permdock 0.0.0 → 0.1.0

package/dist/better-auth/index.js

@@ -0,0 +1,324 @@
+import { n as isReadonlyArray, t as compact } from "../compact-y6vfu2_f.js";
+import { n as freezeDeep } from "../freeze-y1_jQL4v.js";
+import { g as listPermissions } from "../permissions-DC7GROPA.js";
+import { d as role, t as allow } from "../policy-ANp36PnI.js";
+import { t as ignoreRejection } from "../thenable-okc2xDsj.js";
+import { t as anonymousSubject } from "../subject-C6dLxqHU.js";
+import { i as membershipEvent } from "../sink-Bd9PSyfq.js";
+//#region src/better-auth/parse.ts
+function isRecord(value) {
+	return value !== null && typeof value === "object" && !Array.isArray(value);
+}
+function asRoles(value) {
+	if (typeof value === "string") return value === "" ? [] : value.split(",").map((item) => item.trim()).filter((item) => item !== "");
+	if (!Array.isArray(value)) return [];
+	return value.filter((item) => typeof item === "string");
+}
+function asStatements(value) {
+	if (!isRecord(value)) return {};
+	const out = {};
+	for (const [resource, actions] of Object.entries(value)) {
+		if (!Array.isArray(actions)) continue;
+		out[resource] = actions.filter((action) => typeof action === "string");
+	}
+	return out;
+}
+function expiresAtSeconds(value) {
+	if (typeof value === "number" && Number.isFinite(value)) return value > 0xe8d4a51000 ? Math.floor(value / 1e3) : Math.floor(value);
+	if (value instanceof Date) {
+		const ms = value.getTime();
+		return Number.isFinite(ms) ? Math.floor(ms / 1e3) : void 0;
+	}
+	if (typeof value === "string") {
+		const parsed = Date.parse(value);
+		return Number.isNaN(parsed) ? void 0 : Math.floor(parsed / 1e3);
+	}
+}
+function unwrapList(value) {
+	if (Array.isArray(value)) return value;
+	if (!isRecord(value)) return [];
+	for (const key of [
+		"members",
+		"teams",
+		"organizations",
+		"roles",
+		"data",
+		"items"
+	]) {
+		const inner = value[key];
+		if (Array.isArray(inner)) return inner;
+	}
+	return [];
+}
+/**
+* Member rows for `userId` only. `listMembers` returns every member of an
+* organization, so a row without the caller's `userId` is never theirs.
+*/
+function parseMemberRows(value, userId, requireUserId = true) {
+	const out = [];
+	const rows = isRecord(value) && typeof value["organizationId"] === "string" ? [value] : unwrapList(value);
+	for (const item of rows) {
+		if (!isRecord(item)) continue;
+		const owner = typeof item["userId"] === "string" ? item["userId"] : void 0;
+		if (owner === void 0 ? requireUserId : owner !== userId) continue;
+		const tenant = typeof item["organizationId"] === "string" ? item["organizationId"] : void 0;
+		const roles = asRoles(item["role"] ?? item["roles"]);
+		if (tenant === void 0 || roles.length === 0) continue;
+		out.push(compact({
+			tenant,
+			roles
+		}));
+	}
+	return out;
+}
+function parseTeamRows(value, userId) {
+	const out = [];
+	for (const item of unwrapList(value)) {
+		if (!isRecord(item)) continue;
+		if (typeof item["userId"] === "string" && item["userId"] !== userId) continue;
+		const teamRecord = isRecord(item["team"]) ? item["team"] : void 0;
+		const team = typeof item["teamId"] === "string" ? item["teamId"] : typeof teamRecord?.["id"] === "string" ? teamRecord["id"] : void 0;
+		const tenant = typeof item["organizationId"] === "string" ? item["organizationId"] : typeof teamRecord?.["organizationId"] === "string" ? teamRecord["organizationId"] : void 0;
+		const roles = asRoles(item["role"] ?? item["roles"]);
+		if (team === void 0 || roles.length === 0) continue;
+		out.push(compact({
+			tenant,
+			team,
+			roles,
+			via: `team:${team}`
+		}));
+	}
+	return out;
+}
+function parseOrganizationRoles(value) {
+	const out = [];
+	for (const item of unwrapList(value)) {
+		if (!isRecord(item)) continue;
+		const name = typeof item["role"] === "string" ? item["role"] : typeof item["name"] === "string" ? item["name"] : void 0;
+		if (name === void 0 || name === "") continue;
+		out.push({
+			name,
+			statements: asStatements(item["permission"] ?? item["permissions"] ?? item["statements"])
+		});
+	}
+	return out;
+}
+function statementsCover(candidate, required) {
+	for (const [resource, actions] of Object.entries(required)) {
+		const held = candidate[resource];
+		if (held === void 0) return false;
+		const set = new Set(held);
+		for (const action of actions) if (!set.has(action)) return false;
+	}
+	return true;
+}
+//#endregion
+//#region src/better-auth/roles.ts
+function statementsOf(accessRole) {
+	return asStatements(accessRole.statements ?? accessRole.permissions);
+}
+function rolesFromAccessControl(access, permissions, options = {}) {
+	const leaves = listPermissions(permissions);
+	const unmatched = [];
+	const roles = [];
+	for (const [name, accessRole] of Object.entries(access.roles)) {
+		const statements = statementsOf(accessRole);
+		const grants = [];
+		for (const [resource, actions] of Object.entries(statements)) for (const action of actions) {
+			const leaf = leaves.find((item) => item.resource === resource && item.action === action);
+			if (leaf === void 0) {
+				unmatched.push({
+					role: name,
+					resource,
+					action
+				});
+				continue;
+			}
+			grants.push(allow(leaf));
+		}
+		roles.push(options.on === "tenant" ? role(name, grants, { on: "tenant" }) : role(name, grants));
+	}
+	return Object.assign(roles, { unmatched });
+}
+function betterAuthRoleSource(auth, options = {}) {
+	const assignableRoles = options.assignable ?? [];
+	return {
+		async rolesFor(tenant) {
+			try {
+				return parseOrganizationRoles(await auth.api?.listOrganizationRoles?.({
+					query: { organizationId: tenant },
+					headers: options.headers
+				})).map((item) => freezeDeep(compact({
+					tenant,
+					name: item.name,
+					includes: assignableRoles.filter((declared) => statementsCover(item.statements, declared.statements)).map((declared) => declared.name)
+				})));
+			} catch {
+				return [];
+			}
+		},
+		assignable() {
+			return assignableRoles.map((item) => item.name);
+		}
+	};
+}
+/** A team role sits in the second scope inside its organization; an organization role in the first. */
+function scopeOfChange(event) {
+	const tenant = event.organizationId;
+	if (tenant === void 0) return {};
+	return event.teamId === void 0 ? {
+		scope: "tenant",
+		id: tenant
+	} : {
+		scope: "team",
+		id: event.teamId,
+		within: { tenant }
+	};
+}
+function onRoleChange(refresh, options = {}) {
+	return async (event) => {
+		await refresh(event);
+		const sink = options.sink;
+		if (sink === void 0 || event.userId === void 0) return;
+		const added = event.role !== void 0 && event.role !== event.previousRole ? [event.role] : [];
+		const removed = event.previousRole !== void 0 && event.previousRole !== event.role ? [event.previousRole] : [];
+		const operation = event.previousRole === void 0 ? "added" : event.role === void 0 ? "removed" : "changed";
+		try {
+			await sink.write([membershipEvent(compact({
+				source: "better-auth",
+				operation,
+				principal: { id: event.userId },
+				...scopeOfChange(event),
+				roles: {
+					added,
+					removed
+				},
+				by: event.by
+			}))]);
+		} catch {}
+	};
+}
+//#endregion
+//#region src/better-auth/subject.ts
+const PROFILE_FIELDS = /* @__PURE__ */ new Set([
+	"name",
+	"image",
+	"displayName"
+]);
+function validateClaims(extra, schema) {
+	const result = schema["~standard"].validate(extra);
+	if (result instanceof Promise) {
+		ignoreRejection(result);
+		return;
+	}
+	if ("issues" in result && result.issues !== void 0) return;
+	const value = result.value;
+	return isRecord(value) ? value : void 0;
+}
+function extraFields(user) {
+	const reserved = /* @__PURE__ */ new Set([
+		"id",
+		"role",
+		"roles",
+		"email",
+		"emailVerified",
+		"createdAt",
+		"updatedAt",
+		"banned",
+		"banReason",
+		"banExpires"
+	]);
+	const extra = {};
+	for (const [key, value] of Object.entries(user)) {
+		if (reserved.has(key) || PROFILE_FIELDS.has(key)) continue;
+		extra[key] = value;
+	}
+	return extra;
+}
+function isTrustedSession(session) {
+	if (!isRecord(session)) return false;
+	return isRecord(session["user"]) || isRecord(session["session"]);
+}
+async function settle(load, fallback) {
+	try {
+		return await load();
+	} catch {
+		return fallback;
+	}
+}
+async function organizationIds(auth, tenant, options) {
+	const list = auth.api?.listOrganizations;
+	if (options.memberships === "active" || list === void 0) return tenant === void 0 ? [] : [tenant];
+	const ids = (await settle(async () => {
+		const value = await list({ headers: options.headers });
+		return isReadonlyArray(value) ? value : [];
+	}, [])).map((row) => isRecord(row) && typeof row["id"] === "string" ? row["id"] : void 0).filter((id) => id !== void 0 && id !== "");
+	return [...new Set(ids)];
+}
+function memberIn(auth, userId, organizationId, tenant, headers) {
+	const active = auth.api?.getActiveMember;
+	if (organizationId === tenant && active !== void 0) return settle(async () => parseMemberRows(await active({ headers }), userId), []);
+	const list = auth.api?.listMembers;
+	if (list === void 0) return Promise.resolve([]);
+	return settle(async () => parseMemberRows(await list({
+		query: {
+			organizationId,
+			filterField: "userId",
+			filterOperator: "eq",
+			filterValue: userId
+		},
+		headers
+	}), userId).filter((item) => item.tenant === organizationId), []);
+}
+async function loadMemberships(auth, session, user, userId, tenant, options) {
+	let members = parseMemberRows(session["members"] ?? session["member"] ?? user["members"], userId, false);
+	let teams = parseTeamRows(session["teamMembers"] ?? session["teams"] ?? user["teamMembers"], userId);
+	const headers = options.headers;
+	if (members.length === 0) {
+		const ids = await organizationIds(auth, tenant, options);
+		members = (await Promise.all(ids.map((id) => memberIn(auth, userId, id, tenant, headers)))).flat();
+	}
+	const listUserTeams = auth.api?.listUserTeams;
+	if (teams.length === 0 && listUserTeams !== void 0) teams = await settle(async () => parseTeamRows(await listUserTeams({ headers }), userId), []);
+	if (options.memberships === "active" && tenant !== void 0) {
+		members = members.filter((item) => item.tenant === tenant);
+		teams = teams.filter((item) => item.tenant === tenant);
+	}
+	return [...members, ...teams];
+}
+async function subjectFromBetterAuth(auth, session, options = {}) {
+	try {
+		if (session === null || session === void 0 || !isTrustedSession(session)) return anonymousSubject();
+		if (!isRecord(session["user"])) return anonymousSubject();
+		const user = session["user"];
+		const record = isRecord(session["session"]) ? session["session"] : void 0;
+		const id = typeof user["id"] === "string" ? user["id"] : void 0;
+		if (id === void 0 || id === "") return anonymousSubject();
+		const tenant = typeof record?.["activeOrganizationId"] === "string" ? record["activeOrganizationId"] : void 0;
+		const roles = asRoles(user["role"] ?? user["roles"]);
+		const declared = options.declared;
+		const globalRoles = declared === void 0 ? roles : roles.filter((role) => declared.includes(role));
+		let extra = extraFields(user);
+		if (options.schema !== void 0) extra = validateClaims(extra, options.schema) ?? {};
+		const memberships = await loadMemberships(auth, session, user, id, tenant, options);
+		const principal = compact({
+			id,
+			kind: "user",
+			roles: globalRoles,
+			tenant,
+			memberships,
+			email: typeof user["email"] === "string" ? user["email"] : void 0,
+			claims: Object.keys(extra).length === 0 ? void 0 : extra
+		});
+		return freezeDeep(compact({
+			principal,
+			context: {},
+			session: typeof record?.["id"] === "string" ? record["id"] : void 0,
+			expiresAt: expiresAtSeconds(record?.["expiresAt"])
+		}));
+	} catch {
+		return anonymousSubject();
+	}
+}
+//#endregion
+export { betterAuthRoleSource, onRoleChange, rolesFromAccessControl, subjectFromBetterAuth };

package/dist/budget-JqcRqyhK.d.ts

@@ -0,0 +1,11 @@
+//#region src/supabase/budget.d.ts
+/** The default size budget, in bytes of JSON, for the hook's `memberships` claim: about 15 UUID-keyed single-role memberships. */
+declare const supabaseMembershipsBudget = 1024;
+/**
+ * The default claim that carries the active first-scope id: the hook writes
+ * it, `subjectFromSupabase` reads it, and the RLS helpers compare with it.
+ * `rls.tenantClaim` and the `tenant` option change it.
+ */
+declare const supabaseTenantClaim = "tenant_id";
+//#endregion
+export { supabaseTenantClaim as n, supabaseMembershipsBudget as t };

package/dist/budget-NbEtbJC_.js

@@ -0,0 +1,11 @@
+//#region src/supabase/budget.ts
+/** The default size budget, in bytes of JSON, for the hook's `memberships` claim: about 15 UUID-keyed single-role memberships. */
+const supabaseMembershipsBudget = 1024;
+/**
+* The default claim that carries the active first-scope id: the hook writes
+* it, `subjectFromSupabase` reads it, and the RLS helpers compare with it.
+* `rls.tenantClaim` and the `tenant` option change it.
+*/
+const supabaseTenantClaim = "tenant_id";
+//#endregion
+export { supabaseTenantClaim as n, supabaseMembershipsBudget as t };

package/dist/capability-B68OFnZx.js

@@ -0,0 +1,171 @@
+import { t as compact } from "./compact-y6vfu2_f.js";
+import { n as freezeDeep } from "./freeze-y1_jQL4v.js";
+import { S as isForbiddenKey, g as listPermissions } from "./permissions-DC7GROPA.js";
+import { t as anonymousSubject } from "./subject-C6dLxqHU.js";
+//#region src/core/capability.ts
+function redeemerKind(redeemer) {
+	if (redeemer === void 0 || typeof redeemer === "string") return redeemer ?? "anyone";
+	return "user" in redeemer ? "user" : "scope";
+}
+/**
+* The first rule of `policy` the capability breaks, or `undefined`. A
+* lifetime rule without a known `issuedAt`, or one that is not a finite
+* non-negative number, is broken: the check fails closed.
+*/
+function linkPolicyViolation(capability, policy, issuedAt) {
+	const policies = Array.isArray(policy) ? policy : [policy];
+	for (const item of policies) {
+		const max = item.maxLifetime;
+		if (max !== void 0 && (typeof max !== "number" || !Number.isFinite(max) || max < 0 || issuedAt === void 0 || capability.expiresAt - issuedAt > max)) return "lifetime";
+		if (item.redeemers !== void 0 && !item.redeemers.includes(redeemerKind(capability.redeemer))) return "redeemer";
+		if (item.once === true && capability.once !== true) return "once";
+	}
+}
+const MAX_ID = 256;
+const MAX_ENTRIES = 64;
+/** A copy holding only own enumerable properties, so a prototype never supplies a field. */
+function ownRecord(value) {
+	if (value === null || typeof value !== "object" || Array.isArray(value)) return;
+	const record = {};
+	for (const [key, item] of Object.entries(value)) if (!isForbiddenKey(key)) record[key] = item;
+	return record;
+}
+function isId(value) {
+	return typeof value === "string" && value.length > 0 && value.length <= MAX_ID;
+}
+function idList(value) {
+	if (!Array.isArray(value) || value.length === 0 || value.length > MAX_ENTRIES || !value.every(isId)) return;
+	return [...new Set(value)];
+}
+function parseRedeemer(input) {
+	if (input === "anyone" || input === "signed-in") return input;
+	const value = ownRecord(input);
+	if (value === void 0) return;
+	const keys = Object.keys(value);
+	if (keys.length === 1 && isId(value["user"])) return { user: value["user"] };
+	if (keys.length === 2 && isId(value["scope"]) && isId(value["id"])) return {
+		scope: value["scope"],
+		id: value["id"]
+	};
+}
+/**
+* Validates an untrusted `capability` claim and returns a frozen copy with
+* only the v1 fields, or `undefined`. Unknown fields are dropped; a wrong
+* type in a known field rejects the whole claim.
+*/
+function parseCapability(input) {
+	const value = ownRecord(input);
+	if (value === void 0 || value["v"] !== 1 || !isId(value["id"])) return;
+	if (value["holder"] !== "link" && value["holder"] !== "key") return;
+	const on = ownRecord(value["on"]);
+	if (on === void 0 || !isId(on["resource"]) || !isId(on["id"])) return;
+	const roles = idList(value["roles"]);
+	if (roles === void 0) return;
+	const permissions = value["permissions"] === void 0 ? void 0 : idList(value["permissions"]);
+	if (value["permissions"] !== void 0 && permissions === void 0) return;
+	const redeemer = value["redeemer"] === void 0 ? void 0 : parseRedeemer(value["redeemer"]);
+	if (value["redeemer"] !== void 0 && redeemer === void 0) return;
+	if (value["once"] !== void 0 && value["once"] !== true) return;
+	const expiresAt = value["expiresAt"];
+	if (typeof expiresAt !== "number" || !Number.isFinite(expiresAt)) return;
+	return freezeDeep(compact({
+		v: 1,
+		id: value["id"],
+		holder: value["holder"],
+		on: {
+			resource: on["resource"],
+			id: on["id"]
+		},
+		roles,
+		permissions,
+		redeemer,
+		once: value["once"],
+		expiresAt
+	}));
+}
+function resourceName(resource) {
+	const names = new Set(listPermissions(resource).map((leaf) => leaf.resource));
+	const [name] = names;
+	if (names.size !== 1 || name === void 0) throw new Error("PermDock: capability on.resource must name exactly one resource");
+	return name;
+}
+/** Builds the v1 `Capability` for `input`; throws on an input no resolver would accept. */
+function capabilityOf(input) {
+	const capability = parseCapability(compact({
+		v: 1,
+		id: input.id,
+		holder: "link",
+		on: {
+			resource: resourceName(input.on.resource),
+			id: input.on.id
+		},
+		roles: input.roles,
+		permissions: input.permissions?.map((permission) => permission.key),
+		redeemer: input.redeemer,
+		once: input.once === true ? true : void 0,
+		expiresAt: Math.floor(input.expiresAt)
+	}));
+	if (capability === void 0) throw new Error("PermDock: invalid capability (id, on.id and roles are required; roles and permissions hold at most 64 entries)");
+	return capability;
+}
+/**
+* Signs a capability as a `permdock-capability+jwt`: `sub` is the link id,
+* `exp` is `expiresAt`, and the signer sets `iss`, `iat` and a fresh `jti`.
+*/
+function signCapability(input, signer, options = {}) {
+	const capability = capabilityOf(input);
+	const violation = options.linkPolicy === void 0 ? void 0 : linkPolicyViolation(capability, options.linkPolicy, Math.floor(Date.now() / 1e3));
+	if (violation !== void 0) return Promise.reject(/* @__PURE__ */ new Error(`PermDock: capability breaks the link policy (${violation})`));
+	return signer.sign({
+		capability,
+		sub: capability.id
+	}, compact({
+		typ: "permdock-capability+jwt",
+		audience: options.audience,
+		expiresAt: capability.expiresAt
+	}));
+}
+function holdsScope(membership, scope, id, now) {
+	if (membership.expiresAt !== void 0 && membership.expiresAt <= now) return false;
+	if (membership.scope === scope && membership.id === id) return true;
+	return scope === "tenant" && membership.tenant === id || scope === "team" && membership.team === id;
+}
+/** Whether `viewer`, the request's own verified subject, may redeem a capability. */
+function redeemerAllows(redeemer, viewer, now = Date.now() / 1e3) {
+	if (redeemer === void 0 || redeemer === "anyone") return true;
+	const principal = viewer?.principal ?? null;
+	if (principal === null || principal.kind === "link") return false;
+	if (redeemer === "signed-in") return true;
+	if ("user" in redeemer) return principal.id === redeemer.user;
+	return (principal.memberships ?? []).some((membership) => holdsScope(membership, redeemer.scope, redeemer.id, now));
+}
+/**
+* The subject a verified capability acts as: a `link` principal holding
+* `roles` on `on` and nothing else, with `delegation.scopes` narrowing it to
+* `permissions` when the capability lists them. A `key` holder resolves to
+* the anonymous subject until user-bound credentials ship.
+*/
+function capabilitySubject(capability, options = {}) {
+	if (capability.holder !== "link") return anonymousSubject();
+	const membership = {
+		on: capability.on,
+		roles: capability.roles,
+		via: "link",
+		expiresAt: capability.expiresAt
+	};
+	const principal = compact({
+		id: capability.id,
+		kind: "link",
+		issuer: options.issuer,
+		memberships: [membership],
+		capability
+	});
+	return freezeDeep(compact({
+		principal,
+		delegation: capability.permissions === void 0 ? void 0 : { scopes: capability.permissions.map((key) => key.replaceAll(".", ":")) },
+		context: {},
+		expiresAt: capability.expiresAt
+	}));
+}
+//#endregion
+export { ownRecord as a, signCapability as c, linkPolicyViolation as i, idList as n, parseCapability as o, isId as r, redeemerAllows as s, capabilitySubject as t };

package/dist/capability-BDG_nkxt.d.ts

@@ -0,0 +1,99 @@
+import { Tt as TokenSigner, hr as Subject, mr as Principal } from "./policy-CInmNGkM.js";
+import { d as Permission, p as PermissionTree } from "./permissions-B4apnahQ.js";
+//#region src/core/capability.d.ts
+/**
+ * Who may redeem a capability: anyone holding it, any signed-in principal,
+ * one user, or a member of one scope instance. The viewer is the request's
+ * own verified subject, never a claim of the capability.
+ */
+type CapabilityRedeemer = "anyone" | "signed-in" | {
+  readonly user: string;
+} | {
+  readonly scope: string;
+  readonly id: string;
+};
+/**
+ * Capability v1: the `capability` claim of a `permdock-capability+jwt`. It
+ * holds `roles` on one resource instance (`on`, the `Membership.on` shape),
+ * optionally narrowed to `permissions` (keys). `id` is the link id: the
+ * token's `sub` and the handle an application revokes.
+ */
+type Capability = {
+  readonly v: 1;
+  readonly id: string;
+  /** `key` is reserved for user-bound credentials and resolves to no subject. */
+  readonly holder: "link" | "key";
+  readonly on: {
+    readonly resource: string;
+    readonly id: string;
+  };
+  readonly roles: readonly string[];
+  readonly permissions?: readonly string[];
+  readonly redeemer?: CapabilityRedeemer;
+  /** One request per token: the resolver claims the token's `jti` in a `ReplayStore`. */
+  readonly once?: true;
+  /** Seconds since the epoch; also the token's `exp` and the membership's `expiresAt`. */
+  readonly expiresAt: number;
+};
+type LinkPrincipal = Principal & {
+  readonly kind: "link";
+  readonly capability: Capability;
+};
+type CapabilityInput = {
+  readonly id: string;
+  readonly on: {
+    readonly resource: Permission | PermissionTree;
+    readonly id: string;
+  };
+  readonly roles: readonly string[];
+  readonly permissions?: readonly Permission[];
+  readonly redeemer?: CapabilityRedeemer;
+  readonly once?: boolean;
+  readonly expiresAt: number;
+};
+/**
+ * What one scope instance (a tenant, a customer) allows for links on its
+ * resources. Every field only tightens; several policies must all hold.
+ */
+type LinkPolicy = {
+  /** Longest a link may live, in seconds from when it was issued. */
+  readonly maxLifetime?: number;
+  /** Redeemer kinds allowed; `anyone` also covers a capability without `redeemer`. */
+  readonly redeemers?: readonly ("anyone" | "signed-in" | "user" | "scope")[];
+  /** Every link must be one-time. */
+  readonly once?: boolean;
+};
+type LinkPolicyViolation = "lifetime" | "redeemer" | "once";
+type SignCapabilityOptions = {
+  readonly audience?: string | readonly string[];
+  /** Refuse to sign a link these policies would refuse at resolution. */
+  readonly linkPolicy?: LinkPolicy | readonly LinkPolicy[];
+};
+/**
+ * The first rule of `policy` the capability breaks, or `undefined`. A
+ * lifetime rule without a known `issuedAt`, or one that is not a finite
+ * non-negative number, is broken: the check fails closed.
+ */
+declare function linkPolicyViolation(capability: Capability, policy: LinkPolicy | readonly LinkPolicy[], issuedAt: number | undefined): LinkPolicyViolation | undefined;
+/**
+ * Validates an untrusted `capability` claim and returns a frozen copy with
+ * only the v1 fields, or `undefined`. Unknown fields are dropped; a wrong
+ * type in a known field rejects the whole claim.
+ */
+declare function parseCapability(input: unknown): Capability | undefined;
+/**
+ * Signs a capability as a `permdock-capability+jwt`: `sub` is the link id,
+ * `exp` is `expiresAt`, and the signer sets `iss`, `iat` and a fresh `jti`.
+ */
+declare function signCapability(input: CapabilityInput, signer: TokenSigner, options?: SignCapabilityOptions): Promise<string>;
+/**
+ * The subject a verified capability acts as: a `link` principal holding
+ * `roles` on `on` and nothing else, with `delegation.scopes` narrowing it to
+ * `permissions` when the capability lists them. A `key` holder resolves to
+ * the anonymous subject until user-bound credentials ship.
+ */
+declare function capabilitySubject(capability: Capability, options?: {
+  readonly issuer?: string;
+}): Subject<LinkPrincipal> | Subject;
+//#endregion
+export { LinkPolicyViolation as a, capabilitySubject as c, signCapability as d, LinkPolicy as i, linkPolicyViolation as l, CapabilityInput as n, LinkPrincipal as o, CapabilityRedeemer as r, SignCapabilityOptions as s, Capability as t, parseCapability as u };

package/dist/catalog/index.d.ts

@@ -0,0 +1,12 @@
+import { a as CatalogDocument, c as CatalogResource, d as CatalogSupportAccess, f as CatalogUsage, i as CatalogDelegation, l as CatalogRole, n as CatalogApproval, o as CatalogGrant, p as CatalogValidity, r as CatalogBreakGlass, s as CatalogPermission, t as CatalogActivation, u as CatalogScope } from "../types-BBK-exvJ.js";
+//#region src/catalog/parse.d.ts
+/**
+ * Reads a `permissions.catalog.json` document (parsed, or the JSON text) and
+ * validates it against `schemas/catalog-v1.json`. Returns a deep-frozen copy
+ * built from own keys; throws `PermDockValidationError` with every issue.
+ */
+export declare function parseCatalog(json: unknown): CatalogDocument;
+/** Keys of the permissions the catalog marks `rowConditions: true`: the SQL helpers alone cannot enforce them. */
+export declare function rowConditionKeys(catalog: CatalogDocument): ReadonlySet<string>;
+//#endregion
+export type { CatalogActivation, CatalogApproval, CatalogBreakGlass, CatalogDelegation, CatalogDocument, CatalogGrant, CatalogPermission, CatalogResource, CatalogRole, CatalogScope, CatalogSupportAccess, CatalogUsage, CatalogValidity };

package/dist/catalog/index.js

@@ -0,0 +1,2 @@
+import { n as rowConditionKeys, t as parseCatalog } from "../parse-DPfIvFMU.js";
+export { parseCatalog, rowConditionKeys };

package/dist/catalog-B0E6bggc.js

@@ -0,0 +1,48 @@
+import { a as listArg, i as globalArgs, s as stringArg, t as COMMAND_DESCRIPTIONS } from "./commands-BMh_Etm2.js";
+import { defineCommand } from "citty";
+//#region src/cli/commands/catalog.ts
+function catalog(ctx) {
+	return defineCommand({
+		meta: {
+			name: "catalog",
+			description: COMMAND_DESCRIPTIONS.catalog
+		},
+		args: {
+			...globalArgs,
+			format: {
+				type: "enum",
+				options: [
+					"json",
+					"schema",
+					"markdown"
+				],
+				default: "json",
+				description: "Output format"
+			},
+			from: {
+				type: "string",
+				description: "Module exporting the permissions, instead of the config",
+				valueHint: "module"
+			},
+			include: {
+				type: "string",
+				description: "Permission keys or prefixes to keep, repeatable",
+				valueHint: "key"
+			}
+		},
+		async run({ args: parsed, rawArgs }) {
+			const result = await (await import("./catalog-idsHc0vo.js")).runCatalog({
+				cwd: ctx.cwd,
+				config: ctx.config,
+				format: parsed.format,
+				from: stringArg(parsed.from),
+				include: listArg(rawArgs, "include"),
+				now: ctx.now,
+				io: ctx.io
+			});
+			ctx.report(result);
+		}
+	});
+}
+//#endregion
+export { catalog };