permdock 0.0.0 → 0.1.0

package/dist/version-CnSh33Fj.js

@@ -0,0 +1,16 @@
+import { t as packageRoot } from "./package-root-zGkxO3oN.js";
+import { readFileSync } from "node:fs";
+import { join } from "node:path";
+//#region src/cli/version.ts
+function cliVersion() {
+	return JSON.parse(readFileSync(join(packageRoot(), "package.json"), "utf8")).version;
+}
+function generatorBanner() {
+	return `permdock@${cliVersion()}`;
+}
+const CATALOG_SCHEMA = "https://permdock.dev/schemas/catalog-v1.json";
+const SUPABASE_MANIFEST_SCHEMA = "https://permdock.dev/schemas/supabase-manifest-v1.json";
+const USAGE_REPORT_SCHEMA = "https://permdock.dev/schemas/usage-report-v1.json";
+const DOCTOR_REPORT_SCHEMA = "https://permdock.dev/schemas/doctor-report-v1.json";
+//#endregion
+export { cliVersion as a, USAGE_REPORT_SCHEMA as i, DOCTOR_REPORT_SCHEMA as n, generatorBanner as o, SUPABASE_MANIFEST_SCHEMA as r, CATALOG_SCHEMA as t };

package/dist/vocabulary-Dk0fs-Jk.d.ts

@@ -0,0 +1,56 @@
+import { n as ActionMeta } from "./permissions-B4apnahQ.js";
+//#region src/core/vocabulary.d.ts
+declare const ROLE_KIND: "role";
+declare const PLAN_KIND: "plan";
+/**
+ * A role's metadata. `audience` names the surface its holders use (`'staff'`,
+ * `'portal'`, `'platform'`); `permdock.audiences()` lists the distinct
+ * audiences of the roles held in the active scope.
+ */
+type RoleMeta = ActionMeta & {
+  readonly audience?: string;
+};
+type Role<K extends string = string> = {
+  readonly key: K;
+  /** A declared scope name, or the `tenant` / `team` alias. */
+  readonly on?: string;
+  readonly assignable: boolean;
+  readonly meta: RoleMeta;
+  readonly kind: typeof ROLE_KIND;
+};
+type Plan<K extends string = string> = {
+  readonly key: K;
+  readonly meta: ActionMeta;
+  readonly kind: typeof PLAN_KIND;
+};
+type RoleInit = {
+  /** A declared scope name, or the `tenant` / `team` alias. */
+  readonly on?: string;
+  readonly assignable?: boolean;
+  readonly meta?: RoleMeta;
+};
+type PlanInit = {
+  readonly meta?: ActionMeta;
+};
+type RoleTree = {
+  readonly [key: string]: Role;
+};
+type PlanTree = {
+  readonly [key: string]: Plan;
+};
+type Vocabulary = {
+  readonly permissions?: unknown;
+  readonly roles?: RoleTree;
+  readonly plans?: PlanTree;
+};
+type InferRoleTree<Input> = { readonly [K in keyof Input & string]: Role<K>; };
+type InferPlanTree<Input> = { readonly [K in keyof Input & string]: Plan<K>; };
+declare function isRole(value: unknown): value is Role;
+declare function isPlan(value: unknown): value is Plan;
+declare function defineRoles<const Input extends Record<string, RoleInit>>(input: Input): InferRoleTree<Input>;
+declare function definePlans<const Input extends Record<string, PlanInit>>(input: Input): InferPlanTree<Input>;
+declare function listRoles(tree: RoleTree | undefined): readonly Role[];
+declare function listPlans(tree: PlanTree | undefined): readonly Plan[];
+declare function findRole(tree: RoleTree | undefined, key: string): Role | undefined;
+//#endregion
+export { RoleTree as a, defineRoles as c, isRole as d, listPlans as f, RoleMeta as i, findRole as l, PlanTree as n, Vocabulary as o, listRoles as p, Role as r, definePlans as s, Plan as t, isPlan as u };

package/dist/vue/index.d.ts

@@ -0,0 +1,57 @@
+import { Et as TokenVerifier, Mn as Decision, gt as Snapshot, pr as Membership } from "../policy-CInmNGkM.js";
+import { d as Permission } from "../permissions-B4apnahQ.js";
+import { r as Role } from "../vocabulary-Dk0fs-Jk.js";
+import { a as requiredPlans, i as describe } from "../describe-DernyItf.js";
+import { t as approvalHeaders } from "../headers-C8SHQccD.js";
+import { a as FilterResult, c as PermissionState, d as TenantView, f as UseRolesOptions, i as ClientStatus, n as ApprovalState, r as ClientPermDock, s as PermissionSet, t as ApprovalHandle, u as SubjectView } from "../types-DbWdEfcm.js";
+import { ComputedRef, DefineComponent, MaybeRefOrGetter, Plugin } from "vue";
+//#region src/vue/types.d.ts
+type PermDockPluginOptions = {
+  /**
+   * A ref or getter re-hydrates the store when it changes; a promise keeps
+   * the store `pending` until it settles (await the same promise in an async
+   * `setup` under `<Suspense>`).
+   */
+  readonly snapshot: MaybeRefOrGetter<Snapshot | string> | PromiseLike<Snapshot | string>;
+  readonly endpoint?: string;
+  readonly approvals?: string;
+  readonly tenant?: string;
+  readonly fetch?: typeof fetch;
+  readonly headers?: Readonly<Record<string, string>>;
+  readonly maxAge?: number;
+  readonly verifier?: TokenVerifier;
+};
+//#endregion
+//#region src/vue/composables.d.ts
+export declare function usePermDock(): ClientPermDock;
+export declare function usePermission(permission: MaybeRefOrGetter<Permission>, data?: MaybeRefOrGetter<unknown>): {
+  readonly allowed: ComputedRef<boolean>;
+  readonly status: ComputedRef<PermissionState["status"]>;
+  readonly decision: ComputedRef<Decision>;
+};
+export declare function usePermissions(permissions: MaybeRefOrGetter<readonly Permission[]>, data?: MaybeRefOrGetter<unknown>): ComputedRef<PermissionSet>;
+export declare function useFilter<T>(permission: Permission<string, T, "instance">, rows: MaybeRefOrGetter<readonly T[]>): ComputedRef<FilterResult<T>>;
+export declare function useTenant(): ComputedRef<TenantView>;
+export declare function useMemberships(): ComputedRef<readonly Membership[]>;
+export declare function useRoles(options?: MaybeRefOrGetter<UseRolesOptions>): ComputedRef<{
+  readonly roles: readonly Role[];
+}>;
+export declare function useAssignableRoles(): ComputedRef<readonly Role[]>;
+export declare function useAssignablePermissions(options?: {
+  readonly tenant?: string;
+}): ComputedRef<readonly Permission[]>;
+export declare function useSubject(): ComputedRef<SubjectView>;
+export declare function useApproval(decision: MaybeRefOrGetter<Decision>): ComputedRef<ApprovalHandle>;
+//#endregion
+//#region src/vue/plugin.d.ts
+export declare const permdockPlugin: Plugin<PermDockPluginOptions>;
+//#endregion
+//#region src/vue/protected.d.ts
+type ProtectedProps = {
+  readonly permission: Permission;
+  readonly data?: unknown;
+  readonly tenant?: string;
+};
+export declare const Protected: DefineComponent<ProtectedProps>;
+//#endregion
+export { type ApprovalHandle, type ApprovalState, type ClientPermDock, type ClientStatus, type FilterResult, type PermDockPluginOptions, type PermissionSet, type PermissionState, type SubjectView, type TenantView, type UseRolesOptions, approvalHeaders, describe, requiredPlans };

package/dist/vue/index.js

@@ -0,0 +1,203 @@
+import { t as compact } from "../compact-y6vfu2_f.js";
+import { n as requiredPlans, t as describe } from "../describe-Bt1YD5uS.js";
+import { t as emptySnapshot } from "../from-snapshot-BMGnhmgv.js";
+import { t as approvalHeaders } from "../headers-B5RRv3Xm.js";
+import { t as createClientStore } from "../store-C6hFW6ta.js";
+import { t as isPromiseLike } from "../source-DoBBYJi2.js";
+import { computed, defineComponent, effectScope, inject, isRef, onScopeDispose, shallowRef, toValue, watch } from "vue";
+//#region src/vue/context.ts
+const permDockKey = Symbol("permdock");
+//#endregion
+//#region src/vue/composables.ts
+function useStore() {
+	const store = inject(permDockKey);
+	if (store === void 0) throw new Error("PermDock: composables require permdockPlugin.");
+	return store;
+}
+function useTick(store) {
+	const tick = shallowRef(0);
+	onScopeDispose(store.subscribe(() => {
+		tick.value += 1;
+	}));
+	return computed(() => {
+		tick.value;
+		return store.get();
+	});
+}
+function usePermDock() {
+	const permdock = useTick(useStore());
+	return new Proxy({}, { get(_target, prop, _receiver) {
+		return Reflect.get(permdock.value, prop);
+	} });
+}
+function usePermission(permission, data) {
+	const store = useStore();
+	const permdock = useTick(store);
+	const state = computed(() => {
+		permdock.value;
+		return store.permissionState(toValue(permission), toValue(data));
+	});
+	return {
+		allowed: computed(() => state.value.allowed),
+		status: computed(() => state.value.status),
+		decision: computed(() => state.value.decision)
+	};
+}
+function usePermissions(permissions, data) {
+	const store = useStore();
+	const permdock = useTick(store);
+	return computed(() => {
+		permdock.value;
+		const granted = [];
+		const byKey = {};
+		for (const permission of toValue(permissions)) {
+			const next = store.permissionState(permission, toValue(data));
+			byKey[permission.key] = next;
+			if (next.allowed) granted.push(permission);
+		}
+		return new Proxy({
+			granted,
+			get(permission) {
+				return byKey[permission.key];
+			}
+		}, { get(target, prop, receiver) {
+			if (typeof prop === "string" && Object.hasOwn(byKey, prop)) return byKey[prop];
+			return Reflect.get(target, prop, receiver);
+		} });
+	});
+}
+function useFilter(permission, rows) {
+	const permdock = useTick(useStore());
+	return computed(() => {
+		const result = [...permdock.value.filter(permission, toValue(rows))];
+		result.partial = permdock.value.where(permission).partial;
+		return result;
+	});
+}
+function useTenant() {
+	const permdock = useTick(useStore());
+	return computed(() => ({
+		tenant: permdock.value.subject.principal?.tenant ?? null,
+		tenants: permdock.value.tenants(),
+		switchTo: (id) => permdock.value.refresh({ tenant: id }),
+		status: permdock.value.status()
+	}));
+}
+function useMemberships() {
+	const permdock = useTick(useStore());
+	return computed(() => permdock.value.memberships());
+}
+function useRoles(options = {}) {
+	const permdock = useTick(useStore());
+	return computed(() => {
+		const next = toValue(options);
+		return { roles: (next.team === void 0 ? permdock.value : permdock.value.team(next.team)).heldRoles(next.tenant === void 0 ? void 0 : { tenant: next.tenant }) };
+	});
+}
+function useAssignableRoles() {
+	const permdock = useTick(useStore());
+	return computed(() => permdock.value.assignableRoles());
+}
+function useAssignablePermissions(options = {}) {
+	const permdock = useTick(useStore());
+	return computed(() => permdock.value.assignablePermissions(options));
+}
+function useSubject() {
+	const permdock = useTick(useStore());
+	return computed(() => {
+		const snapshot = permdock.value.snapshot();
+		const simulated = typeof snapshot === "object" && snapshot !== null && "simulated" in snapshot && snapshot.simulated === true;
+		return {
+			principal: permdock.value.subject.principal,
+			actor: permdock.value.subject.actor,
+			delegation: permdock.value.subject.delegation,
+			expiresAt: permdock.value.subject.expiresAt,
+			simulated
+		};
+	});
+}
+function useApproval(decision) {
+	const store = useStore();
+	const permdock = useTick(store);
+	return computed(() => {
+		permdock.value;
+		const next = toValue(decision);
+		return {
+			state: store.approvalState(next),
+			token: next.outcome === "approval-required" ? next.token : void 0,
+			request: (note) => store.requestApproval(next, note)
+		};
+	});
+}
+//#endregion
+//#region src/vue/plugin.ts
+const permdockPlugin = { install(app, options) {
+	const source = options.snapshot;
+	const promised = isPromiseLike(source);
+	const store = createClientStore(compact({
+		snapshot: promised ? emptySnapshot() : toValue(source),
+		endpoint: options.endpoint,
+		approvals: options.approvals,
+		tenant: options.tenant,
+		fetch: options.fetch,
+		headers: options.headers,
+		maxAge: options.maxAge,
+		verifier: options.verifier
+	}));
+	if (promised) store.follow(source);
+	else if (isRef(source) || typeof source === "function") {
+		const scope = effectScope(true);
+		scope.run(() => {
+			watch(() => toValue(source), (next) => {
+				store.replace(next);
+			});
+		});
+		app.onUnmount(() => {
+			scope.stop();
+		});
+	}
+	app.provide(permDockKey, store);
+} };
+//#endregion
+//#region src/vue/protected.ts
+const Protected = defineComponent({
+	name: "Protected",
+	props: {
+		permission: {
+			type: Object,
+			required: true
+		},
+		data: {
+			type: Object,
+			required: false
+		},
+		tenant: {
+			type: String,
+			required: false
+		}
+	},
+	setup(props, { slots }) {
+		const local = usePermission(() => props.permission, () => props.data);
+		const root = usePermDock();
+		return () => {
+			const scoped = props.tenant === void 0 ? {
+				allowed: local.allowed.value,
+				status: local.status.value,
+				decision: local.decision.value
+			} : tenantView(root.tenant(props.tenant), props.permission, props.data);
+			if (scoped.status === "pending") return slots["pending"]?.() ?? null;
+			if (!scoped.allowed || scoped.decision.outcome !== "granted") return slots["fallback"]?.({ decision: scoped.decision }) ?? null;
+			return slots["default"]?.({ decision: scoped.decision }) ?? null;
+		};
+	}
+});
+function tenantView(permdock, permission, data) {
+	const decision = permdock.decide(permission, data);
+	return {
+		allowed: decision.outcome === "granted",
+		status: "ready",
+		decision
+	};
+}
+//#endregion
+export { Protected, approvalHeaders, describe, permdockPlugin, requiredPlans, useApproval, useAssignablePermissions, useAssignableRoles, useFilter, useMemberships, usePermDock, usePermission, usePermissions, useRoles, useSubject, useTenant };

package/dist/webmcp/index.d.ts

@@ -0,0 +1,75 @@
+import { Mn as Decision, gt as Snapshot } from "../policy-CInmNGkM.js";
+import { d as Permission, p as PermissionTree } from "../permissions-B4apnahQ.js";
+import { StandardSchemaV1 } from "@standard-schema/spec";
+//#region src/webmcp/types.d.ts
+type WebMcpClientStatus = "ready" | "pending" | "stale" | "server-only";
+type WebMcpPermDock = {
+  can(permission: Permission, data?: unknown): boolean;
+  decide(permission: Permission, data?: unknown): Decision;
+  snapshot(): Snapshot | string | Promise<Snapshot | string>;
+  tenant?(id: string): WebMcpPermDock;
+  subscribe?(listener: () => void): () => void;
+  status?(permission?: Permission, data?: unknown): WebMcpClientStatus;
+};
+type WebMcpToolContent = {
+  readonly type: "text";
+  readonly text: string;
+};
+type WebMcpToolResult = {
+  readonly isError?: boolean;
+  readonly content: readonly WebMcpToolContent[];
+  readonly structuredContent?: Readonly<Record<string, unknown>>;
+};
+type WebMcpToolCall = {
+  /** Validated arguments with the tenant key bound. */
+  readonly input: unknown;
+  /** The decision token; send it as `PermDock-Approval` so the server resumes. */
+  readonly token: string | undefined;
+};
+type WebMcpToolHandler = (call: WebMcpToolCall) => Promise<unknown>;
+type WebMcpToolAnnotations = {
+  readonly readOnlyHint?: boolean;
+  readonly untrustedContentHint?: boolean;
+};
+type WebMcpRegisteredTool = {
+  readonly name: string;
+  readonly title?: string;
+  readonly description?: string;
+  readonly inputSchema?: Readonly<Record<string, unknown>>;
+  readonly annotations?: WebMcpToolAnnotations;
+  execute(input: unknown): Promise<WebMcpToolResult>;
+};
+type ModelContext = {
+  registerTool(tool: WebMcpRegisteredTool, options?: {
+    readonly signal?: AbortSignal;
+  }): {
+    readonly unregister?: () => void;
+  };
+};
+type WebMcpApprovalRequest = {
+  readonly permission: Permission;
+  readonly decision: Extract<Decision, {
+    readonly outcome: "approval-required";
+  }>;
+  readonly input: unknown;
+};
+type RegisterToolsOptions = {
+  readonly permdock: WebMcpPermDock;
+  readonly handlers?: Readonly<Record<string, WebMcpToolHandler>>;
+  readonly signal?: AbortSignal;
+  readonly tenant?: string;
+  readonly tenantKey?: string;
+  readonly schema?: StandardSchemaV1;
+  readonly untrustedContentHint?: boolean;
+  readonly onApprovalRequired?: (request: WebMcpApprovalRequest) => Promise<boolean | undefined>;
+  readonly warn?: (message: string) => void;
+};
+type RegisterToolsHandle = {
+  readonly unregister: () => void;
+};
+type PermissionGroup = PermissionTree | Permission;
+//#endregion
+//#region src/webmcp/register.d.ts
+export declare function registerTools(modelContext: ModelContext | null | undefined, group: PermissionGroup, options: RegisterToolsOptions): RegisterToolsHandle;
+//#endregion
+export type { ModelContext, PermissionGroup, RegisterToolsHandle, RegisterToolsOptions, WebMcpApprovalRequest, WebMcpClientStatus, WebMcpPermDock, WebMcpRegisteredTool, WebMcpToolAnnotations, WebMcpToolCall, WebMcpToolHandler, WebMcpToolResult };