permdock 0.0.0 → 0.2.0

package/dist/index-D6_cSa1z.d.ts

@@ -0,0 +1,201 @@
+import { Mr as Membership, Pr as Subject, Pt as TokenSigner, Yn as Decision, bt as RelationSource, ln as PermDock } from "./policy-CFZAr_Al.js";
+import { f as Permission, m as PermissionTree } from "./permissions-DttnqqxC.js";
+import { a as ApprovalListFilter, c as ApprovalRequest, f as ApprovalStore, i as ApprovalInspectResult, m as ApprovalVerdict, o as ApprovalListQuery, r as ApprovalCancelMeta, s as ApprovalPage } from "./types-vKyAMtcX.js";
+//#region src/approvals/errors.d.ts
+type ApprovalErrorCode = "approval-not-found" | "approval-not-pending" | "approval-expired" | "approver-unauthenticated" | "approver-is-actor" | "approver-is-principal" | "approver-not-eligible" | "approver-repeated";
+declare class ApprovalError extends Error {
+  override readonly name: "ApprovalError";
+  readonly code: ApprovalErrorCode;
+  constructor(code: ApprovalErrorCode, message: string);
+}
+/** Matches by `name` and `code`, so an error from another copy of the module still maps. */
+declare function isApprovalError(value: unknown): value is ApprovalError;
+//#endregion
+//#region src/approvals/handler.d.ts
+type ApprovalsHandlerOptions = {
+  readonly subject: (request: Request) => Subject | null | undefined | Promise<Subject | null | undefined>;
+  /** Refuse the principal even on grants that set `approval: { distinct: false }`. */
+  readonly requireDistinctApprover?: boolean;
+  readonly signer?: TokenSigner;
+  readonly audience?: string | readonly string[];
+  /** Where `relation()` approvers are read, by the request's resource id; without it they match nobody. */
+  readonly relations?: RelationSource;
+  /** The policy's permission tree, for `through` links and `includes` on relation approvers. */
+  readonly permissions?: PermissionTree;
+  /**
+   * The approver's own instance in the request's tenant, for
+   * `holder(permission)` approvers (custom roles included when the instance
+   * reads a `RoleSource`). Without it, or when it throws, they match nobody.
+   */
+  readonly permdockFor?: (approver: Subject, request: ApprovalRequest) => PermDock | Promise<PermDock>;
+};
+declare function approvalsHandler(store: ApprovalStore, options: ApprovalsHandlerOptions): (request: Request) => Promise<Response>;
+//#endregion
+//#region src/approvals/relations.d.ts
+type ApproverRelationsOptions = {
+  /** The object graph relation approvers are read from; without it they match nobody. */
+  readonly relations?: RelationSource;
+  /** The permission tree the policy declares; needed to follow `through` links and `includes`. */
+  readonly permissions?: PermissionTree;
+  readonly now?: Date;
+};
+/**
+ * The relation approvers of `request` that `subject` holds on its resource,
+ * keyed by `approverRelationKey`, for `ApprovalVerdict.relations`. Reads go
+ * through `relations` by the request's resource id; a request without an id,
+ * a missing source or a read that fails holds nothing.
+ */
+declare function approverRelations(request: ApprovalRequest, subject: Subject, options: ApproverRelationsOptions): Promise<readonly string[]>;
+//#endregion
+//#region src/approvals/helpers.d.ts
+declare function summariseSubject(subject: Subject): ApprovalRequest["subject"];
+declare function requestApproval(store: ApprovalStore, decision: Extract<Decision, {
+  readonly outcome: "approval-required";
+}>, meta: {
+  readonly permission: Permission | {
+    readonly key: string;
+    readonly scope: string;
+    readonly resource: string;
+  };
+  readonly resource?: {
+    readonly type: string;
+    readonly id?: string;
+  };
+  readonly subject: Subject;
+  readonly membership?: Membership;
+  readonly adapter?: string;
+  readonly ttl?: number;
+  readonly now?: Date;
+  readonly detail?: string;
+}): Promise<ApprovalRequest>;
+/**
+ * Checks `verdict.by` and resolves the request. Relation approvers are read
+ * through `options.relations` unless `verdict.relations` is already set.
+ */
+declare function resolveApproval(store: ApprovalStore, token: string, verdict: ApprovalVerdict, options?: ApproverRelationsOptions & {
+  readonly requireDistinctApprover?: boolean;
+  readonly permdockFor?: ApprovalsHandlerOptions["permdockFor"];
+}): Promise<ApprovalRequest>;
+declare function vouchApproval(store: ApprovalStore, token: string, verdict: {
+  readonly status: "approved" | "rejected";
+  readonly by: Subject;
+  readonly rule: string;
+  readonly note?: string;
+}): Promise<ApprovalRequest>;
+declare function inspectApproval(store: ApprovalStore, token: string, now?: Date): Promise<ApprovalInspectResult>;
+/** Inspects `token` and, when it is approved, consumes it so it resumes once. */
+declare function consumeApproval(store: ApprovalStore, token: string, now?: Date): Promise<ApprovalInspectResult>;
+/**
+ * Applies a resume token to a decision. The token only matters when the
+ * decision is `approval-required` and the token is the one this call was
+ * issued; otherwise a new approval is requested. A matching token is consumed
+ * unless `consume` is `false`, so an approval resumes exactly one call. Under
+ * `staleOn: 'resource-change'`, a token issued for an earlier version of the
+ * same row denies with `stale-approval`; the next call without it asks again.
+ */
+declare function resumeDecision(input: {
+  readonly decision: Decision;
+  readonly permission: Permission | {
+    readonly key: string;
+    readonly scope: string;
+    readonly resource: string;
+  };
+  readonly subject: Subject;
+  readonly store: ApprovalStore | undefined;
+  readonly resource: {
+    readonly type: string;
+    readonly id?: string;
+  };
+  readonly adapter: string;
+  readonly token: string | undefined;
+  /** `false` for checks that do not run the action, such as the decision endpoint. */
+  readonly consume?: boolean;
+  readonly now?: Date;
+  /**
+   * How long a request this call opens stays open, in milliseconds; absent
+   * means the store's `ttl`, else `DEFAULT_APPROVAL_TTL_MS`. The grant's
+   * `approval.ttl` still caps it.
+   */
+  readonly ttl?: number;
+}): Promise<Decision>;
+declare function cancelApprovals(store: ApprovalStore, filter: ApprovalListFilter, meta: ApprovalCancelMeta): Promise<number>;
+declare function readApprovalHeader(headers: Headers | {
+  readonly get: (name: string) => string | null;
+}): string | undefined;
+declare function resumeFromHeader(store: ApprovalStore, headers: Headers | {
+  readonly get: (name: string) => string | null;
+}, now?: Date): Promise<ApprovalInspectResult>;
+/**
+ * The token to resume `decision` with when the caller carries none: the
+ * decision's own token when the store holds an approved or rejected request
+ * for it, so `resumeDecision` resumes (or denies) the call without the
+ * caller passing the token back. The token already binds permission,
+ * resource (or the call's data when there is no row id), subject and actor.
+ * A pending request counts only with `denyPending: true`, which makes the
+ * call deny with `approval-pending` instead of asking again. `undefined` when
+ * the decision needs no approval, there is no store, or the store has no
+ * unexpired request for the token; a store that throws counts as none.
+ */
+declare function storedApprovalToken(store: ApprovalStore | undefined, decision: Decision, options?: {
+  readonly denyPending?: boolean;
+  readonly now?: Date;
+}): Promise<string | undefined>;
+//#endregion
+//#region src/approvals/page.d.ts
+/** The page size of a query: `limit` within 1 to 200, 50 when absent. */
+declare function approvalPageSize(limit: number | undefined): number;
+/** Where a page starts: the `(createdAt, token)` of the last request before it. */
+type ApprovalCursorPosition = readonly [createdAt: string, token: string];
+/** The `next` cursor after `request`, for a store that pages in its own query. */
+declare function encodeApprovalCursor(request: ApprovalRequest): string;
+/** The `(createdAt, token)` position a `next` cursor names, or `null` for one that does not parse. */
+declare function decodeApprovalCursor(cursor: string): ApprovalCursorPosition | null;
+/**
+ * Pages already-filtered requests in `(createdAt, token)` order, as the
+ * built-in stores do: `limit` within 1 to 200 (50 when absent), `cursor` from
+ * the previous page's `next`, and no items for a cursor that does not parse.
+ * A custom `ApprovalStore` that filters in memory returns it from `list`.
+ */
+declare function pageApprovals(matching: readonly ApprovalRequest[], query: ApprovalListQuery): ApprovalPage;
+/** Every matching request of `store`, following `next` until the last page (at most 1000 pages of 200). */
+declare function listAllApprovals(store: ApprovalStore, filter: ApprovalListFilter): Promise<ApprovalRequest[]>;
+//#endregion
+//#region src/approvals/permissions.d.ts
+/**
+ * The `holder(permission)` approvers of `request` that `approver` holds, for
+ * `ApprovalVerdict.permissions`: each permission key the approver's own
+ * instance grants without a row. `approver` must be an instance for the
+ * approving principal in the request's tenant; for any other tenant, or an
+ * anonymous instance, it holds nothing. A check that throws holds nothing.
+ */
+declare function approverPermissions(request: ApprovalRequest, approver: PermDock): readonly string[];
+//#endregion
+//#region src/approvals/store.d.ts
+/**
+ * Refuses `by` as an approver of `request`, or returns the index of the
+ * stage the approval counts for (`undefined` without `stages`). Eligibility
+ * is `approvers.by` or, under `stages`, the first incomplete stage
+ * (`sequential`) or any incomplete stage (`all`); `approvers.escalation.to`
+ * is eligible too once the request has waited `escalation.after`. A
+ * principal who already approved is refused, so one person never completes
+ * two stages. `relations` are the relation approvers `by` holds on the
+ * request's resource (see `ApprovalVerdict.relations`).
+ */
+declare function assertApprover(request: ApprovalRequest, by: Subject, requireDistinctApprover: boolean, now?: Date, relations?: readonly string[], permissions?: readonly string[]): number | undefined;
+/**
+ * The request after `verdict`, for a store to persist: a rejection resolves
+ * it; an approval is appended to `approvals` and resolves it once there are
+ * `approvers.quorum` (default 1). Throws an `ApprovalError` when the request
+ * is not pending, has expired or `verdict.by` may not approve it. Stores
+ * should write the result only when the stored row is still pending with the
+ * same number of approvals, so two approvers racing both count.
+ */
+declare function applyApprovalVerdict(request: ApprovalRequest, verdict: ApprovalVerdict, now?: Date): ApprovalRequest;
+type MemoryApprovalStore = ApprovalStore & {
+  readonly ttl: number;
+};
+declare function memoryApprovalStore(options?: {
+  readonly ttl?: number;
+}): MemoryApprovalStore;
+//#endregion
+export { ApproverRelationsOptions as C, ApprovalError as D, approvalsHandler as E, ApprovalErrorCode as O, vouchApproval as S, ApprovalsHandlerOptions as T, resolveApproval as _, approverPermissions as a, storedApprovalToken as b, decodeApprovalCursor as c, pageApprovals as d, cancelApprovals as f, requestApproval as g, readApprovalHeader as h, memoryApprovalStore as i, isApprovalError as k, encodeApprovalCursor as l, inspectApproval as m, applyApprovalVerdict as n, ApprovalCursorPosition as o, consumeApproval as p, assertApprover as r, approvalPageSize as s, MemoryApprovalStore as t, listAllApprovals as u, resumeDecision as v, approverRelations as w, summariseSubject as x, resumeFromHeader as y };

package/dist/index.d.ts

@@ -0,0 +1,16 @@
+import { $ as AccessEvent, $n as ExplainedDecision, $t as CredentialPrincipal, A as RoleOptions, An as RoleChangeOptions, Ar as GnapAccess, At as SnapshotSource, B as normalizeApproval, Bn as simulateArazzo, Br as MemberOfParent, Bt as memoryMembershipSource, C as Policy, Cn as mergeHostedGrants, Cr as Actor, Ct as SettingsSource, Dn as WhoCan, Dr as CustomRole, Dt as SnapshotGrant, E as PolicyScopes, En as HoldingVia, Er as Binding, Et as SnapshotAssignable, F as SupportConsent, Fn as ArazzoFinding, Fr as VerifiedClaims, Ft as TokenVerifier, G as Approver, Gn as ApprovalPolicyValidation, Gr as SqlFunctionArg, Gt as WireDenial, H as role, Hn as ApprovalPolicy, Hr as RelatedCondition, Ht as memorySettings, I as ValidateMode, In as ArazzoPlan, Ir as Condition, It as VerificationFailure, J as UserApprover, Jn as ApprovalRequiredDecision, Jr as isCondition, Jt as CredentialKind, K as ApproverInput, Kn as memoryApprovalPolicies, Kr as SqlFunctionCondition, Kt as Credential, L as allow, Ln as ArazzoSimulateInput, Lr as ConditionRef, Lt as VerifiedToken, M as SeparationConflict, Mn as ActivateInput, Mr as Membership, Mt as TenantSettings, N as SubjectOf, Nn as breakGlass, Nr as Principal, Nt as TokenFailureCause, O as PrincipalOf, On as RoleChange, Or as CustomRoleGrant, Ot as SnapshotNotEntitled, P as SupportAccessOptions, Pn as supportAccess, Pr as Subject, Pt as TokenSigner, Q as user, Qn as DeniedDecision, Qt as CredentialPolicyViolation, R as definePolicy, Rn as ArazzoStepResult, Rr as ConditionValue, Rt as WhereCompiler, S as MembershipFixture, Sn as memoryPolicySource, Sr as ScopeNames, St as RoleSourceFactory, T as PolicyOAuthScope, Tn as Holder, Tr as AuthorizationDetail, Tt as Snapshot, U as separationConflicts, Un as ApprovalPolicyProblem, Ur as RelatedHop, Ut as memorySnapshotSource, V as normalizeAssurance, Vn as APPROVAL_POLICY_UNAVAILABLE, Vt as memoryRoleSource, W as AnyOfApprover, Wn as ApprovalPolicySource, Wr as RestrictedAncestors, Wt as WireDecision, X as anyOf, Xn as Denial, Xr as isConditionRef, Xt as CredentialPermissionInput, Y as allOf, Yn as Decision, Yr as isConditionDate, Yt as CredentialPermission, Z as holder, Zn as DenialReason, Zr as isSqlFunctionField, Zt as CredentialPolicy, _ as GrantLimit, _n as HostedGrantDropReason, _r as plan, _t as RelationChain, a as ApprovalRequirement, an as decideCredential, ar as Trace, at as DecisionSink, b as GrantValidity, bn as PolicySource, br as Scope, bt as RelationSource, c as BreakGlassOptions, cn as DeriveOptions, cr as Grantee, d as ClosureContext, dn as RowPair, dr as RelationGrantee, dt as LimitStore, en as CredentialRequest, er as GrantedDecision, et as AuthEvent, f as ClosureGrantFn, fn as SimulateOptions, fr as actor, ft as LocalCustomRoleTable, g as GrantCondition, gn as HostedGrant, gr as inherit, gt as MembershipSource, h as Grant, hn as createPermDock, hr as authenticated, ht as MembershipEvent, i as ApprovalOption, in as credentialSubject, ir as Quota, it as DecisionProvider, j as RoleScope, jn as RoleChangeTarget, jt as SubjectResolver, k as RoleBinding, kn as RoleChangeDecision, kr as Delegation, kt as SnapshotScope, l as BreakGlassRequirements, ln as PermDock, lr as GranteeInput, lt as LimitConsumeInput, m as DelegationTarget, mn as WhereResult, mr as assurance, mt as MemberEntry, n as ApprovalEscalation, nn as credentialDelegation, nr as MatchedGrant, nt as CredentialVerifier, o as ApprovalStage, on as parseCredential, or as TraceSkip, ot as DirectoryEvent, p as DelegationInput, pn as SnapshotOptions, pr as anyone, pt as LocalSnapshotManifest, q as PermissionApprover, qn as validateApprovalPolicy, qr as hasConditionOp, qt as CredentialDecision, r as ApprovalMode, rn as credentialPolicyViolation, rr as Obligation, rt as DecisionEvent, s as AssuranceRequirement, sn as DecideOptions, sr as TraceSkipReason, st as EntitlementSource, t as ActivationOption, tn as DecideCredentialOptions, tr as LimitDetail, tt as CredentialEvent, u as BreakGlassSpec, un as PermDockOptions, ur as InheritGrantee, ut as LimitRemaining, v as GrantOptions, vn as HostedGrantDropped, vr as relation, vt as RelationGroup, w as PolicyDelegation, wn as parsePolicyDocument, wr as Assurance, wt as SinkEvent, x as HostedGrantRef, xn as isPortableCondition, xr as ScopeDeclaration, xt as RoleSource, y as GrantScope, yn as PolicyDocument, yr as PolicyScopesInput, yt as RelationHolder, z as deny, zn as arazzoFindings, zr as MemberOfCondition, zt as memoryEntitlementSource } from "./policy-CFZAr_Al.js";
+import { A as listPermissions, C as ResourceRelationInput, D as formerKeys, E as findPermission, M as resource, O as getResource, S as ResourceRelation, T as definePermissions, _ as ResourceLevel, a as EdgeGroup, b as ResourceOptions, c as EdgeRelation, d as MetaValue, f as Permission, g as ResourceInit, h as PrincipalRelation, i as DefinePermissionsOptions, j as mergePermissions, k as isPermission, l as FieldRelation, m as PermissionTree, n as ActionMeta, o as EdgeGroups, p as PermissionKind, r as ComputedRelation, s as EdgeMatch, v as ResourceLink, w as ResourceRestricted, x as ResourceParent, y as ResourceNode } from "./permissions-DttnqqxC.js";
+import { a as RoleTree, c as defineRoles, d as isRole, f as listPlans, i as RoleMeta, l as findRole, n as PlanTree, o as Vocabulary, p as listRoles, r as Role, s as definePlans, t as Plan, u as isPlan } from "./vocabulary-DA8a8zif.js";
+import { A as countHolders, B as MemoryEdge, C as mayAccess, D as fromStripeEntitlements, E as StripeEntitlementsClient, F as context, G as CustomRoleRename, H as memoryRelations, I as principal, J as customRoleClaim, K as CustomRoleValidation, L as emptySnapshot, M as sqlFunction, N as opaque, O as claimsFirst, P as requiresApproval, R as fromSnapshot, S as permittedIds, T as memoryLimitStore, U as CustomRoleDrop, V as MemoryRelationsData, W as CustomRoleDropReason, X as validateCustomRole, Y as resolveCustomRole, _ as CustomRoleReader, a as toCsvRow, b as PermittedIdsOptions, c as OcsfAuthorizeSession, d as parseDuration, f as crud, g as snapshotFor, h as SnapshotForOptions, i as CSV_COLUMNS, j as isExternallyManaged, k as composeMemberships, l as accessToOcsf, m as writable, n as delegatedPermissions, o as OCSF_VERSION, p as readable, q as ResolvedCustomRole, r as catalogFingerprint, s as OcsfAccountChange, t as coveredByDelegation, u as toOcsf, v as CustomRoleSourceOptions, w as localSnapshotManifest, x as mayUse, y as customRoleSource, z as parseSnapshot } from "./index-D3vbkoSI.js";
+import { n as PermDockValidationError } from "./validation-error-CtF23SrC.js";
+import { n as requiredPlans } from "./problem-details-CkL50EEf.js";
+import { a as ProblemDetails, i as PermDockRevokedError, n as PermDockApprovalRequiredError, o as RevokedCode, r as PermDockDeniedError } from "./errors-DAqevpNk.js";
+import { t as InstanceOptions } from "./instance-options-BK_rNOSC.js";
+import { t as ClientNames } from "./clients-C7zLFuWT.js";
+import { a as CloudEvent, c as MemorySinkOptions, d as credentialEvent, f as membershipEvent, h as toCloudEvent, i as CatalogFindingCode, l as SignDecisionBatchOptions, m as signDecisionBatch, n as CatalogEventData, o as CloudEventType, p as memorySink, r as CatalogFinding, s as MemorySink, t as CLOUD_EVENT_TYPES, u as accessEvent } from "./sink-Gs6TTVa-.js";
+import { i as memoryRevocationFeed, n as RevocationFeed, r as RevocationListener, t as RevocationEvent } from "./revocations-Cy06JNx2.js";
+import { i as describe, n as DescribeMessages, r as DescribeOptions, t as DecisionDescription } from "./describe-PdoqESvg.js";
+import { n as parsePermDockDigest, t as PermDockDigest } from "./digest-B3kc_PgQ.js";
+import { t as parseLocalSnapshotManifest } from "./parse-local-manifest-BkGQNzAh.js";
+import { a as LinkPolicyViolation, c as capabilitySubject, d as signCapability, i as LinkPolicy, l as linkPolicyViolation, n as CapabilityInput, o as LinkPrincipal, r as CapabilityRedeemer, s as SignCapabilityOptions, t as Capability, u as parseCapability } from "./capability-Dq43tT1u.js";
+export { APPROVAL_POLICY_UNAVAILABLE, type AccessEvent, type ActionMeta, type ActivateInput, type ActivationOption, type Actor, type AnyOfApprover, type ApprovalEscalation, type ApprovalMode, type ApprovalOption, type ApprovalPolicy, type ApprovalPolicyProblem, type ApprovalPolicySource, type ApprovalPolicyValidation, type ApprovalRequiredDecision, type ApprovalRequirement, type ApprovalStage, type Approver, type ApproverInput, type ArazzoFinding, type ArazzoPlan, type ArazzoSimulateInput, type ArazzoStepResult, type Assurance, type AssuranceRequirement, type AuthEvent, type AuthorizationDetail, type Binding, type BreakGlassOptions, type BreakGlassRequirements, type BreakGlassSpec, CLOUD_EVENT_TYPES, CSV_COLUMNS, type Capability, type CapabilityInput, type CapabilityRedeemer, type CatalogEventData, type CatalogFinding, type CatalogFindingCode, type ClientNames, type ClosureContext, type ClosureGrantFn, type CloudEvent, type CloudEventType, type ComputedRelation, type Condition, type ConditionRef, type ConditionValue, type Credential, type CredentialDecision, type CredentialEvent, type CredentialKind, type CredentialPermission, type CredentialPermissionInput, type CredentialPolicy, type CredentialPolicyViolation, type CredentialPrincipal, type CredentialRequest, type CredentialVerifier, type CustomRole, type CustomRoleDrop, type CustomRoleDropReason, type CustomRoleGrant, type CustomRoleReader, type CustomRoleRename, type CustomRoleSourceOptions, type CustomRoleValidation, type DecideCredentialOptions, type DecideOptions, type Decision, type DecisionDescription, type DecisionEvent, type DecisionProvider, type DecisionSink, type DefinePermissionsOptions, type Delegation, type DelegationInput, type DelegationTarget, type Denial, type DenialReason, type DeniedDecision, type DeriveOptions, type DescribeMessages, type DescribeOptions, type DirectoryEvent, type EdgeGroup, type EdgeGroups, type EdgeMatch, type EdgeRelation, type EntitlementSource, type ExplainedDecision, type FieldRelation, type GnapAccess, type Grant, type GrantCondition, type GrantLimit, type GrantOptions, type GrantScope, type GrantValidity, type GrantedDecision, type Grantee, type GranteeInput, type Holder, type HoldingVia, type HostedGrant, type HostedGrantDropReason, type HostedGrantDropped, type HostedGrantRef, type InheritGrantee, type InstanceOptions, type LimitConsumeInput, type LimitDetail, type LimitRemaining, type LimitStore, type LinkPolicy, type LinkPolicyViolation, type LinkPrincipal, type LocalCustomRoleTable, type LocalSnapshotManifest, type MatchedGrant, type MemberEntry, type MemberOfCondition, type MemberOfParent, type Membership, type MembershipEvent, type MembershipFixture, type MembershipSource, type MemoryEdge, type MemoryRelationsData, type MemorySink, type MemorySinkOptions, type MetaValue, OCSF_VERSION, type Obligation, type OcsfAccountChange, type OcsfAuthorizeSession, type PermDock, PermDockApprovalRequiredError, PermDockDeniedError, type PermDockDigest, type PermDockOptions, PermDockRevokedError, PermDockValidationError, type Permission, type PermissionApprover, type PermissionKind, type PermissionTree, type PermittedIdsOptions, type Plan, type PlanTree, type Policy, type PolicyDelegation, type PolicyDocument, type PolicyOAuthScope, type PolicyScopes, type PolicyScopesInput, type PolicySource, type Principal, type PrincipalOf, type PrincipalRelation, type ProblemDetails, type Quota, type RelatedCondition, type RelatedHop, type RelationChain, type RelationGrantee, type RelationGroup, type RelationHolder, type RelationSource, type ResolvedCustomRole, type ResourceInit, type ResourceLevel, type ResourceLink, type ResourceNode, type ResourceOptions, type ResourceParent, type ResourceRelation, type ResourceRelationInput, type ResourceRestricted, type RestrictedAncestors, type RevocationEvent, type RevocationFeed, type RevocationListener, type RevokedCode, type Role, type RoleBinding, type RoleChange, type RoleChangeDecision, type RoleChangeOptions, type RoleChangeTarget, type RoleMeta, type RoleOptions, type RoleScope, type RoleSource, type RoleSourceFactory, type RoleTree, type RowPair, type Scope, type ScopeDeclaration, type ScopeNames, type SeparationConflict, type SettingsSource, type SignCapabilityOptions, type SignDecisionBatchOptions, type SimulateOptions, type SinkEvent, type Snapshot, type SnapshotAssignable, type SnapshotForOptions, type SnapshotGrant, type SnapshotNotEntitled, type SnapshotOptions, type SnapshotScope, type SnapshotSource, type SqlFunctionArg, type SqlFunctionCondition, type StripeEntitlementsClient, type Subject, type SubjectOf, type SubjectResolver, type SupportAccessOptions, type SupportConsent, type TenantSettings, type TokenFailureCause, type TokenSigner, type TokenVerifier, type Trace, type TraceSkip, type TraceSkipReason, type UserApprover, type ValidateMode, type VerificationFailure, type VerifiedClaims, type VerifiedToken, type Vocabulary, type WhereCompiler, type WhereResult, type WhoCan, type WireDecision, type WireDenial, accessEvent, accessToOcsf, actor, allOf, allow, anyOf, anyone, arazzoFindings, assurance, authenticated, breakGlass, capabilitySubject, catalogFingerprint, claimsFirst, composeMemberships, context, countHolders, coveredByDelegation, createPermDock, credentialDelegation, credentialEvent, credentialPolicyViolation, credentialSubject, crud, customRoleClaim, customRoleSource, decideCredential, definePermissions, definePlans, definePolicy, defineRoles, delegatedPermissions, deny, describe, emptySnapshot, findPermission, findRole, formerKeys, fromSnapshot, fromStripeEntitlements, getResource, hasConditionOp, holder, inherit, isCondition, isConditionDate, isConditionRef, isExternallyManaged, isPermission, isPlan, isPortableCondition, isRole, isSqlFunctionField, linkPolicyViolation, listPermissions, listPlans, listRoles, localSnapshotManifest, mayAccess, mayUse, membershipEvent, memoryApprovalPolicies, memoryEntitlementSource, memoryLimitStore, memoryMembershipSource, memoryPolicySource, memoryRelations, memoryRevocationFeed, memoryRoleSource, memorySettings, memorySink, memorySnapshotSource, mergeHostedGrants, mergePermissions, normalizeApproval, normalizeAssurance, opaque, parseCapability, parseCredential, parseDuration, parseLocalSnapshotManifest, parsePermDockDigest, parsePolicyDocument, parseSnapshot, permittedIds, plan, principal, readable, relation, requiredPlans, requiresApproval, resolveCustomRole, resource, role, separationConflicts, signCapability, signDecisionBatch, simulateArazzo, snapshotFor, sqlFunction, supportAccess, toCloudEvent, toCsvRow, toOcsf, user, validateApprovalPolicy, validateCustomRole, writable };

package/dist/index.js

@@ -0,0 +1,26 @@
+import { _ as listPermissions, a as formerKeys, b as resource, c as getResource, i as findPermission, n as definePermissions, p as isPermission, v as mergePermissions } from "./permissions-DVoF6dMt.js";
+import { a as hasConditionOp, c as isConditionRef, l as isSqlFunctionField, o as isCondition, r as principal, s as isConditionDate, t as context } from "./refs-KYb4ntaz.js";
+import { S as opaque, _ as memoryLimitStore, a as definePolicy, d as normalizeApproval, f as normalizeAssurance, h as separationConflicts, m as role, o as deny, t as allow } from "./policy-xyWg7QdR.js";
+import { _ as memoryRoleSource, a as accessToOcsf, b as sqlFunction, c as readable, d as customRoleSource, f as mayAccess, g as memoryMembershipSource, h as memoryEntitlementSource, i as OCSF_VERSION, l as writable, m as fromStripeEntitlements, n as CSV_COLUMNS, o as toOcsf, p as localSnapshotManifest, r as toCsvRow, s as crud, t as catalogFingerprint, u as snapshotFor, v as memorySettings, y as memorySnapshotSource } from "./src-CSbUiozF.js";
+import { a as holder, l as user, n as anyOf, t as allOf } from "./approvers-DT4AVyIg.js";
+import { n as PermDockValidationError } from "./validation-error-CnjZ4t92.js";
+import { r as requiredPlans } from "./problem-details-_AMOYz-w.js";
+import { t as describe } from "./describe-B_gVZEVi.js";
+import { r as parsePermDockDigest } from "./digest-BI-6aa6d.js";
+import { n as PermDockDeniedError, r as PermDockRevokedError, t as PermDockApprovalRequiredError } from "./errors-Cz5zn0mW.js";
+import { t as memoryRevocationFeed } from "./revocations-Bhr0aMIC.js";
+import { f as simulateArazzo, n as parseSnapshot, u as arazzoFindings } from "./snapshot-Enxd0n-s.js";
+import { t as parseDuration } from "./duration-xK2jGFVc.js";
+import { C as isPlan, E as listRoles, S as findRole, T as listPlans, a as authenticated, b as definePlans, c as inherit, f as plan, i as assurance, n as anyone, p as relation, t as actor, w as isRole, x as defineRoles } from "./grantee-Cv5Sogfv.js";
+import { t as requiresApproval } from "./approval-required-TzNB9oQA.js";
+import { i as parsePolicyDocument, n as memoryPolicySource, r as mergeHostedGrants, t as isPortableCondition } from "./hosted-DJQw46hn.js";
+import { C as countHolders, D as memoryApprovalPolicies, O as validateApprovalPolicy, S as composeMemberships, T as APPROVAL_POLICY_UNAVAILABLE, b as validateCustomRole, d as breakGlass, f as supportAccess, h as customRoleClaim, t as createPermDock, w as isExternallyManaged, x as claimsFirst, y as resolveCustomRole } from "./permdock-CzqXjCpU.js";
+import { t as memoryRelations } from "./relations-cjOL01hZ.js";
+import { r as delegatedPermissions, t as coveredByDelegation } from "./delegation-D8pUEuce.js";
+import { n as fromSnapshot, t as emptySnapshot } from "./from-snapshot-C3sHpZNS.js";
+import { t as parseLocalSnapshotManifest } from "./parse-local-manifest-BrMozJCo.js";
+import { n as permittedIds, t as mayUse } from "./may-use-DndQ5tQ-.js";
+import { a as memorySink, i as membershipEvent, n as accessEvent, o as signDecisionBatch, r as credentialEvent, s as toCloudEvent, t as CLOUD_EVENT_TYPES } from "./sink-Bd9PSyfq.js";
+import { c as signCapability, i as linkPolicyViolation, o as parseCapability, t as capabilitySubject } from "./capability-4qPdO9gk.js";
+import { a as decideCredential, n as credentialPolicyViolation, o as parseCredential, r as credentialSubject, t as credentialDelegation } from "./credential-8P81ff4u.js";
+export { APPROVAL_POLICY_UNAVAILABLE, CLOUD_EVENT_TYPES, CSV_COLUMNS, OCSF_VERSION, PermDockApprovalRequiredError, PermDockDeniedError, PermDockRevokedError, PermDockValidationError, accessEvent, accessToOcsf, actor, allOf, allow, anyOf, anyone, arazzoFindings, assurance, authenticated, breakGlass, capabilitySubject, catalogFingerprint, claimsFirst, composeMemberships, context, countHolders, coveredByDelegation, createPermDock, credentialDelegation, credentialEvent, credentialPolicyViolation, credentialSubject, crud, customRoleClaim, customRoleSource, decideCredential, definePermissions, definePlans, definePolicy, defineRoles, delegatedPermissions, deny, describe, emptySnapshot, findPermission, findRole, formerKeys, fromSnapshot, fromStripeEntitlements, getResource, hasConditionOp, holder, inherit, isCondition, isConditionDate, isConditionRef, isExternallyManaged, isPermission, isPlan, isPortableCondition, isRole, isSqlFunctionField, linkPolicyViolation, listPermissions, listPlans, listRoles, localSnapshotManifest, mayAccess, mayUse, membershipEvent, memoryApprovalPolicies, memoryEntitlementSource, memoryLimitStore, memoryMembershipSource, memoryPolicySource, memoryRelations, memoryRevocationFeed, memoryRoleSource, memorySettings, memorySink, memorySnapshotSource, mergeHostedGrants, mergePermissions, normalizeApproval, normalizeAssurance, opaque, parseCapability, parseCredential, parseDuration, parseLocalSnapshotManifest, parsePermDockDigest, parsePolicyDocument, parseSnapshot, permittedIds, plan, principal, readable, relation, requiredPlans, requiresApproval, resolveCustomRole, resource, role, separationConflicts, signCapability, signDecisionBatch, simulateArazzo, snapshotFor, sqlFunction, supportAccess, toCloudEvent, toCsvRow, toOcsf, user, validateApprovalPolicy, validateCustomRole, writable };

package/dist/instance-options-BK_rNOSC.d.ts

@@ -0,0 +1,11 @@
+import { un as PermDockOptions } from "./policy-CFZAr_Al.js";
+//#region src/core/instance-options.d.ts
+type InstanceKey = "memberships" | "relations" | "entitlements" | "customRoles" | "policies" | "approvalPolicies" | "sink" | "limits";
+/**
+ * The data sources an adapter passes through to every instance it creates.
+ * Each adapter's options type extends this, so a source added to core
+ * reaches every adapter without a per-adapter change.
+ */
+type InstanceOptions = Pick<PermDockOptions, InstanceKey>;
+//#endregion
+export { InstanceOptions as t };

package/dist/instance-options-Dhhcnm3y.js

@@ -0,0 +1,22 @@
+//#region src/core/instance-options.ts
+const INSTANCE_KEYS = {
+	memberships: true,
+	relations: true,
+	entitlements: true,
+	customRoles: true,
+	policies: true,
+	approvalPolicies: true,
+	sink: true,
+	limits: true
+};
+/** The `InstanceOptions` set on `options`, without the adapter's own keys. */
+function instanceOptions(options) {
+	const picked = {};
+	for (const key of Object.keys(INSTANCE_KEYS)) {
+		const name = key;
+		if (options[name] !== void 0) picked[name] = options[name];
+	}
+	return picked;
+}
+//#endregion
+export { instanceOptions as t };

package/dist/json-schema-BsAflUGW.js

@@ -0,0 +1,106 @@
+//#region src/core/json-schema.ts
+function issue(issues, path, message) {
+	issues.push({
+		message,
+		path: [...path]
+	});
+}
+function isRecord(value) {
+	return value !== null && typeof value === "object" && !Array.isArray(value);
+}
+/**
+* A plain-data copy built from own enumerable keys, so `__proto__` stays an
+* ordinary key and nothing the input inherits is read. Anything JSON cannot
+* carry is an issue.
+*/
+function copyJson(value, path, issues, ancestors) {
+	if (value === null || typeof value === "string" || typeof value === "boolean") return value;
+	if (typeof value === "number") {
+		if (!Number.isFinite(value)) issue(issues, path, "Expected a finite number");
+		return value;
+	}
+	if (typeof value !== "object") {
+		issue(issues, path, `Expected JSON, got ${typeof value}`);
+		return;
+	}
+	if (ancestors.has(value)) {
+		issue(issues, path, "Expected JSON, got a cycle");
+		return;
+	}
+	ancestors.add(value);
+	try {
+		if (Array.isArray(value)) return value.map((item, index) => copyJson(item, [...path, index], issues, ancestors));
+		const proto = Object.getPrototypeOf(value);
+		if (proto !== Object.prototype && proto !== null) {
+			issue(issues, path, "Expected a plain object");
+			return;
+		}
+		return Object.fromEntries(Object.keys(value).map((key) => [key, copyJson(Reflect.get(value, key), [...path, key], issues, ancestors)]));
+	} finally {
+		ancestors.delete(value);
+	}
+}
+function typeMatches(type, value) {
+	switch (type) {
+		case "object": return isRecord(value);
+		case "array": return Array.isArray(value);
+		case "string": return typeof value === "string";
+		case "boolean": return typeof value === "boolean";
+		case "integer": return Number.isInteger(value);
+		default: return type;
+	}
+}
+const DEF_REF = /^#\/\$defs\/([^/]+)$/u;
+function resolveRef(root, ref) {
+	const name = DEF_REF.exec(ref)?.[1];
+	const target = name !== void 0 && root.$defs !== void 0 && Object.hasOwn(root.$defs, name) ? root.$defs[name] : void 0;
+	if (target === void 0) throw new TypeError(`Unsupported or unknown $ref ${ref}`);
+	return target;
+}
+/** Validates a `copyJson` result against `node`, reading `$ref` targets from `root`. */
+function checkSchema(node, value, path, issues, root = node) {
+	if (node.$ref !== void 0) {
+		checkSchema(resolveRef(root, node.$ref), value, path, issues, root);
+		return;
+	}
+	if ("const" in node && value !== node.const) {
+		issue(issues, path, `Expected ${JSON.stringify(node.const)}`);
+		return;
+	}
+	if (node.enum !== void 0 && !node.enum.includes(value)) {
+		issue(issues, path, `Expected one of ${node.enum.map((item) => JSON.stringify(item)).join(", ")}`);
+		return;
+	}
+	if (node.type !== void 0 && !typeMatches(node.type, value)) {
+		issue(issues, path, `Expected ${node.type}`);
+		return;
+	}
+	if (node.pattern !== void 0 && typeof value === "string" && !new RegExp(node.pattern, "u").test(value)) issue(issues, path, `Expected a string matching ${node.pattern}`);
+	if (node.minimum !== void 0 && typeof value === "number" && value < node.minimum) issue(issues, path, `Expected at least ${String(node.minimum)}`);
+	if (node.oneOf !== void 0) {
+		if (node.oneOf.filter((option) => {
+			const scratch = [];
+			checkSchema(option, value, path, scratch, root);
+			return scratch.length === 0;
+		}).length !== 1) issue(issues, path, "Expected exactly one matching form");
+	}
+	if (Array.isArray(value)) {
+		if (node.minItems !== void 0 && value.length < node.minItems) issue(issues, path, `Expected at least ${String(node.minItems)} items`);
+		if (node.uniqueItems === true && new Set(value.map((item) => JSON.stringify(item))).size !== value.length) issue(issues, path, "Expected unique items");
+		if (node.items !== void 0) for (const [index, item] of value.entries()) checkSchema(node.items, item, [...path, index], issues, root);
+	}
+	if (!isRecord(value)) return;
+	for (const key of node.required ?? []) if (!Object.hasOwn(value, key)) issue(issues, [...path, key], "Required");
+	const properties = node.properties ?? {};
+	for (const key of Object.keys(value)) {
+		if (Object.hasOwn(properties, key)) {
+			const child = properties[key];
+			if (child !== void 0) checkSchema(child, value[key], [...path, key], issues, root);
+			continue;
+		}
+		if (node.additionalProperties === false) issue(issues, [...path, key], "Unexpected property");
+		else if (node.additionalProperties !== void 0) checkSchema(node.additionalProperties, value[key], [...path, key], issues, root);
+	}
+}
+//#endregion
+export { copyJson as n, checkSchema as t };

package/dist/jwt/index.d.ts

@@ -0,0 +1,91 @@
+import { Ft as TokenVerifier, Nr as Principal, Nt as TokenFailureCause, Pr as Subject, Pt as TokenSigner, ct as JwtClaims, et as AuthEvent } from "../policy-CFZAr_Al.js";
+import { a as JsonWebKeySet, c as JwtJwks, d as MappedSubject, g as ReplayStore, i as JoseTokenVerifierOptions, l as JwtPrincipal, n as DpopProofResult, o as JwtAlgorithm, r as JoseTokenSignerOptions, s as JwtClaimPaths, t as DiscoveryInput, u as JwtSubjectOptions } from "../types-9AWO9EGt.js";
+import { i as LinkPolicy, o as LinkPrincipal, t as Capability } from "../capability-Dq43tT1u.js";
+import { t as memoryReplayStore } from "../replay-sqBGMnNs.js";
+import { StandardSchemaV1 } from "@standard-schema/spec";
+//#region src/jwt/capability.d.ts
+/** `on('auth')` causes: a verification failure, or one of the three capability checks. */
+type CapabilityFailureCause = TokenFailureCause | "capability-revoked" | "capability-replayed" | "redeemer-mismatch" | "link-policy";
+type CapabilitySubjectOptions = Omit<JoseTokenVerifierOptions, "typ" | "issuer" | "audience" | "profile"> & {
+  /** The issuer the capability was signed by (`iss`); required. */
+  readonly issuer: string;
+  /** The application the capability was signed for (`aud`); required. */
+  readonly audience: string | readonly string[];
+  readonly verifier?: TokenVerifier;
+  /**
+   * The link policies of the scope instances the linked resource sits in
+   * (its tenant, its customer); every one must hold. A throw denies.
+   */
+  readonly linkPolicy?: (capability: Capability) => LinkPolicy | readonly LinkPolicy[] | undefined | Promise<LinkPolicy | readonly LinkPolicy[] | undefined>;
+  /** `true` when the application revoked the link id (`sub`); a throw denies. */
+  readonly revoked?: (id: string) => boolean | Promise<boolean>;
+  /** Claims the `jti` of a one-time capability; a one-time capability without it is refused. */
+  readonly replay?: ReplayStore;
+  /** The request's own verified subject, checked against the capability's `redeemer`. */
+  readonly viewer?: Subject;
+  readonly onAuth?: (event: AuthEvent) => void;
+  readonly requestId?: string;
+};
+/**
+ * Resolves a `permdock-capability+jwt` into the `link` subject it acts as.
+ * Every failure (signature, `typ`, `iss`, `aud`, expiry, a malformed claim,
+ * a revoked link, a replayed one-time token, a redeemer the viewer does not
+ * satisfy, a throwing store) is the anonymous subject, never a throw.
+ */
+export declare function subjectFromCapability(token: string | undefined | null, options: CapabilitySubjectOptions): Promise<Subject<LinkPrincipal> | Subject>;
+//#endregion
+//#region src/jwt/ci-oidc.d.ts
+type CiOidcProvider = "github" | "gitlab" | "buildkite";
+type CiOidcSubjectOptions = Omit<JoseTokenVerifierOptions, "typ" | "issuer" | "audience" | "discovery" | "profile"> & {
+  readonly provider: CiOidcProvider;
+  /** The audience the job requested the token for; required. */
+  readonly audience: string | readonly string[];
+  /**
+   * A self-managed GitLab or GitHub Enterprise Server issuer. Its keys come
+   * from OpenID discovery unless `jwks` is set.
+   */
+  readonly issuer?: string;
+  /** Validates the verified claims; a failure or a Promise is the anonymous subject. */
+  readonly schema?: StandardSchemaV1;
+  readonly verifier?: TokenVerifier;
+  readonly onAuth?: (event: AuthEvent) => void;
+  readonly requestId?: string;
+};
+/** A CI job: never a user. `ref` is a full ref (`refs/heads/main`, `refs/tags/v1`). */
+type CiOidcPrincipal = Principal & {
+  readonly kind: "workload";
+  readonly issuer: string;
+  readonly provider: CiOidcProvider;
+  readonly repository?: string;
+  readonly ref?: string;
+  readonly environment?: string;
+};
+/**
+ * Resolves a CI provider's OIDC token (GitHub Actions, GitLab CI, Buildkite)
+ * into a `workload` principal whose id is `sub`. Every failure (signature,
+ * issuer, audience, expiry, a missing `sub`, the `schema`) is the anonymous
+ * subject, never a throw and never a user.
+ */
+export declare function subjectFromCiOidc(token: string | undefined | null, options: CiOidcSubjectOptions): Promise<Subject<CiOidcPrincipal> | Subject>;
+//#endregion
+//#region src/jwt/dpop.d.ts
+type DpopProofOptions = {
+  /** Rejects a proof whose `jti` this key already used within the 60-second window. */
+  readonly replay?: ReplayStore;
+};
+export declare function verifyDpopProof(request: Request, claims: JwtClaims, accessToken?: string, options?: DpopProofOptions): Promise<DpopProofResult>;
+//#endregion
+//#region src/jwt/introspection.d.ts
+export declare function subjectFromIntrospection(response: unknown, options?: JwtSubjectOptions): MappedSubject;
+//#endregion
+//#region src/jwt/signer.d.ts
+export declare function joseTokenSigner(options: JoseTokenSignerOptions): TokenSigner;
+//#endregion
+//#region src/jwt/subject.d.ts
+export declare function subjectFromJwt(token: string | undefined | null, options: JwtSubjectOptions, request?: Request): Promise<MappedSubject>;
+export declare function createJwtSubjectResolver(options: JwtSubjectOptions): (token: string | undefined | null, request?: Request) => Promise<MappedSubject>;
+//#endregion
+//#region src/jwt/verifier.d.ts
+export declare function joseTokenVerifier(options: JoseTokenVerifierOptions): TokenVerifier;
+//#endregion
+export { type CapabilityFailureCause, type CapabilitySubjectOptions, type CiOidcPrincipal, type CiOidcProvider, type CiOidcSubjectOptions, type DiscoveryInput, type DpopProofOptions, type DpopProofResult, type JoseTokenSignerOptions, type JoseTokenVerifierOptions, type JsonWebKeySet, type JwtAlgorithm, type JwtClaimPaths, type JwtJwks, type JwtPrincipal, type JwtSubjectOptions, type MappedSubject, type ReplayStore, memoryReplayStore };