permdock 0.0.0 → 0.2.0

package/dist/orpc/index.d.ts

@@ -0,0 +1,51 @@
+import { C as Policy, D as PolicyVocabulary, Nr as Principal, ln as PermDock } from "../policy-CFZAr_Al.js";
+import { f as Permission } from "../permissions-DttnqqxC.js";
+import { n as RevocationFeed } from "../revocations-Cy06JNx2.js";
+import { A as ConnectionOptions, O as Connection, n as OpenApiHooks } from "../create-BWyx3jua.js";
+import { t as ServerAdapterOptions } from "../bind-CVy3Espv.js";
+import { t as StreamProtectOptions } from "../stream-DlvG2hs-.js";
+import { Middleware } from "@orpc/server";
+//#region src/orpc/create.d.ts
+type OrpcMiddlewareOpts<TCtx extends object = object, TInput = unknown> = {
+  readonly context: TCtx;
+  readonly input?: TInput;
+  readonly path?: readonly string[];
+  readonly next: (opts?: {
+    readonly context: TCtx;
+  }) => Promise<unknown>;
+};
+type OrpcMiddleware<TCtx extends object = object, TInput = unknown, V extends PolicyVocabulary = PolicyVocabulary> = Middleware<TCtx, TCtx & {
+  readonly permdock: PermDock<V>;
+  readonly permdockData?: unknown;
+}, TInput, any, Record<never, never>>;
+type OrpcPermDockOptions<TCtx extends object = object, TUser = unknown> = ServerAdapterOptions<OrpcMiddlewareOpts<TCtx>, TUser> & {
+  /** The Web `Request` behind a context; defaults to `context.request` or `context.req`. */
+  readonly request?: (context: TCtx) => Request | null | undefined;
+  /** Ends or revalidates open event iterators. */
+  readonly revocations?: RevocationFeed;
+};
+type OrpcOpenApiHooks<TCtx extends object = object, V extends PolicyVocabulary = PolicyVocabulary> = {
+  readonly protect: (permission: Permission | null, loadData?: (opts: OrpcMiddlewareOpts<TCtx>) => unknown, protectOptions?: StreamProtectOptions) => OrpcMiddleware<TCtx, unknown, V>;
+  readonly security: (permission: Permission) => {
+    readonly security: readonly Record<string, readonly string[]>[];
+    readonly "x-permdock-permissions": readonly string[];
+  };
+  readonly securitySchemes: OpenApiHooks["securitySchemes"];
+};
+type OrpcPermDock<TCtx extends object = object, V extends PolicyVocabulary = PolicyVocabulary> = {
+  readonly permdock: () => OrpcMiddleware<TCtx, unknown, V>;
+  readonly protect: (permission: Permission | null, loadData?: (opts: OrpcMiddlewareOpts<TCtx>) => unknown, protectOptions?: StreamProtectOptions) => OrpcMiddleware<TCtx, unknown, V>;
+  /** A long-lived connection for the request behind `context`. */
+  readonly connection: (opts: OrpcMiddlewareOpts<TCtx>, connectionOptions?: ConnectionOptions) => Promise<Connection>;
+  readonly permdockHandler: (request: Request) => Promise<Response>;
+  readonly openapi: OrpcOpenApiHooks<TCtx, V>;
+};
+/**
+ * The permission the procedure's first `protect` decides, or `undefined`
+ * when no `protect` is attached. Reads the procedure definition only and
+ * never decides.
+ */
+export declare function permissionOf(procedure: unknown): Permission | undefined;
+export declare function createPermDock<TCtx extends object = object, TUser = unknown, TPrincipal extends Principal = Principal, V extends PolicyVocabulary = PolicyVocabulary>(policy: Policy<TUser, TPrincipal, V>, options: OrpcPermDockOptions<TCtx, TUser>): OrpcPermDock<TCtx, V>;
+//#endregion
+export type { OrpcMiddleware, OrpcMiddlewareOpts, OrpcOpenApiHooks, OrpcPermDock, OrpcPermDockOptions };

package/dist/orpc/index.js

@@ -0,0 +1,145 @@
+import { t as compact } from "../compact-y6vfu2_f.js";
+import { p as isPermission } from "../permissions-DVoF6dMt.js";
+import { a as problemMessage } from "../http-SO7qGttf.js";
+import { t as problemFromError } from "../map-error-pgUWNNtG.js";
+import { n as attached } from "../bind-VnYn2HKq.js";
+import { a as reloadAfter, r as isAsyncIterable } from "../stream-DDpvynSB.js";
+import { i as rpcCode, n as guardStream, r as problemBody, t as bindRpcKernel } from "../rpc-DOK54_CS.js";
+import { ORPCError } from "@orpc/server";
+//#region src/orpc/create.ts
+function toOpts(mw, input, next) {
+	return compact({
+		context: mw.context,
+		input,
+		path: mw.path,
+		next
+	});
+}
+function isErrorConstructor(value) {
+	return typeof value === "function";
+}
+/** Uses the procedure's own constructor when it declares the code, so the declared status and `defined` apply. */
+function orpcError(code, message, data, errors) {
+	const declared = errors !== void 0 && Object.hasOwn(errors, code) ? errors[code] : void 0;
+	return isErrorConstructor(declared) ? declared({
+		message,
+		data
+	}) : new ORPCError(code, {
+		message,
+		data
+	});
+}
+function orpcErrorFrom(error, errors) {
+	const problem = error.toProblemDetails();
+	return orpcError(rpcCode(problem.status), error.code, problem, errors);
+}
+async function throwOrpcError(response, errors) {
+	const data = await problemBody(response);
+	const code = rpcCode(response.status);
+	throw orpcError(code, problemMessage(data, code), data, errors);
+}
+/** A PermDock error thrown further down (an `assert` in a handler) becomes the ORPCError `protect` throws. */
+function mapDownstream(run, errors) {
+	return new Promise((resolve) => {
+		resolve(run());
+	}).catch((error) => {
+		const mapped = problemFromError(error);
+		if (mapped === void 0) throw error;
+		return throwOrpcError(mapped, errors);
+	});
+}
+/** Registered, so a second copy of `permdock` in the bundle reads the same tag. */
+const PERMISSION = Symbol.for("permdock.orpc.permission");
+function tagged(permission, middleware) {
+	if (permission !== null) Object.defineProperty(middleware, PERMISSION, { value: permission });
+	return middleware;
+}
+function readOwn(value, key) {
+	return (typeof value === "object" || typeof value === "function") && value !== null && Object.hasOwn(value, key) ? Reflect.get(value, key) : void 0;
+}
+/**
+* The permission the procedure's first `protect` decides, or `undefined`
+* when no `protect` is attached. Reads the procedure definition only and
+* never decides.
+*/
+function permissionOf(procedure) {
+	const ordered = readOwn(readOwn(procedure, "~orpc"), "orderedMiddlewares");
+	if (!Array.isArray(ordered)) return;
+	for (const entry of ordered) {
+		const permission = readOwn(readOwn(entry, "middleware"), PERMISSION);
+		if (isPermission(permission)) return permission;
+	}
+}
+function createPermDock(policy, options) {
+	const { kernel, bind, attach, scopeOf, connection, evaluate } = bindRpcKernel(policy, options, "orpc", (opts) => opts.context, (opts) => opts.path?.join(".") ?? "orpc");
+	/** Instances this factory built, with the tenant each was built for. */
+	const issued = /* @__PURE__ */ new WeakMap();
+	const issue = (instance, scope) => {
+		issued.set(instance, scope.tenant);
+		return instance;
+	};
+	const boundFor = (context, scope) => {
+		const bound = Reflect.get(context, "permdock");
+		if (typeof bound !== "object" || bound === null || !issued.has(bound) || issued.get(bound) !== scope.tenant) return;
+		return bound;
+	};
+	const permdock = () => ((mwOptions, input) => {
+		const opts = toOpts(mwOptions, input, mwOptions.next);
+		const request = bind(opts);
+		return scopeOf(opts).then((scope) => attached(async () => boundFor(opts.context, scope) ?? issue(await kernel.permdock(request, scope), scope))).then((instance) => {
+			if (!instance.ok) return throwOrpcError(instance.response, mwOptions.errors);
+			const nextCtx = {
+				...opts.context,
+				permdock: instance.permdock
+			};
+			attach(nextCtx, request);
+			return mapDownstream(() => mwOptions.next({ context: nextCtx }), mwOptions.errors);
+		});
+	});
+	/** Wraps an event iterator so revocation ends it and unreadable items drop. */
+	const guardOutput = async (result, opts, permission, loadData, protectOptions, errors) => {
+		const output = result !== null && typeof result === "object" && "output" in result ? result.output : void 0;
+		if (!isAsyncIterable(output)) return result;
+		return {
+			...result,
+			output: await guardStream(output, (connectionOptions) => connection(opts, connectionOptions), permission, loadData, protectOptions, { onRevoked: (error) => orpcErrorFrom(error, errors) })
+		};
+	};
+	const protect = (permission, loadData, protectOptions) => tagged(permission, (async (mwOptions, input) => {
+		const opts = toOpts(mwOptions, input, mwOptions.next);
+		const request = bind(opts);
+		const scope = await scopeOf(opts);
+		const guard = await kernel.protect(permission, loadData === void 0 ? void 0 : () => loadData(opts), protectOptions)(request, scope);
+		if (guard.ok) {
+			const nextCtx = {
+				...opts.context,
+				permdock: issue(guard.permdock, scope),
+				permdockData: guard.data
+			};
+			attach(nextCtx, request);
+			return guardOutput(await mapDownstream(() => mwOptions.next({ context: nextCtx }), mwOptions.errors), opts, permission, loadData === void 0 ? void 0 : reloadAfter(guard.data, () => loadData(opts)), protectOptions, mwOptions.errors);
+		}
+		return throwOrpcError(guard.response, mwOptions.errors);
+	}));
+	const permdockHandler = (request) => {
+		return evaluate(request, {
+			context: { req: request },
+			path: ["permdock"],
+			next: (nextOpts) => Promise.resolve(nextOpts ?? { context: { req: request } })
+		});
+	};
+	const kernelOpenApi = kernel.openapi;
+	return {
+		permdock,
+		protect,
+		connection,
+		permdockHandler,
+		openapi: {
+			protect,
+			security: kernelOpenApi.security,
+			securitySchemes: kernelOpenApi.securitySchemes
+		}
+	};
+}
+//#endregion
+export { createPermDock, permissionOf };

package/dist/otel/index.d.ts

@@ -0,0 +1,13 @@
+import { D as PolicyVocabulary, ln as PermDock } from "../policy-CFZAr_Al.js";
+import { a as OtelOptions, i as OtelApi, n as GEN_AI_TOOL_CALL_ID, o as OtelWrap, r as GEN_AI_TOOL_NAME, s as StructuralLogger, t as GENAI_SEMCONV_PIN } from "../types-vNSDF7Dq.js";
+//#region src/otel/instrument.d.ts
+/**
+ * Listens on one instance. Spans carry no duration and no histogram is
+ * recorded, because a listener only sees a decision after it is made; use
+ * `withOtel` for timings and for `tenant()` / `team()` derived instances.
+ */
+export declare function instrument(permdock: PermDock, options?: OtelOptions): () => void;
+/** Returns an instrumented instance: timed spans and histogram, derived instances included. */
+export declare function withOtel<V extends PolicyVocabulary = PolicyVocabulary>(permdock: PermDock<V>, options?: OtelOptions): PermDock<V>;
+//#endregion
+export { GENAI_SEMCONV_PIN, GEN_AI_TOOL_CALL_ID, GEN_AI_TOOL_NAME, type OtelApi, type OtelOptions, type OtelWrap, type StructuralLogger };

package/dist/otel/index.js

@@ -0,0 +1,202 @@
+import { t as compact } from "../compact-y6vfu2_f.js";
+//#region src/otel/types.ts
+const GENAI_SEMCONV_PIN = "1.37.0";
+const GEN_AI_TOOL_NAME = "gen_ai.tool.name";
+const GEN_AI_TOOL_CALL_ID = "gen_ai.tool.call.id";
+//#endregion
+//#region src/otel/instrument.ts
+const FORBIDDEN = /* @__PURE__ */ new Set([
+	"__proto__",
+	"constructor",
+	"prototype"
+]);
+const SPAN_STATUS_ERROR = 2;
+const OTEL_REGISTRY = Symbol.for("opentelemetry.js.api.1");
+const OTEL_SPAN_KEY = Symbol.for("OpenTelemetry Context Key SPAN");
+function registry() {
+	const value = globalThis[OTEL_REGISTRY];
+	return typeof value === "object" && value !== null ? value : void 0;
+}
+const NOOP_TRACER = { startSpan: () => ({}) };
+const registryApi = {
+	trace: {
+		getTracer: (name) => registry()?.trace?.getTracer?.(name) ?? NOOP_TRACER,
+		getActiveSpan: () => registry()?.context?.active?.()?.getValue?.(OTEL_SPAN_KEY)
+	},
+	metrics: { getMeter: (name) => registry()?.metrics?.getMeter?.(name) ?? {
+		createCounter: () => ({ add: () => void 0 }),
+		createHistogram: () => ({ record: () => void 0 })
+	} }
+};
+function resolveApi(injected) {
+	if (injected !== void 0) return injected;
+	return registry() === void 0 ? void 0 : registryApi;
+}
+function safeCall(fn, logger) {
+	try {
+		fn();
+	} catch (error) {
+		if (logger?.error !== void 0) try {
+			logger.error("permdock.otel", { cause: String(error) });
+		} catch {}
+	}
+}
+function omitPath(attributes, path) {
+	if (Object.hasOwn(attributes, path)) {
+		const next = {};
+		for (const key of Object.keys(attributes)) if (key !== path) next[key] = attributes[key];
+		return {
+			attributes: next,
+			matched: true
+		};
+	}
+	const parts = path.split(".");
+	if (parts.some((part) => FORBIDDEN.has(part))) return {
+		attributes,
+		matched: false
+	};
+	const [head, ...rest] = parts;
+	if (head === void 0 || rest.length === 0 || !Object.hasOwn(attributes, head)) return {
+		attributes,
+		matched: false
+	};
+	const nested = attributes[head];
+	if (nested === null || typeof nested !== "object") return {
+		attributes,
+		matched: false
+	};
+	const child = omitPath(nested, rest.join("."));
+	if (!child.matched) return {
+		attributes,
+		matched: false
+	};
+	return {
+		attributes: {
+			...attributes,
+			[head]: child.attributes
+		},
+		matched: true
+	};
+}
+function attributesOf(event, options, parent) {
+	const extra = options.attributes === void 0 ? {} : options.attributes(event);
+	let redacted = compact({
+		"permdock.outcome": event.outcome,
+		"permdock.permission": event.permission,
+		"permdock.scope": event.scope,
+		"permdock.resource.type": event.resource.type,
+		"permdock.resource.id": event.resource.id,
+		"permdock.subject.id": event.subject.principal?.id,
+		"permdock.actor.id": event.subject.actor?.id,
+		"permdock.actor.kind": event.subject.actor?.kind,
+		"permdock.delegation.scopes": event.subject.delegation?.scopes?.join(","),
+		"permdock.matched.role": event.matched?.role,
+		"permdock.denials.count": event.denials?.length,
+		"permdock.token": event.token,
+		"permdock.validate": event.trusted ? "trusted" : "boundary",
+		"permdock.adapter": event.adapter,
+		"permdock.filter.total": event.counts === void 0 ? void 0 : event.counts.granted + event.counts.denied + event.counts.approvalRequired,
+		"permdock.filter.kept": event.counts?.granted,
+		[GEN_AI_TOOL_NAME]: parent?.attributes?.[GEN_AI_TOOL_NAME],
+		[GEN_AI_TOOL_CALL_ID]: parent?.attributes?.[GEN_AI_TOOL_CALL_ID],
+		...extra
+	});
+	const unmatched = [];
+	for (const path of options.redact ?? []) {
+		const result = omitPath(redacted, path);
+		redacted = result.attributes;
+		if (!result.matched) unmatched.push(path);
+	}
+	if (unmatched.length > 0) safeCall(() => {
+		options.logger?.warn(`permdock.otel unmatched redact: ${unmatched.join(", ")}`);
+	}, options.logger);
+	return redacted;
+}
+/** Epoch milliseconds with sub-millisecond precision, the OTel `TimeInput` form. */
+function now() {
+	return performance.timeOrigin + performance.now();
+}
+function recordSignals(event, options, api, timing) {
+	const parent = api?.trace.getActiveSpan?.();
+	const attributes = attributesOf(event, options, parent);
+	if (options.logger !== void 0) safeCall(() => {
+		options.logger?.info("permdock.decision", attributes);
+	}, options.logger);
+	if (api === void 0) return;
+	const name = options.tracer ?? "permdock";
+	const span = api.trace.getTracer(name).startSpan("permdock.decide", timing === void 0 ? void 0 : { startTime: timing.start });
+	if (span.isRecording?.() === false) safeCall(() => {
+		options.logger?.warn("permdock.otel: @opentelemetry/api is present but no provider is registered");
+	}, options.logger);
+	span.setAttributes?.(attributes);
+	if (event.outcome === "denied") {
+		span.addEvent?.("permdock.denied", compact({
+			role: event.denials?.map((denial) => denial.role).join(","),
+			reason: event.denials?.map((denial) => denial.reason).join(","),
+			alternatives: event.alternatives?.join(",")
+		}));
+		if (event.denials?.some((denial) => denial.reason === "validation") === true) span.recordException?.(/* @__PURE__ */ new Error("validation"));
+		if (options.errorOnDeny === true) span.setStatus?.({ code: SPAN_STATUS_ERROR });
+	}
+	span.end?.(timing?.end);
+	const meter = api.metrics?.getMeter(name);
+	const counterAttrs = compact({
+		"permdock.outcome": event.outcome,
+		"permdock.permission": event.permission,
+		"permdock.adapter": event.adapter
+	});
+	meter?.createCounter("permdock.decisions").add(1, counterAttrs);
+	if (timing !== void 0) meter?.createHistogram("permdock.decide.duration", { unit: "s" }).record((timing.end - timing.start) / 1e3, counterAttrs);
+}
+function listen(permdock, options, api, startedAt) {
+	return permdock.on("decision", (payload) => {
+		const end = now();
+		const start = startedAt();
+		const event = payload;
+		safeCall(() => {
+			recordSignals(event, options, api, start === void 0 ? void 0 : {
+				start,
+				end
+			});
+		}, options.logger);
+	});
+}
+/**
+* Listens on one instance. Spans carry no duration and no histogram is
+* recorded, because a listener only sees a decision after it is made; use
+* `withOtel` for timings and for `tenant()` / `team()` derived instances.
+*/
+function instrument(permdock, options = {}) {
+	return listen(permdock, options, resolveApi(options.api), () => void 0);
+}
+function instrumented(permdock, options, api) {
+	let started;
+	listen(permdock, options, api, () => started);
+	const timed = (fn) => (...args) => {
+		const outer = started === void 0;
+		if (outer) started = now();
+		try {
+			return fn(...args);
+		} finally {
+			if (outer) started = void 0;
+		}
+	};
+	return Object.freeze({
+		...permdock,
+		can: timed(permdock.can),
+		decide: timed(permdock.decide),
+		assert: timed(permdock.assert),
+		explain: timed(permdock.explain),
+		filter: timed(permdock.filter),
+		pick: timed(permdock.pick),
+		actions: timed(permdock.actions),
+		tenant: (id) => instrumented(permdock.tenant(id), options, api),
+		team: (id) => instrumented(permdock.team(id), options, api)
+	});
+}
+/** Returns an instrumented instance: timed spans and histogram, derived instances included. */
+function withOtel(permdock, options = {}) {
+	return instrumented(permdock, options, resolveApi(options.api));
+}
+//#endregion
+export { GENAI_SEMCONV_PIN, GEN_AI_TOOL_CALL_ID, GEN_AI_TOOL_NAME, instrument, withOtel };

package/dist/package-root-zGkxO3oN.js

@@ -0,0 +1,30 @@
+import { existsSync, readFileSync } from "node:fs";
+import { dirname, join } from "node:path";
+import { fileURLToPath } from "node:url";
+//#region src/cli/package-root.ts
+let cached;
+/**
+* The `permdock` package directory. The bundler may place this module in
+* `dist/cli/` or in a shared chunk at `dist/`, so walk up instead of
+* assuming a depth.
+*/
+function packageRoot() {
+	cached ??= findPackageRoot(dirname(fileURLToPath(import.meta.url)));
+	return cached;
+}
+/** The nearest directory at or above `start` whose `package.json` is named `permdock`. */
+function findPackageRoot(start) {
+	let dir = start;
+	for (;;) {
+		const manifest = join(dir, "package.json");
+		if (existsSync(manifest)) {
+			const { name } = JSON.parse(readFileSync(manifest, "utf8"));
+			if (name === "permdock") return dir;
+		}
+		const parent = dirname(dir);
+		if (parent === dir) throw new Error("PermDock CLI: cannot find the permdock package root");
+		dir = parent;
+	}
+}
+//#endregion
+export { packageRoot as t };

package/dist/parse-BuyjxhZV.js

@@ -0,0 +1,53 @@
+import { n as freezeDeep } from "./freeze-CrU8nQeX.js";
+import { n as PermDockValidationError } from "./validation-error-CnjZ4t92.js";
+import { t as catalogSchema } from "./schema-D3MnDMxa.js";
+import { n as copyJson, t as checkSchema } from "./json-schema-BsAflUGW.js";
+//#region src/catalog/parse.ts
+function invalid(issues) {
+	const [first] = issues;
+	const where = first?.path === void 0 || first.path.length === 0 ? "" : ` at ${first.path.map(String).join(".")}`;
+	const more = issues.length > 1 ? ` (and ${String(issues.length - 1)} more)` : "";
+	throw new PermDockValidationError({
+		code: "invalid-data",
+		permission: "",
+		resource: "",
+		boundary: "catalog",
+		issues,
+		message: `PermDock: invalid catalog${where}: ${first?.message ?? "unknown"}${more}`
+	});
+}
+/**
+* Reads a `permissions.catalog.json` document (parsed, or the JSON text) and
+* validates it against `schemas/catalog-v1.json`. Returns a deep-frozen copy
+* built from own keys; throws `PermDockValidationError` with every issue.
+*/
+function parseCatalog(json) {
+	const issues = [];
+	let input = json;
+	if (typeof json === "string") try {
+		input = JSON.parse(json);
+	} catch (error) {
+		invalid([{
+			message: `Expected JSON text: ${error instanceof Error ? error.message : String(error)}`,
+			path: []
+		}]);
+	}
+	let copy;
+	try {
+		copy = copyJson(input, [], issues, /* @__PURE__ */ new Set());
+	} catch (error) {
+		invalid([{
+			message: `Could not read the input: ${error instanceof Error ? error.message : String(error)}`,
+			path: []
+		}]);
+	}
+	if (issues.length === 0) checkSchema(catalogSchema, copy, [], issues);
+	if (issues.length > 0) invalid(issues);
+	return freezeDeep(copy);
+}
+/** Keys of the permissions the catalog marks `rowConditions: true`: the SQL helpers alone cannot enforce them. */
+function rowConditionKeys(catalog) {
+	return new Set(catalog.permissions.filter((permission) => permission.rowConditions === true).map((permission) => permission.key));
+}
+//#endregion
+export { rowConditionKeys as n, parseCatalog as t };

package/dist/parse-local-manifest-BkGQNzAh.d.ts

@@ -0,0 +1,10 @@
+import { pt as LocalSnapshotManifest } from "./policy-CFZAr_Al.js";
+//#region src/core/parse-local-manifest.d.ts
+/**
+ * Whether `value` has the shape `localSnapshotManifest(policy)` writes, with
+ * no prototype keys. A JSON import widens `v: 1` to `number`; this narrows it
+ * back without a cast.
+ */
+declare function parseLocalSnapshotManifest(value: unknown): value is LocalSnapshotManifest;
+//#endregion
+export { parseLocalSnapshotManifest as t };

package/dist/parse-local-manifest-BrMozJCo.js

@@ -0,0 +1,36 @@
+import { T as isForbiddenKey } from "./permissions-DVoF6dMt.js";
+//#region src/core/local-role.ts
+/** The role name custom-role tables in a local snapshot manifest hold their grants under; no declared or tenant role can take it. */
+const LOCAL_CUSTOM_ROLE = "\0custom";
+//#endregion
+//#region src/core/parse-local-manifest.ts
+function isRecord(value) {
+	return value !== null && typeof value === "object" && !Array.isArray(value);
+}
+function isStrings(value) {
+	return Array.isArray(value) && value.every((item) => typeof item === "string");
+}
+function safeKeys(value) {
+	if (Array.isArray(value)) return value.every(safeKeys);
+	if (!isRecord(value)) return true;
+	return Object.entries(value).every(([key, item]) => !isForbiddenKey(key) && safeKeys(item));
+}
+function isGrants(value) {
+	return Array.isArray(value) && value.every((grant) => isRecord(grant) && typeof grant["permission"] === "string" && (grant["effect"] === "allow" || grant["effect"] === "deny") && (grant["role"] === null || typeof grant["role"] === "string") && (isRecord(grant["to"]) || Array.isArray(grant["to"])));
+}
+function isGrantTable(value) {
+	return isRecord(value) && Object.values(value).every(isGrants);
+}
+function isCustomTable(value) {
+	return isRecord(value) && isRecord(value["permissions"]) && Object.values(value["permissions"]).every((row) => isRecord(row) && isGrants(row["all"]) && (row["levels"] === void 0 || isGrantTable(row["levels"]))) && isGrantTable(value["includes"]);
+}
+/**
+* Whether `value` has the shape `localSnapshotManifest(policy)` writes, with
+* no prototype keys. A JSON import widens `v: 1` to `number`; this narrows it
+* back without a cast.
+*/
+function parseLocalSnapshotManifest(value) {
+	return isRecord(value) && value["v"] === 1 && isStrings(value["roles"]) && (value["rank"] === void 0 || isStrings(value["rank"])) && (value["scopes"] === void 0 || Array.isArray(value["scopes"]) && value["scopes"].every(isRecord)) && (value["vocabulary"] === void 0 || isRecord(value["vocabulary"])) && isGrants(value["grants"]) && isRecord(value["custom"]) && Object.values(value["custom"]).every(isCustomTable) && safeKeys(value);
+}
+//#endregion
+export { LOCAL_CUSTOM_ROLE as n, parseLocalSnapshotManifest as t };

package/dist/pdp/index.d.ts

@@ -0,0 +1,22 @@
+import { C as Policy, D as PolicyVocabulary, Nr as Principal, it as DecisionProvider, un as PermDockOptions } from "../policy-CFZAr_Al.js";
+import { a as RelationMap, c as RemotePdpEndpoints, d as SpiceDbCheck, f as SpiceDbOptions, i as PdpPermDock, l as RemotePdpMapping, n as OpenFgaTuple, o as RemotePdpAuth, r as PdpFactory, s as RemotePdpCache, t as OpenFgaOptions, u as RemotePdpOptions } from "../types-BVyImy5I.js";
+//#region src/pdp/create.d.ts
+export declare function createPermDock<TUser, TPrincipal extends Principal = Principal, V extends PolicyVocabulary = PolicyVocabulary>(policy: Policy<TUser, TPrincipal, V>, user: TUser | null, options?: PermDockOptions): Promise<PdpPermDock<V>>;
+//#endregion
+//#region src/pdp/relations.d.ts
+/**
+ * An OpenFGA store as a decision provider: `check` decides one row and
+ * `list-objects` lists the ids `filter` and `where` use.
+ */
+export declare function openfga(options: OpenFgaOptions): DecisionProvider;
+/**
+ * A SpiceDB HTTP gateway as a decision provider: `CheckPermission` decides
+ * one row and `LookupResources` lists the ids `filter` and `where` use. A
+ * conditional permissionship (a caveat missing context) is a denial.
+ */
+export declare function spicedb(options: SpiceDbOptions): DecisionProvider;
+//#endregion
+//#region src/pdp/remote.d.ts
+export declare function remotePdp(options: RemotePdpOptions): DecisionProvider;
+//#endregion
+export type { OpenFgaOptions, OpenFgaTuple, PdpFactory, PdpPermDock, RelationMap, RemotePdpAuth, RemotePdpCache, RemotePdpEndpoints, RemotePdpMapping, RemotePdpOptions, SpiceDbCheck, SpiceDbOptions };