permdock 0.1.0 → 0.2.0

package/dist/collect-B7_TIfmg.js

@@ -1,49 +0,0 @@
-import { a as listArg, i as globalArgs, s as stringArg, t as COMMAND_DESCRIPTIONS } from "./commands-BMh_Etm2.js";
-import { defineCommand } from "citty";
-//#region src/cli/commands/collect.ts
-function collect(ctx) {
-	return defineCommand({
-		meta: {
-			name: "collect",
-			description: COMMAND_DESCRIPTIONS.collect
-		},
-		args: {
-			...globalArgs,
-			check: {
-				type: "boolean",
-				description: "Exit 1 when the catalog on disk is stale; write nothing"
-			},
-			src: {
-				type: "string",
-				description: "Source roots or globs, repeatable or comma-separated",
-				valueHint: "path"
-			},
-			out: {
-				type: "string",
-				description: "Catalog file to write",
-				valueHint: "file"
-			}
-		},
-		async run({ args: parsed, rawArgs }) {
-			const src = listArg(rawArgs, "src");
-			const out = stringArg(parsed.out);
-			const result = await (await import("./collect-fRPAQIWb.js")).runCollect({
-				cwd: ctx.cwd,
-				config: ctx.config,
-				collect: {
-					...src.length > 0 ? { srcPath: src } : {},
-					...out === void 0 ? {} : { out }
-				},
-				check: parsed.check === true,
-				now: ctx.now,
-				io: ctx.io
-			});
-			ctx.report({
-				code: result.code,
-				output: result.message
-			});
-		}
-	});
-}
-//#endregion
-export { collect };

package/dist/collect-fRPAQIWb.js

@@ -1,2 +0,0 @@
-import { t as runCollect } from "./collect-O-tOtbnk.js";
-export { runCollect };

package/dist/compile-CQbvyIBr.d.ts

@@ -1,30 +0,0 @@
-//#region src/conditions/compile.d.ts
-type MembershipTable = {
-  readonly table: string;
-  readonly user: string;
-  readonly role: string;
-  /** Per scope name, the column holding that scope's id (the row's own scope and its ancestors). */
-  readonly columns?: Readonly<Record<string, string>>;
-  /** Column of the first scope's id; shorthand for `columns[<first scope>]`. */
-  readonly tenant?: string;
-  /** Column of the second scope's id; shorthand for `columns[<second scope>]`. */
-  readonly team?: string;
-  readonly id?: string;
-  /** Column naming the membership's resource, when one table holds several kinds. */
-  readonly resource?: string;
-  /** Column holding the membership kind (`Membership.via`); roles with `for` need it. */
-  readonly via?: string;
-  /** Unix seconds, like `Membership.expiresAt`; `null` never expires. */
-  readonly expiresAt?: string;
-};
-type MembershipsMapping = {
-  /** The membership table of each named scope. */
-  readonly scopes?: Readonly<Record<string, MembershipTable>>;
-  /** The first scope's table; shorthand for `scopes[<first scope>]`. */
-  readonly tenant?: MembershipTable;
-  /** The second scope's table; shorthand for `scopes[<second scope>]`. */
-  readonly team?: MembershipTable;
-  readonly resource?: Readonly<Record<string, MembershipTable>>;
-};
-//#endregion
-export { MembershipsMapping as t };

package/dist/config-BPYmjTOp.js

@@ -1,26 +0,0 @@
-import { existsSync } from "node:fs";
-import { resolve } from "node:path";
-//#region src/cli/config.ts
-const CONFIG_FILES = [
-	"permdock.config.ts",
-	"permdock.config.mts",
-	"permdock.config.js",
-	"permdock.config.mjs"
-];
-function defineConfig(config) {
-	return config;
-}
-async function loadConfig(cwd, fromFlag) {
-	const path = fromFlag ? resolve(cwd, fromFlag) : CONFIG_FILES.map((name) => resolve(cwd, name)).find((file) => existsSync(file));
-	if (path === void 0) return {};
-	if (!existsSync(path)) throw new Error(`PermDock CLI: config file not found: ${path}`);
-	const { loadModule, pickNamed } = await import("./load-QOOm1z70.js");
-	const value = pickNamed(await loadModule(path), ["default"]);
-	if (value === null || typeof value !== "object") return {};
-	return value;
-}
-function resolveCwd(cwd, fallback) {
-	return cwd === void 0 ? fallback : resolve(fallback, cwd);
-}
-//#endregion
-export { loadConfig as n, resolveCwd as r, defineConfig as t };

package/dist/context-gtAwAILx.js

@@ -1,6 +0,0 @@
-import { createContext } from "react";
-//#region src/react/context.ts
-const PermDockStoreContext = createContext(null);
-const PermDockSnapshotPromiseContext = createContext(null);
-//#endregion
-export { PermDockStoreContext as n, PermDockSnapshotPromiseContext as t };

package/dist/create-BKF3dgFk.d.ts

@@ -1,162 +0,0 @@
-import { $ as DecisionSink, C as Policy, E as PolicyVocabulary, Mn as Decision, Zt as PermDock, at as LimitStore, ct as MembershipSource, fr as JsonWebKeyLike, ft as RelationSource, hr as Subject, ir as Actor, mr as Principal, pt as RoleSource, sn as PolicySource, tt as EntitlementSource, xt as SnapshotSource } from "./policy-CInmNGkM.js";
-import { d as Permission } from "./permissions-B4apnahQ.js";
-import { f as ApprovalStore } from "./types-B8w5PFtS.js";
-import { t as ApprovalHint } from "./errors-DbZ1YOnb.js";
-import { n as RevocationFeed } from "./revocations-Cy06JNx2.js";
-import { r as PdpFactory } from "./types-BvBk1wgn.js";
-//#region src/server/connection.d.ts
-type ConnectionData<T> = T | (() => T | null | undefined | Promise<T | null | undefined>);
-type ConnectionOptions<T = unknown> = {
-  /** The permission the stream or socket is opened for; re-checked after every revalidation. */
-  readonly permission?: Permission;
-  /** The row for `permission`, or a loader re-run on every revalidation. */
-  readonly data?: ConnectionData<T>;
-  /** Milliseconds between periodic revalidations; off by default. */
-  readonly revalidate?: number;
-};
-type Connection = {
-  /** The current instance; replaced, never mutated, after a revalidation. */
-  readonly permdock: PermDock;
-  /** Aborts with a `PermDockRevokedError` when the connection must end. */
-  readonly signal: AbortSignal;
-  /**
-   * Per-message decision. Data is validated against the resource schema
-   * first unless `{ trusted: true }` marks it as a row the server loaded.
-   */
-  readonly check: (permission: Permission, data?: unknown, options?: {
-    readonly trusted?: boolean;
-  }) => Decision;
-  readonly filter: <T>(permission: Permission<string, T, "instance">, items: readonly T[]) => T[];
-  /** Stops timers and the feed subscription. Call it when the transport closes. */
-  readonly close: () => void;
-};
-//#endregion
-//#region src/server/web-bot-auth.d.ts
-type WebBotAuthJwk = JsonWebKeyLike & {
-  readonly kid?: string;
-  readonly crv?: string;
-};
-type WebBotAuthKeyLookup = (input: {
-  readonly request: Request;
-  readonly keyid: string;
-  readonly agent: string | undefined;
-}) => WebBotAuthJwk | undefined | Promise<WebBotAuthJwk | undefined>;
-type WebBotAuthKeys = {
-  readonly lookup: WebBotAuthKeyLookup;
-};
-type WebBotAuthOptions = {
-  readonly verify?: boolean;
-  readonly keys: WebBotAuthKeys | WebBotAuthKeyLookup;
-  readonly required?: boolean;
-  readonly maxAge?: number;
-  /** Unix seconds; defaults to the system clock. */
-  readonly now?: () => number;
-};
-/**
- * An adapter's `webBotAuth` option: `(request) => verifyWebBotAuth(request, options)`,
- * so an app without it does not bundle RFC 9421 verification.
- */
-type WebBotAuthVerifier = (request: Request) => Promise<Actor | undefined>;
-type DiscoverViaSignatureAgentOptions = {
-  readonly allow: readonly string[];
-  readonly fetch?: typeof fetch;
-};
-declare class InvalidSignatureError extends Error {
-  override readonly name: "InvalidSignatureError";
-  readonly response: Response;
-  constructor(response: Response);
-}
-declare function invalidSignatureResponse(error: unknown): Response | undefined;
-declare function invalidSignatureProblem(detail: string): Response;
-declare function discoverViaSignatureAgent(options: DiscoverViaSignatureAgentOptions): WebBotAuthKeys;
-declare function verifyWebBotAuth(request: Request, options: WebBotAuthOptions | undefined): Promise<Actor | undefined>;
-//#endregion
-//#region src/server/evaluations.d.ts
-declare function createEvaluationsHandler(options: {
-  readonly policy: Policy;
-  readonly resolve?: (request: Request) => Promise<PermDock>;
-  readonly getPermDock?: (query?: {
-    readonly tenant?: string;
-  }) => Promise<PermDock>;
-  readonly store?: ApprovalStore;
-  readonly adapter?: string;
-  /** The most evaluations one POST may carry; a larger batch is a 413 before any instance is resolved. */
-  readonly maxEvaluations?: number;
-}): {
-  readonly POST: (request: Request) => Promise<Response>;
-  readonly GET: (request: Request) => Promise<Response>;
-};
-//#endregion
-//#region src/server/create.d.ts
-type ServerPermDockOptions<TUser = unknown> = {
-  /** The user, or a full `Subject` (core then skips `policy.subject`); `null` is anonymous. */
-  readonly subject: (request: Request) => TUser | Subject | null | Promise<TUser | Subject | null>;
-  readonly actor?: (request: Request) => unknown;
-  /** `(request) => verifyWebBotAuth(request, options)`; a verified bot becomes the actor. */
-  readonly webBotAuth?: WebBotAuthVerifier;
-  readonly tenant?: string | ((request: Request) => string | undefined | Promise<string | undefined>);
-  readonly memberships?: MembershipSource | readonly MembershipSource[];
-  /** The object graph for relation grants that walk a parent chain; without it they deny. */
-  readonly relations?: RelationSource;
-  readonly entitlements?: EntitlementSource;
-  readonly customRoles?: RoleSource;
-  /** Hosted grants, read once per instance; see `PolicySource`. */
-  readonly policies?: PolicySource;
-  readonly store?: ApprovalStore;
-  readonly sink?: DecisionSink;
-  readonly limits?: LimitStore;
-  /** Ends or revalidates open connections; never a decision input. */
-  readonly revocations?: RevocationFeed;
-  /**
-   * `createPermDock` from `permdock/pdp`: `protect` then decides delegated
-   * permissions through the remote PDP. The instance handlers receive stays
-   * synchronous and keeps denying delegated permissions (`pdp-unavailable`).
-   */
-  readonly pdp?: PdpFactory;
-  /** Accepted for adapter parity; HTTP adapters do not read it. */
-  readonly snapshots?: SnapshotSource;
-  /** Added as `approval` to every `approval-required` problem. */
-  readonly approval?: ApprovalHint;
-};
-type Guard<T = unknown, V extends PolicyVocabulary = PolicyVocabulary> = {
-  readonly ok: true;
-  readonly permdock: PermDock<V>;
-  readonly decision: Extract<Decision, {
-    readonly outcome: "granted";
-  }>;
-  readonly data: T;
-} | {
-  readonly ok: false;
-  readonly response: Response;
-};
-type OpenApiHooks = {
-  readonly security: (permission: Permission) => {
-    readonly security: readonly Record<string, readonly string[]>[];
-    readonly "x-permdock-permissions": readonly string[];
-  };
-  readonly securitySchemes: () => Readonly<Record<string, unknown>>;
-};
-type ProtectOptions = {
-  /**
-   * `true` when `loadData` returns a row the server loaded itself, to skip
-   * schema validation. Anything else is validated against the resource
-   * schema before the check.
-   */
-  readonly trusted?: boolean;
-};
-type TenantOption<TContext> = string | ((context: TContext) => string | undefined | Promise<string | undefined>);
-type ServerPermDock<V extends PolicyVocabulary = PolicyVocabulary> = {
-  readonly permdock: (request: Request) => Promise<PermDock<V>>;
-  readonly protect: <T = unknown>(permission: Permission, loadData?: (request: Request) => T | null | undefined | Promise<T | null | undefined>, protectOptions?: ProtectOptions) => (request: Request) => Promise<Guard<T, V>>;
-  /** A long-lived connection for a stream or socket opened by `request`. */
-  readonly connection: <T = unknown>(request: Request, options?: ConnectionOptions<T>) => Promise<Connection>;
-  readonly problem: (decision: Decision, init?: {
-    readonly permission?: Permission;
-    readonly instance?: string;
-  }) => Response;
-  readonly openapi: OpenApiHooks;
-  readonly permdockHandler: () => ReturnType<typeof createEvaluationsHandler>;
-};
-declare function createPermDock<TUser, TPrincipal extends Principal = Principal, V extends PolicyVocabulary = PolicyVocabulary>(policy: Policy<TUser, TPrincipal, V>, options: ServerPermDockOptions<TUser>): ServerPermDock<V>;
-//#endregion
-export { ConnectionOptions as S, invalidSignatureProblem as _, ServerPermDockOptions as a, Connection as b, createEvaluationsHandler as c, WebBotAuthJwk as d, WebBotAuthKeyLookup as f, discoverViaSignatureAgent as g, WebBotAuthVerifier as h, ServerPermDock as i, DiscoverViaSignatureAgentOptions as l, WebBotAuthOptions as m, OpenApiHooks as n, TenantOption as o, WebBotAuthKeys as p, ProtectOptions as r, createPermDock as s, Guard as t, InvalidSignatureError as u, invalidSignatureResponse as v, ConnectionData as x, verifyWebBotAuth as y };

package/dist/create-CSkhDU9T.js

@@ -1,222 +0,0 @@
-import { t as compact } from "./compact-y6vfu2_f.js";
-import { g as listPermissions } from "./permissions-DC7GROPA.js";
-import { t as createPermDock$1 } from "./permdock-yoZ7EjxX.js";
-import { n as isActor } from "./subject-C6dLxqHU.js";
-import { a as problemFromDecision, i as notFoundProblem, o as problemResponse, t as PROBLEM_BASE } from "./problem-Cgp9-KZA.js";
-import { n as createEvaluationsHandler, r as InvalidSignatureError, t as applyApprovalResume } from "./evaluations-DsAU9ppl.js";
-//#region src/server/create.ts
-/** Resolves an adapter `tenant` option against its framework context; a throw is no tenant. */
-async function tenantScope(option, context) {
-	if (option === void 0 || typeof option === "string") return { tenant: option };
-	try {
-		return { tenant: await option(context) };
-	} catch {
-		return { tenant: void 0 };
-	}
-}
-async function resolveActor(request, options) {
-	const verified = options.webBotAuth === void 0 ? void 0 : await options.webBotAuth(request);
-	if (verified !== void 0) return verified;
-	if (options.actor === void 0) return;
-	try {
-		const resolved = await options.actor(request);
-		return isActor(resolved) ? resolved : void 0;
-	} catch {
-		return;
-	}
-}
-const NO_TENANT = "\0";
-function createPermDock(policy, options) {
-	return createKernel(policy, options);
-}
-function problemFor(decision, init, approval) {
-	if (init?.permission !== void 0) return problemFromDecision(decision, init.permission, {
-		principal: null,
-		context: {}
-	}, compact({
-		instance: init.instance,
-		approval
-	}));
-	return problemResponse({
-		type: `${PROBLEM_BASE}/denied`,
-		title: "Permission denied",
-		status: 403,
-		detail: decision.outcome
-	});
-}
-/**
-* The kernel behind every HTTP adapter. The subject and actor are resolved
-* once per `Request`; one instance is cached per `(Request, tenant)`, so a
-* global middleware and a later tenant-scoped `protect` never share a tenant.
-*/
-function createKernel(policy, options) {
-	const adapter = options.adapter ?? "server";
-	const subjects = /* @__PURE__ */ new WeakMap();
-	const instances = /* @__PURE__ */ new WeakMap();
-	const resolveSubject = (request) => {
-		const hit = subjects.get(request);
-		if (hit !== void 0) return hit;
-		const resolved = (async () => {
-			const actor = await resolveActor(request, options);
-			let user = null;
-			try {
-				user = await options.subject(request);
-			} catch {
-				user = null;
-			}
-			return {
-				user,
-				actor
-			};
-		})();
-		subjects.set(request, resolved);
-		return resolved;
-	};
-	const freshSubject = async (request) => {
-		const actor = await resolveActor(request, options);
-		try {
-			return {
-				user: await options.subject(request),
-				actor
-			};
-		} catch {
-			return {
-				user: null,
-				actor
-			};
-		}
-	};
-	const instanceFor = async ({ user, actor }, tenant) => {
-		const coreOptions = compact({
-			tenant,
-			memberships: options.memberships,
-			relations: options.relations,
-			entitlements: options.entitlements,
-			customRoles: options.customRoles,
-			policies: options.policies,
-			sink: options.sink,
-			limits: options.limits,
-			actor
-		});
-		const permdock = await createPermDock$1(policy, user, coreOptions);
-		const remote = options.pdp === void 0 ? void 0 : await options.pdp(policy, user, coreOptions);
-		return {
-			permdock: options.wrap === void 0 ? permdock : options.wrap(permdock),
-			remote
-		};
-	};
-	const build = async (request, scope) => {
-		const { tenant } = scope ?? await tenantScope(options.tenant, request);
-		let byTenant = instances.get(request);
-		if (byTenant === void 0) {
-			byTenant = /* @__PURE__ */ new Map();
-			instances.set(request, byTenant);
-		}
-		const key = tenant ?? NO_TENANT;
-		const hit = byTenant.get(key);
-		if (hit !== void 0) return hit;
-		const built = (async () => instanceFor(await resolveSubject(request), tenant))();
-		byTenant.set(key, built);
-		return built;
-	};
-	const connection = async (request, connectionOptions = {}, scope) => {
-		const { tenant } = scope ?? await tenantScope(options.tenant, request);
-		const { openConnection } = await import("./connection-JvqwHODC.js");
-		return openConnection({
-			open: async () => (await build(request, { tenant })).permdock,
-			rebuild: async () => (await instanceFor(await freshSubject(request), tenant)).permdock,
-			tenant,
-			...options.revocations === void 0 ? {} : { feed: options.revocations },
-			adapter,
-			options: connectionOptions
-		});
-	};
-	const permdock = async (request, scope) => (await build(request, scope)).permdock;
-	const protect = (permission, loadData, protectOptions = {}) => async (request, scope) => {
-		let instance;
-		let remote;
-		try {
-			({permdock: instance, remote} = await build(request, scope));
-		} catch (error) {
-			if (error instanceof InvalidSignatureError) return {
-				ok: false,
-				response: error.response
-			};
-			throw error;
-		}
-		let data;
-		if (loadData !== void 0) {
-			const loaded = await loadData(request);
-			if (loaded === null || loaded === void 0) return {
-				ok: false,
-				response: notFoundProblem()
-			};
-			data = loaded;
-		}
-		const decideOptions = compact({
-			source: "adapter",
-			adapter,
-			...protectOptions.trusted === true ? { trusted: true } : {
-				trusted: false,
-				boundary: "http-body"
-			}
-		});
-		const raw = remote === void 0 ? instance.decide(permission, data, decideOptions) : await remote.decide(permission, data, decideOptions).catch(() => ({
-			outcome: "denied",
-			denials: [{
-				role: null,
-				reason: "pdp-unavailable"
-			}],
-			alternatives: []
-		}));
-		const decision = await applyApprovalResume(raw, permission, instance, options.store, request, compact({
-			type: permission.resource,
-			id: data !== null && typeof data === "object" && "id" in data && (typeof data.id === "string" || typeof data.id === "number") ? String(data.id) : void 0
-		}), adapter);
-		if (decision.outcome === "granted") return {
-			ok: true,
-			permdock: instance,
-			decision,
-			data
-		};
-		return {
-			ok: false,
-			response: problemFromDecision(decision, permission, instance.subject, compact({
-				approval: options.approval,
-				credentials: request.headers.has("authorization"),
-				disclosure: data === void 0 ? void 0 : policy.resources.get(permission.resource)?.disclosure
-			}))
-		};
-	};
-	const openapi = {
-		security: (permission) => ({
-			security: [{ oauth2: [permission.scope] }],
-			"x-permdock-permissions": [permission.key]
-		}),
-		securitySchemes: () => {
-			const scopes = {};
-			for (const leaf of listPermissions(policy.permissions)) scopes[leaf.scope] = leaf.meta.title ?? leaf.key;
-			return { oauth2: {
-				type: "oauth2",
-				flows: {},
-				scopes
-			} };
-		}
-	};
-	const permdockHandler = (scope) => createEvaluationsHandler(compact({
-		policy,
-		resolve: scope === void 0 ? permdock : async (request) => permdock(request, await scope(request)),
-		store: options.store,
-		adapter
-	}));
-	return {
-		permdock,
-		protect,
-		connection,
-		problem: (decision, init) => problemFor(decision, init, options.approval),
-		openapi,
-		permdockHandler
-	};
-}
-//#endregion
-export { createPermDock as n, tenantScope as r, createKernel as t };