permdock 0.7.0 → 0.9.0

package/dist/{types-DBHftjgS.d.ts → types-BB-zWDcR.d.ts}

@@ -1,15 +1,18 @@
-import { dt as TokenVerifier, lr as Subject, ot as SnapshotSource, q as DecisionSink, ut as TokenSigner } from "./policy-types-B-F-qAZk.js";
-import { s as PolicySource } from "./hosted-BmjzxQhp.js";
-import { m as ApprovalStore, u as ApprovalRequest } from "./types-DC44-hqb.js";
-import { a as CatalogDocument } from "./types-BXMYB7BY.js";
-import { a as CatalogFinding } from "./sink-Cp_Eot9W.js";
+import { J as DecisionSink, ct as SnapshotSource, hr as Subject, ht as TokenVerifier, mt as TokenSigner } from "./policy-types-DGIO_gxq.js";
+import { s as PolicySource } from "./hosted-DVxlLZMe.js";
+import { m as ApprovalStore, u as ApprovalRequest } from "./types-DLvhVm1r.js";
+import { a as CatalogDocument } from "./types-ZzRGoViD.js";
+import { a as CatalogFinding } from "./sink-B5zoUW_O.js";
 //#region src/cloud/types.d.ts
 type CloudEndpointOptions = {
   readonly url?: string;
   readonly environment?: string;
 };
 type CloudEndpoints = {
-  /** The environment URL, `<url>/v1/environments/<env>`: `iss` and `aud` of the policy document. */
+  /**
+   * The environment URL, `<url>/v1/environments/<env>`: `iss` and `aud` of the
+   * policy document.
+   */
   readonly issuer: string;
   /** The environment's JWK Set URL, for `joseTokenVerifier({ jwks })`. */
   readonly jwks: string;
@@ -24,51 +27,60 @@ type CloudConnectionOptions = CloudEndpointOptions & {
 type CloudApproverOptions = {
   /**
    * Signs the token with a key the environment trusts as an issuer, such as
-   * `joseTokenSigner` over your own key. Never `cloudSigner`: a client key
-   * that could mint approver tokens could forge any approver.
+   * `joseTokenSigner` over your own key. Never `cloudSigner`: a client key that
+   * could mint approver tokens could forge any approver.
    */
   readonly signer: TokenSigner;
-  /** `aud` of the token; defaults to `<issuer>/approvals`, the environment URL plus `/approvals`. */
+  /**
+   * `aud` of the token; defaults to `<issuer>/approvals`, the environment URL
+   * plus `/approvals`.
+   */
   readonly audience?: string | readonly string[];
   /**
    * The `holder(permission)` approvers of `request` that `approver` holds,
    * typically `approverPermissions(request, permdockFor(approver))`. Signed
-   * into the token as `permissions`; without it the verdict's own
-   * `permissions` are signed. A throw signs none.
+   * into the token as `permissions`; without it the verdict's own `permissions`
+   * are signed. A throw signs none.
    */
   readonly permissions?: (request: ApprovalRequest, approver: Subject) => readonly string[] | Promise<readonly string[]>;
   /**
    * The relation approvers of `request` that `approver` holds, typically
-   * `approverRelations(request, approver, { relations, permissions })`.
-   * Signed into the token as `relations`; without it the verdict's own
-   * `relations` are signed. A throw signs none.
+   * `approverRelations(request, approver, { relations, permissions })`. Signed
+   * into the token as `relations`; without it the verdict's own `relations` are
+   * signed. A throw signs none.
    */
   readonly relations?: (request: ApprovalRequest, approver: Subject) => readonly string[] | Promise<readonly string[]>;
 };
 type CloudOptions = CloudConnectionOptions & {
   /**
-   * Proves the approver on `approvals.resolve`. Without it, every resolve but
-   * a `system` rejection throws `approver-unauthenticated` and sends nothing.
+   * Proves the approver on `approvals.resolve`. Without it, every resolve but a
+   * `system` rejection throws `approver-unauthenticated` and sends nothing.
    */
   readonly approver?: CloudApproverOptions;
   readonly flushAt?: number;
-  /** Most events the sink holds while the Cloud is unreachable (default 10 000); the oldest are dropped first. */
+  /**
+   * Most events the sink holds while the Cloud is unreachable (default 10 000);
+   * the oldest are dropped first.
+   */
   readonly capacity?: number;
   readonly waitUntil?: (task: Promise<void>) => void;
-  /** The CloudEvents `source` of every event the sink sends, an absolute URI; defaults to the environment URL. */
+  /**
+   * The CloudEvents `source` of every event the sink sends, an absolute URI;
+   * defaults to the environment URL.
+   */
   readonly source?: string;
   /**
-   * Verifies the environment's signed policy document, typically
-   * `({ jwks }) => joseTokenVerifier({ jwks })`. A function is called once,
-   * with the resolved endpoints, on the first refresh. Without one,
-   * `policies.current()` stays `null`: an unverifiable document is never applied.
+   * Verifies the environment's signed policy document, typically `({ jwks }) =>
+   * joseTokenVerifier({ jwks })`. A function is called once, with the resolved
+   * endpoints, on the first refresh. Without one, `policies.current()` stays
+   * `null`: an unverifiable document is never applied.
    */
   readonly verifier?: TokenVerifier | ((endpoints: CloudEndpoints) => TokenVerifier);
 };
 /**
  * What `POST /catalog` answers: `201` with the new version and the drift
- * findings against the previous one, or `200` with `unchanged: true` when
- * the fingerprint is already published.
+ * findings against the previous one, or `200` with `unchanged: true` when the
+ * fingerprint is already published.
  */
 type CloudCatalogPush = {
   readonly version: number;
@@ -81,19 +93,19 @@ type CloudCatalogPush = {
 };
 type CloudCatalog = {
   /**
-   * Posts the catalog, its `operations` included, to the environment.
-   * Throws when the Cloud refuses it or answers another shape. The Cloud
-   * shows and diffs it; it never decides with it.
+   * Posts the catalog, its `operations` included, to the environment. Throws
+   * when the Cloud refuses it or answers another shape. The Cloud shows and
+   * diffs it; it never decides with it.
    */
-  push(catalog: CatalogDocument): Promise<CloudCatalogPush>;
+  push: (catalog: CatalogDocument) => Promise<CloudCatalogPush>;
 };
 type CloudClient = Partial<CloudEndpoints> & {
   /**
-   * The environment URL and JWK Set URL. `issuer` and `jwks` are set only
-   * when the environment is configured; otherwise the first call asks
-   * `GET /v1/environment` which environment the key belongs to.
+   * The environment URL and JWK Set URL. `issuer` and `jwks` are set only when
+   * the environment is configured; otherwise the first call asks `GET
+   * /v1/environment` which environment the key belongs to.
    */
-  endpoints(): Promise<CloudEndpoints>;
+  endpoints: () => Promise<CloudEndpoints>;
   readonly approvals: ApprovalStore;
   readonly sink: DecisionSink;
   /**
@@ -102,7 +114,7 @@ type CloudClient = Partial<CloudEndpoints> & {
    * signed. Sent as `PermDock-Subject`; the Cloud never takes a subject from
    * anything else.
    */
-  snapshotsFor(token: string): SnapshotSource;
+  snapshotsFor: (token: string) => SnapshotSource;
   readonly policies: PolicySource;
   readonly catalog: CloudCatalog;
 };

package/dist/{types-BfVmNJO5.d.ts → types-BMVDHvI0.d.ts}

@@ -1,9 +1,12 @@
-import { Zt as AuthEvent, sr as Principal } from "./policy-types-B-F-qAZk.js";
-import { t as ClaimsMap } from "./claims-map-Ca-QX8C6.js";
-import { t as ClientNames } from "./clients-C7zLFuWT.js";
+import { pr as Principal, rn as AuthEvent } from "./policy-types-DGIO_gxq.js";
+import { t as ClaimsMap } from "./claims-map-D1Pb5oRq.js";
+import { t as ClientNames } from "./clients-C_NOET3z.js";
 import { StandardSchemaV1 } from "@standard-schema/spec";
 //#region src/supabase/claims.d.ts
-/** One entry of the `memberships` claim, as `schemas/supabase-claims-v1.json` defines it. */
+/**
+ * One entry of the `memberships` claim, as `schemas/supabase-claims-v1.json`
+ * defines it.
+ */
 type SupabaseMembershipClaim = {
   readonly scope?: string;
   /** Canonical text of the scope instance id, compared exactly. */
@@ -28,7 +31,10 @@ type SupabaseMembershipClaim = {
   };
   readonly managed_by?: "idp";
   readonly entitlements?: readonly string[];
-  /** The instance or an ancestor is suspended: the permission keys the membership still grants. */
+  /**
+   * The instance or an ancestor is suspended: the permission keys the
+   * membership still grants.
+   */
   readonly keep?: readonly string[];
   /** Custom roles in compact form, read by the RLS helpers in `jwt` mode. */
   readonly grants?: Readonly<Record<string, unknown>>;
@@ -47,9 +53,15 @@ type SupabasePermDockClaims<TenantClaim extends string = "tenant_id"> = {
   readonly memberships?: readonly SupabaseMembershipClaim[];
   /** `true` when the size budget cut `memberships` or `attrs`. */
   readonly memberships_truncated?: boolean;
-  /** Allow-listed server-owned attributes, read as `principal.claims.attrs.<key>`. */
+  /**
+   * Allow-listed server-owned attributes, read as
+   * `principal.claims.attrs.<key>`.
+   */
   readonly attrs?: Readonly<Record<string, unknown>>;
-  /** The uuid of every team the user belongs to (`supabase.hook.teams`), cut by the same budget as `memberships`. */
+  /**
+   * The uuid of every team the user belongs to (`supabase.hook.teams`), cut by
+   * the same budget as `memberships`.
+   */
   readonly team_ids?: readonly string[];
   /** The principal's authorization version. */
   readonly authz_ver?: number;
@@ -75,10 +87,13 @@ type SupabaseClaims<TenantClaim extends string = "tenant_id"> = SupabasePermDock
  * are combined, and the app's output is merged over the base.
  */
 type SupabaseClaimsSchema<TenantClaim extends string = "tenant_id", Extra = unknown> = StandardSchemaV1<unknown, SupabaseClaims<TenantClaim> & Extra> & {
-  extend<App extends StandardSchemaV1>(app: App): SupabaseClaimsSchema<TenantClaim, Extra & StandardSchemaV1.InferOutput<App>>;
+  extend: <App extends StandardSchemaV1>(app: App) => SupabaseClaimsSchema<TenantClaim, Extra & StandardSchemaV1.InferOutput<App>>;
 };
 type SupabaseClaimsOptions<TenantClaim extends string = "tenant_id"> = {
-  /** The claim holding the active tenant; `rls.tenantClaim`, default `tenant_id`. */
+  /**
+   * The claim holding the active tenant; `rls.tenantClaim`, default
+   * `tenant_id`.
+   */
   readonly tenantClaim?: TenantClaim;
 };
 /**
@@ -88,7 +103,9 @@ type SupabaseClaimsOptions<TenantClaim extends string = "tenant_id"> = {
  * Needs no validation library.
  *
  * ```ts
- * sb.claims(supabaseClaims().extend(z.object({ datetime_preferences: Prefs })))
+ * sb.claims(
+ *   supabaseClaims().extend(z.object({ datetime_preferences: Prefs })),
+ * );
  * ```
  */
 declare function supabaseClaims<TenantClaim extends string = "tenant_id">(options?: SupabaseClaimsOptions<TenantClaim>): SupabaseClaimsSchema<TenantClaim>;
@@ -102,14 +119,17 @@ type SupabasePrincipal = Principal & {
 };
 type SupabaseInclude = "email" | "phone" | "is_anonymous";
 /**
- * A column that holds a foreign key: the value is `column` of `through`,
- * joined on `on`. A role reads its key from a roles table
- * (`{ through: 'roles', on: { role_id: 'id' }, column: 'key' }`); a
- * membership source's user can read its user id from a profile table
- * (`{ through: 'contact_profiles', on: { contact_profile_id: 'id' }, column: 'user_id' }`).
+ * A column that holds a foreign key: the value is `column` of `through`, joined
+ * on `on`. A role reads its key from a roles table (`{ through: 'roles', on: {
+ * role_id: 'id' }, column: 'key' }`); a membership source's user can read its
+ * user id from a profile table (`{ through: 'contact_profiles', on: {
+ * contact_profile_id: 'id' }, column: 'user_id' }`).
  */
 type RoleThrough = {
-  /** The referenced table; unqualified, it is in the schema of the table that references it. */
+  /**
+   * The referenced table; unqualified, it is in the schema of the table that
+   * references it.
+   */
   readonly through: string;
   /** One entry: the referencing column to the column of `through` it references. */
   readonly on: Readonly<Record<string, string>>;
@@ -118,8 +138,8 @@ type RoleThrough = {
 };
 /**
  * A role column whose values are not role keys: each value maps to a role key,
- * or to `null` for no role, and an unlisted value is no role
- * (`{ column: 'kind', map: { admin: 'owner', user: null } }`).
+ * or to `null` for no role, and an unlisted value is no role (`{ column:
+ * 'kind', map: { admin: 'owner', user: null } }`).
  */
 type RoleMap = {
   readonly column: string;
@@ -133,7 +153,10 @@ type SupabaseMembershipTable = {
    * several of them: the row holds every non-null key.
    */
   readonly role: string | RoleThrough | RoleMap | readonly (string | RoleThrough | RoleMap)[];
-  /** Per scope name, the column holding that scope's id: the table's own scope and its ancestors. */
+  /**
+   * Per scope name, the column holding that scope's id: the table's own scope
+   * and its ancestors.
+   */
   readonly columns?: Readonly<Record<string, string>>;
   readonly tenant?: string;
   readonly team?: string;
@@ -141,7 +164,10 @@ type SupabaseMembershipTable = {
   readonly expiresAt?: string;
   readonly disabledAt?: string;
 };
-/** A table whose row says whether a user or a scope instance is active. A missing row counts as suspended. */
+/**
+ * A table whose row says whether a user or a scope instance is active. A
+ * missing row counts as suspended.
+ */
 type SupabaseActiveRow = {
   readonly table: string;
   /** Column holding the user id or the scope instance id. */
@@ -152,12 +178,15 @@ type SupabaseActiveRow = {
   readonly status?: string;
   readonly active?: readonly string[];
 };
-/** A scope's active-row table, with the permissions its suspended instances keep. */
+/**
+ * A scope's active-row table, with the permissions its suspended instances
+ * keep.
+ */
 type SupabaseSuspendedScope = SupabaseActiveRow & {
   /**
    * Permissions (references or keys) members of a suspended instance, and of
-   * every instance nested in it, still hold; such a membership carries them
-   * as `keep`.
+   * every instance nested in it, still hold; such a membership carries them as
+   * `keep`.
    */
   readonly keep?: readonly (string | {
     readonly key: string;
@@ -171,7 +200,10 @@ type SupabaseSuspendedMembership = {
 type SupabaseSuspension = {
   /** A suspended user holds no role and no membership. */
   readonly users?: SupabaseActiveRow;
-  /** Per scope name: a suspended instance voids its memberships and every membership nested under it, except for `keep`. */
+  /**
+   * Per scope name: a suspended instance voids its memberships and every
+   * membership nested under it, except for `keep`.
+   */
   readonly scopes?: Readonly<Record<string, SupabaseSuspendedScope>>;
   readonly memberships?: SupabaseSuspendedMembership;
 };
@@ -183,25 +215,42 @@ type SupabaseMemberships = {
   readonly resource?: Readonly<Record<string, SupabaseMembershipTable>>;
 };
 type AuthorizeSqlOptions = {
-  /** Postgres schema of `authorize`, `user_roles`, `role_permissions` and `app_permission`. Default `permdock`. */
+  /**
+   * Postgres schema of `authorize`, `user_roles`, `role_permissions` and
+   * `app_permission`. Default `permdock`.
+   */
   readonly schema?: string;
-  /** `database` (default) reads the tables on every call; `jwt` reads the hook-injected claims. */
+  /**
+   * `database` (default) reads the tables on every call; `jwt` reads the
+   * hook-injected claims.
+   */
   readonly authorize?: "database" | "jwt";
-  /** The policy's first scope, which `requested_tenant` is an instance of. Default `tenant`. */
+  /**
+   * The policy's first scope, which `requested_tenant` is an instance of.
+   * Default `tenant`.
+   */
   readonly scope?: string;
-  /** Membership table for tenant requests in `database` mode; without one they deny. */
+  /**
+   * Membership table for tenant requests in `database` mode; without one they
+   * deny.
+   */
   readonly tenant?: boolean | SupabaseMembershipTable;
   /**
-   * Tenant requests also answer from custom roles, through the `permdock_custom_keys` function
-   * `permdock rls generate --custom-roles` emits: the `custom_role_*` tables in `database` mode,
-   * the `memberships[].grants` claim in `jwt` mode. `declared` role names never resolve as custom.
+   * Tenant requests also answer from custom roles, through the
+   * `permdock_custom_keys` function `permdock rls generate --custom-roles`
+   * emits: the `custom_role_*` tables in `database` mode, the
+   * `memberships[].grants` claim in `jwt` mode. `declared` role names never
+   * resolve as custom.
    */
   readonly customRoles?: {
     readonly declared: readonly string[];
     /** Stored allows may carry a level (`custom_role_permissions.level`). */
     readonly levels?: true;
   };
-  /** A suspended user, or a suspended instance of `scope` for a tenant request, answers `false`. */
+  /**
+   * A suspended user, or a suspended instance of `scope` for a tenant request,
+   * answers `false`.
+   */
   readonly suspension?: SupabaseSuspension;
 };
 /** A permission reference; `rls generate` reads only its `key`. */
@@ -220,7 +269,10 @@ type SupabaseRealtime = {
     readonly write?: SupabasePermissionRef;
   }>>;
 };
-/** Storage buckets whose object paths hold a scope instance id in folder `folder` (default 1). */
+/**
+ * Storage buckets whose object paths hold a scope instance id in folder
+ * `folder` (default 1).
+ */
 type SupabaseStorage = {
   readonly buckets: Readonly<Record<string, {
     readonly scope: string;
@@ -233,26 +285,39 @@ type SupabaseStorage = {
 type SupabaseRlsOptions = {
   readonly roleClaim?: string;
   readonly tenantClaim?: string;
-  /** Postgres type of tenant columns; the tenant claim is cast to it. `rls generate` defaults to `uuid`. */
+  /**
+   * Postgres type of tenant columns; the tenant claim is cast to it. `rls
+   * generate` defaults to `uuid`.
+   */
   readonly tenantType?: string;
   readonly memberships?: SupabaseMembershipTable | SupabaseMemberships;
   readonly suspension?: SupabaseSuspension;
   readonly realtime?: SupabaseRealtime;
   readonly storage?: SupabaseStorage;
 };
+/**
+ * A membership table as `permdock.config.ts` names it: scope columns in
+ * `columns`.
+ */
+type SupabaseRlsMembershipTable = Omit<SupabaseMembershipTable, "tenant" | "team">;
 type SupabaseRlsConfig = {
   readonly dialect: "supabase";
   readonly roleClaim: string;
   readonly tenantClaim: string;
-  readonly tenantType?: string;
-  readonly memberships?: SupabaseMemberships;
+  /** `tenantType` as the type of the first scope, under its `tenant` alias. */
+  readonly scopeTypes?: Readonly<Record<string, string>>;
+  readonly memberships?: {
+    readonly scopes?: Readonly<Record<string, SupabaseRlsMembershipTable>>;
+    readonly resource?: Readonly<Record<string, SupabaseRlsMembershipTable>>;
+  };
   readonly suspension?: SupabaseSuspension;
   readonly realtime?: SupabaseRealtime;
   readonly storage?: SupabaseStorage;
 };
 /**
- * The structural shape `subjectFromSupabaseSession` reads: a discriminant and the verified JWT claims.
- * Matches any session object of that shape without importing its library.
+ * The structural shape `subjectFromSupabaseSession` reads: a discriminant and
+ * the verified JWT claims. Matches any session object of that shape without
+ * importing its library.
  */
 type SupabaseSessionLike = {
   readonly kind: string;
@@ -270,25 +335,38 @@ type SupabaseSubjectOptions = {
   readonly schema?: StandardSchemaV1;
   readonly include?: readonly SupabaseInclude[];
   readonly declared?: readonly string[];
-  /** Names for OAuth client ids: an `oauth-client` actor gets `client` set to the name of its id, which a policy delegation matches with `to: { kind: 'oauth-client', client }`. */
+  /**
+   * Names for OAuth client ids: an `oauth-client` actor gets `client` set to
+   * the name of its id, which a policy delegation matches with `to: { kind:
+   * 'oauth-client', client }`.
+   */
   readonly clients?: ClientNames;
-  /** `'deny'` maps a token with `is_anonymous: true` (`signInAnonymously()`) to the anonymous subject, as `rls.anonymousSignIns: 'deny'` does in RLS. */
+  /**
+   * `'deny'` maps a token with `is_anonymous: true` (`signInAnonymously()`) to
+   * the anonymous subject, as `rls.anonymousSignIns: 'deny'` does in RLS.
+   */
   readonly anonymousSignIns?: "deny";
   /**
-   * `true` once the caller checked the session against the Auth server for this request
-   * (`auth.getUser()` or an equivalent session check): a token with a `session_id` gets
-   * `subject.liveSession`, which `{ subject: { session: { live: true } } }` requires. Never read from claims.
+   * `true` once the caller checked the session against the Auth server for this
+   * request (`auth.getUser()` or an equivalent session check): a token with a
+   * `session_id` gets `subject.liveSession`, which `{ subject: { session: {
+   * live: true } } }` requires. Never read from claims.
    */
   readonly liveSession?: boolean;
-  /** Audit hook: `membership-dropped` for a `memberships` entry that could not be read, `invalid-chain` for a malformed `act`. */
+  /**
+   * Audit hook: `membership-dropped` for a `memberships` entry that could not
+   * be read, `invalid-chain` for a malformed `act`.
+   */
   readonly onAuth?: (event: AuthEvent) => void;
 };
 /**
- * Who acts for the user. `oauth-client`: a third-party app or an agent chain (`client_id`, or an
- * `act` without `kind`). `support`: a support session (`act.kind: "support"` with `session_id`).
- * `impersonation`: an admin acting as the user (`act.kind: "impersonation"`). `agent`: an agent
- * run better-supabase's `agentClaims` minted (`act.kind: "agent"`), with the `tools` it may call.
- * `chain` is a copy of the token's `act` claim when it has one.
+ * Who acts for the user. `oauth-client`: a third-party app or an agent chain
+ * (`client_id`, or an `act` without `kind`). `support`: a support session
+ * (`act.kind: "support"` with `session_id`). `impersonation`: an admin acting
+ * as the user (`act.kind: "impersonation"`). `agent`: an agent run
+ * better-supabase's `agentClaims` minted (`act.kind: "agent"`), with the
+ * `tools` it may call. `chain` is a copy of the token's `act` claim when it has
+ * one.
  */
 type SupabaseActor = {
   readonly id: string;
@@ -326,4 +404,4 @@ type SupabaseDelegation = {
   readonly scopes: readonly string[];
 };
 //#endregion
-export { SupabaseClaimsOptions as C, supabaseClaims as D, SupabasePermDockClaims as E, SupabaseClaims as S, SupabaseMembershipClaim as T, SupabaseSubjectOptions as _, SupabaseActor as a, SupabaseSuspension as b, SupabaseInclude as c, SupabasePrincipal as d, SupabaseRealtime as f, SupabaseStorage as g, SupabaseSessionLike as h, SupabaseActiveRow as i, SupabaseMembershipTable as l, SupabaseRlsOptions as m, RoleMap as n, SupabaseActorResult as o, SupabaseRlsConfig as p, RoleThrough as r, SupabaseDelegation as s, AuthorizeSqlOptions as t, SupabasePermissionRef as u, SupabaseSuspendedMembership as v, SupabaseClaimsSchema as w, SupabaseActClaim as x, SupabaseSuspendedScope as y };
+export { SupabaseClaims as C, SupabasePermDockClaims as D, SupabaseMembershipClaim as E, supabaseClaims as O, SupabaseActClaim as S, SupabaseClaimsSchema as T, SupabaseStorage as _, SupabaseActor as a, SupabaseSuspendedScope as b, SupabaseInclude as c, SupabasePrincipal as d, SupabaseRealtime as f, SupabaseSessionLike as g, SupabaseRlsOptions as h, SupabaseActiveRow as i, SupabaseMembershipTable as l, SupabaseRlsMembershipTable as m, RoleMap as n, SupabaseActorResult as o, SupabaseRlsConfig as p, RoleThrough as r, SupabaseDelegation as s, AuthorizeSqlOptions as t, SupabasePermissionRef as u, SupabaseSubjectOptions as v, SupabaseClaimsOptions as w, SupabaseSuspension as x, SupabaseSuspendedMembership as y };

package/dist/{types-DXmwu78Z.d.ts → types-CEinc15V.d.ts}

@@ -1,15 +1,15 @@
-import { Gt as Snapshot, In as ApprovalRequiredDecision, Ln as Decision, Un as GrantedDecision, dt as TokenVerifier } from "./policy-types-B-F-qAZk.js";
-import { u as Permission } from "./permission-types-DhNEmoRG.js";
-import { a as PermDock } from "./permdock-Dco6dyCK.js";
-import { t as PermissionBoundaryState } from "./boundary-BmHxVH1J.js";
-import { l as PermissionState, m as ClientStore, u as ProviderOptionsBase } from "./types-CKV71kKh.js";
+import { Hn as ApprovalRequiredDecision, Un as Decision, Yn as GrantedDecision, Zt as Snapshot, ht as TokenVerifier } from "./policy-types-DGIO_gxq.js";
+import { u as Permission } from "./permission-types-CAY-GU7e.js";
+import { a as PermDock } from "./permdock-CprAPN3w.js";
+import { t as PermissionBoundaryState } from "./boundary-C9ck-3uK.js";
+import { t as ActionResult } from "./action-result-BcudBQOF.js";
+import { d as ProtectedActionView, f as ProviderOptionsBase, g as ClientStore, l as PermissionState } from "./types-tQB2CEnY.js";
 import { Snippet } from "svelte";
 import { Readable } from "svelte/store";
 //#region src/client/views.d.ts
 /**
  * What `Protected` renders: `pending` while an endpoint answer is in flight,
- * `approval` for an approval-required decision, `denied` for any other
- * denial.
+ * `approval` for an approval-required decision, `denied` for any other denial.
  */
 type ProtectedView = (PermissionState & {
   readonly slot: "pending" | "denied";
@@ -59,21 +59,30 @@ type ProtectedProps = {
   /** Rendered for an approval-required decision; defaults to `denied`. */
   readonly approval?: Snippet<[ApprovalRequiredDecision]>;
 };
-/** The instance for `tenant`, built once per store change rather than once per check. */
+/**
+ * The instance for `tenant`, built once per store change rather than once per
+ * check.
+ */
 declare function scopedFor(store: ClientStore, tenant: string | undefined, _generation?: number): PermDock | undefined;
 declare function viewFor(store: ClientStore, reference: Permission, data: unknown, scoped: PermDock | undefined, _generation?: number): ProtectedView;
 //#endregion
 //#region src/svelte/types.d.ts
 type SveltePermDockOptions = ProviderOptionsBase & {
   /**
-   * A getter (`() => data.snapshot`) or a readable store re-hydrates the
-   * store when it changes; a promise keeps the store `pending` until it
-   * settles (render the same promise with `{#await}`).
+   * A getter (`() => data.snapshot`) or a readable store re-hydrates the store
+   * when it changes; a promise keeps the store `pending` until it settles
+   * (render the same promise with `{#await}`).
    */
   readonly snapshot: Snapshot | string | (() => Snapshot | string) | Readable<Snapshot | string> | PromiseLike<Snapshot | string>;
-  /** A getter (`() => page.params.org`) switches the active tenant (`refresh({ tenant })`) when it changes. */
+  /**
+   * A getter (`() => page.params.org`) switches the active tenant (`refresh({
+   * tenant })`) when it changes.
+   */
   readonly tenant?: string | (() => string | undefined);
-  /** A getter is read on every request, so a rotated token applies without a new store. */
+  /**
+   * A getter is read on every request, so a rotated token applies without a new
+   * store.
+   */
   readonly headers?: Readonly<Record<string, string>> | (() => Readonly<Record<string, string>> | undefined);
   readonly verifier?: TokenVerifier;
   /** What every `<Protected>` renders for a snippet it leaves out. */
@@ -85,5 +94,13 @@ type PermDockDefaults = {
   readonly denied?: Snippet<[Decision]>;
   readonly approval?: Snippet<[ApprovalRequiredDecision]>;
 };
+/**
+ * `protectedAction` in Svelte: a readable store of the view, with `run` and
+ * `retry`.
+ */
+type ProtectedActionReadable<T> = Readable<ProtectedActionView<T>> & {
+  readonly run: (input: unknown) => Promise<ActionResult<T>>;
+  readonly retry: () => Promise<ActionResult<T> | undefined>;
+};
 //#endregion
-export { viewFor as a, scopedFor as i, SveltePermDockOptions as n, PermissionBoundaryProps as o, ProtectedProps as r, slotContent as s, PermDockDefaults as t };
+export { scopedFor as a, slotContent as c, ProtectedProps as i, ProtectedActionReadable as n, viewFor as o, SveltePermDockOptions as r, PermissionBoundaryProps as s, PermDockDefaults as t };