@openverb/policy 2.0.0-alpha.2

package/dist/index.d.mts

@@ -0,0 +1,32 @@
+import { VerbDefinition, Actor, Context, PolicyDecision } from '@openverb/runtime';
+
+type TierPolicy = {
+    id: string;
+    stripePriceId?: string;
+    allow?: {
+        verbs?: string[];
+        effects?: string[];
+    };
+    deny?: {
+        verbs?: string[];
+        effects?: string[];
+    };
+    quotas?: Record<string, number>;
+    rateLimits?: Record<string, string>;
+};
+type TierMap = {
+    tiers: TierPolicy[];
+};
+type QuotaTracker = {
+    getUsage: (tenantId: string, key: string, period: string) => Promise<number>;
+    incrementUsage: (tenantId: string, key: string, period: string, delta: number) => Promise<void>;
+};
+
+declare function createPolicyEngine(config: {
+    tiers: TierMap | TierMap['tiers'];
+    quotaTracker?: QuotaTracker;
+}): (verb: VerbDefinition, actor: Actor, context: Context) => Promise<PolicyDecision>;
+
+declare function loadTierMap(tiersPath?: string): TierMap;
+
+export { type QuotaTracker, type TierMap, type TierPolicy, createPolicyEngine, loadTierMap };

package/dist/index.d.ts

@@ -0,0 +1,32 @@
+import { VerbDefinition, Actor, Context, PolicyDecision } from '@openverb/runtime';
+
+type TierPolicy = {
+    id: string;
+    stripePriceId?: string;
+    allow?: {
+        verbs?: string[];
+        effects?: string[];
+    };
+    deny?: {
+        verbs?: string[];
+        effects?: string[];
+    };
+    quotas?: Record<string, number>;
+    rateLimits?: Record<string, string>;
+};
+type TierMap = {
+    tiers: TierPolicy[];
+};
+type QuotaTracker = {
+    getUsage: (tenantId: string, key: string, period: string) => Promise<number>;
+    incrementUsage: (tenantId: string, key: string, period: string, delta: number) => Promise<void>;
+};
+
+declare function createPolicyEngine(config: {
+    tiers: TierMap | TierMap['tiers'];
+    quotaTracker?: QuotaTracker;
+}): (verb: VerbDefinition, actor: Actor, context: Context) => Promise<PolicyDecision>;
+
+declare function loadTierMap(tiersPath?: string): TierMap;
+
+export { type QuotaTracker, type TierMap, type TierPolicy, createPolicyEngine, loadTierMap };

package/dist/index.js

@@ -0,0 +1,142 @@
+"use strict";
+var __create = Object.create;
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __getProtoOf = Object.getPrototypeOf;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(
+  // If the importer is in node compatibility mode or this is not an ESM
+  // file that has been converted to a CommonJS file using a Babel-
+  // compatible transform (i.e. "__esModule" has not been set), then set
+  // "default" to the CommonJS "module.exports" for node compatibility.
+  isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", { value: mod, enumerable: true }) : target,
+  mod
+));
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+
+// src/index.ts
+var index_exports = {};
+__export(index_exports, {
+  createPolicyEngine: () => createPolicyEngine,
+  loadTierMap: () => loadTierMap
+});
+module.exports = __toCommonJS(index_exports);
+
+// src/engine.ts
+function createPolicyEngine(config) {
+  const tiers = Array.isArray(config.tiers) ? config.tiers : config.tiers.tiers;
+  return async function evaluatePolicy(verb, actor, context) {
+    if (verb.policy?.rolesAllowed) {
+      const roles = actor.roles || [];
+      const allowed = verb.policy.rolesAllowed.some((r) => roles.includes(r));
+      if (!allowed) {
+        return {
+          decision: "deny",
+          reasons: ["role_not_allowed"],
+          code: "role_denied",
+          message: "Your role does not allow this action"
+        };
+      }
+    }
+    const tier = tiers.find((t) => t.id === context.planId);
+    if (!tier) {
+      return {
+        decision: "deny",
+        reasons: ["unknown_tier"],
+        code: "unknown_tier",
+        message: "Unknown subscription tier"
+      };
+    }
+    if (tier.deny?.verbs?.includes(verb.id)) {
+      return {
+        decision: "deny",
+        reasons: ["tier_denies_verb"],
+        code: "tier_denied",
+        message: "This action is not available on your plan",
+        upsell: { suggestedPlanId: "pro", cta: "Upgrade to access this feature" }
+      };
+    }
+    if (tier.deny?.effects) {
+      const denied = verb.effects.some((e) => tier.deny.effects.includes(e));
+      if (denied) {
+        return {
+          decision: "deny",
+          reasons: ["tier_denies_effect"],
+          code: "tier_denied",
+          message: "This action is not available on your plan",
+          upsell: { suggestedPlanId: "pro", cta: "Upgrade to access this feature" }
+        };
+      }
+    }
+    if (tier.allow) {
+      const verbAllowed = tier.allow.verbs?.includes(verb.id) || false;
+      const effectAllowed = tier.allow.effects?.some((e) => {
+        if (e.endsWith(".*")) {
+          const prefix = e.slice(0, -2);
+          return verb.effects.some((ve) => ve.startsWith(prefix));
+        }
+        return verb.effects.includes(e);
+      }) || false;
+      if (!verbAllowed && !effectAllowed) {
+        return {
+          decision: "deny",
+          reasons: ["not_in_tier_allowlist"],
+          code: "not_allowed",
+          message: "This action is not included in your plan",
+          upsell: { suggestedPlanId: "pro", cta: "Upgrade to unlock" }
+        };
+      }
+    }
+    const meterKey = verb.billing?.meterKey;
+    if (meterKey && tier.quotas?.[meterKey] && config.quotaTracker) {
+      const period = (/* @__PURE__ */ new Date()).toISOString().slice(0, 7);
+      const usage = await config.quotaTracker.getUsage(context.tenantId, meterKey, period);
+      const limit = tier.quotas[meterKey];
+      if (usage >= limit) {
+        return {
+          decision: "deny",
+          reasons: ["quota_exceeded"],
+          code: "quota_exceeded",
+          message: `You've reached your monthly limit of ${limit} for this action`,
+          upsell: { suggestedPlanId: "pro", cta: "Upgrade for higher limits" }
+        };
+      }
+    }
+    const meter = meterKey ? {
+      key: meterKey,
+      delta: verb.billing?.defaultDelta || 1
+    } : void 0;
+    return {
+      decision: "allow",
+      reasons: ["tier_allows"],
+      meter
+    };
+  };
+}
+
+// src/tiers.ts
+var fs = __toESM(require("fs"));
+var path = __toESM(require("path"));
+function loadTierMap(tiersPath = "./openverb/policies/tiers.json") {
+  const resolvedPath = path.resolve(process.cwd(), tiersPath);
+  const content = fs.readFileSync(resolvedPath, "utf-8");
+  return JSON.parse(content);
+}
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  createPolicyEngine,
+  loadTierMap
+});

package/dist/index.mjs

@@ -0,0 +1,104 @@
+// src/engine.ts
+function createPolicyEngine(config) {
+  const tiers = Array.isArray(config.tiers) ? config.tiers : config.tiers.tiers;
+  return async function evaluatePolicy(verb, actor, context) {
+    if (verb.policy?.rolesAllowed) {
+      const roles = actor.roles || [];
+      const allowed = verb.policy.rolesAllowed.some((r) => roles.includes(r));
+      if (!allowed) {
+        return {
+          decision: "deny",
+          reasons: ["role_not_allowed"],
+          code: "role_denied",
+          message: "Your role does not allow this action"
+        };
+      }
+    }
+    const tier = tiers.find((t) => t.id === context.planId);
+    if (!tier) {
+      return {
+        decision: "deny",
+        reasons: ["unknown_tier"],
+        code: "unknown_tier",
+        message: "Unknown subscription tier"
+      };
+    }
+    if (tier.deny?.verbs?.includes(verb.id)) {
+      return {
+        decision: "deny",
+        reasons: ["tier_denies_verb"],
+        code: "tier_denied",
+        message: "This action is not available on your plan",
+        upsell: { suggestedPlanId: "pro", cta: "Upgrade to access this feature" }
+      };
+    }
+    if (tier.deny?.effects) {
+      const denied = verb.effects.some((e) => tier.deny.effects.includes(e));
+      if (denied) {
+        return {
+          decision: "deny",
+          reasons: ["tier_denies_effect"],
+          code: "tier_denied",
+          message: "This action is not available on your plan",
+          upsell: { suggestedPlanId: "pro", cta: "Upgrade to access this feature" }
+        };
+      }
+    }
+    if (tier.allow) {
+      const verbAllowed = tier.allow.verbs?.includes(verb.id) || false;
+      const effectAllowed = tier.allow.effects?.some((e) => {
+        if (e.endsWith(".*")) {
+          const prefix = e.slice(0, -2);
+          return verb.effects.some((ve) => ve.startsWith(prefix));
+        }
+        return verb.effects.includes(e);
+      }) || false;
+      if (!verbAllowed && !effectAllowed) {
+        return {
+          decision: "deny",
+          reasons: ["not_in_tier_allowlist"],
+          code: "not_allowed",
+          message: "This action is not included in your plan",
+          upsell: { suggestedPlanId: "pro", cta: "Upgrade to unlock" }
+        };
+      }
+    }
+    const meterKey = verb.billing?.meterKey;
+    if (meterKey && tier.quotas?.[meterKey] && config.quotaTracker) {
+      const period = (/* @__PURE__ */ new Date()).toISOString().slice(0, 7);
+      const usage = await config.quotaTracker.getUsage(context.tenantId, meterKey, period);
+      const limit = tier.quotas[meterKey];
+      if (usage >= limit) {
+        return {
+          decision: "deny",
+          reasons: ["quota_exceeded"],
+          code: "quota_exceeded",
+          message: `You've reached your monthly limit of ${limit} for this action`,
+          upsell: { suggestedPlanId: "pro", cta: "Upgrade for higher limits" }
+        };
+      }
+    }
+    const meter = meterKey ? {
+      key: meterKey,
+      delta: verb.billing?.defaultDelta || 1
+    } : void 0;
+    return {
+      decision: "allow",
+      reasons: ["tier_allows"],
+      meter
+    };
+  };
+}
+
+// src/tiers.ts
+import * as fs from "fs";
+import * as path from "path";
+function loadTierMap(tiersPath = "./openverb/policies/tiers.json") {
+  const resolvedPath = path.resolve(process.cwd(), tiersPath);
+  const content = fs.readFileSync(resolvedPath, "utf-8");
+  return JSON.parse(content);
+}
+export {
+  createPolicyEngine,
+  loadTierMap
+};

package/package.json

@@ -0,0 +1,25 @@
+{
+  "name": "@openverb/policy",
+  "version": "2.0.0-alpha.2",
+  "description": "OpenVerb policy engine",
+  "main": "./dist/index.js",
+  "module": "./dist/index.mjs",
+  "types": "./dist/index.d.ts",
+  "files": [
+    "dist"
+  ],
+  "scripts": {
+    "build": "tsup src/index.ts --format cjs,esm --dts",
+    "dev": "tsup src/index.ts --format cjs,esm --dts --watch",
+    "lint": "tsc --noEmit"
+  },
+  "peerDependencies": {
+    "@openverb/runtime": "workspace:*"
+  },
+  "devDependencies": {
+    "@openverb/runtime": "workspace:*",
+    "tsup": "^8.0.1",
+    "typescript": "^5.3.2"
+  },
+  "license": "MIT"
+}