@contractspec/bundle.library 3.4.2 → 3.5.0

package/dist/components/docs/safety/SafetyPDPPage.js

@@ -2,188 +2,188 @@
 // src/components/docs/safety/SafetyPDPPage.tsx
 import Link from "@contractspec/lib.ui-link";
 import { ChevronRight } from "lucide-react";
-import { jsxDEV } from "react/jsx-dev-runtime";
+import { jsx, jsxs } from "react/jsx-runtime";
 function SafetyPDPPage() {
-  return /* @__PURE__ */ jsxDEV("div", {
+  return /* @__PURE__ */ jsxs("div", {
     className: "space-y-8",
     children: [
-      /* @__PURE__ */ jsxDEV("div", {
+      /* @__PURE__ */ jsxs("div", {
         className: "space-y-4",
         children: [
-          /* @__PURE__ */ jsxDEV("h1", {
+          /* @__PURE__ */ jsx("h1", {
             className: "text-4xl font-bold",
             children: "Policy Decision Points"
-          }, undefined, false, undefined, this),
-          /* @__PURE__ */ jsxDEV("p", {
+          }),
+          /* @__PURE__ */ jsxs("p", {
             className: "text-muted-foreground",
             children: [
               "A ",
-              /* @__PURE__ */ jsxDEV("strong", {
+              /* @__PURE__ */ jsx("strong", {
                 children: "Policy Decision Point (PDP)"
-              }, undefined, false, undefined, this),
+              }),
               " is a centralized component that evaluates access control policies and makes authorization decisions. According to",
               " ",
-              /* @__PURE__ */ jsxDEV("a", {
+              /* @__PURE__ */ jsx("a", {
                 href: "https://www.strongdm.com/blog/policy-decision-point",
                 target: "_blank",
                 rel: "noopener noreferrer",
                 className: "text-violet-400 hover:text-violet-300",
                 children: "StrongDM"
-              }, undefined, false, undefined, this),
+              }),
               ', the PDP "receives requests for access to resources, evaluates them against policies, and returns a decision (permit or deny)."'
             ]
-          }, undefined, true, undefined, this)
+          })
         ]
-      }, undefined, true, undefined, this),
-      /* @__PURE__ */ jsxDEV("div", {
+      }),
+      /* @__PURE__ */ jsxs("div", {
         className: "space-y-4",
         children: [
-          /* @__PURE__ */ jsxDEV("h2", {
+          /* @__PURE__ */ jsx("h2", {
             className: "text-2xl font-bold",
             children: "How the PDP works in ContractSpec"
-          }, undefined, false, undefined, this),
-          /* @__PURE__ */ jsxDEV("p", {
+          }),
+          /* @__PURE__ */ jsx("p", {
             className: "text-muted-foreground",
             children: "In ContractSpec, the PDP is invoked on every operation\u2014whether it's rendering a UI component, executing a capability, or querying a data view. The flow is:"
-          }, undefined, false, undefined, this),
-          /* @__PURE__ */ jsxDEV("ol", {
+          }),
+          /* @__PURE__ */ jsxs("ol", {
             className: "text-muted-foreground list-inside list-decimal space-y-3",
             children: [
-              /* @__PURE__ */ jsxDEV("li", {
+              /* @__PURE__ */ jsxs("li", {
                 children: [
-                  /* @__PURE__ */ jsxDEV("strong", {
+                  /* @__PURE__ */ jsx("strong", {
                     children: "Request evaluation"
-                  }, undefined, false, undefined, this),
+                  }),
                   " \u2013 The runtime sends a request to the PDP containing:",
-                  /* @__PURE__ */ jsxDEV("ul", {
+                  /* @__PURE__ */ jsxs("ul", {
                     className: "mt-2 ml-6 list-inside list-disc space-y-1",
                     children: [
-                      /* @__PURE__ */ jsxDEV("li", {
+                      /* @__PURE__ */ jsx("li", {
                         children: "The user's identity and attributes (roles, groups, location, etc.)"
-                      }, undefined, false, undefined, this),
-                      /* @__PURE__ */ jsxDEV("li", {
+                      }),
+                      /* @__PURE__ */ jsx("li", {
                         children: "The resource being accessed (capability, field, workflow step)"
-                      }, undefined, false, undefined, this),
-                      /* @__PURE__ */ jsxDEV("li", {
+                      }),
+                      /* @__PURE__ */ jsx("li", {
                         children: "The action being performed (read, write, execute)"
-                      }, undefined, false, undefined, this),
-                      /* @__PURE__ */ jsxDEV("li", {
+                      }),
+                      /* @__PURE__ */ jsx("li", {
                         children: "Contextual information (time of day, device type, IP address)"
-                      }, undefined, false, undefined, this)
+                      })
                     ]
-                  }, undefined, true, undefined, this)
+                  })
                 ]
-              }, undefined, true, undefined, this),
-              /* @__PURE__ */ jsxDEV("li", {
+              }),
+              /* @__PURE__ */ jsxs("li", {
                 children: [
-                  /* @__PURE__ */ jsxDEV("strong", {
+                  /* @__PURE__ */ jsx("strong", {
                     children: "Policy evaluation"
-                  }, undefined, false, undefined, this),
+                  }),
                   " \u2013 The PDP evaluates the request against all applicable ",
-                  /* @__PURE__ */ jsxDEV("strong", {
+                  /* @__PURE__ */ jsx("strong", {
                     children: "PolicySpecs"
-                  }, undefined, false, undefined, this),
+                  }),
                   ". These specs define rules using attribute-based access control (ABAC) and can reference:",
-                  /* @__PURE__ */ jsxDEV("ul", {
+                  /* @__PURE__ */ jsxs("ul", {
                     className: "mt-2 ml-6 list-inside list-disc space-y-1",
                     children: [
-                      /* @__PURE__ */ jsxDEV("li", {
+                      /* @__PURE__ */ jsx("li", {
                         children: `User attributes (e.g., "role == 'admin'")`
-                      }, undefined, false, undefined, this),
-                      /* @__PURE__ */ jsxDEV("li", {
+                      }),
+                      /* @__PURE__ */ jsx("li", {
                         children: `Resource attributes (e.g., "field.sensitivity == 'PII'")`
-                      }, undefined, false, undefined, this),
-                      /* @__PURE__ */ jsxDEV("li", {
+                      }),
+                      /* @__PURE__ */ jsx("li", {
                         children: 'Environmental attributes (e.g., "time.hour >= 9 AND time.hour < 17")'
-                      }, undefined, false, undefined, this)
+                      })
                     ]
-                  }, undefined, true, undefined, this)
+                  })
                 ]
-              }, undefined, true, undefined, this),
-              /* @__PURE__ */ jsxDEV("li", {
+              }),
+              /* @__PURE__ */ jsxs("li", {
                 children: [
-                  /* @__PURE__ */ jsxDEV("strong", {
+                  /* @__PURE__ */ jsx("strong", {
                     children: "Decision return"
-                  }, undefined, false, undefined, this),
+                  }),
                   " \u2013 The PDP returns one of:",
-                  /* @__PURE__ */ jsxDEV("ul", {
+                  /* @__PURE__ */ jsxs("ul", {
                     className: "mt-2 ml-6 list-inside list-disc space-y-1",
                     children: [
-                      /* @__PURE__ */ jsxDEV("li", {
+                      /* @__PURE__ */ jsxs("li", {
                         children: [
-                          /* @__PURE__ */ jsxDEV("code", {
+                          /* @__PURE__ */ jsx("code", {
                             className: "bg-background/50 rounded px-2 py-1",
                             children: "PERMIT"
-                          }, undefined, false, undefined, this),
+                          }),
                           " ",
                           "\u2013 The operation is allowed."
                         ]
-                      }, undefined, true, undefined, this),
-                      /* @__PURE__ */ jsxDEV("li", {
+                      }),
+                      /* @__PURE__ */ jsxs("li", {
                         children: [
-                          /* @__PURE__ */ jsxDEV("code", {
+                          /* @__PURE__ */ jsx("code", {
                             className: "bg-background/50 rounded px-2 py-1",
                             children: "DENY"
-                          }, undefined, false, undefined, this),
+                          }),
                           " ",
                           "\u2013 The operation is blocked."
                         ]
-                      }, undefined, true, undefined, this),
-                      /* @__PURE__ */ jsxDEV("li", {
+                      }),
+                      /* @__PURE__ */ jsxs("li", {
                         children: [
-                          /* @__PURE__ */ jsxDEV("code", {
+                          /* @__PURE__ */ jsx("code", {
                             className: "bg-background/50 rounded px-2 py-1",
                             children: "REDACT"
-                          }, undefined, false, undefined, this),
+                          }),
                           " ",
                           "\u2013 The operation is allowed, but sensitive fields are masked."
                         ]
-                      }, undefined, true, undefined, this)
+                      })
                     ]
-                  }, undefined, true, undefined, this)
+                  })
                 ]
-              }, undefined, true, undefined, this),
-              /* @__PURE__ */ jsxDEV("li", {
+              }),
+              /* @__PURE__ */ jsxs("li", {
                 children: [
-                  /* @__PURE__ */ jsxDEV("strong", {
+                  /* @__PURE__ */ jsx("strong", {
                     children: "Enforcement"
-                  }, undefined, false, undefined, this),
+                  }),
                   " \u2013 The runtime enforces the decision. If denied, the operation fails with a clear error message. If redacted, sensitive fields are replaced with placeholders."
                 ]
-              }, undefined, true, undefined, this),
-              /* @__PURE__ */ jsxDEV("li", {
+              }),
+              /* @__PURE__ */ jsxs("li", {
                 children: [
-                  /* @__PURE__ */ jsxDEV("strong", {
+                  /* @__PURE__ */ jsx("strong", {
                     children: "Auditing"
-                  }, undefined, false, undefined, this),
+                  }),
                   " \u2013 Every PDP decision is logged to the",
                   " ",
-                  /* @__PURE__ */ jsxDEV(Link, {
+                  /* @__PURE__ */ jsx(Link, {
                     href: "/docs/safety/auditing",
                     className: "text-violet-400 hover:text-violet-300",
                     children: "audit log"
-                  }, undefined, false, undefined, this),
+                  }),
                   ", including the request, decision, and reasoning."
                 ]
-              }, undefined, true, undefined, this)
+              })
             ]
-          }, undefined, true, undefined, this)
+          })
         ]
-      }, undefined, true, undefined, this),
-      /* @__PURE__ */ jsxDEV("div", {
+      }),
+      /* @__PURE__ */ jsxs("div", {
         className: "space-y-4",
         children: [
-          /* @__PURE__ */ jsxDEV("h2", {
+          /* @__PURE__ */ jsx("h2", {
             className: "text-2xl font-bold",
             children: "Example PolicySpec"
-          }, undefined, false, undefined, this),
-          /* @__PURE__ */ jsxDEV("p", {
+          }),
+          /* @__PURE__ */ jsx("p", {
             className: "text-muted-foreground",
             children: "Here's a simple policy that restricts access to PII fields:"
-          }, undefined, false, undefined, this),
-          /* @__PURE__ */ jsxDEV("div", {
+          }),
+          /* @__PURE__ */ jsx("div", {
             className: "bg-background/50 border-border text-muted-foreground overflow-x-auto rounded-lg border p-4 font-mono text-sm",
-            children: /* @__PURE__ */ jsxDEV("pre", {
+            children: /* @__PURE__ */ jsx("pre", {
               children: `policyId: pii-access-control
 version: '1.0.0'.0.0
 rules:
@@ -203,116 +203,116 @@ rules:
     condition: |
       user.role NOT IN ['admin', 'support'] AND
       field.sensitivity == 'PII'`
-            }, undefined, false, undefined, this)
-          }, undefined, false, undefined, this),
-          /* @__PURE__ */ jsxDEV("p", {
+            })
+          }),
+          /* @__PURE__ */ jsx("p", {
             className: "text-muted-foreground",
             children: "With this policy, admins see all data, support staff see redacted PII, and other users cannot access PII at all."
-          }, undefined, false, undefined, this)
+          })
         ]
-      }, undefined, true, undefined, this),
-      /* @__PURE__ */ jsxDEV("div", {
+      }),
+      /* @__PURE__ */ jsxs("div", {
         className: "space-y-4",
         children: [
-          /* @__PURE__ */ jsxDEV("h2", {
+          /* @__PURE__ */ jsx("h2", {
             className: "text-2xl font-bold",
             children: "Benefits of centralized decision-making"
-          }, undefined, false, undefined, this),
-          /* @__PURE__ */ jsxDEV("ul", {
+          }),
+          /* @__PURE__ */ jsxs("ul", {
             className: "text-muted-foreground list-inside list-disc space-y-2",
             children: [
-              /* @__PURE__ */ jsxDEV("li", {
+              /* @__PURE__ */ jsxs("li", {
                 children: [
-                  /* @__PURE__ */ jsxDEV("strong", {
+                  /* @__PURE__ */ jsx("strong", {
                     children: "Consistency"
-                  }, undefined, false, undefined, this),
+                  }),
                   " \u2013 Policies are enforced uniformly across all surfaces (API, UI, workflows)."
                 ]
-              }, undefined, true, undefined, this),
-              /* @__PURE__ */ jsxDEV("li", {
+              }),
+              /* @__PURE__ */ jsxs("li", {
                 children: [
-                  /* @__PURE__ */ jsxDEV("strong", {
+                  /* @__PURE__ */ jsx("strong", {
                     children: "Auditability"
-                  }, undefined, false, undefined, this),
+                  }),
                   " \u2013 Every decision is logged, making it easy to trace why access was granted or denied."
                 ]
-              }, undefined, true, undefined, this),
-              /* @__PURE__ */ jsxDEV("li", {
+              }),
+              /* @__PURE__ */ jsxs("li", {
                 children: [
-                  /* @__PURE__ */ jsxDEV("strong", {
+                  /* @__PURE__ */ jsx("strong", {
                     children: "Flexibility"
-                  }, undefined, false, undefined, this),
+                  }),
                   " \u2013 Policies can be updated without changing application code."
                 ]
-              }, undefined, true, undefined, this),
-              /* @__PURE__ */ jsxDEV("li", {
+              }),
+              /* @__PURE__ */ jsxs("li", {
                 children: [
-                  /* @__PURE__ */ jsxDEV("strong", {
+                  /* @__PURE__ */ jsx("strong", {
                     children: "Security"
-                  }, undefined, false, undefined, this),
+                  }),
                   " \u2013 Reduces the risk of authorization bugs by removing ad-hoc checks scattered throughout the codebase."
                 ]
-              }, undefined, true, undefined, this)
+              })
             ]
-          }, undefined, true, undefined, this)
+          })
         ]
-      }, undefined, true, undefined, this),
-      /* @__PURE__ */ jsxDEV("div", {
+      }),
+      /* @__PURE__ */ jsxs("div", {
         className: "space-y-4",
         children: [
-          /* @__PURE__ */ jsxDEV("h2", {
+          /* @__PURE__ */ jsx("h2", {
             className: "text-2xl font-bold",
             children: "Performance considerations"
-          }, undefined, false, undefined, this),
-          /* @__PURE__ */ jsxDEV("p", {
+          }),
+          /* @__PURE__ */ jsx("p", {
             className: "text-muted-foreground",
             children: "Because the PDP is invoked on every operation, performance is critical. ContractSpec optimizes this by:"
-          }, undefined, false, undefined, this),
-          /* @__PURE__ */ jsxDEV("ul", {
+          }),
+          /* @__PURE__ */ jsxs("ul", {
             className: "text-muted-foreground list-inside list-disc space-y-2",
             children: [
-              /* @__PURE__ */ jsxDEV("li", {
+              /* @__PURE__ */ jsx("li", {
                 children: "Caching policy decisions for identical requests"
-              }, undefined, false, undefined, this),
-              /* @__PURE__ */ jsxDEV("li", {
+              }),
+              /* @__PURE__ */ jsx("li", {
                 children: "Compiling policies into efficient bytecode"
-              }, undefined, false, undefined, this),
-              /* @__PURE__ */ jsxDEV("li", {
+              }),
+              /* @__PURE__ */ jsx("li", {
                 children: "Evaluating only the minimal set of rules needed for each request"
-              }, undefined, false, undefined, this),
-              /* @__PURE__ */ jsxDEV("li", {
+              }),
+              /* @__PURE__ */ jsx("li", {
                 children: "Running the PDP in-process to avoid network latency"
-              }, undefined, false, undefined, this)
+              })
             ]
-          }, undefined, true, undefined, this),
-          /* @__PURE__ */ jsxDEV("p", {
+          }),
+          /* @__PURE__ */ jsx("p", {
             className: "text-muted-foreground",
             children: "In practice, PDP overhead is typically less than 1ms per request."
-          }, undefined, false, undefined, this)
+          })
         ]
-      }, undefined, true, undefined, this),
-      /* @__PURE__ */ jsxDEV("div", {
+      }),
+      /* @__PURE__ */ jsxs("div", {
         className: "flex items-center gap-4 pt-4",
         children: [
-          /* @__PURE__ */ jsxDEV(Link, {
+          /* @__PURE__ */ jsx(Link, {
             href: "/docs/safety/signing",
             className: "btn-ghost",
             children: "Previous: Spec Signing"
-          }, undefined, false, undefined, this),
-          /* @__PURE__ */ jsxDEV(Link, {
+          }),
+          /* @__PURE__ */ jsxs(Link, {
             href: "/docs/safety/auditing",
             className: "btn-primary",
             children: [
               "Next: Audit Logs ",
-              /* @__PURE__ */ jsxDEV(ChevronRight, {
+              /* @__PURE__ */ jsx(ChevronRight, {
                 size: 16
-              }, undefined, false, undefined, this)
+              })
             ]
-          }, undefined, true, undefined, this)
+          })
         ]
-      }, undefined, true, undefined, this)
+      })
     ]
-  }, undefined, true, undefined, this);
+  });
 }
 export {
   SafetyPDPPage