permdock 0.0.0 → 0.1.0

package/dist/index-xIxJLwOQ.d.ts

@@ -0,0 +1,415 @@
+import { C as Policy, E as PolicyVocabulary, Er as SqlFunctionCondition, Pn as DenialReason, Sr as OpaqueCondition, Tr as SqlFunctionArg, Z as DecisionEvent, Zt as PermDock, at as LimitStore, cr as CustomRole, ct as MembershipSource, ft as RelationSource, gt as Snapshot, h as Grant, hr as Subject, mr as Principal, pr as Membership, q as AccessEvent, tt as EntitlementSource, ur as Delegation, vr as ConditionRef, w as PolicyDelegation } from "./policy-CInmNGkM.js";
+import { d as Permission, n as ActionMeta, p as PermissionTree, t as ActionList, x as ResourceRelationInput, y as ResourceParent } from "./permissions-B4apnahQ.js";
+//#region src/core/custom-roles.d.ts
+type CustomRoleDropReason = "unknown-permission" | "outside-ceiling" | "condition-not-allowed";
+/** Why part of a custom role was left out: a permission, or an undeclared include. */
+type CustomRoleDrop = {
+  readonly permission: string;
+  readonly reason: CustomRoleDropReason;
+} | {
+  readonly role: string;
+  readonly reason: "unknown-role";
+};
+/** A stored grant that named a permission by a key it was renamed from. */
+type CustomRoleRename = {
+  readonly from: string;
+  readonly to: string;
+};
+type ResolvedCustomRole = {
+  /** Declared grants re-targeted to the custom role; conditions and approvals kept. */
+  readonly grants: readonly Grant[];
+  readonly dropped: readonly CustomRoleDrop[];
+  /** Grants stored under a former key (`definePermissions` `renamed`), resolved to the current one. */
+  readonly renamed: readonly CustomRoleRename[];
+};
+type CustomRoleValidation = {
+  readonly ok: boolean;
+  /** Permission keys the role allows after the ceiling, sorted. */
+  readonly permissions: readonly string[];
+  readonly dropped: readonly CustomRoleDrop[];
+  /** Grants to rewrite in storage: each still resolves, under its current key. */
+  readonly renamed: readonly CustomRoleRename[];
+};
+/**
+ * The one resolver behind evaluation, snapshots and `validateCustomRole`.
+ * Included roles' grants plus the role's own allows, minus its denies, all
+ * intersected with the ceiling. An allow inherits the condition, approval and
+ * limit of the declared grant it comes from: an included assignable role's
+ * grant when there is one, otherwise every ceiling grant of that permission,
+ * together with the denies of the roles those grants belong to.
+ */
+declare function resolveCustomRole(policy: Policy, role: CustomRole): ResolvedCustomRole;
+declare function validateCustomRole(policy: Policy, role: CustomRole): CustomRoleValidation;
+/**
+ * The compact JWT form of custom roles for the `memberships[].grants` claim
+ * RLS reads in `jwt` mode: role name to entries, where `key` allows, `-key`
+ * denies and `@role` includes. Put a team custom role on its team membership.
+ * Pass `policy` to write keys stored under a former name as the current key.
+ */
+declare function customRoleClaim(roles: readonly CustomRole[], policy?: Policy): Readonly<Record<string, readonly string[]>>;
+//#endregion
+//#region src/core/relations.d.ts
+type MemoryEdge = {
+  /** The object's id. */
+  readonly id: string;
+  readonly principal: string;
+  readonly startsAt?: number;
+  readonly expiresAt?: number;
+};
+type MemoryRelationsData = {
+  /** Rows per resource: parent pointers, links, restricted flags and relation columns are read from them. */
+  readonly rows?: Readonly<Record<string, readonly Readonly<Record<string, unknown>>[]>>;
+  /** Edge-table rows per resource and relation. */
+  readonly edges?: Readonly<Record<string, Readonly<Record<string, readonly MemoryEdge[]>>>>;
+  /**
+   * Edge tables as the database holds them, keyed by `edge` name: each row
+   * is read through the relation's `object`, `subject`, `expiresAt`, `match`
+   * and `groups` columns. A relation whose table is here ignores `edges`.
+   */
+  readonly tables?: Readonly<Record<string, readonly Readonly<Record<string, unknown>>[]>>;
+};
+/**
+ * An in-process `RelationSource` over plain rows and edges, read against the
+ * resource definitions in `permissions`. For tests, fixtures and small apps.
+ */
+declare function memoryRelations(permissions: PermissionTree, data?: MemoryRelationsData): RelationSource;
+//#endregion
+//#region src/core/snapshot.d.ts
+declare function parseSnapshot(json: unknown): Snapshot;
+//#endregion
+//#region src/core/from-snapshot.d.ts
+declare function fromSnapshot(snapshot: Snapshot, options?: {
+  readonly tenant?: string;
+  readonly team?: string;
+}): PermDock;
+declare function emptySnapshot(): Snapshot;
+//#endregion
+//#region src/conditions/refs.d.ts
+type KnownRefField = "id" | "issuer" | "kind" | "tenant" | "team" | "roles" | "plans" | "memberships" | "assurance" | "binding" | "session";
+type SubjectRef = ConditionRef & { readonly [K in KnownRefField]: SubjectRef; } & {
+  readonly [key: string]: SubjectRef;
+};
+declare const principal: SubjectRef;
+declare const context: SubjectRef;
+//#endregion
+//#region src/core/approval-required.d.ts
+declare function requiresApproval(approval: Grant["approval"] | undefined): boolean;
+//#endregion
+//#region src/conditions/opaque.d.ts
+declare function opaque(input: {
+  readonly sql: string;
+  readonly fingerprint: string;
+}): OpaqueCondition;
+//#endregion
+//#region src/conditions/sql-function.d.ts
+declare function sqlFunction(name: string, options: {
+  readonly args?: readonly SqlFunctionArg[];
+  readonly twin: unknown;
+}): SqlFunctionCondition;
+//#endregion
+//#region src/core/memberships.d.ts
+/**
+ * One `MembershipSource` over several: memberships are merged and
+ * de-duplicated, `list` concatenates the sources that can list, and `version`
+ * is the highest version any source reports. A source that throws makes the
+ * whole lookup throw, which the subject resolver turns into no memberships.
+ */
+declare function composeMemberships(sources: readonly MembershipSource[]): MembershipSource;
+/**
+ * Trust the memberships the verified token carries, and read `source` only
+ * when the token marks them truncated. With `version`, a token minted before
+ * the latest membership change is stale for the policy's `fresh` permissions.
+ */
+declare function claimsFirst(source: MembershipSource | readonly MembershipSource[], options?: {
+  readonly version?: MembershipSource["version"];
+}): MembershipSource;
+/** Whether the identity provider owns `membership`: the application must not add, change or remove it. */
+declare function isExternallyManaged(membership: Membership): boolean;
+//#endregion
+//#region src/core/stripe-entitlements.d.ts
+/** The part of the Stripe Node SDK this source calls: `stripe.entitlements.activeEntitlements.list`. */
+type StripeEntitlementsClient = {
+  readonly entitlements: {
+    readonly activeEntitlements: {
+      list(params: {
+        readonly customer: string;
+        readonly limit?: number;
+        readonly starting_after?: string;
+      }): PromiseLike<{
+        readonly data: readonly {
+          readonly id: string;
+          readonly lookup_key: string;
+        }[];
+        readonly has_more: boolean;
+      }>;
+    };
+  };
+};
+/**
+ * Plan names from Stripe Entitlements: the `lookup_key` of every active
+ * entitlement of the tenant's Stripe customer. `customer` maps the active
+ * tenant to its customer id; no tenant or no customer means no entitlements.
+ * Pass it as `entitlements`, and grant with `plan('<lookup_key>')`.
+ */
+declare function fromStripeEntitlements(options: {
+  readonly stripe: StripeEntitlementsClient;
+  readonly customer: (tenant: string, principal: {
+    readonly id: string;
+  }) => string | undefined | PromiseLike<string | undefined>;
+}): EntitlementSource;
+//#endregion
+//#region src/core/limits.d.ts
+declare function memoryLimitStore(): LimitStore & {
+  /** Live counters, for tests and diagnostics. */
+  size(): number;
+};
+//#endregion
+//#region src/core/may-access.d.ts
+/**
+ * An optimistic routing hint for a proxy or middleware, never a decision.
+ * `false` only when the subject's declared roles provably lack `permission`;
+ * `true` whenever custom roles, plans, memberships the claims do not carry or
+ * row conditions could still grant it. Synchronous, no network, never throws.
+ * Pages, Server Actions and RLS remain the enforcement points.
+ */
+declare function mayAccess(policy: Policy, user: unknown, permission: Permission, options?: {
+  readonly tenant?: string;
+}): boolean;
+//#endregion
+//#region src/core/may-use.d.ts
+/**
+ * Whether `permission` could be granted to this instance's subject for some
+ * row: the grants its snapshot carries for the active tenant, minus an
+ * unconditional deny, within its delegation. A listing hint for tools and
+ * skills, never a decision; the call itself is decided in full.
+ */
+declare function mayUse(permdock: PermDock, permission: Permission): boolean;
+//#endregion
+//#region src/core/instance.d.ts
+type SnapshotInclude = readonly (Permission | {
+  readonly [key: string]: unknown;
+})[];
+//#endregion
+//#region src/core/snapshot-for.d.ts
+type SnapshotForOptions = {
+  /** Active tenant; ignored unless the subject holds a membership in it. */
+  readonly tenant?: string;
+  /** Database mode: replaces the memberships carried by the subject. */
+  readonly memberships?: readonly Membership[];
+  /** The tenant's custom roles, typically from a shared, tagged cache. */
+  readonly customRoles?: readonly CustomRole[];
+  /** Per tenant, the role names `RoleSource.assignable` returns; narrows `assignable`. */
+  readonly assignable?: Readonly<Record<string, readonly string[]>>;
+  /** Plans of the active tenant; replaces `principal.plans`. */
+  readonly plans?: readonly string[];
+  readonly include?: SnapshotInclude;
+  readonly tenants?: "all";
+  /** Epoch seconds for `issuedAt` and membership expiry. Defaults to the clock. */
+  readonly now?: number;
+};
+/**
+ * Builds the serializable access snapshot for a subject without a request,
+ * a network call or a cache directive: call it inside the app's own
+ * `'use cache: private'` function. Synchronous; the policy's `subject` and
+ * `context` mappers must be synchronous too.
+ */
+declare function snapshotFor<TUser, TPrincipal extends Principal = Principal, V extends PolicyVocabulary = PolicyVocabulary>(policy: Policy<TUser, TPrincipal, V>, user: TUser | Subject | null, options?: SnapshotForOptions): Snapshot;
+//#endregion
+//#region src/core/presets.d.ts
+type ReadOnlyMeta = {
+  readonly readOnly: true;
+};
+type DestructiveMeta = {
+  readonly destructive: true;
+};
+type CrudActions = {
+  readonly read: ReadOnlyMeta;
+  readonly update: ActionMeta;
+  readonly delete: DestructiveMeta;
+};
+type CrudCollection = {
+  readonly create: ActionMeta;
+  readonly list: ReadOnlyMeta;
+};
+type ReadableActions = {
+  readonly read: ReadOnlyMeta;
+};
+type ReadableCollection = {
+  readonly list: ReadOnlyMeta;
+};
+type WritableActions = {
+  readonly read: ReadOnlyMeta;
+  readonly update: ActionMeta;
+};
+declare const CRUD_ACTIONS: CrudActions;
+declare const CRUD_COLLECTION: CrudCollection;
+declare const READABLE_ACTIONS: ReadableActions;
+declare const READABLE_COLLECTION: ReadableCollection;
+declare const WRITABLE_ACTIONS: WritableActions;
+type EmptyRecord = Record<never, never>;
+declare const WRITABLE_COLLECTION: EmptyRecord;
+type ActionNames<A extends ActionList | undefined> = A extends readonly string[] ? A[number] & string : A extends Record<string, ActionMeta> ? keyof A & string : never;
+type ToActionRecord<A extends ActionList | undefined> = [ActionNames<A>] extends [never] ? EmptyRecord : { readonly [K in ActionNames<A>]: ActionMeta; };
+type OverlayMeta<Base extends ActionMeta, Extra extends ActionMeta> = Omit<Base, keyof Extra> & Extra;
+type MergeActionRecords<Base extends Record<string, ActionMeta>, Extra extends Record<string, ActionMeta>> = { readonly [K in keyof Base | keyof Extra]: K extends keyof Extra ? K extends keyof Base ? OverlayMeta<Base[K] & ActionMeta, Extra[K] & ActionMeta> : Extra[K] & ActionMeta : K extends keyof Base ? Base[K] & ActionMeta : never; };
+type PresetOptions<A extends ActionList | undefined = undefined, C extends ActionList | undefined = undefined> = {
+  readonly id?: string;
+  readonly parent?: ResourceParent;
+  readonly relations?: Readonly<Record<string, ResourceRelationInput>>;
+  readonly restricted?: string;
+  readonly disclosure?: "hide" | "reveal";
+  readonly actions?: A;
+  readonly collection?: C;
+};
+type PresetResult<BaseA extends Record<string, ActionMeta>, BaseC extends Record<string, ActionMeta>, A extends ActionList | undefined, C extends ActionList | undefined> = {
+  readonly id?: string;
+  readonly parent?: ResourceParent;
+  readonly relations?: Readonly<Record<string, ResourceRelationInput>>;
+  readonly restricted?: string;
+  readonly disclosure?: "hide" | "reveal";
+  readonly actions: MergeActionRecords<BaseA, ToActionRecord<A>>;
+  readonly collection?: MergeActionRecords<BaseC, ToActionRecord<C>>;
+};
+declare function crud<const A extends ActionList | undefined = undefined, const C extends ActionList | undefined = undefined>(options?: PresetOptions<A, C>): PresetResult<typeof CRUD_ACTIONS, typeof CRUD_COLLECTION, A, C>;
+declare function readable<const A extends ActionList | undefined = undefined, const C extends ActionList | undefined = undefined>(options?: PresetOptions<A, C>): PresetResult<typeof READABLE_ACTIONS, typeof READABLE_COLLECTION, A, C>;
+declare function writable<const A extends ActionList | undefined = undefined, const C extends ActionList | undefined = undefined>(options?: PresetOptions<A, C>): PresetResult<typeof WRITABLE_ACTIONS, typeof WRITABLE_COLLECTION, A, C>;
+//#endregion
+//#region src/core/duration.d.ts
+declare function parseDuration(input: unknown): number | undefined;
+//#endregion
+//#region src/core/ocsf.d.ts
+/** The OCSF schema version `toOcsf` emits. */
+declare const OCSF_VERSION = "1.3.0";
+/** An OCSF Authorize Session (class 3003, category Identity and Access Management) event. */
+type OcsfAuthorizeSession = {
+  readonly class_uid: 3003;
+  readonly category_uid: 3;
+  readonly activity_id: 1;
+  readonly type_uid: 300301;
+  readonly severity_id: 1 | 4;
+  readonly time: number;
+  readonly status_id: 0 | 1 | 2 | 99;
+  readonly status: "Unknown" | "Success" | "Failure" | "Other";
+  readonly status_detail?: string;
+  readonly message: string;
+  readonly privileges: readonly string[];
+  /** OCSF requires `user`; an anonymous subject is `{ name: 'anonymous' }`. */
+  readonly user: {
+    readonly uid: string;
+  } | {
+    readonly name: "anonymous";
+  };
+  readonly actor?: {
+    readonly user?: {
+      readonly uid: string;
+    };
+    readonly app_name?: string;
+  };
+  readonly metadata: {
+    readonly version: typeof OCSF_VERSION;
+    readonly product: {
+      readonly name: "PermDock";
+      readonly vendor_name: "PermDock";
+      readonly feature?: {
+        readonly name: string;
+      };
+    };
+    readonly tenant_uid?: string;
+    readonly correlation_uid?: string;
+  };
+  readonly unmapped: {
+    readonly outcome: DecisionEvent["outcome"];
+    readonly scope: string;
+    readonly resource: DecisionEvent["resource"];
+    readonly source: DecisionEvent["source"];
+    readonly phase?: DecisionEvent["phase"];
+    readonly role?: string | null;
+    readonly via?: string | null;
+    /** Set high-severity break-glass events apart in a SIEM. */
+    readonly breakGlass?: true;
+    readonly purpose?: readonly string[];
+    readonly reason?: string;
+  };
+};
+/** Projects a decision or approval event onto OCSF Authorize Session; the event itself is unchanged. */
+declare function toOcsf(event: DecisionEvent): OcsfAuthorizeSession;
+/**
+ * An OCSF Account Change (class 3001) event for a support-access lifecycle
+ * event: `started` enables the session, `ended` and `revoked` disable it.
+ * Support access is high severity, so a SIEM can alert on vendor access.
+ */
+type OcsfAccountChange = {
+  readonly class_uid: 3001;
+  readonly category_uid: 3;
+  /** 2 Enable for `started`, 5 Disable for `ended` and `revoked`. */
+  readonly activity_id: 2 | 5;
+  readonly type_uid: 300102 | 300105;
+  readonly severity_id: 4;
+  readonly time: number;
+  readonly message: string;
+  readonly user: {
+    readonly uid: string;
+  };
+  readonly actor?: {
+    readonly user?: {
+      readonly uid: string;
+    };
+  };
+  readonly metadata: {
+    readonly version: typeof OCSF_VERSION;
+    readonly product: {
+      readonly name: "PermDock";
+      readonly vendor_name: "PermDock";
+    };
+    readonly tenant_uid: string;
+  };
+  readonly unmapped: {
+    readonly operation: AccessEvent["operation"];
+    readonly via: string;
+    readonly roles: readonly string[];
+    readonly member?: {
+      readonly group: string;
+    };
+    readonly grantedBy?: string;
+    readonly reason?: string;
+  };
+};
+declare function accessToOcsf(event: AccessEvent): OcsfAccountChange;
+//#endregion
+//#region src/core/csv.d.ts
+/** The CSV export columns, in order; the header row of every CSV file. */
+declare const CSV_COLUMNS: readonly ["time", "principal", "actor", "tenant", "permission", "outcome", "matched.role", "via", "denials.reason", "token"];
+/**
+ * One RFC 4180 row for a decision or approval event, without a line
+ * terminator; join rows with CRLF under a `CSV_COLUMNS` header.
+ */
+declare function toCsvRow(event: DecisionEvent): string;
+//#endregion
+//#region src/core/catalog-fingerprint.d.ts
+/**
+ * The catalog v1 fingerprint: base64url SHA-256 of canonical JSON (keys
+ * sorted, no whitespace) without `generatedAt`, `generator`, `fingerprint`
+ * and every `permissions[].usages`, so neither the CLI version, the clock nor
+ * call sites change it.
+ */
+declare function catalogFingerprint(catalog: unknown): string;
+//#endregion
+//#region src/core/delegation.d.ts
+type DelegatedPermission = Pick<Permission, "scope" | "resource" | "action">;
+/**
+ * Whether a delegated caller may use a permission its principal holds, through
+ * OAuth `scopes`, RFC 9396 `authorizationDetails` or GNAP `access`.
+ * `undefined` means covered; otherwise the denial reason `decide` would add.
+ */
+declare function coveredByDelegation(permission: DelegatedPermission, delegation: Delegation | undefined, resourceId?: string, hasActor?: boolean): DenialReason | undefined;
+/**
+ * The permission keys the policy's delegations let `subject.actor` use for
+ * `subject.principal` right now: the union over every active delegation whose
+ * `to` matches the actor and whose `from` the principal holds. `undefined`
+ * when none applies, so the call falls back to the token delegation alone.
+ * An actor with `readOnly: true` gets only each delegation's read-only keys.
+ * Attenuation only: a key here still needs a matching allow and no deny.
+ */
+declare function delegatedPermissions(delegations: readonly PolicyDelegation[] | undefined, subject: Subject, heldRoles: ReadonlySet<string>, now: number): ReadonlySet<string> | undefined;
+//#endregion
+export { emptySnapshot as A, ResolvedCustomRole as B, composeMemberships as C, requiresApproval as D, opaque as E, memoryRelations as F, resolveCustomRole as H, CustomRoleDrop as I, CustomRoleDropReason as L, parseSnapshot as M, MemoryEdge as N, context as O, MemoryRelationsData as P, CustomRoleRename as R, claimsFirst as S, sqlFunction as T, validateCustomRole as U, customRoleClaim as V, mayUse as _, toCsvRow as a, StripeEntitlementsClient as b, OcsfAuthorizeSession as c, parseDuration as d, crud as f, snapshotFor as g, SnapshotForOptions as h, CSV_COLUMNS as i, fromSnapshot as j, principal as k, accessToOcsf as l, writable as m, delegatedPermissions as n, OCSF_VERSION as o, readable as p, catalogFingerprint as r, OcsfAccountChange as s, coveredByDelegation as t, toOcsf as u, mayAccess as v, isExternallyManaged as w, fromStripeEntitlements as x, memoryLimitStore as y, CustomRoleValidation as z };

package/dist/index.d.ts

@@ -0,0 +1,11 @@
+import { $ as DecisionSink, $n as relation, $t as RowPair, A as RoleScope, An as memoryApprovalPolicies, Ar as isConditionRef, At as memoryEntitlementSource, B as normalizeAssurance, Bn as Obligation, Bt as CredentialPolicy, C as Policy, Cn as ArazzoPlan, Cr as RelatedCondition, Ct as TenantSettings, D as PrincipalOf, Dn as simulateArazzo, Dr as hasConditionOp, Dt as VerificationFailure, En as arazzoFindings, Er as SqlFunctionCondition, Et as TokenVerifier, F as ValidateMode, Fn as DeniedDecision, Ft as Credential, G as UserApprover, Gn as Grantee, Gt as credentialDelegation, H as separationConflicts, Hn as Trace, Ht as CredentialPrincipal, I as allow, In as ExplainedDecision, It as CredentialDecision, J as AuthEvent, Jn as actor, Jt as decideCredential, K as user, Kn as GranteeInput, Kt as credentialPolicyViolation, L as definePolicy, Ln as GrantedDecision, Lt as CredentialKind, M as SubjectOf, Mn as Decision, Mt as memorySettings, N as SupportAccessOptions, Nn as Denial, Nt as WireDecision, O as RoleBinding, On as ApprovalPolicy, Or as isCondition, Ot as VerifiedToken, P as SupportConsent, Pn as DenialReason, Pt as WireDenial, Q as DecisionProvider, Qn as plan, Qt as PermDockOptions, R as deny, Rn as LimitDetail, Rt as CredentialPermission, S as MembershipFixture, Sn as ArazzoFinding, St as SubjectResolver, T as PolicyScopes, Tn as ArazzoStepResult, Tr as SqlFunctionArg, Tt as TokenSigner, U as Approver, Un as TraceSkip, Ut as CredentialRequest, V as role, Vn as Quota, Vt as CredentialPolicyViolation, W as ApproverInput, Wn as TraceSkipReason, Wt as DecideCredentialOptions, X as CredentialVerifier, Xn as assurance, Xt as DecideOptions, Y as CredentialEvent, Yn as anyone, Yt as parseCredential, Z as DecisionEvent, Zn as authenticated, Zt as PermDock, _ as GrantLimit, _n as RoleChangeOptions, _r as Condition, _t as SnapshotAssignable, a as ApprovalRequirement, an as HostedGrantDropped, ar as Assurance, at as LimitStore, b as GrantValidity, bn as breakGlass, br as MemberOfCondition, bt as SnapshotScope, c as BreakGlassOptions, cn as isPortableCondition, cr as CustomRole, ct as MembershipSource, d as ClosureContext, dn as parsePolicyDocument, dr as GnapAccess, dt as RelationHolder, en as SimulateOptions, er as PolicyScopesInput, et as DirectoryEvent, f as ClosureGrantFn, fn as Holder, ft as RelationSource, g as GrantCondition, gn as RoleChangeDecision, gr as VerifiedClaims, gt as Snapshot, h as Grant, hn as RoleChange, hr as Subject, ht as SinkEvent, i as ApprovalOption, in as HostedGrantDropReason, ir as Actor, it as LimitRemaining, j as SeparationConflict, jn as ApprovalRequiredDecision, jr as isSqlFunctionField, jt as memoryRoleSource, k as RoleOptions, kn as ApprovalPolicySource, kr as isConditionDate, kt as WhereCompiler, l as BreakGlassRequirements, ln as memoryPolicySource, lr as CustomRoleGrant, lt as RelationChain, m as DelegationTarget, mn as WhoCan, mr as Principal, mt as SettingsSource, n as ApprovalEscalation, nn as createPermDock, nr as ScopeDeclaration, o as ApprovalStage, on as PolicyDocument, or as AuthorizationDetail, ot as MemberEntry, p as DelegationInput, pn as HoldingVia, pr as Membership, pt as RoleSource, q as AccessEvent, qn as RelationGrantee, qt as credentialSubject, r as ApprovalMode, rn as HostedGrant, rr as ScopeNames, rt as LimitConsumeInput, s as AssuranceRequirement, sn as PolicySource, sr as Binding, st as MembershipEvent, t as ActivationOption, tn as WhereResult, tr as Scope, tt as EntitlementSource, u as BreakGlassSpec, un as mergeHostedGrants, ur as Delegation, ut as RelationGroup, v as GrantOptions, vn as RoleChangeTarget, vr as ConditionRef, vt as SnapshotGrant, w as PolicyDelegation, wn as ArazzoSimulateInput, wr as RelatedHop, wt as TokenFailureCause, x as HostedGrantRef, xn as supportAccess, xr as MemberOfParent, xt as SnapshotSource, y as GrantScope, yn as ActivateInput, yr as ConditionValue, yt as SnapshotNotEntitled, z as normalizeApproval, zn as MatchedGrant, zt as CredentialPermissionInput } from "./policy-CInmNGkM.js";
+import { C as findPermission, D as listPermissions, E as isPermission, O as mergePermissions, S as definePermissions, T as getResource, _ as ResourceNode, a as EdgeGroups, b as ResourceRelation, c as FieldRelation, d as Permission, f as PermissionKind, g as ResourceLink, h as ResourceInit, i as DefinePermissionsOptions, k as resource, m as PrincipalRelation, n as ActionMeta, o as EdgeMatch, p as PermissionTree, r as ComputedRelation, s as EdgeRelation, u as MetaValue, v as ResourceOptions, w as formerKeys, x as ResourceRelationInput, y as ResourceParent } from "./permissions-B4apnahQ.js";
+import { a as RoleTree, c as defineRoles, d as isRole, f as listPlans, i as RoleMeta, l as findRole, n as PlanTree, o as Vocabulary, p as listRoles, r as Role, s as definePlans, t as Plan, u as isPlan } from "./vocabulary-Dk0fs-Jk.js";
+import { A as emptySnapshot, B as ResolvedCustomRole, C as composeMemberships, D as requiresApproval, E as opaque, F as memoryRelations, H as resolveCustomRole, I as CustomRoleDrop, L as CustomRoleDropReason, M as parseSnapshot, N as MemoryEdge, O as context, P as MemoryRelationsData, R as CustomRoleRename, S as claimsFirst, T as sqlFunction, U as validateCustomRole, V as customRoleClaim, _ as mayUse, a as toCsvRow, b as StripeEntitlementsClient, c as OcsfAuthorizeSession, d as parseDuration, f as crud, g as snapshotFor, h as SnapshotForOptions, i as CSV_COLUMNS, j as fromSnapshot, k as principal, l as accessToOcsf, m as writable, n as delegatedPermissions, o as OCSF_VERSION, p as readable, r as catalogFingerprint, s as OcsfAccountChange, t as coveredByDelegation, u as toOcsf, v as mayAccess, w as isExternallyManaged, x as fromStripeEntitlements, y as memoryLimitStore, z as CustomRoleValidation } from "./index-xIxJLwOQ.js";
+import { a as PermDockValidationError, i as PermDockRevokedError, n as PermDockApprovalRequiredError, o as ProblemDetails, r as PermDockDeniedError, s as RevokedCode } from "./errors-DbZ1YOnb.js";
+import { a as CloudEvent, c as MemorySinkOptions, d as credentialEvent, f as membershipEvent, h as toCloudEvent, i as CatalogFindingCode, l as SignDecisionBatchOptions, m as signDecisionBatch, n as CatalogEventData, o as CloudEventType, p as memorySink, r as CatalogFinding, s as MemorySink, t as CLOUD_EVENT_TYPES, u as accessEvent } from "./sink-Cfr9-7YC.js";
+import { i as memoryRevocationFeed, n as RevocationFeed, r as RevocationListener, t as RevocationEvent } from "./revocations-Cy06JNx2.js";
+import { a as requiredPlans, i as describe, n as DescribeMessages, r as DescribeOptions, t as DecisionDescription } from "./describe-DernyItf.js";
+import { n as parsePermDockDigest, t as PermDockDigest } from "./digest-B3kc_PgQ.js";
+import { a as LinkPolicyViolation, c as capabilitySubject, d as signCapability, i as LinkPolicy, l as linkPolicyViolation, n as CapabilityInput, o as LinkPrincipal, r as CapabilityRedeemer, s as SignCapabilityOptions, t as Capability, u as parseCapability } from "./capability-BDG_nkxt.js";
+export { type AccessEvent, type ActionMeta, type ActivateInput, type ActivationOption, type Actor, type ApprovalEscalation, type ApprovalMode, type ApprovalOption, type ApprovalPolicy, type ApprovalPolicySource, type ApprovalRequiredDecision, type ApprovalRequirement, type ApprovalStage, type Approver, type ApproverInput, type ArazzoFinding, type ArazzoPlan, type ArazzoSimulateInput, type ArazzoStepResult, type Assurance, type AssuranceRequirement, type AuthEvent, type AuthorizationDetail, type Binding, type BreakGlassOptions, type BreakGlassRequirements, type BreakGlassSpec, CLOUD_EVENT_TYPES, CSV_COLUMNS, type Capability, type CapabilityInput, type CapabilityRedeemer, type CatalogEventData, type CatalogFinding, type CatalogFindingCode, type ClosureContext, type ClosureGrantFn, type CloudEvent, type CloudEventType, type ComputedRelation, type Condition, type ConditionRef, type ConditionValue, type Credential, type CredentialDecision, type CredentialEvent, type CredentialKind, type CredentialPermission, type CredentialPermissionInput, type CredentialPolicy, type CredentialPolicyViolation, type CredentialPrincipal, type CredentialRequest, type CredentialVerifier, type CustomRole, type CustomRoleDrop, type CustomRoleDropReason, type CustomRoleGrant, type CustomRoleRename, type CustomRoleValidation, type DecideCredentialOptions, type DecideOptions, type Decision, type DecisionDescription, type DecisionEvent, type DecisionProvider, type DecisionSink, type DefinePermissionsOptions, type Delegation, type DelegationInput, type DelegationTarget, type Denial, type DenialReason, type DeniedDecision, type DescribeMessages, type DescribeOptions, type DirectoryEvent, type EdgeGroups, type EdgeMatch, type EdgeRelation, type EntitlementSource, type ExplainedDecision, type FieldRelation, type GnapAccess, type Grant, type GrantCondition, type GrantLimit, type GrantOptions, type GrantScope, type GrantValidity, type GrantedDecision, type Grantee, type GranteeInput, type Holder, type HoldingVia, type HostedGrant, type HostedGrantDropReason, type HostedGrantDropped, type HostedGrantRef, type LimitConsumeInput, type LimitDetail, type LimitRemaining, type LimitStore, type LinkPolicy, type LinkPolicyViolation, type LinkPrincipal, type MatchedGrant, type MemberEntry, type MemberOfCondition, type MemberOfParent, type Membership, type MembershipEvent, type MembershipFixture, type MembershipSource, type MemoryEdge, type MemoryRelationsData, type MemorySink, type MemorySinkOptions, type MetaValue, OCSF_VERSION, type Obligation, type OcsfAccountChange, type OcsfAuthorizeSession, type PermDock, PermDockApprovalRequiredError, PermDockDeniedError, type PermDockDigest, type PermDockOptions, PermDockRevokedError, PermDockValidationError, type Permission, type PermissionKind, type PermissionTree, type Plan, type PlanTree, type Policy, type PolicyDelegation, type PolicyDocument, type PolicyScopes, type PolicyScopesInput, type PolicySource, type Principal, type PrincipalOf, type PrincipalRelation, type ProblemDetails, type Quota, type RelatedCondition, type RelatedHop, type RelationChain, type RelationGrantee, type RelationGroup, type RelationHolder, type RelationSource, type ResolvedCustomRole, type ResourceInit, type ResourceLink, type ResourceNode, type ResourceOptions, type ResourceParent, type ResourceRelation, type ResourceRelationInput, type RevocationEvent, type RevocationFeed, type RevocationListener, type RevokedCode, type Role, type RoleBinding, type RoleChange, type RoleChangeDecision, type RoleChangeOptions, type RoleChangeTarget, type RoleMeta, type RoleOptions, type RoleScope, type RoleSource, type RoleTree, type RowPair, type Scope, type ScopeDeclaration, type ScopeNames, type SeparationConflict, type SettingsSource, type SignCapabilityOptions, type SignDecisionBatchOptions, type SimulateOptions, type SinkEvent, type Snapshot, type SnapshotAssignable, type SnapshotForOptions, type SnapshotGrant, type SnapshotNotEntitled, type SnapshotScope, type SnapshotSource, type SqlFunctionArg, type SqlFunctionCondition, type StripeEntitlementsClient, type Subject, type SubjectOf, type SubjectResolver, type SupportAccessOptions, type SupportConsent, type TenantSettings, type TokenFailureCause, type TokenSigner, type TokenVerifier, type Trace, type TraceSkip, type TraceSkipReason, type UserApprover, type ValidateMode, type VerificationFailure, type VerifiedClaims, type VerifiedToken, type Vocabulary, type WhereCompiler, type WhereResult, type WhoCan, type WireDecision, type WireDenial, accessEvent, accessToOcsf, actor, allow, anyone, arazzoFindings, assurance, authenticated, breakGlass, capabilitySubject, catalogFingerprint, claimsFirst, composeMemberships, context, coveredByDelegation, createPermDock, credentialDelegation, credentialEvent, credentialPolicyViolation, credentialSubject, crud, customRoleClaim, decideCredential, definePermissions, definePlans, definePolicy, defineRoles, delegatedPermissions, deny, describe, emptySnapshot, findPermission, findRole, formerKeys, fromSnapshot, fromStripeEntitlements, getResource, hasConditionOp, isCondition, isConditionDate, isConditionRef, isExternallyManaged, isPermission, isPlan, isPortableCondition, isRole, isSqlFunctionField, linkPolicyViolation, listPermissions, listPlans, listRoles, mayAccess, mayUse, membershipEvent, memoryApprovalPolicies, memoryEntitlementSource, memoryLimitStore, memoryPolicySource, memoryRelations, memoryRevocationFeed, memoryRoleSource, memorySettings, memorySink, mergeHostedGrants, mergePermissions, normalizeApproval, normalizeAssurance, opaque, parseCapability, parseCredential, parseDuration, parsePermDockDigest, parsePolicyDocument, parseSnapshot, plan, principal, readable, relation, requiredPlans, requiresApproval, resolveCustomRole, resource, role, separationConflicts, signCapability, signDecisionBatch, simulateArazzo, snapshotFor, sqlFunction, supportAccess, toCloudEvent, toCsvRow, toOcsf, user, validateCustomRole, writable };

package/dist/index.js

@@ -0,0 +1,21 @@
+import { _ as mergePermissions, a as formerKeys, c as getResource, f as isPermission, g as listPermissions, i as findPermission, n as definePermissions, y as resource } from "./permissions-DC7GROPA.js";
+import { a as hasConditionOp, c as isConditionRef, l as isSqlFunctionField, o as isCondition, r as principal, s as isConditionDate, t as context } from "./refs-ChLSxbST.js";
+import { a as definePolicy, d as role, f as separationConflicts, l as normalizeApproval, m as memoryLimitStore, o as deny, t as allow, u as normalizeAssurance, y as opaque } from "./policy-ANp36PnI.js";
+import { a as accessToOcsf, c as readable, d as mayAccess, f as fromStripeEntitlements, g as sqlFunction, h as memorySettings, i as OCSF_VERSION, l as writable, m as memoryRoleSource, n as CSV_COLUMNS, o as toOcsf, p as memoryEntitlementSource, r as toCsvRow, s as crud, t as catalogFingerprint, u as snapshotFor } from "./src-CTNT-PBW.js";
+import { r as user } from "./approvers-aH0PJkmf.js";
+import { C as listPlans, S as isRole, a as authenticated, b as findRole, d as relation, i as assurance, n as anyone, t as actor, u as plan, v as definePlans, w as listRoles, x as isPlan, y as defineRoles } from "./grantee-Bv04_Vzf.js";
+import { n as requiredPlans, t as describe } from "./describe-Bt1YD5uS.js";
+import { r as parsePermDockDigest } from "./digest-BI-6aa6d.js";
+import { i as PermDockValidationError, n as PermDockDeniedError, r as PermDockRevokedError, t as PermDockApprovalRequiredError } from "./errors-Iy71s7Oj.js";
+import { a as decideCredential, n as credentialPolicyViolation, o as parseCredential, r as credentialSubject, s as memoryRevocationFeed, t as credentialDelegation } from "./credential-B_rkUNlY.js";
+import { d as delegatedPermissions, h as simulateArazzo, n as parseSnapshot, p as arazzoFindings, u as coveredByDelegation } from "./snapshot-DE8dE_hz.js";
+import { t as parseDuration } from "./duration-xK2jGFVc.js";
+import { t as requiresApproval } from "./approval-required-TzNB9oQA.js";
+import { i as parsePolicyDocument, n as memoryPolicySource, r as mergeHostedGrants, t as isPortableCondition } from "./hosted-BwKQ1BTA.js";
+import { c as supportAccess, f as resolveCustomRole, g as isExternallyManaged, h as composeMemberships, l as customRoleClaim, m as claimsFirst, p as validateCustomRole, s as breakGlass, t as createPermDock, v as memoryApprovalPolicies } from "./permdock-yoZ7EjxX.js";
+import { t as memoryRelations } from "./relations-r4soIFZB.js";
+import { n as fromSnapshot, t as emptySnapshot } from "./from-snapshot-BMGnhmgv.js";
+import { t as mayUse } from "./may-use-CnFEjVEp.js";
+import { a as memorySink, i as membershipEvent, n as accessEvent, o as signDecisionBatch, r as credentialEvent, s as toCloudEvent, t as CLOUD_EVENT_TYPES } from "./sink-Bd9PSyfq.js";
+import { c as signCapability, i as linkPolicyViolation, o as parseCapability, t as capabilitySubject } from "./capability-B68OFnZx.js";
+export { CLOUD_EVENT_TYPES, CSV_COLUMNS, OCSF_VERSION, PermDockApprovalRequiredError, PermDockDeniedError, PermDockRevokedError, PermDockValidationError, accessEvent, accessToOcsf, actor, allow, anyone, arazzoFindings, assurance, authenticated, breakGlass, capabilitySubject, catalogFingerprint, claimsFirst, composeMemberships, context, coveredByDelegation, createPermDock, credentialDelegation, credentialEvent, credentialPolicyViolation, credentialSubject, crud, customRoleClaim, decideCredential, definePermissions, definePlans, definePolicy, defineRoles, delegatedPermissions, deny, describe, emptySnapshot, findPermission, findRole, formerKeys, fromSnapshot, fromStripeEntitlements, getResource, hasConditionOp, isCondition, isConditionDate, isConditionRef, isExternallyManaged, isPermission, isPlan, isPortableCondition, isRole, isSqlFunctionField, linkPolicyViolation, listPermissions, listPlans, listRoles, mayAccess, mayUse, membershipEvent, memoryApprovalPolicies, memoryEntitlementSource, memoryLimitStore, memoryPolicySource, memoryRelations, memoryRevocationFeed, memoryRoleSource, memorySettings, memorySink, mergeHostedGrants, mergePermissions, normalizeApproval, normalizeAssurance, opaque, parseCapability, parseCredential, parseDuration, parsePermDockDigest, parsePolicyDocument, parseSnapshot, plan, principal, readable, relation, requiredPlans, requiresApproval, resolveCustomRole, resource, role, separationConflicts, signCapability, signDecisionBatch, simulateArazzo, snapshotFor, sqlFunction, supportAccess, toCloudEvent, toCsvRow, toOcsf, user, validateCustomRole, writable };

package/dist/jwt/index.d.ts

@@ -0,0 +1,87 @@
+import { Et as TokenVerifier, J as AuthEvent, Tt as TokenSigner, hr as Subject, mr as Principal, nt as JwtClaims, wt as TokenFailureCause } from "../policy-CInmNGkM.js";
+import { a as JsonWebKeySet, c as JwtJwks, d as MappedSubject, i as JoseTokenVerifierOptions, l as JwtPrincipal, n as DpopProofResult, o as JwtAlgorithm, r as JoseTokenSignerOptions, s as JwtClaimPaths, t as DiscoveryInput, u as JwtSubjectOptions } from "../types-bva3i4Gf.js";
+import { a as ReplayStore } from "../types-i4BAOvdb.js";
+import { i as LinkPolicy, o as LinkPrincipal, t as Capability } from "../capability-BDG_nkxt.js";
+import { StandardSchemaV1 } from "@standard-schema/spec";
+//#region src/jwt/capability.d.ts
+/** `on('auth')` causes: a verification failure, or one of the three capability checks. */
+type CapabilityFailureCause = TokenFailureCause | "capability-revoked" | "capability-replayed" | "redeemer-mismatch" | "link-policy";
+type CapabilitySubjectOptions = Omit<JoseTokenVerifierOptions, "typ" | "issuer" | "audience" | "profile"> & {
+  /** The issuer the capability was signed by (`iss`); required. */
+  readonly issuer: string;
+  /** The application the capability was signed for (`aud`); required. */
+  readonly audience: string | readonly string[];
+  readonly verifier?: TokenVerifier;
+  /**
+   * The link policies of the scope instances the linked resource sits in
+   * (its tenant, its customer); every one must hold. A throw denies.
+   */
+  readonly linkPolicy?: (capability: Capability) => LinkPolicy | readonly LinkPolicy[] | undefined | Promise<LinkPolicy | readonly LinkPolicy[] | undefined>;
+  /** `true` when the application revoked the link id (`sub`); a throw denies. */
+  readonly revoked?: (id: string) => boolean | Promise<boolean>;
+  /** Claims the `jti` of a one-time capability; a one-time capability without it is refused. */
+  readonly replay?: ReplayStore;
+  /** The request's own verified subject, checked against the capability's `redeemer`. */
+  readonly viewer?: Subject;
+  readonly onAuth?: (event: AuthEvent) => void;
+  readonly requestId?: string;
+};
+/**
+ * Resolves a `permdock-capability+jwt` into the `link` subject it acts as.
+ * Every failure (signature, `typ`, `iss`, `aud`, expiry, a malformed claim,
+ * a revoked link, a replayed one-time token, a redeemer the viewer does not
+ * satisfy, a throwing store) is the anonymous subject, never a throw.
+ */
+export declare function subjectFromCapability(token: string | undefined | null, options: CapabilitySubjectOptions): Promise<Subject<LinkPrincipal> | Subject>;
+//#endregion
+//#region src/jwt/ci-oidc.d.ts
+type CiOidcProvider = "github" | "gitlab" | "buildkite";
+type CiOidcSubjectOptions = Omit<JoseTokenVerifierOptions, "typ" | "issuer" | "audience" | "discovery" | "profile"> & {
+  readonly provider: CiOidcProvider;
+  /** The audience the job requested the token for; required. */
+  readonly audience: string | readonly string[];
+  /**
+   * A self-managed GitLab or GitHub Enterprise Server issuer. Its keys come
+   * from OpenID discovery unless `jwks` is set.
+   */
+  readonly issuer?: string;
+  /** Validates the verified claims; a failure or a Promise is the anonymous subject. */
+  readonly schema?: StandardSchemaV1;
+  readonly verifier?: TokenVerifier;
+  readonly onAuth?: (event: AuthEvent) => void;
+  readonly requestId?: string;
+};
+/** A CI job: never a user. `ref` is a full ref (`refs/heads/main`, `refs/tags/v1`). */
+type CiOidcPrincipal = Principal & {
+  readonly kind: "workload";
+  readonly issuer: string;
+  readonly provider: CiOidcProvider;
+  readonly repository?: string;
+  readonly ref?: string;
+  readonly environment?: string;
+};
+/**
+ * Resolves a CI provider's OIDC token (GitHub Actions, GitLab CI, Buildkite)
+ * into a `workload` principal whose id is `sub`. Every failure (signature,
+ * issuer, audience, expiry, a missing `sub`, the `schema`) is the anonymous
+ * subject, never a throw and never a user.
+ */
+export declare function subjectFromCiOidc(token: string | undefined | null, options: CiOidcSubjectOptions): Promise<Subject<CiOidcPrincipal> | Subject>;
+//#endregion
+//#region src/jwt/dpop.d.ts
+export declare function verifyDpopProof(request: Request, claims: JwtClaims, accessToken?: string): Promise<DpopProofResult>;
+//#endregion
+//#region src/jwt/introspection.d.ts
+export declare function subjectFromIntrospection(response: unknown, options?: JwtSubjectOptions): MappedSubject;
+//#endregion
+//#region src/jwt/signer.d.ts
+export declare function joseTokenSigner(options: JoseTokenSignerOptions): TokenSigner;
+//#endregion
+//#region src/jwt/subject.d.ts
+export declare function subjectFromJwt(token: string | undefined | null, options: JwtSubjectOptions, request?: Request): Promise<MappedSubject>;
+export declare function createJwtSubjectResolver(options: JwtSubjectOptions): (token: string | undefined | null, request?: Request) => Promise<MappedSubject>;
+//#endregion
+//#region src/jwt/verifier.d.ts
+export declare function joseTokenVerifier(options: JoseTokenVerifierOptions): TokenVerifier;
+//#endregion
+export type { CapabilityFailureCause, CapabilitySubjectOptions, CiOidcPrincipal, CiOidcProvider, CiOidcSubjectOptions, DiscoveryInput, DpopProofResult, JoseTokenSignerOptions, JoseTokenVerifierOptions, JsonWebKeySet, JwtAlgorithm, JwtClaimPaths, JwtJwks, JwtPrincipal, JwtSubjectOptions, MappedSubject };