@assemora/auth 0.1.0

package/dist/ownership.js

@@ -0,0 +1,51 @@
+/**
+ * The sections whose entry names *are* subjects.
+ *
+ * A model is registered under its table and a resource under its name, and both of
+ * those are what a subject is spelled as — `articles`, `pages`, `media`.
+ */
+const NAMING_SECTIONS = ['resources', 'models', 'singletons'];
+/**
+ * The sections whose entry names *contain* a subject.
+ *
+ * A command or a query is `menu.list`, and the subject the authorizer takes from it is
+ * everything before the last dot. These carry the registering module in the descriptor
+ * itself, so they are read rather than attributed.
+ */
+const GROUPING_SECTIONS = ['commands', 'queries'];
+/** What `subjectOf` takes as the subject of `menu.list`. Kept identical to it. */
+const groupOf = (name) => name.slice(0, Math.max(name.lastIndexOf('.'), 0));
+/**
+ * Whether `module` declared `subject`, and may therefore write a policy for it.
+ *
+ * @param registry the application's, for the attribution — the module that registered
+ *   each entry, which is what `forModule` records.
+ */
+export const ownsSubject = (registry, module, subject) => {
+    if (subject === module || subject.startsWith(`${module}.`))
+        return true;
+    if (NAMING_SECTIONS.some((section) => registry.registeredBy(section, subject) === module)) {
+        return true;
+    }
+    return GROUPING_SECTIONS.some((section) => registry
+        .section(section)
+        .some((entry) => entry.module === module && groupOf(entry.name) === subject));
+};
+/**
+ * Why a subject was refused, in the terms the person reading it can act on.
+ *
+ * It names all three things the refusal is about — who asked, for what, and what would
+ * have had to be true — because a configuration error read at boot is read once, by
+ * somebody who did not write the module that caused it.
+ */
+export const foreignSubject = (module, subject) => `Module "${module}" registered a policy for "${subject}", which it does not declare. ` +
+    `A policy is a grant: it lets a caller through where a permission would have been ` +
+    `required, so a module may only write one for a subject of its own. "${module}" would ` +
+    `have to name "${subject}" as a model or a resource, declare a command or query in the "${subject}." group, or be named "${subject}" itself. ` +
+    `If this policy belongs to the application rather than to a module, pass it as ` +
+    `auth({ policies: [...] }) at the composition root, where the application speaks for itself.`;
+/** The same, for a policy that reached the registry through no module at all. */
+export const unattributedSubject = (subject) => `A policy for "${subject}" was registered outside any module, so nothing declares it ` +
+    `and nothing answers for it. Register it on the module that owns the subject with ` +
+    `.policies(...), or — if it is the application's — pass it as auth({ policies: [...] }).`;
+//# sourceMappingURL=ownership.js.map

package/dist/ownership.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ownership.js","sourceRoot":"","sources":["../src/ownership.ts"],"names":[],"mappings":"AAkDA;;;;;GAKG;AACH,MAAM,eAAe,GAAG,CAAC,WAAW,EAAE,QAAQ,EAAE,YAAY,CAAU,CAAA;AAEtE;;;;;;GAMG;AACH,MAAM,iBAAiB,GAAG,CAAC,UAAU,EAAE,SAAS,CAAU,CAAA;AAE1D,kFAAkF;AAClF,MAAM,OAAO,GAAG,CAAC,IAAY,EAAU,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,CAAA;AAE3F;;;;;GAKG;AACH,MAAM,CAAC,MAAM,WAAW,GAAG,CAAC,QAAwB,EAAE,MAAc,EAAE,OAAe,EAAW,EAAE;IAChG,IAAI,OAAO,KAAK,MAAM,IAAI,OAAO,CAAC,UAAU,CAAC,GAAG,MAAM,GAAG,CAAC;QAAE,OAAO,IAAI,CAAA;IAEvE,IAAI,eAAe,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,QAAQ,CAAC,YAAY,CAAC,OAAO,EAAE,OAAO,CAAC,KAAK,MAAM,CAAC,EAAE,CAAC;QAC1F,OAAO,IAAI,CAAA;IACb,CAAC;IAED,OAAO,iBAAiB,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CACxC,QAAQ;SACL,OAAO,CAAC,OAAO,CAAC;SAChB,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM,KAAK,MAAM,IAAI,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,OAAO,CAAC,CAC/E,CAAA;AACH,CAAC,CAAA;AAED;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,MAAc,EAAE,OAAe,EAAU,EAAE,CACxE,WAAW,MAAM,8BAA8B,OAAO,gCAAgC;IACtF,mFAAmF;IACnF,uEAAuE,MAAM,UAAU;IACvF,iBAAiB,OAAO,kEAAkE,OAAO,0BAA0B,OAAO,YAAY;IAC9I,gFAAgF;IAChF,6FAA6F,CAAA;AAE/F,iFAAiF;AACjF,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC,OAAe,EAAU,EAAE,CAC7D,iBAAiB,OAAO,8DAA8D;IACtF,mFAAmF;IACnF,yFAAyF,CAAA"}

package/dist/permissions.d.ts

@@ -0,0 +1,40 @@
+/**
+ * What an actor is allowed to do (SPEC.md §50).
+ *
+ * A user's permissions come from the roles they hold; an API token and an agent
+ * carry their own list. All three answer the same question the same way, which is
+ * why a policy never has to know which kind of actor it is looking at.
+ *
+ * All three are also asked a question before that one: whether this is still an
+ * actor at all. It is asked *here* rather than where a credential is accepted,
+ * because not every path presents a credential. A session is checked when the cookie
+ * is read (`sessionActor`) and a bearer token when the header is (`tokenActor`), but
+ * a job carries an actor sealed into an envelope and is replayed by a worker hours
+ * later with nothing to present — as does anything else that stores an identity and
+ * acts on it afterwards. This function is the one narrow place every one of those
+ * paths goes through, so this is where liveness has to be decided (ADR-0023).
+ *
+ * The cost is a row read: resolving a user's permissions is four queries rather than
+ * three, and the command pipeline resolves them twice — once for the permission
+ * check and once for the policy rule (ADR-0015). It buys the only revocation the
+ * framework has, so it is paid on every command. A deactivated actor short-circuits
+ * to one query, which is the case where it matters that it is cheap.
+ */
+import type { Actor } from '@assemora/core';
+/** Grants everything. Given to the first administrator, and to nobody casually. */
+export declare const WILDCARD = "*";
+export type PermissionSet = ReadonlySet<string>;
+/** Everything this actor may do, whoever they are. */
+export declare const permissionsOf: (actor: Actor | undefined) => Promise<PermissionSet>;
+/**
+ * Whether a permission is held, exactly or by a wildcard above it.
+ *
+ * `articles.update` is held by `articles.update`, by `articles.*`, and by `*`. The
+ * grouped form is what makes a role like "editor" writable at all — `content.*` says
+ * something a list of forty names does not — and it matches how the names themselves
+ * are built, since a command name *is* a permission name (ADR-0015).
+ *
+ * Only whole segments match: `articles.*` does not grant `articlesecret.read`.
+ */
+export declare const holds: (permissions: PermissionSet, permission: string) => boolean;
+//# sourceMappingURL=permissions.d.ts.map

package/dist/permissions.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"permissions.d.ts","sourceRoot":"","sources":["../src/permissions.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,gBAAgB,CAAA;AAK3C,mFAAmF;AACnF,eAAO,MAAM,QAAQ,MAAM,CAAA;AAE3B,MAAM,MAAM,aAAa,GAAG,WAAW,CAAC,MAAM,CAAC,CAAA;AAmE/C,sDAAsD;AACtD,eAAO,MAAM,aAAa,UAAiB,KAAK,GAAG,SAAS,KAAG,OAAO,CAAC,aAAa,CAWnF,CAAA;AAED;;;;;;;;;GASG;AACH,eAAO,MAAM,KAAK,gBAAiB,aAAa,cAAc,MAAM,KAAG,OAUtE,CAAA"}

package/dist/permissions.js

@@ -0,0 +1,86 @@
+import { Agent, ApiToken, Permission, RolePermission, User, UserRole } from './models.js';
+import { isLive } from './tokens.js';
+/** Grants everything. Given to the first administrator, and to nobody casually. */
+export const WILDCARD = '*';
+const EMPTY = new Set();
+/**
+ * Whether the person behind an actor may still act.
+ *
+ * An absent row is deliberately *not* a revocation. The framework has no user
+ * deletion — `active: false` is the whole of how a person is cut off — so an absence
+ * is never something this system decided; it is an application whose identities live
+ * in an SSO directory and whose roles are assigned here, and denying on absence
+ * would make `assemora_user_roles` unusable for it. `active: false` is a statement,
+ * and it is the one that binds.
+ */
+const userIsLive = async (userId) => {
+    const user = await User.find(userId);
+    return user === null || user.active;
+};
+const permissionsOfUser = async (userId) => {
+    // Asked first, so a user who may not act costs one read instead of four.
+    if (!(await userIsLive(userId)))
+        return EMPTY;
+    const roles = await UserRole.where('userId', userId);
+    if (roles.length === 0)
+        return EMPTY;
+    const links = await RolePermission.whereIn('roleId', roles.map((role) => role.roleId));
+    if (links.length === 0)
+        return EMPTY;
+    const permissions = await Permission.whereIn('id', links.map((link) => link.permissionId));
+    return new Set(permissions.map((permission) => permission.name));
+};
+const permissionsOfAgent = async (agentId) => {
+    const agent = await Agent.find(agentId);
+    if (agent === null || !agent.enabled)
+        return EMPTY;
+    return new Set(agent.permissions);
+};
+const permissionsOfApiToken = async (tokenId) => {
+    const token = await ApiToken.find(tokenId);
+    // `tokenActor` refuses an expired token at the header, but a token id restored
+    // from anywhere else — a queue, a stored context — never passes that check, and a
+    // token whose expiry has come and gone is not a credential any more.
+    if (token === null || !isLive(token.expiresAt))
+        return EMPTY;
+    // A token issued *for* a person is that person's access under another name.
+    // Deactivating them has to take it with it, or the one revocation gesture the
+    // framework has quietly leaves a door open (SPEC.md §49).
+    if (token.userId !== null && !(await userIsLive(token.userId)))
+        return EMPTY;
+    return new Set(token.permissions);
+};
+/** Everything this actor may do, whoever they are. */
+export const permissionsOf = async (actor) => {
+    if (actor === undefined)
+        return EMPTY;
+    switch (actor.type) {
+        case 'user':
+            return permissionsOfUser(actor.id);
+        case 'agent':
+            return permissionsOfAgent(actor.id);
+        case 'api':
+            return permissionsOfApiToken(actor.id);
+    }
+};
+/**
+ * Whether a permission is held, exactly or by a wildcard above it.
+ *
+ * `articles.update` is held by `articles.update`, by `articles.*`, and by `*`. The
+ * grouped form is what makes a role like "editor" writable at all — `content.*` says
+ * something a list of forty names does not — and it matches how the names themselves
+ * are built, since a command name *is* a permission name (ADR-0015).
+ *
+ * Only whole segments match: `articles.*` does not grant `articlesecret.read`.
+ */
+export const holds = (permissions, permission) => {
+    if (permissions.has(WILDCARD) || permissions.has(permission))
+        return true;
+    const segments = permission.split('.');
+    for (let depth = segments.length - 1; depth > 0; depth -= 1) {
+        if (permissions.has(`${segments.slice(0, depth).join('.')}.*`))
+            return true;
+    }
+    return false;
+};
+//# sourceMappingURL=permissions.js.map

package/dist/permissions.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"permissions.js","sourceRoot":"","sources":["../src/permissions.ts"],"names":[],"mappings":"AAwBA,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,UAAU,EAAE,cAAc,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAA;AACzF,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAA;AAEpC,mFAAmF;AACnF,MAAM,CAAC,MAAM,QAAQ,GAAG,GAAG,CAAA;AAI3B,MAAM,KAAK,GAAkB,IAAI,GAAG,EAAE,CAAA;AAEtC;;;;;;;;;GASG;AACH,MAAM,UAAU,GAAG,KAAK,EAAE,MAAc,EAAoB,EAAE;IAC5D,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,CAAA;IAEpC,OAAO,IAAI,KAAK,IAAI,IAAI,IAAI,CAAC,MAAM,CAAA;AACrC,CAAC,CAAA;AAED,MAAM,iBAAiB,GAAG,KAAK,EAAE,MAAc,EAA0B,EAAE;IACzE,yEAAyE;IACzE,IAAI,CAAC,CAAC,MAAM,UAAU,CAAC,MAAM,CAAC,CAAC;QAAE,OAAO,KAAK,CAAA;IAE7C,MAAM,KAAK,GAAG,MAAM,QAAQ,CAAC,KAAK,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAA;IAEpD,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,KAAK,CAAA;IAEpC,MAAM,KAAK,GAAG,MAAM,cAAc,CAAC,OAAO,CACxC,QAAQ,EACR,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,CACjC,CAAA;IAED,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,KAAK,CAAA;IAEpC,MAAM,WAAW,GAAG,MAAM,UAAU,CAAC,OAAO,CAC1C,IAAI,EACJ,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,YAAY,CAAC,CACvC,CAAA;IAED,OAAO,IAAI,GAAG,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,UAAU,EAAE,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAA;AAClE,CAAC,CAAA;AAED,MAAM,kBAAkB,GAAG,KAAK,EAAE,OAAe,EAA0B,EAAE;IAC3E,MAAM,KAAK,GAAG,MAAM,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,CAAA;IAEvC,IAAI,KAAK,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO;QAAE,OAAO,KAAK,CAAA;IAElD,OAAO,IAAI,GAAG,CAAC,KAAK,CAAC,WAAW,CAAC,CAAA;AACnC,CAAC,CAAA;AAED,MAAM,qBAAqB,GAAG,KAAK,EAAE,OAAe,EAA0B,EAAE;IAC9E,MAAM,KAAK,GAAG,MAAM,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,CAAA;IAE1C,+EAA+E;IAC/E,kFAAkF;IAClF,qEAAqE;IACrE,IAAI,KAAK,KAAK,IAAI,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC;QAAE,OAAO,KAAK,CAAA;IAE5D,4EAA4E;IAC5E,8EAA8E;IAC9E,0DAA0D;IAC1D,IAAI,KAAK,CAAC,MAAM,KAAK,IAAI,IAAI,CAAC,CAAC,MAAM,UAAU,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;QAAE,OAAO,KAAK,CAAA;IAE5E,OAAO,IAAI,GAAG,CAAC,KAAK,CAAC,WAAW,CAAC,CAAA;AACnC,CAAC,CAAA;AAED,sDAAsD;AACtD,MAAM,CAAC,MAAM,aAAa,GAAG,KAAK,EAAE,KAAwB,EAA0B,EAAE;IACtF,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,KAAK,CAAA;IAErC,QAAQ,KAAK,CAAC,IAAI,EAAE,CAAC;QACnB,KAAK,MAAM;YACT,OAAO,iBAAiB,CAAC,KAAK,CAAC,EAAE,CAAC,CAAA;QACpC,KAAK,OAAO;YACV,OAAO,kBAAkB,CAAC,KAAK,CAAC,EAAE,CAAC,CAAA;QACrC,KAAK,KAAK;YACR,OAAO,qBAAqB,CAAC,KAAK,CAAC,EAAE,CAAC,CAAA;IAC1C,CAAC;AACH,CAAC,CAAA;AAED;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,KAAK,GAAG,CAAC,WAA0B,EAAE,UAAkB,EAAW,EAAE;IAC/E,IAAI,WAAW,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,WAAW,CAAC,GAAG,CAAC,UAAU,CAAC;QAAE,OAAO,IAAI,CAAA;IAEzE,MAAM,QAAQ,GAAG,UAAU,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;IAEtC,KAAK,IAAI,KAAK,GAAG,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,KAAK,GAAG,CAAC,EAAE,KAAK,IAAI,CAAC,EAAE,CAAC;QAC5D,IAAI,WAAW,CAAC,GAAG,CAAC,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC;YAAE,OAAO,IAAI,CAAA;IAC7E,CAAC;IAED,OAAO,KAAK,CAAA;AACd,CAAC,CAAA"}

package/dist/policies.d.ts

@@ -0,0 +1,120 @@
+/**
+ * Policies (SPEC.md §51).
+ *
+ * A policy answers one question — may this actor do this to this thing — and the
+ * same answer is given to Studio, REST, the SDK, the CLI and MCP, because they all
+ * arrive through the same Command Bus and the same Query Bus.
+ */
+import { type Actor, type AssemoraContext } from '@assemora/core';
+export type PolicyActor = Actor | undefined;
+export type PolicyContext<R = unknown> = {
+    readonly actor: PolicyActor;
+    /** The row being acted on, once it has been read. `undefined` before that. */
+    readonly record: R;
+    readonly context: AssemoraContext;
+    /** Whether the actor holds a named permission (SPEC.md §50). */
+    can(permission: string): boolean;
+};
+export type PolicyRule<R = unknown> = (context: PolicyContext<R>) => boolean | Promise<boolean>;
+/**
+ * Rules by action. `read`, `create`, `update` and `delete` are the ones the CRUD
+ * commands ask about; any other name is asked for by whoever defines it.
+ */
+export type PolicyRules<R = unknown> = Readonly<Record<string, PolicyRule<R>>>;
+export type Policy<R = unknown> = {
+    readonly node: 'policy';
+    readonly subject: string;
+    readonly rules: PolicyRules<R>;
+};
+/**
+ * ```ts
+ * export const ArticlePolicy = policy('articles', {
+ *   read: () => true,
+ *   update: ({ actor, record }) => actor?.id === record.authorId,
+ *   delete: ({ can }) => can('articles.delete'),
+ * })
+ * ```
+ *
+ * SPEC.md §51 spells the record argument after the model — `{ actor, article }`.
+ * It is named `record` here because the key would have to be derived from a literal
+ * table name that `model()` does not preserve; naming it after the subject would be
+ * a runtime-only convenience with no type behind it.
+ */
+export declare const policy: <R = Record<string, unknown>>(subject: string, rules: PolicyRules<R>) => Policy<R>;
+/**
+ * What the Schema Registry is told about a policy (SPEC.md §51, ADR-0002).
+ *
+ * The rules themselves are functions and stay here: a function does not survive
+ * `JSON.stringify`, so a descriptor that carried one would arrive at Studio as an empty
+ * object and be worse than saying nothing (ADR-0027). What travels is the shape of the
+ * thing — which subject, which actions it answers for, and which module put it there.
+ *
+ * That last field is the reason this section exists at all. `registerPolicy` grants
+ * access, and until now it wrote nothing anywhere: an installed package could open
+ * `pages.create` to everybody in twelve lines and the application's single source of
+ * truth described the rest of the system perfectly while saying nothing about that.
+ */
+export type PolicyDescriptor = {
+    /** The subject the policy is about, which is what it is addressed by. */
+    readonly name: string;
+    /** The actions it answers for, in declaration order. */
+    readonly actions: readonly string[];
+    /**
+     * The module that registered it, when a module did.
+     *
+     * Absent means `registerPolicy` was called outside module registration — which is
+     * legal, and is exactly the case worth being able to see.
+     */
+    readonly module?: string;
+};
+declare module '@assemora/core' {
+    interface RegistrySections {
+        policies: PolicyDescriptor;
+    }
+}
+export declare const describePolicy: (definition: Policy<never>, module?: string) => PolicyDescriptor;
+/**
+ * What the application's own policies are attributed to.
+ *
+ * A policy passed as `auth({ policies: [...] })` is written at the composition root by
+ * the person who assembled the application, so it speaks for the whole of it and is
+ * held to no ownership rule — the application *is* the trust boundary the rule exists
+ * to protect. A symbol rather than a name so that no module can be called this, and so
+ * that a descriptor never carries it: the section shows such a policy with no `module`,
+ * which is what "the application, not a package" has looked like since #5.
+ */
+export declare const APPLICATION: unique symbol;
+export type PolicySource = string | typeof APPLICATION;
+/**
+ * Puts a rule in the map, attributed to whoever is registering it.
+ *
+ * Deliberately *not* exported from this package. The source is what the ownership rule
+ * is checked against, so a caller able to supply one is a caller able to claim to be
+ * `pages` — and a package outside this file cannot reach this function to try
+ * (ADR-0027). The two callers are the module facet, which passes the module the
+ * builder is registering, and `auth({ policies })`, which passes `APPLICATION`.
+ */
+export declare const registerModulePolicy: (definition: Policy<never>, module: PolicySource) => void;
+/**
+ * Puts a rule in the map, attributed to nobody.
+ *
+ * Exported, because a test of the authorization port needs a policy in front of it and
+ * never boots an application. An application *does* boot, and refuses to start on a
+ * policy nothing declares — so this is a harness seam rather than a way in: a package
+ * that calls it at import time takes the application down at boot, naming the subject
+ * and itself (`ownership.ts`).
+ */
+export declare const registerPolicy: (definition: Policy<never>) => void;
+/**
+ * Who registered each policy, including the ones the application registered itself.
+ *
+ * `describedPolicies` cannot answer this: a descriptor carries a module *name*, and
+ * the application is deliberately not one. The check at boot needs the difference.
+ */
+export declare const policySources: () => ReadonlyMap<string, PolicySource>;
+export declare const policyFor: (subject: string) => Policy<never> | undefined;
+export declare const registeredPolicies: () => readonly Policy<never>[];
+/** Every policy as the registry describes it, whoever registered it and however. */
+export declare const describedPolicies: () => readonly PolicyDescriptor[];
+export declare const clearPolicies: () => void;
+//# sourceMappingURL=policies.d.ts.map

package/dist/policies.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"policies.d.ts","sourceRoot":"","sources":["../src/policies.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,OAAO,EAAE,KAAK,KAAK,EAAE,KAAK,eAAe,EAAiB,MAAM,gBAAgB,CAAA;AAEhF,MAAM,MAAM,WAAW,GAAG,KAAK,GAAG,SAAS,CAAA;AAE3C,MAAM,MAAM,aAAa,CAAC,CAAC,GAAG,OAAO,IAAI;IACvC,QAAQ,CAAC,KAAK,EAAE,WAAW,CAAA;IAC3B,8EAA8E;IAC9E,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAA;IAClB,QAAQ,CAAC,OAAO,EAAE,eAAe,CAAA;IACjC,gEAAgE;IAChE,GAAG,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAA;CACjC,CAAA;AAED,MAAM,MAAM,UAAU,CAAC,CAAC,GAAG,OAAO,IAAI,CAAC,OAAO,EAAE,aAAa,CAAC,CAAC,CAAC,KAAK,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAAA;AAE/F;;;GAGG;AACH,MAAM,MAAM,WAAW,CAAC,CAAC,GAAG,OAAO,IAAI,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,CAAA;AAE9E,MAAM,MAAM,MAAM,CAAC,CAAC,GAAG,OAAO,IAAI;IAChC,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAA;IACvB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;IACxB,QAAQ,CAAC,KAAK,EAAE,WAAW,CAAC,CAAC,CAAC,CAAA;CAC/B,CAAA;AAED;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,MAAM,GAAI,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,WACvC,MAAM,SACR,WAAW,CAAC,CAAC,CAAC,KACpB,MAAM,CAAC,CAAC,CAAyC,CAAA;AAEpD;;;;;;;;;;;;GAYG;AACH,MAAM,MAAM,gBAAgB,GAAG;IAC7B,yEAAyE;IACzE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,wDAAwD;IACxD,QAAQ,CAAC,OAAO,EAAE,SAAS,MAAM,EAAE,CAAA;IACnC;;;;;OAKG;IACH,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAA;CACzB,CAAA;AAED,OAAO,QAAQ,gBAAgB,CAAC;IAC9B,UAAU,gBAAgB;QACxB,QAAQ,EAAE,gBAAgB,CAAA;KAC3B;CACF;AAED,eAAO,MAAM,cAAc,eAAgB,MAAM,CAAC,KAAK,CAAC,WAAW,MAAM,KAAG,gBAI1E,CAAA;AAOF;;;;;;;;;GASG;AACH,eAAO,MAAM,WAAW,EAAE,OAAO,MAAuC,CAAA;AAExE,MAAM,MAAM,YAAY,GAAG,MAAM,GAAG,OAAO,WAAW,CAAA;AAEtD;;;;;;;;GAQG;AACH,eAAO,MAAM,oBAAoB,eAAgB,MAAM,CAAC,KAAK,CAAC,UAAU,YAAY,KAAG,IAGtF,CAAA;AAED;;;;;;;;GAQG;AACH,eAAO,MAAM,cAAc,eAAgB,MAAM,CAAC,KAAK,CAAC,KAAG,IAU1D,CAAA;AAED;;;;;GAKG;AACH,eAAO,MAAM,aAAa,QAAO,WAAW,CAAC,MAAM,EAAE,YAAY,CAAY,CAAA;AAE7E,eAAO,MAAM,SAAS,YAAa,MAAM,KAAG,MAAM,CAAC,KAAK,CAAC,GAAG,SAAoC,CAAA;AAEhG,eAAO,MAAM,kBAAkB,QAAO,SAAS,MAAM,CAAC,KAAK,CAAC,EAA8B,CAAA;AAE1F,oFAAoF;AACpF,eAAO,MAAM,iBAAiB,QAAO,SAAS,gBAAgB,EAQ1D,CAAA;AAEJ,eAAO,MAAM,aAAa,QAAO,IAGhC,CAAA"}

package/dist/policies.js

@@ -0,0 +1,92 @@
+/**
+ * Policies (SPEC.md §51).
+ *
+ * A policy answers one question — may this actor do this to this thing — and the
+ * same answer is given to Studio, REST, the SDK, the CLI and MCP, because they all
+ * arrive through the same Command Bus and the same Query Bus.
+ */
+import { AssemoraError } from '@assemora/core';
+/**
+ * ```ts
+ * export const ArticlePolicy = policy('articles', {
+ *   read: () => true,
+ *   update: ({ actor, record }) => actor?.id === record.authorId,
+ *   delete: ({ can }) => can('articles.delete'),
+ * })
+ * ```
+ *
+ * SPEC.md §51 spells the record argument after the model — `{ actor, article }`.
+ * It is named `record` here because the key would have to be derived from a literal
+ * table name that `model()` does not preserve; naming it after the subject would be
+ * a runtime-only convenience with no type behind it.
+ */
+export const policy = (subject, rules) => ({ node: 'policy', subject, rules });
+export const describePolicy = (definition, module) => ({
+    name: definition.subject,
+    actions: Object.keys(definition.rules),
+    ...(module === undefined ? {} : { module }),
+});
+const registered = new Map();
+/** Which module registered which subject, for the check at boot to be able to say. */
+const sources = new Map();
+/**
+ * What the application's own policies are attributed to.
+ *
+ * A policy passed as `auth({ policies: [...] })` is written at the composition root by
+ * the person who assembled the application, so it speaks for the whole of it and is
+ * held to no ownership rule — the application *is* the trust boundary the rule exists
+ * to protect. A symbol rather than a name so that no module can be called this, and so
+ * that a descriptor never carries it: the section shows such a policy with no `module`,
+ * which is what "the application, not a package" has looked like since #5.
+ */
+export const APPLICATION = Symbol('assemora.application');
+/**
+ * Puts a rule in the map, attributed to whoever is registering it.
+ *
+ * Deliberately *not* exported from this package. The source is what the ownership rule
+ * is checked against, so a caller able to supply one is a caller able to claim to be
+ * `pages` — and a package outside this file cannot reach this function to try
+ * (ADR-0027). The two callers are the module facet, which passes the module the
+ * builder is registering, and `auth({ policies })`, which passes `APPLICATION`.
+ */
+export const registerModulePolicy = (definition, module) => {
+    registerPolicy(definition);
+    sources.set(definition.subject, module);
+};
+/**
+ * Puts a rule in the map, attributed to nobody.
+ *
+ * Exported, because a test of the authorization port needs a policy in front of it and
+ * never boots an application. An application *does* boot, and refuses to start on a
+ * policy nothing declares — so this is a harness seam rather than a way in: a package
+ * that calls it at import time takes the application down at boot, naming the subject
+ * and itself (`ownership.ts`).
+ */
+export const registerPolicy = (definition) => {
+    if (registered.has(definition.subject)) {
+        throw new AssemoraError('CONFIGURATION_ERROR', `A policy for "${definition.subject}" is already registered`, { status: 500 });
+    }
+    registered.set(definition.subject, definition);
+};
+/**
+ * Who registered each policy, including the ones the application registered itself.
+ *
+ * `describedPolicies` cannot answer this: a descriptor carries a module *name*, and
+ * the application is deliberately not one. The check at boot needs the difference.
+ */
+export const policySources = () => sources;
+export const policyFor = (subject) => registered.get(subject);
+export const registeredPolicies = () => [...registered.values()];
+/** Every policy as the registry describes it, whoever registered it and however. */
+export const describedPolicies = () => [...registered.values()].map((definition) => {
+    const source = sources.get(definition.subject);
+    // The application's policies are described with no module, which is the shape a
+    // registration outside any module has always had — and the right one: naming a
+    // module there would claim a package wrote what the application wrote.
+    return describePolicy(definition, typeof source === 'string' ? source : undefined);
+});
+export const clearPolicies = () => {
+    registered.clear();
+    sources.clear();
+};
+//# sourceMappingURL=policies.js.map

package/dist/policies.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"policies.js","sourceRoot":"","sources":["../src/policies.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,OAAO,EAAoC,aAAa,EAAE,MAAM,gBAAgB,CAAA;AA2BhF;;;;;;;;;;;;;GAaG;AACH,MAAM,CAAC,MAAM,MAAM,GAAG,CACpB,OAAe,EACf,KAAqB,EACV,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,CAAA;AAmCpD,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,UAAyB,EAAE,MAAe,EAAoB,EAAE,CAAC,CAAC;IAC/F,IAAI,EAAE,UAAU,CAAC,OAAO;IACxB,OAAO,EAAE,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC;IACtC,GAAG,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC;CAC5C,CAAC,CAAA;AAEF,MAAM,UAAU,GAAG,IAAI,GAAG,EAAyB,CAAA;AAEnD,sFAAsF;AACtF,MAAM,OAAO,GAAG,IAAI,GAAG,EAAwB,CAAA;AAE/C;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,WAAW,GAAkB,MAAM,CAAC,sBAAsB,CAAC,CAAA;AAIxE;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC,UAAyB,EAAE,MAAoB,EAAQ,EAAE;IAC5F,cAAc,CAAC,UAAU,CAAC,CAAA;IAC1B,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,OAAO,EAAE,MAAM,CAAC,CAAA;AACzC,CAAC,CAAA;AAED;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,UAAyB,EAAQ,EAAE;IAChE,IAAI,UAAU,CAAC,GAAG,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;QACvC,MAAM,IAAI,aAAa,CACrB,qBAAqB,EACrB,iBAAiB,UAAU,CAAC,OAAO,yBAAyB,EAC5D,EAAE,MAAM,EAAE,GAAG,EAAE,CAChB,CAAA;IACH,CAAC;IAED,UAAU,CAAC,GAAG,CAAC,UAAU,CAAC,OAAO,EAAE,UAAU,CAAC,CAAA;AAChD,CAAC,CAAA;AAED;;;;;GAKG;AACH,MAAM,CAAC,MAAM,aAAa,GAAG,GAAsC,EAAE,CAAC,OAAO,CAAA;AAE7E,MAAM,CAAC,MAAM,SAAS,GAAG,CAAC,OAAe,EAA6B,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC,OAAO,CAAC,CAAA;AAEhG,MAAM,CAAC,MAAM,kBAAkB,GAAG,GAA6B,EAAE,CAAC,CAAC,GAAG,UAAU,CAAC,MAAM,EAAE,CAAC,CAAA;AAE1F,oFAAoF;AACpF,MAAM,CAAC,MAAM,iBAAiB,GAAG,GAAgC,EAAE,CACjE,CAAC,GAAG,UAAU,CAAC,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,UAAU,EAAE,EAAE;IAC1C,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,OAAO,CAAC,CAAA;IAE9C,gFAAgF;IAChF,+EAA+E;IAC/E,uEAAuE;IACvE,OAAO,cAAc,CAAC,UAAU,EAAE,OAAO,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC,CAAA;AACpF,CAAC,CAAC,CAAA;AAEJ,MAAM,CAAC,MAAM,aAAa,GAAG,GAAS,EAAE;IACtC,UAAU,CAAC,KAAK,EAAE,CAAA;IAClB,OAAO,CAAC,KAAK,EAAE,CAAA;AACjB,CAAC,CAAA"}

package/dist/queries.d.ts

@@ -0,0 +1,166 @@
+export declare const ListUsers: import("@assemora/core").QueryDefinition<{
+    page: import("@assemora/schema").OptionalSchema<number>;
+    perPage: import("@assemora/schema").OptionalSchema<number>;
+    search: import("@assemora/schema").OptionalSchema<string>;
+    active: import("@assemora/schema").OptionalSchema<boolean>;
+}, {
+    readonly data: readonly {
+        readonly active: boolean;
+        readonly createdAt: Date;
+        readonly email: string;
+        readonly id: string;
+        readonly name: string;
+        readonly roles: readonly string[];
+        readonly version: number;
+    }[];
+    readonly lastPage: number;
+    readonly page: number;
+    readonly perPage: number;
+    readonly total: number;
+}>;
+export declare const GetUser: import("@assemora/core").QueryDefinition<{
+    id: import("@assemora/schema").StringSchema;
+}, {
+    readonly active: boolean;
+    readonly createdAt: Date;
+    readonly email: string;
+    readonly id: string;
+    readonly name: string;
+    readonly permissions: readonly string[];
+    readonly roles: readonly string[];
+    readonly updatedAt: Date;
+    readonly version: number;
+}>;
+export declare const ListRoles: import("@assemora/core").QueryDefinition<{}, {
+    readonly data: readonly {
+        readonly id: string;
+        readonly label: string;
+        readonly name: string;
+        readonly permissions: readonly string[];
+        readonly version: number;
+    }[];
+}>;
+export declare const ListPermissions: import("@assemora/core").QueryDefinition<{}, {
+    readonly data: readonly {
+        readonly description: string | null;
+        readonly id: string;
+        readonly name: string;
+    }[];
+}>;
+export declare const ListApiTokens: import("@assemora/core").QueryDefinition<{
+    page: import("@assemora/schema").OptionalSchema<number>;
+    perPage: import("@assemora/schema").OptionalSchema<number>;
+    userId: import("@assemora/schema").OptionalSchema<string>;
+}, {
+    readonly data: readonly {
+        readonly createdAt: Date;
+        readonly expiresAt: Date | null;
+        readonly id: string;
+        readonly lastUsedAt: Date | null;
+        readonly name: string;
+        readonly permissions: readonly string[];
+        readonly userId: string | null;
+    }[];
+    readonly lastPage: number;
+    readonly page: number;
+    readonly perPage: number;
+    readonly total: number;
+}>;
+export declare const ListAgents: import("@assemora/core").QueryDefinition<{
+    page: import("@assemora/schema").OptionalSchema<number>;
+    perPage: import("@assemora/schema").OptionalSchema<number>;
+}, {
+    readonly data: readonly {
+        readonly createdAt: Date;
+        readonly description: string | null;
+        readonly enabled: boolean;
+        readonly id: string;
+        readonly name: string;
+        readonly permissions: readonly string[];
+    }[];
+    readonly lastPage: number;
+    readonly page: number;
+    readonly perPage: number;
+    readonly total: number;
+}>;
+export declare const authQueries: readonly [import("@assemora/core").QueryDefinition<{
+    page: import("@assemora/schema").OptionalSchema<number>;
+    perPage: import("@assemora/schema").OptionalSchema<number>;
+    search: import("@assemora/schema").OptionalSchema<string>;
+    active: import("@assemora/schema").OptionalSchema<boolean>;
+}, {
+    readonly data: readonly {
+        readonly active: boolean;
+        readonly createdAt: Date;
+        readonly email: string;
+        readonly id: string;
+        readonly name: string;
+        readonly roles: readonly string[];
+        readonly version: number;
+    }[];
+    readonly lastPage: number;
+    readonly page: number;
+    readonly perPage: number;
+    readonly total: number;
+}>, import("@assemora/core").QueryDefinition<{
+    id: import("@assemora/schema").StringSchema;
+}, {
+    readonly active: boolean;
+    readonly createdAt: Date;
+    readonly email: string;
+    readonly id: string;
+    readonly name: string;
+    readonly permissions: readonly string[];
+    readonly roles: readonly string[];
+    readonly updatedAt: Date;
+    readonly version: number;
+}>, import("@assemora/core").QueryDefinition<{}, {
+    readonly data: readonly {
+        readonly id: string;
+        readonly label: string;
+        readonly name: string;
+        readonly permissions: readonly string[];
+        readonly version: number;
+    }[];
+}>, import("@assemora/core").QueryDefinition<{}, {
+    readonly data: readonly {
+        readonly description: string | null;
+        readonly id: string;
+        readonly name: string;
+    }[];
+}>, import("@assemora/core").QueryDefinition<{
+    page: import("@assemora/schema").OptionalSchema<number>;
+    perPage: import("@assemora/schema").OptionalSchema<number>;
+    userId: import("@assemora/schema").OptionalSchema<string>;
+}, {
+    readonly data: readonly {
+        readonly createdAt: Date;
+        readonly expiresAt: Date | null;
+        readonly id: string;
+        readonly lastUsedAt: Date | null;
+        readonly name: string;
+        readonly permissions: readonly string[];
+        readonly userId: string | null;
+    }[];
+    readonly lastPage: number;
+    readonly page: number;
+    readonly perPage: number;
+    readonly total: number;
+}>, import("@assemora/core").QueryDefinition<{
+    page: import("@assemora/schema").OptionalSchema<number>;
+    perPage: import("@assemora/schema").OptionalSchema<number>;
+}, {
+    readonly data: readonly {
+        readonly createdAt: Date;
+        readonly description: string | null;
+        readonly enabled: boolean;
+        readonly id: string;
+        readonly name: string;
+        readonly permissions: readonly string[];
+    }[];
+    readonly lastPage: number;
+    readonly page: number;
+    readonly perPage: number;
+    readonly total: number;
+}>];
+//# sourceMappingURL=queries.d.ts.map

package/dist/queries.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"queries.d.ts","sourceRoot":"","sources":["../src/queries.ts"],"names":[],"mappings":"AAgEA,eAAO,MAAM,SAAS;;;;;;;;;;;;;;;;;;;EA4CpB,CAAA;AAEF,eAAO,MAAM,OAAO;;;;;;;;;;;;EAiClB,CAAA;AAEF,eAAO,MAAM,SAAS;;;;;;;;EAuCpB,CAAA;AAEF,eAAO,MAAM,eAAe;;;;;;EAa1B,CAAA;AAEF,eAAO,MAAM,aAAa;;;;;;;;;;;;;;;;;;EAsCxB,CAAA;AAEF,eAAO,MAAM,UAAU;;;;;;;;;;;;;;;;EA+BrB,CAAA;AAEF,eAAO,MAAM,WAAW;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAOd,CAAA"}