permdock 0.3.0 → 0.4.0

package/dist/{map-claims-Z4QZOiFF.js → map-claims-AVlBaJoa.js}

@@ -1,7 +1,6 @@
-import { t as compact } from "./compact-y6vfu2_f.js";
+import { r as isRecord, t as compact } from "./compact-CAf557ZB.js";
 import { n as freezeDeep } from "./freeze-CrU8nQeX.js";
-import { O as readPath, T as isForbiddenKey } from "./permissions-DVoF6dMt.js";
-import { t as ignoreRejection } from "./thenable-okc2xDsj.js";
+import { l as readPath, o as isForbiddenKey, r as validateRecord } from "./thenable-QSmvt-vZ.js";
 import { t as anonymousSubject } from "./subject-C6dLxqHU.js";
 import { t as clientNameOf } from "./clients-DjU5ABMy.js";
 //#region src/jwt/map-claims.ts
@@ -72,13 +71,10 @@ function assuranceOf(claims, paths) {
 	});
 	return Object.keys(assurance).length === 0 ? void 0 : assurance;
 }
-function isPlainRecord(value) {
-	return value !== null && typeof value === "object" && !Array.isArray(value);
-}
 function hasForbiddenKey(value, depth = 0) {
 	if (depth > 16) return true;
 	if (Array.isArray(value)) return value.some((item) => hasForbiddenKey(item, depth + 1));
-	if (!isPlainRecord(value)) return false;
+	if (!isRecord(value)) return false;
 	return Object.keys(value).some((key) => isForbiddenKey(key) || hasForbiddenKey(value[key], depth + 1));
 }
 /**
@@ -86,7 +82,7 @@ function hasForbiddenKey(value, depth = 0) {
 * without `verification.trust_framework` and a `claims` object is dropped.
 */
 function verifiedClaimsOf(value) {
-	const verified = (Array.isArray(value) ? value : [value]).filter((entry) => isPlainRecord(entry) && isPlainRecord(entry["verification"]) && typeof entry["verification"]["trust_framework"] === "string" && isPlainRecord(entry["claims"]) && !hasForbiddenKey(entry));
+	const verified = (Array.isArray(value) ? value : [value]).filter((entry) => isRecord(entry) && isRecord(entry["verification"]) && typeof entry["verification"]["trust_framework"] === "string" && isRecord(entry["claims"]) && !hasForbiddenKey(entry));
 	return verified.length === 0 ? void 0 : freezeDeep(verified.map((entry) => ({
 		verification: entry.verification,
 		claims: entry.claims
@@ -242,15 +238,10 @@ function customClaims(claims, reserved) {
 	return out;
 }
 function validateCustomClaims(claims, schema) {
-	const result = schema["~standard"].validate(claims);
-	if (result instanceof Promise) {
-		ignoreRejection(result);
-		return { ok: false };
-	}
-	if ("issues" in result && result.issues !== void 0) return { ok: false };
-	return {
+	const value = validateRecord(schema, claims);
+	return value === void 0 ? { ok: false } : {
 		ok: true,
-		value: result.value
+		value
 	};
 }
 function mapClaimsToSubject(claims, options) {

package/dist/{map-error-pgUWNNtG.js → map-error-BE27PYkE.js}

@@ -1,8 +1,8 @@
-import { t as compact } from "./compact-y6vfu2_f.js";
-import { n as PermDockValidationError } from "./validation-error-CnjZ4t92.js";
-import { n as PermDockDeniedError, r as PermDockRevokedError, t as PermDockApprovalRequiredError } from "./errors-Cz5zn0mW.js";
-import { r as decisionResponse, s as problemResponse } from "./problem-B43ztKIm.js";
-import { r as InvalidSignatureError } from "./evaluations-tz6D9A2G.js";
+import { t as compact } from "./compact-CAf557ZB.js";
+import { n as PermDockValidationError } from "./validation-error-ZfUHbKvf.js";
+import { n as PermDockDeniedError, r as PermDockRevokedError, t as PermDockApprovalRequiredError } from "./errors-drnfxYtm.js";
+import { c as problemResponse, i as decisionResponse } from "./problem-CnWraVhC.js";
+import { r as InvalidSignatureError } from "./evaluations-C9YJsv3H.js";
 //#region src/server/map-error.ts
 /**
 * Turns a thrown PermDock error into its Problem Details response, with the

package/dist/{markers-B0hYLvMD.js → markers-CiwAOZtO.js}

@@ -1,4 +1,4 @@
-//#region src/cli/markers.ts
+//#region src/cli/sql/markers.ts
 const HOOK_MARKER = "-- permdock:hook v1";
 /** The first line of a `--grants-out` file. */
 const GRANTS_MARKER = "-- permdock:grants v1";
@@ -6,6 +6,10 @@ const GRANTS_MARKER = "-- permdock:grants v1";
 const SEEDS_MARKER = "-- permdock:seeds v1";
 /** The first line of the `indexes` part: the indexes the policies and helpers read through. */
 const INDEXES_MARKER = "-- permdock:indexes v1";
+/** The first line of a `--backfill-out` migration: existing custom roles copied into the custom-role tables. */
+const BACKFILL_MARKER = "-- permdock:backfill v1";
+/** The first line of a `rls migrate --retire-out` migration: a materialised permissions table and its refresh triggers dropped. */
+const RETIRE_MARKER = "-- permdock:retire v1";
 const HOOK_LINE = /^-- permdock:hook v(?<version>[1-9]\d*)(?: (?<rest>.*))?$/u;
 const GRANTS_LINE = /^-- permdock:grants v(?<version>[1-9]\d*)(?: (?<rest>.*))?$/u;
 function firstLine(sql) {
@@ -57,4 +61,4 @@ function parseGrantsMarker(sql) {
 	});
 }
 //#endregion
-export { hookMarkerFields as a, SEEDS_MARKER as i, HOOK_MARKER as n, parseGrantsMarker as o, INDEXES_MARKER as r, parseHookMarker as s, GRANTS_MARKER as t };
+export { RETIRE_MARKER as a, parseGrantsMarker as c, INDEXES_MARKER as i, parseHookMarker as l, GRANTS_MARKER as n, SEEDS_MARKER as o, HOOK_MARKER as r, hookMarkerFields as s, BACKFILL_MARKER as t };

package/dist/{may-use-DndQ5tQ-.js → may-use-BOn_dR_w.js}

@@ -1,6 +1,7 @@
-import { d as scopeList, m as tenantOf, o as resolveScope } from "./scopes-CVdPrWN-.js";
-import { a as isMembershipExpired, t as isActive, u as nowSeconds } from "./validity-uOp8UpYn.js";
-import { t as coveredByDelegation } from "./delegation-D8pUEuce.js";
+import { d as scopeList, m as tenantOf, o as resolveScope } from "./scopes-tvpa34ep.js";
+import { s as coveredByDelegation } from "./snapshot-Dc9CHPME.js";
+import { t as isActive } from "./validity-dVrUEPJt.js";
+import { c as nowSeconds, r as isMembershipExpired } from "./tenancy-DshjqY0n.js";
 //#region src/core/may-use.ts
 function delegationMayCover(permission, delegation, hasActor) {
 	return [void 0, ...[...delegation?.access ?? [], ...delegation?.authorizationDetails ?? []].flatMap((entry) => typeof entry === "object" && entry !== null && typeof entry["identifier"] === "string" ? [entry["identifier"]] : [])].some((id) => coveredByDelegation(permission, delegation, id, hasActor) === void 0);

package/dist/mcp/index.d.ts

@@ -1,11 +1,14 @@
-import { C as Policy, Nr as Principal, Pr as Subject } from "../policy-IB6yxpC3.js";
-import { f as Permission } from "../permissions-DttnqqxC.js";
-import { f as ApprovalStore } from "../types-aqOHTHcp.js";
-import { t as ApprovalHint } from "../errors-DPdqI50v.js";
-import { t as InstanceOptions } from "../instance-options-jARdwfPN.js";
+import { E as Policy, Or as Principal, kr as Subject } from "../policy-types-sp9P1iIV.js";
+import { d as Permission } from "../permission-types-Dg39z9Kv.js";
+import { f as ApprovalStore } from "../types-Br9IXUBG.js";
+import { t as ApprovalHint } from "../errors-OD_4c__H.js";
+import { t as InstanceOptions } from "../instance-options-plkrsAog.js";
+import { n as OnDeniedText, t as DeniedTextEvent } from "../denied-text-DfRk15uw.js";
+import { t as RequestContext } from "../request-context-C2_1lchh.js";
+import { n as PermDockWrap } from "../wrap-Cr93qqdP.js";
 import { t as ClientNames } from "../clients-C7zLFuWT.js";
-import { u as JwtSubjectOptions } from "../types-Cq_H8N_X.js";
-import { o as OtelWrap } from "../types-QCuYJh4q.js";
+import { u as JwtSubjectOptions } from "../types-C0dee0Qf.js";
+import { o as OtelWrap } from "../types-CUcFZfpU.js";
 import { CacheHint, Icon, McpServer, PromptCallback, ReadResourceCallback, ReadResourceTemplateCallback, RegisteredPrompt, RegisteredResource, RegisteredResourceTemplate, RegisteredTool, ResourceMetadata, ResourceTemplate, ScopeChallengeHandler, StandardSchemaWithJSON, ToolAnnotations, ToolCallback, Variables } from "@modelcontextprotocol/server";
 //#region src/mcp/types.d.ts
 /** The verified `AuthInfo` the MCP SDK's bearer auth puts on `ctx.http.authInfo`. */
@@ -125,6 +128,18 @@ type McpPermDockOptions<TUser = unknown> = InstanceOptions & {
   readonly store?: ApprovalStore;
   /** `(permdock) => withOtel(permdock, options)` from `permdock/otel`. */
   readonly otel?: OtelWrap;
+  /** Wraps each instance after `otel`; build it with `wrapPermDock` to cover derived instances. */
+  readonly wrap?: PermDockWrap;
+  /**
+   * Request values merged into `subject.context`, under `policy.context`.
+   * Read them from the verified `authInfo`, never from tool arguments.
+   */
+  readonly context?: (authInfo: McpAuthInfo) => RequestContext | undefined | Promise<RequestContext | undefined>;
+  /**
+   * Replaces the text of a refusal. `isError`, `structuredContent` and the
+   * approval shape stay as PermDock built them.
+   */
+  readonly onDenied?: OnDeniedText;
 };
 type McpPermDock = {
   /** Call before registering anything: later `register*` calls must carry a `permission`. */
@@ -135,9 +150,11 @@ type McpPermDock = {
 };
 //#endregion
 //#region src/mcp/create.d.ts
+export declare function createPermDock<TUser, TPrincipal extends Principal = Principal>(policy: Policy<TUser, TPrincipal>, options: McpPermDockOptions<TUser>): McpPermDock;
+//#endregion
+//#region src/mcp/mcp-auth.d.ts
 /** `_meta` key on `tools/call`, `resources/read` and `prompts/get` carrying an approval token. */
 export declare const APPROVAL_META_KEY = "dev.permdock/approval";
-export declare function createPermDock<TUser, TPrincipal extends Principal = Principal>(policy: Policy<TUser, TPrincipal>, options: McpPermDockOptions<TUser>): McpPermDock;
 //#endregion
 //#region src/mcp/subject.d.ts
 type McpSubjectOptions = Pick<JwtSubjectOptions, "claims" | "groupRoles" | "schema" | "delegation"> & {
@@ -156,4 +173,4 @@ type McpSubjectOptions = Pick<JwtSubjectOptions, "claims" | "groupRoles" | "sche
  */
 export declare function subjectFromMcp(authInfo: McpAuthInfo | undefined, options?: McpSubjectOptions): Subject<McpPrincipal>;
 //#endregion
-export type { GuardedMcpServer, McpAuthInfo, McpPermDock, McpPermDockOptions, McpPrincipal, McpProcedureEnforcement, McpProcedureToolConfig, McpPromptConfig, McpResourceConfig, McpSubjectOptions, McpToolConfig, ProcedureMcpServer };
+export type { DeniedTextEvent, GuardedMcpServer, McpAuthInfo, McpPermDock, McpPermDockOptions, McpPrincipal, McpProcedureEnforcement, McpProcedureToolConfig, McpPromptConfig, McpResourceConfig, McpSubjectOptions, McpToolConfig, OnDeniedText, ProcedureMcpServer };