permdock 0.7.0 → 0.8.0

package/dist/{types-CIeZcG8v.d.ts → types-DHKPcqzr.d.ts}

@@ -1,5 +1,5 @@
-import { en as DecisionEvent, j as PolicyVocabulary } from "./policy-types-B-F-qAZk.js";
-import { a as PermDock } from "./permdock-Dco6dyCK.js";
+import { en as DecisionEvent, j as PolicyVocabulary } from "./policy-types-CCiDRZBH.js";
+import { a as PermDock } from "./permdock-B6Sf4T_S.js";
 //#region src/otel/types.d.ts
 declare const GENAI_SEMCONV_PIN = "1.37.0";
 declare const GEN_AI_TOOL_NAME = "gen_ai.tool.name";

package/dist/{types-cTos-H7p.d.ts → types-DjuMBNF9.d.ts}

@@ -1,8 +1,8 @@
-import { Y as JwtClaims, Zn as Actor, Zt as AuthEvent, dt as TokenVerifier, et as MembershipSource, lr as Subject, lt as TokenFailureCause, sr as Principal } from "./policy-types-B-F-qAZk.js";
-import { m as ApprovalStore } from "./types-DC44-hqb.js";
-import { n as RevocationFeed } from "./revocations-R07lFBnX.js";
-import { t as ClaimsMap } from "./claims-map-Ca-QX8C6.js";
-import { t as ClientNames } from "./clients-C7zLFuWT.js";
+import { Y as JwtClaims, Zn as Actor, Zt as AuthEvent, dt as TokenVerifier, et as MembershipSource, lr as Subject, lt as TokenFailureCause, sr as Principal } from "./policy-types-CCiDRZBH.js";
+import { m as ApprovalStore } from "./types-B_tiYvk8.js";
+import { n as RevocationFeed } from "./revocations-BaUXHM1N.js";
+import { t as ClaimsMap } from "./claims-map-D1Pb5oRq.js";
+import { t as ClientNames } from "./clients-C_NOET3z.js";
 import { StandardSchemaV1 } from "@standard-schema/spec";
 //#region src/jwt/types.d.ts
 type JwtAlgorithm = "ES256" | "PS256" | "Ed25519" | "RS256" | "HS256" | "EdDSA";
@@ -24,7 +24,10 @@ type JwksCacheOptions = {
   readonly minTtl?: number;
   readonly maxTtl?: number;
   readonly cooldown?: number;
-  /** Milliseconds a discovery or JWKS request may take before it counts as failed. Default 5000. */
+  /**
+   * Milliseconds a discovery or JWKS request may take before it counts as
+   * failed. Default 5000.
+   */
   readonly timeout?: number;
 };
 type JoseTokenVerifierOptions = {
@@ -47,7 +50,10 @@ type JoseTokenSignerOptions = {
   readonly kid: string;
   /** `iss` of every output; required. */
   readonly issuer: string;
-  /** `aud` for an output whose `sign` call names none; without either, `sign` rejects. */
+  /**
+   * `aud` for an output whose `sign` call names none; without either, `sign`
+   * rejects.
+   */
   readonly audience?: string | readonly string[];
 };
 type JwtDelegationPaths = {
@@ -69,11 +75,17 @@ type JwtSubjectOptions = Omit<JoseTokenVerifierOptions, "audience"> & {
   readonly actor?: {
     readonly from?: "act";
     readonly kind?: string;
-    /** Names for client ids (`ClientNames`): the actor gets `client` set to the name of `act.sub`. */
+    /**
+     * Names for client ids (`ClientNames`): the actor gets `client` set to
+     * the name of `act.sub`.
+     */
     readonly clients?: ClientNames;
   } | ((claims: JwtClaims) => Actor | undefined);
   readonly sender?: "none" | "dpop" | "mtls";
-  /** With `sender: "dpop"`, rejects a proof `jti` already used by the same key within 60 seconds. */
+  /**
+   * With `sender: "dpop"`, rejects a proof `jti` already used by the same key
+   * within 60 seconds.
+   */
   readonly replay?: ReplayStore;
   readonly memberships?: MembershipSource;
   readonly verifier?: TokenVerifier;
@@ -101,7 +113,10 @@ type CaepEventName = "session-revoked" | "credential-change" | "assurance-level-
 /** The RISC 1.0 event types PermDock treats as a revocation of every session. */
 type RiscEventName = "account-disabled" | "account-purged" | "credential-compromise";
 type SsfEventName = CaepEventName | RiscEventName;
-/** An SSF 1.0 stream `verification` event: the `state` the receiver asked the transmitter to echo. */
+/**
+ * An SSF 1.0 stream `verification` event: the `state` the receiver asked the
+ * transmitter to echo.
+ */
 type SsfVerification = {
   readonly state?: string;
   readonly jti: string;
@@ -130,7 +145,10 @@ type SsfEventInput = {
 type SsfEventHandler = (input: SsfEventInput) => void | Promise<void>;
 type SsfOnEvent = { readonly [K in SsfEventName]?: SsfEventHandler; } & {
   readonly "*"?: SsfEventHandler;
-  /** SSF 1.0 section 8.1.4.1 stream verification; it names a stream, never a subject. */
+  /**
+   * SSF 1.0 section 8.1.4.1 stream verification; it names a stream, never a
+   * subject.
+   */
   readonly verification?: (input: SsfVerification) => void | Promise<void>;
 };
 /**
@@ -141,12 +159,12 @@ type SsfOnEvent = { readonly [K in SsfEventName]?: SsfEventHandler; } & {
 type ReplayStore = {
   /** Names the implementation in errors and events. */
   readonly name?: string;
-  seen(key: string): boolean | Promise<boolean>;
-  remember(key: string, expiresAt?: number): void | Promise<void>;
+  seen: (key: string) => boolean | Promise<boolean>;
+  remember: (key: string, expiresAt?: number) => void | Promise<void>;
   /** Records `key` and returns `true` only if it was not already recorded. */
-  claim?(key: string, expiresAt?: number): boolean | Promise<boolean>;
+  claim?: (key: string, expiresAt?: number) => boolean | Promise<boolean>;
   /** Forgets a claimed `key` so a failed delivery can be retried. */
-  release?(key: string): void | Promise<void>;
+  release?: (key: string) => void | Promise<void>;
 };
 type SsfAuditEvent = {
   readonly type: string;
@@ -193,22 +211,25 @@ type SsfPermDockOptions = {
   readonly revocations?: RevocationFeed;
   readonly clockTolerance?: number;
   /**
-   * Seconds a SET without `exp` is accepted after its `iat`; default one
-   * day. The replay record is kept at least that long, so a replayed SET
-   * is refused for as long as its signature would verify.
+   * Seconds a SET without `exp` is accepted after its `iat`; default one day.
+   * The replay record is kept at least that long, so a replayed SET is refused
+   * for as long as its signature would verify.
    */
   readonly maxTokenAge?: number;
 };
 type SsfReceiver = {
-  push(request: Request): Promise<Response>;
-  logout(request: Request): Promise<Response>;
-  poll(options: PollOptions): Promise<PollResult> | PollHandle;
-  on(event: "event", handler: SsfEventListener): () => void;
+  push: (request: Request) => Promise<Response>;
+  logout: (request: Request) => Promise<Response>;
+  poll: (options: PollOptions) => Promise<PollResult> | PollHandle;
+  on: (event: "event", handler: SsfEventListener) => () => void;
 };
 type SsfPermDock = {
   readonly receiver: SsfReceiver;
 };
-/** One event of a SET: the event-type URI, the RFC 9493 subject and the event's own claims. */
+/**
+ * One event of a SET: the event-type URI, the RFC 9493 subject and the event's
+ * own claims.
+ */
 type SetEvent = {
   readonly type: string;
   readonly subject: SetSubject;
@@ -237,7 +258,10 @@ type SignSetOptions = {
   /** `iat`, NumericDate seconds; the signer's clock when absent. */
   readonly issuedAt?: number;
 };
-/** Why `pushSet` did not deliver: the RFC 8935 `err` code in kebab case, or a transport failure. */
+/**
+ * Why `pushSet` did not deliver: the RFC 8935 `err` code in kebab case, or a
+ * transport failure.
+ */
 type SetDeliveryFailureCause = "invalid-request" | "invalid-key" | "invalid-issuer" | "invalid-audience" | "authentication-failed" | "access-denied" | "unavailable";
 type SetDelivery = {
   readonly ok: true;
@@ -245,13 +269,22 @@ type SetDelivery = {
   readonly ok: false;
   readonly cause: SetDeliveryFailureCause;
   readonly description?: string;
-  /** `true` when the same SET may be pushed again: a network failure, a timeout or a `5xx`. */
+  /**
+   * `true` when the same SET may be pushed again: a network failure, a
+   * timeout or a `5xx`.
+   */
   readonly retry: boolean;
 };
 type PushSetOptions = {
-  /** The receiver's RFC 8935 push endpoint, the stream's `delivery.endpoint_url`. */
+  /**
+   * The receiver's RFC 8935 push endpoint, the stream's
+   * `delivery.endpoint_url`.
+   */
   readonly endpoint: string;
-  /** The `Authorization` header value, the stream's `delivery.authorization_header`. */
+  /**
+   * The `Authorization` header value, the stream's
+   * `delivery.authorization_header`.
+   */
   readonly authorization?: string;
   readonly fetch?: typeof fetch;
   readonly signal?: AbortSignal;
@@ -268,21 +301,24 @@ type SetError = {
 type SetQueue = {
   /** Names the implementation in errors and events. */
   readonly name?: string;
-  enqueue(stream: string, jti: string, set: string): void | Promise<void>;
+  enqueue: (stream: string, jti: string, set: string) => void | Promise<void>;
   /** Up to `max` pending SETs, oldest first. */
-  pending(stream: string, max: number): readonly {
+  pending: (stream: string, max: number) => readonly {
     readonly jti: string;
     readonly set: string;
   }[] | Promise<readonly {
     readonly jti: string;
     readonly set: string;
   }[]>;
-  ack(stream: string, jti: string): void | Promise<void>;
-  fail(stream: string, jti: string, error: SetError): void | Promise<void>;
+  ack: (stream: string, jti: string) => void | Promise<void>;
+  fail: (stream: string, jti: string, error: SetError) => void | Promise<void>;
 };
 type SetPollHandlerOptions = {
   readonly queue: SetQueue;
-  /** The stream id the request's credentials may poll, or `null` to refuse it with `401`. */
+  /**
+   * The stream id the request's credentials may poll, or `null` to refuse it
+   * with `401`.
+   */
   readonly authorize: (request: Request) => string | null | Promise<string | null>;
   /** The largest `maxEvents` honoured; default 100. */
   readonly maxEvents?: number;

package/dist/{types-CeIscIKp.d.ts → types-HzqOtvsJ.d.ts}

@@ -1,24 +1,27 @@
-import { Gt as Snapshot, dt as TokenVerifier, ot as SnapshotSource } from "./policy-types-B-F-qAZk.js";
-import { n as DescribeMessages } from "./describe-O0SwYIK8.js";
-import { h as ClientStoreOptions } from "./types-CKV71kKh.js";
-import { t as PermDockDefaults } from "./types-CQVEQawv.js";
+import { Gt as Snapshot, dt as TokenVerifier, ot as SnapshotSource } from "./policy-types-CCiDRZBH.js";
+import { n as DescribeMessages } from "./describe-ByS9LgHK.js";
+import { _ as ClientStoreOptions } from "./types-B_d_g7T3.js";
+import { t as PermDockDefaults } from "./types-BJk0BKRX.js";
 import { ReactNode } from "react";
 //#region src/react-native/types.d.ts
 type SnapshotStorage = {
   /** Names the implementation in errors and events. */
   readonly name?: string;
-  getItem(key: string): string | null | Promise<string | null>;
-  setItem(key: string, value: string): void | Promise<void>;
-  removeItem(key: string): void | Promise<void>;
+  getItem: (key: string) => string | null | Promise<string | null>;
+  setItem: (key: string, value: string) => void | Promise<void>;
+  removeItem: (key: string) => void | Promise<void>;
 };
 type NativeRevalidate = "launch" | "focus" | number;
 /**
- * Calls `listener` when the app changes state; `active` is `false` when it
- * goes to the background. A listener called without an argument counts as
- * a return to the foreground.
+ * Calls `listener` when the app changes state; `active` is `false` when it goes
+ * to the background. A listener called without an argument counts as a return
+ * to the foreground.
  */
 type SubscribeForeground = (listener: (active?: boolean) => void) => () => void;
-/** Calls `listener` with `false` when the device loses connectivity and `true` when it returns. */
+/**
+ * Calls `listener` with `false` when the device loses connectivity and `true`
+ * when it returns.
+ */
 type SubscribeOnline = (listener: (online: boolean) => void) => () => void;
 type ReactNativePermDockProviderProps = {
   readonly storage: SnapshotStorage;
@@ -29,7 +32,10 @@ type ReactNativePermDockProviderProps = {
   readonly subjectId: string | null;
   readonly snapshot?: Snapshot | string;
   readonly snapshotUrl?: string;
-  /** Hydrates from the device's own rows (`localSnapshot`); with `snapshotUrl` too, the latest answer wins. */
+  /**
+   * Hydrates from the device's own rows (`localSnapshot`); with `snapshotUrl`
+   * too, the latest answer wins.
+   */
   readonly source?: SnapshotSource;
   readonly endpoint?: string;
   readonly approvals?: string;
@@ -51,6 +57,11 @@ type ReactNativePermDockProviderProps = {
   readonly onClear?: () => void;
   /** Milliseconds between approval status polls. Defaults to 2000. */
   readonly approvalInterval?: number;
+  /**
+   * Triggers that refresh the snapshot, such as `eventSourceRefresh(url)`; read
+   * when the store is built.
+   */
+  readonly refreshOn?: ClientStoreOptions["refreshOn"];
   readonly children: ReactNode;
 };
 //#endregion

package/dist/{types-BXMYB7BY.d.ts → types-ZzRGoViD.d.ts}

@@ -1,5 +1,5 @@
-import { C as ResourceRelation } from "./permission-types-DhNEmoRG.js";
-import { s as OperationMeta } from "./operations-BNLes61x.js";
+import { C as ResourceRelation } from "./permission-types-CAY-GU7e.js";
+import { s as OperationMeta } from "./operations-Ci_rT6Uo.js";
 //#region src/catalog/types.d.ts
 type CatalogUsage = {
   readonly file: string;
@@ -14,19 +14,33 @@ type CatalogPermission = {
   readonly arity: "instance" | "collection";
   readonly meta: Readonly<Record<string, unknown>>;
   readonly usages: readonly CatalogUsage[];
-  /** Keys the permission was renamed from (`definePermissions` `renamed`), sorted; absent when none. */
+  /**
+   * Keys the permission was renamed from (`definePermissions` `renamed`),
+   * sorted; absent when none.
+   */
   readonly renamedFrom?: readonly string[];
-  /** Level names a custom role may pick for the permission (`resource(…, { levels })`); absent when none. */
+  /**
+   * Level names a custom role may pick for the permission (`resource(…, {
+   * levels })`); absent when none.
+   */
   readonly levels?: readonly string[];
+  /**
+   * `true` when `levels` run from narrowest to widest (`resource(…, {
+   * orderedLevels: true })`); absent otherwise.
+   */
+  readonly orderedLevels?: true;
   /** Present only when the policy lists the permission in `hostable`. */
   readonly hostable?: true;
   /**
-   * `true` when a code grant for the key has a condition beyond role and
-   * scope, so the SQL helpers alone cannot enforce it, and when the catalog
-   * was built without the policy, which leaves it unknown.
+   * `true` when a code grant for the key has a condition beyond role and scope,
+   * so the SQL helpers alone cannot enforce it, and when the catalog was built
+   * without the policy, which leaves it unknown.
    */
   readonly rowConditions: boolean;
-  /** The approvals code allows on this permission require; a hosted grant must meet each. */
+  /**
+   * The approvals code allows on this permission require; a hosted grant must
+   * meet each.
+   */
   readonly approvals?: readonly CatalogApproval[];
   /** Present when a `breakGlass` override targets this permission. */
   readonly breakGlass?: CatalogBreakGlass;
@@ -72,7 +86,10 @@ type CatalogResource = {
     readonly field: string;
     readonly resource: string;
   }>>;
-  /** `'hide'` answers a denied check on a loaded row as if the row did not exist; absent for `'reveal'`. */
+  /**
+   * `'hide'` answers a denied check on a loaded row as if the row did not
+   * exist; absent for `'reveal'`.
+   */
   readonly disclosure?: "hide";
   readonly relations?: Readonly<Record<string, ResourceRelation>>;
   /** The row field an `approval: { staleOn: 'resource-change' }` binds to. */
@@ -97,7 +114,10 @@ type CatalogRole = {
   readonly for?: readonly string[];
   readonly exclusiveWith?: readonly string[];
   readonly audience?: string;
-  /** Present when the role is eligible-only and activated with `permdock.activate`. */
+  /**
+   * Present when the role is eligible-only and activated with
+   * `permdock.activate`.
+   */
   readonly activation?: CatalogActivation;
   /** Present when the role is a `supportAccess` role. */
   readonly supportAccess?: CatalogSupportAccess;
@@ -133,9 +153,9 @@ type CatalogValidity = {
   readonly until?: string;
 };
 /**
- * One code grant as the catalog carries it: the normalised shape
- * `definePolicy` produced, minus closures. `permdock diff` compares these;
- * a hosted document is authored against them.
+ * One code grant as the catalog carries it: the normalised shape `definePolicy`
+ * produced, minus closures. `permdock diff` compares these; a hosted document
+ * is authored against them.
  */
 type CatalogGrant = {
   readonly permission: string;
@@ -157,7 +177,10 @@ type CatalogGrant = {
   readonly validity?: CatalogValidity;
   readonly name?: string;
   readonly purpose?: readonly string[];
-  /** The permission key the subject must also hold through a role on the row's scope instance (`requires`). */
+  /**
+   * The permission key the subject must also hold through a role on the row's
+   * scope instance (`requires`).
+   */
   readonly requires?: string | readonly string[];
   readonly limit?: {
     readonly count: number;
@@ -165,9 +188,15 @@ type CatalogGrant = {
     readonly per: number;
     readonly mode?: "hard" | "soft";
   };
-  /** Present when the grant is a closure, reads the relation graph or is opaque; `where` and `check` are then omitted. */
+  /**
+   * Present when the grant is a closure, reads the relation graph or is opaque;
+   * `where` and `check` are then omitted.
+   */
   readonly portable?: false;
-  /** The grant's `meta`: a description plus the app's own `x`; absent when empty. */
+  /**
+   * The grant's `meta`: a description plus the app's own `x`; absent when
+   * empty.
+   */
   readonly meta?: Readonly<Record<string, unknown>>;
 };
 /** `permissions.catalog.json`, validated by `schemas/catalog-v1.json`. */
@@ -176,7 +205,10 @@ type CatalogDocument = {
   readonly version: 1;
   readonly generatedAt: string;
   readonly generator: string;
-  /** `catalogFingerprint` of this document; what hosted documents pin as `catalog`. */
+  /**
+   * `catalogFingerprint` of this document; what hosted documents pin as
+   * `catalog`.
+   */
   readonly fingerprint?: string;
   readonly resources: Readonly<Record<string, CatalogResource>>;
   readonly permissions: readonly CatalogPermission[];
@@ -186,28 +218,49 @@ type CatalogDocument = {
   readonly plans?: readonly {
     readonly key: string;
   }[];
-  /** Every code grant, canonically ordered; present when the catalog was built with the policy. */
+  /**
+   * Every code grant, canonically ordered; present when the catalog was built
+   * with the policy.
+   */
   readonly grants?: readonly CatalogGrant[];
-  /** The policy's standing delegations, canonically ordered; present when the policy declares any. */
+  /**
+   * The policy's standing delegations, canonically ordered; present when the
+   * policy declares any.
+   */
   readonly delegations?: readonly CatalogDelegation[];
-  /** The `defineOperations` map in definition order; present when the config names an `operations` module. */
+  /**
+   * The `defineOperations` map in definition order; present when the config
+   * names an `operations` module.
+   */
   readonly operations?: readonly CatalogOperation[];
-  /** The policy's coarse OAuth scopes, sorted by scope; present when the policy declares any. */
+  /**
+   * The policy's coarse OAuth scopes, sorted by scope; present when the policy
+   * declares any.
+   */
   readonly oauthScopes?: readonly CatalogOAuthScope[];
 };
-/** One `definePolicy({ oauthScopes })` entry: the coarse scope an authorization server issues and the permission keys it covers, sorted by code point. */
+/**
+ * One `definePolicy({ oauthScopes })` entry: the coarse scope an authorization
+ * server issues and the permission keys it covers, sorted by code point.
+ */
 type CatalogOAuthScope = {
   readonly scope: string;
   readonly permissions: readonly string[];
 };
-/** One `defineOperations` entry: its name, the permission keys it is bound to, and its meta. */
+/**
+ * One `defineOperations` entry: its name, the permission keys it is bound to,
+ * and its meta.
+ */
 type CatalogOperation = {
   readonly name: string;
   readonly permission: string;
   readonly results?: string;
   readonly meta: OperationMeta;
 };
-/** One `definePolicy({ delegations })` entry: who hands over, to which actor, which permission keys, and when. */
+/**
+ * One `definePolicy({ delegations })` entry: who hands over, to which actor,
+ * which permission keys, and when.
+ */
 type CatalogDelegation = {
   readonly from: unknown;
   readonly to: {