permdock 0.1.0 → 0.2.0

package/dist/kernel-YOGCWNLf.js

@@ -1,211 +0,0 @@
-import { t as compact } from "./compact-y6vfu2_f.js";
-import { t as describe } from "./describe-Bt1YD5uS.js";
-import { o as deniedMessage } from "./errors-Iy71s7Oj.js";
-import { t as createPermDock } from "./permdock-yoZ7EjxX.js";
-import { t as mayUse } from "./may-use-CnFEjVEp.js";
-import { l as storedApprovalToken, s as resumeDecision } from "./helpers-DnSOrhB9.js";
-//#region src/agent/reason.ts
-function modelReason(decision, permission, subjectId) {
-	if (decision.outcome === "denied") return deniedMessage(permission?.key ?? "unknown", subjectId, decision.denials, decision.alternatives.map((leaf) => leaf.key));
-	return describe(decision).detail;
-}
-function unmappedReason(toolName) {
-	return `Denied: unmapped tool ${toolName}.`;
-}
-function thrownReason(toolName) {
-	return `Denied: ${toolName} failed closed.`;
-}
-//#endregion
-//#region src/agent/kernel.ts
-function asActor(value) {
-	if (value === null || typeof value !== "object" || Array.isArray(value)) return;
-	const record = value;
-	if (typeof record.id !== "string" || typeof record.kind !== "string") return;
-	return {
-		id: record.id,
-		kind: record.kind
-	};
-}
-async function resolveTenant(tenant, context) {
-	if (tenant === void 0 || typeof tenant === "string") return tenant;
-	try {
-		return await tenant(context);
-	} catch {
-		return;
-	}
-}
-/** The resume token an agent run carries under the namespaced `permdockApproval` key. */
-function approvalTokenOf(context) {
-	if (context === null || typeof context !== "object") return;
-	const token = context.permdockApproval;
-	return typeof token === "string" && token !== "" ? token : void 0;
-}
-function idOf(data) {
-	if (data === null || typeof data !== "object") return;
-	const id = data.id;
-	if (typeof id === "string" || typeof id === "number") return String(id);
-}
-function resourceRef(permission, data) {
-	return compact({
-		type: permission.resource,
-		id: idOf(data)
-	});
-}
-function runDecide(permdock, permission, data, adapter) {
-	return permdock.decide(permission, data, compact({
-		source: "adapter",
-		adapter,
-		boundary: "tool-args"
-	}));
-}
-function createAgentKernel(policy, options) {
-	const cache = /* @__PURE__ */ new WeakMap();
-	const instance = (context) => {
-		if (typeof context === "object" && context !== null) {
-			const hit = cache.get(context);
-			if (hit !== void 0) return hit;
-		}
-		const built = (async () => {
-			let user = null;
-			try {
-				user = await options.subject(context);
-			} catch {
-				user = null;
-			}
-			let actor;
-			if (options.actor !== void 0) try {
-				actor = asActor(await options.actor(context));
-			} catch {
-				actor = void 0;
-			}
-			let delegation;
-			if (options.delegation !== void 0) try {
-				delegation = await options.delegation(context);
-			} catch {
-				delegation = void 0;
-			}
-			const tenant = await resolveTenant(options.tenant, context);
-			return createPermDock(policy, user, compact({
-				tenant,
-				actor,
-				delegation,
-				memberships: options.memberships,
-				relations: options.relations,
-				entitlements: options.entitlements,
-				customRoles: options.customRoles,
-				policies: options.policies,
-				sink: options.sink,
-				limits: options.limits
-			}));
-		})();
-		if (typeof context === "object" && context !== null) {
-			cache.set(context, built);
-			const release = () => {
-				if (cache.get(context) === built) cache.delete(context);
-			};
-			built.then(release, release);
-		}
-		return built;
-	};
-	const evaluate = async (binding, toolName, args, context, decideOptions = {}) => {
-		try {
-			const permdock = await instance(context);
-			let data;
-			if (binding.data !== void 0) {
-				data = await binding.data(args);
-				if (data === null || data === void 0) {
-					const decision = {
-						outcome: "denied",
-						denials: [{
-							role: null,
-							reason: "validation"
-						}],
-						alternatives: []
-					};
-					return {
-						outcome: "denied",
-						decision,
-						permission: binding.permission,
-						reason: modelReason(decision, binding.permission, permdock.subject.principal?.id)
-					};
-				}
-			}
-			const raw = runDecide(permdock, binding.permission, data, options.adapter);
-			const decision = await resumeDecision({
-				decision: raw,
-				permission: binding.permission,
-				subject: permdock.subject,
-				store: options.store,
-				resource: resourceRef(binding.permission, data),
-				adapter: options.adapter,
-				token: decideOptions.resumeToken ?? await storedApprovalToken(options.store, raw, decideOptions.denyPending === true)
-			});
-			if (decision.outcome === "granted") return {
-				outcome: "granted",
-				decision,
-				permission: binding.permission,
-				data
-			};
-			if (decision.outcome === "approval-required") return {
-				outcome: "approval-required",
-				decision,
-				permission: binding.permission,
-				data,
-				token: decision.token,
-				summary: modelReason(decision, binding.permission, permdock.subject.principal?.id)
-			};
-			return {
-				outcome: "denied",
-				decision,
-				permission: binding.permission,
-				reason: modelReason(decision, binding.permission, permdock.subject.principal?.id)
-			};
-		} catch {
-			return {
-				outcome: "denied",
-				decision: null,
-				permission: binding.permission,
-				reason: thrownReason(toolName)
-			};
-		}
-	};
-	const tokenFor = async (binding, args, context) => {
-		try {
-			const permdock = await instance(context);
-			let data;
-			if (binding.data !== void 0) {
-				data = await binding.data(args);
-				if (data === null || data === void 0) return;
-			}
-			const raw = runDecide(permdock, binding.permission, data, options.adapter);
-			return raw.outcome === "approval-required" ? raw.token : void 0;
-		} catch {
-			return;
-		}
-	};
-	const decideTool = (toolName, args, context, decideOptions = {}) => {
-		const binding = options.tools[toolName];
-		if (binding === void 0) return Promise.resolve({
-			outcome: "denied",
-			decision: null,
-			permission: void 0,
-			reason: unmappedReason(toolName)
-		});
-		return evaluate(binding, toolName, args, context, decideOptions);
-	};
-	const allowedToolNames = async (context) => {
-		const permdock = await instance(context);
-		const allowed = /* @__PURE__ */ new Set();
-		for (const [name, binding] of Object.entries(options.tools)) if (mayUse(permdock, binding.permission)) allowed.add(name);
-		return allowed;
-	};
-	return {
-		instance,
-		decideTool,
-		evaluate,
-		tokenFor,
-		allowedToolNames
-	};
-}
-//#endregion
-export { createAgentKernel as n, approvalTokenOf as t };

package/dist/load-QOOm1z70.js

@@ -1,2 +0,0 @@
-import { a as loadModule, o as pickNamed } from "./load-BZ24CpZP.js";
-export { loadModule, pickNamed };

package/dist/manifest-DDQbC6K0.d.ts

@@ -1,118 +0,0 @@
-//#region src/supabase/manifest.d.ts
-/**
- * What `permdock supabase inspect --json` prints and `--out` writes to
- * `permdock.manifest.json`: the contract between the generated hook and SQL
- * helpers and a package that writes policies or claims next to them
- * (better-supabase). `version` is the major of this shape; a field is only
- * ever added within it. `schemas/supabase-manifest-v1.json` is its JSON Schema.
- */
-type SupabaseHookManifest = {
-  readonly $schema: "https://permdock.dev/schemas/supabase-manifest-v1.json";
-  readonly version: 1;
-  readonly hook: {
-    readonly schema: string;
-    readonly function: "custom_access_token_hook";
-    readonly out: string;
-  };
-  readonly helpers: {
-    readonly schema: string;
-    /**
-     * `permdock_has` and, per declared scope, `permitted_<scope>_ids`, each
-     * `(p_grant text)`, the membership-only `member_<scope>_ids()` and, for a
-     * scope with a membership source, `member_<scope>_ids_for(p_user uuid)`.
-     */
-    readonly functions: readonly string[];
-  };
-  readonly tenantClaim: string;
-  readonly budget: {
-    readonly bytes: number;
-    readonly measure: string;
-  };
-  readonly claims: readonly SupabaseHookClaim[];
-  readonly authzVersion: boolean;
-  /**
-   * With `authzVersion`, the function that bumps the listed users' `authz_ver`,
-   * for a membership source outside the hook. It is `security definer` and no
-   * client role may execute it: call it from a trigger owned by the table's owner.
-   */
-  readonly authzVersionBump?: {
-    readonly schema: string;
-    readonly function: "permdock_bump_authz_version_for";
-    readonly args: "p_users uuid[]";
-  };
-  /** The `supabase.hook.memberships` sources, in the order the hook reads them. */
-  readonly memberships: readonly SupabaseManifestMembership[];
-  readonly rls: SupabaseManifestRls;
-  /**
-   * Every `schema.table.column` a membership or an `attrs` claim is computed
-   * from. A client role that can insert or update one can grant itself access.
-   */
-  readonly decidingColumns: readonly string[];
-  /** The majors of the `-- permdock:hook` and `-- permdock:grants` marker lines. */
-  readonly markers: {
-    readonly hook: "v1";
-    readonly grants: "v1";
-  };
-};
-type SupabaseHookClaim = {
-  readonly name: string;
-  /** `permdock`, or the `<schema>.<function>` of a `supabase.hook.claims` entry. */
-  readonly source: string;
-  /** Whether the claim counts toward `budget.bytes`. */
-  readonly budget: boolean;
-};
-type SupabaseManifestColumn = {
-  readonly column: string;
-};
-/** A column of the source table, or a value every row has. */
-type SupabaseManifestValue = SupabaseManifestColumn | {
-  readonly value: string | readonly string[];
-};
-/** One `fromTable` or `fromJunction` source. */
-type SupabaseManifestMembership = {
-  /** `schema.table`, `public` when the source names no schema. */
-  readonly table: string;
-  readonly user: SupabaseManifestColumn;
-  /** A column for `fromTable`, the fixed scope for `fromJunction`. */
-  readonly scope: SupabaseManifestValue;
-  readonly id: SupabaseManifestColumn;
-  /** A role column, or the fixed roles every row holds. */
-  readonly role: SupabaseManifestValue;
-  /** A `jsonb` column of ancestor ids keyed by scope, or one column per ancestor scope. */
-  readonly within?: SupabaseManifestColumn | {
-    readonly columns: Readonly<Record<string, string>>;
-  };
-  readonly via?: SupabaseManifestValue;
-  readonly expiresAt?: SupabaseManifestColumn;
-  /** The columns of `table` that decide the membership. */
-  readonly columns: readonly string[];
-};
-type SupabaseManifestHelper = {
-  readonly name: string;
-  /** The argument list, `p_grant text`, or `''` for none. */
-  readonly args: string;
-  readonly returns: string;
-  /** The roles granted `execute`; a field view `anon` reads adds `anon` to the `authenticated` ones. */
-  readonly execute: readonly string[];
-};
-type SupabaseManifestRls = {
-  readonly schema: string;
-  /** Where the helpers read roles and memberships: the claims (`jwt`) or the tables (`database`). */
-  readonly mode: "jwt" | "database";
-  readonly tenantClaim: string;
-  /** The declared scopes, root first, with the Postgres type of their ids. */
-  readonly scopes: readonly {
-    readonly name: string;
-    readonly type: string;
-    readonly within?: string;
-  }[];
-  readonly helpers: readonly SupabaseManifestHelper[];
-  /**
-   * The tables `member_<scope>_ids_for` reads: an `rls.memberships` table
-   * mapped for the scope, else `rls.membershipSources`, else the hook's
-   * `memberships`.
-   */
-  readonly memberships: readonly SupabaseManifestMembership[];
-};
-//#endregion
-export { SupabaseManifestMembership as a, SupabaseManifestHelper as i, SupabaseHookManifest as n, SupabaseManifestRls as o, SupabaseManifestColumn as r, SupabaseManifestValue as s, SupabaseHookClaim as t };

package/dist/map-error-RJ3ZsUyA.js

@@ -1,16 +0,0 @@
-import { i as PermDockValidationError, n as PermDockDeniedError, r as PermDockRevokedError, t as PermDockApprovalRequiredError } from "./errors-Iy71s7Oj.js";
-import { o as problemResponse } from "./problem-Cgp9-KZA.js";
-import { r as InvalidSignatureError } from "./evaluations-DsAU9ppl.js";
-//#region src/server/map-error.ts
-/**
-* Turns a thrown PermDock error into its Problem Details response. Returns
-* `undefined` for anything else so the framework's own error path takes over.
-*/
-function problemFromError(error) {
-	if (error instanceof InvalidSignatureError) return error.response;
-	if (error instanceof PermDockDeniedError || error instanceof PermDockApprovalRequiredError) return problemResponse(error.toProblemDetails(), void 0, error.decision);
-	if (error instanceof PermDockRevokedError) return problemResponse(error.toProblemDetails(), void 0, error.decision);
-	if (error instanceof PermDockValidationError) return problemResponse(error.toProblemDetails());
-}
-//#endregion
-export { problemFromError as t };

package/dist/may-use-CnFEjVEp.js

@@ -1,37 +0,0 @@
-import { f as tenantOf, u as scopeList } from "./scopes-cKVp_WTw.js";
-import { u as coveredByDelegation } from "./snapshot-DE8dE_hz.js";
-//#region src/core/may-use.ts
-function delegationMayCover(permission, delegation, hasActor) {
-	return [void 0, ...[...delegation?.access ?? [], ...delegation?.authorizationDetails ?? []].flatMap((entry) => typeof entry === "object" && entry !== null && typeof entry["identifier"] === "string" ? [entry["identifier"]] : [])].some((id) => coveredByDelegation(permission, delegation, id, hasActor) === void 0);
-}
-function blocksEveryRow(grant) {
-	return grant.effect === "deny" && grant.where === void 0 && grant.check === void 0 && grant.portable !== false && grant.fields === void 0 && (grant.scope === void 0 || grant.scope === "tenant");
-}
-/**
-* Whether `permission` could be granted to this instance's subject for some
-* row: the grants its snapshot carries for the active tenant, minus an
-* unconditional deny, within its delegation. A listing hint for tools and
-* skills, never a decision; the call itself is decided in full.
-*/
-function mayUse(permdock, permission) {
-	try {
-		const snapshot = permdock.snapshot();
-		if (!("grants" in snapshot)) return false;
-		const ceiling = snapshot.delegated;
-		if (ceiling !== void 0 && !ceiling.includes(permission.key)) return false;
-		if (!delegationMayCover(permission, permdock.subject.delegation, permdock.subject.actor !== void 0 && ceiling === void 0)) return false;
-		const tenant = permdock.subject.principal?.tenant;
-		const scopes = scopeList(snapshot.scopes);
-		const grants = snapshot.grants.filter((grant) => {
-			if (grant.permission !== permission.key) return false;
-			const owner = grant.membership === void 0 ? void 0 : tenantOf(grant.membership, scopes);
-			return owner === void 0 || owner === tenant;
-		});
-		if (grants.some(blocksEveryRow)) return false;
-		return grants.some((grant) => grant.effect === "allow");
-	} catch {
-		return false;
-	}
-}
-//#endregion
-export { mayUse as t };