endpoint-permissions-kit 0.1.0

package/dist/esm/index.js

@@ -0,0 +1,594 @@
+// src/constants.ts
+var METHODS = ["find", "update", "create", "remove"];
+var GENERAL_ROLE = "general";
+var GLOBAL_HOOK_OWNER = "*";
+var ALL_FIELDS = "*";
+var MODULE_SEPARATOR = ".";
+var PERMISSION_ID_SEPARATOR = "::";
+
+// src/state.ts
+function getOrCreateState() {
+  const stateKey = Symbol.for("endpoint-permissions-kit");
+  const stateHost = globalThis;
+  if (stateHost[stateKey] === undefined) {
+    stateHost[stateKey] = { roles: new Set([GENERAL_ROLE]), modules: new Map, snapshot: null };
+  }
+  return stateHost[stateKey];
+}
+
+// src/errors.ts
+function pkitError(code, message) {
+  return Object.assign(new Error(message), { name: "PkitError", code });
+}
+
+// src/resolve.ts
+var DIRECT_AUTHORIZATION = Object.freeze({ direct: true, grantedBy: Object.freeze([]) });
+var DISABLED_ACCESS = Object.freeze({ status: "disabled" });
+var UNASSIGNED_ACCESS = Object.freeze({ status: "unassigned" });
+function permissionIdOf(role, action, name) {
+  return [role, action, name].join(PERMISSION_ID_SEPARATOR);
+}
+function resolveAccess(nameEntry, permissionId, role, method, assigned) {
+  if (assigned.has(permissionId))
+    return resolveDirectAccess(nameEntry, role, method);
+  return resolveGrantedAccess(nameEntry, method, assigned);
+}
+function resolveDirectAccess(nameEntry, role, method) {
+  const definition = nameEntry.actions.get(role)?.[method];
+  if (!definition?.enabled)
+    return DISABLED_ACCESS;
+  return { status: "granted", properties: definition.properties, authorization: DIRECT_AUTHORIZATION };
+}
+function resolveGrantedAccess(nameEntry, method, assigned) {
+  const grantedBy = [];
+  const properties = new Set;
+  let reachable = false;
+  for (const [enablingId, grant] of nameEntry.grants) {
+    if (!assigned.has(enablingId))
+      continue;
+    reachable = true;
+    const definition = grant.actions[method];
+    if (!definition)
+      continue;
+    grantedBy.push(enablingId);
+    for (const field of definition.properties)
+      properties.add(field);
+  }
+  if (grantedBy.length === 0)
+    return reachable ? DISABLED_ACCESS : UNASSIGNED_ACCESS;
+  const authorization = Object.freeze({ direct: false, grantedBy: Object.freeze(grantedBy.sort()) });
+  return { status: "granted", properties: Object.freeze([...properties]), authorization };
+}
+
+// src/validators.ts
+function validateObject(value, failure) {
+  if (value === null || typeof value !== "object" || Array.isArray(value)) {
+    throw pkitError(failure.code, failure.message);
+  }
+}
+function validateStrings(value, rules) {
+  if (!Array.isArray(value))
+    throw pkitError(rules.code, rules.message);
+  for (const field of value) {
+    if (typeof field !== "string" || field.length < rules.minimumLength) {
+      throw pkitError(rules.code, rules.message);
+    }
+  }
+}
+function validateContextKey(key) {
+  if (key !== "roles")
+    throw pkitError("INVALID_DEFINITION", `unknown context key: "${String(key)}"`);
+}
+function validateOpenRegistry(state) {
+  if (state.snapshot)
+    throw pkitError("SEALED", "pkit.seal() was already called: no more registrations allowed");
+}
+function validateSnapshot(snapshot) {
+  if (snapshot === null) {
+    throw pkitError("NOT_SEALED", "pkit.seal() has not been called: call it after importing every permission file");
+  }
+}
+function validateRole(role, roles, code) {
+  if (typeof role === "string" && roles.has(role))
+    return;
+  if (code === "ROLE_NOT_DECLARED") {
+    throw pkitError(code, `role "${String(role)}" is not declared. Available roles: ${[...roles].join(", ")}.
+` + "Is pkit.context.set('roles', [...]) missing from pkit.config.js, or was it imported after this file?");
+  }
+  throw pkitError(code, `role "${String(role)}" is not declared`);
+}
+function validateRoleCatalog(roles, state) {
+  validateOpenRegistry(state);
+  if (state.modules.size) {
+    throw pkitError("INVALID_DEFINITION", "roles must be declared before registering permissions: import pkit.config.js first");
+  }
+  validateStrings(roles, {
+    code: "INVALID_DEFINITION",
+    message: "roles must be an array of non-empty strings",
+    minimumLength: 1
+  });
+  if (roles.length === 0)
+    throw pkitError("INVALID_DEFINITION", "roles must declare at least one role");
+  for (const role of roles)
+    validateRoleSegment(role);
+}
+function isCleanSegment(value) {
+  return value.length > 0 && value.trim() === value && !value.includes(":");
+}
+function validateRoleSegment(role) {
+  if (typeof role === "string" && isCleanSegment(role) && role !== GLOBAL_HOOK_OWNER)
+    return;
+  throw pkitError("INVALID_DEFINITION", `invalid role: "${String(role)}" (non-empty string, no ":" or surrounding whitespace; "${GLOBAL_HOOK_OWNER}" is reserved for global hooks)`);
+}
+function validateModuleName(moduleName) {
+  if (typeof moduleName === "string" && isCleanSegment(moduleName) && !moduleName.includes(MODULE_SEPARATOR))
+    return;
+  throw pkitError("INVALID_DEFINITION", `invalid module name: "${String(moduleName)}" (non-empty string, no dots, no ":" or surrounding whitespace)`);
+}
+function validatePermissionName(name) {
+  if (typeof name === "string" && isCleanSegment(name) && name !== GLOBAL_HOOK_OWNER)
+    return;
+  throw pkitError("INVALID_DEFINITION", `invalid permission name: "${String(name)}" (non-empty string, no ":" or surrounding whitespace; "*" is reserved)`);
+}
+function parsePermissionId(value, failure) {
+  if (typeof value !== "string")
+    throw pkitError(failure.code, failure.message);
+  const parts = value.split(PERMISSION_ID_SEPARATOR);
+  const [role, action, name] = parts;
+  if (parts.length !== 3 || role === undefined || action === undefined || name === undefined) {
+    throw pkitError(failure.code, failure.message);
+  }
+  const isValidRole = isCleanSegment(role) && role !== GLOBAL_HOOK_OWNER;
+  const isValidName = isCleanSegment(name) && name !== GLOBAL_HOOK_OWNER;
+  const isValidAction = action.split(MODULE_SEPARATOR).every(isCleanSegment);
+  if (!isValidRole || !isValidName || !isValidAction)
+    throw pkitError(failure.code, failure.message);
+  return { role, action, name };
+}
+function validateMethod(method, failure) {
+  if (METHODS.includes(method))
+    return;
+  throw pkitError(failure.code, `${failure.message}: method "${String(method)}" does not exist. Methods: ${METHODS.join(", ")}`);
+}
+function readActionDefinition(definition, permissionPath) {
+  validateObject(definition, { code: "INVALID_DEFINITION", message: `${permissionPath}: must be an object` });
+  if (typeof definition.enabled !== "boolean") {
+    throw pkitError("INVALID_DEFINITION", `${permissionPath}: enabled must be a boolean`);
+  }
+  const { properties } = definition;
+  if (properties === ALL_FIELDS)
+    return Object.freeze({ enabled: definition.enabled, properties });
+  validateStrings(properties, {
+    code: "INVALID_DEFINITION",
+    message: `${permissionPath}: properties must be string[] or '*'`,
+    minimumLength: 1
+  });
+  if (properties.includes(ALL_FIELDS)) {
+    throw pkitError("INVALID_DEFINITION", `${permissionPath}: '${ALL_FIELDS}' is only allowed as the whole properties value`);
+  }
+  if (new Set(properties).size !== properties.length) {
+    throw pkitError("INVALID_DEFINITION", `${permissionPath}: properties contains duplicate fields`);
+  }
+  return Object.freeze({ enabled: definition.enabled, properties: Object.freeze([...properties]) });
+}
+function readActionDefinitions(actions, permissionPath) {
+  validateObject(actions, { code: "INVALID_DEFINITION", message: `${permissionPath}: registerActions expects an object` });
+  const registeredActions = Object.create(null);
+  for (const [method, definition] of Object.entries(actions)) {
+    validateMethod(method, { code: "INVALID_DEFINITION", message: permissionPath });
+    registeredActions[method] = readActionDefinition(definition, `${permissionPath}.${method}`);
+  }
+  return Object.freeze(registeredActions);
+}
+function validateActions(actions, registration, state) {
+  const { action, name, role } = registration;
+  validateOpenRegistry(state);
+  validateRole(role, state.roles, "ROLE_NOT_DECLARED");
+  if (state.modules.get(action)?.names.get(name)?.actions.has(role)) {
+    throw pkitError("DUPLICATE_REGISTRATION", `"${action}::${name}" already has actions registered for role "${role}"`);
+  }
+  return readActionDefinitions(actions, `${action}::${name} [${role}]`);
+}
+function validateGrantActions(actions, registration, state) {
+  const { action, name, permissionId } = registration;
+  validateOpenRegistry(state);
+  const source = parsePermissionId(permissionId, {
+    code: "INVALID_DEFINITION",
+    message: `"${action}::${name}": invalid grantTo identifier: "${String(permissionId)}" (format role::module::name)`
+  });
+  validateRole(source.role, state.roles, "ROLE_NOT_DECLARED");
+  if (source.action === action && source.name === name) {
+    throw pkitError("INVALID_DEFINITION", `"${permissionId}" cannot grant to itself`);
+  }
+  if (state.modules.get(action)?.names.get(name)?.grants.has(permissionId)) {
+    throw pkitError("DUPLICATE_REGISTRATION", `"${action}::${name}" already has a grant for "${permissionId}"`);
+  }
+  const permissionPath = `${action}::${name} [grantTo ${permissionId}]`;
+  const registeredActions = readActionDefinitions(actions, permissionPath);
+  for (const [method, definition] of Object.entries(registeredActions)) {
+    if (definition.enabled !== true) {
+      throw pkitError("INVALID_DEFINITION", `${permissionPath}.${method}: a grant does not allow enabled: false`);
+    }
+    if (definition.properties === ALL_FIELDS) {
+      throw pkitError("INVALID_DEFINITION", `${permissionPath}.${method}: a grant requires an explicit properties list`);
+    }
+  }
+  return { source, actions: registeredActions };
+}
+function validateHook(hook, registration, state) {
+  const { action, name, role, method } = registration;
+  validateOpenRegistry(state);
+  if (role !== undefined && role !== GLOBAL_HOOK_OWNER)
+    validateRole(role, state.roles, "ROLE_NOT_DECLARED");
+  const permissionPath = name === undefined ? action : `${action}::${name}`;
+  validateMethod(method, { code: "INVALID_DEFINITION", message: permissionPath });
+  if (typeof hook !== "function")
+    throw pkitError("INVALID_DEFINITION", `${permissionPath}: hook("${method}") expects a function`);
+}
+function declaresMethod(nameEntry, method) {
+  for (const actions of nameEntry.actions.values()) {
+    if (Object.hasOwn(actions, method))
+      return true;
+  }
+  return false;
+}
+function hasAccessPath(nameEntry, role, method) {
+  if (nameEntry.actions.get(role)?.[method])
+    return true;
+  for (const grant of nameEntry.grants.values()) {
+    if (grant.source.role === role && grant.actions[method])
+      return true;
+  }
+  return false;
+}
+function validateGrantReferences(permissionPath, nameEntry, modules) {
+  for (const [permissionId, grant] of nameEntry.grants) {
+    const sourceEntry = modules.get(grant.source.action)?.names.get(grant.source.name);
+    if (!sourceEntry?.actions.has(grant.source.role)) {
+      throw pkitError("INVALID_DEFINITION", `"${permissionPath}": grantTo "${permissionId}" references a permission with no registered actions`);
+    }
+    for (const method of Object.keys(grant.actions)) {
+      if (declaresMethod(nameEntry, method))
+        continue;
+      throw pkitError("INVALID_DEFINITION", `"${permissionPath}": grantTo "${permissionId}" grants "${method}", which no role declares on that permission`);
+    }
+  }
+}
+function validateRoleHooks(permissionPath, nameEntry) {
+  for (const [hookRole, methodHooks] of nameEntry.hooks) {
+    if (hookRole === GLOBAL_HOOK_OWNER)
+      continue;
+    for (const method of methodHooks.keys()) {
+      if (hasAccessPath(nameEntry, hookRole, method))
+        continue;
+      throw pkitError("INVALID_DEFINITION", `"${permissionPath}": hook for "${hookRole}" on "${method}" has no registered actions or grant for that role`);
+    }
+  }
+}
+function validateSealedRegistry(modules) {
+  for (const [action, registeredModule] of modules) {
+    if (registeredModule.names.size === 0) {
+      throw pkitError("INVALID_DEFINITION", `"${action}" has hooks but no name with registered actions`);
+    }
+    for (const [name, nameEntry] of registeredModule.names) {
+      const permissionPath = `${action}::${name}`;
+      if (nameEntry.actions.size === 0) {
+        throw pkitError("INVALID_DEFINITION", `"${permissionPath}" has no registered actions for any role`);
+      }
+      validateGrantReferences(permissionPath, nameEntry, modules);
+      validateRoleHooks(permissionPath, nameEntry);
+    }
+  }
+}
+function validateAssignments(permissions, role, assignable) {
+  validateStrings(permissions, { code: "INVALID_INPUT", message: "permissions must be an array of strings", minimumLength: 1 });
+  const assigned = new Set;
+  for (const permissionId of permissions) {
+    const reference = parsePermissionId(permissionId, {
+      code: "INVALID_INPUT",
+      message: `invalid permission identifier: "${permissionId}" (format role::module::name)`
+    });
+    if (reference.role !== role) {
+      throw pkitError("PERMISSION_ROLE_MISMATCH", `"${permissionId}" belongs to role "${reference.role}", not the authenticated role "${role}"`);
+    }
+    if (!assignable.has(permissionId)) {
+      throw pkitError("UNKNOWN_PERMISSION", `"${permissionId}" is not an assignable permission`);
+    }
+    assigned.add(permissionId);
+  }
+  return assigned;
+}
+function validateIdentity(assignments, state) {
+  validateSnapshot(state.snapshot);
+  const { role, permissions } = assignments;
+  if (typeof role !== "string")
+    throw pkitError("INVALID_INPUT", "role is required");
+  validateRole(role, state.roles, "UNKNOWN_ROLE");
+  return { role, assigned: validateAssignments(permissions, role, state.snapshot.assignable) };
+}
+function trimSelection(select, properties) {
+  validateStrings(select, { code: "INVALID_INPUT", message: "select must be an array of strings", minimumLength: 0 });
+  const selectedFields = [];
+  for (const field of select) {
+    if (properties.includes(field))
+      selectedFields.push(field);
+  }
+  return selectedFields;
+}
+function rejectForbiddenFields(data, properties, permissionPath) {
+  const forbiddenFields = [];
+  for (const field of Object.keys(data)) {
+    if (!properties.includes(field))
+      forbiddenFields.push(field);
+  }
+  if (forbiddenFields.length === 0)
+    return;
+  throw Object.assign(pkitError("PROPERTIES_NOT_ALLOWED", `fields not allowed in "${permissionPath}": ${forbiddenFields.join(", ")}`), { fields: forbiddenFields });
+}
+function validateRequest(input, state) {
+  validateSnapshot(state.snapshot);
+  const { action, name, method } = input;
+  validateMethod(method, { code: "INVALID_INPUT", message: "method is required" });
+  if (method !== "find" && Object.hasOwn(input, "select"))
+    throw pkitError("INVALID_INPUT", "select only applies to find");
+  if (typeof action !== "string" || typeof name !== "string")
+    throw pkitError("INVALID_INPUT", "action and name are required");
+  const { role, assigned } = validateIdentity(input, state);
+  const registeredModule = state.modules.get(action);
+  if (!registeredModule)
+    throw pkitError("UNKNOWN_ACTION", `module "${action}" is not registered`);
+  const nameEntry = registeredModule.names.get(name);
+  if (!nameEntry)
+    throw pkitError("UNKNOWN_PERMISSION", `permission "${action}::${name}" is not registered`);
+  const permissionId = permissionIdOf(role, action, name);
+  const access = resolveAccess(nameEntry, permissionId, role, method, assigned);
+  if (access.status === "unassigned") {
+    throw pkitError("PERMISSION_NOT_ASSIGNED", `"${permissionId}" is not assigned or granted by the user permissions`);
+  }
+  if (access.status === "disabled")
+    throw pkitError("METHOD_DISABLED", `"${permissionId}.${method}" is not enabled`);
+  const { data, context } = input;
+  if (context !== undefined)
+    validateObject(context, { code: "INVALID_INPUT", message: "context must be an object" });
+  const { properties, authorization } = access;
+  const permission = Object.freeze({ role, action, name, permissionId, method, enabled: true, properties, authorization });
+  const request = { registeredModule, nameEntry, permission, data, context };
+  if (method === "find") {
+    if (data !== undefined)
+      validateObject(data, { code: "INVALID_INPUT", message: "data must be an object" });
+    const { select } = input;
+    if (select === undefined)
+      return { ...request, result: properties };
+    if (properties === ALL_FIELDS) {
+      validateStrings(select, { code: "INVALID_INPUT", message: "select must be an array of strings", minimumLength: 0 });
+      return { ...request, result: select };
+    }
+    return { ...request, result: trimSelection(select, properties) };
+  }
+  validateObject(data, { code: "INVALID_INPUT", message: "data must be an object" });
+  if (properties !== ALL_FIELDS)
+    rejectForbiddenFields(data, properties, `${permissionId}.${method}`);
+  return { ...request, result: data };
+}
+
+// src/context.ts
+function setRoles(key, roles) {
+  validateContextKey(key);
+  const state = getOrCreateState();
+  validateRoleCatalog(roles, state);
+  state.roles = new Set(roles);
+}
+function getRoles(key) {
+  validateContextKey(key);
+  return [...getOrCreateState().roles];
+}
+var context = Object.freeze({ set: setRoles, get: getRoles });
+
+// src/registry.ts
+function appendHook(methodHooks, method, hook) {
+  const hooks = methodHooks.get(method) ?? [];
+  methodHooks.set(method, hooks);
+  hooks.push(hook);
+}
+function registerActions(scope, actions) {
+  const state = getOrCreateState();
+  const registeredActions = validateActions(actions, scope, state);
+  ensureName(state, scope.action, scope.name).actions.set(scope.role, registeredActions);
+  return scope.builder;
+}
+function registerGrant(scope, actions) {
+  const state = getOrCreateState();
+  const grant = validateGrantActions(actions, scope, state);
+  ensureName(state, scope.action, scope.name).grants.set(scope.permissionId, grant);
+  return scope.builder;
+}
+function registerModuleHook(scope, method, hook) {
+  const state = getOrCreateState();
+  validateHook(hook, { action: scope.action, method }, state);
+  appendHook(ensureModule(state, scope.action).hooks, method, hook);
+  return scope.builder;
+}
+function registerNameHook(scope, method, hook) {
+  const state = getOrCreateState();
+  validateHook(hook, { ...scope, method }, state);
+  const nameEntry = ensureName(state, scope.action, scope.name);
+  const roleHooks = nameEntry.hooks.get(scope.role) ?? new Map;
+  nameEntry.hooks.set(scope.role, roleHooks);
+  appendHook(roleHooks, method, hook);
+  return scope.builder;
+}
+function createRoleBuilder(action, name, role) {
+  validateRoleSegment(role);
+  const builder = {};
+  const scope = { action, name, role, builder };
+  return Object.assign(builder, {
+    registerActions: registerActions.bind(null, scope),
+    hook: registerNameHook.bind(null, scope)
+  });
+}
+function createGrantBuilder(action, name, permissionId) {
+  const builder = {};
+  const scope = { action, name, permissionId, builder };
+  return Object.assign(builder, { registerActions: registerGrant.bind(null, scope) });
+}
+function createNameBuilder(action, name) {
+  validatePermissionName(name);
+  const builder = {};
+  const scope = { action, name, role: GLOBAL_HOOK_OWNER, builder };
+  return Object.assign(builder, {
+    role: createRoleBuilder.bind(null, action, name),
+    grantTo: createGrantBuilder.bind(null, action, name),
+    hook: registerNameHook.bind(null, scope)
+  });
+}
+function createModuleBuilder(action) {
+  const builder = {};
+  const scope = { action, builder };
+  return Object.assign(builder, {
+    module: appendModule.bind(null, action),
+    name: createNameBuilder.bind(null, action),
+    hook: registerModuleHook.bind(null, scope)
+  });
+}
+function appendModule(parentAction, segment) {
+  validateModuleName(segment);
+  return createModuleBuilder(`${parentAction}${MODULE_SEPARATOR}${segment}`);
+}
+function defineModule(segment) {
+  validateModuleName(segment);
+  return createModuleBuilder(segment);
+}
+function ensureModule(state, action) {
+  const registeredModule = state.modules.get(action);
+  if (registeredModule)
+    return registeredModule;
+  const newModule = { names: new Map, hooks: new Map };
+  state.modules.set(action, newModule);
+  return newModule;
+}
+function ensureName(state, action, name) {
+  const registeredModule = ensureModule(state, action);
+  const registeredName = registeredModule.names.get(name);
+  if (registeredName)
+    return registeredName;
+  const newName = { actions: new Map, grants: new Map, hooks: new Map };
+  registeredModule.names.set(name, newName);
+  return newName;
+}
+
+// src/seal.ts
+function seal() {
+  const state = getOrCreateState();
+  if (state.snapshot)
+    return;
+  validateSealedRegistry(state.modules);
+  const named = Object.create(null);
+  for (const [action, registeredModule] of state.modules) {
+    for (const [name, nameEntry] of registeredModule.names) {
+      for (const [role, actions] of nameEntry.actions) {
+        named[permissionIdOf(role, action, name)] = actions;
+      }
+    }
+  }
+  state.snapshot = { named: Object.freeze(named), assignable: new Set(Object.keys(named)) };
+}
+
+// src/permissions.ts
+function getNamedCatalog() {
+  const { snapshot } = getOrCreateState();
+  validateSnapshot(snapshot);
+  return snapshot.named;
+}
+function resolveMethodAccess(nameEntry, permissionId, role, assigned) {
+  const methodAccess = Object.create(null);
+  let reachable = false;
+  for (const method of METHODS) {
+    const access = resolveAccess(nameEntry, permissionId, role, method, assigned);
+    methodAccess[method] = access.status === "granted";
+    if (access.status !== "unassigned")
+      reachable = true;
+  }
+  return reachable ? Object.freeze(methodAccess) : undefined;
+}
+function forUser(assignments) {
+  const state = getOrCreateState();
+  const { role, assigned } = validateIdentity(assignments, state);
+  const access = Object.create(null);
+  for (const [action, registeredModule] of state.modules) {
+    for (const [name, nameEntry] of registeredModule.names) {
+      const permissionId = permissionIdOf(role, action, name);
+      const methodAccess = resolveMethodAccess(nameEntry, permissionId, role, assigned);
+      if (methodAccess)
+        access[permissionId] = methodAccess;
+    }
+  }
+  return Object.freeze(access);
+}
+var permissions = Object.freeze(Object.defineProperty({ forUser }, "named", { get: getNamedCatalog, enumerable: true, configurable: false }));
+
+// src/validate.ts
+async function invokeHook(hook, request) {
+  return hook(request.data, request.context, request.permission);
+}
+function describeHookFailure(reason) {
+  try {
+    return reason instanceof Error ? reason.message : String(reason);
+  } catch {
+    return "the hook threw a value that cannot be described";
+  }
+}
+async function validate(input) {
+  try {
+    const request = validateRequest(input, getOrCreateState());
+    const { registeredModule, nameEntry, permission, result } = request;
+    const { method, role } = permission;
+    const hookGroups = [
+      registeredModule.hooks.get(method),
+      nameEntry.hooks.get(GLOBAL_HOOK_OWNER)?.get(method),
+      nameEntry.hooks.get(role)?.get(method)
+    ];
+    const hookCalls = [];
+    for (const hooks of hookGroups) {
+      if (!hooks)
+        continue;
+      for (const hook of hooks)
+        hookCalls.push(invokeHook(hook, request));
+    }
+    const hookResults = await Promise.allSettled(hookCalls);
+    const errors = [];
+    for (const hookResult of hookResults) {
+      if (hookResult.status === "fulfilled")
+        continue;
+      const hookCause = hookResult.reason;
+      errors.push({ code: "HOOK_ERROR", message: describeHookFailure(hookCause), cause: hookCause });
+    }
+    if (errors.length)
+      return { result: null, errors: Object.freeze(errors) };
+    return { result, errors: Object.freeze([]) };
+  } catch (cause) {
+    if (cause instanceof Error && cause.name === "PkitError") {
+      const permissionError = cause;
+      const error = permissionError.code === "PROPERTIES_NOT_ALLOWED" ? { code: permissionError.code, message: permissionError.message, fields: permissionError.fields } : { code: permissionError.code, message: permissionError.message };
+      return { result: null, errors: Object.freeze([error]) };
+    }
+    return {
+      result: null,
+      errors: Object.freeze([{ code: "VALIDATION_ERROR", message: "permission could not be validated", cause }])
+    };
+  }
+}
+// src/index.ts
+var pkit = Object.freeze({ context, module: defineModule, seal, permissions, validate });
+var src_default = pkit;
+export {
+  METHODS,
+  context,
+  src_default as default,
+  defineModule as module,
+  permissions,
+  pkit,
+  seal,
+  validate
+};
+
+//# debugId=60F9871502AF5BAC64756E2164756E21