RFC 8936 poll endpoint over a `SetQueue`. It applies the request's
+ * `acks` and `setErrs`, then answers `{ sets, moreAvailable }` with up to
+ * `maxEvents` pending SETs. It answers at once whatever `returnImmediately`
+ * says, which RFC 8936 section 2.4 allows.
+ */
+declare function setPollHandler(options: SetPollHandlerOptions): (request: Request) => Promise<Response>;
+//#endregion
+//#region src/ssf/streams.d.ts
+/** One stream a transmitter holds and the receiver that created it. */
+type SsfStream = {
+  /** The receiver `ssfTransmitter`'s `authorize` answered when the stream was created. */
+  readonly owner: string;
+  readonly configuration: SsfStreamConfiguration;
+};
+/**
+ * The streams an SSF 1.0 transmitter serves (section 8.1). A new stream is
+ * `enabled`; `status` answers `null` for a stream that does not exist.
+ */
+type SsfStreamStore = {
+  /** Names the implementation in errors and events. */
+  readonly name?: string;
+  create(owner: string, configuration: SsfStreamConfiguration): void | Promise<void>;
+  get(streamId: string): SsfStream | null | Promise<SsfStream | null>;
+  /** Every stream of `owner`, or every stream when `owner` is absent, oldest first. */
+  list(owner?: string): readonly SsfStream[] | Promise<readonly SsfStream[]>;
+  /** Replaces the configuration of the stream `configuration.stream_id`; the owner and status stay. */
+  update(configuration: SsfStreamConfiguration): void | Promise<void>;
+  delete(streamId: string): void | Promise<void>;
+  status(streamId: string): SsfStreamStatus | null | Promise<SsfStreamStatus | null>;
+  setStatus(status: SsfStreamStatus): void | Promise<void>;
+};
+/**
+ * An in-process `SsfStreamStore`. A process restart loses every stream; a
+ * deployment with more than one instance needs a shared store.
+ */
+declare function memorySsfStreamStore(): SsfStreamStore;
+//#endregion
+//#region src/ssf/transmitter-handler.d.ts
+type SsfTransmitterOptions = {
+  /** `iss` of every stream and of the metadata; the `iss` the signer writes. */
+  readonly issuer: string;
+  /** The URL the handler is mounted at; endpoints are `<endpoint>/stream`, `/status`, `/verify` and `/poll`. Default `issuer`. */
+  readonly endpoint?: string;
+  readonly streams: SsfStreamStore;
+  readonly queue: SetQueue;
+  readonly signer: TokenSigner;
+  /** The receiver the request's credentials authenticate, or `null` to refuse it with `401`. */
+  readonly authorize: (request: Request) => string | null | Promise<string | null>;
+  /** `aud` of a receiver's streams; default the receiver itself. */
+  readonly audience?: (receiver: string) => string | readonly string[];
+  readonly jwksUri?: string;
+  /** Default every CAEP and RISC event PermDock's receiver handles. */
+  readonly eventsSupported?: readonly string[];
+  /** The largest `maxEvents` a poll is answered with; default 100. */
+  readonly maxEvents?: number;
+  readonly fetch?: typeof fetch;
+};
+type FanOutSetOptions = {
+  readonly streams: SsfStreamStore;
+  readonly queue: SetQueue;
+  readonly signer: TokenSigner;
+  readonly fetch?: typeof fetch;
+};
+/** How one stream took a SET. `queued` is `true` for a poll stream and for a paused push stream. */
+type SsfFanOut = {
+  readonly stream: string;
+  readonly jti: string;
+  readonly queued: boolean;
+  readonly delivery: SetDelivery;
+};
+/**
+ * Signs `event` once per distinct stream audience and delivers it to every
+ * stream that is not disabled and has the event in `events_delivered`: a
+ * push stream through `pushSet`, a poll stream or a paused stream into the
+ * queue. Answers one row per stream that took the event.
+ */
+declare function fanOutSet(event: SetEvent, options: FanOutSetOptions): Promise<readonly SsfFanOut[]>;
+/**
+ * An SSF 1.0 transmitter as one Fetch handler, routed by path suffix:
+ * `/.well-known/ssf-configuration` (section 7.1), `/stream` (8.1.1),
+ * `/status` (8.1.2), `/verify` (8.1.4) and `/poll` (RFC 8936). Each receiver
+ * sees only the streams it created. Disabling or deleting a stream drops its
+ * pending SETs; a paused stream holds them until it is enabled again.
+ */
+declare function ssfTransmitter(options: SsfTransmitterOptions): (request: Request) => Promise<Response>;
+//#endregion
+//#region src/ssf/transmitter.d.ts
+/** SSF 1.0 delivery method URN for RFC 8935 push. */
+declare const SSF_PUSH_DELIVERY = "urn:ietf:rfc:8935";
+/** SSF 1.0 delivery method URN for RFC 8936 poll. */
+declare const SSF_POLL_DELIVERY = "urn:ietf:rfc:8936";
+/**
+ * Signs one event as an RFC 8417 Security Event Token (`typ: secevent+jwt`):
+ * `sub_id` is the event's subject and `events` holds exactly one entry, as
+ * SSF 1.0 requires. `iss` is the signer's own.
+ */
+declare function signSet(event: SetEvent, signer: TokenSigner, options: SignSetOptions): Promise<string>;
+/**
+ * Pushes one SET to a receiver (RFC 8935). A `2xx` is delivery; a `400`
+ * maps the receiver's `err` to a cause; `401` and `403` are
+ * `authentication-failed` and `access-denied`; a network failure, a timeout,
+ * a `429` or a `5xx` is `unavailable` with `retry: true`. Never throws.
+ */
+declare function pushSet(set: string, options: PushSetOptions): Promise<SetDelivery>;
+type CaepCredentialChange = CaepCommon & {
+  readonly credentialType: string;
+  readonly changeType: "create" | "revoke" | "update" | "delete";
+  readonly friendlyName?: string;
+  readonly x509Issuer?: string;
+  readonly x509Serial?: string;
+  readonly fido2Aaguid?: string;
+};
+type CaepTokenClaimsChange = CaepCommon & {
+  readonly claims: Readonly<Record<string, unknown>>;
+};
+type CaepAssuranceLevelChange = CaepCommon & {
+  readonly namespace: string;
+  readonly currentLevel: string;
+  readonly previousLevel?: string;
+  readonly changeDirection?: "increase" | "decrease";
+};
+type CaepDeviceComplianceChange = CaepCommon & {
+  readonly previousStatus: "compliant" | "not-compliant";
+  readonly currentStatus: "compliant" | "not-compliant";
+};
+type CaepEvents = {
+  readonly sessionRevoked: (input: CaepCommon) => SetEvent;
+  readonly credentialChange: (input: CaepCredentialChange) => SetEvent;
+  readonly tokenClaimsChange: (input: CaepTokenClaimsChange) => SetEvent;
+  readonly assuranceLevelChange: (input: CaepAssuranceLevelChange) => SetEvent;
+  readonly deviceComplianceChange: (input: CaepDeviceComplianceChange) => SetEvent;
+};
+/** CAEP 1.0 event builders; each returns a `SetEvent` for `signSet`. */
+declare const caepEvents: CaepEvents;
+type RiscAccountDisabled = {
+  readonly subject: SetSubject;
+  readonly reason?: "hijacking" | "bulk-account";
+};
+type RiscCredentialCompromise = CaepCommon & {
+  readonly credentialType: string;
+};
+type RiscEvents = {
+  readonly accountDisabled: (input: RiscAccountDisabled) => SetEvent;
+  readonly accountPurged: (input: {
+    readonly subject: SetSubject;
+  }) => SetEvent;
+  readonly credentialCompromise: (input: RiscCredentialCompromise) => SetEvent;
+};
+/** RISC 1.0 event builders for the events PermDock's receiver treats as revoking every session. */
+declare const riscEvents: RiscEvents;
+/**
+ * The SSF 1.0 section 8.1.4 verification event for `stream`, echoing the
+ * receiver's `state`. Its subject is the stream, never a principal.
+ */
+declare function streamVerificationEvent(stream: string, state?: string): SetEvent;
+//#endregion
+export { createPermDock as A, memorySsfStreamStore as C, PollSetsResult as D, PollSetsOptions as E, PolledSet as O, SsfStreamStore as S, setPollHandler as T, SsfFanOut as _, CaepTokenClaimsChange as a, ssfTransmitter as b, RiscEvents as c, caepEvents as d, pushSet as f, FanOutSetOptions as g, streamVerificationEvent as h, CaepEvents as i, pollSets as k, SSF_POLL_DELIVERY as l, signSet as m, CaepCredentialChange as n, RiscAccountDisabled as o, riscEvents as p, CaepDeviceComplianceChange as r, RiscCredentialCompromise as s, CaepAssuranceLevelChange as t, SSF_PUSH_DELIVERY as u, SsfTransmitterOptions as v, memorySetQueue as w, SsfStream as x, fanOutSet as y };

package/dist/{index-SGdIQyzc.d.ts → index-DH9DUDEM.d.ts}

@@ -1,7 +1,8 @@
-import { dt as TokenVerifier, et as MembershipSource, q as DecisionSink } from "./policy-types-DzwivBgR.js";
-import { V as AppData } from "./vocabulary-D6lPdb4Z.js";
+import { dt as TokenVerifier, et as MembershipSource, q as DecisionSink } from "./policy-types-B-F-qAZk.js";
+import { O as AppData } from "./permission-types-DhNEmoRG.js";
 import { n as RevocationFeed } from "./revocations-R07lFBnX.js";
 import { t as ClaimsMap } from "./claims-map-Ca-QX8C6.js";
+import { t as SqlQuery } from "./sql-CDEPCA0g.js";
 //#region src/scim/types.d.ts
 declare const SCIM_CONTENT_TYPE = "application/scim+json";
 declare const USER_SCHEMA = "urn:ietf:params:scim:schemas:core:2.0:User";
@@ -192,4 +193,18 @@ declare function directoryMembershipSource(store: DirectoryStore, options?: Dire
 //#region src/scim/store.d.ts
 declare function memoryDirectoryStore(): DirectoryStore;
 //#endregion
-export { ScimPage as A, GROUP_SCHEMA as C, SCIM_CONTENT_TYPE as D, ROLES_EXTENSION as E, isDirectoryNotFoundError as F, isDirectoryUniquenessError as I, ScimPatchOp as M, ScimTokenOptions as N, ScimFilter as O, USER_SCHEMA as P, ERROR_SCHEMA as S, PATCH_SCHEMA as T, DirectoryMembershipSourceOptions as _, scimHandler as a, DirectoryUniquenessError as b, parseScimFilter as c, serviceProviderConfig as d, authenticateScim as f, DirectoryGroup as g, DirectoryChange as h, tenantFromPath as i, ScimPageResult as j, ScimHandlerOptions as k, resourceTypes as l, APP_DATA_EXTENSION as m, directoryMembershipSource as n, filterSupported as o, sha256Hex as p, normalizePatchOps as r, matchFilter as s, memoryDirectoryStore as t, schemas as u, DirectoryNotFoundError as v, LIST_SCHEMA as w, DirectoryUser as x, DirectoryStore as y };
+//#region src/scim/postgres-store.d.ts
+type PostgresDirectoryStoreOptions = {
+  /** Schema of the generated tables (`permdock scim generate --schema`). Default `permdock`. */
+  readonly schema?: string;
+};
+/**
+ * A `DirectoryStore` over the tables `permdock scim generate` writes, called
+ * through a `SqlQuery` that may read and write them (the table owner, or a
+ * role granted on them). Every method is one statement, so a pool needs no
+ * transaction: a group and its members change together, and a PATCH that
+ * races another write re-reads the row and applies its operations again.
+ */
+declare function postgresDirectoryStore(query: SqlQuery, options?: PostgresDirectoryStoreOptions): DirectoryStore;
+//#endregion
+export { ScimFilter as A, DirectoryUser as C, PATCH_SCHEMA as D, LIST_SCHEMA as E, ScimTokenOptions as F, USER_SCHEMA as I, isDirectoryNotFoundError as L, ScimPage as M, ScimPageResult as N, ROLES_EXTENSION as O, ScimPatchOp as P, isDirectoryUniquenessError as R, DirectoryUniquenessError as S, GROUP_SCHEMA as T, DirectoryChange as _, normalizePatchOps as a, DirectoryNotFoundError as b, filterSupported as c, resourceTypes as d, schemas as f, APP_DATA_EXTENSION as g, sha256Hex as h, directoryMembershipSource as i, ScimHandlerOptions as j, SCIM_CONTENT_TYPE as k, matchFilter as l, authenticateScim as m, postgresDirectoryStore as n, tenantFromPath as o, serviceProviderConfig as p, memoryDirectoryStore as r, scimHandler as s, PostgresDirectoryStoreOptions as t, parseScimFilter as u, DirectoryGroup as v, ERROR_SCHEMA as w, DirectoryStore as x, DirectoryMembershipSourceOptions as y };