permdock 0.0.0 → 0.1.0

package/dist/svelte/Protected.svelte

@@ -0,0 +1,34 @@
+<script lang="ts">
+  import { onDestroy } from 'svelte';
+
+  import { getStore, protectedView, type ProtectedProps } from './runtime.js';
+
+  let {
+    permission,
+    data,
+    tenant,
+    children,
+    pending,
+    fallback,
+  }: ProtectedProps = $props();
+
+  const store = getStore();
+  let tick = $state(0);
+  onDestroy(
+    store.subscribe(() => {
+      tick += 1;
+    }),
+  );
+  const view = $derived.by(() => {
+    const generation = tick;
+    return protectedView(store, permission, data, tenant, generation);
+  });
+</script>
+
+{#if view.slot === 'pending'}
+  {@render pending?.()}
+{:else if view.slot === 'fallback'}
+  {@render fallback?.(view.decision)}
+{:else}
+  {@render children?.(view.decision)}
+{/if}

package/dist/svelte/index.d.ts

@@ -0,0 +1,10 @@
+import { a as requiredPlans, i as describe } from "../describe-DernyItf.js";
+import { t as approvalHeaders } from "../headers-C8SHQccD.js";
+import { a as FilterResult, c as PermissionState, d as TenantView, f as UseRolesOptions, i as ClientStatus, n as ApprovalState, r as ClientPermDock, s as PermissionSet, t as ApprovalHandle, u as SubjectView } from "../types-DbWdEfcm.js";
+import { a as getPermDock, c as permissions, d as subject, f as tenant, i as filtered, l as roles, n as assignable, o as memberships, p as PermDockSvelteOptions, r as assignablePermissions, s as permission, t as approval, u as setPermDock } from "../stores-CvOnu_2T.js";
+import { t as ProtectedProps } from "../protected-wY7nXhY9.js";
+import { Component } from "svelte";
+//#region src/svelte/index.d.ts
+export declare const Protected: Component<ProtectedProps>;
+//#endregion
+export { type ApprovalHandle, type ApprovalState, type ClientPermDock, type ClientStatus, type FilterResult, type PermDockSvelteOptions, type PermissionSet, type PermissionState, type ProtectedProps, type SubjectView, type TenantView, type UseRolesOptions, approval, approvalHeaders, assignable, assignablePermissions, describe, filtered, getPermDock, memberships, permission, permissions, requiredPlans, roles, setPermDock, subject, tenant };

package/dist/svelte/index.js

@@ -0,0 +1,53 @@
+import { n as requiredPlans, t as describe } from "../describe-Bt1YD5uS.js";
+import { t as approvalHeaders } from "../headers-B5RRv3Xm.js";
+import { t as getStore } from "../context-CKEAabd7.js";
+import { t as protectedView } from "../runtime-DP9ttFh1.js";
+import { a as getPermDock, c as permissions, d as subject, f as tenant, i as filtered, l as roles, n as assignable, o as memberships, r as assignablePermissions, s as permission, t as approval, u as setPermDock } from "../stores-CkG2HrSg.js";
+import "svelte/internal/disclose-version";
+import * as $ from "svelte/internal/client";
+import { onDestroy } from "svelte";
+//#region src/svelte/Protected.svelte
+function Protected$1($$anchor, $$props) {
+	$.push($$props, true);
+	const store = getStore();
+	let tick = $.state(0);
+	onDestroy(store.subscribe(() => {
+		$.set(tick, $.get(tick) + 1);
+	}));
+	const view = $.derived(() => {
+		const generation = $.get(tick);
+		return protectedView(store, $$props.permission, $$props.data, $$props.tenant, generation);
+	});
+	var fragment = $.comment();
+	var node = $.first_child(fragment);
+	var consequent = ($$anchor) => {
+		var fragment_1 = $.comment();
+		var node_1 = $.first_child(fragment_1);
+		$.snippet(node_1, () => $$props.pending ?? $.noop);
+		$.append($$anchor, fragment_1);
+	};
+	var consequent_1 = ($$anchor) => {
+		var fragment_2 = $.comment();
+		var node_2 = $.first_child(fragment_2);
+		$.snippet(node_2, () => $$props.fallback ?? $.noop, () => $.get(view).decision);
+		$.append($$anchor, fragment_2);
+	};
+	var alternate = ($$anchor) => {
+		var fragment_3 = $.comment();
+		var node_3 = $.first_child(fragment_3);
+		$.snippet(node_3, () => $$props.children ?? $.noop, () => $.get(view).decision);
+		$.append($$anchor, fragment_3);
+	};
+	$.if(node, ($$render) => {
+		if ($.get(view).slot === "pending") $$render(consequent);
+		else if ($.get(view).slot === "fallback") $$render(consequent_1, 1);
+		else $$render(alternate, -1);
+	});
+	$.append($$anchor, fragment);
+	$.pop();
+}
+//#endregion
+//#region src/svelte/index.ts
+const Protected = Protected$1;
+//#endregion
+export { Protected, approval, approvalHeaders, assignable, assignablePermissions, describe, filtered, getPermDock, memberships, permission, permissions, requiredPlans, roles, setPermDock, subject, tenant };

package/dist/svelte/runtime.d.ts

@@ -0,0 +1,6 @@
+import { t as ClientStore } from "../store-Bq90395i.js";
+import { n as protectedView, t as ProtectedProps } from "../protected-wY7nXhY9.js";
+//#region src/svelte/context.d.ts
+export declare function getStore(): ClientStore;
+//#endregion
+export { type ProtectedProps, protectedView };

package/dist/svelte/runtime.js

@@ -0,0 +1,3 @@
+import { t as getStore } from "../context-CKEAabd7.js";
+import { t as protectedView } from "../runtime-DP9ttFh1.js";
+export { getStore, protectedView };

package/dist/svelte/source.d.ts

@@ -0,0 +1,10 @@
+import { i as describe } from "../describe-DernyItf.js";
+import { t as approvalHeaders } from "../headers-C8SHQccD.js";
+import { a as FilterResult, c as PermissionState, d as TenantView, f as UseRolesOptions, i as ClientStatus, n as ApprovalState, r as ClientPermDock, s as PermissionSet, t as ApprovalHandle, u as SubjectView } from "../types-DbWdEfcm.js";
+import { a as getPermDock, c as permissions, d as subject, f as tenant, i as filtered, l as roles, n as assignable, o as memberships, p as PermDockSvelteOptions, r as assignablePermissions, s as permission, t as approval, u as setPermDock } from "../stores-CvOnu_2T.js";
+import { t as ProtectedProps } from "../protected-wY7nXhY9.js";
+import { Component } from "svelte";
+//#region src/svelte/source.d.ts
+export declare const Protected: Component<ProtectedProps>;
+//#endregion
+export { type ApprovalHandle, type ApprovalState, type ClientPermDock, type ClientStatus, type FilterResult, type PermDockSvelteOptions, type PermissionSet, type PermissionState, type ProtectedProps, type SubjectView, type TenantView, type UseRolesOptions, approval, approvalHeaders, assignable, assignablePermissions, describe, filtered, getPermDock, memberships, permission, permissions, roles, setPermDock, subject, tenant };

package/dist/svelte/source.js

@@ -0,0 +1,8 @@
+import { t as describe } from "../describe-Bt1YD5uS.js";
+import { t as approvalHeaders } from "../headers-B5RRv3Xm.js";
+import { a as getPermDock, c as permissions, d as subject, f as tenant, i as filtered, l as roles, n as assignable, o as memberships, r as assignablePermissions, s as permission, t as approval, u as setPermDock } from "../stores-CkG2HrSg.js";
+import ProtectedComponent from "./Protected.svelte";
+//#region src/svelte/source.ts
+const Protected = ProtectedComponent;
+//#endregion
+export { Protected, approval, approvalHeaders, assignable, assignablePermissions, describe, filtered, getPermDock, memberships, permission, permissions, roles, setPermDock, subject, tenant };

package/dist/terminal/index.d.ts

@@ -0,0 +1,171 @@
+import { $ as DecisionSink, C as Policy, E as PolicyVocabulary, Mn as Decision, Zt as PermDock, at as LimitStore, ct as MembershipSource, ft as RelationSource, hr as Subject, mr as Principal, pt as RoleSource, sn as PolicySource, tt as EntitlementSource } from "../policy-CInmNGkM.js";
+import { d as Permission } from "../permissions-B4apnahQ.js";
+import { f as ApprovalStore } from "../types-B8w5PFtS.js";
+import { o as ProblemDetails, t as ApprovalHint } from "../errors-DbZ1YOnb.js";
+//#region src/terminal/types.d.ts
+type TokenSourceName = "device" | "keychain" | "env" | "ci-oidc";
+type TokenSource = TokenSourceName | {
+  readonly env: string;
+} | {
+  readonly source: TokenSourceName;
+  readonly env?: string;
+  /** `ci-oidc`: the audience requested from GitHub Actions (`aud`). */
+  readonly audience?: string;
+};
+type TokenHelper = (sources: readonly TokenSource[]) => Promise<string | null>;
+type TokenContext = {
+  readonly token: TokenHelper;
+  readonly profile: string;
+};
+type DeviceFlowOptions = {
+  readonly issuer?: string;
+  readonly clientId: string;
+  readonly scope?: string;
+  readonly authorizationEndpoint?: string;
+  readonly tokenEndpoint?: string;
+  readonly revocationEndpoint?: string;
+  readonly open?: (url: string) => void;
+  readonly onPrompt?: (info: {
+    readonly user_code: string;
+    readonly verification_uri: string;
+    readonly verification_uri_complete?: string;
+  }) => void;
+};
+type InteractiveConfirm = (input: {
+  readonly permission: string;
+  readonly resource: {
+    readonly type: string;
+    readonly id?: string;
+  };
+  readonly reason: string;
+  readonly token: string;
+}) => Promise<boolean>;
+/** Asks the user to type `expected` before a destructive action; resolves with what they typed. */
+type TypedConfirm = (input: {
+  readonly permission: string;
+  readonly resource: {
+    readonly type: string;
+    readonly id?: string;
+  };
+  readonly expected: string;
+}) => Promise<string>;
+type TerminalRuntime = {
+  readonly argv?: readonly string[];
+  readonly env?: Readonly<Record<string, string | undefined>>;
+  readonly stdoutIsTTY?: boolean;
+  readonly platform?: string;
+  readonly now?: () => number;
+  readonly write?: (text: string) => void;
+  readonly exit?: (code: number) => never;
+  readonly fetch?: typeof fetch;
+  readonly sleep?: (ms: number) => Promise<void>;
+  readonly homedir?: () => string;
+  readonly configDir?: string;
+};
+/** The shape of `Entry` from `@napi-rs/keyring`. */
+type KeyringEntry = {
+  getPassword(): string | null | undefined;
+  setPassword(password: string): void;
+  deletePassword(): unknown;
+};
+type TerminalStorageOptions = {
+  readonly service: string;
+  readonly dir?: string;
+  /**
+   * `Entry` from `@napi-rs/keyring`: tokens go to the OS keychain under
+   * `service`, one entry per profile. Without it, or when the keychain
+   * throws, they go to the mode-0600 credentials file.
+   */
+  readonly keyring?: new (service: string, account: string) => KeyringEntry;
+};
+type TerminalPermDockOptions<TUser = unknown> = {
+  readonly subject: (context: TokenContext) => TUser | Promise<TUser>;
+  readonly actor?: (context: TokenContext) => unknown;
+  readonly tenant?: string;
+  readonly memberships?: MembershipSource | readonly MembershipSource[];
+  /** The object graph for relation grants that walk a parent chain; without it they deny. */
+  readonly relations?: RelationSource;
+  readonly entitlements?: EntitlementSource;
+  readonly customRoles?: RoleSource;
+  /** Hosted grants, read once per instance; see `PolicySource`. */
+  readonly policies?: PolicySource;
+  readonly store?: ApprovalStore;
+  readonly sink?: DecisionSink;
+  readonly limits?: LimitStore;
+  readonly storage?: TerminalStorageOptions;
+  readonly device?: DeviceFlowOptions;
+  readonly interactive?: boolean | {
+    readonly confirm?: InteractiveConfirm;
+    readonly typed?: TypedConfirm;
+  };
+  /** Runs a destructive action without the typed confirmation; defaults to `--yes` / `-y` in argv. */
+  readonly yes?: boolean;
+  /** Decides and prints the decision without running the action; defaults to `--dry-run` in argv. */
+  readonly dryRun?: boolean;
+  readonly output?: {
+    readonly json?: boolean;
+  };
+  readonly approval?: ApprovalHint;
+  readonly runtime?: TerminalRuntime;
+};
+type PermDockResolveOptions = {
+  readonly refresh?: boolean;
+  readonly source?: TokenSourceName;
+  readonly as?: string;
+};
+type CommandEntry = {
+  readonly name: string;
+  readonly permission: Permission;
+  readonly description: string;
+};
+type FilterCommandsOptions = {
+  readonly mode: "hide" | "annotate";
+  readonly permdock?: PermDock;
+};
+type FormatOptions = {
+  readonly json?: boolean;
+  readonly permission?: Permission;
+  readonly instance?: string;
+  readonly subject?: Subject;
+  readonly approval?: ApprovalHint;
+};
+type TerminalProblemDetails = ProblemDetails;
+type ProtectContext<T = unknown, V extends PolicyVocabulary = PolicyVocabulary> = {
+  readonly permdock: PermDock<V>;
+  readonly data: T;
+  readonly decision: Extract<Decision, {
+    readonly outcome: "granted";
+  }>;
+};
+type TerminalPermDock<V extends PolicyVocabulary = PolicyVocabulary> = {
+  readonly permdock: (options?: PermDockResolveOptions) => Promise<PermDock<V>>;
+  readonly protect: <TArgs extends readonly unknown[], TData = unknown>(permission: Permission, load?: (...args: TArgs) => TData | Promise<TData>) => (action: (context: ProtectContext<TData, V>, ...args: TArgs) => unknown) => (...args: TArgs) => Promise<unknown>;
+  readonly filterCommands: (entries: readonly CommandEntry[], options?: FilterCommandsOptions) => readonly CommandEntry[];
+  readonly format: (decision: Decision, options?: FormatOptions) => string;
+  readonly exitCode: (decision: Decision) => number;
+  readonly logout: () => Promise<void>;
+};
+//#endregion
+//#region src/terminal/create.d.ts
+export declare function createPermDock<TUser, TPrincipal extends Principal = Principal, V extends PolicyVocabulary = PolicyVocabulary>(policy: Policy<TUser, TPrincipal, V>, options: TerminalPermDockOptions<TUser>): TerminalPermDock<V>;
+//#endregion
+//#region src/terminal/exit.d.ts
+export declare const EX_OK = 0;
+export declare const EX_USAGE = 64;
+export declare const EX_TEMPFAIL = 75;
+export declare const EX_NOPERM = 77;
+export declare const EX_CONFIG = 78;
+export declare class TerminalExit extends Error {
+  override readonly name: "TerminalExit";
+  readonly code: number;
+  constructor(code: number);
+}
+//#endregion
+//#region src/terminal/format.d.ts
+export declare function exitCode(decision: Decision): number;
+export declare function formatDecision(decision: Decision, options?: FormatOptions): string;
+//#endregion
+//#region src/terminal/token.d.ts
+export declare function looksLikeJwt(value: string): boolean;
+//#endregion
+export type { ApprovalHint, CommandEntry, DeviceFlowOptions, FilterCommandsOptions, FormatOptions, InteractiveConfirm, KeyringEntry, PermDockResolveOptions, ProtectContext, TerminalPermDock, TerminalPermDockOptions, TerminalProblemDetails, TerminalRuntime, TerminalStorageOptions, TokenContext, TokenHelper, TokenSource, TokenSourceName, TypedConfirm };