permdock 0.1.0 → 0.2.0

package/dist/shared-DRu8VFVM.js

@@ -0,0 +1,123 @@
+import { t as decisionToken } from "./token-CIWxJOCh.js";
+//#region src/pdp/shared.ts
+const MAX_CACHE_TTL_MS = 3e4;
+const CACHE_MAX = 1e3;
+/** Milliseconds, clamped to `[0, 30s]`; anything unparseable disables the cache. */
+function ttlMs(cache) {
+	if (cache === void 0) return 0;
+	const raw = typeof cache.ttl === "number" ? cache.ttl : cache.ttl.endsWith("ms") ? Number(cache.ttl.slice(0, -2)) : Number(cache.ttl.slice(0, -1)) * 1e3;
+	if (!Number.isFinite(raw) || raw <= 0) return 0;
+	return Math.min(raw, MAX_CACHE_TTL_MS);
+}
+function denied(reason) {
+	return {
+		outcome: "denied",
+		denials: [{
+			role: null,
+			reason
+		}],
+		alternatives: []
+	};
+}
+function resourceIdOf(data, field = "id") {
+	if (data === null || typeof data !== "object") return "*";
+	const id = Object.hasOwn(data, field) ? data[field] : void 0;
+	if (typeof id === "string" || typeof id === "number") return String(id);
+	return "*";
+}
+function granted(provider, permission, subject, data) {
+	const principal = subject.principal;
+	if (principal === null) return denied("anonymous");
+	return {
+		outcome: "granted",
+		subject: {
+			...subject,
+			principal
+		},
+		matched: {
+			role: provider,
+			permission: permission.key,
+			provider
+		},
+		token: decisionToken({
+			key: permission.key,
+			resourceId: resourceIdOf(data),
+			principal,
+			actor: subject.actor,
+			fingerprint: provider
+		})
+	};
+}
+/**
+* The request that would be sent, plus what a custom mapping may drop
+* (issuer, tenant, actor): a tenant switch or a changed row never reuses a
+* cached answer.
+*/
+function cacheKey(subject, permission, body) {
+	return JSON.stringify([
+		permission.key,
+		subject.principal?.issuer ?? null,
+		subject.principal?.tenant ?? null,
+		subject.actor === void 0 ? null : [subject.actor.id, subject.actor.kind],
+		body
+	]);
+}
+function ttlCache(ttl) {
+	const entries = /* @__PURE__ */ new Map();
+	return {
+		get(key) {
+			if (ttl <= 0) return;
+			const hit = entries.get(key);
+			if (hit !== void 0 && Date.now() - hit.at < ttl) return hit.value;
+			entries.delete(key);
+		},
+		set(key, value) {
+			if (ttl <= 0) return;
+			entries.set(key, {
+				at: Date.now(),
+				value
+			});
+			if (entries.size > CACHE_MAX) {
+				const oldest = entries.keys().next();
+				if (oldest.done !== true) entries.delete(oldest.value);
+			}
+		}
+	};
+}
+async function bearerOf(auth) {
+	if (auth === void 0) return null;
+	try {
+		const token = typeof auth.bearer === "function" ? await auth.bearer() : auth.bearer;
+		return token === "" ? null : token;
+	} catch {
+		return null;
+	}
+}
+async function postJson(fetcher, url, body, options) {
+	const token = await bearerOf(options.auth);
+	const headers = {
+		"content-type": "application/json",
+		accept: "application/json"
+	};
+	if (token !== null) headers["authorization"] = `Bearer ${token}`;
+	try {
+		const response = await fetcher(url, {
+			method: "POST",
+			headers,
+			body: JSON.stringify(body),
+			signal: AbortSignal.timeout(options.timeout)
+		});
+		return response.ok ? {
+			ok: true,
+			response
+		} : { ok: false };
+	} catch {
+		return { ok: false };
+	}
+}
+function joinUrl(base, path) {
+	if (path.startsWith("http://") || path.startsWith("https://")) return path;
+	return `${base.endsWith("/") ? base.slice(0, -1) : base}${path.startsWith("/") ? path : `/${path}`}`;
+}
+//#endregion
+export { postJson as a, ttlMs as c, joinUrl as i, denied as n, resourceIdOf as o, granted as r, ttlCache as s, cacheKey as t };

package/dist/{sink-Cfr9-7YC.d.ts → sink-Gs6TTVa-.d.ts}

@@ -1,4 +1,4 @@
-import { $ as DecisionSink, Ft as Credential, Tt as TokenSigner, Y as CredentialEvent, ht as SinkEvent, q as AccessEvent, st as MembershipEvent } from "./policy-CInmNGkM.js";
+import { $ as AccessEvent, Kt as Credential, Pt as TokenSigner, at as DecisionSink, ht as MembershipEvent, tt as CredentialEvent, wt as SinkEvent } from "./policy-CFZAr_Al.js";
 //#region src/core/sink.d.ts
 /** The closed list of CloudEvents `type` values PermDock emits. */
 declare const CLOUD_EVENT_TYPES: {

package/dist/skills-Biq5uup3.js

@@ -0,0 +1,192 @@
+import { t as byCodePoint } from "./compare-pfyVnBjE.js";
+import { t as packageRoot } from "./package-root-zGkxO3oN.js";
+import { cpSync, existsSync, lstatSync, mkdirSync, readFileSync, readdirSync, readlinkSync, realpathSync, writeFileSync } from "node:fs";
+import { basename, dirname, join, relative, resolve } from "node:path";
+import { createRequire } from "node:module";
+//#region src/cli/skills.ts
+const SKILL_NAMES = [
+	"permdock",
+	"permdock-wire",
+	"permdock-audit",
+	"permdock-agents",
+	"permdock-approvals",
+	"permdock-tenancy",
+	"permdock-data",
+	"permdock-credentials"
+];
+const AGENT_FOLDERS = {
+	agents: ".agents/skills",
+	claude: ".claude/skills",
+	cursor: ".cursor/skills"
+};
+/** The `--agent` names `skills install` knows, with the folder each writes. */
+const SKILL_AGENTS = AGENT_FOLDERS;
+/** Agents whose config folder (`.claude`, `.cursor`, `.agents`) the project already has. */
+function detectedAgents(cwd) {
+	return Object.entries(AGENT_FOLDERS).filter(([, folder]) => existsSync(join(cwd, dirname(folder)))).map(([agent]) => agent);
+}
+function runSkills(input) {
+	switch (input.action) {
+		case void 0:
+		case "install":
+		case "update": return input.check === true ? runSkillsCheck({
+			cwd: input.cwd,
+			agents: input.agents
+		}) : runSkillsInstall({
+			cwd: input.cwd,
+			agents: input.agents
+		});
+		case "list": return listSkills(input.cwd);
+		default: return {
+			code: 2,
+			output: `unknown skills command '${input.action}'. Use install, list or update.`
+		};
+	}
+}
+function runSkillsInstall(input) {
+	const source = resolveSkillsRoot(input.cwd, input.bundled ?? join(packageRoot(), "skills"));
+	if (source === void 0) return {
+		code: 2,
+		output: "PermDock CLI: permdock package with skills/ not found. Add permdock as a dependency."
+	};
+	const version = readPermdockVersion(source);
+	const copied = [];
+	const linked = [];
+	for (const target of destinations(input.cwd, source, input.agents)) {
+		if (target.sameAs !== void 0) {
+			linked.push(`${target.shown} to ${target.sameAs}`);
+			continue;
+		}
+		cpSync(target.from, target.real, { recursive: true });
+		copied.push(target.shown);
+	}
+	mkdirSync(join(input.cwd, ".permdock"), { recursive: true });
+	writeFileSync(join(input.cwd, ".permdock/skills-lock.json"), `${JSON.stringify({
+		version,
+		skills: [...SKILL_NAMES]
+	}, null, 2)}\n`);
+	const links = linked.length === 0 ? "" : `; linked ${linked.join(", ")}`;
+	return {
+		code: 0,
+		output: `installed ${copied.join(", ") || "no skills"}${links} (permdock@${version})`
+	};
+}
+/**
+* Compares the installed skills with the ones this version ships and writes
+* nothing: exit 1 lists every file that is missing or differs. Without
+* agents it checks the agent folders the project has, else every folder.
+*/
+function runSkillsCheck(input) {
+	const source = resolveSkillsRoot(input.cwd, input.bundled ?? join(packageRoot(), "skills"));
+	if (source === void 0) return {
+		code: 2,
+		output: "PermDock CLI: permdock package with skills/ not found. Add permdock as a dependency."
+	};
+	const version = readPermdockVersion(source);
+	const detected = detectedAgents(input.cwd);
+	const agents = input.agents.length > 0 ? input.agents : detected.length > 0 ? detected : Object.keys(AGENT_FOLDERS);
+	const stale = [];
+	for (const target of destinations(input.cwd, source, agents)) {
+		if (target.sameAs !== void 0) continue;
+		for (const file of filesOf(target.from)) {
+			const installed = join(target.real, file);
+			if (!existsSync(installed) || !readFileSync(installed).equals(readFileSync(join(target.from, file)))) stale.push(`${target.shown}/${file}`);
+		}
+	}
+	return stale.length === 0 ? {
+		code: 0,
+		output: `skills match permdock@${version}`
+	} : {
+		code: 1,
+		output: `skills differ from permdock@${version}: ${stale.join(", ")}. Run permdock skills install.`
+	};
+}
+function destinations(cwd, source, agents) {
+	const seen = /* @__PURE__ */ new Map();
+	const list = [];
+	for (const folder of resolveTargets(agents)) for (const name of SKILL_NAMES) {
+		const from = join(source, name);
+		if (!existsSync(from)) continue;
+		const shown = `${folder}/${name}`;
+		const real = followLinks(join(cwd, folder, name));
+		const sameAs = seen.get(real);
+		list.push(sameAs === void 0 ? {
+			from,
+			shown,
+			real
+		} : {
+			from,
+			shown,
+			real,
+			sameAs
+		});
+		if (sameAs === void 0) seen.set(real, shown);
+	}
+	return list;
+}
+/**
+* The path with every symlink on it followed, including a link whose target
+* does not exist yet, so a skill folder linked to another agent's folder is
+* written through the link instead of over it.
+*/
+function followLinks(path, depth = 0) {
+	if (depth > 32) throw new Error(`PermDock CLI: too many symlinks at ${path}`);
+	let link;
+	try {
+		link = lstatSync(path).isSymbolicLink();
+	} catch {
+		const parent = dirname(path);
+		return parent === path ? path : join(followLinks(parent, depth + 1), basename(path));
+	}
+	if (!link) return realpathSync(path);
+	try {
+		return realpathSync(path);
+	} catch {
+		return followLinks(resolve(dirname(path), readlinkSync(path)), depth + 1);
+	}
+}
+function filesOf(root, folder = root) {
+	return readdirSync(folder, { withFileTypes: true }).toSorted((a, b) => byCodePoint(a.name, b.name)).flatMap((entry) => {
+		const path = join(folder, entry.name);
+		if (entry.isDirectory()) return filesOf(root, path);
+		return entry.isFile() ? [relative(root, path).split("\\").join("/")] : [];
+	});
+}
+function listSkills(cwd) {
+	const lockPath = join(cwd, ".permdock/skills-lock.json");
+	const lock = existsSync(lockPath) ? JSON.parse(readFileSync(lockPath, "utf8")) : {};
+	const lines = ["permdock skills", ""];
+	for (const name of SKILL_NAMES) {
+		const places = Object.values(AGENT_FOLDERS).filter((folder) => existsSync(join(cwd, folder, name, "SKILL.md")));
+		lines.push(`  ${name}  ${places.length > 0 ? places.join(", ") : "not installed"}`);
+	}
+	if (lock.version !== void 0) lines.push("", `  lock ${lock.version}`);
+	return {
+		code: 0,
+		output: `${lines.join("\n")}\n`
+	};
+}
+function resolveTargets(agents) {
+	if (agents.length === 0) return Object.values(AGENT_FOLDERS);
+	return agents.map((agent) => {
+		const key = agent === "agent" ? "agents" : agent;
+		return AGENT_FOLDERS[key] ?? `.${key}/skills`;
+	});
+}
+function resolveSkillsRoot(cwd, bundled) {
+	try {
+		const pkg = createRequire(resolve(cwd, "package.json")).resolve("permdock/package.json");
+		const root = join(dirname(pkg), "skills");
+		if (existsSync(root)) return root;
+	} catch {}
+	const local = join(cwd, "node_modules/permdock/skills");
+	if (existsSync(local)) return local;
+	return existsSync(bundled) ? bundled : void 0;
+}
+function readPermdockVersion(skillsRoot) {
+	const pkg = join(dirname(skillsRoot), "package.json");
+	if (!existsSync(pkg)) return "0.0.0";
+	return JSON.parse(readFileSync(pkg, "utf8")).version;
+}
+//#endregion
+export { runSkillsInstall as i, detectedAgents as n, runSkills as r, SKILL_AGENTS as t };

package/dist/{skills-C_lpV4Jx.js → skills-JaymNCdK.js}

@@ -1,6 +1,6 @@
-import { a as listArg, i as globalArgs, t as COMMAND_DESCRIPTIONS } from "./commands-BMh_Etm2.js";
+import { a as listArg, i as globalArgs, t as COMMAND_DESCRIPTIONS } from "./commands-DWOrSQic.js";
 import { r as pick, t as CANCELLED } from "./prompt-CXYhLfsS.js";
-import { n as detectedAgents, r as runSkills, t as SKILL_AGENTS } from "./skills-Dx3QLnMY.js";
+import { n as detectedAgents, r as runSkills, t as SKILL_AGENTS } from "./skills-Biq5uup3.js";
 import { defineCommand } from "citty";
 //#region src/cli/commands/skills.ts
 function skills(ctx) {
@@ -20,13 +20,18 @@ function skills(ctx) {
 				type: "string",
 				description: "Agent skill folders to write, repeatable",
 				valueHint: "name"
+			},
+			check: {
+				type: "boolean",
+				description: "Fail when the installed skills differ from this version; write nothing"
 			}
 		},
 		async run({ args: parsed, rawArgs }) {
 			const action = parsed._[0];
 			let agents = listArg(rawArgs, "agent");
 			const installs = action === void 0 || action === "install" || action === "update";
-			if (ctx.interactive && installs && agents.length === 0) {
+			const check = parsed.check === true;
+			if (ctx.interactive && installs && !check && agents.length === 0) {
 				const detected = detectedAgents(ctx.cwd);
 				const picked = await pick("Which agents should get the PermDock skills?", Object.entries(SKILL_AGENTS).map(([value, hint]) => ({
 					value,
@@ -41,7 +46,8 @@ function skills(ctx) {
 			ctx.report(runSkills({
 				cwd: ctx.cwd,
 				action,
-				agents
+				agents,
+				check
 			}));
 		}
 	});