permdock 0.1.0 → 0.2.0

package/dist/runtime-DP9ttFh1.js

@@ -1,27 +0,0 @@
-//#region src/svelte/protected.ts
-function protectedView(store, reference, data, tenant, _generation) {
-	const local = store.permissionState(reference, data);
-	return tenant === void 0 ? {
-		allowed: local.allowed,
-		status: local.status,
-		decision: local.decision,
-		slot: slotOf(local.allowed, local.status, local.decision)
-	} : tenantView(store.get().tenant(tenant), reference, data);
-}
-function tenantView(permdock, reference, data) {
-	const decision = permdock.decide(reference, data);
-	const allowed = decision.outcome === "granted";
-	return {
-		allowed,
-		status: "ready",
-		decision,
-		slot: slotOf(allowed, "ready", decision)
-	};
-}
-function slotOf(allowed, status, decision) {
-	if (status === "pending") return "pending";
-	if (!allowed || decision.outcome !== "granted") return "fallback";
-	return "default";
-}
-//#endregion
-export { protectedView as t };

package/dist/skills-Dx3QLnMY.js

@@ -1,110 +0,0 @@
-import { t as packageRoot } from "./package-root-zGkxO3oN.js";
-import { cpSync, existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
-import { dirname, join, resolve } from "node:path";
-import { createRequire } from "node:module";
-//#region src/cli/skills.ts
-const SKILL_NAMES = [
-	"permdock",
-	"permdock-wire",
-	"permdock-audit",
-	"permdock-agents",
-	"permdock-approvals",
-	"permdock-tenancy",
-	"permdock-data",
-	"permdock-credentials"
-];
-const AGENT_FOLDERS = {
-	agents: ".agents/skills",
-	claude: ".claude/skills",
-	cursor: ".cursor/skills"
-};
-/** The `--agent` names `skills install` knows, with the folder each writes. */
-const SKILL_AGENTS = AGENT_FOLDERS;
-/** Agents whose config folder (`.claude`, `.cursor`, `.agents`) the project already has. */
-function detectedAgents(cwd) {
-	return Object.entries(AGENT_FOLDERS).filter(([, folder]) => existsSync(join(cwd, dirname(folder)))).map(([agent]) => agent);
-}
-function runSkills(input) {
-	switch (input.action) {
-		case void 0:
-		case "install":
-		case "update": return runSkillsInstall({
-			cwd: input.cwd,
-			agents: input.agents
-		});
-		case "list": return listSkills(input.cwd);
-		default: return {
-			code: 2,
-			output: `unknown skills command '${input.action}'. Use install, list or update.`
-		};
-	}
-}
-function runSkillsInstall(input) {
-	const source = resolveSkillsRoot(input.cwd, input.bundled ?? join(packageRoot(), "skills"));
-	if (source === void 0) return {
-		code: 2,
-		output: "PermDock CLI: permdock package with skills/ not found. Add permdock as a dependency."
-	};
-	const version = readPermdockVersion(source);
-	const targets = resolveTargets(input.agents);
-	const copied = [];
-	for (const folder of targets) {
-		const destRoot = join(input.cwd, folder);
-		for (const name of SKILL_NAMES) {
-			const from = join(source, name);
-			if (!existsSync(from)) continue;
-			copyDir(from, join(destRoot, name));
-			copied.push(`${folder}/${name}`);
-		}
-	}
-	mkdirSync(join(input.cwd, ".permdock"), { recursive: true });
-	writeFileSync(join(input.cwd, ".permdock/skills-lock.json"), `${JSON.stringify({
-		version,
-		skills: [...SKILL_NAMES]
-	}, null, 2)}\n`);
-	return {
-		code: 0,
-		output: `installed ${copied.join(", ") || "no skills"} (permdock@${version})`
-	};
-}
-function listSkills(cwd) {
-	const lockPath = join(cwd, ".permdock/skills-lock.json");
-	const lock = existsSync(lockPath) ? JSON.parse(readFileSync(lockPath, "utf8")) : {};
-	const lines = ["permdock skills", ""];
-	for (const name of SKILL_NAMES) {
-		const places = Object.values(AGENT_FOLDERS).filter((folder) => existsSync(join(cwd, folder, name, "SKILL.md")));
-		lines.push(`  ${name}  ${places.length > 0 ? places.join(", ") : "not installed"}`);
-	}
-	if (lock.version !== void 0) lines.push("", `  lock ${lock.version}`);
-	return {
-		code: 0,
-		output: `${lines.join("\n")}\n`
-	};
-}
-function resolveTargets(agents) {
-	if (agents.length === 0) return Object.values(AGENT_FOLDERS);
-	return agents.map((agent) => {
-		const key = agent === "agent" ? "agents" : agent;
-		return AGENT_FOLDERS[key] ?? `.${key}/skills`;
-	});
-}
-function resolveSkillsRoot(cwd, bundled) {
-	try {
-		const pkg = createRequire(resolve(cwd, "package.json")).resolve("permdock/package.json");
-		const root = join(dirname(pkg), "skills");
-		if (existsSync(root)) return root;
-	} catch {}
-	const local = join(cwd, "node_modules/permdock/skills");
-	if (existsSync(local)) return local;
-	return existsSync(bundled) ? bundled : void 0;
-}
-function readPermdockVersion(skillsRoot) {
-	const pkg = join(dirname(skillsRoot), "package.json");
-	if (!existsSync(pkg)) return "0.0.0";
-	return JSON.parse(readFileSync(pkg, "utf8")).version;
-}
-function copyDir(from, to) {
-	cpSync(from, to, { recursive: true });
-}
-//#endregion
-export { runSkillsInstall as i, detectedAgents as n, runSkills as r, SKILL_AGENTS as t };

package/dist/source-DoBBYJi2.js

@@ -1,6 +0,0 @@
-//#region src/react/source.ts
-function isPromiseLike(value) {
-	return typeof value === "object" && value !== null && "then" in value && typeof value.then === "function";
-}
-//#endregion
-export { isPromiseLike as t };

package/dist/sources-DVHM3Mwq.js

@@ -1,284 +0,0 @@
-import { t as compact } from "./compact-y6vfu2_f.js";
-import { a as quoteSqlTable, i as quoteSqlLiteral, r as quoteSqlIdent } from "./sql-Bll1d7y0.js";
-//#region src/supabase/sources.ts
-const ident = (name) => quoteSqlIdent(name);
-const literal = quoteSqlLiteral;
-function qualifiedName(name) {
-	return name.includes(".") ? name : `public.${name}`;
-}
-function qualified(name) {
-	return quoteSqlTable(qualifiedName(name));
-}
-function col(name) {
-	return `m.${ident(name)}`;
-}
-function activeRow(row, id) {
-	const parts = [`s.${ident(row.id)}::text = (${id})::text`];
-	if (row.disabledAt !== void 0) parts.push(`s.${ident(row.disabledAt)} is null`);
-	if (row.status !== void 0) {
-		const values = row.active ?? [];
-		if (values.length === 0) throw new TypeError("PermDock: a suspension status column needs its active values");
-		parts.push(`s.${ident(row.status)}::text = any(array[${values.map(literal).join(", ")}]::text[])`);
-	}
-	if (row.disabledAt === void 0 && row.status === void 0) throw new TypeError("PermDock: a suspension table needs disabledAt or status");
-	return `exists (select 1 from ${qualified(row.table)} s where ${parts.join(" and ")})`;
-}
-function filters(shape, owner) {
-	const lines = [owner];
-	if (shape.expiresAt !== void 0) {
-		const expires = col(shape.expiresAt);
-		lines.push(`(${expires} is null or ${expires} > now())`);
-	}
-	const users = shape.suspension?.users;
-	if (users !== void 0) lines.push(activeRow(users, col(shape.user)));
-	for (const [name, row] of Object.entries(shape.suspension?.scopes ?? {})) {
-		const id = shape.idOf(name);
-		if (id !== void 0) lines.push(`(${id} is null or ${activeRow(row, id)})`);
-	}
-	return lines;
-}
-function selectOf(shape, where, user) {
-	const fields = [
-		...user ? [`${col(shape.user)}::text as user_id`] : [],
-		`${shape.scope} as scope`,
-		`${shape.id} as id`,
-		`${shape.within} as within`,
-		`${shape.roles} as roles`,
-		`${shape.via} as via`,
-		`${shape.expiresAt === void 0 ? "null::bigint" : `floor(extract(epoch from ${col(shape.expiresAt)}))::bigint`} as expires_at`,
-		`${shape.grantedBy} as granted_by`,
-		`${shape.reason} as reason`,
-		`${shape.memberGroup} as member_group`,
-		`${shape.managed} as managed_by`,
-		`${shape.seats} as seats`
-	];
-	const group = [...user ? [col(shape.user)] : [], ...shape.groupBy];
-	return `select ${fields.join(", ")}
-from ${qualified(shape.table)} m
-where ${where.join("\n  and ")}
-group by ${group.join(", ")}`;
-}
-function sqlOf(shape) {
-	const suspension = shape.suspension;
-	return compact({
-		table: shape.table,
-		user: shape.user,
-		userType: `${qualified(shape.table)}.${ident(shape.user)}%type`,
-		reads: [...new Set([suspension?.users, ...Object.values(suspension?.scopes ?? {})].flatMap((row) => row === void 0 ? [] : [row.table]))],
-		managed: shape.managedColumn,
-		columns: [...new Set(shape.columns)],
-		manifest: {
-			table: qualifiedName(shape.table),
-			...shape.manifest,
-			columns: [...new Set(shape.columns)]
-		},
-		select: (user) => selectOf(shape, filters(shape, `${col(shape.user)} = ${user}`), false),
-		list: () => selectOf(shape, filters(shape, `${shape.scope} = $1::text and ${shape.id} = $2::text`), true)
-	});
-}
-function rowsOf(result) {
-	return Array.isArray(result) ? result : result.rows;
-}
-function strings(value) {
-	return Array.isArray(value) ? value.filter((item) => typeof item === "string" && item !== "") : [];
-}
-function membershipOf(row) {
-	const roles = strings(row["roles"]);
-	if (typeof row["scope"] !== "string" || typeof row["id"] !== "string") return;
-	if (roles.length === 0) return;
-	const within = row["within"] !== null && typeof row["within"] === "object" && !Array.isArray(row["within"]) ? Object.fromEntries(Object.entries(row["within"]).filter((entry) => typeof entry[1] === "string")) : void 0;
-	const expires = typeof row["expires_at"] === "number" ? row["expires_at"] : typeof row["expires_at"] === "string" && row["expires_at"] !== "" ? Number(row["expires_at"]) : void 0;
-	const seats = strings(row["seats"]);
-	return compact({
-		scope: row["scope"],
-		id: row["id"],
-		within: within === void 0 || Object.keys(within).length === 0 ? void 0 : within,
-		roles: [...roles].toSorted(),
-		via: typeof row["via"] === "string" ? row["via"] : void 0,
-		expiresAt: Number.isFinite(expires) ? expires : void 0,
-		grantedBy: typeof row["granted_by"] === "string" && row["granted_by"] !== "" ? row["granted_by"] : void 0,
-		reason: typeof row["reason"] === "string" && row["reason"] !== "" ? row["reason"] : void 0,
-		member: typeof row["member_group"] === "string" && row["member_group"] !== "" ? { group: row["member_group"] } : void 0,
-		managedBy: row["managed_by"] === "idp" ? "idp" : void 0,
-		entitlements: seats.length === 0 ? void 0 : seats
-	});
-}
-function sourceOf(sql, query) {
-	const run = async (text, values) => {
-		if (query === void 0) throw new TypeError(`PermDock: the ${sql.table} membership source needs query to resolve memberships`);
-		return rowsOf(await query(text, values));
-	};
-	return {
-		sql,
-		async membershipsFor(principal) {
-			return (await run(sql.select("$1"), [principal.id])).flatMap((row) => {
-				const membership = membershipOf(row);
-				return membership === void 0 ? [] : [membership];
-			});
-		},
-		async list(scope) {
-			return (await run(sql.list(), [scope.scope, scope.id])).flatMap((row) => {
-				const membership = membershipOf(row);
-				return membership === void 0 || typeof row["user_id"] !== "string" ? [] : [{
-					principal: { id: row["user_id"] },
-					membership
-				}];
-			});
-		}
-	};
-}
-/**
-* Memberships from one table holding every scope: a row per user, scope,
-* instance and role (`user_id, scope, scope_id, role`), with optional
-* `within`, `via`, expiry, owner and seat columns. Rows of the same instance
-* merge into one membership.
-*/
-function fromTable(options) {
-	const c = options.columns ?? {};
-	const scope = `${col(c.scope ?? "scope")}::text`;
-	const id = `${col(c.id ?? "scope_id")}::text`;
-	const within = c.within === void 0 ? "null::jsonb" : col(c.within);
-	const optional = (name, cast) => name === void 0 ? `null::${cast}` : `${col(name)}::${cast}`;
-	return sourceOf(sqlOf({
-		table: options.table,
-		user: c.user ?? "user_id",
-		scope,
-		id,
-		within,
-		roles: `jsonb_agg(distinct ${col(c.role ?? "role")}::text order by ${col(c.role ?? "role")}::text)`,
-		via: optional(c.via, "text"),
-		expiresAt: c.expiresAt,
-		grantedBy: optional(c.grantedBy, "text"),
-		reason: optional(c.reason, "text"),
-		memberGroup: optional(c.group, "text"),
-		managed: optional(c.managedBy, "text"),
-		managedColumn: c.managedBy,
-		seats: c.seats === void 0 ? "null::jsonb" : `to_jsonb(${col(c.seats)})`,
-		idOf: (name) => `coalesce(case when ${scope} = ${literal(name)} then ${id} end${c.within === void 0 ? "" : `, ${within} ->> ${literal(name)}`})`,
-		groupBy: [
-			scope,
-			id,
-			...c.within === void 0 ? [] : [within],
-			...[
-				c.via,
-				c.expiresAt,
-				c.grantedBy,
-				c.reason,
-				c.group,
-				c.managedBy,
-				c.seats
-			].filter((name) => name !== void 0).map(col)
-		],
-		suspension: options.suspension,
-		columns: [
-			c.user ?? "user_id",
-			c.scope ?? "scope",
-			c.id ?? "scope_id",
-			c.role ?? "role",
-			...[
-				c.within,
-				c.via,
-				c.expiresAt
-			].filter((name) => name !== void 0)
-		],
-		manifest: compact({
-			user: { column: c.user ?? "user_id" },
-			scope: { column: c.scope ?? "scope" },
-			id: { column: c.id ?? "scope_id" },
-			role: { column: c.role ?? "role" },
-			within: c.within === void 0 ? void 0 : { column: c.within },
-			via: c.via === void 0 ? void 0 : { column: c.via },
-			expiresAt: c.expiresAt === void 0 ? void 0 : { column: c.expiresAt }
-		})
-	}), options.query);
-}
-/**
-* Memberships from a table of one scope (`customer_contacts`): every row is a
-* membership of `scope`, with roles from a column or fixed (`['contact']`), a
-* fixed `via`, and ancestor ids from `within` columns.
-*/
-function fromJunction(options) {
-	if (!/^[a-z][a-z0-9_]*$/u.test(options.scope)) throw new TypeError(`PermDock: unsafe scope name '${options.scope}'`);
-	const idColumn = options.id ?? `${options.scope}_id`;
-	const withinEntries = Object.entries(options.within ?? {});
-	const fixed = typeof options.roles === "string" ? void 0 : options.roles;
-	if (fixed?.length === 0) throw new TypeError("PermDock: fromJunction needs at least one role");
-	const managedColumn = options.managedBy === void 0 ? void 0 : options.managedBy === "idp" ? "" : options.managedBy.column;
-	const groupColumn = options.group === void 0 || typeof options.group === "string" ? void 0 : options.group.column;
-	const shape = {
-		table: options.table,
-		user: options.user ?? "user_id",
-		scope: `${literal(options.scope)}::text`,
-		id: `${col(idColumn)}::text`,
-		within: withinEntries.length === 0 ? "null::jsonb" : `jsonb_build_object(${withinEntries.map(([name, column]) => `${literal(name)}, ${col(column)}::text`).join(", ")})`,
-		roles: fixed === void 0 ? `jsonb_agg(distinct ${col(options.roles)}::text order by ${col(options.roles)}::text)` : `jsonb_build_array(${fixed.map(literal).join(", ")})`,
-		via: options.via === void 0 ? "null::text" : `${literal(options.via)}::text`,
-		expiresAt: options.expiresAt,
-		grantedBy: options.grantedBy === void 0 ? "null::text" : `${col(options.grantedBy)}::text`,
-		reason: options.reason === void 0 ? "null::text" : `${col(options.reason)}::text`,
-		memberGroup: options.group === void 0 ? "null::text" : typeof options.group === "string" ? `${literal(options.group)}::text` : `${col(options.group.column)}::text`,
-		managed: managedColumn === void 0 ? "null::text" : managedColumn === "" ? `'idp'::text` : `${col(managedColumn)}::text`,
-		managedColumn,
-		seats: options.seats === void 0 ? "null::jsonb" : `to_jsonb(${col(options.seats)})`,
-		idOf: (name) => {
-			if (name === options.scope) return `${col(idColumn)}::text`;
-			const column = options.within?.[name];
-			return column === void 0 ? void 0 : `${col(column)}::text`;
-		},
-		groupBy: [
-			col(idColumn),
-			...withinEntries.map(([, column]) => col(column)),
-			...[
-				options.expiresAt,
-				options.grantedBy,
-				options.reason,
-				groupColumn,
-				managedColumn === "" ? void 0 : managedColumn,
-				options.seats
-			].filter((name) => name !== void 0).map(col)
-		],
-		suspension: options.suspension,
-		columns: [
-			options.user ?? "user_id",
-			idColumn,
-			...withinEntries.map(([, column]) => column),
-			...[typeof options.roles === "string" ? options.roles : void 0, options.expiresAt].filter((name) => name !== void 0)
-		],
-		manifest: compact({
-			user: { column: options.user ?? "user_id" },
-			scope: { value: options.scope },
-			id: { column: idColumn },
-			role: typeof options.roles === "string" ? { column: options.roles } : { value: [...options.roles] },
-			within: withinEntries.length === 0 ? void 0 : { columns: Object.fromEntries(withinEntries) },
-			via: options.via === void 0 ? void 0 : { value: options.via },
-			expiresAt: options.expiresAt === void 0 ? void 0 : { column: options.expiresAt }
-		})
-	};
-	return sourceOf({
-		...sqlOf(shape),
-		scope: options.scope,
-		holds: [options.scope, ...withinEntries.map(([name]) => name)],
-		list: () => selectOf(shape, filters(shape, `$1::text = ${literal(options.scope)} and ${col(idColumn)}::text = $2::text`), true)
-	}, options.query);
-}
-const AUTHZ_VERSION_TABLE = "permdock_authz_version";
-/**
-* The default schema of everything PermDock generates: helpers, seeds, the
-* RBAC scaffold, the hook and the version table. Keep it out of the Data
-* API's exposed schemas, so the `security definer` functions are not RPCs.
-*/
-const PERMDOCK_SCHEMA = "permdock";
-/**
-* Reads the authorization version `permdock supabase hook generate` keeps in
-* `<schema>.permdock_authz_version`: pass it to `claimsFirst(sources, { version })`.
-*/
-function authzVersion(options) {
-	const table = qualified(`${options.schema ?? "permdock"}.${AUTHZ_VERSION_TABLE}`);
-	return async (principal) => {
-		const value = rowsOf(await options.query(`select version from ${table} where user_id = $1`, [principal.id]))[0]?.["version"];
-		const version = typeof value === "number" ? value : value === void 0 ? 0 : Number(value);
-		return Number.isFinite(version) ? version : void 0;
-	};
-}
-//#endregion
-export { fromTable as a, fromJunction as i, PERMDOCK_SCHEMA as n, authzVersion as r, AUTHZ_VERSION_TABLE as t };