@assemora/auth 0.1.0

package/dist/credentials.d.ts

@@ -0,0 +1,16 @@
+export declare const hashPassword: (password: string) => Promise<string>;
+export declare const verifyPassword: (stored: string, password: string) => Promise<boolean>;
+export type IssuedToken = {
+    /** Shown once, at creation. Nothing stores it. */
+    readonly token: string;
+    /** What the database keeps. */
+    readonly hash: string;
+};
+/** 256 bits of randomness, url-safe, with a prefix that says what it opens. */
+export declare const issueToken: (prefix: string) => IssuedToken;
+export declare const hashToken: (token: string) => string;
+/**
+ * Compares two digests without leaking, through timing, how much of one matched.
+ */
+export declare const tokensMatch: (left: string, right: string) => boolean;
+//# sourceMappingURL=credentials.d.ts.map

package/dist/credentials.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"credentials.d.ts","sourceRoot":"","sources":["../src/credentials.ts"],"names":[],"mappings":"AAoBA,eAAO,MAAM,YAAY,aAAc,MAAM,KAAG,OAAO,CAAC,MAAM,CAAiC,CAAA;AAE/F,eAAO,MAAM,cAAc,WAAkB,MAAM,YAAY,MAAM,KAAG,OAAO,CAAC,OAAO,CAQtF,CAAA;AAED,MAAM,MAAM,WAAW,GAAG;IACxB,kDAAkD;IAClD,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;IACtB,+BAA+B;IAC/B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;CACtB,CAAA;AAED,+EAA+E;AAC/E,eAAO,MAAM,UAAU,WAAY,MAAM,KAAG,WAI3C,CAAA;AAED,eAAO,MAAM,SAAS,UAAW,MAAM,KAAG,MAA0D,CAAA;AAEpG;;GAEG;AACH,eAAO,MAAM,WAAW,SAAU,MAAM,SAAS,MAAM,KAAG,OAKzD,CAAA"}

package/dist/credentials.js

@@ -0,0 +1,43 @@
+/**
+ * Password and token secrets (SPEC.md §49, §85).
+ *
+ * The two are hashed differently on purpose. A password is chosen by a person, so it
+ * is low in entropy and needs a slow, memory-hard hash — Argon2id. A token is 256
+ * bits from a CSPRNG, so guessing it is already impossible; hashing it slowly would
+ * cost every request and buy nothing, and SHA-256 is the right tool. Both are stored
+ * as digests and never as written.
+ */
+import { createHash, randomBytes, timingSafeEqual } from 'node:crypto';
+import { hash as argon2Hash, verify as argon2Verify } from '@node-rs/argon2';
+/** OWASP's recommended Argon2id parameters, kept in one place to be raised together. */
+const ARGON2 = {
+    memoryCost: 19_456,
+    timeCost: 2,
+    parallelism: 1,
+};
+export const hashPassword = (password) => argon2Hash(password, ARGON2);
+export const verifyPassword = async (stored, password) => {
+    try {
+        return await argon2Verify(stored, password);
+    }
+    catch {
+        // A malformed or truncated hash is a failed verification, never an exception
+        // that a caller might treat as a success.
+        return false;
+    }
+};
+/** 256 bits of randomness, url-safe, with a prefix that says what it opens. */
+export const issueToken = (prefix) => {
+    const token = `${prefix}_${randomBytes(32).toString('base64url')}`;
+    return { token, hash: hashToken(token) };
+};
+export const hashToken = (token) => createHash('sha256').update(token).digest('hex');
+/**
+ * Compares two digests without leaking, through timing, how much of one matched.
+ */
+export const tokensMatch = (left, right) => {
+    const a = Buffer.from(left, 'utf8');
+    const b = Buffer.from(right, 'utf8');
+    return a.length === b.length && timingSafeEqual(a, b);
+};
+//# sourceMappingURL=credentials.js.map

package/dist/credentials.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"credentials.js","sourceRoot":"","sources":["../src/credentials.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AACH,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,eAAe,EAAE,MAAM,aAAa,CAAA;AAEtE,OAAO,EAAE,IAAI,IAAI,UAAU,EAAE,MAAM,IAAI,YAAY,EAAE,MAAM,iBAAiB,CAAA;AAE5E,wFAAwF;AACxF,MAAM,MAAM,GAAG;IACb,UAAU,EAAE,MAAM;IAClB,QAAQ,EAAE,CAAC;IACX,WAAW,EAAE,CAAC;CACN,CAAA;AAEV,MAAM,CAAC,MAAM,YAAY,GAAG,CAAC,QAAgB,EAAmB,EAAE,CAAC,UAAU,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAA;AAE/F,MAAM,CAAC,MAAM,cAAc,GAAG,KAAK,EAAE,MAAc,EAAE,QAAgB,EAAoB,EAAE;IACzF,IAAI,CAAC;QACH,OAAO,MAAM,YAAY,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAA;IAC7C,CAAC;IAAC,MAAM,CAAC;QACP,6EAA6E;QAC7E,0CAA0C;QAC1C,OAAO,KAAK,CAAA;IACd,CAAC;AACH,CAAC,CAAA;AASD,+EAA+E;AAC/E,MAAM,CAAC,MAAM,UAAU,GAAG,CAAC,MAAc,EAAe,EAAE;IACxD,MAAM,KAAK,GAAG,GAAG,MAAM,IAAI,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAA;IAElE,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,SAAS,CAAC,KAAK,CAAC,EAAE,CAAA;AAC1C,CAAC,CAAA;AAED,MAAM,CAAC,MAAM,SAAS,GAAG,CAAC,KAAa,EAAU,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA;AAEpG;;GAEG;AACH,MAAM,CAAC,MAAM,WAAW,GAAG,CAAC,IAAY,EAAE,KAAa,EAAW,EAAE;IAClE,MAAM,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,CAAA;IACnC,MAAM,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,MAAM,CAAC,CAAA;IAEpC,OAAO,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,MAAM,IAAI,eAAe,CAAC,CAAC,EAAE,CAAC,CAAC,CAAA;AACvD,CAAC,CAAA"}

package/dist/index.d.ts

@@ -0,0 +1,35 @@
+/**
+ * `@assemora/auth` — who is asking, and what they may do.
+ *
+ * Core has declared the authorization port since phase 1 and denied everything in
+ * its absence. This package is the implementation: roles and permissions from
+ * SPEC.md §50, policies from §51, sessions and tokens from §49.
+ *
+ * ```ts
+ * export const ArticlePolicy = policy('articles', {
+ *   read: () => true,
+ *   update: ({ actor, record }) => actor?.id === record.authorId,
+ *   delete: ({ can }) => can('articles.delete'),
+ * })
+ *
+ * const app = createApplication({
+ *   modules: [auth({ policies: [ArticlePolicy] }), blog()],
+ *   authorization: policies(),
+ * })
+ * ```
+ *
+ * Nothing sensitive is stored as written: passwords are Argon2id, tokens are
+ * digests, and a token's plaintext exists exactly once — when it is issued.
+ */
+export { resolveActor, SESSION_COOKIE } from './actors.js';
+export { type CommandSubject, policies, subjectOf } from './authorization.js';
+export { authCommands, CreateAgent, CreateApiToken, CreateRole, CreateUser, DeleteRole, GrantRole, publicAuthPolicy, RevokeApiToken, RevokeRole, SetPassword, SignIn, SignOut, UpdateAgent, UpdateRole, UpdateUser, } from './commands.js';
+export { hashPassword, hashToken, type IssuedToken, issueToken, tokensMatch, verifyPassword, } from './credentials.js';
+export { Agent, AgentToken, ApiToken, authModels, Permission, Role, RolePermission, Session, User, UserRole, } from './models.js';
+export { type AuthModuleOptions, auth, definePolicyFacet } from './module.js';
+export { holds, type PermissionSet, permissionsOf, WILDCARD, } from './permissions.js';
+export { clearPolicies, describedPolicies, describePolicy, type Policy, type PolicyActor, type PolicyContext, type PolicyDescriptor, type PolicyRule, type PolicyRules, policy, policyFor, registeredPolicies, registerPolicy, } from './policies.js';
+export { authQueries, GetUser, ListAgents, ListApiTokens, ListPermissions, ListRoles, ListUsers, } from './queries.js';
+export { DEFAULT_SESSION_TTL_MS, endSession, purgeExpiredSessions, SESSION_PREFIX, type SessionDetails, type StartedSession, sessionActor, startSession, } from './sessions.js';
+export { AGENT_TOKEN_PREFIX, type AgentDetails, API_TOKEN_PREFIX, type ApiTokenDetails, type CreatedAgent, createAgent, createApiToken, type IssuedApiToken, revokeAgentToken, revokeApiToken, tokenActor, } from './tokens.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAEH,OAAO,EAAE,YAAY,EAAE,cAAc,EAAE,MAAM,aAAa,CAAA;AAC1D,OAAO,EAAE,KAAK,cAAc,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAA;AAC7E,OAAO,EACL,YAAY,EACZ,WAAW,EACX,cAAc,EACd,UAAU,EACV,UAAU,EACV,UAAU,EACV,SAAS,EACT,gBAAgB,EAChB,cAAc,EACd,UAAU,EACV,WAAW,EACX,MAAM,EACN,OAAO,EACP,WAAW,EACX,UAAU,EACV,UAAU,GACX,MAAM,eAAe,CAAA;AACtB,OAAO,EACL,YAAY,EACZ,SAAS,EACT,KAAK,WAAW,EAChB,UAAU,EACV,WAAW,EACX,cAAc,GACf,MAAM,kBAAkB,CAAA;AACzB,OAAO,EACL,KAAK,EACL,UAAU,EACV,QAAQ,EACR,UAAU,EACV,UAAU,EACV,IAAI,EACJ,cAAc,EACd,OAAO,EACP,IAAI,EACJ,QAAQ,GACT,MAAM,aAAa,CAAA;AACpB,OAAO,EAAE,KAAK,iBAAiB,EAAE,IAAI,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAA;AAC7E,OAAO,EACL,KAAK,EACL,KAAK,aAAa,EAClB,aAAa,EACb,QAAQ,GACT,MAAM,kBAAkB,CAAA;AACzB,OAAO,EACL,aAAa,EACb,iBAAiB,EACjB,cAAc,EACd,KAAK,MAAM,EACX,KAAK,WAAW,EAChB,KAAK,aAAa,EAClB,KAAK,gBAAgB,EACrB,KAAK,UAAU,EACf,KAAK,WAAW,EAChB,MAAM,EACN,SAAS,EACT,kBAAkB,EAClB,cAAc,GACf,MAAM,eAAe,CAAA;AACtB,OAAO,EACL,WAAW,EACX,OAAO,EACP,UAAU,EACV,aAAa,EACb,eAAe,EACf,SAAS,EACT,SAAS,GACV,MAAM,cAAc,CAAA;AACrB,OAAO,EACL,sBAAsB,EACtB,UAAU,EACV,oBAAoB,EACpB,cAAc,EACd,KAAK,cAAc,EACnB,KAAK,cAAc,EACnB,YAAY,EACZ,YAAY,GACb,MAAM,eAAe,CAAA;AACtB,OAAO,EACL,kBAAkB,EAClB,KAAK,YAAY,EACjB,gBAAgB,EAChB,KAAK,eAAe,EACpB,KAAK,YAAY,EACjB,WAAW,EACX,cAAc,EACd,KAAK,cAAc,EACnB,gBAAgB,EAChB,cAAc,EACd,UAAU,GACX,MAAM,aAAa,CAAA"}

package/dist/index.js

@@ -0,0 +1,35 @@
+/**
+ * `@assemora/auth` — who is asking, and what they may do.
+ *
+ * Core has declared the authorization port since phase 1 and denied everything in
+ * its absence. This package is the implementation: roles and permissions from
+ * SPEC.md §50, policies from §51, sessions and tokens from §49.
+ *
+ * ```ts
+ * export const ArticlePolicy = policy('articles', {
+ *   read: () => true,
+ *   update: ({ actor, record }) => actor?.id === record.authorId,
+ *   delete: ({ can }) => can('articles.delete'),
+ * })
+ *
+ * const app = createApplication({
+ *   modules: [auth({ policies: [ArticlePolicy] }), blog()],
+ *   authorization: policies(),
+ * })
+ * ```
+ *
+ * Nothing sensitive is stored as written: passwords are Argon2id, tokens are
+ * digests, and a token's plaintext exists exactly once — when it is issued.
+ */
+export { resolveActor, SESSION_COOKIE } from './actors.js';
+export { policies, subjectOf } from './authorization.js';
+export { authCommands, CreateAgent, CreateApiToken, CreateRole, CreateUser, DeleteRole, GrantRole, publicAuthPolicy, RevokeApiToken, RevokeRole, SetPassword, SignIn, SignOut, UpdateAgent, UpdateRole, UpdateUser, } from './commands.js';
+export { hashPassword, hashToken, issueToken, tokensMatch, verifyPassword, } from './credentials.js';
+export { Agent, AgentToken, ApiToken, authModels, Permission, Role, RolePermission, Session, User, UserRole, } from './models.js';
+export { auth, definePolicyFacet } from './module.js';
+export { holds, permissionsOf, WILDCARD, } from './permissions.js';
+export { clearPolicies, describedPolicies, describePolicy, policy, policyFor, registeredPolicies, registerPolicy, } from './policies.js';
+export { authQueries, GetUser, ListAgents, ListApiTokens, ListPermissions, ListRoles, ListUsers, } from './queries.js';
+export { DEFAULT_SESSION_TTL_MS, endSession, purgeExpiredSessions, SESSION_PREFIX, sessionActor, startSession, } from './sessions.js';
+export { AGENT_TOKEN_PREFIX, API_TOKEN_PREFIX, createAgent, createApiToken, revokeAgentToken, revokeApiToken, tokenActor, } from './tokens.js';
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAEH,OAAO,EAAE,YAAY,EAAE,cAAc,EAAE,MAAM,aAAa,CAAA;AAC1D,OAAO,EAAuB,QAAQ,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAA;AAC7E,OAAO,EACL,YAAY,EACZ,WAAW,EACX,cAAc,EACd,UAAU,EACV,UAAU,EACV,UAAU,EACV,SAAS,EACT,gBAAgB,EAChB,cAAc,EACd,UAAU,EACV,WAAW,EACX,MAAM,EACN,OAAO,EACP,WAAW,EACX,UAAU,EACV,UAAU,GACX,MAAM,eAAe,CAAA;AACtB,OAAO,EACL,YAAY,EACZ,SAAS,EAET,UAAU,EACV,WAAW,EACX,cAAc,GACf,MAAM,kBAAkB,CAAA;AACzB,OAAO,EACL,KAAK,EACL,UAAU,EACV,QAAQ,EACR,UAAU,EACV,UAAU,EACV,IAAI,EACJ,cAAc,EACd,OAAO,EACP,IAAI,EACJ,QAAQ,GACT,MAAM,aAAa,CAAA;AACpB,OAAO,EAA0B,IAAI,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAA;AAC7E,OAAO,EACL,KAAK,EAEL,aAAa,EACb,QAAQ,GACT,MAAM,kBAAkB,CAAA;AACzB,OAAO,EACL,aAAa,EACb,iBAAiB,EACjB,cAAc,EAOd,MAAM,EACN,SAAS,EACT,kBAAkB,EAClB,cAAc,GACf,MAAM,eAAe,CAAA;AACtB,OAAO,EACL,WAAW,EACX,OAAO,EACP,UAAU,EACV,aAAa,EACb,eAAe,EACf,SAAS,EACT,SAAS,GACV,MAAM,cAAc,CAAA;AACrB,OAAO,EACL,sBAAsB,EACtB,UAAU,EACV,oBAAoB,EACpB,cAAc,EAGd,YAAY,EACZ,YAAY,GACb,MAAM,eAAe,CAAA;AACtB,OAAO,EACL,kBAAkB,EAElB,gBAAgB,EAGhB,WAAW,EACX,cAAc,EAEd,gBAAgB,EAChB,cAAc,EACd,UAAU,GACX,MAAM,aAAa,CAAA"}

package/dist/models.d.ts

@@ -0,0 +1,136 @@
+export declare const User: import("@assemora/data").Model<{
+    id: import("@assemora/data").UuidColumnBuilder;
+    email: import("@assemora/data").ColumnBuilder<string>;
+    name: import("@assemora/data").ColumnBuilder<string>;
+    /** Argon2id. Never leaves the database and never reaches serialized output. */
+    passwordHash: import("@assemora/data").ColumnBuilder<string>;
+    active: import("@assemora/data").ColumnBuilder<boolean>;
+    /** Studio states the version it read, and a stale edit is a 409 (SPEC.md §66). */
+    version: import("@assemora/data").ColumnBuilder<number>;
+    createdAt: import("@assemora/data").TimestampColumnBuilder;
+    updatedAt: import("@assemora/data").TimestampColumnBuilder;
+}, never, Readonly<Record<never, never>>>;
+export declare const Session: import("@assemora/data").Model<{
+    id: import("@assemora/data").UuidColumnBuilder;
+    /** A digest of the session secret; the secret itself lives only in the cookie. */
+    tokenHash: import("@assemora/data").ColumnBuilder<string>;
+    userId: import("@assemora/data").UuidColumnBuilder;
+    userAgent: import("@assemora/data").ColumnBuilder<string | null>;
+    ipAddress: import("@assemora/data").ColumnBuilder<string | null>;
+    expiresAt: import("@assemora/data").TimestampColumnBuilder;
+    createdAt: import("@assemora/data").TimestampColumnBuilder;
+}, never, Readonly<Record<never, never>>>;
+export declare const Role: import("@assemora/data").Model<{
+    id: import("@assemora/data").UuidColumnBuilder;
+    name: import("@assemora/data").ColumnBuilder<string>;
+    label: import("@assemora/data").ColumnBuilder<string>;
+    version: import("@assemora/data").ColumnBuilder<number>;
+    createdAt: import("@assemora/data").TimestampColumnBuilder;
+}, never, Readonly<Record<never, never>>>;
+export declare const Permission: import("@assemora/data").Model<{
+    id: import("@assemora/data").UuidColumnBuilder;
+    name: import("@assemora/data").ColumnBuilder<string>;
+    description: import("@assemora/data").ColumnBuilder<string | null>;
+}, never, Readonly<Record<never, never>>>;
+export declare const UserRole: import("@assemora/data").Model<{
+    id: import("@assemora/data").UuidColumnBuilder;
+    userId: import("@assemora/data").UuidColumnBuilder;
+    roleId: import("@assemora/data").UuidColumnBuilder;
+}, never, Readonly<Record<never, never>>>;
+export declare const RolePermission: import("@assemora/data").Model<{
+    id: import("@assemora/data").UuidColumnBuilder;
+    roleId: import("@assemora/data").UuidColumnBuilder;
+    permissionId: import("@assemora/data").UuidColumnBuilder;
+}, never, Readonly<Record<never, never>>>;
+export declare const ApiToken: import("@assemora/data").Model<{
+    id: import("@assemora/data").UuidColumnBuilder;
+    name: import("@assemora/data").ColumnBuilder<string>;
+    tokenHash: import("@assemora/data").ColumnBuilder<string>;
+    userId: import("@assemora/data").ColumnBuilder<string | null>;
+    permissions: import("@assemora/data").JsonColumnBuilder<readonly string[]>;
+    expiresAt: import("@assemora/data").ColumnBuilder<Date | null>;
+    lastUsedAt: import("@assemora/data").ColumnBuilder<Date | null>;
+    createdAt: import("@assemora/data").TimestampColumnBuilder;
+}, never, Readonly<Record<never, never>>>;
+export declare const Agent: import("@assemora/data").Model<{
+    id: import("@assemora/data").UuidColumnBuilder;
+    name: import("@assemora/data").ColumnBuilder<string>;
+    description: import("@assemora/data").ColumnBuilder<string | null>;
+    permissions: import("@assemora/data").JsonColumnBuilder<readonly string[]>;
+    enabled: import("@assemora/data").ColumnBuilder<boolean>;
+    createdAt: import("@assemora/data").TimestampColumnBuilder;
+}, never, Readonly<Record<never, never>>>;
+export declare const AgentToken: import("@assemora/data").Model<{
+    id: import("@assemora/data").UuidColumnBuilder;
+    agentId: import("@assemora/data").UuidColumnBuilder;
+    name: import("@assemora/data").ColumnBuilder<string>;
+    tokenHash: import("@assemora/data").ColumnBuilder<string>;
+    expiresAt: import("@assemora/data").ColumnBuilder<Date | null>;
+    lastUsedAt: import("@assemora/data").ColumnBuilder<Date | null>;
+    createdAt: import("@assemora/data").TimestampColumnBuilder;
+}, never, Readonly<Record<never, never>>>;
+/** Every table this package owns, for schema generation and for tests. */
+export declare const authModels: readonly [import("@assemora/data").Model<{
+    id: import("@assemora/data").UuidColumnBuilder;
+    email: import("@assemora/data").ColumnBuilder<string>;
+    name: import("@assemora/data").ColumnBuilder<string>;
+    /** Argon2id. Never leaves the database and never reaches serialized output. */
+    passwordHash: import("@assemora/data").ColumnBuilder<string>;
+    active: import("@assemora/data").ColumnBuilder<boolean>;
+    /** Studio states the version it read, and a stale edit is a 409 (SPEC.md §66). */
+    version: import("@assemora/data").ColumnBuilder<number>;
+    createdAt: import("@assemora/data").TimestampColumnBuilder;
+    updatedAt: import("@assemora/data").TimestampColumnBuilder;
+}, never, Readonly<Record<never, never>>>, import("@assemora/data").Model<{
+    id: import("@assemora/data").UuidColumnBuilder;
+    /** A digest of the session secret; the secret itself lives only in the cookie. */
+    tokenHash: import("@assemora/data").ColumnBuilder<string>;
+    userId: import("@assemora/data").UuidColumnBuilder;
+    userAgent: import("@assemora/data").ColumnBuilder<string | null>;
+    ipAddress: import("@assemora/data").ColumnBuilder<string | null>;
+    expiresAt: import("@assemora/data").TimestampColumnBuilder;
+    createdAt: import("@assemora/data").TimestampColumnBuilder;
+}, never, Readonly<Record<never, never>>>, import("@assemora/data").Model<{
+    id: import("@assemora/data").UuidColumnBuilder;
+    name: import("@assemora/data").ColumnBuilder<string>;
+    label: import("@assemora/data").ColumnBuilder<string>;
+    version: import("@assemora/data").ColumnBuilder<number>;
+    createdAt: import("@assemora/data").TimestampColumnBuilder;
+}, never, Readonly<Record<never, never>>>, import("@assemora/data").Model<{
+    id: import("@assemora/data").UuidColumnBuilder;
+    name: import("@assemora/data").ColumnBuilder<string>;
+    description: import("@assemora/data").ColumnBuilder<string | null>;
+}, never, Readonly<Record<never, never>>>, import("@assemora/data").Model<{
+    id: import("@assemora/data").UuidColumnBuilder;
+    userId: import("@assemora/data").UuidColumnBuilder;
+    roleId: import("@assemora/data").UuidColumnBuilder;
+}, never, Readonly<Record<never, never>>>, import("@assemora/data").Model<{
+    id: import("@assemora/data").UuidColumnBuilder;
+    roleId: import("@assemora/data").UuidColumnBuilder;
+    permissionId: import("@assemora/data").UuidColumnBuilder;
+}, never, Readonly<Record<never, never>>>, import("@assemora/data").Model<{
+    id: import("@assemora/data").UuidColumnBuilder;
+    name: import("@assemora/data").ColumnBuilder<string>;
+    tokenHash: import("@assemora/data").ColumnBuilder<string>;
+    userId: import("@assemora/data").ColumnBuilder<string | null>;
+    permissions: import("@assemora/data").JsonColumnBuilder<readonly string[]>;
+    expiresAt: import("@assemora/data").ColumnBuilder<Date | null>;
+    lastUsedAt: import("@assemora/data").ColumnBuilder<Date | null>;
+    createdAt: import("@assemora/data").TimestampColumnBuilder;
+}, never, Readonly<Record<never, never>>>, import("@assemora/data").Model<{
+    id: import("@assemora/data").UuidColumnBuilder;
+    name: import("@assemora/data").ColumnBuilder<string>;
+    description: import("@assemora/data").ColumnBuilder<string | null>;
+    permissions: import("@assemora/data").JsonColumnBuilder<readonly string[]>;
+    enabled: import("@assemora/data").ColumnBuilder<boolean>;
+    createdAt: import("@assemora/data").TimestampColumnBuilder;
+}, never, Readonly<Record<never, never>>>, import("@assemora/data").Model<{
+    id: import("@assemora/data").UuidColumnBuilder;
+    agentId: import("@assemora/data").UuidColumnBuilder;
+    name: import("@assemora/data").ColumnBuilder<string>;
+    tokenHash: import("@assemora/data").ColumnBuilder<string>;
+    expiresAt: import("@assemora/data").ColumnBuilder<Date | null>;
+    lastUsedAt: import("@assemora/data").ColumnBuilder<Date | null>;
+    createdAt: import("@assemora/data").TimestampColumnBuilder;
+}, never, Readonly<Record<never, never>>>];
+//# sourceMappingURL=models.d.ts.map

package/dist/models.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"models.d.ts","sourceRoot":"","sources":["../src/models.ts"],"names":[],"mappings":"AASA,eAAO,MAAM,IAAI;;;;IAIf,+EAA+E;;;IAG/E,kFAAkF;;;;yCAIlF,CAAA;AAEF,eAAO,MAAM,OAAO;;IAElB,kFAAkF;;;;;;;yCAOlF,CAAA;AAEF,eAAO,MAAM,IAAI;;;;;;yCAMf,CAAA;AAEF,eAAO,MAAM,UAAU;;;;yCAIrB,CAAA;AAEF,eAAO,MAAM,QAAQ;;;;yCAInB,CAAA;AAEF,eAAO,MAAM,cAAc;;;;yCAIzB,CAAA;AAEF,eAAO,MAAM,QAAQ;;;;;;;;;yCASnB,CAAA;AAEF,eAAO,MAAM,KAAK;;;;;;;yCAOhB,CAAA;AAEF,eAAO,MAAM,UAAU;;;;;;;;yCAQrB,CAAA;AAEF,0EAA0E;AAC1E,eAAO,MAAM,UAAU;;;;IA7ErB,+EAA+E;;;IAG/E,kFAAkF;;;;;;IAQlF,kFAAkF;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;0CA4E1E,CAAA"}

package/dist/models.js

@@ -0,0 +1,92 @@
+/**
+ * The tables authentication and authorization live in (SPEC.md §50).
+ *
+ * Nothing sensitive is stored as written: a password is an Argon2id hash and a token
+ * is a digest. What a caller sees once, at creation, is the only time the plaintext
+ * exists (SPEC.md §49, §85).
+ */
+import { boolean, integer, json, model, string, text, timestamp, uuid } from '@assemora/data';
+export const User = model('assemora_users', {
+    id: uuid().primary().defaultRandom(),
+    email: string().unique(),
+    name: string(),
+    /** Argon2id. Never leaves the database and never reaches serialized output. */
+    passwordHash: string().hidden(),
+    active: boolean().default(true),
+    /** Studio states the version it read, and a stale edit is a 409 (SPEC.md §66). */
+    version: integer().default(1),
+    createdAt: timestamp().created(),
+    updatedAt: timestamp().updated(),
+});
+export const Session = model('assemora_sessions', {
+    id: uuid().primary().defaultRandom(),
+    /** A digest of the session secret; the secret itself lives only in the cookie. */
+    tokenHash: string().unique().hidden(),
+    userId: uuid(),
+    userAgent: string().nullable(),
+    ipAddress: string().nullable(),
+    expiresAt: timestamp(),
+    createdAt: timestamp().created(),
+});
+export const Role = model('assemora_roles', {
+    id: uuid().primary().defaultRandom(),
+    name: string().unique(),
+    label: string(),
+    version: integer().default(1),
+    createdAt: timestamp().created(),
+});
+export const Permission = model('assemora_permissions', {
+    id: uuid().primary().defaultRandom(),
+    name: string().unique(),
+    description: text().nullable(),
+});
+export const UserRole = model('assemora_user_roles', {
+    id: uuid().primary().defaultRandom(),
+    userId: uuid(),
+    roleId: uuid(),
+});
+export const RolePermission = model('assemora_role_permissions', {
+    id: uuid().primary().defaultRandom(),
+    roleId: uuid(),
+    permissionId: uuid(),
+});
+export const ApiToken = model('assemora_api_tokens', {
+    id: uuid().primary().defaultRandom(),
+    name: string(),
+    tokenHash: string().unique().hidden(),
+    userId: uuid().nullable(),
+    permissions: json(),
+    expiresAt: timestamp().nullable(),
+    lastUsedAt: timestamp().nullable(),
+    createdAt: timestamp().created(),
+});
+export const Agent = model('assemora_agents', {
+    id: uuid().primary().defaultRandom(),
+    name: string().unique(),
+    description: text().nullable(),
+    permissions: json(),
+    enabled: boolean().default(true),
+    createdAt: timestamp().created(),
+});
+export const AgentToken = model('assemora_agent_tokens', {
+    id: uuid().primary().defaultRandom(),
+    agentId: uuid(),
+    name: string(),
+    tokenHash: string().unique().hidden(),
+    expiresAt: timestamp().nullable(),
+    lastUsedAt: timestamp().nullable(),
+    createdAt: timestamp().created(),
+});
+/** Every table this package owns, for schema generation and for tests. */
+export const authModels = [
+    User,
+    Session,
+    Role,
+    Permission,
+    UserRole,
+    RolePermission,
+    ApiToken,
+    Agent,
+    AgentToken,
+];
+//# sourceMappingURL=models.js.map

package/dist/models.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"models.js","sourceRoot":"","sources":["../src/models.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,gBAAgB,CAAA;AAE7F,MAAM,CAAC,MAAM,IAAI,GAAG,KAAK,CAAC,gBAAgB,EAAE;IAC1C,EAAE,EAAE,IAAI,EAAE,CAAC,OAAO,EAAE,CAAC,aAAa,EAAE;IACpC,KAAK,EAAE,MAAM,EAAE,CAAC,MAAM,EAAE;IACxB,IAAI,EAAE,MAAM,EAAE;IACd,+EAA+E;IAC/E,YAAY,EAAE,MAAM,EAAE,CAAC,MAAM,EAAE;IAC/B,MAAM,EAAE,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;IAC/B,kFAAkF;IAClF,OAAO,EAAE,OAAO,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC;IAC7B,SAAS,EAAE,SAAS,EAAE,CAAC,OAAO,EAAE;IAChC,SAAS,EAAE,SAAS,EAAE,CAAC,OAAO,EAAE;CACjC,CAAC,CAAA;AAEF,MAAM,CAAC,MAAM,OAAO,GAAG,KAAK,CAAC,mBAAmB,EAAE;IAChD,EAAE,EAAE,IAAI,EAAE,CAAC,OAAO,EAAE,CAAC,aAAa,EAAE;IACpC,kFAAkF;IAClF,SAAS,EAAE,MAAM,EAAE,CAAC,MAAM,EAAE,CAAC,MAAM,EAAE;IACrC,MAAM,EAAE,IAAI,EAAE;IACd,SAAS,EAAE,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC9B,SAAS,EAAE,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC9B,SAAS,EAAE,SAAS,EAAE;IACtB,SAAS,EAAE,SAAS,EAAE,CAAC,OAAO,EAAE;CACjC,CAAC,CAAA;AAEF,MAAM,CAAC,MAAM,IAAI,GAAG,KAAK,CAAC,gBAAgB,EAAE;IAC1C,EAAE,EAAE,IAAI,EAAE,CAAC,OAAO,EAAE,CAAC,aAAa,EAAE;IACpC,IAAI,EAAE,MAAM,EAAE,CAAC,MAAM,EAAE;IACvB,KAAK,EAAE,MAAM,EAAE;IACf,OAAO,EAAE,OAAO,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC;IAC7B,SAAS,EAAE,SAAS,EAAE,CAAC,OAAO,EAAE;CACjC,CAAC,CAAA;AAEF,MAAM,CAAC,MAAM,UAAU,GAAG,KAAK,CAAC,sBAAsB,EAAE;IACtD,EAAE,EAAE,IAAI,EAAE,CAAC,OAAO,EAAE,CAAC,aAAa,EAAE;IACpC,IAAI,EAAE,MAAM,EAAE,CAAC,MAAM,EAAE;IACvB,WAAW,EAAE,IAAI,EAAE,CAAC,QAAQ,EAAE;CAC/B,CAAC,CAAA;AAEF,MAAM,CAAC,MAAM,QAAQ,GAAG,KAAK,CAAC,qBAAqB,EAAE;IACnD,EAAE,EAAE,IAAI,EAAE,CAAC,OAAO,EAAE,CAAC,aAAa,EAAE;IACpC,MAAM,EAAE,IAAI,EAAE;IACd,MAAM,EAAE,IAAI,EAAE;CACf,CAAC,CAAA;AAEF,MAAM,CAAC,MAAM,cAAc,GAAG,KAAK,CAAC,2BAA2B,EAAE;IAC/D,EAAE,EAAE,IAAI,EAAE,CAAC,OAAO,EAAE,CAAC,aAAa,EAAE;IACpC,MAAM,EAAE,IAAI,EAAE;IACd,YAAY,EAAE,IAAI,EAAE;CACrB,CAAC,CAAA;AAEF,MAAM,CAAC,MAAM,QAAQ,GAAG,KAAK,CAAC,qBAAqB,EAAE;IACnD,EAAE,EAAE,IAAI,EAAE,CAAC,OAAO,EAAE,CAAC,aAAa,EAAE;IACpC,IAAI,EAAE,MAAM,EAAE;IACd,SAAS,EAAE,MAAM,EAAE,CAAC,MAAM,EAAE,CAAC,MAAM,EAAE;IACrC,MAAM,EAAE,IAAI,EAAE,CAAC,QAAQ,EAAE;IACzB,WAAW,EAAE,IAAI,EAAqB;IACtC,SAAS,EAAE,SAAS,EAAE,CAAC,QAAQ,EAAE;IACjC,UAAU,EAAE,SAAS,EAAE,CAAC,QAAQ,EAAE;IAClC,SAAS,EAAE,SAAS,EAAE,CAAC,OAAO,EAAE;CACjC,CAAC,CAAA;AAEF,MAAM,CAAC,MAAM,KAAK,GAAG,KAAK,CAAC,iBAAiB,EAAE;IAC5C,EAAE,EAAE,IAAI,EAAE,CAAC,OAAO,EAAE,CAAC,aAAa,EAAE;IACpC,IAAI,EAAE,MAAM,EAAE,CAAC,MAAM,EAAE;IACvB,WAAW,EAAE,IAAI,EAAE,CAAC,QAAQ,EAAE;IAC9B,WAAW,EAAE,IAAI,EAAqB;IACtC,OAAO,EAAE,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;IAChC,SAAS,EAAE,SAAS,EAAE,CAAC,OAAO,EAAE;CACjC,CAAC,CAAA;AAEF,MAAM,CAAC,MAAM,UAAU,GAAG,KAAK,CAAC,uBAAuB,EAAE;IACvD,EAAE,EAAE,IAAI,EAAE,CAAC,OAAO,EAAE,CAAC,aAAa,EAAE;IACpC,OAAO,EAAE,IAAI,EAAE;IACf,IAAI,EAAE,MAAM,EAAE;IACd,SAAS,EAAE,MAAM,EAAE,CAAC,MAAM,EAAE,CAAC,MAAM,EAAE;IACrC,SAAS,EAAE,SAAS,EAAE,CAAC,QAAQ,EAAE;IACjC,UAAU,EAAE,SAAS,EAAE,CAAC,QAAQ,EAAE;IAClC,SAAS,EAAE,SAAS,EAAE,CAAC,OAAO,EAAE;CACjC,CAAC,CAAA;AAEF,0EAA0E;AAC1E,MAAM,CAAC,MAAM,UAAU,GAAG;IACxB,IAAI;IACJ,OAAO;IACP,IAAI;IACJ,UAAU;IACV,QAAQ;IACR,cAAc;IACd,QAAQ;IACR,KAAK;IACL,UAAU;CACF,CAAA"}

package/dist/module.d.ts

@@ -0,0 +1,39 @@
+/**
+ * The `auth()` module (SPEC.md §9, §113).
+ *
+ * ```ts
+ * export default assemora({ modules: [auth(), blog()] })
+ * ```
+ *
+ * Registering it is what replaces `permitAll()`: the authorization port core has
+ * declared since phase 1 finally has an implementation, and every command and query
+ * starts passing roles, permissions and policies (ADR-0008).
+ */
+import { type ModuleBuilder } from '@assemora/core';
+import { type Policy } from './policies.js';
+declare module '@assemora/core' {
+    interface ModuleBuilder {
+        /** Registers policies for this module's subjects (SPEC.md §51). */
+        policies(...policies: Policy<never>[]): ModuleBuilder;
+    }
+}
+export declare const definePolicyFacet: () => void;
+export type AuthModuleOptions = {
+    /**
+     * The application's own policies (SPEC.md §51, ADR-0027).
+     *
+     * A module may only write a policy for a subject it declares, because a policy is a
+     * grant and an installed package must not be able to open the application with one.
+     * This is the other door, and it is the application's: it is written at the
+     * composition root, by whoever assembled the modules, so it speaks for the whole
+     * application and is held to no ownership rule.
+     *
+     * A policy over a module's own subject belongs on that module —
+     * `module('blog').resources(Articles).policies(ArticlePolicy)`. Use this for a policy
+     * over somebody else's, which is a decision the application is entitled to make and
+     * a package is not.
+     */
+    readonly policies?: readonly Policy<never>[];
+};
+export declare const auth: (options?: AuthModuleOptions) => ModuleBuilder;
+//# sourceMappingURL=module.d.ts.map

package/dist/module.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"module.d.ts","sourceRoot":"","sources":["../src/module.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AACH,OAAO,EAAyC,KAAK,aAAa,EAAU,MAAM,gBAAgB,CAAA;AAKlG,OAAO,EAIL,KAAK,MAAM,EAGZ,MAAM,eAAe,CAAA;AAGtB,OAAO,QAAQ,gBAAgB,CAAC;IAC9B,UAAU,aAAa;QACrB,mEAAmE;QACnE,QAAQ,CAAC,GAAG,QAAQ,EAAE,MAAM,CAAC,KAAK,CAAC,EAAE,GAAG,aAAa,CAAA;KACtD;CACF;AAkBD,eAAO,MAAM,iBAAiB,QAAO,IA4BpC,CAAA;AAID,MAAM,MAAM,iBAAiB,GAAG;IAC9B;;;;;;;;;;;;;OAaG;IACH,QAAQ,CAAC,QAAQ,CAAC,EAAE,SAAS,MAAM,CAAC,KAAK,CAAC,EAAE,CAAA;CAC7C,CAAA;AAED,eAAO,MAAM,IAAI,aAAa,iBAAiB,KAAQ,aA6CtD,CAAA"}

package/dist/module.js

@@ -0,0 +1,95 @@
+/**
+ * The `auth()` module (SPEC.md §9, §113).
+ *
+ * ```ts
+ * export default assemora({ modules: [auth(), blog()] })
+ * ```
+ *
+ * Registering it is what replaces `permitAll()`: the authorization port core has
+ * declared since phase 1 finally has an implementation, and every command and query
+ * starts passing roles, permissions and policies (ADR-0008).
+ */
+import { ConfigurationError, defineModuleFacet, module } from '@assemora/core';
+import { authCommands, publicAuthPolicy } from './commands.js';
+import { authModels } from './models.js';
+import { foreignSubject, ownsSubject, unattributedSubject } from './ownership.js';
+import { APPLICATION, describedPolicies, describePolicy, policySources, registerModulePolicy, } from './policies.js';
+import { authQueries } from './queries.js';
+let defined = false;
+/**
+ * The policies the application passed to `auth({ policies })`, by identity.
+ *
+ * They travel through the same facet as a module's own — so they are registered at the
+ * same moment, and an application that is created and never booted has them, which is
+ * what a module's `.policies()` has always given. What differs is only the attribution,
+ * and it cannot be a second builder method: a facet is a method on *every* module, and
+ * "register a policy for a subject you do not own" is precisely what no module may have.
+ *
+ * Weak, and private to this file. A package cannot reach it, which is what makes the
+ * exemption the application's rather than anybody's.
+ */
+const applicationOwned = new WeakSet();
+export const definePolicyFacet = () => {
+    if (defined)
+        return;
+    defineModuleFacet('policies', (internals, args) => {
+        internals.addRegistration((context) => {
+            for (const candidate of args) {
+                const declared = candidate;
+                if (declared?.node !== 'policy')
+                    continue;
+                const application = applicationOwned.has(declared);
+                registerModulePolicy(declared, application ? APPLICATION : context.module);
+                // Described where it is registered, by the module that registered it. A policy
+                // grants access, so the one thing the single source must not be silent about
+                // is which package put one there (ADR-0002, ADR-0027). The application's carry
+                // no module, which is what "not a package" has looked like since the section
+                // existed.
+                context.registry.register('policies', application ? describePolicy(declared) : describePolicy(declared, context.module));
+            }
+        });
+    });
+    defined = true;
+};
+definePolicyFacet();
+export const auth = (options = {}) => {
+    // Marked before the module is built, so the facet knows which of the policies it is
+    // handed speak for the application rather than for `auth`.
+    for (const declared of options.policies ?? [])
+        applicationOwned.add(declared);
+    return (module('auth')
+        .models(...authModels)
+        .commands(...authCommands)
+        .queries(...authQueries)
+        .policies(publicAuthPolicy, ...(options.policies ?? []))
+        /**
+         * Every policy, held to the rule that a module speaks only for what it declared.
+         *
+         * At boot rather than at registration, and that is not a detail: ownership is
+         * decided against what the module *registered*, and a facet runs in the order the
+         * builder was written. `.policies(P).resources(Articles)` would be refused and
+         * `.resources(Articles).policies(P)` allowed, for one declaration. By boot every
+         * module has registered everything, so the answer no longer depends on the order
+         * somebody typed two lines in.
+         *
+         * The sweep for what got in through no module at all stays, and is now a refusal
+         * rather than a note: an unattributed policy is exactly the registration nothing
+         * else records, and describing it only ever made it visible.
+         */
+        .boot((context) => {
+        const described = new Set(context.registry.section('policies').map((entry) => entry.name));
+        const sources = policySources();
+        for (const descriptor of describedPolicies()) {
+            const source = sources.get(descriptor.name);
+            if (source === undefined)
+                throw new ConfigurationError(unattributedSubject(descriptor.name));
+            if (source !== APPLICATION && !ownsSubject(context.registry, source, descriptor.name)) {
+                throw new ConfigurationError(foreignSubject(source, descriptor.name));
+            }
+            if (described.has(descriptor.name))
+                continue;
+            context.registry.register('policies', descriptor);
+        }
+    }));
+};
+//# sourceMappingURL=module.js.map

package/dist/module.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"module.js","sourceRoot":"","sources":["../src/module.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AACH,OAAO,EAAE,kBAAkB,EAAE,iBAAiB,EAAsB,MAAM,EAAE,MAAM,gBAAgB,CAAA;AAElG,OAAO,EAAE,YAAY,EAAE,gBAAgB,EAAE,MAAM,eAAe,CAAA;AAC9D,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAA;AACxC,OAAO,EAAE,cAAc,EAAE,WAAW,EAAE,mBAAmB,EAAE,MAAM,gBAAgB,CAAA;AACjF,OAAO,EACL,WAAW,EACX,iBAAiB,EACjB,cAAc,EAEd,aAAa,EACb,oBAAoB,GACrB,MAAM,eAAe,CAAA;AACtB,OAAO,EAAE,WAAW,EAAE,MAAM,cAAc,CAAA;AAS1C,IAAI,OAAO,GAAG,KAAK,CAAA;AAEnB;;;;;;;;;;;GAWG;AACH,MAAM,gBAAgB,GAAG,IAAI,OAAO,EAAiB,CAAA;AAErD,MAAM,CAAC,MAAM,iBAAiB,GAAG,GAAS,EAAE;IAC1C,IAAI,OAAO;QAAE,OAAM;IAEnB,iBAAiB,CAAC,UAAU,EAAE,CAAC,SAAS,EAAE,IAAI,EAAE,EAAE;QAChD,SAAS,CAAC,eAAe,CAAC,CAAC,OAAO,EAAE,EAAE;YACpC,KAAK,MAAM,SAAS,IAAI,IAAI,EAAE,CAAC;gBAC7B,MAAM,QAAQ,GAAG,SAA0B,CAAA;gBAE3C,IAAI,QAAQ,EAAE,IAAI,KAAK,QAAQ;oBAAE,SAAQ;gBAEzC,MAAM,WAAW,GAAG,gBAAgB,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAA;gBAElD,oBAAoB,CAAC,QAAQ,EAAE,WAAW,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,CAAA;gBAE1E,+EAA+E;gBAC/E,6EAA6E;gBAC7E,+EAA+E;gBAC/E,6EAA6E;gBAC7E,WAAW;gBACX,OAAO,CAAC,QAAQ,CAAC,QAAQ,CACvB,UAAU,EACV,WAAW,CAAC,CAAC,CAAC,cAAc,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,cAAc,CAAC,QAAQ,EAAE,OAAO,CAAC,MAAM,CAAC,CAClF,CAAA;YACH,CAAC;QACH,CAAC,CAAC,CAAA;IACJ,CAAC,CAAC,CAAA;IAEF,OAAO,GAAG,IAAI,CAAA;AAChB,CAAC,CAAA;AAED,iBAAiB,EAAE,CAAA;AAoBnB,MAAM,CAAC,MAAM,IAAI,GAAG,CAAC,OAAO,GAAsB,EAAE,EAAiB,EAAE;IACrE,oFAAoF;IACpF,2DAA2D;IAC3D,KAAK,MAAM,QAAQ,IAAI,OAAO,CAAC,QAAQ,IAAI,EAAE;QAAE,gBAAgB,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAA;IAE7E,OAAO,CACL,MAAM,CAAC,MAAM,CAAC;SACX,MAAM,CAAC,GAAG,UAAU,CAAC;SACrB,QAAQ,CAAC,GAAG,YAAY,CAAC;SACzB,OAAO,CAAC,GAAG,WAAW,CAAC;SACvB,QAAQ,CAAC,gBAAgB,EAAE,GAAG,CAAC,OAAO,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAC;QACxD;;;;;;;;;;;;;WAaG;SACF,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE;QAChB,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAA;QAC1F,MAAM,OAAO,GAAG,aAAa,EAAE,CAAA;QAE/B,KAAK,MAAM,UAAU,IAAI,iBAAiB,EAAE,EAAE,CAAC;YAC7C,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC,CAAA;YAE3C,IAAI,MAAM,KAAK,SAAS;gBACtB,MAAM,IAAI,kBAAkB,CAAC,mBAAmB,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAA;YAEpE,IAAI,MAAM,KAAK,WAAW,IAAI,CAAC,WAAW,CAAC,OAAO,CAAC,QAAQ,EAAE,MAAM,EAAE,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;gBACtF,MAAM,IAAI,kBAAkB,CAAC,cAAc,CAAC,MAAM,EAAE,UAAU,CAAC,IAAI,CAAC,CAAC,CAAA;YACvE,CAAC;YAED,IAAI,SAAS,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC;gBAAE,SAAQ;YAE5C,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC,UAAU,EAAE,UAAU,CAAC,CAAA;QACnD,CAAC;IACH,CAAC,CAAC,CACL,CAAA;AACH,CAAC,CAAA"}

package/dist/ownership.d.ts

@@ -0,0 +1,67 @@
+/**
+ * Which subjects a module may speak for (SPEC.md §51, ADR-0027).
+ *
+ * A policy is a *grant*. `authorize` lets a caller through on a permission **or** a
+ * policy, so registering one for `pages` opens `pages.create` to everybody the rule
+ * says yes to — and the rule is somebody's function. That is fine while every module
+ * in the process is first-party. It stops being fine the day a package is installable,
+ * which is what ADR-0027 is for: twelve lines in a dependency would otherwise open the
+ * application, and describing the registration (as `assemora.describe` and Studio now
+ * do) makes it *visible* rather than *impossible*. Looking is not a control.
+ *
+ * So a module may only write a policy for a subject it declared. Three ways to have
+ * declared one, and each is something the module already says out loud:
+ *
+ * **Its own name, as a namespace.** `module('pages')` owns `pages` and `pages.drafts`.
+ * This is what every framework module relies on — `@assemora/pages` names `pages` as
+ * the subject of its block commands, `@assemora/auth` answers for `auth` and
+ * `auth.users` — and it is the case where the module name *is* the domain.
+ *
+ * **A resource or a model it registered.** An application's module is usually named
+ * after the area rather than the table: `module('blog').models(Article)
+ * .resources(Articles)` owns `articles`, and would own nothing at all under a
+ * name-only rule. The registry knows who registered each entry, so this asks it.
+ *
+ * **The group of a command or query it registered.** A subject is what the authorizer
+ * derives from a command's name — everything before the last dot — so a module
+ * declaring `menu.list`, `menu.get` and `menu.dish` owns `menu`, and writing a policy
+ * for it is writing one for its own reads.
+ *
+ * That third one is not a convenience. A real project declares exactly those queries
+ * and a `policy('menu', …)` beside them, *on purpose*: the menu is public and the
+ * generated CRUD over `dishes` is not, so the rule is written on the narrow subject
+ * rather than the wide one. Without this clause the only way to keep booting would have
+ * been to move the policy onto `dishes` — which opens the admin surface. A rule that
+ * pushes an author toward the less safe design is a wrong rule, whatever it prevents.
+ *
+ * ## What this is not
+ *
+ * It is not a sandbox. Everything here runs in one process, and a package determined
+ * to grant itself access can reach past any of it — patch the module, patch this
+ * function, register a resource named `pages` (which the registry would refuse as a
+ * duplicate, but the shape of the attack is the point). Nothing short of a separate
+ * realm changes that, and claiming otherwise would be worse than saying so.
+ *
+ * What it removes is the *casual* case, which is the one that actually happens: a
+ * package that wants a policy for a subject it has nothing to do with now has to
+ * impersonate a module to get one, and impersonation reads as impersonation in a diff.
+ */
+import type { SchemaRegistry } from '@assemora/core';
+/**
+ * Whether `module` declared `subject`, and may therefore write a policy for it.
+ *
+ * @param registry the application's, for the attribution — the module that registered
+ *   each entry, which is what `forModule` records.
+ */
+export declare const ownsSubject: (registry: SchemaRegistry, module: string, subject: string) => boolean;
+/**
+ * Why a subject was refused, in the terms the person reading it can act on.
+ *
+ * It names all three things the refusal is about — who asked, for what, and what would
+ * have had to be true — because a configuration error read at boot is read once, by
+ * somebody who did not write the module that caused it.
+ */
+export declare const foreignSubject: (module: string, subject: string) => string;
+/** The same, for a policy that reached the registry through no module at all. */
+export declare const unattributedSubject: (subject: string) => string;
+//# sourceMappingURL=ownership.d.ts.map

package/dist/ownership.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ownership.d.ts","sourceRoot":"","sources":["../src/ownership.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+CG;AACH,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAA;AAsBpD;;;;;GAKG;AACH,eAAO,MAAM,WAAW,aAAc,cAAc,UAAU,MAAM,WAAW,MAAM,KAAG,OAYvF,CAAA;AAED;;;;;;GAMG;AACH,eAAO,MAAM,cAAc,WAAY,MAAM,WAAW,MAAM,KAAG,MAM8B,CAAA;AAE/F,iFAAiF;AACjF,eAAO,MAAM,mBAAmB,YAAa,MAAM,KAAG,MAGqC,CAAA"}