permdock 0.1.0 → 0.3.0

package/dist/drizzle/index.d.ts

@@ -1,6 +1,7 @@
-import { _r as Condition, hr as Subject, tn as WhereResult } from "../policy-CInmNGkM.js";
-import { n as WithSubjectOptions, r as RelationsMapping, t as RowCheck } from "../row-check-BajTgQZ-.js";
-import { t as MembershipsMapping } from "../compile-CQbvyIBr.js";
+import { Ir as Condition, Pr as Subject, mn as WhereResult } from "../policy-IB6yxpC3.js";
+import { r as RelationsMapping } from "../graph-sql-B-dsAT6j.js";
+import { s as MembershipsMapping } from "../compile-BkRyBDBw.js";
+import { n as WithSubjectOptions, t as RowCheck } from "../row-check-Dt35czLy.js";
 import { SQL, Table } from "drizzle-orm";
 //#region src/drizzle/types.d.ts
 /** A column of the Drizzle table `T` or an `SQL` expression; anything for a structural stand-in. */

package/dist/drizzle/index.js

@@ -1,7 +1,7 @@
 import { t as compact } from "../compact-y6vfu2_f.js";
-import { x as assertSafeKey } from "../permissions-DC7GROPA.js";
-import { n as escapeLike, t as compileWhere } from "../compile-D22iwvuV.js";
-import { i as rowCheckFrom, r as subjectStatements, t as statementTemplate } from "../subject-settings-xt7V845g.js";
+import { w as assertSafeKey } from "../permissions-DVoF6dMt.js";
+import { n as escapeLike, t as compileWhere } from "../compile-Ba4blROR.js";
+import { i as rowCheckFrom, r as subjectStatements, t as statementTemplate } from "../subject-settings-BwBmCdTR.js";
 //#region src/drizzle/to-where.ts
 function loadOperators(injected) {
 	if (injected !== void 0) return injected;

package/dist/elysia/index.d.ts

@@ -1,10 +1,8 @@
-import { $ as DecisionSink, C as Policy, E as PolicyVocabulary, Zt as PermDock, at as LimitStore, ct as MembershipSource, ft as RelationSource, mr as Principal, pt as RoleSource, sn as PolicySource, tt as EntitlementSource, xt as SnapshotSource } from "../policy-CInmNGkM.js";
-import { d as Permission } from "../permissions-B4apnahQ.js";
-import { f as ApprovalStore } from "../types-B8w5PFtS.js";
+import { C as Policy, D as PolicyVocabulary, Nr as Principal, ln as PermDock } from "../policy-IB6yxpC3.js";
+import { f as Permission } from "../permissions-DttnqqxC.js";
 import { n as RevocationFeed } from "../revocations-Cy06JNx2.js";
-import { o as OtelWrap } from "../types-B9dmiiab.js";
-import { r as PdpFactory } from "../types-BvBk1wgn.js";
-import { S as ConnectionOptions, b as Connection, g as discoverViaSignatureAgent, h as WebBotAuthVerifier, n as OpenApiHooks, o as TenantOption, r as ProtectOptions, u as InvalidSignatureError, y as verifyWebBotAuth } from "../create-BKF3dgFk.js";
+import { A as ConnectionOptions, O as Connection, h as InvalidSignatureError, i as ProtectOptions, n as OpenApiHooks, w as verifyWebBotAuth, x as discoverViaSignatureAgent } from "../create-B1d519XK.js";
+import { t as ServerAdapterOptions } from "../bind-C_ob3LKa.js";
 import { Elysia } from "elysia";
 //#region src/elysia/create.d.ts
 type ElysiaCtx = {
@@ -12,27 +10,7 @@ type ElysiaCtx = {
   readonly body?: unknown;
   readonly params?: Readonly<Record<string, string | undefined>>;
 };
-type ElysiaPermDockOptions<TUser = unknown> = {
-  readonly subject: (ctx: ElysiaCtx) => TUser | Promise<TUser>;
-  readonly tenant?: TenantOption<ElysiaCtx>;
-  readonly memberships?: MembershipSource | readonly MembershipSource[];
-  /** The object graph for relation grants that walk a parent chain; without it they deny. */
-  readonly relations?: RelationSource;
-  readonly entitlements?: EntitlementSource;
-  readonly customRoles?: RoleSource;
-  /** Hosted grants, read once per instance; see `PolicySource`. */
-  readonly policies?: PolicySource;
-  readonly store?: ApprovalStore;
-  readonly sink?: DecisionSink;
-  readonly limits?: LimitStore;
-  /** `createPermDock` from `permdock/pdp`; `protect` then decides delegated permissions remotely. */
-  readonly pdp?: PdpFactory;
-  /** Accepted for adapter parity; not read by this adapter. */
-  readonly snapshots?: SnapshotSource;
-  /** `(permdock) => withOtel(permdock, options)` from `permdock/otel`. */
-  readonly otel?: OtelWrap;
-  /** `(request) => verifyWebBotAuth(request, options)`; a verified bot becomes the actor. */
-  readonly webBotAuth?: WebBotAuthVerifier;
+type ElysiaPermDockOptions<TUser = unknown> = ServerAdapterOptions<ElysiaCtx, TUser> & {
   /** Ends or revalidates open sockets. */
   readonly revocations?: RevocationFeed;
 };
@@ -45,7 +23,7 @@ type ElysiaContext<V extends PolicyVocabulary = PolicyVocabulary> = ElysiaCtx &
   permdock: PermDock<V>;
   permdockData?: unknown;
 };
-type ElysiaProtect = (permission: Permission, loadData?: (ctx: ElysiaCtx) => unknown, protectOptions?: ProtectOptions) => (ctx: ElysiaCtx) => Promise<Response | undefined>;
+type ElysiaProtect = (permission: Permission | null, loadData?: (ctx: ElysiaCtx) => unknown, protectOptions?: ProtectOptions) => (ctx: ElysiaCtx) => Promise<Response | undefined>;
 /** The `permdock()` plugin: its global derive types `permdock` in every later handler. */
 type ElysiaPermDockPlugin<V extends PolicyVocabulary = PolicyVocabulary> = Elysia<"", {
   decorator: Record<never, never>;

package/dist/elysia/index.js

@@ -1,47 +1,13 @@
-import { t as compact } from "../compact-y6vfu2_f.js";
-import { i as discoverViaSignatureAgent, r as InvalidSignatureError, s as verifyWebBotAuth } from "../evaluations-DsAU9ppl.js";
-import { r as tenantScope, t as createKernel } from "../create-CSkhDU9T.js";
-import { t as problemFromError } from "../map-error-RJ3ZsUyA.js";
-import { i as onRevoked, t as POLICY_VIOLATION } from "../stream-Q_xlB6Ko.js";
+import { i as parsedBody, n as hasCredentials } from "../http-SO7qGttf.js";
+import { i as discoverViaSignatureAgent, r as InvalidSignatureError, s as verifyWebBotAuth } from "../evaluations-tz6D9A2G.js";
+import { t as problemFromError } from "../map-error-pgUWNNtG.js";
+import { a as socketConnection, i as decorate, r as bindKernel } from "../bind-CuzGytRf.js";
+import { i as onRevoked, t as POLICY_VIOLATION } from "../stream-DDpvynSB.js";
 import { Elysia } from "elysia";
 //#region src/elysia/create.ts
 function createPermDock(policy, options) {
-	const contexts = /* @__PURE__ */ new WeakMap();
-	const bound = /* @__PURE__ */ new WeakMap();
 	const seed = globalThis.crypto.randomUUID();
-	const kernel = createKernel(policy, compact({
-		subject: (request) => {
-			const ctx = contexts.get(request);
-			return ctx === void 0 ? null : options.subject(ctx);
-		},
-		memberships: options.memberships,
-		relations: options.relations,
-		entitlements: options.entitlements,
-		customRoles: options.customRoles,
-		policies: options.policies,
-		store: options.store,
-		sink: options.sink,
-		limits: options.limits,
-		pdp: options.pdp,
-		webBotAuth: options.webBotAuth,
-		revocations: options.revocations,
-		adapter: "elysia",
-		wrap: options.otel
-	}));
-	const bind = (ctx) => {
-		const hit = bound.get(ctx);
-		if (hit !== void 0) return hit;
-		const next = toRequest(ctx);
-		bound.set(ctx, next);
-		contexts.set(next, ctx);
-		return next;
-	};
-	const scopeOf = (ctx) => tenantScope(options.tenant, ctx);
-	const decorate = (ctx, instance, data) => {
-		const scoped = ctx;
-		scoped.permdock = instance;
-		if (data !== void 0) scoped.permdockData = data;
-	};
+	const { kernel, bind, scopeOf, handlerScope } = bindKernel(policy, options, "elysia", toRequest);
 	const permdock = () => new Elysia({
 		name: "permdock",
 		seed
@@ -49,31 +15,22 @@ function createPermDock(policy, options) {
 		const instance = await kernel.permdock(bind(ctx), await scopeOf(ctx));
 		decorate(ctx, instance);
 		return { permdock: instance };
-	}).onError({ as: "global" }, ({ error }) => problemFromError(error));
+	}).onError({ as: "global" }, ({ error, request }) => problemFromError(error, { credentials: hasCredentials(request) }));
 	const protect = (permission, loadData, protectOptions) => async (ctx) => {
 		const guard = await kernel.protect(permission, loadData === void 0 ? void 0 : () => loadData(ctx), protectOptions)(bind(ctx), await scopeOf(ctx));
 		if (!guard.ok) return guard.response;
 		decorate(ctx, guard.permdock, guard.data);
 	};
 	const sockets = /* @__PURE__ */ new WeakMap();
-	const connection = (ws, connectionOptions) => {
-		const hit = sockets.get(ws.data);
-		if (hit !== void 0) return hit;
-		const opened = (async () => {
-			const conn = await kernel.connection(bind(ws.data), connectionOptions, await scopeOf(ws.data));
-			onRevoked(conn, (problem) => {
-				ws.close(POLICY_VIOLATION, problem.type);
-			});
-			return conn;
-		})();
-		sockets.set(ws.data, opened);
-		return opened;
-	};
-	const permdockHandler = () => {
-		const { POST, GET } = kernel.permdockHandler((request) => {
-			const ctx = contexts.get(request);
-			return ctx === void 0 ? { tenant: void 0 } : scopeOf(ctx);
+	const connection = (ws, connectionOptions) => socketConnection(sockets, ws.data, async () => {
+		const conn = await kernel.connection(bind(ws.data), connectionOptions, await scopeOf(ws.data));
+		onRevoked(conn, (problem) => {
+			ws.close(POLICY_VIOLATION, problem.type);
 		});
+		return conn;
+	});
+	const permdockHandler = () => {
+		const { POST, GET } = kernel.permdockHandler(handlerScope);
 		return new Elysia({
 			name: "permdock-handler",
 			seed
@@ -91,8 +48,7 @@ function toRequest(ctx) {
 	const method = ctx.request.method;
 	if (method === "GET" || method === "HEAD" || ctx.body === void 0) return ctx.request;
 	const headers = new Headers(ctx.request.headers);
-	const body = typeof ctx.body === "string" ? ctx.body : JSON.stringify(ctx.body);
-	if (!headers.has("content-type")) headers.set("content-type", "application/json");
+	const body = parsedBody(ctx.body, headers) ?? null;
 	return new Request(ctx.request.url, {
 		method,
 		headers,

package/dist/{errors-DSMnAVNa.js → errors-CWfoNg9N.js}

@@ -10,8 +10,12 @@ var CliError = class extends Error {
 };
 const TITLES = {
 	usage: "Usage or configuration error",
-	unavailable: "A database or service the command needs did not answer"
+	unavailable: "A database or service the command needs did not answer",
+	failed: "The check the command ran found a problem"
 };
+function describeError(error) {
+	return error instanceof Error ? error.message : String(error);
+}
 /** An unclassified error is a usage error: a module that throws while loading is the project's to fix. */
 function cliErrorKind(error) {
 	return error instanceof CliError ? error.kind : "usage";
@@ -21,7 +25,7 @@ function exitCodeOf(kind) {
 }
 function cliProblem(kind, message, command) {
 	return {
-		type: `https://permdock.dev/problems/cli-${kind}`,
+		type: `https://permdock.com/problems/cli-${kind}`,
 		title: TITLES[kind],
 		detail: stripVTControlCharacters(message),
 		...command === void 0 ? {} : { command },
@@ -36,8 +40,8 @@ function usageResult(error) {
 	if (error instanceof CliError) throw error;
 	return {
 		code: 2,
-		output: error instanceof Error ? error.message : String(error)
+		output: describeError(error)
 	};
 }
 //#endregion
-export { usageResult as a, exitCodeOf as i, cliErrorKind as n, cliProblem as r, CliError as t };
+export { exitCodeOf as a, describeError as i, cliErrorKind as n, usageResult as o, cliProblem as r, CliError as t };

package/dist/{errors-Iy71s7Oj.js → errors-Cz5zn0mW.js}

@@ -1,32 +1,8 @@
 import { t as compact } from "./compact-y6vfu2_f.js";
+import { t as PROBLEM_BASE } from "./validation-error-CnjZ4t92.js";
+import { a as wireDenials, n as problemDetails } from "./problem-details-_AMOYz-w.js";
 import { n as deniedDigest, t as approvalDigest } from "./digest-BI-6aa6d.js";
-//#region src/core/wire-denial.ts
-const IN_PROCESS = /* @__PURE__ */ new Set(["closure-error", "validation"]);
-function jsonDetail(value) {
-	if (value === void 0 || value === null || value instanceof Error) return;
-	if (typeof value === "string" || typeof value === "boolean") return value;
-	if (typeof value === "number") return Number.isFinite(value) ? value : void 0;
-	if (typeof value !== "object") return;
-	try {
-		return JSON.parse(JSON.stringify(value));
-	} catch {
-		return;
-	}
-}
-function wireDenial(denial) {
-	return compact({
-		role: denial.role,
-		reason: denial.reason,
-		to: denial.to,
-		detail: IN_PROCESS.has(denial.reason) ? void 0 : jsonDetail(denial.detail)
-	});
-}
-function wireDenials(denials) {
-	return denials.map(wireDenial);
-}
-//#endregion
 //#region src/core/errors.ts
-const PROBLEM_BASE = "https://permdock.dev/problems";
 var PermDockDeniedError = class extends Error {
 	name = "PermDockDeniedError";
 	decision;
@@ -34,6 +10,8 @@ var PermDockDeniedError = class extends Error {
 	scope;
 	resource;
 	subject;
+	/** The resource's `disclosure` when the denied check carried a row; `'hide'` answers as `404`. */
+	disclosure;
 	/** `PERMDOCK_DENIED;<permission>`; survives the Server Component boundary (`parsePermDockDigest`). */
 	digest;
 	constructor(input) {
@@ -43,21 +21,20 @@ var PermDockDeniedError = class extends Error {
 		this.scope = input.scope;
 		this.resource = input.resource;
 		this.subject = input.subject;
+		if (input.disclosure !== void 0) this.disclosure = input.disclosure;
 		this.digest = deniedDigest(input.permission);
 	}
+	/** The same status matrix as `protect`: `401`, `404`, `429`, `503` or `403`. */
 	toProblemDetails(options) {
-		return compact({
-			type: `${PROBLEM_BASE}/denied`,
-			title: "Permission denied",
-			status: 403,
+		return problemDetails(compact({
+			decision: this.decision,
 			detail: this.message,
 			instance: options?.instance,
 			permission: this.permission,
 			scope: this.scope,
 			resource: this.resource,
-			denials: wireDenials(this.decision.denials),
-			alternatives: this.decision.alternatives.map((leaf) => leaf.key)
-		});
+			disclosure: options?.disclosure ?? this.disclosure
+		}));
 	}
 };
 var PermDockApprovalRequiredError = class extends Error {
@@ -81,45 +58,14 @@ var PermDockApprovalRequiredError = class extends Error {
 		this.digest = approvalDigest(input.permission, input.decision.token);
 	}
 	toProblemDetails(options) {
-		return compact({
-			type: `${PROBLEM_BASE}/approval-required`,
-			title: "Approval required",
-			status: 403,
+		return problemDetails(compact({
+			decision: this.decision,
 			detail: this.message,
 			instance: options?.instance,
 			permission: this.permission,
 			scope: this.scope,
-			resource: this.resource,
-			reason: this.reason,
-			token: this.token
-		});
-	}
-};
-var PermDockValidationError = class extends Error {
-	name = "PermDockValidationError";
-	code;
-	permission;
-	resource;
-	issues;
-	boundary;
-	constructor(input) {
-		super(input.message);
-		this.code = input.code;
-		this.permission = input.permission;
-		this.resource = input.resource;
-		this.issues = input.issues ?? [];
-		this.boundary = input.boundary;
-	}
-	toProblemDetails(options) {
-		return compact({
-			type: `${PROBLEM_BASE}/validation`,
-			title: "Invalid resource data",
-			status: 400,
-			detail: this.message,
-			instance: options?.instance,
-			permission: this.permission,
-			issues: this.issues
-		});
+			resource: this.resource
+		}));
 	}
 };
 /** The `name` of the deny grant a `deny` denial carries in `detail`, if any. */
@@ -127,13 +73,13 @@ function denyName(detail) {
 	if (detail === null || typeof detail !== "object" || !("name" in detail)) return;
 	return typeof detail.name === "string" ? detail.name : void 0;
 }
-function deniedMessage(permission, subjectId, denials, alternatives) {
+function deniedMessage(permission, subjectId, denials, alternatives, named = true) {
 	const clauses = denials.map((denial) => {
 		const name = denial.reason === "deny" ? denyName(denial.detail) : void 0;
 		return name === void 0 ? `${denial.role ?? "none"} (${denial.reason})` : `${denial.role ?? "none"} (${denial.reason} '${name}')`;
 	}).join(", ");
 	const alt = alternatives.length === 0 ? "" : ` Alternatives: ${alternatives.join(", ")}.`;
-	return `${permission} denied for subject ${subjectId ?? "anonymous"}: ${clauses}.${alt}`;
+	return `${permission} denied${named ? ` for subject ${subjectId ?? "anonymous"}` : ""}: ${clauses}.${alt}`;
 }
 function approvalMessage(permission, reason, token) {
 	return `${permission} requires human approval (${reason}). Token: ${token}.`;
@@ -174,4 +120,4 @@ var PermDockRevokedError = class extends Error {
 	}
 };
 //#endregion
-export { approvalMessage as a, PermDockValidationError as i, PermDockDeniedError as n, deniedMessage as o, PermDockRevokedError as r, wireDenials as s, PermDockApprovalRequiredError as t };
+export { deniedMessage as a, approvalMessage as i, PermDockDeniedError as n, PermDockRevokedError as r, PermDockApprovalRequiredError as t };

package/dist/{errors-DbZ1YOnb.d.ts → errors-DPdqI50v.d.ts}

@@ -1,4 +1,5 @@
-import { Mn as Decision, Pt as WireDenial, hr as Subject } from "./policy-CInmNGkM.js";
+import { Gt as WireDenial, Pr as Subject, Yn as Decision } from "./policy-IB6yxpC3.js";
+import { t as Disclosure } from "./problem-details-DX075l9V.js";
 import { StandardSchemaV1 } from "@standard-schema/spec";
 //#region src/core/errors.d.ts
 /** Where and how a human approves; carries no secret. */
@@ -42,6 +43,8 @@ declare class PermDockDeniedError extends Error {
     readonly id?: string;
   };
   readonly subject: Subject;
+  /** The resource's `disclosure` when the denied check carried a row; `'hide'` answers as `404`. */
+  readonly disclosure?: Disclosure;
   /** `PERMDOCK_DENIED;<permission>`; survives the Server Component boundary (`parsePermDockDigest`). */
   readonly digest: string;
   constructor(input: {
@@ -56,9 +59,12 @@ declare class PermDockDeniedError extends Error {
     };
     readonly subject: Subject;
     readonly message: string;
+    readonly disclosure?: Disclosure;
   });
+  /** The same status matrix as `protect`: `401`, `404`, `429`, `503` or `403`. */
   toProblemDetails(options?: {
     readonly instance?: string;
+    readonly disclosure?: Disclosure;
   }): ProblemDetails;
 }
 declare class PermDockApprovalRequiredError extends Error {
@@ -92,25 +98,6 @@ declare class PermDockApprovalRequiredError extends Error {
     readonly instance?: string;
   }): ProblemDetails;
 }
-declare class PermDockValidationError extends Error {
-  override readonly name: "PermDockValidationError";
-  readonly code: "invalid-data" | "async-schema" | "no-schema" | "non-portable-condition";
-  readonly permission: string;
-  readonly resource: string;
-  readonly issues: readonly StandardSchemaV1.Issue[];
-  readonly boundary: string;
-  constructor(input: {
-    readonly code: "invalid-data" | "async-schema" | "no-schema" | "non-portable-condition";
-    readonly permission: string;
-    readonly resource: string;
-    readonly issues?: readonly StandardSchemaV1.Issue[];
-    readonly boundary: string;
-    readonly message: string;
-  });
-  toProblemDetails(options?: {
-    readonly instance?: string;
-  }): ProblemDetails;
-}
 type RevokedCode = "session-revoked" | "expired" | "denied" | "subject-changed";
 /**
  * The `reason` of a long-lived connection's aborted `signal`. `denied` carries
@@ -135,4 +122,4 @@ declare class PermDockRevokedError extends Error {
   }): ProblemDetails;
 }
 //#endregion
-export { PermDockValidationError as a, PermDockRevokedError as i, PermDockApprovalRequiredError as n, ProblemDetails as o, PermDockDeniedError as r, RevokedCode as s, ApprovalHint as t };
+export { ProblemDetails as a, PermDockRevokedError as i, PermDockApprovalRequiredError as n, RevokedCode as o, PermDockDeniedError as r, ApprovalHint as t };

package/dist/{errors-m3u9TmDu.js → errors-DRnGZHzF.js}

@@ -17,6 +17,9 @@ const CODES = /* @__PURE__ */ new Set([
 	"approver-not-eligible",
 	"approver-repeated"
 ]);
+function isApprovalErrorCode(value) {
+	return typeof value === "string" && CODES.has(value);
+}
 /** Matches by `name` and `code`, so an error from another copy of the module still maps. */
 function isApprovalError(value) {
 	if (!(value instanceof Error) || value.name !== "ApprovalError") return false;
@@ -24,4 +27,4 @@ function isApprovalError(value) {
 	return typeof code === "string" && CODES.has(code);
 }
 //#endregion
-export { isApprovalError as n, ApprovalError as t };
+export { isApprovalError as n, isApprovalErrorCode as r, ApprovalError as t };

package/dist/evaluation-items-CfCCejQd.js

@@ -0,0 +1,40 @@
+import { _ as listPermissions, a as formerKeys, o as formerScopes } from "./permissions-DVoF6dMt.js";
+//#region src/server/evaluation-items.ts
+function firstWins(map, name, leaf) {
+	if (!map.has(name)) map.set(name, leaf);
+}
+/**
+* Indexes `tree` once. The lookup tries `action` as a permission key or
+* scope, then `<resource.type>.<action>`, then the leaf with that resource
+* and action; current names win over former ones and earlier leaves over
+* later ones. Anything else is `undefined`, which the caller denies.
+*/
+function permissionLookup(tree) {
+	const current = /* @__PURE__ */ new Map();
+	const former = /* @__PURE__ */ new Map();
+	const byPair = /* @__PURE__ */ new Map();
+	for (const leaf of listPermissions(tree)) {
+		firstWins(current, leaf.key, leaf);
+		firstWins(current, leaf.scope, leaf);
+		for (const name of [...formerKeys(leaf), ...formerScopes(leaf)]) firstWins(former, name, leaf);
+		firstWins(byPair, `${leaf.resource}\u0000${leaf.action}`, leaf);
+	}
+	const named = (name) => current.get(name) ?? former.get(name);
+	return (action, resource) => {
+		if (action === void 0) return;
+		const byKey = named(action);
+		if (byKey !== void 0) return byKey;
+		const type = typeof resource?.type === "string" ? resource.type : void 0;
+		if (type === void 0) return;
+		return named(`${type}.${action}`) ?? byPair.get(`${type}\u0000${action}`);
+	};
+}
+/** The row an item's resource describes: its `properties`, else `{ id }`. */
+function itemResourceData(resource) {
+	const properties = resource?.properties;
+	if (properties !== null && typeof properties === "object") return properties;
+	const id = resource?.id;
+	if (typeof id === "string" || typeof id === "number") return { id: String(id) };
+}
+//#endregion
+export { permissionLookup as n, itemResourceData as t };

package/dist/{evaluations-DsAU9ppl.js → evaluations-tz6D9A2G.js}

@@ -1,9 +1,22 @@
 import { t as compact } from "./compact-y6vfu2_f.js";
-import { g as listPermissions, i as findPermission } from "./permissions-DC7GROPA.js";
-import { s as wireDenials } from "./errors-Iy71s7Oj.js";
-import { i as readApprovalHeader, s as resumeDecision } from "./helpers-DnSOrhB9.js";
+import { t as PROBLEM_BASE } from "./validation-error-CnjZ4t92.js";
+import { a as wireDenials } from "./problem-details-_AMOYz-w.js";
+import { n as resourceRef } from "./resource-ref-CaS9yVPi.js";
+import { s as problemResponse, t as batchTooLarge, u as validationProblem } from "./problem-B43ztKIm.js";
+import { i as readApprovalHeader, s as resumeDecision } from "./helpers-H_KARDVC.js";
 import { t as timeoutSignal } from "./timeout-D51niuQP.js";
-import { l as validationProblem, n as batchTooLarge, o as problemResponse, t as PROBLEM_BASE } from "./problem-Cgp9-KZA.js";
+import { n as permissionLookup, t as itemResourceData } from "./evaluation-items-CfCCejQd.js";
+//#region src/core/decision.ts
+/** The denial for a check that failed or named no declared permission. */
+const NO_GRANT = Object.freeze({
+	outcome: "denied",
+	denials: Object.freeze([Object.freeze({
+		role: null,
+		reason: "no-grant"
+	})]),
+	alternatives: Object.freeze([])
+});
+//#endregion
 //#region src/server/web-bot-auth.ts
 /** Milliseconds a key directory fetch may take before the signature counts as unverifiable. */
 const DIRECTORY_TIMEOUT_MS = 5e3;
@@ -316,39 +329,8 @@ function decodeSfBytes(value) {
 }
 //#endregion
 //#region src/server/evaluations.ts
-const DENIED = {
-	outcome: "denied",
-	denials: [{
-		role: null,
-		reason: "no-grant"
-	}],
-	alternatives: []
-};
-function permissionOf(tree, item) {
-	const action = typeof item.action?.name === "string" ? item.action.name : void 0;
-	if (action === void 0) return;
-	const byKey = findPermission(tree, action);
-	if (byKey !== void 0) return byKey;
-	const resource = typeof item.resource?.type === "string" ? item.resource.type : void 0;
-	if (resource === void 0) return;
-	const dotted = findPermission(tree, `${resource}.${action}`);
-	if (dotted !== void 0) return dotted;
-	return listPermissions(tree).find((leaf) => leaf.resource === resource && leaf.action === action);
-}
-function resourceData(item) {
-	const properties = item.resource?.properties;
-	if (properties !== null && typeof properties === "object") return properties;
-	const id = item.resource?.id;
-	if (typeof id === "string" || typeof id === "number") return { id: String(id) };
-}
-function resourceRef(permission, item, data) {
-	const fromRow = data !== null && typeof data === "object" && "id" in data ? data.id : void 0;
-	const fromWire = item.resource?.id;
-	const id = typeof fromRow === "string" || typeof fromRow === "number" ? String(fromRow) : typeof fromWire === "string" || typeof fromWire === "number" ? String(fromWire) : void 0;
-	return compact({
-		type: permission.resource,
-		id
-	});
+function permissionOf(lookup, item) {
+	return lookup(typeof item.action?.name === "string" ? item.action.name : void 0, item.resource);
 }
 function evaluationRow(decision) {
 	switch (decision.outcome) {
@@ -387,13 +369,13 @@ function applyApprovalResume(decision, permission, permdock, store, request, res
 		store,
 		resource,
 		adapter,
-		token: readApprovalHeader(request.headers)
+		token: request === void 0 ? void 0 : readApprovalHeader(request.headers)
 	});
 }
-function evaluateOne(policy, permdock, item, store, header, adapter) {
-	const permission = permissionOf(policy.permissions, item);
-	if (permission === void 0) return Promise.resolve(DENIED);
-	const data = resourceData(item);
+function evaluateOne(lookup, permdock, item, store, header, adapter) {
+	const permission = permissionOf(lookup, item);
+	if (permission === void 0) return Promise.resolve(NO_GRANT);
+	const data = itemResourceData(item.resource);
 	const decide = permdock.decide;
 	const decision = decide(permission, data, compact({
 		source: "endpoint",
@@ -406,7 +388,7 @@ function evaluateOne(policy, permdock, item, store, header, adapter) {
 		permission,
 		subject: permdock.subject,
 		store,
-		resource: resourceRef(permission, item, data),
+		resource: resourceRef(permission, data, item.resource?.id),
 		adapter,
 		token: header,
 		consume: false
@@ -422,6 +404,7 @@ async function resolvePermdock(options, request, tenant) {
 }
 function createEvaluationsHandler(options) {
 	const adapter = options.adapter ?? "server";
+	const lookup = permissionLookup(options.policy.permissions);
 	const maxEvaluations = options.maxEvaluations ?? 256;
 	const POST = async (request) => {
 		let body;
@@ -444,8 +427,7 @@ function createEvaluationsHandler(options) {
 			throw error;
 		}
 		const rows = await Promise.all(evaluations.map(async (item) => {
-			const entry = item !== null && typeof item === "object" ? item : {};
-			return evaluationRow(await evaluateOne(options.policy, permdock, entry, options.store, header, adapter));
+			return evaluationRow(await evaluateOne(lookup, permdock, item !== null && typeof item === "object" ? item : {}, options.store, header, adapter));
 		}));
 		return Response.json({ evaluations: rows });
 	};
@@ -476,4 +458,4 @@ function createEvaluationsHandler(options) {
 	};
 }
 //#endregion
-export { invalidSignatureProblem as a, discoverViaSignatureAgent as i, createEvaluationsHandler as n, invalidSignatureResponse as o, InvalidSignatureError as r, verifyWebBotAuth as s, applyApprovalResume as t };
+export { invalidSignatureProblem as a, NO_GRANT as c, discoverViaSignatureAgent as i, createEvaluationsHandler as n, invalidSignatureResponse as o, InvalidSignatureError as r, verifyWebBotAuth as s, applyApprovalResume as t };

package/dist/eve/index.d.ts

@@ -1,7 +1,8 @@
-import { $ as DecisionSink, C as Policy, E as PolicyVocabulary, Zt as PermDock, at as LimitStore, ct as MembershipSource, ft as RelationSource, mr as Principal, pt as RoleSource, sn as PolicySource, tt as EntitlementSource, ur as Delegation, xt as SnapshotSource } from "../policy-CInmNGkM.js";
-import { d as Permission } from "../permissions-B4apnahQ.js";
-import { c as ApprovalRequest, f as ApprovalStore } from "../types-B8w5PFtS.js";
-import { t as ToolMap } from "../types-CxquUByI.js";
+import { C as Policy, D as PolicyVocabulary, Nr as Principal, kr as Delegation, ln as PermDock } from "../policy-IB6yxpC3.js";
+import { f as Permission } from "../permissions-DttnqqxC.js";
+import { c as ApprovalRequest, f as ApprovalStore } from "../types-aqOHTHcp.js";
+import { t as InstanceOptions } from "../instance-options-jARdwfPN.js";
+import { t as ToolMap } from "../types-Bvc4oWT6.js";
 //#region src/eve/create.d.ts
 /** Structural `SessionAuthContext` from `eve`. */
 type EvePrincipal = {
@@ -48,24 +49,14 @@ type EveContext = Pick<EveApprovalContext, "session" | "callId">;
 type EveApprovers = {
   readonly roles: readonly string[];
 } | ((responder: EvePrincipal, request: ApprovalRequest) => boolean);
-type EvePermDockOptions<TUser = unknown> = {
+type EvePermDockOptions<TUser = unknown> = InstanceOptions & {
   readonly subject?: (context: EveContext) => TUser | Promise<TUser>;
   readonly actor?: (context: EveContext) => unknown;
   readonly delegation?: (context: EveContext) => Delegation | undefined | Promise<Delegation | undefined>;
   readonly tenant?: string | ((context: EveContext) => string | undefined | Promise<string | undefined>);
   readonly tools: ToolMap;
   readonly approvers?: EveApprovers;
-  readonly memberships?: MembershipSource | readonly MembershipSource[];
-  /** The object graph for relation grants that walk a parent chain; without it they deny. */
-  readonly relations?: RelationSource;
-  readonly entitlements?: EntitlementSource;
-  readonly customRoles?: RoleSource;
-  /** Hosted grants, read once per instance; see `PolicySource`. */
-  readonly policies?: PolicySource;
   readonly store?: ApprovalStore;
-  readonly sink?: DecisionSink;
-  readonly limits?: LimitStore;
-  readonly snapshots?: SnapshotSource;
 };
 type EveRequestResult = "not-applicable" | "user-approval" | {
   readonly type: "denied";