permdock 0.6.0 → 0.8.0

package/dist/{time-DkWjdL98.js → time-nR1JesoH.js}

@@ -9,19 +9,31 @@ function isRfc3339(value) {
 function rfc3339(seconds) {
 	return (/* @__PURE__ */ new Date(seconds * 1e3)).toISOString();
 }
-/** Milliseconds since the epoch as RFC 3339 in UTC, milliseconds kept; throws a `RangeError` for a value outside the `Date` range. */
+/**
+* Milliseconds since the epoch as RFC 3339 in UTC, milliseconds kept; throws a
+* `RangeError` for a value outside the `Date` range.
+*/
 function isoAt(millis) {
 	return new Date(millis).toISOString();
 }
-/** RFC 3339 in UTC of `now`, or of the clock when absent; throws a `RangeError` for a `now` that is not an `Instant`. */
+/**
+* RFC 3339 in UTC of `now`, or of the clock when absent; throws a `RangeError`
+* for a `now` that is not an `Instant`.
+*/
 function isoNow(now) {
 	return dateAt(now).toISOString();
 }
-/** Whole seconds since the epoch of an RFC 3339 instant; `undefined` for anything else. */
+/**
+* Whole seconds since the epoch of an RFC 3339 instant; `undefined` for
+* anything else.
+*/
 function secondsOf(value) {
 	return isRfc3339(value) ? Math.floor(Date.parse(value) / 1e3) : void 0;
 }
-/** Whole seconds since the epoch of an RFC 3339 string or an `Instant`; `undefined` for anything else, Unix seconds included. */
+/**
+* Whole seconds since the epoch of an RFC 3339 string or an `Instant`;
+* `undefined` for anything else, Unix seconds included.
+*/
 function instantOf(value) {
 	if (typeof value === "string") return secondsOf(value);
 	if (typeof value === "object" && value !== null && "epochMilliseconds" in value && typeof value.epochMilliseconds === "number" && Number.isFinite(value.epochMilliseconds)) return Math.floor(value.epochMilliseconds / 1e3);
@@ -30,7 +42,10 @@ function instantOf(value) {
 function durationOf(value) {
 	return typeof value === "number" && Number.isSafeInteger(value) && value > 0 ? value : void 0;
 }
-/** Throws at definition time unless `value` is a whole number of seconds above zero. */
+/**
+* Throws at definition time unless `value` is a whole number of seconds above
+* zero.
+*/
 function assertDuration(value, label) {
 	if (durationOf(value) === void 0) throw new Error(`PermDock: ${label} must be a whole number of seconds above 0, got ${JSON.stringify(value) ?? String(value)}`);
 }
@@ -43,13 +58,19 @@ const INVALID_NOW = Object.freeze({
 	field: "now",
 	message: "now must be an Instant ({ epochMilliseconds }), such as a Temporal.Instant"
 });
-/** The `Date` of `now`, or of the clock when absent; throws a `RangeError` for a `now` that is not an `Instant`. */
+/**
+* The `Date` of `now`, or of the clock when absent; throws a `RangeError` for a
+* `now` that is not an `Instant`.
+*/
 function dateAt(now) {
 	const millis = nowMillis(now);
 	if (!Number.isFinite(millis)) throw new RangeError(`PermDock: ${INVALID_NOW.message}`);
 	return new Date(millis);
 }
-/** Whole seconds since the epoch of `now`, or of the clock when absent; throws a `RangeError` for a `now` that is not an `Instant`. */
+/**
+* Whole seconds since the epoch of `now`, or of the clock when absent; throws a
+* `RangeError` for a `now` that is not an `Instant`.
+*/
 function secondsAt(now) {
 	return Math.floor(dateAt(now).getTime() / 1e3);
 }
@@ -61,7 +82,10 @@ function instantAt(seconds) {
 function epochSeconds(now) {
 	return nowMillis(now) / 1e3;
 }
-/** Milliseconds since the epoch of `now`, or of the clock when absent; `NaN` for a `now` that is not an `Instant`. */
+/**
+* Milliseconds since the epoch of `now`, or of the clock when absent; `NaN` for
+* a `now` that is not an `Instant`.
+*/
 function nowMillis(now) {
 	if (now === void 0) return Date.now();
 	const millis = typeof now === "object" && now !== null ? now.epochMilliseconds : void 0;

package/dist/{token-BLZcjQgt.js → token-DC9EQiet.js}

@@ -1,9 +1,9 @@
-import { t as canonicalJson } from "./canonical-json-BC8_nMTw.js";
-import { r as sha256Digest } from "./sha256-D9ihqmvd.js";
+import { t as canonicalJson } from "./canonical-json-DwilZ1iB.js";
+import { r as sha256Digest } from "./sha256-C-4WXKIu.js";
 //#region src/core/token.ts
 /**
-* Only stable identity goes into the token, so refreshing a session (new
-* roles, assurance or claims) does not orphan an outstanding approval.
+* Only stable identity goes into the token, so refreshing a session (new roles,
+* assurance or claims) does not orphan an outstanding approval.
 */
 function principalIdentity(principal) {
 	if (principal === null) return null;
@@ -13,7 +13,10 @@ function principalIdentity(principal) {
 		issuer: principal.issuer ?? null
 	};
 }
-/** A row's `version` field as token input; `null` when it is missing or not a scalar. */
+/**
+* A row's `version` field as token input; `null` when it is missing or not a
+* scalar.
+*/
 function versionOf(row, field) {
 	if (row === null || typeof row !== "object" || !Object.hasOwn(row, field)) return null;
 	const value = row[field];
@@ -25,20 +28,19 @@ function payloadDigest(data) {
 	return sha256Digest(canonicalJson(data));
 }
 /**
-* The payload a decision token binds: the call's `args` when the caller
-* passes them (an agent or MCP tool call, row or not), otherwise the data of
-* a call without a row id. `undefined` binds nothing beyond the row id.
+* The payload a decision token binds: the call's `args` when the caller passes
+* them (an agent or MCP tool call, row or not), otherwise the data of a call
+* without a row id. `undefined` binds nothing beyond the row id.
 */
 function tokenPayload(resourceId, data, args) {
 	if (args !== void 0) return payloadDigest(args);
 	return resourceId === "*" && data !== void 0 ? payloadDigest(data) : void 0;
 }
 /**
-* `version` is set only for an approval that goes stale on a resource
-* change; without it the payload, and so every other token, is unchanged.
-* `payload` is set when `resourceId` is `*` (a collection action or a row
-* without an id), so an approval covers the arguments it was given and no
-* others.
+* `version` is set only for an approval that goes stale on a resource change;
+* without it the payload, and so every other token, is unchanged. `payload` is
+* set when `resourceId` is `*` (a collection action or a row without an id), so
+* an approval covers the arguments it was given and no others.
 */
 function decisionToken(input) {
 	const payload = canonicalJson({

package/dist/{tool-refusal-CMLN5xhn.js → tool-refusal-Qpjs_W6M.js}

@@ -1,5 +1,5 @@
 import { t as wireDenials } from "./wire-denial-C7PaVYEM.js";
-import { t as describe } from "./describe-BybMRY7A.js";
+import { n as describe } from "./describe-Bb4hGK5d.js";
 //#region src/core/tool-refusal.ts
 function deniedToolRefusal(decision, permission, resource) {
 	const alternatives = decision.alternatives.map((leaf) => leaf.key);
@@ -26,7 +26,10 @@ function approvalToolRefusal(decision, permission, resource) {
 		}
 	};
 }
-/** An MCP `CallToolResult` with `isError` set, as MCP and WebMCP clients read it. */
+/**
+* An MCP `CallToolResult` with `isError` set, as MCP and WebMCP clients read
+* it.
+*/
 function toolErrorResult(refusal) {
 	return {
 		isError: true,

package/dist/trpc/index.d.ts

@@ -1,10 +1,10 @@
-import { T as Policy, rr as Principal } from "../policy-types-n0uRTsW8.js";
-import { w as Permission } from "../vocabulary-CN8H_9UF.js";
-import { r as PermDock } from "../permdock-SV8ZINYT.js";
-import { n as RevocationFeed } from "../revocations-R07lFBnX.js";
-import { D as ConnectionOptions, T as Connection, i as OpenApiHooks } from "../server-types-CKQiCnON.js";
-import { t as ServerAdapterOptions } from "../bind-DOyrv6zi.js";
-import { t as StreamProtectOptions } from "../stream-CeCMJmBB.js";
+import { T as Policy, sr as Principal } from "../policy-types-CCiDRZBH.js";
+import { u as Permission } from "../permission-types-CAY-GU7e.js";
+import { a as PermDock } from "../permdock-B6Sf4T_S.js";
+import { n as RevocationFeed } from "../revocations-BaUXHM1N.js";
+import { D as ConnectionOptions, T as Connection, i as OpenApiHooks } from "../server-types-CIlpSA2G.js";
+import { t as ServerAdapterOptions } from "../bind-Cp2hBHzP.js";
+import { t as StreamProtectOptions } from "../stream-ltuLdtTG.js";
 import { AnyTRPCMiddlewareFunction } from "@trpc/server";
 //#region src/trpc/create.d.ts
 type TrpcMiddlewareOpts<TCtx = object, TInput = unknown> = {
@@ -34,7 +34,10 @@ type TrpcOpenApiHooks = {
   readonly securitySchemes: OpenApiHooks["securitySchemes"];
 };
 type TrpcPermDock<TCtx = object> = {
-  /** The `PermDock` for one procedure call, for code the middleware does not run before. */
+  /**
+   * The `PermDock` for one procedure call, for code the middleware does not run
+   * before.
+   */
   readonly getPermDock: (opts: TrpcMiddlewareOpts<TCtx>) => Promise<PermDock>;
   readonly middleware: () => TrpcMiddleware;
   readonly protect: (permission: Permission | null, data?: (opts: TrpcMiddlewareOpts<TCtx>) => unknown, protectOptions?: StreamProtectOptions) => TrpcMiddleware;

package/dist/trpc/index.js

@@ -1,12 +1,15 @@
-import { o as problemMessage } from "../http-BBoKefeS.js";
-import { t as problemFromError } from "../map-error-Dr70oA_3.js";
-import { n as attached } from "../bind-CAvgUuKs.js";
-import { i as isAsyncIterable, o as reloadAfter } from "../stream-CvdUS9V1.js";
-import { i as rpcCode, n as guardStream, r as problemBody, t as bindRpcKernel } from "../rpc-VSl5ylaQ.js";
+import { o as problemMessage } from "../http-DKLXrFGk.js";
+import { t as problemFromError } from "../map-error-pasIGqMT.js";
+import { n as attached } from "../bind-D_sZSVA3.js";
+import { i as isAsyncIterable, o as reloadAfter } from "../stream-CDvF0sJm.js";
+import { i as rpcCode, n as guardStream, r as problemBody, t as bindRpcKernel } from "../rpc-fNqAIqQk.js";
 import { TRPCError, isTrackedEnvelope } from "@trpc/server";
 //#region src/trpc/create.ts
 const PROBLEM = Symbol.for("permdock.problem");
-/** A `TRPCError` for a revoked subscription; the Problem Details body rides on `cause`. */
+/**
+* A `TRPCError` for a revoked subscription; the Problem Details body rides on
+* `cause`.
+*/
 function trpcErrorFrom(error) {
 	const problem = error.toProblemDetails();
 	const cause = { ...problem };
@@ -34,8 +37,8 @@ async function throwTrpcError(response) {
 	});
 }
 /**
-* A PermDock error thrown further down (an `assert` in a resolver) arrives as
-* a failed middleware result; it becomes the same TRPCError `protect` throws.
+* A PermDock error thrown further down (an `assert` in a resolver) arrives as a
+* failed middleware result; it becomes the same TRPCError `protect` throws.
 */
 function mapDownstream(result) {
 	if (result === null || typeof result !== "object" || result.ok !== false) return Promise.resolve(result);
@@ -70,7 +73,10 @@ function createPermDock(policy, options) {
 		attach(nextCtx, request);
 		return mapDownstream(await opts.next({ ctx: nextCtx }));
 	});
-	/** Wraps a subscription's iterable so revocation ends it and unreadable items drop. */
+	/**
+	* Wraps a subscription's iterable so revocation ends it and unreadable items
+	* drop.
+	*/
 	const guardSubscription = async (result, opts, permission, data, protectOptions) => {
 		if (result === null || typeof result !== "object" || result.ok !== true || !isAsyncIterable(result.data)) return result;
 		return {

package/dist/type-helpers-BIPIDa6a.d.ts

@@ -0,0 +1,50 @@
+import { j as PolicyVocabulary, mn as ScopeNames } from "./policy-types-CCiDRZBH.js";
+import { k as POLICY_SCOPES, u as Permission } from "./permission-types-CAY-GU7e.js";
+import { n as PlanTree } from "./vocabulary-DEJ5j4mR.js";
+import { o as OperationMap } from "./operations-Ci_rT6Uo.js";
+//#region src/core/type-helpers.d.ts
+/** Recursion guard: a tree nests resources at most this many levels deep. */
+type Depth = [never, 0, 1, 2, 3, 4, 5, 6, 7];
+/** The literal string keys of `T`, without an index signature. */
+type KnownKeys<T> = keyof { readonly [K in keyof T as string extends K ? never : K extends string ? K : never]: 0; };
+type LeavesOf<T, D extends number> = [D] extends [never] ? never : T extends Permission ? T : { readonly [K in KnownKeys<T>]-?: LeavesOf<T[K], Depth[D]>; }[KnownKeys<T>];
+/** The union of the permission leaves of a `definePermissions` tree. */
+type PermissionOf<T> = [KnownKeys<T>] extends [never] ? Permission : LeavesOf<T, 8>;
+type TreeOf<P> = P extends {
+  readonly vocabulary: {
+    readonly permissions: infer T;
+  };
+} ? T : P;
+/** The resource names of a policy or a permission tree, else `string`. */
+type ResourceNameOf<P> = PermissionOf<TreeOf<P>>["resource"];
+/** The action names of a policy or a permission tree, else `string`. */
+type ActionNameOf<P> = PermissionOf<TreeOf<P>>["action"];
+/** The permission keys of a policy or a permission tree, else `string`. */
+type PermissionKeyOf<P> = PermissionOf<TreeOf<P>>["key"];
+/**
+ * The scope names a policy's `definePolicy({ scopes })` declares, plus the
+ * `tenant` / `team` aliases; `string` for a policy that declares none.
+ */
+type ScopeNameOf<P> = P extends {
+  readonly [POLICY_SCOPES]?: infer S;
+} ? ScopeNames<Exclude<S, undefined>> : string;
+/**
+ * The plan names a policy declares: the keys of its `definePlans` vocabulary,
+ * else `string`.
+ */
+type PlanNameOf<P> = P extends {
+  readonly vocabulary: infer V;
+} ? V extends {
+  readonly plans: infer T extends PlanTree;
+} ? T[keyof T]["key"] : string : string;
+/** The operation names of a `defineOperations` map, else `string`. */
+type OperationNameOf<O> = O extends OperationMap<infer D> ? keyof D & string : string;
+/**
+ * The vocabulary a policy was defined with, for an instance type such as
+ * `usePermDock<VocabularyOf<typeof policy>>()`; `PolicyVocabulary` otherwise.
+ */
+type VocabularyOf<P> = P extends {
+  readonly vocabulary: infer V extends PolicyVocabulary;
+} ? V : PolicyVocabulary;
+//#endregion
+export { PlanNameOf as a, VocabularyOf as c, PermissionOf as i, OperationNameOf as n, ResourceNameOf as o, PermissionKeyOf as r, ScopeNameOf as s, ActionNameOf as t };

package/dist/{types-8RnwUAvE.d.ts → types-AMJ5qoU_.d.ts}

@@ -1,15 +1,18 @@
-import { ar as Subject, dt as TokenVerifier, ot as SnapshotSource, q as DecisionSink, ut as TokenSigner } from "./policy-types-n0uRTsW8.js";
-import { o as PolicySource } from "./hosted-BPk51-kX.js";
-import { m as ApprovalStore, u as ApprovalRequest } from "./types-BdtSDbBO.js";
-import { a as CatalogDocument } from "./types-Druu9wLM.js";
-import { a as CatalogFinding } from "./sink-4-eQIRWf.js";
+import { dt as TokenVerifier, lr as Subject, ot as SnapshotSource, q as DecisionSink, ut as TokenSigner } from "./policy-types-CCiDRZBH.js";
+import { s as PolicySource } from "./hosted-Cmtxogd0.js";
+import { m as ApprovalStore, u as ApprovalRequest } from "./types-B_tiYvk8.js";
+import { a as CatalogDocument } from "./types-ZzRGoViD.js";
+import { a as CatalogFinding } from "./sink-Dvi7YZG_.js";
 //#region src/cloud/types.d.ts
 type CloudEndpointOptions = {
   readonly url?: string;
   readonly environment?: string;
 };
 type CloudEndpoints = {
-  /** The environment URL, `<url>/v1/environments/<env>`: `iss` and `aud` of the policy document. */
+  /**
+   * The environment URL, `<url>/v1/environments/<env>`: `iss` and `aud` of the
+   * policy document.
+   */
   readonly issuer: string;
   /** The environment's JWK Set URL, for `joseTokenVerifier({ jwks })`. */
   readonly jwks: string;
@@ -24,50 +27,60 @@ type CloudConnectionOptions = CloudEndpointOptions & {
 type CloudApproverOptions = {
   /**
    * Signs the token with a key the environment trusts as an issuer, such as
-   * `joseTokenSigner` over your own key. Never `cloudSigner`: a client key
-   * that could mint approver tokens could forge any approver.
+   * `joseTokenSigner` over your own key. Never `cloudSigner`: a client key that
+   * could mint approver tokens could forge any approver.
    */
   readonly signer: TokenSigner;
-  /** `aud` of the token; defaults to `<issuer>/approvals`, the environment URL plus `/approvals`. */
+  /**
+   * `aud` of the token; defaults to `<issuer>/approvals`, the environment URL
+   * plus `/approvals`.
+   */
   readonly audience?: string | readonly string[];
   /**
    * The `holder(permission)` approvers of `request` that `approver` holds,
    * typically `approverPermissions(request, permdockFor(approver))`. Signed
-   * into the token as `permissions`; without it the verdict's own
-   * `permissions` are signed. A throw signs none.
+   * into the token as `permissions`; without it the verdict's own `permissions`
+   * are signed. A throw signs none.
    */
   readonly permissions?: (request: ApprovalRequest, approver: Subject) => readonly string[] | Promise<readonly string[]>;
   /**
    * The relation approvers of `request` that `approver` holds, typically
-   * `approverRelations(request, approver, { relations, permissions })`.
-   * Signed into the token as `relations`; without it the verdict's own
-   * `relations` are signed. A throw signs none.
+   * `approverRelations(request, approver, { relations, permissions })`. Signed
+   * into the token as `relations`; without it the verdict's own `relations` are
+   * signed. A throw signs none.
    */
   readonly relations?: (request: ApprovalRequest, approver: Subject) => readonly string[] | Promise<readonly string[]>;
 };
 type CloudOptions = CloudConnectionOptions & {
   /**
-   * Proves the approver on `approvals.resolve`. Without it, every resolve but
-   * a `system` rejection throws `approver-unauthenticated` and sends nothing.
+   * Proves the approver on `approvals.resolve`. Without it, every resolve but a
+   * `system` rejection throws `approver-unauthenticated` and sends nothing.
    */
   readonly approver?: CloudApproverOptions;
   readonly flushAt?: number;
-  /** Most events the sink holds while the Cloud is unreachable (default 10 000); the oldest are dropped first. */
+  /**
+   * Most events the sink holds while the Cloud is unreachable (default 10 000);
+   * the oldest are dropped first.
+   */
   readonly capacity?: number;
   readonly waitUntil?: (task: Promise<void>) => void;
-  /** The CloudEvents `source` of every event the sink sends, an absolute URI; defaults to the environment URL. */
+  /**
+   * The CloudEvents `source` of every event the sink sends, an absolute URI;
+   * defaults to the environment URL.
+   */
   readonly source?: string;
   /**
-   * Verifies the environment's signed policy document, typically
-   * `joseTokenVerifier({ jwks: cloudEndpoints().jwks })`. Without one,
-   * `policies.current()` stays `null`: an unverifiable document is never applied.
+   * Verifies the environment's signed policy document, typically `({ jwks }) =>
+   * joseTokenVerifier({ jwks })`. A function is called once, with the resolved
+   * endpoints, on the first refresh. Without one, `policies.current()` stays
+   * `null`: an unverifiable document is never applied.
    */
-  readonly verifier?: TokenVerifier;
+  readonly verifier?: TokenVerifier | ((endpoints: CloudEndpoints) => TokenVerifier);
 };
 /**
  * What `POST /catalog` answers: `201` with the new version and the drift
- * findings against the previous one, or `200` with `unchanged: true` when
- * the fingerprint is already published.
+ * findings against the previous one, or `200` with `unchanged: true` when the
+ * fingerprint is already published.
  */
 type CloudCatalogPush = {
   readonly version: number;
@@ -80,13 +93,19 @@ type CloudCatalogPush = {
 };
 type CloudCatalog = {
   /**
-   * Posts the catalog, its `operations` included, to the environment.
-   * Throws when the Cloud refuses it or answers another shape. The Cloud
-   * shows and diffs it; it never decides with it.
+   * Posts the catalog, its `operations` included, to the environment. Throws
+   * when the Cloud refuses it or answers another shape. The Cloud shows and
+   * diffs it; it never decides with it.
    */
-  push(catalog: CatalogDocument): Promise<CloudCatalogPush>;
+  push: (catalog: CatalogDocument) => Promise<CloudCatalogPush>;
 };
-type CloudClient = CloudEndpoints & {
+type CloudClient = Partial<CloudEndpoints> & {
+  /**
+   * The environment URL and JWK Set URL. `issuer` and `jwks` are set only when
+   * the environment is configured; otherwise the first call asks `GET
+   * /v1/environment` which environment the key belongs to.
+   */
+  endpoints: () => Promise<CloudEndpoints>;
   readonly approvals: ApprovalStore;
   readonly sink: DecisionSink;
   /**
@@ -95,7 +114,7 @@ type CloudClient = CloudEndpoints & {
    * signed. Sent as `PermDock-Subject`; the Cloud never takes a subject from
    * anything else.
    */
-  snapshotsFor(token: string): SnapshotSource;
+  snapshotsFor: (token: string) => SnapshotSource;
   readonly policies: PolicySource;
   readonly catalog: CloudCatalog;
 };

package/dist/{types-C_IiEs64.d.ts → types-B2mlGuhW.d.ts}

@@ -1,11 +1,11 @@
-import { fn as Approver } from "./policy-types-n0uRTsW8.js";
+import { gn as Approver } from "./policy-types-CCiDRZBH.js";
 //#region src/approvals/access-reviews/types.d.ts
 type AccessReviewStatus = "open" | "closed";
 type AccessReviewItemStatus = "pending" | "kept" | "revoked";
 /**
- * Access review v1: who holds `permissions` in one tenant, and who may
- * confirm or revoke each holding. PermDock records the reviewer's decision
- * and never changes the role or membership itself.
+ * Access review v1: who holds `permissions` in one tenant, and who may confirm
+ * or revoke each holding. PermDock records the reviewer's decision and never
+ * changes the role or membership itself.
  */
 type AccessReview = {
   readonly v: 1;
@@ -20,7 +20,10 @@ type AccessReview = {
   /** `false` when the population can omit a holder, such as a global role. */
   readonly complete: boolean;
 };
-/** One holding in a review. `via` names the roles the population attributed it to. */
+/**
+ * One holding in a review. `via` names the roles the population attributed it
+ * to.
+ */
 type AccessReviewItem = {
   readonly v: 1;
   readonly id: string;
@@ -54,12 +57,12 @@ type AccessReviewDecision = {
 type AccessReviewStore = {
   /** Names the implementation in errors and events. */
   readonly name?: string;
-  create(review: AccessReview, items: readonly AccessReviewItem[]): Promise<void> | void;
-  get(id: string): Promise<AccessReview | null> | AccessReview | null;
-  items(query: AccessReviewItemQuery): Promise<AccessReviewItemPage> | AccessReviewItemPage;
-  decide(reviewId: string, itemId: string, decision: AccessReviewDecision): Promise<AccessReviewItem> | AccessReviewItem;
-  markApplied(reviewId: string, itemId: string, at: string): Promise<AccessReviewItem> | AccessReviewItem;
-  close(id: string): Promise<AccessReview> | AccessReview;
+  create: (review: AccessReview, items: readonly AccessReviewItem[]) => Promise<void> | void;
+  get: (id: string) => Promise<AccessReview | null> | AccessReview | null;
+  items: (query: AccessReviewItemQuery) => Promise<AccessReviewItemPage> | AccessReviewItemPage;
+  decide: (reviewId: string, itemId: string, decision: AccessReviewDecision) => Promise<AccessReviewItem> | AccessReviewItem;
+  markApplied: (reviewId: string, itemId: string, at: string) => Promise<AccessReviewItem> | AccessReviewItem;
+  close: (id: string) => Promise<AccessReview> | AccessReview;
 };
 //#endregion
 export { AccessReviewItemQuery as a, AccessReviewStore as c, AccessReviewItemPage as i, AccessReviewDecision as n, AccessReviewItemStatus as o, AccessReviewItem as r, AccessReviewStatus as s, AccessReview as t };

package/dist/{types-_WhUP7ud.d.ts → types-B4uqKDnp.d.ts}

@@ -1,6 +1,6 @@
-import { Nn as Decision, Rn as ExplainedDecision, T as Policy, ar as Subject, j as PolicyVocabulary, nr as Membership, rr as Principal } from "./policy-types-n0uRTsW8.js";
-import { E as PermissionTree, w as Permission } from "./vocabulary-CN8H_9UF.js";
-import { c as WhereResult, i as PermDockOptions, n as DeriveOptions, o as SimulateOptions, r as PermDock, t as DecideOptions } from "./permdock-SV8ZINYT.js";
+import { Hn as ExplainedDecision, Ln as Decision, T as Policy, j as PolicyVocabulary, lr as Subject, or as Membership, sr as Principal } from "./policy-types-CCiDRZBH.js";
+import { f as PermissionTree, u as Permission } from "./permission-types-CAY-GU7e.js";
+import { C as PermissionCheck, a as PermDock, f as WhereResult, l as SimulateOptions, n as DecideOptions, o as PermDockOptions, r as DeriveOptions } from "./permdock-B6Sf4T_S.js";
 //#region src/pdp/types.d.ts
 type RemotePdpAuth = {
   readonly bearer: string | (() => string | Promise<string>);
@@ -40,9 +40,9 @@ type RemotePdpOptions = {
   readonly fetch?: typeof fetch;
 };
 /**
- * One tuple callback per delegated permission. The callback receives the
- * row for a check and `undefined` for a listing; returning `null` denies
- * with `pdp-denied`, throwing denies with `pdp-invalid-response`.
+ * One tuple callback per delegated permission. The callback receives the row
+ * for a check and `undefined` for a listing; returning `null` denies with
+ * `pdp-denied`, throwing denies with `pdp-invalid-response`.
  */
 type RelationMap<T> = readonly (readonly [Permission, (subject: Subject, data: unknown) => T | null])[];
 type OpenFgaTuple = {
@@ -86,25 +86,38 @@ type SpiceDbOptions = {
   readonly cache?: RemotePdpCache;
   readonly fetch?: typeof fetch;
 };
-type PdpPermDock<V extends PolicyVocabulary = PolicyVocabulary> = Omit<PermDock<V>, "can" | "decide" | "decideEach" | "assert" | "explain" | "filter" | "where" | "simulate" | "tenant" | "team" | "derive"> & {
+type PdpPermDock<V extends PolicyVocabulary = PolicyVocabulary> = Omit<PermDock<V>, "can" | "decide" | "canAll" | "decideAll" | "decideEach" | "decideIds" | "assert" | "explain" | "filter" | "where" | "simulate" | "tenant" | "team" | "derive"> & {
   /** `permdock.derive` with the same providers: the result asks the PDP too. */
   readonly derive: (options: DeriveOptions) => Promise<PdpPermDock<V>>;
   /**
-   * For a delegated permission whose provider lists ids, an `in` over them
-   * (AND the local condition when local grants exist); otherwise the local
-   * `where`, or an always-false `partial` result.
+   * For a delegated permission whose provider lists ids, an `in` over them (AND
+   * the local condition when local grants exist); otherwise the local `where`,
+   * or an always-false `partial` result.
    */
   readonly where: (permission: Permission) => Promise<WhereResult>;
   readonly can: (permission: Permission, data?: unknown, options?: DecideOptions) => Promise<boolean>;
   readonly decide: (permission: Permission, data?: unknown, options?: DecideOptions) => Promise<Decision>;
+  /**
+   * `can` for every check, asking the PDP for each in parallel; `false` for an
+   * empty list.
+   */
+  readonly canAll: (checks: readonly PermissionCheck[], options?: DecideOptions) => Promise<boolean>;
+  /**
+   * `decide` for every check, in check order, asking the PDP for each in
+   * parallel.
+   */
+  readonly decideAll: (checks: readonly PermissionCheck[], options?: DecideOptions) => Promise<readonly Decision[]>;
   /** `decide` for each row, in row order, asking the PDP per row. */
   readonly decideEach: (permission: Permission, rows: readonly unknown[], options?: DecideOptions) => Promise<readonly Decision[]>;
   readonly assert: (permission: Permission, data?: unknown, options?: DecideOptions) => Promise<Extract<Decision, {
     readonly outcome: "granted";
   }>>;
-  /** `decide` with a trace of the local grants; a decision the remote PDP made carries an empty trace. */
+  /**
+   * `decide` with a trace of the local grants; a decision the remote PDP made
+   * carries an empty trace.
+   */
   readonly explain: (permission: Permission, data?: unknown, options?: Omit<DecideOptions, "explain">) => Promise<ExplainedDecision>;
-  readonly filter: <T>(permission: Permission<string, T, "instance">, rows: readonly T[], options?: DecideOptions) => Promise<T[]>;
+  readonly filter: <T>(permission: Permission<string, NoInfer<T>, "instance">, rows: readonly T[], options?: DecideOptions) => Promise<T[]>;
   readonly simulate: {
     (checks: readonly (readonly [Permission, unknown?])[], options?: SimulateOptions): Promise<readonly Decision[]>;
     (preview: {

package/dist/{types-CX7AvRqP.d.ts → types-BJk0BKRX.d.ts}

@@ -1,7 +1,8 @@
-import { Mn as ApprovalRequiredDecision, Nn as Decision, Vt as Snapshot, dt as TokenVerifier, zn as GrantedDecision } from "./policy-types-n0uRTsW8.js";
-import { w as Permission } from "./vocabulary-CN8H_9UF.js";
-import { n as DescribeMessages } from "./describe-B5qgDvEW.js";
-import { h as ClientStoreOptions } from "./types-B3_ooZgZ.js";
+import { Gt as Snapshot, In as ApprovalRequiredDecision, Ln as Decision, Un as GrantedDecision, dt as TokenVerifier } from "./policy-types-CCiDRZBH.js";
+import { u as Permission } from "./permission-types-CAY-GU7e.js";
+import { s as RowData } from "./permdock-B6Sf4T_S.js";
+import { n as DescribeMessages } from "./describe-ByS9LgHK.js";
+import { _ as ClientStoreOptions } from "./types-B_d_g7T3.js";
 import { ReactNode } from "react";
 //#region src/react/types.d.ts
 type PermDockProviderProps = ({
@@ -9,21 +10,24 @@ type PermDockProviderProps = ({
   readonly snapshotPromise?: never;
 } | {
   /**
-   * An unawaited snapshot from a Server Component. Hooks never suspend on it: until it
-   * resolves they deny with `status: 'pending'`, then re-render. A rejection fails closed
-   * (`server-only`). Set `suspend` to suspend readers through `use()` instead.
+   * An unawaited snapshot from a Server Component. Hooks never suspend on
+   * it: until it resolves they deny with `status: 'pending'`, then
+   * re-render. A rejection fails closed (`server-only`). Set `suspend` to
+   * suspend readers through `use()` instead.
    */
   readonly snapshotPromise: PromiseLike<Snapshot | string>;
   readonly snapshot?: never;
 }) & {
   /**
-   * With `snapshotPromise`: `true` suspends every hook to the nearest Suspense boundary until it
-   * resolves, and a rejection reaches the nearest error boundary. Defaults to `false`.
+   * With `snapshotPromise`: `true` suspends every hook to the nearest Suspense
+   * boundary until it resolves, and a rejection reaches the nearest error
+   * boundary. Defaults to `false`.
    */
   readonly suspend?: boolean;
   /**
-   * The AuthZEN evaluations endpoint for checks the snapshot cannot answer. `false` never
-   * fetches: those checks answer `denied` with reason `server-only`.
+   * The AuthZEN evaluations endpoint for checks the snapshot cannot answer.
+   * `false` never fetches: those checks answer `denied` with reason
+   * `server-only`.
    */
   readonly endpoint?: string | false;
   /** Where `refresh()` fetches a fresh snapshot. Defaults to `endpoint`. */
@@ -44,6 +48,11 @@ type PermDockProviderProps = ({
   readonly onClear?: () => void;
   /** Milliseconds between approval status polls. Defaults to 2000. */
   readonly approvalInterval?: number;
+  /**
+   * Triggers that refresh the snapshot, such as `eventSourceRefresh(url)`; read
+   * when the store is built.
+   */
+  readonly refreshOn?: ClientStoreOptions["refreshOn"];
   readonly children: ReactNode;
 };
 /** Provider-wide content for the `<Protected>` slots a component leaves out. */
@@ -52,9 +61,10 @@ type PermDockDefaults = {
   readonly denied?: ReactNode | ((decision: Decision) => ReactNode);
   readonly approval?: ReactNode | ((decision: ApprovalRequiredDecision) => ReactNode);
 };
-type ProtectedProps = {
-  readonly permission: Permission;
-  readonly data?: unknown;
+type ProtectedProps<P extends Permission = Permission> = {
+  readonly permission: P;
+  /** Any part of the permission's row; see `RowData`. */
+  readonly data?: RowData<P>;
   readonly tenant?: string;
   readonly pending?: ReactNode;
   readonly denied?: ReactNode | ((decision: Decision) => ReactNode);