permdock 0.7.0 → 0.8.0

package/dist/testing/saas/index.d.ts

@@ -1,8 +1,8 @@
-import { Q as LimitStore, Rt as Instant, Zn as Actor, it as RelationSource, lr as Subject, or as Membership, rr as Delegation, sr as Principal, tr as CustomRole } from "../../policy-types-B-F-qAZk.js";
-import { u as Permission } from "../../permission-types-DhNEmoRG.js";
-import { o as PermDockOptions } from "../../permdock-Dco6dyCK.js";
-import { a as SaasProject, c as saasPlans, i as SaasFolderSchema, l as saasRoles, n as SaasDocSchema, o as SaasProjectSchema, r as SaasFolder, s as saasPermissions, t as SaasDoc, u as saasTenantRoleNames } from "../../permissions-CoqCOfJ3.js";
-import { n as saasPolicy, t as SAAS_API_KEY_LIMIT } from "../../policy-B7dg_yzu.js";
+import { Q as LimitStore, Rt as Instant, Zn as Actor, it as RelationSource, lr as Subject, or as Membership, rr as Delegation, sr as Principal, tr as CustomRole } from "../../policy-types-CCiDRZBH.js";
+import { u as Permission } from "../../permission-types-CAY-GU7e.js";
+import { o as PermDockOptions } from "../../permdock-B6Sf4T_S.js";
+import { a as SaasProject, c as saasPlans, i as SaasFolderSchema, l as saasRoles, n as SaasDocSchema, o as SaasProjectSchema, r as SaasFolder, s as saasPermissions, t as SaasDoc, u as saasTenantRoleNames } from "../../permissions-Bx6UI8n1.js";
+import { n as saasPolicy, t as SAAS_API_KEY_LIMIT } from "../../policy-Ba4bDhaj.js";
 import { StandardSchemaV1 } from "@standard-schema/spec";
 //#region src/testing/saas/schema.d.ts
 type FieldKind = "string" | "boolean" | "nullable-string";
@@ -53,6 +53,7 @@ type SaasSeed = {
 export declare const SAAS_EXPIRED_AT = 1e9;
 /**
  * Users, one hazard each:
+ *
  * - alice: admin in acme, viewer in globex (different role per org)
  * - bob: member in acme (owns p1, p3, p4)
  * - carol: owner in acme
@@ -62,16 +63,21 @@ export declare const SAAS_EXPIRED_AT = 1e9;
  * - mallory: no memberships at all
  * - gina: `lead` of team-a in acme
  * - hank: viewer in acme, `collaborator` on project p3 only
- * - `user-2` and `2`: members of `org-1`; `Date.parse` maps both ids to one instant
+ * - `user-2` and `2`: members of `org-1`; `Date.parse` maps both ids to one
+ *   instant
  * - tina: member of `tenant-1`; `Date.parse('org-1') === Date.parse('tenant-1')`
- * - ivan: viewer in acme who holds the team role `lead` on the tenant membership (the wrong scope)
+ * - ivan: viewer in acme who holds the team role `lead` on the tenant membership
+ *   (the wrong scope)
  *
  * Acme's folders: `root` ─ `eng` ─ `platform` ─ `infra`, and `root` ─ `hr`
  * (restricted) ─ `payroll`. bob views `root`, hank views `hr`, gina edits
  * `eng`, frank's view of `root` expired.
  */
 export declare const saasSeed: SaasSeed;
-/** The seed's folder tree and shares as a `RelationSource`, for `createPermDock({ relations })`. */
+/**
+ * The seed's folder tree and shares as a `RelationSource`, for
+ * `createPermDock({ relations })`.
+ */
 export declare function saasRelations(seed?: SaasSeed): RelationSource;
 /** Every user id in the seed. */
 export declare const saasUsers: readonly string[];
@@ -81,18 +87,18 @@ export declare function saasMemberships(user: string, members?: readonly SaasMem
 /** Custom roles of every org, as `createPermDock({ customRoles })` expects. */
 export declare const saasCustomRoles: readonly CustomRole[];
 /**
- * The principal for `user`, with the plans of the requested `tenant`'s org.
- * The tenant itself is passed to `createPermDock({ tenant })`, never trusted
- * from here.
+ * The principal for `user`, with the plans of the requested `tenant`'s org. The
+ * tenant itself is passed to `createPermDock({ tenant })`, never trusted from
+ * here.
  */
 export declare function saasPrincipal(user: string, tenant?: string): Principal;
 //#endregion
 //#region src/testing/saas/sql.d.ts
 /**
- * Postgres tables for the SaaS domain. Column names match the resource
- * fields (`"orgId"`, `"ownerId"`) so generated RLS and ORM filters compile
- * against them without a column map. RLS is enabled and forced on the row
- * tables; policies come from `permdock rls generate`.
+ * Postgres tables for the SaaS domain. Column names match the resource fields
+ * (`"orgId"`, `"ownerId"`) so generated RLS and ORM filters compile against
+ * them without a column map. RLS is enabled and forced on the row tables;
+ * policies come from `permdock rls generate`.
  */
 export declare const saasSchemaSql = "\ncreate table org (\n  id text primary key,\n  name text not null,\n  plan text not null check (plan in ('free', 'pro'))\n);\ncreate table org_member (\n  user_id text not null,\n  org_id text references org (id),\n  team_id text,\n  resource text,\n  resource_id text,\n  role text not null,\n  expires_at bigint\n);\ncreate table project (\n  id text primary key,\n  \"orgId\" text not null references org (id),\n  \"ownerId\" text not null,\n  name text not null,\n  archived boolean not null default false\n);\nalter table project enable row level security;\nalter table project force row level security;\ncreate table doc (\n  id text primary key,\n  \"orgId\" text not null references org (id),\n  \"teamId\" text,\n  title text not null,\n  locked boolean not null default false\n);\nalter table doc enable row level security;\nalter table doc force row level security;\ncreate table folder (\n  id text primary key,\n  \"orgId\" text not null references org (id),\n  \"parentId\" text references folder (id),\n  name text not null,\n  restricted boolean not null default false\n);\nalter table folder enable row level security;\nalter table folder force row level security;\ncreate table folder_share (\n  folder_id text not null references folder (id) on delete cascade,\n  user_id text not null,\n  expires_at timestamptz\n);\ncreate table folder_editor (\n  folder_id text not null references folder (id) on delete cascade,\n  user_id text not null\n);\n";
 /** `insert` statements for a seed; the default is the full shared seed. */
@@ -119,7 +125,10 @@ export declare const saasIssuer = "https://saas.permdock.test";
 export declare const saasAudience = "permdock-saas";
 export declare const SAAS_TOKEN_TTL_SECONDS = 3600;
 type SaasTokenOptions = {
-  /** Claim memberships; `false` omits the claim (database mode). Defaults to the seed. */
+  /**
+   * Claim memberships; `false` omits the claim (database mode). Defaults to the
+   * seed.
+   */
   readonly memberships?: readonly Membership[] | false;
   readonly ttl?: number;
   /** The instant used for `iat`; defaults to the current time. */
@@ -131,9 +140,9 @@ type SaasTokenOptions = {
 /** Signs an ES256 access token for `sub` with WebCrypto; no dependency. */
 export declare function signSaasToken(sub: string, options?: SaasTokenOptions): Promise<string>;
 /**
- * Verifies a token from `signSaasToken` (ES256, `kid`, `iss`, `aud`, `exp`)
- * and returns its `sub`, or `null`; never throws. Identity only: memberships
- * and plans come from the seed, never from the token.
+ * Verifies a token from `signSaasToken` (ES256, `kid`, `iss`, `aud`, `exp`) and
+ * returns its `sub`, or `null`; never throws. Identity only: memberships and
+ * plans come from the seed, never from the token.
  */
 export declare function verifySaasToken(token: string | null | undefined, now?: Instant): Promise<string | null>;
 /** `verifySaasToken` plus the token's `exp` as `expiresAt` (epoch seconds). */
@@ -162,8 +171,8 @@ type SaasScenario = {
    */
   readonly client?: boolean;
   /**
-   * The client outcome when it is stricter than the server's: a snapshot
-   * cannot evaluate a closure deny, so it fails closed.
+   * The client outcome when it is stricter than the server's: a snapshot cannot
+   * evaluate a closure deny, so it fails closed.
    */
   readonly clientOutcome?: SaasOutcome;
   /** An agent acting for `user`; without `delegation` it reaches nothing. */
@@ -172,23 +181,30 @@ type SaasScenario = {
   /** Units of the daily api-key quota this subject already used in the tenant. */
   readonly quotaUsed?: number;
 };
-/** What the policy's `subject` receives: the principal, or a `Subject` carrying the actor. */
+/**
+ * What the policy's `subject` receives: the principal, or a `Subject` carrying
+ * the actor.
+ */
 export declare function saasUser(scenario: SaasScenario): Principal | Subject;
 /** A memory quota store in which every subject has already used `used` units. */
 export declare function saasLimitStore(used?: number): LimitStore;
-/** The `createPermDock` options a scenario runs with: tenant, custom roles, quota and folder tree. */
+/**
+ * The `createPermDock` options a scenario runs with: tenant, custom roles,
+ * quota and folder tree.
+ */
 export declare function saasScenarioOptions(scenario: SaasScenario): PermDockOptions;
 export declare function saasProject(id: string): SaasProject;
 export declare function saasDoc(id: string): SaasDoc;
 export declare function saasFolder(id: string): SaasFolder;
 /**
- * The folder tree, decided with `createPermDock({ relations: saasRelations() })`.
- * A snapshot carries no graph, so every graph grant is server-only on a client.
+ * The folder tree, decided with `createPermDock({ relations: saasRelations()
+ * })`. A snapshot carries no graph, so every graph grant is server-only on a
+ * client.
  */
 export declare const saasFolderScenarios: readonly SaasScenario[];
 /**
- * Hand-written expectations. Never derive `expected` from the engine: the
- * list is the oracle every adapter, ORM and client suite runs against.
+ * Hand-written expectations. Never derive `expected` from the engine: the list
+ * is the oracle every adapter, ORM and client suite runs against.
  */
 export declare const saasScenarios: readonly SaasScenario[];
 //#endregion

package/dist/testing/saas/index.js

@@ -1,3 +1,3 @@
-import { a as saasPlans, c as rowSchema, i as saasPermissions, n as SaasFolderSchema, o as saasRoles, r as SaasProjectSchema, s as saasTenantRoleNames, t as SaasDocSchema } from "../../permissions-DArULThq.js";
-import { C as saasOrg, D as saasUsers, E as saasSeed, O as SAAS_API_KEY_LIMIT, S as saasMemberships, T as saasRelations, _ as verifySaasToken, a as saasProject, b as SAAS_EXPIRED_AT, c as saasUser, d as saasIssuer, f as saasJwks, g as verifySaasSession, h as signSaasToken, i as saasLimitStore, k as saasPolicy, l as SAAS_TOKEN_TTL_SECONDS, m as saasPublicJwk, n as saasFolder, o as saasScenarioOptions, p as saasPrivateJwk, r as saasFolderScenarios, s as saasScenarios, t as saasDoc, u as saasAudience, v as saasSchemaSql, w as saasPrincipal, x as saasCustomRoles, y as saasSeedSql } from "../../saas-Az_Kz-4D.js";
+import { a as saasPlans, c as rowSchema, i as saasPermissions, n as SaasFolderSchema, o as saasRoles, r as SaasProjectSchema, s as saasTenantRoleNames, t as SaasDocSchema } from "../../permissions-mDcTWoBs.js";
+import { C as saasOrg, D as saasUsers, E as saasSeed, O as SAAS_API_KEY_LIMIT, S as saasMemberships, T as saasRelations, _ as verifySaasToken, a as saasProject, b as SAAS_EXPIRED_AT, c as saasUser, d as saasIssuer, f as saasJwks, g as verifySaasSession, h as signSaasToken, i as saasLimitStore, k as saasPolicy, l as SAAS_TOKEN_TTL_SECONDS, m as saasPublicJwk, n as saasFolder, o as saasScenarioOptions, p as saasPrivateJwk, r as saasFolderScenarios, s as saasScenarios, t as saasDoc, u as saasAudience, v as saasSchemaSql, w as saasPrincipal, x as saasCustomRoles, y as saasSeedSql } from "../../saas-iWnUdwCt.js";
 export { SAAS_API_KEY_LIMIT, SAAS_EXPIRED_AT, SAAS_TOKEN_TTL_SECONDS, SaasDocSchema, SaasFolderSchema, SaasProjectSchema, rowSchema, saasAudience, saasCustomRoles, saasDoc, saasFolder, saasFolderScenarios, saasIssuer, saasJwks, saasLimitStore, saasMemberships, saasOrg, saasPermissions, saasPlans, saasPolicy, saasPrincipal, saasPrivateJwk, saasProject, saasPublicJwk, saasRelations, saasRoles, saasScenarioOptions, saasScenarios, saasSchemaSql, saasSeed, saasSeedSql, saasTenantRoleNames, saasUser, saasUsers, signSaasToken, verifySaasSession, verifySaasToken };

package/dist/testing/saas/permissions.d.ts

@@ -1,2 +1,2 @@
-import { a as SaasProject, c as saasPlans, i as SaasFolderSchema, l as saasRoles, n as SaasDocSchema, o as SaasProjectSchema, r as SaasFolder, s as saasPermissions, t as SaasDoc, u as saasTenantRoleNames } from "../../permissions-CoqCOfJ3.js";
+import { a as SaasProject, c as saasPlans, i as SaasFolderSchema, l as saasRoles, n as SaasDocSchema, o as SaasProjectSchema, r as SaasFolder, s as saasPermissions, t as SaasDoc, u as saasTenantRoleNames } from "../../permissions-Bx6UI8n1.js";
 export { SaasDoc, SaasDocSchema, SaasFolder, SaasFolderSchema, SaasProject, SaasProjectSchema, saasPermissions, saasPlans, saasRoles, saasTenantRoleNames };

package/dist/testing/saas/permissions.js

@@ -1 +1 @@
-export { t as SaasDocSchema, n as SaasFolderSchema, r as SaasProjectSchema, i as saasPermissions, a as saasPlans, o as saasRoles, s as saasTenantRoleNames } from "../../permissions-DArULThq.js";
+export { t as SaasDocSchema, n as SaasFolderSchema, r as SaasProjectSchema, i as saasPermissions, a as saasPlans, o as saasRoles, s as saasTenantRoleNames } from "../../permissions-mDcTWoBs.js";

package/dist/{text-diff-DhITNCnD.js → text-diff-BtfSmdUo.js}

@@ -431,8 +431,8 @@ function splitLines(text) {
 //#region src/cli/core/text-diff.ts
 const MAX_LINES = 40;
 /**
-* A unified diff from the file on disk to what the command would write,
-* cut to the first {@link MAX_LINES} lines so a CI log stays readable.
+* A unified diff from the file on disk to what the command would write, cut to
+* the first {@link MAX_LINES} lines so a CI log stays readable.
 */
 function shortDiff(file, onDisk, next) {
 	const lines = createTwoFilesPatch(`${file} (on disk)`, `${file} (generated)`, onDisk, next, void 0, void 0, { context: 2 }).split("\n").filter((line) => !line.startsWith("=====")).filter((line, index, all) => line !== "" || index < all.length - 1);

package/dist/{thenable-yD7SabqG.js → thenable-BNSM1U2R.js}

@@ -3,11 +3,17 @@ import { r as isRecord } from "./compact-CAf557ZB.js";
 function isThenable(value) {
 	return value !== null && typeof value === "object" && "then" in value && typeof value.then === "function";
 }
-/** Settles a promise nobody awaits, so its rejection is not reported as unhandled. */
+/**
+* Settles a promise nobody awaits, so its rejection is not reported as
+* unhandled.
+*/
 function ignoreRejection(value) {
 	Promise.resolve(value).then(void 0, () => void 0);
 }
-/** Runs a Standard Schema that must answer synchronously; an asynchronous answer fails. */
+/**
+* Runs a Standard Schema that must answer synchronously; an asynchronous answer
+* fails.
+*/
 function validateSync(schema, value) {
 	const result = schema["~standard"].validate(value);
 	if (isThenable(result)) {
@@ -22,7 +28,10 @@ function validateSync(schema, value) {
 		issues: result.issues
 	};
 }
-/** `validateSync` for a schema whose output must be an object; anything else is `undefined`. */
+/**
+* `validateSync` for a schema whose output must be an object; anything else is
+* `undefined`.
+*/
 function validateRecord(schema, value) {
 	const validated = validateSync(schema, value);
 	return validated.ok && isRecord(validated.value) ? validated.value : void 0;

package/dist/{time-DkWjdL98.js → time-nR1JesoH.js}

@@ -9,19 +9,31 @@ function isRfc3339(value) {
 function rfc3339(seconds) {
 	return (/* @__PURE__ */ new Date(seconds * 1e3)).toISOString();
 }
-/** Milliseconds since the epoch as RFC 3339 in UTC, milliseconds kept; throws a `RangeError` for a value outside the `Date` range. */
+/**
+* Milliseconds since the epoch as RFC 3339 in UTC, milliseconds kept; throws a
+* `RangeError` for a value outside the `Date` range.
+*/
 function isoAt(millis) {
 	return new Date(millis).toISOString();
 }
-/** RFC 3339 in UTC of `now`, or of the clock when absent; throws a `RangeError` for a `now` that is not an `Instant`. */
+/**
+* RFC 3339 in UTC of `now`, or of the clock when absent; throws a `RangeError`
+* for a `now` that is not an `Instant`.
+*/
 function isoNow(now) {
 	return dateAt(now).toISOString();
 }
-/** Whole seconds since the epoch of an RFC 3339 instant; `undefined` for anything else. */
+/**
+* Whole seconds since the epoch of an RFC 3339 instant; `undefined` for
+* anything else.
+*/
 function secondsOf(value) {
 	return isRfc3339(value) ? Math.floor(Date.parse(value) / 1e3) : void 0;
 }
-/** Whole seconds since the epoch of an RFC 3339 string or an `Instant`; `undefined` for anything else, Unix seconds included. */
+/**
+* Whole seconds since the epoch of an RFC 3339 string or an `Instant`;
+* `undefined` for anything else, Unix seconds included.
+*/
 function instantOf(value) {
 	if (typeof value === "string") return secondsOf(value);
 	if (typeof value === "object" && value !== null && "epochMilliseconds" in value && typeof value.epochMilliseconds === "number" && Number.isFinite(value.epochMilliseconds)) return Math.floor(value.epochMilliseconds / 1e3);
@@ -30,7 +42,10 @@ function instantOf(value) {
 function durationOf(value) {
 	return typeof value === "number" && Number.isSafeInteger(value) && value > 0 ? value : void 0;
 }
-/** Throws at definition time unless `value` is a whole number of seconds above zero. */
+/**
+* Throws at definition time unless `value` is a whole number of seconds above
+* zero.
+*/
 function assertDuration(value, label) {
 	if (durationOf(value) === void 0) throw new Error(`PermDock: ${label} must be a whole number of seconds above 0, got ${JSON.stringify(value) ?? String(value)}`);
 }
@@ -43,13 +58,19 @@ const INVALID_NOW = Object.freeze({
 	field: "now",
 	message: "now must be an Instant ({ epochMilliseconds }), such as a Temporal.Instant"
 });
-/** The `Date` of `now`, or of the clock when absent; throws a `RangeError` for a `now` that is not an `Instant`. */
+/**
+* The `Date` of `now`, or of the clock when absent; throws a `RangeError` for a
+* `now` that is not an `Instant`.
+*/
 function dateAt(now) {
 	const millis = nowMillis(now);
 	if (!Number.isFinite(millis)) throw new RangeError(`PermDock: ${INVALID_NOW.message}`);
 	return new Date(millis);
 }
-/** Whole seconds since the epoch of `now`, or of the clock when absent; throws a `RangeError` for a `now` that is not an `Instant`. */
+/**
+* Whole seconds since the epoch of `now`, or of the clock when absent; throws a
+* `RangeError` for a `now` that is not an `Instant`.
+*/
 function secondsAt(now) {
 	return Math.floor(dateAt(now).getTime() / 1e3);
 }
@@ -61,7 +82,10 @@ function instantAt(seconds) {
 function epochSeconds(now) {
 	return nowMillis(now) / 1e3;
 }
-/** Milliseconds since the epoch of `now`, or of the clock when absent; `NaN` for a `now` that is not an `Instant`. */
+/**
+* Milliseconds since the epoch of `now`, or of the clock when absent; `NaN` for
+* a `now` that is not an `Instant`.
+*/
 function nowMillis(now) {
 	if (now === void 0) return Date.now();
 	const millis = typeof now === "object" && now !== null ? now.epochMilliseconds : void 0;

package/dist/{token-2qYDvXz2.js → token-DC9EQiet.js}

@@ -1,9 +1,9 @@
 import { t as canonicalJson } from "./canonical-json-DwilZ1iB.js";
-import { r as sha256Digest } from "./sha256-D9ihqmvd.js";
+import { r as sha256Digest } from "./sha256-C-4WXKIu.js";
 //#region src/core/token.ts
 /**
-* Only stable identity goes into the token, so refreshing a session (new
-* roles, assurance or claims) does not orphan an outstanding approval.
+* Only stable identity goes into the token, so refreshing a session (new roles,
+* assurance or claims) does not orphan an outstanding approval.
 */
 function principalIdentity(principal) {
 	if (principal === null) return null;
@@ -13,7 +13,10 @@ function principalIdentity(principal) {
 		issuer: principal.issuer ?? null
 	};
 }
-/** A row's `version` field as token input; `null` when it is missing or not a scalar. */
+/**
+* A row's `version` field as token input; `null` when it is missing or not a
+* scalar.
+*/
 function versionOf(row, field) {
 	if (row === null || typeof row !== "object" || !Object.hasOwn(row, field)) return null;
 	const value = row[field];
@@ -25,20 +28,19 @@ function payloadDigest(data) {
 	return sha256Digest(canonicalJson(data));
 }
 /**
-* The payload a decision token binds: the call's `args` when the caller
-* passes them (an agent or MCP tool call, row or not), otherwise the data of
-* a call without a row id. `undefined` binds nothing beyond the row id.
+* The payload a decision token binds: the call's `args` when the caller passes
+* them (an agent or MCP tool call, row or not), otherwise the data of a call
+* without a row id. `undefined` binds nothing beyond the row id.
 */
 function tokenPayload(resourceId, data, args) {
 	if (args !== void 0) return payloadDigest(args);
 	return resourceId === "*" && data !== void 0 ? payloadDigest(data) : void 0;
 }
 /**
-* `version` is set only for an approval that goes stale on a resource
-* change; without it the payload, and so every other token, is unchanged.
-* `payload` is set when `resourceId` is `*` (a collection action or a row
-* without an id), so an approval covers the arguments it was given and no
-* others.
+* `version` is set only for an approval that goes stale on a resource change;
+* without it the payload, and so every other token, is unchanged. `payload` is
+* set when `resourceId` is `*` (a collection action or a row without an id), so
+* an approval covers the arguments it was given and no others.
 */
 function decisionToken(input) {
 	const payload = canonicalJson({

package/dist/{tool-refusal-reAhIzdl.js → tool-refusal-Qpjs_W6M.js}

@@ -1,5 +1,5 @@
 import { t as wireDenials } from "./wire-denial-C7PaVYEM.js";
-import { t as describe } from "./describe-DZlnEtLy.js";
+import { n as describe } from "./describe-Bb4hGK5d.js";
 //#region src/core/tool-refusal.ts
 function deniedToolRefusal(decision, permission, resource) {
 	const alternatives = decision.alternatives.map((leaf) => leaf.key);
@@ -26,7 +26,10 @@ function approvalToolRefusal(decision, permission, resource) {
 		}
 	};
 }
-/** An MCP `CallToolResult` with `isError` set, as MCP and WebMCP clients read it. */
+/**
+* An MCP `CallToolResult` with `isError` set, as MCP and WebMCP clients read
+* it.
+*/
 function toolErrorResult(refusal) {
 	return {
 		isError: true,

package/dist/trpc/index.d.ts

@@ -1,10 +1,10 @@
-import { T as Policy, sr as Principal } from "../policy-types-B-F-qAZk.js";
-import { u as Permission } from "../permission-types-DhNEmoRG.js";
-import { a as PermDock } from "../permdock-Dco6dyCK.js";
-import { n as RevocationFeed } from "../revocations-R07lFBnX.js";
-import { D as ConnectionOptions, T as Connection, i as OpenApiHooks } from "../server-types-C4gZUEZy.js";
-import { t as ServerAdapterOptions } from "../bind-JDuvxjuW.js";
-import { t as StreamProtectOptions } from "../stream-2Vwhl7Er.js";
+import { T as Policy, sr as Principal } from "../policy-types-CCiDRZBH.js";
+import { u as Permission } from "../permission-types-CAY-GU7e.js";
+import { a as PermDock } from "../permdock-B6Sf4T_S.js";
+import { n as RevocationFeed } from "../revocations-BaUXHM1N.js";
+import { D as ConnectionOptions, T as Connection, i as OpenApiHooks } from "../server-types-CIlpSA2G.js";
+import { t as ServerAdapterOptions } from "../bind-Cp2hBHzP.js";
+import { t as StreamProtectOptions } from "../stream-ltuLdtTG.js";
 import { AnyTRPCMiddlewareFunction } from "@trpc/server";
 //#region src/trpc/create.d.ts
 type TrpcMiddlewareOpts<TCtx = object, TInput = unknown> = {
@@ -34,7 +34,10 @@ type TrpcOpenApiHooks = {
   readonly securitySchemes: OpenApiHooks["securitySchemes"];
 };
 type TrpcPermDock<TCtx = object> = {
-  /** The `PermDock` for one procedure call, for code the middleware does not run before. */
+  /**
+   * The `PermDock` for one procedure call, for code the middleware does not run
+   * before.
+   */
   readonly getPermDock: (opts: TrpcMiddlewareOpts<TCtx>) => Promise<PermDock>;
   readonly middleware: () => TrpcMiddleware;
   readonly protect: (permission: Permission | null, data?: (opts: TrpcMiddlewareOpts<TCtx>) => unknown, protectOptions?: StreamProtectOptions) => TrpcMiddleware;

package/dist/trpc/index.js

@@ -1,12 +1,15 @@
-import { o as problemMessage } from "../http-BBoKefeS.js";
-import { t as problemFromError } from "../map-error-BQGyDm_M.js";
-import { n as attached } from "../bind-D1nO6fiC.js";
-import { i as isAsyncIterable, o as reloadAfter } from "../stream-CvdUS9V1.js";
-import { i as rpcCode, n as guardStream, r as problemBody, t as bindRpcKernel } from "../rpc-Bk1bE-ch.js";
+import { o as problemMessage } from "../http-DKLXrFGk.js";
+import { t as problemFromError } from "../map-error-pasIGqMT.js";
+import { n as attached } from "../bind-D_sZSVA3.js";
+import { i as isAsyncIterable, o as reloadAfter } from "../stream-CDvF0sJm.js";
+import { i as rpcCode, n as guardStream, r as problemBody, t as bindRpcKernel } from "../rpc-fNqAIqQk.js";
 import { TRPCError, isTrackedEnvelope } from "@trpc/server";
 //#region src/trpc/create.ts
 const PROBLEM = Symbol.for("permdock.problem");
-/** A `TRPCError` for a revoked subscription; the Problem Details body rides on `cause`. */
+/**
+* A `TRPCError` for a revoked subscription; the Problem Details body rides on
+* `cause`.
+*/
 function trpcErrorFrom(error) {
 	const problem = error.toProblemDetails();
 	const cause = { ...problem };
@@ -34,8 +37,8 @@ async function throwTrpcError(response) {
 	});
 }
 /**
-* A PermDock error thrown further down (an `assert` in a resolver) arrives as
-* a failed middleware result; it becomes the same TRPCError `protect` throws.
+* A PermDock error thrown further down (an `assert` in a resolver) arrives as a
+* failed middleware result; it becomes the same TRPCError `protect` throws.
 */
 function mapDownstream(result) {
 	if (result === null || typeof result !== "object" || result.ok !== false) return Promise.resolve(result);
@@ -70,7 +73,10 @@ function createPermDock(policy, options) {
 		attach(nextCtx, request);
 		return mapDownstream(await opts.next({ ctx: nextCtx }));
 	});
-	/** Wraps a subscription's iterable so revocation ends it and unreadable items drop. */
+	/**
+	* Wraps a subscription's iterable so revocation ends it and unreadable items
+	* drop.
+	*/
 	const guardSubscription = async (result, opts, permission, data, protectOptions) => {
 		if (result === null || typeof result !== "object" || result.ok !== true || !isAsyncIterable(result.data)) return result;
 		return {

package/dist/type-helpers-BIPIDa6a.d.ts

@@ -0,0 +1,50 @@
+import { j as PolicyVocabulary, mn as ScopeNames } from "./policy-types-CCiDRZBH.js";
+import { k as POLICY_SCOPES, u as Permission } from "./permission-types-CAY-GU7e.js";
+import { n as PlanTree } from "./vocabulary-DEJ5j4mR.js";
+import { o as OperationMap } from "./operations-Ci_rT6Uo.js";
+//#region src/core/type-helpers.d.ts
+/** Recursion guard: a tree nests resources at most this many levels deep. */
+type Depth = [never, 0, 1, 2, 3, 4, 5, 6, 7];
+/** The literal string keys of `T`, without an index signature. */
+type KnownKeys<T> = keyof { readonly [K in keyof T as string extends K ? never : K extends string ? K : never]: 0; };
+type LeavesOf<T, D extends number> = [D] extends [never] ? never : T extends Permission ? T : { readonly [K in KnownKeys<T>]-?: LeavesOf<T[K], Depth[D]>; }[KnownKeys<T>];
+/** The union of the permission leaves of a `definePermissions` tree. */
+type PermissionOf<T> = [KnownKeys<T>] extends [never] ? Permission : LeavesOf<T, 8>;
+type TreeOf<P> = P extends {
+  readonly vocabulary: {
+    readonly permissions: infer T;
+  };
+} ? T : P;
+/** The resource names of a policy or a permission tree, else `string`. */
+type ResourceNameOf<P> = PermissionOf<TreeOf<P>>["resource"];
+/** The action names of a policy or a permission tree, else `string`. */
+type ActionNameOf<P> = PermissionOf<TreeOf<P>>["action"];
+/** The permission keys of a policy or a permission tree, else `string`. */
+type PermissionKeyOf<P> = PermissionOf<TreeOf<P>>["key"];
+/**
+ * The scope names a policy's `definePolicy({ scopes })` declares, plus the
+ * `tenant` / `team` aliases; `string` for a policy that declares none.
+ */
+type ScopeNameOf<P> = P extends {
+  readonly [POLICY_SCOPES]?: infer S;
+} ? ScopeNames<Exclude<S, undefined>> : string;
+/**
+ * The plan names a policy declares: the keys of its `definePlans` vocabulary,
+ * else `string`.
+ */
+type PlanNameOf<P> = P extends {
+  readonly vocabulary: infer V;
+} ? V extends {
+  readonly plans: infer T extends PlanTree;
+} ? T[keyof T]["key"] : string : string;
+/** The operation names of a `defineOperations` map, else `string`. */
+type OperationNameOf<O> = O extends OperationMap<infer D> ? keyof D & string : string;
+/**
+ * The vocabulary a policy was defined with, for an instance type such as
+ * `usePermDock<VocabularyOf<typeof policy>>()`; `PolicyVocabulary` otherwise.
+ */
+type VocabularyOf<P> = P extends {
+  readonly vocabulary: infer V extends PolicyVocabulary;
+} ? V : PolicyVocabulary;
+//#endregion
+export { PlanNameOf as a, VocabularyOf as c, PermissionOf as i, OperationNameOf as n, ResourceNameOf as o, PermissionKeyOf as r, ScopeNameOf as s, ActionNameOf as t };

package/dist/{types-DBHftjgS.d.ts → types-AMJ5qoU_.d.ts}

@@ -1,15 +1,18 @@
-import { dt as TokenVerifier, lr as Subject, ot as SnapshotSource, q as DecisionSink, ut as TokenSigner } from "./policy-types-B-F-qAZk.js";
-import { s as PolicySource } from "./hosted-BmjzxQhp.js";
-import { m as ApprovalStore, u as ApprovalRequest } from "./types-DC44-hqb.js";
-import { a as CatalogDocument } from "./types-BXMYB7BY.js";
-import { a as CatalogFinding } from "./sink-Cp_Eot9W.js";
+import { dt as TokenVerifier, lr as Subject, ot as SnapshotSource, q as DecisionSink, ut as TokenSigner } from "./policy-types-CCiDRZBH.js";
+import { s as PolicySource } from "./hosted-Cmtxogd0.js";
+import { m as ApprovalStore, u as ApprovalRequest } from "./types-B_tiYvk8.js";
+import { a as CatalogDocument } from "./types-ZzRGoViD.js";
+import { a as CatalogFinding } from "./sink-Dvi7YZG_.js";
 //#region src/cloud/types.d.ts
 type CloudEndpointOptions = {
   readonly url?: string;
   readonly environment?: string;
 };
 type CloudEndpoints = {
-  /** The environment URL, `<url>/v1/environments/<env>`: `iss` and `aud` of the policy document. */
+  /**
+   * The environment URL, `<url>/v1/environments/<env>`: `iss` and `aud` of the
+   * policy document.
+   */
   readonly issuer: string;
   /** The environment's JWK Set URL, for `joseTokenVerifier({ jwks })`. */
   readonly jwks: string;
@@ -24,51 +27,60 @@ type CloudConnectionOptions = CloudEndpointOptions & {
 type CloudApproverOptions = {
   /**
    * Signs the token with a key the environment trusts as an issuer, such as
-   * `joseTokenSigner` over your own key. Never `cloudSigner`: a client key
-   * that could mint approver tokens could forge any approver.
+   * `joseTokenSigner` over your own key. Never `cloudSigner`: a client key that
+   * could mint approver tokens could forge any approver.
    */
   readonly signer: TokenSigner;
-  /** `aud` of the token; defaults to `<issuer>/approvals`, the environment URL plus `/approvals`. */
+  /**
+   * `aud` of the token; defaults to `<issuer>/approvals`, the environment URL
+   * plus `/approvals`.
+   */
   readonly audience?: string | readonly string[];
   /**
    * The `holder(permission)` approvers of `request` that `approver` holds,
    * typically `approverPermissions(request, permdockFor(approver))`. Signed
-   * into the token as `permissions`; without it the verdict's own
-   * `permissions` are signed. A throw signs none.
+   * into the token as `permissions`; without it the verdict's own `permissions`
+   * are signed. A throw signs none.
    */
   readonly permissions?: (request: ApprovalRequest, approver: Subject) => readonly string[] | Promise<readonly string[]>;
   /**
    * The relation approvers of `request` that `approver` holds, typically
-   * `approverRelations(request, approver, { relations, permissions })`.
-   * Signed into the token as `relations`; without it the verdict's own
-   * `relations` are signed. A throw signs none.
+   * `approverRelations(request, approver, { relations, permissions })`. Signed
+   * into the token as `relations`; without it the verdict's own `relations` are
+   * signed. A throw signs none.
    */
   readonly relations?: (request: ApprovalRequest, approver: Subject) => readonly string[] | Promise<readonly string[]>;
 };
 type CloudOptions = CloudConnectionOptions & {
   /**
-   * Proves the approver on `approvals.resolve`. Without it, every resolve but
-   * a `system` rejection throws `approver-unauthenticated` and sends nothing.
+   * Proves the approver on `approvals.resolve`. Without it, every resolve but a
+   * `system` rejection throws `approver-unauthenticated` and sends nothing.
    */
   readonly approver?: CloudApproverOptions;
   readonly flushAt?: number;
-  /** Most events the sink holds while the Cloud is unreachable (default 10 000); the oldest are dropped first. */
+  /**
+   * Most events the sink holds while the Cloud is unreachable (default 10 000);
+   * the oldest are dropped first.
+   */
   readonly capacity?: number;
   readonly waitUntil?: (task: Promise<void>) => void;
-  /** The CloudEvents `source` of every event the sink sends, an absolute URI; defaults to the environment URL. */
+  /**
+   * The CloudEvents `source` of every event the sink sends, an absolute URI;
+   * defaults to the environment URL.
+   */
   readonly source?: string;
   /**
-   * Verifies the environment's signed policy document, typically
-   * `({ jwks }) => joseTokenVerifier({ jwks })`. A function is called once,
-   * with the resolved endpoints, on the first refresh. Without one,
-   * `policies.current()` stays `null`: an unverifiable document is never applied.
+   * Verifies the environment's signed policy document, typically `({ jwks }) =>
+   * joseTokenVerifier({ jwks })`. A function is called once, with the resolved
+   * endpoints, on the first refresh. Without one, `policies.current()` stays
+   * `null`: an unverifiable document is never applied.
    */
   readonly verifier?: TokenVerifier | ((endpoints: CloudEndpoints) => TokenVerifier);
 };
 /**
  * What `POST /catalog` answers: `201` with the new version and the drift
- * findings against the previous one, or `200` with `unchanged: true` when
- * the fingerprint is already published.
+ * findings against the previous one, or `200` with `unchanged: true` when the
+ * fingerprint is already published.
  */
 type CloudCatalogPush = {
   readonly version: number;
@@ -81,19 +93,19 @@ type CloudCatalogPush = {
 };
 type CloudCatalog = {
   /**
-   * Posts the catalog, its `operations` included, to the environment.
-   * Throws when the Cloud refuses it or answers another shape. The Cloud
-   * shows and diffs it; it never decides with it.
+   * Posts the catalog, its `operations` included, to the environment. Throws
+   * when the Cloud refuses it or answers another shape. The Cloud shows and
+   * diffs it; it never decides with it.
    */
-  push(catalog: CatalogDocument): Promise<CloudCatalogPush>;
+  push: (catalog: CatalogDocument) => Promise<CloudCatalogPush>;
 };
 type CloudClient = Partial<CloudEndpoints> & {
   /**
-   * The environment URL and JWK Set URL. `issuer` and `jwks` are set only
-   * when the environment is configured; otherwise the first call asks
-   * `GET /v1/environment` which environment the key belongs to.
+   * The environment URL and JWK Set URL. `issuer` and `jwks` are set only when
+   * the environment is configured; otherwise the first call asks `GET
+   * /v1/environment` which environment the key belongs to.
    */
-  endpoints(): Promise<CloudEndpoints>;
+  endpoints: () => Promise<CloudEndpoints>;
   readonly approvals: ApprovalStore;
   readonly sink: DecisionSink;
   /**
@@ -102,7 +114,7 @@ type CloudClient = Partial<CloudEndpoints> & {
    * signed. Sent as `PermDock-Subject`; the Cloud never takes a subject from
    * anything else.
    */
-  snapshotsFor(token: string): SnapshotSource;
+  snapshotsFor: (token: string) => SnapshotSource;
   readonly policies: PolicySource;
   readonly catalog: CloudCatalog;
 };