@adaptive-ds/project-registry 0.2.3

package/LICENSE

@@ -0,0 +1,22 @@
+
+MIT License
+
+Copyright (c) 2025 David Siewert
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -0,0 +1,40 @@
+# @adaptive-ds/project-registry
+
+A project model for the machine-wide Adaptive Project Registry.
+
+Package name follows the rest of the stack: `@adaptive-ds/` plus the folder name.
+
+## Install
+
+```bash
+bun add @adaptive-ds/project-registry
+```
+
+## Usage
+
+```typescript
+import { projectList, projectNormalize } from "@adaptive-ds/project-registry"
+
+const normalized = projectNormalize({
+  owner: "david",
+  name: "project-registry",
+  description: "Adaptive project catalog",
+})
+if (!normalized.success) return normalized
+
+console.log(projectList([normalized.data]).data.map((project) => project.name))
+```
+
+Project identity is the `(owner, name)` pair. Normalization validates the combined registry and Caddy model, and listing applies deterministic Software-compatible ordering. Fallible operations return a `Result` from `@adaptive-ds/result`.
+
+## Scripts
+
+- `bun run dev` watch tests
+- `bun run test` run tests once
+- `bun run build` emit `dist/`
+- `bun run format` biome format
+- `bun run release` version, changelog, GitHub release
+
+## License
+
+MIT

package/dist/access/Actor.d.ts

@@ -0,0 +1,7 @@
+import type { Role } from "./Role.js";
+export type Actor = {
+    subject: string | null;
+    username: string;
+    role: Role | undefined;
+};
+//# sourceMappingURL=Actor.d.ts.map

package/dist/access/Actor.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"Actor.d.ts","sourceRoot":"","sources":["../../src/access/Actor.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,WAAW,CAAA;AAErC,MAAM,MAAM,KAAK,GAAG;IAClB,OAAO,EAAE,MAAM,GAAG,IAAI,CAAA;IACtB,QAAQ,EAAE,MAAM,CAAA;IAChB,IAAI,EAAE,IAAI,GAAG,SAAS,CAAA;CACvB,CAAA"}

package/dist/access/Actor.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=Actor.js.map

package/dist/access/Actor.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"Actor.js","sourceRoot":"","sources":["../../src/access/Actor.ts"],"names":[],"mappings":""}

package/dist/access/ProjectAccess.d.ts

@@ -0,0 +1,8 @@
+import type { PromiseResult } from "#result";
+import type { Actor } from "./Actor.js";
+import type { Role } from "./Role.js";
+export interface ProjectAccess {
+    actorResolve(): PromiseResult<Actor>;
+    ownerRoleResolve(owner: string): PromiseResult<Role | undefined>;
+}
+//# sourceMappingURL=ProjectAccess.d.ts.map

package/dist/access/ProjectAccess.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ProjectAccess.d.ts","sourceRoot":"","sources":["../../src/access/ProjectAccess.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,SAAS,CAAA;AAC5C,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,YAAY,CAAA;AACvC,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,WAAW,CAAA;AAErC,MAAM,WAAW,aAAa;IAC5B,YAAY,IAAI,aAAa,CAAC,KAAK,CAAC,CAAA;IACpC,gBAAgB,CAAC,KAAK,EAAE,MAAM,GAAG,aAAa,CAAC,IAAI,GAAG,SAAS,CAAC,CAAA;CACjE"}

package/dist/access/ProjectAccess.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=ProjectAccess.js.map

package/dist/access/ProjectAccess.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ProjectAccess.js","sourceRoot":"","sources":["../../src/access/ProjectAccess.ts"],"names":[],"mappings":""}

package/dist/access/ProjectAccessCreateOptions.d.ts

@@ -0,0 +1,27 @@
+import type { IdentityDirectory } from "../identity/IdentityDirectory.js";
+import type { PosixUserDirectory } from "../identity/PosixUserDirectory.js";
+import type { Clock } from "../session/Clock.js";
+import type { SessionStore } from "../session/SessionStore.js";
+import type { TokenReferenceStore } from "../session/TokenReferenceStore.js";
+export type ProjectAccessCreateOptions = {
+    identityDirectory: IdentityDirectory;
+    posixUsers: PosixUserDirectory;
+    transport: {
+        transport: "browser";
+        sessionId: string;
+        sessions: SessionStore;
+        tokenReferences: TokenReferenceStore;
+        clock?: Clock;
+        timeoutMs?: number;
+        signal?: AbortSignal;
+    } | {
+        transport: "unix";
+        username: string;
+        accessToken: string;
+        timeoutMs?: number;
+        signal?: AbortSignal;
+    };
+    timeoutMs?: number;
+    signal?: AbortSignal;
+};
+//# sourceMappingURL=ProjectAccessCreateOptions.d.ts.map

package/dist/access/ProjectAccessCreateOptions.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ProjectAccessCreateOptions.d.ts","sourceRoot":"","sources":["../../src/access/ProjectAccessCreateOptions.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,kCAAkC,CAAA;AACzE,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,mCAAmC,CAAA;AAC3E,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,qBAAqB,CAAA;AAChD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,4BAA4B,CAAA;AAC9D,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,mCAAmC,CAAA;AAE5E,MAAM,MAAM,0BAA0B,GAAG;IACvC,iBAAiB,EAAE,iBAAiB,CAAA;IACpC,UAAU,EAAE,kBAAkB,CAAA;IAC9B,SAAS,EACL;QACE,SAAS,EAAE,SAAS,CAAA;QACpB,SAAS,EAAE,MAAM,CAAA;QACjB,QAAQ,EAAE,YAAY,CAAA;QACtB,eAAe,EAAE,mBAAmB,CAAA;QACpC,KAAK,CAAC,EAAE,KAAK,CAAA;QACb,SAAS,CAAC,EAAE,MAAM,CAAA;QAClB,MAAM,CAAC,EAAE,WAAW,CAAA;KACrB,GACD;QACE,SAAS,EAAE,MAAM,CAAA;QACjB,QAAQ,EAAE,MAAM,CAAA;QAChB,WAAW,EAAE,MAAM,CAAA;QACnB,SAAS,CAAC,EAAE,MAAM,CAAA;QAClB,MAAM,CAAC,EAAE,WAAW,CAAA;KACrB,CAAA;IACL,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,MAAM,CAAC,EAAE,WAAW,CAAA;CACrB,CAAA"}

package/dist/access/ProjectAccessCreateOptions.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=ProjectAccessCreateOptions.js.map

package/dist/access/ProjectAccessCreateOptions.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ProjectAccessCreateOptions.js","sourceRoot":"","sources":["../../src/access/ProjectAccessCreateOptions.ts"],"names":[],"mappings":""}

package/dist/access/Role.d.ts

@@ -0,0 +1,2 @@
+export type Role = "own" | "admin" | "superadmin";
+//# sourceMappingURL=Role.d.ts.map

package/dist/access/Role.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"Role.d.ts","sourceRoot":"","sources":["../../src/access/Role.ts"],"names":[],"mappings":"AAAA,MAAM,MAAM,IAAI,GAAG,KAAK,GAAG,OAAO,GAAG,YAAY,CAAA"}

package/dist/access/Role.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=Role.js.map

package/dist/access/Role.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"Role.js","sourceRoot":"","sources":["../../src/access/Role.ts"],"names":[],"mappings":""}

package/dist/access/SuperadminOperation.d.ts

@@ -0,0 +1,2 @@
+export type SuperadminOperation = "caddy-config" | "caddy-status" | "caddy-regenerate";
+//# sourceMappingURL=SuperadminOperation.d.ts.map

package/dist/access/SuperadminOperation.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"SuperadminOperation.d.ts","sourceRoot":"","sources":["../../src/access/SuperadminOperation.ts"],"names":[],"mappings":"AAAA,MAAM,MAAM,mBAAmB,GAAG,cAAc,GAAG,cAAc,GAAG,kBAAkB,CAAA"}

package/dist/access/SuperadminOperation.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=SuperadminOperation.js.map

package/dist/access/SuperadminOperation.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"SuperadminOperation.js","sourceRoot":"","sources":["../../src/access/SuperadminOperation.ts"],"names":[],"mappings":""}

package/dist/access/projectAccessCreate.d.ts

@@ -0,0 +1,4 @@
+import type { ProjectAccess } from "./ProjectAccess.js";
+import type { ProjectAccessCreateOptions } from "./ProjectAccessCreateOptions.js";
+export declare function projectAccessCreate(options: ProjectAccessCreateOptions): ProjectAccess;
+//# sourceMappingURL=projectAccessCreate.d.ts.map

package/dist/access/projectAccessCreate.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"projectAccessCreate.d.ts","sourceRoot":"","sources":["../../src/access/projectAccessCreate.ts"],"names":[],"mappings":"AAWA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAA;AACvD,OAAO,KAAK,EAAE,0BAA0B,EAAE,MAAM,iCAAiC,CAAA;AAgOjF,wBAAgB,mBAAmB,CAAC,OAAO,EAAE,0BAA0B,GAAG,aAAa,CAStF"}

package/dist/access/projectAccessCreate.js

@@ -0,0 +1,180 @@
+import { createResult, createResultError } from "#result";
+import { preferredUsernameMap } from "../identity/preferredUsernameMap.js";
+import { userRoleResolve } from "../identity/userRoleResolve.js";
+import { clockNowResolve } from "../runtime/clockNowResolve.js";
+import { promiseBoundedRace } from "../runtime/promiseBoundedRace.js";
+import { sessionActorResolve } from "../session/sessionActorResolve.js";
+import { sessionRecordValidate } from "../session/sessionRecordValidate.js";
+import { tokenReferenceTokensValidate } from "../session/tokenReferenceTokensValidate.js";
+const maximumUsers = 10_000;
+function stringIsBounded(value, maximum) {
+    return typeof value === "string" && value.length > 0 && value.length <= maximum;
+}
+function operationOptionsResolve(options) {
+    const transport = options.transport;
+    return {
+        timeoutMs: transport.timeoutMs ?? options.timeoutMs,
+        signal: transport.signal ?? options.signal,
+    };
+}
+function identityUserValidate(value) {
+    const op = "projectAccessIdentityUserValidate";
+    if (typeof value !== "object" || value === null || Array.isArray(value)) {
+        return createResultError(op, "identity mapping is unavailable");
+    }
+    const user = value;
+    if (!stringIsBounded(user.subject, 256) || !stringIsBounded(user.preferredUsername, 256)) {
+        return createResultError(op, "identity mapping is unavailable");
+    }
+    return createResult({ subject: user.subject, preferredUsername: user.preferredUsername });
+}
+function identityUsersValidate(value) {
+    const op = "projectAccessIdentityUsersResolve";
+    if (!Array.isArray(value) || value.length > maximumUsers) {
+        return createResultError(op, "identity mapping is unavailable");
+    }
+    const subjects = new Set();
+    const usernames = new Set();
+    const users = [];
+    for (const entry of value) {
+        const userR = identityUserValidate(entry);
+        if (!userR.success)
+            return userR;
+        if (subjects.has(userR.data.subject) || usernames.has(userR.data.preferredUsername)) {
+            return createResultError(op, "identity mapping is unavailable");
+        }
+        subjects.add(userR.data.subject);
+        usernames.add(userR.data.preferredUsername);
+        users.push(userR.data);
+    }
+    return createResult(users);
+}
+async function identityUsersResolve(accessToken, options) {
+    const operationOptions = operationOptionsResolve(options);
+    if (!stringIsBounded(accessToken, 8_192)) {
+        return createResultError("projectAccessIdentityUsersResolve", "identity mapping is unavailable");
+    }
+    try {
+        const usersR = await promiseBoundedRace(Promise.resolve().then(() => options.identityDirectory.usersList(accessToken)), operationOptions);
+        if (!usersR.success || !usersR.data.success) {
+            return createResultError("projectAccessIdentityUsersResolve", "identity mapping is unavailable");
+        }
+        return identityUsersValidate(usersR.data.data);
+    }
+    catch {
+        return createResultError("projectAccessIdentityUsersResolve", "identity mapping is unavailable");
+    }
+}
+async function browserIdentityResolve(options) {
+    const operationOptions = operationOptionsResolve(options);
+    const actorOptions = {
+        sessions: options.transport.sessions,
+        tokenReferences: options.transport.tokenReferences,
+        identityDirectory: options.identityDirectory,
+        posixUsers: options.posixUsers,
+        ...(options.transport.clock === undefined ? {} : { clock: options.transport.clock }),
+        ...operationOptions,
+    };
+    const actorR = await sessionActorResolve(options.transport.sessionId, actorOptions);
+    if (!actorR.success)
+        return actorR;
+    try {
+        const sessionR = await promiseBoundedRace(Promise.resolve().then(() => options.transport.sessions.resolve(options.transport.sessionId)), operationOptions);
+        if (!sessionR.success || !sessionR.data.success) {
+            return createResultError("projectAccessCurrentIdentityResolve", "session identity is unavailable");
+        }
+        const sessionRecordR = sessionRecordValidate(sessionR.data.data);
+        if (!sessionRecordR.success || sessionRecordR.data.id !== options.transport.sessionId) {
+            return createResultError("projectAccessCurrentIdentityResolve", "session identity is unavailable");
+        }
+        const tokenR = await promiseBoundedRace(Promise.resolve().then(() => options.transport.tokenReferences.resolve(sessionRecordR.data.tokenReference)), operationOptions);
+        if (!tokenR.success || !tokenR.data.success) {
+            return createResultError("projectAccessCurrentIdentityResolve", "session identity is unavailable");
+        }
+        const tokensR = tokenReferenceTokensValidate(tokenR.data.data);
+        const nowR = clockNowResolve(options.transport.clock ?? Date.now);
+        if (!tokensR.success || !nowR.success) {
+            return createResultError("projectAccessCurrentIdentityResolve", "session identity is unavailable");
+        }
+        if (sessionRecordR.data.expiresAt <= nowR.data || tokensR.data.expiresAt <= nowR.data) {
+            return createResultError("projectAccessCurrentIdentityResolve", "session identity is unavailable");
+        }
+        if (actorR.data.subject !== sessionRecordR.data.subject || actorR.data.username !== sessionRecordR.data.username) {
+            return createResultError("projectAccessCurrentIdentityResolve", "session identity is unavailable");
+        }
+        return createResult({ actor: actorR.data, accessToken: tokensR.data.accessToken });
+    }
+    catch {
+        return createResultError("projectAccessCurrentIdentityResolve", "session identity is unavailable");
+    }
+}
+async function unixIdentityResolve(options) {
+    const username = options.transport.username;
+    if (!stringIsBounded(username, 256)) {
+        return createResultError("projectAccessCurrentIdentityResolve", "socket actor mapping is unavailable");
+    }
+    const usersR = await identityUsersResolve(options.transport.accessToken, options);
+    if (!usersR.success) {
+        return createResultError("projectAccessCurrentIdentityResolve", "socket actor mapping is unavailable");
+    }
+    const matches = usersR.data.filter((user) => user.preferredUsername === username);
+    if (matches.length !== 1) {
+        return createResultError("projectAccessCurrentIdentityResolve", "socket actor mapping is unavailable");
+    }
+    const user = matches[0];
+    const usernameR = await preferredUsernameMap(user.preferredUsername, options.posixUsers, operationOptionsResolve(options));
+    if (!usernameR.success || usernameR.data !== username) {
+        return createResultError("projectAccessCurrentIdentityResolve", "socket actor mapping is unavailable");
+    }
+    const roleR = await userRoleResolve(user.subject, options.transport.accessToken, options.identityDirectory, operationOptionsResolve(options));
+    if (!roleR.success)
+        return createResultError("projectAccessCurrentIdentityResolve", "current role is unavailable");
+    return createResult({
+        actor: { subject: user.subject, username, role: roleR.data },
+        accessToken: options.transport.accessToken,
+    });
+}
+async function currentIdentityResolve(options) {
+    if (options.transport.transport === "browser") {
+        return browserIdentityResolve(options);
+    }
+    if (options.transport.transport === "unix") {
+        return unixIdentityResolve(options);
+    }
+    return createResultError("projectAccessCurrentIdentityResolve", "current identity is unavailable");
+}
+async function ownerRoleResolve(owner, options) {
+    const identityR = await currentIdentityResolve(options);
+    if (!identityR.success)
+        return identityR;
+    if (!stringIsBounded(owner, 256)) {
+        return createResultError("projectAccessOwnerRoleResolve", "project owner mapping is unavailable");
+    }
+    const usersR = await identityUsersResolve(identityR.data.accessToken, options);
+    if (!usersR.success) {
+        return createResultError("projectAccessOwnerRoleResolve", "project owner role is unavailable");
+    }
+    const user = usersR.data.find((entry) => entry.preferredUsername === owner);
+    if (user === undefined)
+        return createResult(undefined);
+    const usernameR = await preferredUsernameMap(user.preferredUsername, options.posixUsers, operationOptionsResolve(options));
+    if (!usernameR.success)
+        return createResult(undefined);
+    const roleR = await userRoleResolve(user.subject, identityR.data.accessToken, options.identityDirectory, operationOptionsResolve(options));
+    if (!roleR.success) {
+        return createResultError("projectAccessOwnerRoleResolve", "project owner role is unavailable");
+    }
+    return createResult(roleR.data);
+}
+export function projectAccessCreate(options) {
+    return {
+        actorResolve: async () => {
+            const identityR = await currentIdentityResolve(options);
+            if (!identityR.success)
+                return identityR;
+            return createResult(identityR.data.actor);
+        },
+        ownerRoleResolve: (owner) => ownerRoleResolve(owner, options),
+    };
+}
+//# sourceMappingURL=projectAccessCreate.js.map

package/dist/access/projectAccessCreate.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"projectAccessCreate.js","sourceRoot":"","sources":["../../src/access/projectAccessCreate.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,iBAAiB,EAAmC,MAAM,SAAS,CAAA;AAE1F,OAAO,EAAE,oBAAoB,EAAE,MAAM,qCAAqC,CAAA;AAC1E,OAAO,EAAE,eAAe,EAAE,MAAM,gCAAgC,CAAA;AAChE,OAAO,EAAE,eAAe,EAAE,MAAM,+BAA+B,CAAA;AAC/D,OAAO,EAAE,kBAAkB,EAAE,MAAM,kCAAkC,CAAA;AAErE,OAAO,EAAE,mBAAmB,EAAE,MAAM,mCAAmC,CAAA;AACvE,OAAO,EAAE,qBAAqB,EAAE,MAAM,qCAAqC,CAAA;AAC3E,OAAO,EAAE,4BAA4B,EAAE,MAAM,4CAA4C,CAAA;AAgBzF,MAAM,YAAY,GAAG,MAAM,CAAA;AAE3B,SAAS,eAAe,CAAC,KAAc,EAAE,OAAe;IACtD,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,IAAI,KAAK,CAAC,MAAM,IAAI,OAAO,CAAA;AACjF,CAAC;AAED,SAAS,uBAAuB,CAAC,OAAmC;IAClE,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,CAAA;IACnC,OAAO;QACL,SAAS,EAAE,SAAS,CAAC,SAAS,IAAI,OAAO,CAAC,SAAS;QACnD,MAAM,EAAE,SAAS,CAAC,MAAM,IAAI,OAAO,CAAC,MAAM;KAC3C,CAAA;AACH,CAAC;AAED,SAAS,oBAAoB,CAAC,KAAc;IAC1C,MAAM,EAAE,GAAG,mCAAmC,CAAA;IAC9C,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACxE,OAAO,iBAAiB,CAAC,EAAE,EAAE,iCAAiC,CAAC,CAAA;IACjE,CAAC;IACD,MAAM,IAAI,GAAG,KAAgC,CAAA;IAC7C,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,CAAC,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,iBAAiB,EAAE,GAAG,CAAC,EAAE,CAAC;QACzF,OAAO,iBAAiB,CAAC,EAAE,EAAE,iCAAiC,CAAC,CAAA;IACjE,CAAC;IACD,OAAO,YAAY,CAAC,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,iBAAiB,EAAE,IAAI,CAAC,iBAAiB,EAAE,CAAC,CAAA;AAC3F,CAAC;AAED,SAAS,qBAAqB,CAAC,KAAc;IAC3C,MAAM,EAAE,GAAG,mCAAmC,CAAA;IAC9C,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,MAAM,GAAG,YAAY,EAAE,CAAC;QACzD,OAAO,iBAAiB,CAAC,EAAE,EAAE,iCAAiC,CAAC,CAAA;IACjE,CAAC;IACD,MAAM,QAAQ,GAAG,IAAI,GAAG,EAAU,CAAA;IAClC,MAAM,SAAS,GAAG,IAAI,GAAG,EAAU,CAAA;IACnC,MAAM,KAAK,GAA4B,EAAE,CAAA;IACzC,KAAK,MAAM,KAAK,IAAI,KAAK,EAAE,CAAC;QAC1B,MAAM,KAAK,GAAG,oBAAoB,CAAC,KAAK,CAAC,CAAA;QACzC,IAAI,CAAC,KAAK,CAAC,OAAO;YAAE,OAAO,KAAK,CAAA;QAChC,IAAI,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,SAAS,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,iBAAiB,CAAC,EAAE,CAAC;YACpF,OAAO,iBAAiB,CAAC,EAAE,EAAE,iCAAiC,CAAC,CAAA;QACjE,CAAC;QACD,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,CAAA;QAChC,SAAS,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAA;QAC3C,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAA;IACxB,CAAC;IACD,OAAO,YAAY,CAAC,KAAK,CAAC,CAAA;AAC5B,CAAC;AAED,KAAK,UAAU,oBAAoB,CACjC,WAAmB,EACnB,OAAmC;IAEnC,MAAM,gBAAgB,GAAG,uBAAuB,CAAC,OAAO,CAAC,CAAA;IACzD,IAAI,CAAC,eAAe,CAAC,WAAW,EAAE,KAAK,CAAC,EAAE,CAAC;QACzC,OAAO,iBAAiB,CAAC,mCAAmC,EAAE,iCAAiC,CAAC,CAAA;IAClG,CAAC;IACD,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,kBAAkB,CACrC,OAAO,CAAC,OAAO,EAAE,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,iBAAiB,CAAC,SAAS,CAAC,WAAW,CAAC,CAAC,EAC9E,gBAAgB,CACjB,CAAA;QACD,IAAI,CAAC,MAAM,CAAC,OAAO,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC;YAC5C,OAAO,iBAAiB,CAAC,mCAAmC,EAAE,iCAAiC,CAAC,CAAA;QAClG,CAAC;QACD,OAAO,qBAAqB,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;IAChD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,iBAAiB,CAAC,mCAAmC,EAAE,iCAAiC,CAAC,CAAA;IAClG,CAAC;AACH,CAAC;AAED,KAAK,UAAU,sBAAsB,CACnC,OAEC;IAED,MAAM,gBAAgB,GAAG,uBAAuB,CAAC,OAAO,CAAC,CAAA;IACzD,MAAM,YAAY,GAA+B;QAC/C,QAAQ,EAAE,OAAO,CAAC,SAAS,CAAC,QAAQ;QACpC,eAAe,EAAE,OAAO,CAAC,SAAS,CAAC,eAAe;QAClD,iBAAiB,EAAE,OAAO,CAAC,iBAAiB;QAC5C,UAAU,EAAE,OAAO,CAAC,UAAU;QAC9B,GAAG,CAAC,OAAO,CAAC,SAAS,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,OAAO,CAAC,SAAS,CAAC,KAAK,EAAE,CAAC;QACpF,GAAG,gBAAgB;KACpB,CAAA;IACD,MAAM,MAAM,GAAG,MAAM,mBAAmB,CAAC,OAAO,CAAC,SAAS,CAAC,SAAS,EAAE,YAAY,CAAC,CAAA;IACnF,IAAI,CAAC,MAAM,CAAC,OAAO;QAAE,OAAO,MAAM,CAAA;IAElC,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,MAAM,kBAAkB,CACvC,OAAO,CAAC,OAAO,EAAE,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,SAAS,CAAC,QAAQ,CAAC,OAAO,CAAC,OAAO,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC,EAC7F,gBAAgB,CACjB,CAAA;QACD,IAAI,CAAC,QAAQ,CAAC,OAAO,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC;YAChD,OAAO,iBAAiB,CAAC,qCAAqC,EAAE,iCAAiC,CAAC,CAAA;QACpG,CAAC;QACD,MAAM,cAAc,GAAG,qBAAqB,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;QAChE,IAAI,CAAC,cAAc,CAAC,OAAO,IAAI,cAAc,CAAC,IAAI,CAAC,EAAE,KAAK,OAAO,CAAC,SAAS,CAAC,SAAS,EAAE,CAAC;YACtF,OAAO,iBAAiB,CAAC,qCAAqC,EAAE,iCAAiC,CAAC,CAAA;QACpG,CAAC;QAED,MAAM,MAAM,GAAG,MAAM,kBAAkB,CACrC,OAAO,CAAC,OAAO,EAAE,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,SAAS,CAAC,eAAe,CAAC,OAAO,CAAC,cAAc,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC,EAC3G,gBAAgB,CACjB,CAAA;QACD,IAAI,CAAC,MAAM,CAAC,OAAO,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC;YAC5C,OAAO,iBAAiB,CAAC,qCAAqC,EAAE,iCAAiC,CAAC,CAAA;QACpG,CAAC;QACD,MAAM,OAAO,GAAG,4BAA4B,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;QAC9D,MAAM,IAAI,GAAG,eAAe,CAAC,OAAO,CAAC,SAAS,CAAC,KAAK,IAAI,IAAI,CAAC,GAAG,CAAC,CAAA;QACjE,IAAI,CAAC,OAAO,CAAC,OAAO,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC;YACtC,OAAO,iBAAiB,CAAC,qCAAqC,EAAE,iCAAiC,CAAC,CAAA;QACpG,CAAC;QACD,IAAI,cAAc,CAAC,IAAI,CAAC,SAAS,IAAI,IAAI,CAAC,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC,SAAS,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC;YACtF,OAAO,iBAAiB,CAAC,qCAAqC,EAAE,iCAAiC,CAAC,CAAA;QACpG,CAAC;QACD,IAAI,MAAM,CAAC,IAAI,CAAC,OAAO,KAAK,cAAc,CAAC,IAAI,CAAC,OAAO,IAAI,MAAM,CAAC,IAAI,CAAC,QAAQ,KAAK,cAAc,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC;YACjH,OAAO,iBAAiB,CAAC,qCAAqC,EAAE,iCAAiC,CAAC,CAAA;QACpG,CAAC;QACD,OAAO,YAAY,CAAC,EAAE,KAAK,EAAE,MAAM,CAAC,IAAI,EAAE,WAAW,EAAE,OAAO,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,CAAA;IACpF,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,iBAAiB,CAAC,qCAAqC,EAAE,iCAAiC,CAAC,CAAA;IACpG,CAAC;AACH,CAAC;AAED,KAAK,UAAU,mBAAmB,CAChC,OAEC;IAED,MAAM,QAAQ,GAAG,OAAO,CAAC,SAAS,CAAC,QAAQ,CAAA;IAC3C,IAAI,CAAC,eAAe,CAAC,QAAQ,EAAE,GAAG,CAAC,EAAE,CAAC;QACpC,OAAO,iBAAiB,CAAC,qCAAqC,EAAE,qCAAqC,CAAC,CAAA;IACxG,CAAC;IACD,MAAM,MAAM,GAAG,MAAM,oBAAoB,CAAC,OAAO,CAAC,SAAS,CAAC,WAAW,EAAE,OAAO,CAAC,CAAA;IACjF,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;QACpB,OAAO,iBAAiB,CAAC,qCAAqC,EAAE,qCAAqC,CAAC,CAAA;IACxG,CAAC;IACD,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,iBAAiB,KAAK,QAAQ,CAAC,CAAA;IACjF,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACzB,OAAO,iBAAiB,CAAC,qCAAqC,EAAE,qCAAqC,CAAC,CAAA;IACxG,CAAC;IACD,MAAM,IAAI,GAAG,OAAO,CAAC,CAAC,CAAE,CAAA;IACxB,MAAM,SAAS,GAAG,MAAM,oBAAoB,CAC1C,IAAI,CAAC,iBAAiB,EACtB,OAAO,CAAC,UAAU,EAClB,uBAAuB,CAAC,OAAO,CAAC,CACjC,CAAA;IACD,IAAI,CAAC,SAAS,CAAC,OAAO,IAAI,SAAS,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;QACtD,OAAO,iBAAiB,CAAC,qCAAqC,EAAE,qCAAqC,CAAC,CAAA;IACxG,CAAC;IACD,MAAM,KAAK,GAAG,MAAM,eAAe,CACjC,IAAI,CAAC,OAAO,EACZ,OAAO,CAAC,SAAS,CAAC,WAAW,EAC7B,OAAO,CAAC,iBAAiB,EACzB,uBAAuB,CAAC,OAAO,CAAC,CACjC,CAAA;IACD,IAAI,CAAC,KAAK,CAAC,OAAO;QAAE,OAAO,iBAAiB,CAAC,qCAAqC,EAAE,6BAA6B,CAAC,CAAA;IAClH,OAAO,YAAY,CAAC;QAClB,KAAK,EAAE,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE;QAC5D,WAAW,EAAE,OAAO,CAAC,SAAS,CAAC,WAAW;KAC3C,CAAC,CAAA;AACJ,CAAC;AAED,KAAK,UAAU,sBAAsB,CAAC,OAAmC;IACvE,IAAI,OAAO,CAAC,SAAS,CAAC,SAAS,KAAK,SAAS,EAAE,CAAC;QAC9C,OAAO,sBAAsB,CAC3B,OAEC,CACF,CAAA;IACH,CAAC;IACD,IAAI,OAAO,CAAC,SAAS,CAAC,SAAS,KAAK,MAAM,EAAE,CAAC;QAC3C,OAAO,mBAAmB,CACxB,OAEC,CACF,CAAA;IACH,CAAC;IACD,OAAO,iBAAiB,CAAC,qCAAqC,EAAE,iCAAiC,CAAC,CAAA;AACpG,CAAC;AAED,KAAK,UAAU,gBAAgB,CAAC,KAAa,EAAE,OAAmC;IAChF,MAAM,SAAS,GAAG,MAAM,sBAAsB,CAAC,OAAO,CAAC,CAAA;IACvD,IAAI,CAAC,SAAS,CAAC,OAAO;QAAE,OAAO,SAAS,CAAA;IACxC,IAAI,CAAC,eAAe,CAAC,KAAK,EAAE,GAAG,CAAC,EAAE,CAAC;QACjC,OAAO,iBAAiB,CAAC,+BAA+B,EAAE,sCAAsC,CAAC,CAAA;IACnG,CAAC;IACD,MAAM,MAAM,GAAG,MAAM,oBAAoB,CAAC,SAAS,CAAC,IAAI,CAAC,WAAW,EAAE,OAAO,CAAC,CAAA;IAC9E,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;QACpB,OAAO,iBAAiB,CAAC,+BAA+B,EAAE,mCAAmC,CAAC,CAAA;IAChG,CAAC;IACD,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,iBAAiB,KAAK,KAAK,CAAC,CAAA;IAC3E,IAAI,IAAI,KAAK,SAAS;QAAE,OAAO,YAAY,CAAC,SAAS,CAAC,CAAA;IAEtD,MAAM,SAAS,GAAG,MAAM,oBAAoB,CAC1C,IAAI,CAAC,iBAAiB,EACtB,OAAO,CAAC,UAAU,EAClB,uBAAuB,CAAC,OAAO,CAAC,CACjC,CAAA;IACD,IAAI,CAAC,SAAS,CAAC,OAAO;QAAE,OAAO,YAAY,CAAC,SAAS,CAAC,CAAA;IACtD,MAAM,KAAK,GAAG,MAAM,eAAe,CACjC,IAAI,CAAC,OAAO,EACZ,SAAS,CAAC,IAAI,CAAC,WAAW,EAC1B,OAAO,CAAC,iBAAiB,EACzB,uBAAuB,CAAC,OAAO,CAAC,CACjC,CAAA;IACD,IAAI,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC;QACnB,OAAO,iBAAiB,CAAC,+BAA+B,EAAE,mCAAmC,CAAC,CAAA;IAChG,CAAC;IACD,OAAO,YAAY,CAAC,KAAK,CAAC,IAAI,CAAC,CAAA;AACjC,CAAC;AAED,MAAM,UAAU,mBAAmB,CAAC,OAAmC;IACrE,OAAO;QACL,YAAY,EAAE,KAAK,IAAI,EAAE;YACvB,MAAM,SAAS,GAAG,MAAM,sBAAsB,CAAC,OAAO,CAAC,CAAA;YACvD,IAAI,CAAC,SAAS,CAAC,OAAO;gBAAE,OAAO,SAAS,CAAA;YACxC,OAAO,YAAY,CAAC,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;QAC3C,CAAC;QACD,gBAAgB,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,gBAAgB,CAAC,KAAK,EAAE,OAAO,CAAC;KAC9D,CAAA;AACH,CAAC"}

package/dist/access/projectAuthorize.d.ts

@@ -0,0 +1,5 @@
+import { type Result } from "#result";
+import type { Actor } from "./Actor.js";
+import type { Role } from "./Role.js";
+export declare function projectAuthorize(actor: Actor, owner: string, ownerRole: Role | undefined): Result<void>;
+//# sourceMappingURL=projectAuthorize.d.ts.map

package/dist/access/projectAuthorize.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"projectAuthorize.d.ts","sourceRoot":"","sources":["../../src/access/projectAuthorize.ts"],"names":[],"mappings":"AAAA,OAAO,EAAmC,KAAK,MAAM,EAAE,MAAM,SAAS,CAAA;AACtE,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,YAAY,CAAA;AACvC,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,WAAW,CAAA;AAgBrC,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,IAAI,GAAG,SAAS,GAAG,MAAM,CAAC,IAAI,CAAC,CAgBvG"}

package/dist/access/projectAuthorize.js

@@ -0,0 +1,34 @@
+import { createResult, createResultError } from "#result";
+function roleIsKnown(role) {
+    return role === "own" || role === "admin" || role === "superadmin";
+}
+function actorIsValid(actor) {
+    if (typeof actor !== "object" || actor === null)
+        return false;
+    return (typeof actor.username === "string" &&
+        actor.username.length > 0 &&
+        (actor.subject === null || (typeof actor.subject === "string" && actor.subject.length > 0)) &&
+        roleIsKnown(actor.role));
+}
+export function projectAuthorize(actor, owner, ownerRole) {
+    const op = "projectAuthorize";
+    if (!actorIsValid(actor))
+        return createResultError(op, "actor mapping or current role is unavailable");
+    if (typeof owner !== "string" || owner.length === 0) {
+        return createResultError(op, "project owner mapping is unavailable", owner);
+    }
+    if (ownerRole !== undefined && !roleIsKnown(ownerRole)) {
+        return createResultError(op, "project owner role is invalid", owner);
+    }
+    if (ownerRole === undefined && actor.role !== "superadmin") {
+        return createResultError(op, "project owner current role is unavailable", owner);
+    }
+    if (actor.role === "superadmin")
+        return createResult(undefined);
+    if (actor.role === "admin" && (ownerRole === "own" || ownerRole === "admin"))
+        return createResult(undefined);
+    if (actor.role === "own" && ownerRole === "own" && actor.username === owner)
+        return createResult(undefined);
+    return createResultError(op, "actor is not authorized for project owner", owner);
+}
+//# sourceMappingURL=projectAuthorize.js.map

package/dist/access/projectAuthorize.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"projectAuthorize.js","sourceRoot":"","sources":["../../src/access/projectAuthorize.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,iBAAiB,EAAe,MAAM,SAAS,CAAA;AAItE,SAAS,WAAW,CAAC,IAAa;IAChC,OAAO,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,OAAO,IAAI,IAAI,KAAK,YAAY,CAAA;AACpE,CAAC;AAED,SAAS,YAAY,CAAC,KAAY;IAChC,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI;QAAE,OAAO,KAAK,CAAA;IAC7D,OAAO,CACL,OAAO,KAAK,CAAC,QAAQ,KAAK,QAAQ;QAClC,KAAK,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC;QACzB,CAAC,KAAK,CAAC,OAAO,KAAK,IAAI,IAAI,CAAC,OAAO,KAAK,CAAC,OAAO,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;QAC3F,WAAW,CAAC,KAAK,CAAC,IAAI,CAAC,CACxB,CAAA;AACH,CAAC;AAED,MAAM,UAAU,gBAAgB,CAAC,KAAY,EAAE,KAAa,EAAE,SAA2B;IACvF,MAAM,EAAE,GAAG,kBAAkB,CAAA;IAC7B,IAAI,CAAC,YAAY,CAAC,KAAK,CAAC;QAAE,OAAO,iBAAiB,CAAC,EAAE,EAAE,8CAA8C,CAAC,CAAA;IACtG,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACpD,OAAO,iBAAiB,CAAC,EAAE,EAAE,sCAAsC,EAAE,KAAK,CAAC,CAAA;IAC7E,CAAC;IACD,IAAI,SAAS,KAAK,SAAS,IAAI,CAAC,WAAW,CAAC,SAAS,CAAC,EAAE,CAAC;QACvD,OAAO,iBAAiB,CAAC,EAAE,EAAE,+BAA+B,EAAE,KAAK,CAAC,CAAA;IACtE,CAAC;IACD,IAAI,SAAS,KAAK,SAAS,IAAI,KAAK,CAAC,IAAI,KAAK,YAAY,EAAE,CAAC;QAC3D,OAAO,iBAAiB,CAAC,EAAE,EAAE,2CAA2C,EAAE,KAAK,CAAC,CAAA;IAClF,CAAC;IACD,IAAI,KAAK,CAAC,IAAI,KAAK,YAAY;QAAE,OAAO,YAAY,CAAC,SAAS,CAAC,CAAA;IAC/D,IAAI,KAAK,CAAC,IAAI,KAAK,OAAO,IAAI,CAAC,SAAS,KAAK,KAAK,IAAI,SAAS,KAAK,OAAO,CAAC;QAAE,OAAO,YAAY,CAAC,SAAS,CAAC,CAAA;IAC5G,IAAI,KAAK,CAAC,IAAI,KAAK,KAAK,IAAI,SAAS,KAAK,KAAK,IAAI,KAAK,CAAC,QAAQ,KAAK,KAAK;QAAE,OAAO,YAAY,CAAC,SAAS,CAAC,CAAA;IAC3G,OAAO,iBAAiB,CAAC,EAAE,EAAE,2CAA2C,EAAE,KAAK,CAAC,CAAA;AAClF,CAAC"}

package/dist/access/roleResolve.d.ts

@@ -0,0 +1,4 @@
+import { type Result } from "#result";
+import type { Role } from "./Role.js";
+export declare function roleResolve(roles: unknown): Result<Role>;
+//# sourceMappingURL=roleResolve.d.ts.map

package/dist/access/roleResolve.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"roleResolve.d.ts","sourceRoot":"","sources":["../../src/access/roleResolve.ts"],"names":[],"mappings":"AAAA,OAAO,EAAmC,KAAK,MAAM,EAAE,MAAM,SAAS,CAAA;AACtE,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,WAAW,CAAA;AAQrC,wBAAgB,WAAW,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,CAYxD"}

package/dist/access/roleResolve.js

@@ -0,0 +1,21 @@
+import { createResult, createResultError } from "#result";
+const rolePrecedence = ["superadmin", "admin", "own"];
+function roleIsKnown(role) {
+    return role === "own" || role === "admin" || role === "superadmin";
+}
+export function roleResolve(roles) {
+    const op = "roleResolve";
+    if (!Array.isArray(roles) || roles.length > 32) {
+        return createResultError(op, "current roles are invalid");
+    }
+    for (const role of roles) {
+        if (!roleIsKnown(role))
+            return createResultError(op, "current roles are invalid");
+    }
+    for (const role of rolePrecedence) {
+        if (roles.includes(role))
+            return createResult(role);
+    }
+    return createResultError(op, "no current Project Registry role");
+}
+//# sourceMappingURL=roleResolve.js.map

package/dist/access/roleResolve.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"roleResolve.js","sourceRoot":"","sources":["../../src/access/roleResolve.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,iBAAiB,EAAe,MAAM,SAAS,CAAA;AAGtE,MAAM,cAAc,GAAoB,CAAC,YAAY,EAAE,OAAO,EAAE,KAAK,CAAC,CAAA;AAEtE,SAAS,WAAW,CAAC,IAAa;IAChC,OAAO,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,OAAO,IAAI,IAAI,KAAK,YAAY,CAAA;AACpE,CAAC;AAED,MAAM,UAAU,WAAW,CAAC,KAAc;IACxC,MAAM,EAAE,GAAG,aAAa,CAAA;IACxB,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,MAAM,GAAG,EAAE,EAAE,CAAC;QAC/C,OAAO,iBAAiB,CAAC,EAAE,EAAE,2BAA2B,CAAC,CAAA;IAC3D,CAAC;IACD,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC;YAAE,OAAO,iBAAiB,CAAC,EAAE,EAAE,2BAA2B,CAAC,CAAA;IACnF,CAAC;IACD,KAAK,MAAM,IAAI,IAAI,cAAc,EAAE,CAAC;QAClC,IAAI,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC;YAAE,OAAO,YAAY,CAAC,IAAI,CAAC,CAAA;IACrD,CAAC;IACD,OAAO,iBAAiB,CAAC,EAAE,EAAE,kCAAkC,CAAC,CAAA;AAClE,CAAC"}

package/dist/access/serviceAuthorize.d.ts

@@ -0,0 +1,5 @@
+import { type Result } from "#result";
+import type { Actor } from "./Actor.js";
+import type { Role } from "./Role.js";
+export declare function serviceAuthorize(actor: Actor, owner: string, ownerRole: Role | undefined): Result<void>;
+//# sourceMappingURL=serviceAuthorize.d.ts.map

package/dist/access/serviceAuthorize.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"serviceAuthorize.d.ts","sourceRoot":"","sources":["../../src/access/serviceAuthorize.ts"],"names":[],"mappings":"AAAA,OAAO,EAAmC,KAAK,MAAM,EAAE,MAAM,SAAS,CAAA;AACtE,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,YAAY,CAAA;AAEvC,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,WAAW,CAAA;AAErC,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,IAAI,GAAG,SAAS,GAAG,MAAM,CAAC,IAAI,CAAC,CAKvG"}

package/dist/access/serviceAuthorize.js

@@ -0,0 +1,10 @@
+import { createResult, createResultError } from "#result";
+import { projectAuthorize } from "./projectAuthorize.js";
+export function serviceAuthorize(actor, owner, ownerRole) {
+    const op = "serviceAuthorize";
+    const authorization = projectAuthorize(actor, owner, ownerRole);
+    if (!authorization.success)
+        return createResultError(op, authorization.errorMessage, authorization.errorData);
+    return createResult(undefined);
+}
+//# sourceMappingURL=serviceAuthorize.js.map

package/dist/access/serviceAuthorize.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"serviceAuthorize.js","sourceRoot":"","sources":["../../src/access/serviceAuthorize.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,iBAAiB,EAAe,MAAM,SAAS,CAAA;AAEtE,OAAO,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAA;AAGxD,MAAM,UAAU,gBAAgB,CAAC,KAAY,EAAE,KAAa,EAAE,SAA2B;IACvF,MAAM,EAAE,GAAG,kBAAkB,CAAA;IAC7B,MAAM,aAAa,GAAG,gBAAgB,CAAC,KAAK,EAAE,KAAK,EAAE,SAAS,CAAC,CAAA;IAC/D,IAAI,CAAC,aAAa,CAAC,OAAO;QAAE,OAAO,iBAAiB,CAAC,EAAE,EAAE,aAAa,CAAC,YAAY,EAAE,aAAa,CAAC,SAAS,CAAC,CAAA;IAC7G,OAAO,YAAY,CAAC,SAAS,CAAC,CAAA;AAChC,CAAC"}

package/dist/access/superadminAuthorize.d.ts

@@ -0,0 +1,5 @@
+import { type Result } from "#result";
+import type { Actor } from "./Actor.js";
+import type { SuperadminOperation } from "./SuperadminOperation.js";
+export declare function superadminAuthorize(actor: Actor, operation: SuperadminOperation): Result<void>;
+//# sourceMappingURL=superadminAuthorize.d.ts.map

package/dist/access/superadminAuthorize.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"superadminAuthorize.d.ts","sourceRoot":"","sources":["../../src/access/superadminAuthorize.ts"],"names":[],"mappings":"AAAA,OAAO,EAAmC,KAAK,MAAM,EAAE,MAAM,SAAS,CAAA;AACtE,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,YAAY,CAAA;AAEvC,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,0BAA0B,CAAA;AAkBnE,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,KAAK,EAAE,SAAS,EAAE,mBAAmB,GAAG,MAAM,CAAC,IAAI,CAAC,CAM9F"}

package/dist/access/superadminAuthorize.js

@@ -0,0 +1,24 @@
+import { createResult, createResultError } from "#result";
+const superadminOperations = ["caddy-config", "caddy-status", "caddy-regenerate"];
+function roleIsKnown(role) {
+    return role === "own" || role === "admin" || role === "superadmin";
+}
+function actorIsValid(actor) {
+    if (typeof actor !== "object" || actor === null)
+        return false;
+    return (typeof actor.username === "string" &&
+        actor.username.length > 0 &&
+        (actor.subject === null || (typeof actor.subject === "string" && actor.subject.length > 0)) &&
+        roleIsKnown(actor.role));
+}
+export function superadminAuthorize(actor, operation) {
+    const op = "superadminAuthorize";
+    if (!superadminOperations.includes(operation))
+        return createResultError(op, "superadmin operation is invalid");
+    if (!actorIsValid(actor))
+        return createResultError(op, "actor mapping or current role is unavailable");
+    if (actor.role !== "superadmin")
+        return createResultError(op, `operation requires superadmin: ${operation}`);
+    return createResult(undefined);
+}
+//# sourceMappingURL=superadminAuthorize.js.map

package/dist/access/superadminAuthorize.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"superadminAuthorize.js","sourceRoot":"","sources":["../../src/access/superadminAuthorize.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,iBAAiB,EAAe,MAAM,SAAS,CAAA;AAKtE,MAAM,oBAAoB,GAAmC,CAAC,cAAc,EAAE,cAAc,EAAE,kBAAkB,CAAC,CAAA;AAEjH,SAAS,WAAW,CAAC,IAAa;IAChC,OAAO,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,OAAO,IAAI,IAAI,KAAK,YAAY,CAAA;AACpE,CAAC;AAED,SAAS,YAAY,CAAC,KAAY;IAChC,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI;QAAE,OAAO,KAAK,CAAA;IAC7D,OAAO,CACL,OAAO,KAAK,CAAC,QAAQ,KAAK,QAAQ;QAClC,KAAK,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC;QACzB,CAAC,KAAK,CAAC,OAAO,KAAK,IAAI,IAAI,CAAC,OAAO,KAAK,CAAC,OAAO,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;QAC3F,WAAW,CAAC,KAAK,CAAC,IAAI,CAAC,CACxB,CAAA;AACH,CAAC;AAED,MAAM,UAAU,mBAAmB,CAAC,KAAY,EAAE,SAA8B;IAC9E,MAAM,EAAE,GAAG,qBAAqB,CAAA;IAChC,IAAI,CAAC,oBAAoB,CAAC,QAAQ,CAAC,SAAS,CAAC;QAAE,OAAO,iBAAiB,CAAC,EAAE,EAAE,iCAAiC,CAAC,CAAA;IAC9G,IAAI,CAAC,YAAY,CAAC,KAAK,CAAC;QAAE,OAAO,iBAAiB,CAAC,EAAE,EAAE,8CAA8C,CAAC,CAAA;IACtG,IAAI,KAAK,CAAC,IAAI,KAAK,YAAY;QAAE,OAAO,iBAAiB,CAAC,EAAE,EAAE,kCAAkC,SAAS,EAAE,CAAC,CAAA;IAC5G,OAAO,YAAY,CAAC,SAAS,CAAC,CAAA;AAChC,CAAC"}

package/dist/access/visibleUserList.d.ts

@@ -0,0 +1,6 @@
+import { type Result } from "#result";
+import type { MappedUser } from "../identity/MappedUser.js";
+import type { VisibleUser } from "../identity/VisibleUser.js";
+import type { Actor } from "./Actor.js";
+export declare function visibleUserList(actor: Actor, users: readonly MappedUser[]): Result<VisibleUser[]>;
+//# sourceMappingURL=visibleUserList.d.ts.map

package/dist/access/visibleUserList.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"visibleUserList.d.ts","sourceRoot":"","sources":["../../src/access/visibleUserList.ts"],"names":[],"mappings":"AAAA,OAAO,EAAmC,KAAK,MAAM,EAAE,MAAM,SAAS,CAAA;AACtE,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,2BAA2B,CAAA;AAC3D,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,4BAA4B,CAAA;AAC7D,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,YAAY,CAAA;AA4CvC,wBAAgB,eAAe,CAAC,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,SAAS,UAAU,EAAE,GAAG,MAAM,CAAC,WAAW,EAAE,CAAC,CAajG"}

package/dist/access/visibleUserList.js

@@ -0,0 +1,51 @@
+import { createResult, createResultError } from "#result";
+function roleIsKnown(role) {
+    return role === "own" || role === "admin" || role === "superadmin";
+}
+function actorIsValid(actor) {
+    if (typeof actor !== "object" || actor === null)
+        return false;
+    return (typeof actor.username === "string" &&
+        actor.username.length > 0 &&
+        actor.username.length <= 256 &&
+        (actor.subject === null ||
+            (typeof actor.subject === "string" && actor.subject.length > 0 && actor.subject.length <= 256)) &&
+        roleIsKnown(actor.role));
+}
+function userIsValid(user) {
+    if (typeof user !== "object" || user === null)
+        return false;
+    return (typeof user.subject === "string" &&
+        user.subject.length > 0 &&
+        user.subject.length <= 256 &&
+        typeof user.username === "string" &&
+        user.username.length > 0 &&
+        user.username.length <= 256 &&
+        roleIsKnown(user.role));
+}
+function usersAreUnique(users) {
+    const subjects = new Set();
+    const usernames = new Set();
+    for (const user of users) {
+        if (!userIsValid(user))
+            return false;
+        if (subjects.has(user.subject) || usernames.has(user.username))
+            return false;
+        subjects.add(user.subject);
+        usernames.add(user.username);
+    }
+    return true;
+}
+export function visibleUserList(actor, users) {
+    const op = "visibleUserList";
+    if (!actorIsValid(actor))
+        return createResultError(op, "actor mapping or current role is unavailable");
+    if (!Array.isArray(users) || users.length > 10_000 || !usersAreUnique(users)) {
+        return createResultError(op, "mapped user directory contains an invalid mapping");
+    }
+    if (actor.role === "own")
+        return createResult([]);
+    const visibleUsers = users.filter((user) => actor.role === "superadmin" || user.role === "own" || user.role === "admin");
+    return createResult(visibleUsers);
+}
+//# sourceMappingURL=visibleUserList.js.map

package/dist/access/visibleUserList.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"visibleUserList.js","sourceRoot":"","sources":["../../src/access/visibleUserList.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,iBAAiB,EAAe,MAAM,SAAS,CAAA;AAMtE,SAAS,WAAW,CAAC,IAAa;IAChC,OAAO,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,OAAO,IAAI,IAAI,KAAK,YAAY,CAAA;AACpE,CAAC;AAED,SAAS,YAAY,CAAC,KAAY;IAChC,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI;QAAE,OAAO,KAAK,CAAA;IAC7D,OAAO,CACL,OAAO,KAAK,CAAC,QAAQ,KAAK,QAAQ;QAClC,KAAK,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC;QACzB,KAAK,CAAC,QAAQ,CAAC,MAAM,IAAI,GAAG;QAC5B,CAAC,KAAK,CAAC,OAAO,KAAK,IAAI;YACrB,CAAC,OAAO,KAAK,CAAC,OAAO,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,IAAI,GAAG,CAAC,CAAC;QACjG,WAAW,CAAC,KAAK,CAAC,IAAI,CAAC,CACxB,CAAA;AACH,CAAC;AAED,SAAS,WAAW,CAAC,IAAgB;IACnC,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,KAAK,IAAI;QAAE,OAAO,KAAK,CAAA;IAC3D,OAAO,CACL,OAAO,IAAI,CAAC,OAAO,KAAK,QAAQ;QAChC,IAAI,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC;QACvB,IAAI,CAAC,OAAO,CAAC,MAAM,IAAI,GAAG;QAC1B,OAAO,IAAI,CAAC,QAAQ,KAAK,QAAQ;QACjC,IAAI,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC;QACxB,IAAI,CAAC,QAAQ,CAAC,MAAM,IAAI,GAAG;QAC3B,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,CACvB,CAAA;AACH,CAAC;AAED,SAAS,cAAc,CAAC,KAA4B;IAClD,MAAM,QAAQ,GAAG,IAAI,GAAG,EAAU,CAAA;IAClC,MAAM,SAAS,GAAG,IAAI,GAAG,EAAU,CAAA;IACnC,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC;YAAE,OAAO,KAAK,CAAA;QACpC,IAAI,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC;YAAE,OAAO,KAAK,CAAA;QAC5E,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,CAAA;QAC1B,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAA;IAC9B,CAAC;IACD,OAAO,IAAI,CAAA;AACb,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,KAAY,EAAE,KAA4B;IACxE,MAAM,EAAE,GAAG,iBAAiB,CAAA;IAC5B,IAAI,CAAC,YAAY,CAAC,KAAK,CAAC;QAAE,OAAO,iBAAiB,CAAC,EAAE,EAAE,8CAA8C,CAAC,CAAA;IACtG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,MAAM,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,KAAK,CAAC,EAAE,CAAC;QAC7E,OAAO,iBAAiB,CAAC,EAAE,EAAE,mDAAmD,CAAC,CAAA;IACnF,CAAC;IAED,IAAI,KAAK,CAAC,IAAI,KAAK,KAAK;QAAE,OAAO,YAAY,CAAC,EAAE,CAAC,CAAA;IAEjD,MAAM,YAAY,GAAG,KAAK,CAAC,MAAM,CAC/B,CAAC,IAAI,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,KAAK,YAAY,IAAI,IAAI,CAAC,IAAI,KAAK,KAAK,IAAI,IAAI,CAAC,IAAI,KAAK,OAAO,CACtF,CAAA;IACD,OAAO,YAAY,CAAC,YAAY,CAAC,CAAA;AACnC,CAAC"}