permdock 0.0.0 → 0.1.0

package/dist/sink-Cfr9-7YC.d.ts

@@ -0,0 +1,104 @@
+import { $ as DecisionSink, Ft as Credential, Tt as TokenSigner, Y as CredentialEvent, ht as SinkEvent, q as AccessEvent, st as MembershipEvent } from "./policy-CInmNGkM.js";
+//#region src/core/sink.d.ts
+/** The closed list of CloudEvents `type` values PermDock emits. */
+declare const CLOUD_EVENT_TYPES: {
+  readonly decision: "dev.permdock.decision";
+  readonly approval: "dev.permdock.approval";
+  readonly directory: "dev.permdock.directory";
+  readonly membership: "dev.permdock.membership";
+  readonly catalog: "dev.permdock.catalog";
+  readonly credential: "dev.permdock.credential";
+  readonly accessStarted: "dev.permdock.access.started";
+  readonly accessEnded: "dev.permdock.access.ended";
+  readonly accessRevoked: "dev.permdock.access.revoked";
+};
+type CloudEventType = (typeof CLOUD_EVENT_TYPES)[keyof typeof CLOUD_EVENT_TYPES];
+/** Why a published catalog broke a live hosted grant, which the Cloud then suspends. */
+type CatalogFindingCode = "permission-removed" | "not-hostable" | "grantee-removed" | "approval-tightened";
+/** One drift finding: the permission key and, when one broke, the hosted grant id. */
+type CatalogFinding = {
+  readonly code: CatalogFindingCode;
+  readonly permission: string;
+  readonly grant?: string;
+};
+/** `data` of a `dev.permdock.catalog` event: a `permdock cloud push` or a drift against live hosted grants. */
+type CatalogEventData = {
+  readonly kind: "publish" | "drift";
+  /** The catalog fingerprint after the publish, or the one drift was measured against. */
+  readonly fingerprint: string;
+  readonly previous?: string;
+  readonly findings?: readonly CatalogFinding[];
+};
+type CloudEvent = {
+  readonly specversion: "1.0";
+  readonly type: CloudEventType;
+  readonly source: string;
+  readonly subject?: string;
+  readonly id: string;
+  readonly time: string;
+  readonly datacontenttype: "application/json";
+  readonly data: SinkEvent | CatalogEventData;
+};
+type SignDecisionBatchOptions = {
+  readonly audience?: string | readonly string[];
+  readonly source?: string;
+};
+type MemorySinkOptions = {
+  readonly capacity?: number;
+  readonly signer?: TokenSigner;
+  readonly audience?: string | readonly string[];
+  readonly source?: string;
+};
+type MemorySink = DecisionSink & {
+  readonly events: () => readonly SinkEvent[];
+  readonly batches: () => readonly string[];
+};
+/**
+ * A `credential` sink event for `credential`. `sample` belongs on `used`
+ * events only and must be in `(0, 1]`.
+ */
+declare function credentialEvent(input: {
+  readonly operation: CredentialEvent["operation"];
+  readonly credential: Credential;
+  readonly source?: string;
+  readonly by?: CredentialEvent["by"];
+  readonly sample?: number;
+  readonly at?: string;
+}): CredentialEvent;
+declare function membershipEvent(input: {
+  readonly source: string;
+  readonly operation: MembershipEvent["operation"];
+  readonly principal: MembershipEvent["principal"];
+  readonly scope?: string;
+  readonly id?: string;
+  readonly within?: MembershipEvent["within"];
+  readonly via?: string;
+  readonly expiresAt?: number;
+  readonly roles: MembershipEvent["roles"];
+  readonly by?: MembershipEvent["by"];
+  readonly at?: string;
+}): MembershipEvent;
+/**
+ * A support-access lifecycle event. `started` on consent, `ended` when the
+ * session lapses, `revoked` when the tenant pulls consent early. It never
+ * decides; the app writes and revokes the membership.
+ */
+declare function accessEvent(input: {
+  readonly source: string;
+  readonly operation: AccessEvent["operation"];
+  readonly tenant: string;
+  readonly principal: AccessEvent["principal"];
+  readonly via?: string;
+  readonly roles: readonly string[];
+  readonly member?: AccessEvent["member"];
+  readonly expiresAt?: number;
+  readonly grantedBy?: string;
+  readonly reason?: string;
+  readonly actor?: AccessEvent["actor"];
+  readonly at?: string;
+}): AccessEvent;
+declare function toCloudEvent(event: SinkEvent, source?: string): CloudEvent;
+declare function signDecisionBatch(events: readonly SinkEvent[], signer: TokenSigner, options?: SignDecisionBatchOptions): Promise<string>;
+declare function memorySink(options?: MemorySinkOptions): MemorySink;
+//#endregion
+export { CloudEvent as a, MemorySinkOptions as c, credentialEvent as d, membershipEvent as f, toCloudEvent as h, CatalogFindingCode as i, SignDecisionBatchOptions as l, signDecisionBatch as m, CatalogEventData as n, CloudEventType as o, memorySink as p, CatalogFinding as r, MemorySink as s, CLOUD_EVENT_TYPES as t, accessEvent as u };

package/dist/skills-C_lpV4Jx.js

@@ -0,0 +1,50 @@
+import { a as listArg, i as globalArgs, t as COMMAND_DESCRIPTIONS } from "./commands-BMh_Etm2.js";
+import { r as pick, t as CANCELLED } from "./prompt-CXYhLfsS.js";
+import { n as detectedAgents, r as runSkills, t as SKILL_AGENTS } from "./skills-Dx3QLnMY.js";
+import { defineCommand } from "citty";
+//#region src/cli/commands/skills.ts
+function skills(ctx) {
+	return defineCommand({
+		meta: {
+			name: "skills",
+			description: COMMAND_DESCRIPTIONS.skills
+		},
+		args: {
+			...globalArgs,
+			action: {
+				type: "positional",
+				required: false,
+				description: "install (default), update or list"
+			},
+			agent: {
+				type: "string",
+				description: "Agent skill folders to write, repeatable",
+				valueHint: "name"
+			}
+		},
+		async run({ args: parsed, rawArgs }) {
+			const action = parsed._[0];
+			let agents = listArg(rawArgs, "agent");
+			const installs = action === void 0 || action === "install" || action === "update";
+			if (ctx.interactive && installs && agents.length === 0) {
+				const detected = detectedAgents(ctx.cwd);
+				const picked = await pick("Which agents should get the PermDock skills?", Object.entries(SKILL_AGENTS).map(([value, hint]) => ({
+					value,
+					hint
+				})), detected.length > 0 ? detected : Object.keys(SKILL_AGENTS));
+				if (picked === void 0) {
+					ctx.report(CANCELLED);
+					return;
+				}
+				agents = picked;
+			}
+			ctx.report(runSkills({
+				cwd: ctx.cwd,
+				action,
+				agents
+			}));
+		}
+	});
+}
+//#endregion
+export { skills };

package/dist/skills-Dx3QLnMY.js

@@ -0,0 +1,110 @@
+import { t as packageRoot } from "./package-root-zGkxO3oN.js";
+import { cpSync, existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
+import { dirname, join, resolve } from "node:path";
+import { createRequire } from "node:module";
+//#region src/cli/skills.ts
+const SKILL_NAMES = [
+	"permdock",
+	"permdock-wire",
+	"permdock-audit",
+	"permdock-agents",
+	"permdock-approvals",
+	"permdock-tenancy",
+	"permdock-data",
+	"permdock-credentials"
+];
+const AGENT_FOLDERS = {
+	agents: ".agents/skills",
+	claude: ".claude/skills",
+	cursor: ".cursor/skills"
+};
+/** The `--agent` names `skills install` knows, with the folder each writes. */
+const SKILL_AGENTS = AGENT_FOLDERS;
+/** Agents whose config folder (`.claude`, `.cursor`, `.agents`) the project already has. */
+function detectedAgents(cwd) {
+	return Object.entries(AGENT_FOLDERS).filter(([, folder]) => existsSync(join(cwd, dirname(folder)))).map(([agent]) => agent);
+}
+function runSkills(input) {
+	switch (input.action) {
+		case void 0:
+		case "install":
+		case "update": return runSkillsInstall({
+			cwd: input.cwd,
+			agents: input.agents
+		});
+		case "list": return listSkills(input.cwd);
+		default: return {
+			code: 2,
+			output: `unknown skills command '${input.action}'. Use install, list or update.`
+		};
+	}
+}
+function runSkillsInstall(input) {
+	const source = resolveSkillsRoot(input.cwd, input.bundled ?? join(packageRoot(), "skills"));
+	if (source === void 0) return {
+		code: 2,
+		output: "PermDock CLI: permdock package with skills/ not found. Add permdock as a dependency."
+	};
+	const version = readPermdockVersion(source);
+	const targets = resolveTargets(input.agents);
+	const copied = [];
+	for (const folder of targets) {
+		const destRoot = join(input.cwd, folder);
+		for (const name of SKILL_NAMES) {
+			const from = join(source, name);
+			if (!existsSync(from)) continue;
+			copyDir(from, join(destRoot, name));
+			copied.push(`${folder}/${name}`);
+		}
+	}
+	mkdirSync(join(input.cwd, ".permdock"), { recursive: true });
+	writeFileSync(join(input.cwd, ".permdock/skills-lock.json"), `${JSON.stringify({
+		version,
+		skills: [...SKILL_NAMES]
+	}, null, 2)}\n`);
+	return {
+		code: 0,
+		output: `installed ${copied.join(", ") || "no skills"} (permdock@${version})`
+	};
+}
+function listSkills(cwd) {
+	const lockPath = join(cwd, ".permdock/skills-lock.json");
+	const lock = existsSync(lockPath) ? JSON.parse(readFileSync(lockPath, "utf8")) : {};
+	const lines = ["permdock skills", ""];
+	for (const name of SKILL_NAMES) {
+		const places = Object.values(AGENT_FOLDERS).filter((folder) => existsSync(join(cwd, folder, name, "SKILL.md")));
+		lines.push(`  ${name}  ${places.length > 0 ? places.join(", ") : "not installed"}`);
+	}
+	if (lock.version !== void 0) lines.push("", `  lock ${lock.version}`);
+	return {
+		code: 0,
+		output: `${lines.join("\n")}\n`
+	};
+}
+function resolveTargets(agents) {
+	if (agents.length === 0) return Object.values(AGENT_FOLDERS);
+	return agents.map((agent) => {
+		const key = agent === "agent" ? "agents" : agent;
+		return AGENT_FOLDERS[key] ?? `.${key}/skills`;
+	});
+}
+function resolveSkillsRoot(cwd, bundled) {
+	try {
+		const pkg = createRequire(resolve(cwd, "package.json")).resolve("permdock/package.json");
+		const root = join(dirname(pkg), "skills");
+		if (existsSync(root)) return root;
+	} catch {}
+	const local = join(cwd, "node_modules/permdock/skills");
+	if (existsSync(local)) return local;
+	return existsSync(bundled) ? bundled : void 0;
+}
+function readPermdockVersion(skillsRoot) {
+	const pkg = join(dirname(skillsRoot), "package.json");
+	if (!existsSync(pkg)) return "0.0.0";
+	return JSON.parse(readFileSync(pkg, "utf8")).version;
+}
+function copyDir(from, to) {
+	cpSync(from, to, { recursive: true });
+}
+//#endregion
+export { runSkillsInstall as i, detectedAgents as n, runSkills as r, SKILL_AGENTS as t };