@powerhousedao/powerhouse-vetra-packages 6.2.2-dev.43 → 6.2.2-dev.45

package/dist/node/{document-drive-CPxMz8lW.mjs → document-drive-DrBAR9as.mjs}

@@ -4143,7 +4143,7 @@ function assertValidGrant(grant, documentType) {
 	const grantId = isPlainValue(grant) && typeof grant.id === "string" ? grant.id : "";
 	const problem = grantProblem(grant);
 	if (problem !== null) throw new InvalidGrantError(grantId, problem);
-	if (documentType === "@powerhousedao/document-group" && "group" in grant.principal) throw new GroupPrincipalNotAllowedError(grantId);
+	if (documentType === "powerhouse/reactor-group" && "group" in grant.principal) throw new GroupPrincipalNotAllowedError(grantId);
 }
 /**
 * Validates an initial grant list: the count cap, every grant, and — on a
@@ -4217,6 +4217,158 @@ function assertAuthAdministrationRetained(creator, previous, next, grantId) {
 	if (creator !== void 0) return;
 	if (administrationReachable(previous) && !administrationReachable(next)) throw new AuthAdministrationLockoutError(grantId);
 }
+/**
+* An operand whose shape validation would have rejected. Distinguished from
+* an unresolved path so a structurally malformed operand poisons its whole
+* condition to false rather than reading as "absent", which `not` would
+* otherwise widen to true.
+*/
+const INVALID_OPERAND = Symbol("invalid-operand");
+/**
+* Narrows to the values conditions compare. An object, array, or non-finite
+* number resolves to undefined, and every comparison involving undefined is
+* false.
+*/
+function asConditionValue(value) {
+	if (value === null || typeof value === "string" || typeof value === "boolean") return value;
+	if (typeof value === "number" && Number.isFinite(value)) return value;
+}
+/**
+* Resolves one operand. Attr roots: `subject.*`, `doc.<scope>.*` where the
+* scope must be the executing scope (validation already rejects any other,
+* but resolution stays total), and `action.input.*`. Path steps read own
+* properties only, so prototype members can never influence a verdict.
+*/
+function resolveOperand(operand, subject, request, conditions) {
+	if (!isPlainValue(operand)) return INVALID_OPERAND;
+	const keys = Object.keys(operand);
+	if (keys.length !== 1) return INVALID_OPERAND;
+	if (keys[0] === "lit") {
+		const value = asConditionValue(operand.lit);
+		return value === void 0 ? INVALID_OPERAND : value;
+	}
+	if (keys[0] !== "attr") return INVALID_OPERAND;
+	const attr = operand.attr;
+	if (typeof attr !== "string" || attr.length === 0) return INVALID_OPERAND;
+	const path = attr.split(".");
+	let value;
+	let rest;
+	if (path[0] === "subject") {
+		value = subject;
+		rest = path.slice(1);
+	} else if (path[0] === "doc") {
+		if (path[1] !== request.scope) return;
+		value = conditions.scopeState;
+		rest = path.slice(2);
+	} else if (path[0] === "action" && path[1] === "input") {
+		value = conditions.actionInput;
+		rest = path.slice(2);
+	} else return;
+	for (const segment of rest) {
+		if (!isPlainValue(value) || !Object.hasOwn(value, segment)) return;
+		value = value[segment];
+	}
+	return asConditionValue(value);
+}
+/**
+* Total order within one type: numbers numerically, strings by code point.
+* Everything else, including mixed types, does not order.
+*/
+function compareValues(left, right) {
+	if (typeof left === "number" && typeof right === "number") return left < right ? -1 : left > right ? 1 : 0;
+	if (typeof left === "string" && typeof right === "string") {
+		const leftPoints = Array.from(left);
+		const rightPoints = Array.from(right);
+		const shared = Math.min(leftPoints.length, rightPoints.length);
+		for (let i = 0; i < shared; i++) {
+			const a = leftPoints[i].codePointAt(0) ?? 0;
+			const b = rightPoints[i].codePointAt(0) ?? 0;
+			if (a !== b) return a < b ? -1 : 1;
+		}
+		return leftPoints.length === rightPoints.length ? 0 : leftPoints.length < rightPoints.length ? -1 : 1;
+	}
+}
+/**
+* Tri-state evaluation: undefined marks a structurally invalid node, which
+* poisons the whole tree to false at the top — and a structurally malformed
+* operand poisons its condition the same way. Both are distinct from an
+* operand whose path fails to resolve, which is a valid comparison that is
+* false. The distinction keeps `not` from widening over malformed input.
+*/
+function evaluateNode(node, subject, request, conditions) {
+	if (!isPlainValue(node)) return;
+	const keys = Object.keys(node);
+	if (keys.length !== 1) return;
+	const kind = keys[0];
+	const body = node[kind];
+	switch (kind) {
+		case "eq":
+		case "ne":
+		case "lt":
+		case "lte":
+		case "gt":
+		case "gte": {
+			if (!Array.isArray(body) || body.length !== 2) return;
+			const left = resolveOperand(body[0], subject, request, conditions);
+			const right = resolveOperand(body[1], subject, request, conditions);
+			if (left === INVALID_OPERAND || right === INVALID_OPERAND) return;
+			if (left === void 0 || right === void 0) return false;
+			if (kind === "eq") return left === right;
+			if (kind === "ne") return left !== right;
+			const order = compareValues(left, right);
+			if (order === void 0) return false;
+			switch (kind) {
+				case "lt": return order < 0;
+				case "lte": return order <= 0;
+				case "gt": return order > 0;
+				case "gte": return order >= 0;
+			}
+			return;
+		}
+		case "in":
+		case "notIn": {
+			if (!Array.isArray(body) || body.length !== 2 || !Array.isArray(body[1])) return;
+			const left = resolveOperand(body[0], subject, request, conditions);
+			if (left === INVALID_OPERAND) return;
+			const elements = body[1].map((element) => resolveOperand(element, subject, request, conditions));
+			if (elements.some((value) => value === INVALID_OPERAND)) return;
+			if (left === void 0) return false;
+			const found = elements.some((value) => value !== void 0 && value === left);
+			return kind === "in" ? found : !found;
+		}
+		case "exists": {
+			const value = resolveOperand(body, subject, request, conditions);
+			if (value === INVALID_OPERAND) return;
+			return value !== void 0;
+		}
+		case "and":
+		case "or": {
+			if (!Array.isArray(body)) return;
+			let result = kind === "and";
+			for (const child of body) {
+				const value = evaluateNode(child, subject, request, conditions);
+				if (value === void 0) return;
+				if (kind === "and") result = result && value;
+				else result = result || value;
+			}
+			return result;
+		}
+		case "not": {
+			const value = evaluateNode(body, subject, request, conditions);
+			return value === void 0 ? void 0 : !value;
+		}
+		default: return;
+	}
+}
+/**
+* Evaluates a version-1 condition. Deterministic, total, and pure: any input
+* shape yields a boolean and never throws, and a malformed condition is
+* false. These are consensus semantics, versioned by `PHAuthState.version`;
+* changing them requires a new version.
+*/
+function evaluateCondition(condition, subject, request, conditions) {
+	return evaluateNode(condition, subject, request, conditions) === true;
+}
 function capabilityCovers(capability, request) {
 	if (capability.can !== request.verb) return false;
 	const scope = capability.scope;
@@ -4227,21 +4379,37 @@ function capabilityCovers(capability, request) {
 	}
 	return true;
 }
-function principalMatches(principal, subject) {
+function principalMatches(principal, subject, request, groups, conditions) {
 	if ("anyone" in principal) return true;
 	if ("address" in principal) return subject.address !== void 0 && subject.address.toLowerCase() === principal.address.toLowerCase();
+	if ("group" in principal) {
+		if (groups === void 0 || subject.address === void 0) return false;
+		const group = groups[principal.group];
+		if (group === void 0 || !Array.isArray(group.members)) return false;
+		const address = subject.address.toLowerCase();
+		return group.members.some((member) => member.toLowerCase() === address);
+	}
+	if ("match" in principal) {
+		if (conditions === void 0) return false;
+		return evaluateCondition(principal.match, subject, request, conditions);
+	}
 	return false;
 }
 /**
 * Evaluates a v1 grant stack: default deny, last applicable grant wins, and
-* reports which grant decided it. Group and match principals and `where`
-* conditions are not evaluated yet; a grant that uses any of them never applies.
+* reports which grant decided it. Group principals match only against a
+* supplied groups map, and `where` clauses and { match } principals evaluate
+* only against a supplied condition context; a grant that uses an unsupplied
+* feature never applies.
 */
-function evaluateGrantStack(grants, subject, request) {
+function evaluateGrantStack(grants, subject, request, groups, conditions) {
 	let applicable;
 	for (const grant of grants) {
-		if (grant.where !== void 0) continue;
-		if (capabilityCovers(grant.capability, request) && principalMatches(grant.principal, subject)) applicable = grant;
+		if (grant.where !== void 0) {
+			if (conditions === void 0) continue;
+			if (!evaluateCondition(grant.where, subject, request, conditions)) continue;
+		}
+		if (capabilityCovers(grant.capability, request) && principalMatches(grant.principal, subject, request, groups, conditions)) applicable = grant;
 	}
 	if (applicable === void 0) return {
 		decision: "deny",
@@ -8139,6 +8307,6 @@ const driveDocumentModelModule = {
 	}
 };
 //#endregion
-export { validateStateSchemaName as $, documentModelDocumentType as A, setModelExtension as B, createReducer as C, deleteModule as D, defaultBaseState as E, replayDocumentVersioned as F, setOperationDescription as G, setModelName as H, setAuthorName as I, setOperationSchema as J, setOperationErrorName as K, setAuthorWebsite as L, isDocumentAction as M, redo as N, deleteOperation as O, releaseNewVersion as P, validateModules as Q, setInitialState as R, createPresignedHeader as S, createZip as T, setModuleName as U, setModelId as V, setName as W, undo as X, setStateSchema as Y, validateInitialState as Z, baseCreateDocument as _, handleTargetNameCollisions as a, baseSaveToFileHandle as b, isValidName as c, documentModelDocumentModelModule as d, generateId as et, logger as f, assertAuthPreservedOnDuplicate as g, addOperationError as h, generateNodesCopy as i, hashDocumentStateForScope as j, deleteOperationError as k, moveNode as l, addOperation as m, copyNode as n, isFileNode as o, addModule as p, setOperationName as q, driveDocumentModelModule as r, isFolderNode as s, addFolder as t, updateNode as u, baseLoadFromInput as v, createState as w, buildSignedAction as x, baseLoadFromInputVersioned as y, setModelDescription as z };
+export { setOperationSchema as $, createZip as A, replayDocumentVersioned as B, baseSaveToFileHandle as C, createPresignedHeader as D, createBaseState as E, documentModelDocumentType as F, setModelExtension as G, setAuthorWebsite as H, hashDocumentStateForScope as I, setModuleName as J, setModelId as K, isDocumentAction as L, deleteModule as M, deleteOperation as N, createReducer as O, deleteOperationError as P, setOperationName as Q, redo as R, baseLoadFromInputVersioned as S, createAction as T, setInitialState as U, setAuthorName as V, setModelDescription as W, setOperationDescription as X, setName as Y, setOperationErrorName as Z, addOperationError as _, handleTargetNameCollisions as a, generateId as at, baseCreateDocument as b, isValidName as c, documentModelDocumentModelModule as d, setStateSchema as et, logger as f, addOperation as g, addModule as h, generateNodesCopy as i, validateStateSchemaName as it, defaultBaseState as j, createState as k, moveNode as l, BaseDocumentStateSchema as m, copyNode as n, validateInitialState as nt, isFileNode as o, BaseDocumentHeaderSchema as p, setModelName as q, driveDocumentModelModule as r, validateModules as rt, isFolderNode as s, addFolder as t, undo as tt, updateNode as u, assertAuthPreservedOnDuplicate as v, buildSignedAction as w, baseLoadFromInput as x, baseActions as y, releaseNewVersion as z };
 
-//# sourceMappingURL=document-drive-CPxMz8lW.mjs.map
+//# sourceMappingURL=document-drive-DrBAR9as.mjs.map