permdock 0.3.0 → 0.4.0

package/dist/drizzle/index.d.ts

@@ -1,6 +1,6 @@
-import { Ir as Condition, Pr as Subject, mn as WhereResult } from "../policy-IB6yxpC3.js";
+import { It as WhereResult, jr as Condition, kr as Subject } from "../policy-types-sp9P1iIV.js";
 import { r as RelationsMapping } from "../graph-sql-B-dsAT6j.js";
-import { s as MembershipsMapping } from "../compile-BkRyBDBw.js";
+import { s as MembershipsMapping } from "../compile-CtTP7eur.js";
 import { n as WithSubjectOptions, t as RowCheck } from "../row-check-Dt35czLy.js";
 import { SQL, Table } from "drizzle-orm";
 //#region src/drizzle/types.d.ts

package/dist/drizzle/index.js

@@ -1,17 +1,11 @@
-import { t as compact } from "../compact-y6vfu2_f.js";
-import { w as assertSafeKey } from "../permissions-DVoF6dMt.js";
-import { n as escapeLike, t as compileWhere } from "../compile-Ba4blROR.js";
-import { i as rowCheckFrom, r as subjectStatements, t as statementTemplate } from "../subject-settings-BwBmCdTR.js";
+import { t as compact } from "../compact-CAf557ZB.js";
+import { a as assertSafeKey } from "../thenable-QSmvt-vZ.js";
+import { n as escapeLike, t as compileWhere } from "../compile-CcEu2ZQ1.js";
+import { a as rowCheckFrom, i as templateOf, r as subjectStatements, s as loadPeer, t as statementTemplate } from "../subject-settings-CkEwrw3W.js";
 //#region src/drizzle/to-where.ts
 function loadOperators(injected) {
 	if (injected !== void 0) return injected;
-	const loader = globalThis.process?.getBuiltinModule?.("node:module");
-	try {
-		if (loader === void 0) throw new Error("no module loader");
-		return loader.createRequire(import.meta.url)("drizzle-orm");
-	} catch {
-		throw new Error("PermDock: permdock/drizzle requires the drizzle-orm peer; pass `operators` on runtimes without require");
-	}
+	return loadPeer("drizzle-orm", "PermDock: permdock/drizzle requires the drizzle-orm peer; pass `operators` on runtimes without require");
 }
 function ident(name) {
 	assertSafeKey(name, "sql identifier");
@@ -38,9 +32,7 @@ function tagged(parts, ops) {
 		values.push(part.value);
 		strings.push("");
 	}
-	const template = strings;
-	Object.defineProperty(template, "raw", { value: strings });
-	return ops.sql(template, ...values);
+	return ops.sql(templateOf(strings), ...values);
 }
 function existsSql(node, table, options, ops) {
 	const m = (name) => `m.${ident(name)}`;

package/dist/elysia/index.d.ts

@@ -1,8 +1,8 @@
-import { C as Policy, D as PolicyVocabulary, Nr as Principal, ln as PermDock } from "../policy-IB6yxpC3.js";
-import { f as Permission } from "../permissions-DttnqqxC.js";
+import { E as Policy, Or as Principal, j as PolicyVocabulary, jt as PermDock } from "../policy-types-sp9P1iIV.js";
+import { d as Permission } from "../permission-types-Dg39z9Kv.js";
 import { n as RevocationFeed } from "../revocations-Cy06JNx2.js";
-import { A as ConnectionOptions, O as Connection, h as InvalidSignatureError, i as ProtectOptions, n as OpenApiHooks, w as verifyWebBotAuth, x as discoverViaSignatureAgent } from "../create-B1d519XK.js";
-import { t as ServerAdapterOptions } from "../bind-C_ob3LKa.js";
+import { A as ConnectionOptions, C as verifyWebBotAuth, O as Connection, b as discoverViaSignatureAgent, i as OpenApiHooks, m as InvalidSignatureError, o as ProtectOptions } from "../server-types-DdqBwZN_.js";
+import { t as ServerAdapterOptions } from "../bind-BzqG8SMb.js";
 import { Elysia } from "elysia";
 //#region src/elysia/create.d.ts
 type ElysiaCtx = {

package/dist/elysia/index.js

@@ -1,13 +1,13 @@
-import { i as parsedBody, n as hasCredentials } from "../http-SO7qGttf.js";
-import { i as discoverViaSignatureAgent, r as InvalidSignatureError, s as verifyWebBotAuth } from "../evaluations-tz6D9A2G.js";
-import { t as problemFromError } from "../map-error-pgUWNNtG.js";
-import { a as socketConnection, i as decorate, r as bindKernel } from "../bind-CuzGytRf.js";
-import { i as onRevoked, t as POLICY_VIOLATION } from "../stream-DDpvynSB.js";
+import { a as parsedBody, r as hasCredentials } from "../http-BBoKefeS.js";
+import { i as discoverViaSignatureAgent, r as InvalidSignatureError, s as verifyWebBotAuth } from "../evaluations-C9YJsv3H.js";
+import { t as problemFromError } from "../map-error-BE27PYkE.js";
+import { a as socketConnection, i as decorate, r as bindKernel } from "../bind-kk-uyCwH.js";
+import { i as onRevoked, t as POLICY_VIOLATION } from "../stream-BMui98KK.js";
 import { Elysia } from "elysia";
 //#region src/elysia/create.ts
 function createPermDock(policy, options) {
 	const seed = globalThis.crypto.randomUUID();
-	const { kernel, bind, scopeOf, handlerScope } = bindKernel(policy, options, "elysia", toRequest);
+	const { kernel, bind, scopeOf, handlerScope, guard: runGuard } = bindKernel(policy, options, "elysia", toRequest);
 	const permdock = () => new Elysia({
 		name: "permdock",
 		seed
@@ -17,7 +17,7 @@ function createPermDock(policy, options) {
 		return { permdock: instance };
 	}).onError({ as: "global" }, ({ error, request }) => problemFromError(error, { credentials: hasCredentials(request) }));
 	const protect = (permission, loadData, protectOptions) => async (ctx) => {
-		const guard = await kernel.protect(permission, loadData === void 0 ? void 0 : () => loadData(ctx), protectOptions)(bind(ctx), await scopeOf(ctx));
+		const guard = await runGuard(permission, loadData, ctx, protectOptions);
 		if (!guard.ok) return guard.response;
 		decorate(ctx, guard.permdock, guard.data);
 	};

package/dist/{errors-DPdqI50v.d.ts → errors-OD_4c__H.d.ts}

@@ -1,5 +1,5 @@
-import { Gt as WireDenial, Pr as Subject, Yn as Decision } from "./policy-IB6yxpC3.js";
-import { t as Disclosure } from "./problem-details-DX075l9V.js";
+import { En as WireDenial, ir as Decision, kr as Subject } from "./policy-types-sp9P1iIV.js";
+import { t as Disclosure } from "./problem-details-rIIo8B2C.js";
 import { StandardSchemaV1 } from "@standard-schema/spec";
 //#region src/core/errors.d.ts
 /** Where and how a human approves; carries no secret. */

package/dist/{errors-Cz5zn0mW.js → errors-drnfxYtm.js}

@@ -1,6 +1,6 @@
-import { t as compact } from "./compact-y6vfu2_f.js";
-import { t as PROBLEM_BASE } from "./validation-error-CnjZ4t92.js";
-import { a as wireDenials, n as problemDetails } from "./problem-details-_AMOYz-w.js";
+import { t as compact } from "./compact-CAf557ZB.js";
+import { t as PROBLEM_BASE } from "./validation-error-ZfUHbKvf.js";
+import { a as wireDenials, n as problemDetails } from "./problem-details-DECUnXAn.js";
 import { n as deniedDigest, t as approvalDigest } from "./digest-BI-6aa6d.js";
 //#region src/core/errors.ts
 var PermDockDeniedError = class extends Error {

package/dist/{evaluations-tz6D9A2G.js → evaluations-C9YJsv3H.js}

@@ -1,11 +1,11 @@
-import { t as compact } from "./compact-y6vfu2_f.js";
-import { t as PROBLEM_BASE } from "./validation-error-CnjZ4t92.js";
-import { a as wireDenials } from "./problem-details-_AMOYz-w.js";
+import { t as compact } from "./compact-CAf557ZB.js";
+import { t as PROBLEM_BASE } from "./validation-error-ZfUHbKvf.js";
+import { a as wireDenials } from "./problem-details-DECUnXAn.js";
+import { c as listPermissions, g as formerScopes, h as formerKeys } from "./permission-registry-BsblpB-z.js";
 import { n as resourceRef } from "./resource-ref-CaS9yVPi.js";
-import { s as problemResponse, t as batchTooLarge, u as validationProblem } from "./problem-B43ztKIm.js";
-import { i as readApprovalHeader, s as resumeDecision } from "./helpers-H_KARDVC.js";
+import { c as problemResponse, d as validationProblem, n as batchTooLarge } from "./problem-CnWraVhC.js";
+import { i as readApprovalHeader, s as resumeDecision } from "./helpers-C9YmyBIa.js";
 import { t as timeoutSignal } from "./timeout-D51niuQP.js";
-import { n as permissionLookup, t as itemResourceData } from "./evaluation-items-CfCCejQd.js";
 //#region src/core/decision.ts
 /** The denial for a check that failed or named no declared permission. */
 const NO_GRANT = Object.freeze({
@@ -17,6 +17,44 @@ const NO_GRANT = Object.freeze({
 	alternatives: Object.freeze([])
 });
 //#endregion
+//#region src/server/evaluation-items.ts
+function firstWins(map, name, leaf) {
+	if (!map.has(name)) map.set(name, leaf);
+}
+/**
+* Indexes `tree` once. The lookup tries `action` as a permission key or
+* scope, then `<resource.type>.<action>`, then the leaf with that resource
+* and action; current names win over former ones and earlier leaves over
+* later ones. Anything else is `undefined`, which the caller denies.
+*/
+function permissionLookup(tree) {
+	const current = /* @__PURE__ */ new Map();
+	const former = /* @__PURE__ */ new Map();
+	const byPair = /* @__PURE__ */ new Map();
+	for (const leaf of listPermissions(tree)) {
+		firstWins(current, leaf.key, leaf);
+		firstWins(current, leaf.scope, leaf);
+		for (const name of [...formerKeys(leaf), ...formerScopes(leaf)]) firstWins(former, name, leaf);
+		firstWins(byPair, `${leaf.resource}\u0000${leaf.action}`, leaf);
+	}
+	const named = (name) => current.get(name) ?? former.get(name);
+	return (action, resource) => {
+		if (action === void 0) return;
+		const byKey = named(action);
+		if (byKey !== void 0) return byKey;
+		const type = typeof resource?.type === "string" ? resource.type : void 0;
+		if (type === void 0) return;
+		return named(`${type}.${action}`) ?? byPair.get(`${type}\u0000${action}`);
+	};
+}
+/** The row an item's resource describes: its `properties`, else `{ id }`. */
+function itemResourceData(resource) {
+	const properties = resource?.properties;
+	if (properties !== null && typeof properties === "object") return properties;
+	const id = resource?.id;
+	if (typeof id === "string" || typeof id === "number") return { id: String(id) };
+}
+//#endregion
 //#region src/server/web-bot-auth.ts
 /** Milliseconds a key directory fetch may take before the signature counts as unverifiable. */
 const DIRECTORY_TIMEOUT_MS = 5e3;
@@ -458,4 +496,4 @@ function createEvaluationsHandler(options) {
 	};
 }
 //#endregion
-export { invalidSignatureProblem as a, NO_GRANT as c, discoverViaSignatureAgent as i, createEvaluationsHandler as n, invalidSignatureResponse as o, InvalidSignatureError as r, verifyWebBotAuth as s, applyApprovalResume as t };
+export { invalidSignatureProblem as a, itemResourceData as c, discoverViaSignatureAgent as i, permissionLookup as l, createEvaluationsHandler as n, invalidSignatureResponse as o, InvalidSignatureError as r, verifyWebBotAuth as s, applyApprovalResume as t, NO_GRANT as u };

package/dist/eve/index.d.ts

@@ -1,8 +1,8 @@
-import { C as Policy, D as PolicyVocabulary, Nr as Principal, kr as Delegation, ln as PermDock } from "../policy-IB6yxpC3.js";
-import { f as Permission } from "../permissions-DttnqqxC.js";
-import { c as ApprovalRequest, f as ApprovalStore } from "../types-aqOHTHcp.js";
-import { t as InstanceOptions } from "../instance-options-jARdwfPN.js";
-import { t as ToolMap } from "../types-Bvc4oWT6.js";
+import { E as Policy, Or as Principal, j as PolicyVocabulary, jt as PermDock, wr as Delegation } from "../policy-types-sp9P1iIV.js";
+import { d as Permission } from "../permission-types-Dg39z9Kv.js";
+import { c as ApprovalRequest, f as ApprovalStore } from "../types-Br9IXUBG.js";
+import { t as InstanceOptions } from "../instance-options-plkrsAog.js";
+import { t as ToolMap } from "../types-DvupZE0w.js";
 //#region src/eve/create.d.ts
 /** Structural `SessionAuthContext` from `eve`. */
 type EvePrincipal = {

package/dist/eve/index.js

@@ -1,9 +1,9 @@
-import { t as compact } from "../compact-y6vfu2_f.js";
+import { t as compact } from "../compact-CAf557ZB.js";
 import { n as isApprovalError } from "../errors-DRnGZHzF.js";
-import { r as memoryApprovalStore } from "../store-DMAWwAJV.js";
-import { o as resolveApproval } from "../helpers-H_KARDVC.js";
-import { t as instanceOptions } from "../instance-options-Dhhcnm3y.js";
-import { n as createAgentKernel } from "../kernel-_RRHmnMY.js";
+import { r as memoryApprovalStore } from "../store-ILkLUj_o.js";
+import { o as resolveApproval } from "../helpers-C9YmyBIa.js";
+import { r as instanceOptions } from "../build-instance-DIIV9DbC.js";
+import { n as createAgentKernel } from "../kernel-CB3LrIJM.js";
 import { t as boundedMap } from "../lru-8q4WZjBV.js";
 //#region src/eve/create.ts
 const TOKENS_PER_PROCESS = 1e3;

package/dist/express/index.d.ts

@@ -1,7 +1,7 @@
-import { C as Policy, D as PolicyVocabulary, Nr as Principal, ln as PermDock } from "../policy-IB6yxpC3.js";
-import { f as Permission } from "../permissions-DttnqqxC.js";
-import { h as InvalidSignatureError, i as ProtectOptions, n as OpenApiHooks, w as verifyWebBotAuth, x as discoverViaSignatureAgent } from "../create-B1d519XK.js";
-import { t as ServerAdapterOptions } from "../bind-C_ob3LKa.js";
+import { E as Policy, Or as Principal, j as PolicyVocabulary, jt as PermDock } from "../policy-types-sp9P1iIV.js";
+import { d as Permission } from "../permission-types-Dg39z9Kv.js";
+import { C as verifyWebBotAuth, b as discoverViaSignatureAgent, i as OpenApiHooks, m as InvalidSignatureError, o as ProtectOptions } from "../server-types-DdqBwZN_.js";
+import { t as ServerAdapterOptions } from "../bind-BzqG8SMb.js";
 import { a as toRequest, i as sendResponse } from "../http-DPuDaChb.js";
 import { ErrorRequestHandler, Request, RequestHandler, Response, Router } from "express";
 //#region src/express/create.d.ts

package/dist/express/index.js

@@ -1,14 +1,15 @@
-import { i as discoverViaSignatureAgent, r as InvalidSignatureError, s as verifyWebBotAuth } from "../evaluations-tz6D9A2G.js";
-import { t as problemFromError } from "../map-error-pgUWNNtG.js";
-import { i as decorate, r as bindKernel } from "../bind-CuzGytRf.js";
-import { i as toRequest, r as sendResponse } from "../http-BIhmLfCc.js";
+import { r as hasCredentials } from "../http-BBoKefeS.js";
+import { i as discoverViaSignatureAgent, r as InvalidSignatureError, s as verifyWebBotAuth } from "../evaluations-C9YJsv3H.js";
+import { t as problemFromError } from "../map-error-BE27PYkE.js";
+import { i as decorate, r as bindKernel } from "../bind-kk-uyCwH.js";
+import { i as toRequest, r as sendResponse } from "../http-BEbdMZ05.js";
 import express from "express";
 //#region src/express/create.ts
 function run(work, next) {
 	work().catch(next);
 }
 function sendProblem(err, req, res, next) {
-	const problem = problemFromError(err, { credentials: req.headers.authorization !== void 0 });
+	const problem = problemFromError(err, { credentials: hasCredentials(req) });
 	if (problem === void 0) {
 		next(err);
 		return;
@@ -32,7 +33,7 @@ const withPermDock = (fn) => (req, res, next) => {
 	}, next);
 };
 function createPermDock(policy, options) {
-	const { kernel, bind, rebind, scopeOf, handlerScope } = bindKernel(policy, options, "express", toRequest);
+	const { kernel, bind, rebind, scopeOf, handlerScope, guard: runGuard } = bindKernel(policy, options, "express", toRequest);
 	const permdock = () => (req, res, next) => {
 		respond(req, res, next, async () => {
 			decorate(req, await kernel.permdock(bind(req), await scopeOf(req)));
@@ -41,7 +42,7 @@ function createPermDock(policy, options) {
 	};
 	const protect = (permission, loadData, protectOptions) => (req, res, next) => {
 		respond(req, res, next, async () => {
-			const guard = await kernel.protect(permission, loadData === void 0 ? void 0 : () => loadData(req), protectOptions)(bind(req), await scopeOf(req));
+			const guard = await runGuard(permission, loadData, req, protectOptions);
 			if (!guard.ok) {
 				await sendResponse(res, guard.response);
 				return;

package/dist/fastify/index.d.ts

@@ -1,7 +1,7 @@
-import { C as Policy, D as PolicyVocabulary, Nr as Principal, ln as PermDock } from "../policy-IB6yxpC3.js";
-import { f as Permission } from "../permissions-DttnqqxC.js";
-import { h as InvalidSignatureError, i as ProtectOptions, n as OpenApiHooks, w as verifyWebBotAuth, x as discoverViaSignatureAgent } from "../create-B1d519XK.js";
-import { t as ServerAdapterOptions } from "../bind-C_ob3LKa.js";
+import { E as Policy, Or as Principal, j as PolicyVocabulary, jt as PermDock } from "../policy-types-sp9P1iIV.js";
+import { d as Permission } from "../permission-types-Dg39z9Kv.js";
+import { C as verifyWebBotAuth, b as discoverViaSignatureAgent, i as OpenApiHooks, m as InvalidSignatureError, o as ProtectOptions } from "../server-types-DdqBwZN_.js";
+import { t as ServerAdapterOptions } from "../bind-BzqG8SMb.js";
 import { FastifyPluginAsync, FastifyReply, FastifyRequest, FastifySchema, FastifyTypeProvider, FastifyTypeProviderDefault, RawRequestDefaultExpression, RawServerDefault, RouteGenericInterface } from "fastify";
 //#region src/fastify/create.d.ts
 type FastifyPermDockOptions<TUser = unknown> = ServerAdapterOptions<FastifyRequest, TUser>;
@@ -26,8 +26,18 @@ type FastifyPermDock<V extends PolicyVocabulary = PolicyVocabulary> = {
 };
 export declare function createPermDock<TUser, TPrincipal extends Principal = Principal, V extends PolicyVocabulary = PolicyVocabulary>(policy: Policy<TUser, TPrincipal, V>, options: FastifyPermDockOptions<TUser>): FastifyPermDock<V>;
 //#endregion
+//#region src/server/http.d.ts
+/** A Fastify-style reply: `code`, `header` and `send`. */
+type ReplyLike = {
+  code(status: number): unknown;
+  header(key: string, value: string): unknown;
+  send(body: string): unknown;
+};
+/** Writes `response` to a Fastify-style reply. */
+declare function writeReply(reply: ReplyLike, response: Response): Promise<void>;
+//#endregion
 //#region src/fastify/http.d.ts
 export declare function toRequest(request: FastifyRequest): Request;
-export declare function sendReply(reply: FastifyReply, response: Response): Promise<void>;
+export declare const sendReply: typeof writeReply;
 //#endregion
 export { type FastifyPermDock, type FastifyPermDockOptions, type FastifyProtect, InvalidSignatureError, type PermDockRequest, discoverViaSignatureAgent, verifyWebBotAuth };

package/dist/fastify/index.js

@@ -1,33 +1,13 @@
-import { i as parsedBody, r as headersFrom, t as firstHeader } from "../http-SO7qGttf.js";
-import { i as discoverViaSignatureAgent, r as InvalidSignatureError, s as verifyWebBotAuth } from "../evaluations-tz6D9A2G.js";
-import { t as problemFromError } from "../map-error-pgUWNNtG.js";
-import { i as decorate, r as bindKernel } from "../bind-CuzGytRf.js";
+import { c as writeReply, i as headersFrom, n as firstHeader, r as hasCredentials, t as fetchRequest } from "../http-BBoKefeS.js";
+import { i as discoverViaSignatureAgent, r as InvalidSignatureError, s as verifyWebBotAuth } from "../evaluations-C9YJsv3H.js";
+import { t as problemFromError } from "../map-error-BE27PYkE.js";
+import { i as decorate, r as bindKernel } from "../bind-kk-uyCwH.js";
 //#region src/fastify/http.ts
 function toRequest(request) {
 	const host = firstHeader(request.headers.host) ?? "localhost";
-	const url = `${request.protocol}://${host}${request.url}`;
-	const headers = headersFrom(request.headers);
-	const method = request.method;
-	if (method === "GET" || method === "HEAD") return new Request(url, {
-		method,
-		headers
-	});
-	const body = parsedBody(request.body, headers);
-	if (body === void 0) return new Request(url, {
-		method,
-		headers
-	});
-	return new Request(url, {
-		method,
-		headers,
-		body
-	});
-}
-async function sendReply(reply, response) {
-	reply.code(response.status);
-	for (const [key, value] of response.headers.entries()) reply.header(key, value);
-	await reply.send(await response.text());
+	return fetchRequest(`${request.protocol}://${host}${request.url}`, request.method, headersFrom(request.headers), request.body);
 }
+const sendReply = writeReply;
 //#endregion
 //#region src/fastify/create.ts
 const SKIP_OVERRIDE = Symbol.for("skip-override");
@@ -41,7 +21,7 @@ function skipped(request) {
 	return typeof config === "object" && config !== null && Reflect.get(config, "permdock") === false;
 }
 function createPermDock(policy, options) {
-	const { kernel, bind, rebind, scopeOf, handlerScope } = bindKernel(policy, options, "fastify", toRequest);
+	const { kernel, bind, rebind, scopeOf, handlerScope, guard: runGuard } = bindKernel(policy, options, "fastify", toRequest);
 	const permdock = breakEncapsulation((app) => {
 		app.decorateRequest("permdock", null);
 		app.decorateRequest("permdockData", null);
@@ -51,7 +31,7 @@ function createPermDock(policy, options) {
 		});
 		const previous = app.errorHandler;
 		app.setErrorHandler(async function permdockErrors(err, request, reply) {
-			const problem = problemFromError(err, { credentials: request.headers.authorization !== void 0 });
+			const problem = problemFromError(err, { credentials: hasCredentials(request) });
 			if (problem === void 0) {
 				await previous.call(this, err, request, reply);
 				return;
@@ -62,7 +42,7 @@ function createPermDock(policy, options) {
 	});
 	const protect = (permission, loadData, protectOptions) => async (request, reply) => {
 		const plain = request;
-		const guard = await kernel.protect(permission, loadData === void 0 ? void 0 : () => loadData(request), protectOptions)(bind(plain), await scopeOf(plain));
+		const guard = await runGuard(permission, loadData === void 0 ? void 0 : () => loadData(request), plain, protectOptions);
 		if (!guard.ok) {
 			await sendReply(reply, guard.response);
 			return;